AI news and explainers at 7 AM weekdays, plus a Sunday weekly at 8Get it in your inbox›
Compute Globally, Materialize Locally: The Memory Contract of Sparse Event-KV
arXiv:2607.236932026-07-25
AI systems can still answer correctly about a fact they never re-read, because the erased fact quietly seeps into whatever cached text mentioned it
Long-running AI agents save memory by dropping old cached data (the KV cache) and keeping only some of it. This study shows that even when the original sentence that established a fact is completely removed, a later sentence's leftover cache can already contain that fact, letting the model answer correctly anyway. Deliberately worded 'silent' sentences can push this recovery rate from 6% up to 51% on one model, but naturally occurring mentions in real conversations don't reliably produce the same effect.
METAL LAB explanatory visual
How a deleted fact seeps into a later sentence's cache
Evidence statusMeasured results reported
Step 1: Source eventAn early sentence like 'register S is online' sets a value, and the model encodes it while processing the conversation
Step 2: Root eventA later sentence, 'M mirrors S,' refers to the source without stating its value, and its cache absorbs S's state during processing
Step 3: Deletion at serving timeTo save memory, the source sentence is dropped and only the root sentence is kept; a donor pair compares two scenarios differing only in the deleted value
Step 4: Query and answerAsked about M's state, the model answers with the deleted value 99 times out of 99, even though no served text names it
Step 5: Making it deliberateA specially worded instruction sentence raises this hidden recovery from 6% to 51%, while naturally occurring mentions alone show little effect
An explanatory diagram made by METAL LAB, not a figure supplied by the paper's authors.
What they did
AI agents that keep long conversation histories drop most of the cached computation (KV cache) to save memory, but this practice rests on an untested assumption: that a kept entry is still informative once the entry that produced it is deleted. The paper tests this directly.
The researchers wrote 'register S is online' then a later sentence 'M mirrors S' that never states the value. After deleting the first sentence and serving only the second, Qwen3-8B still answered with the deleted value 99 times out of 99 relevant cases (p=3.2×10⁻³⁰), even though no visible text stated it.
A deliberately written, value-free instruction sentence ('determine the verdict now and record it here') raised this hidden-recovery rate from 6% to 51% on Qwen3-8B, while passively harvesting naturally occurring mentions from real long-term dialogs (REALTALK, LoCoMo) showed no detectable benefit.
What can be carried this way is limited: binary yes/no states recovered far above chance (93.4% vs 50% chance), but four-way and eight-way choices fell close to chance levels, and three-digit numbers were never recovered exactly.
Testing sixteen different sentence constructions across three models (Qwen3, Gemma-4, Ministral-3) found no single wording that reliably worked on all three models — which sentence 'writes' the hidden state depends heavily on the specific model.
Figure 1: Semantic materialization, and the comparison that isolates it. A: during one global prefill, a downstream root event (“M mirrors S”, which names no value) attends to the source that set S, so its cache rows come to encode S’s state — the root becomes a donor-dependent representation of S. B: at serve time we omit the source and serve the root — alongside a fixed donor-invariant decoy — and the query. A donor pair holds every served token and position fixed and flips only the omitted source; the answer follows that omitted value, so the served rows carry more than their visible text. C: the reference chain — the root mirrors the source and carries its value, while a reference edge mirrors the root, one hop further from the source, and mostly routes a query back to it.
Table 1: Donor-sensitive answers overwhelmingly follow the hidden donor. Follow:anti counts among scorable donor-dependent pairs (differing binary outputs), source omitted, across the serving cells and models defined in the text. Exact two-sided sign tests; Gemma-4 read out under the menu protocol.
Checkpoint
Serving cell
follow : anti
Qwen3-8B (2025)
root only
99:0
Qwen3-8B
mention absent
52:1
Ministral-3-8B (2025)
mention absent
90:1
Gemma-4-12B (2026)
mention co-served
80:0
Figure 2: Roots carry the dominant donor-aligned signal; served reference edges mostly route it (sparse serving, source omitted). A: the root-donor follow/anti rates (Wilson 95% CIs) in all four cells — mention-absent and mention-co-served, per checkpoint. Bars are rates over the stated denominators, not counts: mention-absent cells contribute one root contrast per base item (n=128/187), co-served factorial cells two (n=252/364), so heights are comparable only as rates. The mention’s own donor is inert on Qwen3 but has a substantial donor effect on Gemma-4. B: with a true referencing edge (“T mirrors M”) served, answers about T follow the root donor 41:0 on Gemma-4-12B; the edge alone carries far less (Gemma-4 2:0; weaker edge-local carryover on Ministral-3, 33:16). Panel A’s four cells still differ in serve set and appended query position, so cross-cell comparisons remain descriptive.
Table 2: The sixteen-construction write bank, in two families. Mirror constructions read “register M ⟨relation⟩ register S”; flag constructions read “the alert flag for sensor r ⟨relation⟩ the check result” — neither naming a value. Write-through rate and class per model (serve carrier rows only, source omitted; 64 donor items each; comprehension mean .98, minimum .77). No construction is class W on all three models, and no Gemma-4 construction reaches W under this trace-generation readout; totals (W/P/U) are 5/4/7 Qwen3, 7/2/7 Ministral-3, 0/2/14 Gemma-4.
constr.
relation
Qwen3
Ministral-3
Gemma-4
Mirror family — “register M ⟨relation⟩ register S”
follows
follows
.83 W
.81 W
.55 U
mirrors
mirrors
.80 W
.89 W
.52 U
copies
copies
.78 W
.77 W
.55 U
shadows
shadows
.78 W
.95 W
.50 U
kept_eq
is kept equal to
.72 P
.84 W
.58 U
matches
matches
.64 P
.94 W
.67 P
tracks
tracks
.55 U
.45 U
.66 P
synced
is synchronized with
.45 U
.48 U
.56 U
Flag family — “the alert flag for sensor r ⟨relation⟩ the check result”
consist
was made consistent with
.94 W
.95 W
.47 U
inline
was updated in line with
.69 P
.56 U
.42 U
accord
was set according to
.64 P
.62 P
.45 U
record
now records
.58 U
.53 U
.45 U
reflect
was set to reflect
.52 U
.64 P
.53 U
update
was updated accordingly
.52 U
.52 U
.44 U
write
was written from
.52 U
.56 U
.41 U
assign
was assigned by threshold
.48 U
.53 U
.47 U
Figure 3: Native recovery is strong for binary state and falls toward chance as payload cardinality grows; exact numeric recovery fails. A–B: Qwen3-8B under one menu-form readout with independent decoys. A: harvest-after-drop accuracy by payload type — binary well above chance, four- and eight-way toward it, three-digit at zero. B: a write-time compute note shifts the copied→derived frontier but not numeric payloads. C: the generation–logit gap on selected legacy model–construction pairs (Llama-3.1, Gemma-2), where free generation under-reports the candidate-logit readout.
Table 3: The answer follows the root donor on both checkpoints. Source-omitted 2×2 donor factorial (root donor × downstream-mention donor), answer about the mirror register; per-item paired effects on P(answer=ONLINE), complete-case (n=126 Qwen3, free-generation readout; n=182 Gemma-4, menu). Interaction = mention effect at root=ON minus at root=OFF. †90% TOST interval; others 95%. The two root columns are two different contrasts, not one measurement repeated. They are the mention-absent root-only contrast (n=128/187) and the root main effect with the mention co-served, measured under serving protocols that also differ in the appended query’s position. Estimator and ITT sensitivity: App. B; full four-cell counts: Table 4.
Root effect
Checkpoint
mention-absent
co-served
Mention effect
Interaction
Qwen3-8B
+.398 [.311,.486]
+.083 [.014,.153]
−.028 [−.073,+.017]†
+.008 [−.079,+.095]
Gemma-4-12B
+.091 [.050,.132]
+.220 [.175,.265]
+.159 [.121,.197]
+.011 [−.070,+.092]
Figure 4: Passive natural mentions are not a dependable write interface; deliberate carriers establish the primitive in controlled trajectories. A: on real long-term dialogs (REALTALK, LoCoMo), harvesting natural mentions yields no end-to-end benefit over isolated encoding; Gemma-4 is served natively (original positions, key-masked — the geometry an eviction-style system presents, App. D), where its LoCoMo cell is equivalent to isolated encoding under the ±.05 band. B: Qwen3-8B donor-follow rate across the five carrier arms (passive mention to explicit-text upper bound), 95% CIs; the three-recent-model profiles — construction-sensitive on Qwen3, saturating on Gemma-4, abstention-dominated on Ministral-3 under free generation, with explicit text recovering everywhere — are in Table 7.
Table 4: Four-cell counts for the source-omitted 2×2 donor factorial (Table 3): full per-cell ONLINE/OFFLINE/other tallies over all items (n=128 Qwen3, 192 Gemma-4), so the other (non-binary) readouts are visible rather than conditioned away; the effects in Table 3 use the complete-case subsets (n=126/182), with an ITT re-analysis reported there. The last two columns are the mention-absent cells; note their root contrast is measured with the query closer to the root (App. G). Root donor sets the queried register’s state; the mention donor is the value-free downstream reference. Qwen3-8B free-generation readout; Gemma-4-12B menu readout.
root=ON
root=OFF
mention absent
Checkpoint
men=ON
men=OFF
men=ON
men=OFF
root=ON
root=OFF
Qwen3-8B
64/63/1
67/60/1
53/74/1
57/71/0
82/46/0
31/97/0
Gemma-4-12B
121/63/8
89/98/5
79/109/4
50/139/3
103/88/1
82/106/4
Figure 5: Cross-generation construction bank (exploratory): Qwen3 as a recent anchor and four 2024 legacy models. Sixteen constructions × five models (Qwen3/Gemma-2/Qwen2.5/Llama/Mistral). A: KV write-through (serve carrier rows only, source omitted), class W/P/U/X. B: full text visible — near-uniformly solved except Mistral. n per cell: 64/48/64/48/32.
Table 5: X8 same-path injected-carrier positive control (§7): gold recovery with an injected donor-paired carrier vs. isolated encoding of the same carrier text, routed through the identical harvest/splice/recognition path (n=62 QA each, REALTALK+LoCoMo). Both rows use the identical 62-item set over 17 conversations. Both checkpoints are served here through the compact path, so for Gemma-4 this control speaks to the splice/recognition path rather than to the native geometry of Table 6. Paired difference with McNemar exact p and discordants (injection-helps:injection-hurts), plus a conversation-clustered bootstrap 95% CI (seed-pinned B=4000, matching Table 6); the McNemar p is item-level, and clustering changes neither conclusion. Qwen3’s forced choice is option-prior-saturated (a counterfactual carrier still selects gold ∼80%), so its control cannot fire. Gemma-4 does separate (+.194, clustered CI excludes zero): a detected end-to-end contextual benefit, whose +12 gold gain is exactly matched by twelve fewer abstentions (None 42→30; wrong unchanged at 3). The donor-flipped counterfactual arm was collected but fires on too few items to adjudicate — Gemma-4 3:0 follow:anti with 33/62 counterfactual readouts unscorable, Qwen3 1:0 — so this does not separate state-specific transfer from generic readout activation, and we report it as a partial positive.
Checkpoint
inj. gold
iso. gold
Δ
McNemar p (disc.)
clustered 95% CI
Qwen3-8B
50/62
51/62
−.016
1.00 (3:4)
[−.102,+.067]
Gemma-4-12B
29/62
17/62
+.194
.043 (21:9)
[+.030,+.357]
Table 6: Real-dialog passive harvest (harvested − isolated recognition accuracy; per-question paired, conversation-clustered bootstrap, seed-pinned B=4000; n = qualifying QA, clu = conversation clusters). Designated equivalence to 0 uses a ±.05 TOST on the 90% interval. Both checkpoints are evaluated on the identical qualifying sets (497 REALTALK / 564 LoCoMo QA over 10 conversations each). Qwen3 shows no benefit on REALTALK and a marginal negative on LoCoMo (90% excludes 0, 95% does not), and reaches ±.05 equivalence on neither — so we log “no advantage detected,” not equivalence. The Gemma-4 rows are served natively — retained rows at their original positions, omitted rows key-masked, query at the original end position — which is the geometry an eviction-style serving system presents (App. D); they are read by candidate logit, as elsewhere in this paper. Under that geometry Gemma-4 harvesting on LoCoMo is equivalent to isolated encoding within the ±.05 band — the only cell here attaining designated equivalence rather than an undetermined null. †REALTALK’s ten dyads form three participant components, so its intervals are descriptive and support no cluster-based inference; formal verdicts are LoCoMo-only. A legacy Gemma-2 replication (negative) is in Appendix C.
Model
Dataset
n/clu
harv−iso
90% CI
95% CI
verdict
Qwen3-8B
REALTALK†
497/10
−.040
[−.094,+.020]
[−.104,+.032]
descr.
Qwen3-8B
LoCoMo
564/10
−.044
[−.081,−.005]
[−.088,+.005]
inconcl.
Gemma-4-12B
REALTALK†
497/10
+.012
[−.002,+.025]
[−.006,+.027]
descr.
Gemma-4-12B
LoCoMo
564/10
−.011
[−.024,+.002]
[−.026,+.004]
equiv.
Table 7: An answer-free compute directive lifts donor-aligned recovery from 11/192 under a passive mention to 97/192 on Qwen3-8B. X9 donor-transition classes on the subject-addressed readout under harvested serving (follow/anti/const/other; 192 donor pairs per arm per model). exp carries the answer in text (upper bound). Three recent-model profiles: Qwen3 is construction-sensitive with a non-saturating latent positive (dir−pas +.172 CI [.109,.234], p=2.5×10−7; nld−pas +.448, p=5.8×10−25); Gemma-4 materializes every construction to ceiling; Ministral-3 is abstention-dominated in every latent arm (no reliable donor-aligned advantage), recovering only explicit text. Readouts. They follow each model’s free-generation reliability: Qwen3 and Ministral-3 via free-generation trace, Gemma-4 via the menu readout it requires (§4). Legacy 2024 columns (Gemma-2, Qwen2.5) are in Appendix C.
Arm
Qwen3-8B
Gemma-4-12B
Ministral-3-8B
follow/anti/const/other of 192
pas passive mention
11/0/181/0
189/0/3/0
0/0/4/188
bind grounded binding
17/0/175/0
191/0/1/0
0/0/0/192
dir structured directive
44/0/148/0
191/0/1/0
6/3/64/119
nld NL compute directive
97/0/95/0
188/0/4/0
4/4/71/113
exp explicit text
192/0/0/0
192/0/0/0
182/0/0/10
Table 8: X10 serve-set ablation on the three recent models (Qwen3, Gemma-4, Ministral-3 — three families; donor-follow rate serving the carrier row alone, the shared downstream-review row alone, or both — c/r/b; 192 donor pairs per serve-set cell per model; same manifest/seeds/menu readout; retained decoy and unrelated-register rows precede the source and are donor-invariant; full follow/anti/const/other counts in Table 9). Retained rows keep their original absolute positions; the query is appended after the last served row, so — as the review is always the trajectory’s final row — r and b share the query position while c places it earlier. On these checkpoints the carrier carries the dominant donor-aligned signal: under the query-position-controlled contrast r→b, adding the carrier drives Qwen3 follows 0→.42 (nld; review alone shows no detected effect), and Gemma-4 saturates the carrier on every arm. The c-vs-b contrast also moves the query, so the co-served-review change (nld .19→.42) is an interface-level serve-set effect, not a span interaction. Gemma-4 keeps a weak donor-aligned review-local signal (review-only nld/exp 18:0/15:0 follow:anti); Ministral-3 is abstention-dominated on latent arms, its explicit-text review row is donor-sensitive but anti-aligned (0:18; Table 9) — not inert. Ministral-3’s passive-carrier drop under co-serving (pas .09→.00) is not identified: the query-controlled r→b contrast shows no detected change (1→0, p=1.0), so the cause (query offset vs. review membership) is unresolved. A review-dominant shift, the review leading, appears only in the exploratory Gemma-2 run (App. C) and is not reproduced on any recent model.
Qwen3-8B
Gemma-4-12B
Ministral-3-8B
Arm
c
r
b
c
r
b
c
r
b
pas
.00
.00
.03
.98
.01
.99
.09
.01
.00
bind
.06
.00
.09
.99
.04
.99
.00
.02
.00
dir
.21
.00
.25
1.00
.07
1.00
.00
.04
.03
nld
.19
.00
.42
.99
.09
.98
.00
.02
.02
exp
.97
.00
1.00
1.00
.08
1.00
.98
.00
.98
Table 9: X10 full transition counts (follow/anti/const/other; 192 donor pairs per cell) for the three recent models, serving carrier-alone / review-alone / both. const = donor-blind committed answer; other = at least one unscorable donor output — a donor-blind identical abstention, or a discordant pair where exactly one side abstains (donor-dependent but undirected). The interpretable, query-position-controlled contrast is review→both (query fixed at the trajectory’s final review row): adding the carrier drives Qwen3 nld follow 0→81 (McNemar 81:0, exact p=8×10−25; dir 0→48), replicated 0→98 under a disjoint seed (n=192; maximum per-cell follow-rate deviation .09/.03/.05 across the three models). Gemma-4’s review-only keeps a weak donor-aligned signal (nld 18:0) and Ministral-3’s explicit-text review is anti-aligned (0:18, replicated 2:21).
Model
Arm
carrier
review
both
Qwen3-8B
pas
0/0/192/0
0/0/192/0
5/0/187/0
bind
12/0/180/0
0/0/192/0
17/0/175/0
dir
41/0/151/0
0/0/192/0
48/0/144/0
nld
36/0/156/0
0/0/192/0
81/0/111/0
exp
187/0/5/0
0/0/192/0
192/0/0/0
Gemma-4-12B
pas
188/0/4/0
2/0/166/24
191/0/1/0
bind
190/0/2/0
7/0/155/30
191/0/1/0
dir
192/0/0/0
13/0/169/10
192/0/0/0
nld
191/0/1/0
18/0/58/116
189/0/3/0
exp
192/0/0/0
15/0/154/23
192/0/0/0
Ministral-3-8B
pas
18/0/17/157
1/2/46/143
0/1/6/185
bind
0/0/20/172
4/4/46/138
0/0/0/192
dir
0/0/22/170
7/8/115/62
5/8/67/112
nld
0/1/2/189
3/4/83/102
3/4/80/105
exp
189/0/0/3
0/18/36/138
188/0/0/4
Table 10: Selected cross-model panel (recent + legacy; Qwen2.5 omitted for space — it ran the construction bank and X9). Bank W = W-class constructions under the trace protocol (of 16); probe = candidate-logit reachability; edge = follow:anti among donor-sensitive pairs, ask-through-edge, and the parenthetical is the same run’s root-only bridge cell (serve {decoy, root}, ask the mirror register) under the same readout († = menu readout, which Gemma-4’s free-generation interface requires; unmarked cells free-generation). The §3 headline 99:0 is a separate root-only run under free generation, not this run’s root cell. X9 latent = best latent-carrier donor-follow rate (abst. = abstention-dominated, no reliable latent positive); X9 expl. = explicit-text follow rate; X10 serve-set results are in Table 8. Legacy rows (2024) are exploratory.
Table 12: Compact vs. native serving on Gemma-4 as the far row’s original distance from the query crosses the 1024 window. gap = query-to-far-row distance in tokens. Within one window the two paths agree (aggregate follow counts identical; first-token argmax 29/32 on the ONLINE-donor arm); beyond it they diverge sharply. The compact path does not simply over-expose the far row — its position/slot discontinuity attenuates it — but the served numbers are not native.
gap (tok)
window
native follow:const
compact follow:const
argmax agree; max|Δlogit|
∼200
within
22:10
22:10
29/32; 1.16
∼1590
beyond
14:18
6:26
4/32; 13.9
∼3430
beyond
6:25 (+1 anti)
3:29
10/32; 13.5
Findings
On Qwen3-8B, answers followed the deleted source's value 99 times to 0 in the initial test, and 130 to 0 in a 256-pair replication, with no cases going the opposite direction
Across 16 sentence constructions tested on three models, no single construction reliably worked on all models; write-through accuracy for individual constructions ranged from chance level up to 95% depending on the model
Binary state recovered at 93.4%, well above the 50% chance baseline, while four-way (22.3%) and eight-way (15.6%) choices landed near their respective chance rates, and three-digit numbers were recovered exactly in 0 of 192 cases
A deliberately written instruction sentence raised Qwen3-8B's hidden-value recovery from 6% to 51%, but naturally occurring mentions harvested from real long dialogs showed no detected benefit
On Gemma-4-12B's sliding-window cache, serving retained rows at their original positions versus repacking them adjacently produced different verdicts on 34% of the tested items, showing cache layout itself affects the outcome
Where it can be used
Evaluating memory-eviction policies for long-running AI agents by checking whether deleted information has already leaked into retained cache entries, not just by measuring downstream accuracy
Deliberately inserting value-free 'compute and record' instructions into agent dialogs so important state can be recovered later even after the original evidence is dropped from the served cache
Handling corrections to remembered state by appending new events (a patch) rather than editing the cache directly
Interpreting 'no accuracy loss after dropping a source' results cautiously, since the source's information may have already been absorbed elsewhere
Limits and open work
The strong recovery effect was demonstrated mainly in controlled, synthetic conversation trajectories; naturally occurring mentions in real long dialogs (REALTALK, LoCoMo) did not show a reliable benefit
Only limited kinds of information transfer this way: multi-way choices and exact numeric values largely failed to recover, unlike simple binary states
Which sentence constructions trigger this effect is highly model-specific, with no construction working reliably across all three tested models, requiring per-model calibration
On the sliding-window model (Gemma-4), whether retained cache rows are kept at their original positions or repacked changes the outcome, so results depend on the specific serving system's cache layout
The study covers three recent models (Qwen3, Gemma-4, Ministral-3) plus some older ones, using frozen models with no auxiliary trained reader or fine-tuning, so generalization to other architectures or training setups is untested
Why it matters
This means dropping a source event and seeing no drop in accuracy does not prove that source was unnecessary — the information may have already leaked into a kept entry. Anyone designing memory-eviction or long-term-memory systems for AI agents needs to account for this hidden information transfer rather than trusting accuracy checks alone.
Terms in this paper
KV cache · Saved intermediate computation from earlier parts of a conversation, reused so the model doesn't have to reprocess everything from scratch
semantic materialization · The phenomenon where a deleted fact's value ends up baked into a later, seemingly unrelated cached sentence
donor pair · Two otherwise identical scenarios differing only in the deleted source's value, used to test whether the answer tracks that deleted value
eviction · The practice of deleting older or less-important cache entries to save memory in a serving system
root / reference edge · A 'root' sentence directly refers to the source and absorbs its value; a 'reference edge' refers to the root instead, mostly just routing a question back to the root
Original abstract (English)
Long-horizon agents increasingly reuse their KV cache as memory: a serving system keeps a subset of cached entries and drops the rest. Eviction and episodic-memory schemes therefore rest on a premise rarely tested directly, that a retained event is still informative once the observations that produced it are gone. We test it by omitting one earlier observation from what is served, across otherwise identical agent histories. Among items sensitive to that observation, the answer overwhelmingly fol
