Control Under Compression: Reliability Frontiers for Tool-Using Agents

What it claims

CompressAgent compresses only the agent control context (ACC) — the persistent system-side spec of tools, arguments, policies, planning, output, and recovery rules — while leaving executable tools, schemas, validators, and environments untouched, then measures environment-verified success. Across nine independently built ACCs, 225 held-out tasks, three Qwen endpoints, six budgets, and 15,525 runs, the compression method matters as much as the budget: at 75% retained context two of four methods stay within 1.4 points of the 93.8% full-context baseline, but rankings reshuffle sharply as budgets tighten, so a single "safe compression ratio" does not transfer across methods or across ACCs.

How it works

Four compressors are compared at each budget:

• MT (mechanical truncation): keeps a token-bounded prefix.
• GLR (generic LLM rewriting): a fixed compressor rewrites to preserve tools/policies/order/recovery, forbidden from reading extracted obligations.
• SBC (section-based): deterministic weighted round-robin selecting whole semantic units (action protocol, tool, policy, planning/recovery) in source order.
• OAC (obligation-aware): a deterministic rule-based extractor maps the ACC into six obligation types with risk weights and dependency edges, then greedily solves a dependency-closed knapsack under the token budget; only OAC may read the extracted obligations.

GLR and OAC's renderer share a frozen gemma-4-12b-it compressor (temp 0, seed 20260722). Success is judged by deterministic sandboxes checking terminal state, argument semantics, and policy/protocol compliance — no LLM-as-judge; a syntactically valid call with a wrong semantic argument counts as failure. Models: qwen3.6-flash-2026-04-16, qwen3.6-35b-a3b, qwen3.7-plus-2026-05-26, all with thinking/search disabled, no native function calling, ≤10 steps.

Evidence

Success against the 93.8% full baseline (633/675):

Note MT and OAC at 75% (55.4%, 80.4%) show a large budget alone guarantees nothing. Failures surface mainly as tool-execution and action-parsing errors.

The preregistered confirmatory test underdelivered. OAC vs GLR, paired on (model, ACC, task, budget) with Holm-corrected one-sided sign-flip over nine ACCs: at 35% ∆=+19.11 points but pH=.1563; at 25% ∆=+4.44, pH=.3906 — neither significant despite the large descriptive gap, driven by high cross-ACC variance.

Cost. At 75%, GLR cut attempt-inclusive input tokens 21.6% and API cost 19.2%; SBC 19.3%/17.0%. Latency did not improve (median GLR 5.03s, SBC 4.88s vs Full 4.21s) — authors make no latency claim.

Limits

• The headline OAC-over-GLR advantage is descriptive only; the preregistered test did not reach significance, so obligation-aware selection is not confirmed to beat generic rewriting.
• Below 50% all methods degrade fast; at 25% all four cluster at 16–21%, and at 10% none exceed 11.7%. Treat sub-50% compression as high-risk.
• Reliability varies substantially per ACC — the authors explicitly reject universal compressor rankings and call for per-context qualification.
• Three specific Qwen endpoints differ in more than parameter count, so model results are robustness checks, not a scaling law. No license is stated in the fetched text; the fetched page cuts off mid-Section V-B.