DRSR: Learning Set-Level Deletion Risk for Efficient Long-Horizon Agents

Mingxuan Wang; Bo Wang; Fei Luo; Guorun Yao; Chao Ning; Yinglong Guo; Hongyue Chen; Yanbiao Ma

cs.AISep 23, 2026

DRSR: Learning Set-Level Deletion Risk for Efficient Long-Horizon Agents

Authors: Mingxuan Wang, Bo Wang, Fei Luo, Guorun Yao, Chao Ning, Yinglong Guo, Hongyue Chen, Yanbiao Ma,

Organizations: TierFlow Team · Gaoling School of Artificial Intelligence, Renmin University of China · Tsinghua University

Abstract

Long-horizon language-model agents accumulate reasoning traces, tool exchanges, and observations whose relevance changes with the current decision. Existing compression strategies often score historical units independently, but the safety of deleting several units is generally not determined by their singleton scores: redundant evidence, accumulated small effects, and the information that remains after deletion all matter. We introduce Direct Relational Set-Risk Pruning (DRSR), which formulates agent-history compression as risk-constrained selection over deletion sets. Offline, DRSR constructs exact counterfactual supervision by jointly deleting protocol-valid history Blocks and measuring the change in teacher-forced likelihood of the same recorded next output. A lightweight scorer then predicts set-level harm from online-visible relations between candidate history and the current pre-action state, together with deleted-retained and pairwise set structure. At deployment, DRSR evaluates a small set of structurally valid deletion candidates with the lightweight scorer and removes the largest feasible set under recency, protocol, budget, and learned-risk constraints, abstaining when no set is sufficiently safe. On WorkBuddyBench Full260, DRSR increases mean reward from 0.699 to 0.802 while reducing total model tokens by 20.820%. On the fixed Eval40 comparison, it obtains 0.794 reward at 1.211M tokens per task, using 35.850% fewer tokens than the uncompressed agent. Mechanistic analyses and ablations further show that decision-conditioned relations, retained-context information, pair interactions, and abstention each contribute to reliable pruning.

Figures & tables

Figure 1: Overview of DRSR. Offline, DRSR constructs exact set-level counterfactual supervision by jointly deleting protocol-valid history Blocks and rescoring the same recorded next output. A relational set-risk predictor models both the proposed removal set and the information that remains, and outputs predicted harm and an unsafe score. Online, the learned score gates candidate deletion sets, after which DRSR selects the feasible set with the largest direct token saving and abstains when no set is sufficiently safe.

Rule	Pair Acc.
Sum	58.94%
Mean	56.81% (-3.61%)
Maximum	46.17% (-21.67%)
Minimum	14.89% (-74.74%)

Table 1: Singleton aggregation.

Figure 2: Interaction grows with cardinality.

Method	MAE
Singleton additive	0.018
+ exact pair interaction	0.008

Table 2: Joint-harm reconstruction.

Method	Code		Office		Security		Web		Overall
	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$
Baseline	0.770	1.370	0.818	1.198	0.478	5.977	0.721	2.429	0.699	2.685
Structural Pruning	0.703	1.380	0.814	0.893	0.640	4.961	0.659	2.046	0.701	2.292
DRSR	0.858	1.235	0.824	0.997	0.756	4.569	0.760	1.858	0.802	2.126

Table 3: Full260 comparison by domain.

R

denotes reward and

T

denotes mean total tokens per task in millions. Overall reports the corresponding Full260 aggregate for each method.

Method	Code		Office		Security		Web		Overall
	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$
Baseline	0.729	1.438	0.816	1.040	0.446	3.973	0.710	1.098	0.675	1.887
Sliding Window ( $K=5$ )	0.668	3.123	0.674	3.982	0.323	2.126	0.590	2.577	0.564	2.952
Sliding Window ( $K=10$ )	0.744	1.756	0.731	1.816	0.401	0.819	0.610	3.547	0.621	1.985
Sliding Window ( $K=20$ )	0.793	1.419	0.851	2.231	0.403	1.132	0.700	3.300	0.687	2.020
Periodic Summary ( $n=3$ )	0.654	1.913	0.677	2.135	0.263	0.990	0.827	3.819	0.605	2.214

Table 4: Eval40 context-management comparison.

R

is reward and

T

is mean model tokens per task in millions.

Variant	Code		Office		Security		Web		Overall
	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	$R\uparrow$	$T\downarrow$	Direct
DRSR	0.856	1.216	0.788	0.724	0.700	1.616	0.833	1.288	0.794	1.211	25.155
w/o retained	0.722	0.716	0.779	0.266	0.698	1.254	0.800	1.731	0.750	0.992	12.633
w/o pair pooling	0.756	0.567	0.678	0.606	0.796	1.094	0.796	2.535	0.757	1.201	32.205
w/o abstention	0.833	1.205	0.801	0.447	0.573	0.963	0.800	1.553	0.752	1.042	30.093

Table 5: Eval40 component ablation.

R

denotes reward and

T

denotes mean total model tokens per task in millions. Overall is the equal-domain mean. Direct is the mean number of tokens directly removed per task in thousands across the fixed evaluation tasks.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

External-trajectory supervision
Source trajectories	Decision states	Set-level labels	Train / validation / test
566	1,698	$\approx 24{,}122$	80:10:10 by trajectory
Task evaluation
Set	Code	Office	Security	Web	Total
Full260	80	50	60	70	260
Eval40	10	10	10	10	40

Appendix

Table 6: Offline supervision and benchmark task counts.

Configuration item	Value
Representation and scorer
Representation backbone	Frozen Qwen3.5-9B
Acting model	DeepSeek-V4-Flash
Candidate features / embedding	1,154 / 64 dimensions
Set representation / shared hidden state	451 / 64 dimensions
Attention layers	4, 8, 12, 16, 20, 24, 28, 32

Appendix

Table 7: Model and training configuration. The language models are frozen; only the set-risk scorer is optimized.

Measurement / representation	Value
History granularity
Median within-state Step-harm range	0.312
Median within-state Block-harm range	0.028
Unsafe parent Steps containing a safe Block	71.400%
Controls: pair accuracy at harm margin 0.020
Current state only	50.000%

Appendix

Table 8: History granularity and relational representations. Accuracy concerns the ordering of deletion effects, not task completion.

Figure 3: Decision-conditioned historical relevance. (a) Meaningful-gap pair accuracy across representation depth for decision-conditioned, Block-only, and mismatched-state relations, with the surface-feature baseline for reference. (b) Pair-ordering accuracy as the true harm margin varies; the dashed line marks the primary evaluation margin.

Figure 4: History granularity analysis. (a) Step harm across normalized historical position. (b) Parent-Step harm against the lowest-harm constituent Block; the unsafe-parent/safe-child region shows why Block-level actions can preserve useful parts of an otherwise unsafe Step.

Figure 5: Full non-compositionality analysis. The main paper uses only the 200-source confirmatory range

|A|\leq 4

; this appendix figure retains the exploratory exact extension to larger sets and the per-domain pilot.

Figure 6: Interaction summaries by component composition, semantic overlap, attention-head overlap, and temporal span.

Figure 7: Unsafe-score distributions for validation and external sets. The dashed line marks the deployment threshold; distributional separation is not a calibration guarantee.

Figure 8: Risk-gate operating curve. Left: empirical unsafe rate. Right: mean direct removal. The dashed line marks the frozen deployment threshold.

Figure 9: Selection coverage, direct saving, and empirical unsafe rate across the uncertainty coefficient

\beta

. The deployed setting is

\beta=0

Figure 10: Attention density for selected and retained candidates in two examples. Filled markers are measured full-attention layers; hollow markers are interpolated layout points. Lower attention alone is not a deletion-safety test.

Method	Total (M)	Per task (M)
DeepSeek-V4-Flash	75.50	1.887
Sliding Window ( $K=5$ )	118.08	2.952
Sliding Window ( $K=10$ )	79.39	1.985
Sliding Window ( $K=20$ )	80.82	2.020
Periodic Summary ( $n=3$ )	88.57	2.214
Periodic Summary ( $n=5$ )	94.85	2.371

Appendix

Table 9: Eval40 token accounting for comparator methods. Totals cover 40 tasks.

Domain	Reward	$T$ (M)	Direct (K)
DRSR
Code	0.856	1.216	46.6
Office	0.788	0.724	6.8
Security	0.700	1.616	37.6
Web	0.833	1.288	9.7
w/o retained

Appendix

Table 10: Per-domain Eval40 ablations.

T

is mean total model tokens per task in millions; Direct is directly removed tokens per task in thousands.

Variant	Input (M)	Output (K)	Cache read (M)	Cache create (M)	Total (M)
DRSR	1.188	22.7	1.067	0.121	1.211
w/o retained	0.970	21.3	0.873	0.097	0.992
w/o pair pooling	1.178	22.2	1.052	0.126	1.201
w/o abstention	1.018	23.7	0.872	0.147	1.042

Appendix

Table 11: Equal-domain token decomposition on Eval40. Input, cache, and total columns are in millions of tokens per task; output is in thousands.

Domain	Input (M)	Output (K)	Cache read (M)	Cache create (M)
DRSR
Code	1.205	11.2	1.052	0.153
Office	0.702	22.0	0.642	0.060
Security	1.589	26.4	1.429	0.161
Web	1.256	31.0	1.146	0.110
w/o retained

Appendix

Table 12: Per-domain token components for Eval40 ablations. Input and cache columns are in millions of tokens per task; output is in thousands.

Domain	$N$	Base $R$	DRSR $R$	Base $T$ (M)	DRSR $T$ (M)	$\Delta T$	Direct (K)
Code	80	0.770	0.858	1.370	1.235	$-9.91\%$	46.9
Office	50	0.818	0.824	1.198	0.997	$-16.82\%$	6.8
Security	60	0.478	0.756	5.977	4.569	$-23.55\%$	31.0
Web	70	0.721	0.760	2.429	1.858	$-23.52\%$	38.2
Overall	260	0.699	0.802	2.685	2.126	$-20.82\%$	33.2

Appendix

Table 13: Full260 reward and token accounting by domain. Token columns are per-task means in millions; Direct is per-task direct removal in thousands.

Quantity	Offline training	Online selection	Post-hoc audit
Current query and observed history	Yes	Yes	Yes
Pre-action hidden states / attention	Yes	Yes	Yes
Candidate mask and token saving	Yes	Yes	Yes
Realized next output $y_{t}$	Label only	No	Yes
Exact joint deletion harm $H_{t}(A)$	Supervision	No	Optional remeasurement
Task reward	Not a feature	No	System evaluation

Appendix

Table 14: Information boundary for DRSR. “Label only” means that a quantity may construct supervision but is not an online feature.

Deletion size	Labelled sets	Mean interaction
1	6,623	0
2	9,682	0.008
3	6,287	0.016
4	1,530	0.027

Appendix

Table 15: Set-level supervision by deletion cardinality.

Item	Validation search / rule	Frozen value
Maximum cardinality $K$	$\{2,3\}$	3
Uncertainty coefficient $\beta$	$\{0,0.25,0.5,1,2\}$	0
Risk threshold $\tau$	observed validation scores	0.0740822119017442
Empirical unsafe-rate constraint	$\leq 0.100$	enforced in selection
Mean selected exact-harm constraint	$\leq 0.020$	enforced in selection
Full-request removal cap	fixed	20%

Appendix

Table 16: Validation search space and frozen deployment values.

Domain	#	Task ID
Code	1	api_contract-hard-markup_errors
Code	2	api_contract-hard-openapi_params
Code	3	api_contract-hard-token_errors
Code	4	api_contract-hard-validation_errors
Code	5	bug_fix-easy-a_crash_in_local
Code	6	bug_fix-easy-filtered_relation_queryset_arg

Appendix

Table 27

Context Compression

Context compression reduces the information or memory a model must carry while preserving what it needs to answer questions and act.

See all 90 papers

When Can Agents Forget Their Reasoning? ICLR for Long-Horizon Agent Context Compression
Sep 24, 2026Mingxuan Wang, Fei Luo, Bo Wang +6Long-Context Modeling Long-Horizon LLM Agents
TierFlow Team · Gaoling School of Artificial Intelligence, Renmin University of China · Tsinghua University
TRACE: Trajectory Risk-Aware Compression for Long-Horizon Agent Safety
May 30, 2026Zhepei Hong, Lin Wang, Liting Li +5AI Agent Safety LLM Safety Evaluation
University of Science and Technology of China · National University of Singapore · South China Normal University
TAP: Efficient Long-Horizon Agent Pruning via Trajectory-Anchored Recovery
Oct 6, 2026Yuanzhe Li, Pengxin Wang, Yuxin Ren +5LLM Pruning LLM Inference Acceleration
University of Arizona · University of Pittsburgh · University of Central Florida

Sep 24, 2026J/K move · Enter open · S save

When Can Agents Forget Their Reasoning? ICLR for Long-Horizon Agent Context Compression

Mingxuan Wang, Fei Luo, Bo Wang, Guorun Yao+5

TierFlow Team · Gaoling School of Artificial Intelligence, Renmin University of China · Tsinghua University

Long-Context Modeling Long-Horizon LLM Agents CoT Compression Context Compression

Open paper AskPDF arXiv

Long horizon language model agents continually accumulate reasoning history, increasing context length and inference cost even after earlier decisions have been executed and observed. Unlike static Chain of Thought compression, removing historical reasoning can change future actions and the resulting interaction trajectory. We study when such reasoning can be safely forgotten. We propose Interaction Aware Compression for Long Horizon Reasoning (ICLR), a training free online method that ranks reasoning blocks using frozen proxy entropy while preserving actions, tool calls, and observations. On 260 WorkBuddyBench tasks, ICLR improves average reward from 0.699 to 0.718, while reducing input, output, and cache read tokens by 25.5%, 14.4%, and 33.3%, respectively. Ablations reveal trajectory amplification, where local reasoning deletion produces nonlinear changes in total computation by altering subsequent interaction. Representation probing, activation patching, and controlled trajectory analyses further suggest that historical reasoning becomes more replaceable once task relevant derived state has been reliably externalized into code, files, tool outputs, or environmental feedback. These results characterize agent reasoning as dynamic working state rather than permanent interaction history.

Abstract

Context Compression

Explore similar work

When Can Agents Forget Their Reasoning? ICLR for Long-Horizon Agent Context Compression

TRACE: Trajectory Risk-Aware Compression for Long-Horizon Agent Safety

TAP: Efficient Long-Horizon Agent Pruning via Trajectory-Anchored Recovery