When Goals Leak Across Relationships: How Cached Goal Representations Shape Cross-Client Decisions

Language-model agents often reason before they act, and the value of monitoring that reasoning depends on how it relates to their actions. We ask how an agent's actions depend on its reasoning when the correct action depends on a changing state. In a small file-system task, background events announce which file's lock has been toggled but not its new value. The agent therefore has to reconstruct the current locks from its history before it can move files safely. With Qwen3-8B and Qwen3.5-9B, we separate two roles of reasoning: generating it before each action, and retaining earlier reasoning in the prompt. Most of the reduction in lock-violating commands comes from reasoning written at the moment of action. Retaining earlier reasoning adds little to rule-following, although it helps one model complete the task. The benefit depends on what the reasoning says. Filler text, reasoning written for another history and an accurate table of the state do not reproduce it. When we give the agent reasoning written for a history that differs in one lock value, the agent acts on that reasoning even against its own history. Without reasoning, linear probes recover the state from the model's activations about as well as a text classifier recovers it from the transcript. However, decoding accuracy does not predict which interventions change the agent's actions. In this setting, the benefit of reasoning for rule-following comes mainly from generating it at each step. The state that can be decoded without reasoning is a limited guide to how the agent acts.

LLM agents can share more than text. In some systems, an agent can send a short visible message while also passing its full KV-cache state to another model. This hidden state can help the final model combine evidence from several agents, but it is also hard to inspect. A visible message may look harmless even if the hidden state has been changed. We study this problem in a multi-agent question-answering setup. Specialists each see part of the evidence, send a short commitment, and pass full KV-cache state to a coordinator. In clean runs, this latent collaboration improves over a matched text-only version. On transformed HiddenBench with Qwen3-4B, it reaches EM/F1 of 0.338/0.486, compared with 0.231/0.369 for text collaboration. Qwen3-8B and HotPotQA runs show the same direction of improvement. The problem appears when one specialist is malicious. Some false visible commitments can steer answers. More seriously, changing the hidden KV state can collapse performance even when the visible commitment still looks plausible. A verifier that checks only text misses this failure mode. Simple magnitude checks catch some obvious corruptions, but adaptive attacks can evade them while still damaging the final answer. The most reliable fix we find is not to guess whether hidden state looks normal, but to protect it in transport. We implement an HMAC-SHA256 manifest that binds the specialist, session, model, visible commitment, tensor metadata, and payload digest. It accepts all 774 honest replayed payloads and rejects all 295 recorded tampered payloads. The main lesson is that full-KV latent memory can be useful, but it should be treated as a security-sensitive object, not as ordinary internal model state.

Context managers summarize or evict old messages so agents can operate beyond a finite window. This creates a reliability problem: removing history that still shapes the model's computation may change later actions, while retaining everything defeats compression. We study plans because agents create them early and are expected to use them later, yet behavioral success alone cannot reveal whether later calls still depend on the plan exchange. We make four contributions. First, we introduce replay pairing, which holds the action-observation trajectory fixed and compares pre-action hidden states with and without the plan exchange. We show that, on Llama-3.1-70B in ALFWorld, the mean contrast across 15 sampled layers decreases 4.1x from the first post-plan action to the second; Llama-3.1-8B shows a similar 5.6x decrease. Second, we show that a simple linear model using layer-32 hidden states predicts later contrast on entirely held-out tasks better than a baseline that only knows the action-call offset (R^2 = 0.847 vs. 0.575). Third, we identify confounds that limit this measurement: the paired histories differ in length, token positions, and discourse structure, and replayed reasoning can reintroduce plan-derived text. Reasoning traces therefore require symmetric controls, and native Qwen3 shows that the Llama timing pattern is not universal. Fourth, in a separate descriptive compression test, we find pooled ALFWorld run success of 56.7% with full history and 22.0% with naive eviction; preserving or re-surfacing only the plan does not recover the gap. Replay pairing measures sensitivity to retaining an exchange, not isolated plan content or later eviction. It gives researchers a concrete audit tool and suggests that context policies should preserve broader task state, not plans alone.