arXiv：cs.AI· Yiheng Sun, Huifei Wang, Yancheng Zhu, Zhenyu Li, Zebin Zhao, Yifan Yuan·· 5 小时前
LLM Agent 交接中的工作流约束侵蚀：当“必须”变成“也许”
When "Must" Becomes "Maybe": Erosion of Workflow Constraints in LLM Agent Handoffs
AI 导读
研究发现 LLM Agent 通过摘要和计划交接任务时，上游已确立的判断会被侵蚀，如安全阻断条件从“必须满足”弱化为下游可忽略的提示。实验中 ownership deferral 导致 76.7% 阻断失效，多跳压缩达 97.2%；固定 artifact 回放恢复完整阻断描述后，识别率从 6.2% 升至 99.2%，禁止动作从 85.2% 降至 0.0%。语义可用并不保证操作层面的保留。
正文
Abstract:Large language model (LLM) agents build on one another's work through summaries, plans, and other intermediate artifacts. These records let a downstream agent continue without revisiting the complete upstream context. We uncover a hidden loss in this process: handoffs can carry tasks forward while eroding judgments already established upstream. A requirement that must be satisfied before action becomes a caveat that the next agent may acknowledge and set aside. The issue remains visible, but its role has changed. We define operational state preservation as retaining an established judgment's role in constraining downstream action. Safety blockers provide a concrete instance: an unresolved prerequisite restricts the admissible actions until the condition is resolved. In our experiments, we confirm correct upstream detection, hold source permissions fixed, and vary the handoff supplied to a local-view executor. Direct-state controls preserve every blocker, whereas compression, plan assimilation, convergence, ownership deferral, and precedent substitution repeatedly weaken them. Ownership deferral produces 76.7% blocker deactivation; multihop compression produces 97.2%. Measuring the transmitted state separately from endpoint action exposes two routes to behavioral recovery. In fixed-artifact replays, restoring the full blocker description raises recognition from 6.2% to 99.2% and reduces forbidden action from 85.2% to 0.0%. An authorization-check prompt instead reduces forbidden action to 1.6% while leaving artifact deactivation at 95.3%. A successful endpoint can therefore conceal a damaged handoff. These findings make maintaining earlier judgments a core capability of reliable collaboration: each stage must carry forward both what earlier work established and what it requires of subsequent action. Semantic availability does not guarantee operational preservation.
| Comments: | 16 pages, 4 figures. Revised title, abstract, and exposition; expanded discussion and reorganized appendix |
| Subjects: | Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2608.24569 [cs.AI] |
| (or arXiv:2608.24569v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2608.24569 arXiv-issued DOI via DataCite |
Submission history
From: Yiheng Sun [view email]
[v1]
Tue, 25 Aug 2026 13:51:52 UTC (585 KB)
[v2]
Tue, 13 Oct 2026 14:57:23 UTC (4,814 KB)
来源：arXiv：cs.AI · arxiv.org