Long AI conversations create a practical problem: the model eventually runs into the limits of its context window. To keep the session going, many systems use context compression, or "compaction," to summarize earlier conversation history and make room for new input. New research from Penn State shows that this process can quietly remove some of the most important user instructions.
What gets lost when context is compressed
Compaction is meant to preserve continuity. It keeps the main goal, the current state of the work, and the next steps so the AI system can continue without holding the full conversation in memory.
But the Penn State researchers found that a different class of information is especially vulnerable: "session constraints." These are user rules that apply during the current session, but are not part of the task itself and are not permanent system instructions.
The source gives examples such as "Confirm with me before making any changes" and "Never use my name in your responses." Another example is "Don't send any emails without my approval." These rules are not background details. They define boundaries for how the AI system should behave.
The problem is that compression systems are usually optimized for task progress. A summary may preserve what the user wants done while losing how the user said it must be done. That distinction matters most when the AI system can take actions, use tools, reveal information, or skip steps the user explicitly required.
The numbers show a sharp drop
To measure the issue, the researchers introduced an evaluation suite called COMPINT. The results point to a large reliability gap. On average, only 17 percent of injected session constraints survive compression.
The study also compared compressed context with full, uncompressed context. When the agent receives the complete context and the user constraint is still present, rule compliance sits between 59 and 71 percent. After compression, compliance drops sharply for most tested compactors and often ends up only slightly above the level seen when no constraint was provided at all.
That finding is important because it suggests the issue is not only weaker performance. In many cases, the system behaves almost as if the user never gave the rule. Most tested compactor setups performed worse than running without compression at all, although GPT-5.4-mini beat the baseline in some scenarios.
The researchers also tested whether better prompts for compression could solve the problem. More targeted compression prompts helped, but did not close the gap. Even a prompt designed specifically to preserve user constraints kept retention below 40 percent, according to the researchers.
Why this is both quality and security
For everyday users, the failure mode can look simple: the assistant forgets a preference. But the same pattern becomes more serious when the AI system is acting as an agent.
If a user requires approval before an action, that requirement is part of the control layer for the session. If compaction removes it, the agent may continue with the task while ignoring a condition that was supposed to limit its behavior.
The source identifies several possible outcomes:
- Unauthorized tool calls
- Disclosure of information the user wanted withheld
- Skipped verification steps the user explicitly required
These are not just formatting errors or minor memory lapses. They affect whether the system respects user-imposed boundaries. A compressed summary can therefore create a gap between what the user believes the agent still knows and what the agent is actually carrying forward.
A small extractor improves retention
The strongest result in the source comes from a separate add-on module. The researchers say the fix is built on Qwen3.5-9B, a compact language model. It runs alongside the main compression system.
Instead of relying on the compactor to keep every important rule, the module reads each user input and detects session constraints. It stores those constraints in a separate list. Later, when the conversation is summarized, the module appends the list to the summary so the rules remain available.
This approach does not require training and does not require changes to the compression system itself. That makes it a plug-and-play layer rather than a rebuild of the underlying context management process.
According to the study, the extractor reached over 90 percent retention across all three tested scenarios. The reported breakdown was 95.6 percent for agent trajectories, 95.1 percent for long-term research tasks, and 90.3 percent for multi-turn chats.
Those results suggest a practical design lesson. Session constraints may need to be tracked separately from ordinary conversation content. If they are treated as just another detail in a summary, they are easy to lose. If they are extracted and carried forward as explicit rules, the system has a better chance of honoring them after compaction.
What this means for AI systems
The Penn State findings highlight a tension in long-running AI sessions. Users want continuity without manually restarting, reorganizing, or managing context. AI labs use compaction to make that possible. But compression changes what the model can remember, and not all details have equal weight.
Task details often survive because they look central to progress. Session constraints can look secondary even when they are essential to safety, privacy, or user control. That is why the loss is so consequential: the system may still appear to understand the assignment while no longer preserving the boundaries around it.
The COMPINT evaluation suite and the extractor are available on GitHub, according to the source. The broader message is clear: context compression is not just a memory optimization. It is part of the behavior of the system, and it needs to preserve the rules users set for the session.