长对话中禁令类安全约束会失效，而要求类却持续有效。
Omission Constraints Decay While Commission Constraints Persist in Long-Context LLM Agents
- 发现禁止性指令随上下文加深逐渐失效，而要求性指令保持稳定。
- 第5轮时遗漏合规率73%，到第16轮降至33%，但违规行为始终为0。
- 可提前重注约束恢复合规，无需重新训练，适合生产部署监控优化。
在生产环境中部署的大型语言模型智能体依赖于由操作员定义的行为策略（如系统提示中的禁止项：不泄露凭证、不外传数据、不执行未知代码等），安全评估通常假设这些策略在整个对话过程中始终有效。本文发现，禁止类约束在上下文压力下会衰减，而要求类约束则持续存在，这种不对称现象称为安全-记忆偏离（SRD）。在覆盖12个模型、8个提供商、六种对话深度的4,416次三臂因果实验中，遗漏合规率从第5轮的73%下降至第16轮的33%（Mistral Large 3，p < 10⁻³³），而违规行为始终为0%。在两个采用令牌匹配填充控制的模型中，语义内容占稀释效应的62%-100%。在每模型安全转折点（Safe Turn Depth, STD）前重新注入约束即可恢复合规，无需重新训练。生产安全策略主要由禁止性条款构成，但其失效难以被标准监控察觉，因违规信号仍正常。
原文摘要 · Abstract (English)
LLM agents deployed in production operate under operator-defined behavioral policies (system-prompt instructions such as prohibitions on credential disclosure, data exfiltration, and unauthorized output) that safety evaluations assume hold throughout a conversation. Prohibition-type constraints decay under context pressure while requirement-type constraints persist; we term this asymmetry Security-Recall Divergence (SRD). In a 4,416-trial three-arm causal study across 12 models and 8 providers at six conversation depths, omission compliance falls from 73% at turn 5 to 33% at turn 16 while commission compliance holds at 100% (Mistral Large 3, $p < 10^{-33}$). In the two models with token-matched padding controls, schema semantic content accounts for 62-100% of the dilution effect. Re-injecting constraints before the per-model Safe Turn Depth (STD) restores compliance without retraining. Production security policies consist of prohibitions such as never revealing credentials, never executing untrusted code, and never forwarding user data. Commission-type audit signals remain healthy while omission constraints have already failed, leaving the failure invisible to standard monitoring.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。