An agent handling two clients can retain useful shared knowledge. It can also retain an objective belonging to the wrong relationship.
An October 12 study tests a model in controlled scenarios with opposing client goals. Probes locate goal-ownership information in cached states, and targeted interventions shift decisions toward the current client more than matched random interventions. Read the research paper.
Shared memory can transfer a purpose as well as a fact
A persistent agent serving several clients may benefit from common reference information. It must still distinguish whose objective governs the current decision. Leakage is often discussed as disclosure: one client's private information appears in another client's answer. This study examines a different failure. The agent can reveal no secret and still choose an action influenced by the wrong client's goal.
The experiment uses OLMo-3-7B-Instruct in controlled two-client scenarios with opposing objectives. Its contribution is not only an observed error rate. Probes and interventions in the KV cache investigate whether relationship-specific goal representations are present and whether modifying them changes behaviour.
Swapping ownership separates goals from client labels
Twenty market-style conflict families each receive a base and a swapped assignment, so the same semantic goal appears under both ownership labels. Mechanistic experiments use eight randomised six-turn orders of client A and B interactions. This helps distinguish a preference for one substantive goal from a failure to track which client owns it.
The evaluation offers current-client-aligned, opposite-aligned and balanced choices without explicitly reminding the model of the competitor's objective. Under shared conversational memory, the authors report deviations from the current client's goal in twenty-two percent of eligible decisions. The number belongs to this constructed setting and one model, not to persistent assistants in general.
Cache interventions strengthen a narrow causal claim
Linear probes find that client-goal ownership is highly recoverable in middle layers and concentrated in particular attention heads. Recoverability alone would show that information is present, not that the model uses it. The researchers therefore ablate cached representations associated with the competitor's goal. Decisions shift toward the current client more strongly for probe-selected heads than for random heads, and more strongly for goal tokens than matched non-goal tokens.
Reversing which client's goal is ablated reverses the behavioural effect. These controls support the narrow claim that goal-derived state at the selected locations influences decisions. They do not establish that zeroing those states is a robust production solution or that the same locations govern every kind of relationship memory.
The missing boundary is ownership, not semantic opposition alone
The swap design gives each goal to both client labels across conditions. This helps rule out a simple preference for one substantive objective, such as growth over liquidity, as the entire explanation. The schematic liquidity example asks one client’s decisions to preserve access to funds and the other’s to favour longer-term growth. The problem is following the right owner’s goal at the right turn.
That ownership is explicitly supplied in the experiment. A real system may have to infer it from account state, permissions or conversational context, adding another challenge not isolated here. The study therefore identifies a mechanism worth testing, while leaving the design of reliable relationship-specific memory as an open engineering problem rather than claiming that a head-level ablation provides the finished solution.
Isolation is a behavioural requirement
The scenarios use clearly opposing goals and explicitly supplied ownership. Real assistants may face partly compatible objectives, ambiguous identities and less discrete decisions. Zero-ablation also directly modifies cached state, unlike an ordinary conversational update. Those limitations matter when translating the mechanism into engineering.
The useful deployment test is nevertheless concrete: compare shared and relationship-isolated state under conflicting objectives, measuring action selection as well as disclosure. Common factual knowledge and client-specific purposes may require different persistence rules. Sanitising visible text cannot by itself guarantee relationship separation. A cache can preserve an earlier purpose and allow it to shape a later choice, even when the final response contains nothing that looks like another client's information.
Questions, news tips or corrections? Contact [email protected].
