Semantic Drift in Long-Running Agent Sessions

Semantic drift in long-running agent sessions is not a quality problem that better prompting will solve. It is a structural consequence of how transformer attention distributes itself across growing context windows, and it produces behavioral divergence that standard monitoring cannot see. The good news is that the mechanics are now well enough understood to measure, and what can be measured can be contained before users notice.

Why long-running agent sessions behave differently than short ones

Practitioners routinely conflate three logically independent properties when they describe an agent session as "long." The Horizon Gap survey distinguishes them: long-horizon refers to how many steps a task requires, long-context refers to how many tokens the model attends to at once, and long-term memory refers to whether information persists across steps or sessions. Each axis piles up problems of its own, so each one needs its own instrumentation.

A session that runs for tens of turns compounds all three simultaneously. The task horizon grows, so more decisions accumulate that must remain mutually consistent. The context window fills, so earlier instructions compete with later tool outputs for the model's attention budget. And memory structures get called upon to bridge what the window can no longer hold, which introduces a second channel through which information can be lost or corrupted. The result is a system whose failure modes are categorically distinct from those of a single-turn call. Laban et al. quantified the gap in 2025: multi-turn LLM applications show a 39% performance degradation relative to single-turn settings, driven primarily by a large increase in unreliability rather than any loss in underlying aptitude. The model knows how to do the task. What degrades is its ability to keep doing it the same way as the session grows.

Outcome-only signals grow progressively less informative as horizon lengthens. A single pass/fail judgment at session end cannot tell an engineer whether the agent held its constraints for the first fifty turns and slipped on turn fifty-one, or drifted gradually from turn ten onward. Session-level health cannot be read from individual turn outputs. The problem is longitudinal by definition.

The attention mechanism that turns session length into a liability

The degradation is not a bug in any particular model. It follows from the geometry of self-attention itself. Attention over long contexts distributes itself unevenly by token position: strongest at the beginning and end of the context window, weakest in the middle. This U-shaped distribution is the now well-documented "lost-in-the-middle" effect, and it has a specific consequence for agent sessions.

System prompts sit at position zero, so they get strong attention early in a session. But as conversation history accumulates, the system prompt remains at the same absolute position while the distance between it and the most recent tokens grows. It does not move toward the end of the window. It falls into the middle, into the attention valley. The instructions that define what the agent is supposed to be doing receive progressively less effective attention weight the longer the session runs. This is a feature of the architecture, not a defect a better prompt can patch away.

The problem compounds because models are calibrated to weight recent tokens more heavily, which is useful for conversational flow but destructive for long-horizon consistency. Tool outputs, intermediate reasoning, and the agent's own prior responses all compete with the original instructions for a finite attention budget. The agent's prior outputs become a particularly insidious problem: it reasons from its own prior reasoning, so a small misalignment early in a session can amplify substantially by session end. Self-referential behavioral anchoring means that if the agent produced verbose responses early on, the conversation's implicit style baseline shifts, and subsequent outputs drift to match recent outputs rather than the original specification. Tanner formalized this in 2026: an agent specified to maintain a distinctive voice will, over a long session, gradually lose that character as the accumulated weight of context pulls it toward generic behavior. The responses remain technically adequate. They just stop sounding like the agent they were configured to be.

Three distinct types of drift that attack different layers of agent behavior

Drift is not one phenomenon. A January 2026 paper on multi-agent systems identified three distinct types and proposed a 12-dimension Agent Stability Index to measure them, formalizing what had previously been a vague complaint into an operational taxonomy. Engineers need this granularity because testing for one type does not reveal the others.

Semantic drift is the most intuitive: the agent gradually deviates from its original instructions. A refund policy applied strictly at turn three begins to loosen by turn fifteen, not because anyone changed the policy, but because the weight of recent emotional context in the conversation has overridden the earlier system prompt. The instruction is still in the context window. It just no longer carries enough attention weight to constrain behavior.

Behavioral drift is subtler. The agent develops unintended response strategies that were never present in its design: verbosity, hedging, or tool-use patterns that emerge from the interaction between learned tendencies and growing context. Nothing in the specification told the agent to become evasive or to stop using a particular tool. It drifted into those patterns anyway. The Agent Stability Index's response consistency dimension tracks whether the agent's response strategy stays stable, which is a useful operational proxy when you cannot see model internals.

Coordination drift attacks multi-agent systems. Handoff quality degrades over time: the routing agent becomes less precise about which specialist to invoke, and specialists receive increasingly garbled context summaries, even when each individual agent still performs adequately in isolation. The ASI's Inter-Agent Coordination dimension tracks metrics such as consensus agreement rate, handoff efficiency, and role adherence. The critical operational point is that these three types do not always correlate. An agent can exhibit stable semantic adherence while its behavioral strategy drifts significantly. Treating drift as a single variable produces monitoring blind spots.

The compaction cliff — how context summarization accelerates the worst kind of drift

Attention dilution degrades constraint adherence smoothly. Context compaction destroys it in a step change. Compaction, the standard practice of summarizing history when the context window fills, is supposed to buy the agent more room. Instead, it is a discrete event that erases deployment-specific constraints far faster than ordinary attention dilution does.

The ConstraintRot benchmark tested compaction across seven models and over a thousand episodes, and found that compaction raises policy violation from near-zero to a substantial fraction of runs. The decay is dramatically larger for soft organizational policies than for hard safety norms. Broad safety rules survive compaction reasonably well because they are the kind of content summarization models are trained to preserve. What gets lost are the deployment-specific behavioral guardrails, the exact instructions that differentiate one product's agent from another. A companion study identifies the mechanism: type-agnostic summarization treats a safety rule and an episodic log as competing for the same tokens at the same rate. "The patient is allergic to penicillin" gets compressed or dropped at the same rate as a routine observation about the weather.

The authors call this the Compaction Cliff, and the numbers justify the name. After one round of compaction, a majority of safety rules survive. After five rounds, only a small fraction do. The drop is not gradual. Attention dilution erodes constraints smoothly over tens of turns. Compaction produces an acute step-change in constraint adherence at the moment of summarization. This makes compaction events a natural instrumentation target. The moment a compaction runs is a predictable high-risk point that should trigger re-evaluation of the agent's constraint adherence.

Why conventional monitoring cannot see any of this happening

The monitoring gap is structural, not a matter of insufficient alert thresholds. HTTP 200 codes, latency metrics, and error rates are all orthogonal to behavioral drift. A drifted agent still completes tool calls, returns structured responses, and passes every operational metric an engineering team instruments for. The request succeeds while the agent quietly stops doing what it was configured to do.

Hafez et al. characterize the problem precisely in 2026 work on structural drift in LLM communication loops: information that should shape the next response can be dropped, compressed, or misrouted while every component still reports success. The relational structure between prompt and response decouples, but no single component observes the decoupling. Point-in-time evaluation compounds the gap. Standard eval suites test agents at short conversation lengths, typically a handful of turns, and score single-exchange quality. Drift is definitionally longitudinal. It does not appear in per-turn scoring.

The production case of a misrouting agent makes the cost concrete. The agent was wrong about one ticket in fourteen for nine days, and no dashboard alert fired. It failed by succeeding at the wrong thing: routing to the wrong queue, citing a hallucinated policy, while HTTP responses and latency remained clean. There is no mean time to detect for this class of failure, because there is no detection mechanism. Teams discover drift only through downstream business signals: a support ticket, a billing discrepancy, a customer complaint. By then the drift has been live for days.

What measurable signals actually reflect drift before qualitative degradation becomes visible

Drift becomes detectable earlier when the unit of analysis shifts from individual outputs to the relational structure between consecutive prompts and responses. Hafez et al. introduce structural communication coherence, or SCC, quantified by two metrics. Communication closure asks whether what the pipeline returns at one turn matches what it faces at the next: whether a response, after any declared transformation, is what actually reaches the following prompt. Normalized conditional action contribution measures how much a sent message resolves what the other side says next: how much a prompt shapes the response it draws, and how much that response shapes the prompt that follows.

The validation is striking. When a response is swapped for one from a different turn while surrounding prompts are left untouched, measured contribution drops by 87 to 92 percent. The metric is sensitive to the relational coupling between turns, not just to surface-level output quality. And SCC requires no labels, no healthy reference data, and no predefined rules. It is computable directly from operational traffic, which means it can run continuously without human raters. Tanner observes that qualitative evaluation is a lagging indicator: by the time degradation is visible in human ratings, it has already been present in the agent's behavior for some time. Structural metrics close that gap because they can be computed on every turn.

Two practical proxies are available in any traced system. Tool-use distribution shift tracks which tools the agent selects over the course of a session and alerts when the distribution shifts significantly, surfacing tool-selection drift before it produces visible output errors. The Horizon Gap survey notes that the field's response to uninformative outcome-only signals, in both training and evaluation, is to manufacture denser, step-level signal. The same logic applies to production monitoring: per-turn, trajectory-level diagnostics supersede pass/fail checks. Tanner's geometric framework measures behavioral richness as the number of distinct response patterns an agent produces, and it is a promising direction conceptually, though the paper itself flags that its leading-indicator promise remains empirically unconfirmed under context pressure. SCC is the stronger production candidate today.

How trace structure determines whether drift can be diagnosed at all

The ability to diagnose drift after it appears, and to use structural metrics before it does, depends entirely on whether the agent's decision trace is recorded at step level rather than only at session endpoints. Hafez et al. note that a sufficiently joined trace contains the records from which both communication closure and conditional action contribution can be computed. A trace that records only inputs and final outputs cannot support either metric.

The loan underwriting case illustrates the diagnostic cost of thin traces. After a model update, an MCP agent began returning inconsistent underwriting decisions. Without visibility into which tool responses influenced the final decision, the team could not determine whether the issue stemmed from model drift, tool timeout, or context contamination between calls. The absence of step-level trace data turned a diagnosable problem into an opaque one. Three trace-level data points are specifically load-bearing for drift detection. The full prompt at each turn, including any injected memory or retrieved context, is required for communication closure. Tool selection per turn, not just tool output, is required for tool-use distribution shift. And compaction events tagged in the trace are required to distinguish the Compaction Cliff from gradual attention dilution. Agent incidents without reasoning traces take substantially longer to resolve than those with full decision trace logging. The gap is not marginal. It is a multiple of resolution time.

Intervention strategies that address drift at its source rather than its symptoms

Containment works when it targets the three root mechanisms separately rather than applying a single generic remediation. For attention dilution, the intervention is periodic re-injection of critical constraints into the recent context window: not a verbatim repeat of the full system prompt, but a condensed version of the behavioral anchors most vulnerable to the attention valley. The timing signal can be turn count, token count, or a structural metric crossing a threshold. Any is more reliable than waiting for visible output quality to drop.

For error propagation, the intervention is trajectory-level checkpointing: evaluating the consistency of the agent's current stated reasoning against its earlier decisions at fixed intervals, rather than only evaluating the most recent turn. The Horizon Gap survey identifies trajectory-level diagnostics as the field's response to the uninformativeness of outcome-only signals, and the same principle applies in production monitoring. For compaction, the intervention is type-aware summarization that distinguishes constraint-bearing content from conversational content, treating a behavioral rule differently from a factual exchange during compression so that constraints are preserved or re-injected rather than summarized away. The Compaction Cliff finding makes the stakes clear: any compaction strategy that does not distinguish content types will systematically destroy the deployment-specific guardrails that matter most. For multi-agent coordination drift, the intervention is explicit handoff validation, checking that the context summary passed between agents preserves the goal state and constraint set, not just the factual history.

The common thread across all of these interventions is that they require understanding what the agent was supposed to do, not just what it did. A re-injection strategy that does not know which constraints matter cannot prioritize them. A compaction strategy that does not distinguish rule-bearing content from conversational content cannot preserve it. Drift containment is not a monitoring problem or a prompt-engineering problem. It is a specification problem, and it begins with the question every production agent deployment should answer before launch: what, precisely, must not change.