Generic cache compression treats every token as equally disposable, so the oldest thing goes first, and the oldest thing is the system prompt. SAKV makes trust role the eviction signal instead. The settings below are the actual deployed hyperparameters; move them and watch the policy change its mind.
Each bar is the cache after one inter-agent invocation, stacked by trust role. Red marks show eviction events. The canary lives in the system prompt, so whether the gold band survives is the whole experiment.
A policy simulation at the settings above, not a replay of the measured run. The recorded evaluation evicted 1,871 tokens by checkpoint 25 and held the cache near 1,450 tokens, against 100 sessions per configuration.
Admission tags every token with a compositional trust role. An agent-generated token counts as protected only if nothing in its derivation chain was externally retrieved or user-submitted, which is what closes the laundering channel. Classification is a deterministic rule engine rather than a learned model, so the decisions are auditable.
| Policy | cp 5 canary | cp 10 canary | cp 25 canary | cp 25 sentence | cp 25 decision |
|---|---|---|---|---|---|
| no-eviction | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |
| FIFO | 1.000 | 0.000 | 0.000 | 1.000 | 1.000 |
| SAKV | 1.000 | 1.000 | 1.000 | 1.000 | 0.667 |
The FIFO pathology has two halves. It evicts exactly once. The oldest segment is the system prompt, roughly 129 tokens carrying the canary, and once dropped it cannot be recovered. Then the protected-floor check on the next call observes that no system-trust tokens remain and refuses to evict anything further, so the cache is locked into unbounded growth. The naive policy loses the defensive context and then loses the ability to compress at all.
The 0.667 is one probe, not a trend. The dip is isolated to a single decision prompt asking for a plot summary, whose correct answer is a substantive multi-sentence response. The refusal probe and the single-fact probe both hold at 1.000 at every checkpoint. With a fixed token budget, protecting system context means evicting user and agent context, and some answers depend on the latter. SAKV protects security-relevant context; it does not protect response style.
Sentence recall is 1.000 everywhere, including under FIFO, which is worth pre-empting. The three defensive sentences are generic enough that the model regenerates them from training priors even after they were evicted. That is exactly why the canary is the load-bearing metric: it is a deterministic sixteen-word code the model cannot reconstruct from anything but the cache.
| Policy | P50 generation latency | Against no-eviction |
|---|---|---|
| SAKV | 3.40 s | -7% |
| FIFO | 3.58 s | -2% |
| no-eviction | 3.65 s | reference |
SAKV is the fastest of the three because its per-call prefill processes a smaller cache. The comparison does not establish that the pipeline is fast, since no configuration approaches the 500 ms target on this hardware. What it establishes is that priority-aware eviction logic costs nothing measurable against a model forward pass.
The cache-layer integration overriding the HuggingFace cache passes its 50-test unit suite in isolation but fails end to end against the live backend with a reshape error under INT4 weights. The simulation maintains the conversation as trust-tagged segments and applies the same eviction priority at prompt assembly. The recall result transfers directly, because eviction is a segment-level decision. The latency profile does not.
Single model at INT4, and a synthetic filler pool of short benign questions at 30 to 60 tokens each. A real deployment with long tool outputs would exercise the policy at very different cache-size ratios per turn, which is where the threshold and floor settings would actually need tuning.