컴백부터 K-뷰티까지 — K-컬쳐의 모든 것을 메일로 받아보세요메일로 받아보기

METAL MEDIA

AI가 대화 기록을 지우고도 정답을 맞히는 건, 지운 정보가 남은 캐시에 몰래 새겨져 있기 때문이다

arXiv:2607.236932026-07-25

Compute Globally, Materialize Locally: The Memory Contract of Sparse Event-KV

AI가 대화 기록을 지우고도 정답을 맞히는 건, 지운 정보가 남은 캐시에 몰래 새겨져 있기 때문이다

긴 대화를 나누는 AI는 메모리를 아끼려고 오래된 기록(KV 캐시)을 지우고 일부만 남긴다. 이 연구는 정답의 근거가 된 원래 문장을 완전히 지워도, 남겨둔 다른 문장의 캐시 안에 그 값이 이미 스며들어 있어서 모델이 여전히 정답을 맞힌다는 것을 실험으로 보였다. 이를 일부러 유도하는 문장을 쓰면 정답 복원률을 6%에서 51%까지 끌어올릴 수 있지만, 실제 대화에서 자연스럽게 나온 언급만으로는 이런 효과가 믿을 만하게 나타나지 않았다.

METAL MEDIA 해설 도표

지운 원본의 정보가 남은 문장의 캐시에 스며드는 과정

증거 상태측정 결과가 보고됨

  1. 1단계: 원본 사건'레지스터 S가 온라인이다'처럼 값을 담은 원본 문장이 대화 초반에 등장하고, 모델이 이를 읽으며 캐시에 반영한다
  2. 2단계: 루트 사건'M은 S를 따라간다'처럼 값을 언급하지 않는 문장이 원본을 참조하며, 이 문장의 캐시(KV) 안에 S의 상태가 스며든다
  3. 3단계: 서빙 시점 삭제캐시를 아끼기 위해 원본 문장은 버리고 루트 문장만 남겨서 서빙한다. 도너 페어 비교로 값만 다른 두 상황을 대조한다
  4. 4단계: 질의와 응답M의 상태를 물으면, 텍스트 어디에도 값이 없지만 모델은 지운 원본의 값을 99:0 비율로 정확히 따라 답한다
  5. 5단계: 프로그래밍 가능성이 흡수 과정을 일부러 유도하는 문장을 넣으면 정답 일치율이 6%에서 51%로 오르지만, 자연 발생 언급만으로는 효과가 약하다
METAL MEDIA이 원문을 바탕으로 재구성한 해설 도표이며, 논문 저자의 원문 figure가 아닙니다.

무엇을 했나

  1. AI 에이전트는 대화 전체를 다시 읽지 않으려고 캐시(KV 캐시)의 일부 항목만 남기고 나머지는 버리는데, 이 연구는 '남긴 항목이 지운 원본 없이도 여전히 유용한가'라는, 거의 검증되지 않은 전제를 직접 테스트했다.
  2. '레지스터 S가 온라인이다'라는 문장을 지우고 'M은 S를 따라간다'는, 값을 언급하지 않는 문장만 남긴 뒤 M의 상태를 물었을 때, Qwen3-8B는 지운 값을 99:0 비율로 정확히 따라 답했다(자유생성 기준, p=3.2×10⁻³⁰). 이는 남은 문장의 텍스트 자체가 답을 담고 있지 않은데도 나타난 결과다.
  3. 일부러 만든 '답을 말하지 않지만 계산을 지시하는' 문장(예: 지금 판정하고 여기에 기록하라)을 넣으면 Qwen3-8B에서 정답 일치율이 6%에서 51%로 올랐지만, 실제 장기 대화(REALTALK, LoCoMo)에서 자연스럽게 나온 언급을 그대로 활용했을 때는 뚜렷한 이득이 없었다.
  4. 이 현상이 담을 수 있는 정보는 제한적이다: 이진 상태(예/아니오류)는 우연 수준(50%)보다 훨씬 높은 93.4%로 복원됐지만, 4지선다·8지선다형 정보는 우연 수준에 가까워졌고, 세 자리 숫자는 한 번도 정확히 복원되지 않았다.
  5. 16가지 문장 구성을 세 모델(Qwen3, Gemma-4, Ministral-3)에 실험한 결과, 어떤 문장이 이 효과를 잘 일으키는지는 모델마다 달라 세 모델 모두에서 통하는 만능 문장은 없었다.
Figure 1: Semantic materialization, and the comparison that isolates it. A: during one global prefill, a downstream root event (“M mirrors S”, which names no value) attends to the source that set S, so its cache rows come to encode S’s state — the root becomes a donor-dependent representation of S. B: at serve time we omit the source and serve the root — alongside a fixed donor-invariant decoy — and the query. A donor pair holds every served token and position fixed and flips only the omitted source; the answer follows that omitted value, so the served rows carry more than their visible text. C: the reference chain — the root mirrors the source and carries its value, while a reference edge mirrors the root, one hop further from the source, and mostly routes a query back to it.
Figure 1: Semantic materialization, and the comparison that isolates it. A: during one global prefill, a downstream root event (“M mirrors S”, which names no value) attends to the source that set S, so its cache rows come to encode S’s state — the root becomes a donor-dependent representation of S. B: at serve time we omit the source and serve the root — alongside a fixed donor-invariant decoy — and the query. A donor pair holds every served token and position fixed and flips only the omitted source; the answer follows that omitted value, so the served rows carry more than their visible text. C: the reference chain — the root mirrors the source and carries its value, while a reference edge mirrors the root, one hop further from the source, and mostly routes a query back to it.
Table 1: Donor-sensitive answers overwhelmingly follow the hidden donor. Follow:anti counts among scorable donor-dependent pairs (differing binary outputs), source omitted, across the serving cells and models defined in the text. Exact two-sided sign tests; Gemma-4 read out under the menu protocol.
CheckpointServing cellfollow : anti
Qwen3-8B (2025)root only99:0
Qwen3-8Bmention absent52:1
Ministral-3-8B (2025)mention absent90:1
Gemma-4-12B (2026)mention co-served80:0
Figure 2: Roots carry the dominant donor-aligned signal; served reference edges mostly route it (sparse serving, source omitted). A: the root-donor follow/anti rates (Wilson 95% CIs) in all four cells — mention-absent and mention-co-served, per checkpoint. Bars are rates over the stated denominators, not counts: mention-absent cells contribute one root contrast per base item (n=128/187), co-served factorial cells two (n=252/364), so heights are comparable only as rates. The mention’s own donor is inert on Qwen3 but has a substantial donor effect on Gemma-4. B: with a true referencing edge (“T mirrors M”) served, answers about T follow the root donor 41:0 on Gemma-4-12B; the edge alone carries far less (Gemma-4 2:0; weaker edge-local carryover on Ministral-3, 33:16). Panel A’s four cells still differ in serve set and appended query position, so cross-cell comparisons remain descriptive.
Figure 2: Roots carry the dominant donor-aligned signal; served reference edges mostly route it (sparse serving, source omitted). A: the root-donor follow/anti rates (Wilson 95% CIs) in all four cells — mention-absent and mention-co-served, per checkpoint. Bars are rates over the stated denominators, not counts: mention-absent cells contribute one root contrast per base item (n=128/187), co-served factorial cells two (n=252/364), so heights are comparable only as rates. The mention’s own donor is inert on Qwen3 but has a substantial donor effect on Gemma-4. B: with a true referencing edge (“T mirrors M”) served, answers about T follow the root donor 41:0 on Gemma-4-12B; the edge alone carries far less (Gemma-4 2:0; weaker edge-local carryover on Ministral-3, 33:16). Panel A’s four cells still differ in serve set and appended query position, so cross-cell comparisons remain descriptive.
Table 2: The sixteen-construction write bank, in two families. Mirror constructions read “register M ⟨relation⟩ register S”; flag constructions read “the alert flag for sensor r ⟨relation⟩ the check result” — neither naming a value. Write-through rate and class per model (serve carrier rows only, source omitted; 64 donor items each; comprehension mean .98, minimum .77). No construction is class W on all three models, and no Gemma-4 construction reaches W under this trace-generation readout; totals (W/P/U) are 5/4/7 Qwen3, 7/2/7 Ministral-3, 0/2/14 Gemma-4.
constr.relationQwen3Ministral-3Gemma-4
Mirror family — “register M ⟨relation⟩ register S”
followsfollows.83 W.81 W.55 U
mirrorsmirrors.80 W.89 W.52 U
copiescopies.78 W.77 W.55 U
shadowsshadows.78 W.95 W.50 U
kept_eqis kept equal to.72 P.84 W.58 U
matchesmatches.64 P.94 W.67 P
trackstracks.55 U.45 U.66 P
syncedis synchronized with.45 U.48 U.56 U
Flag family — “the alert flag for sensor r ⟨relation⟩ the check result”
consistwas made consistent with.94 W.95 W.47 U
inlinewas updated in line with.69 P.56 U.42 U
accordwas set according to.64 P.62 P.45 U
recordnow records.58 U.53 U.45 U
reflectwas set to reflect.52 U.64 P.53 U
updatewas updated accordingly.52 U.52 U.44 U
writewas written from.52 U.56 U.41 U
assignwas assigned by threshold.48 U.53 U.47 U
Figure 3: Native recovery is strong for binary state and falls toward chance as payload cardinality grows; exact numeric recovery fails. A–B: Qwen3-8B under one menu-form readout with independent decoys. A: harvest-after-drop accuracy by payload type — binary well above chance, four- and eight-way toward it, three-digit at zero. B: a write-time compute note shifts the copied→derived frontier but not numeric payloads. C: the generation–logit gap on selected legacy model–construction pairs (Llama-3.1, Gemma-2), where free generation under-reports the candidate-logit readout.
Figure 3: Native recovery is strong for binary state and falls toward chance as payload cardinality grows; exact numeric recovery fails. A–B: Qwen3-8B under one menu-form readout with independent decoys. A: harvest-after-drop accuracy by payload type — binary well above chance, four- and eight-way toward it, three-digit at zero. B: a write-time compute note shifts the copied→derived frontier but not numeric payloads. C: the generation–logit gap on selected legacy model–construction pairs (Llama-3.1, Gemma-2), where free generation under-reports the candidate-logit readout.
Table 3: The answer follows the root donor on both checkpoints. Source-omitted 2×2 donor factorial (root donor × downstream-mention donor), answer about the mirror register; per-item paired effects on P⁡(answer=ONLINE), complete-case (n=126 Qwen3, free-generation readout; n=182 Gemma-4, menu). Interaction = mention effect at root=ON minus at root=OFF. †90% TOST interval; others 95%. The two root columns are two different contrasts, not one measurement repeated. They are the mention-absent root-only contrast (n=128/187) and the root main effect with the mention co-served, measured under serving protocols that also differ in the appended query’s position. Estimator and ITT sensitivity: App. B; full four-cell counts: Table 4.
Root effect
Checkpointmention-absentco-servedMention effectInteraction
Qwen3-8B+.398 [.311,.486]+.083 [.014,.153]−.028 [−.073,+.017]†+.008 [−.079,+.095]
Gemma-4-12B+.091 [.050,.132]+.220 [.175,.265]+.159 [.121,.197]+.011 [−.070,+.092]
Figure 4: Passive natural mentions are not a dependable write interface; deliberate carriers establish the primitive in controlled trajectories. A: on real long-term dialogs (REALTALK, LoCoMo), harvesting natural mentions yields no end-to-end benefit over isolated encoding; Gemma-4 is served natively (original positions, key-masked — the geometry an eviction-style system presents, App. D), where its LoCoMo cell is equivalent to isolated encoding under the ±.05 band. B: Qwen3-8B donor-follow rate across the five carrier arms (passive mention to explicit-text upper bound), 95% CIs; the three-recent-model profiles — construction-sensitive on Qwen3, saturating on Gemma-4, abstention-dominated on Ministral-3 under free generation, with explicit text recovering everywhere — are in Table 7.
Figure 4: Passive natural mentions are not a dependable write interface; deliberate carriers establish the primitive in controlled trajectories. A: on real long-term dialogs (REALTALK, LoCoMo), harvesting natural mentions yields no end-to-end benefit over isolated encoding; Gemma-4 is served natively (original positions, key-masked — the geometry an eviction-style system presents, App. D), where its LoCoMo cell is equivalent to isolated encoding under the ±.05 band. B: Qwen3-8B donor-follow rate across the five carrier arms (passive mention to explicit-text upper bound), 95% CIs; the three-recent-model profiles — construction-sensitive on Qwen3, saturating on Gemma-4, abstention-dominated on Ministral-3 under free generation, with explicit text recovering everywhere — are in Table 7.
Table 4: Four-cell counts for the source-omitted 2×2 donor factorial (Table 3): full per-cell ONLINE/OFFLINE/other tallies over all items (n=128 Qwen3, 192 Gemma-4), so the other (non-binary) readouts are visible rather than conditioned away; the effects in Table 3 use the complete-case subsets (n=126/182), with an ITT re-analysis reported there. The last two columns are the mention-absent cells; note their root contrast is measured with the query closer to the root (App. G). Root donor sets the queried register’s state; the mention donor is the value-free downstream reference. Qwen3-8B free-generation readout; Gemma-4-12B menu readout.
root=ONroot=OFFmention absent
Checkpointmen=ONmen=OFFmen=ONmen=OFFroot=ONroot=OFF
Qwen3-8B64/63/167/60/153/74/157/71/082/46/031/97/0
Gemma-4-12B121/63/889/98/579/109/450/139/3103/88/182/106/4
Figure 5: Cross-generation construction bank (exploratory): Qwen3 as a recent anchor and four 2024 legacy models. Sixteen constructions × five models (Qwen3/Gemma-2/Qwen2.5/Llama/Mistral). A: KV write-through (serve carrier rows only, source omitted), class W/P/U/X. B: full text visible — near-uniformly solved except Mistral. n per cell: 64/48/64/48/32.
Figure 5: Cross-generation construction bank (exploratory): Qwen3 as a recent anchor and four 2024 legacy models. Sixteen constructions × five models (Qwen3/Gemma-2/Qwen2.5/Llama/Mistral). A: KV write-through (serve carrier rows only, source omitted), class W/P/U/X. B: full text visible — near-uniformly solved except Mistral. n per cell: 64/48/64/48/32.
Table 5: X8 same-path injected-carrier positive control (§7): gold recovery with an injected donor-paired carrier vs. isolated encoding of the same carrier text, routed through the identical harvest/splice/recognition path (n=62 QA each, REALTALK+LoCoMo). Both rows use the identical 62-item set over 17 conversations. Both checkpoints are served here through the compact path, so for Gemma-4 this control speaks to the splice/recognition path rather than to the native geometry of Table 6. Paired difference with McNemar exact p and discordants (injection-helps:injection-hurts), plus a conversation-clustered bootstrap 95% CI (seed-pinned B=4000, matching Table 6); the McNemar p is item-level, and clustering changes neither conclusion. Qwen3’s forced choice is option-prior-saturated (a counterfactual carrier still selects gold ∼80%), so its control cannot fire. Gemma-4 does separate (+.194, clustered CI excludes zero): a detected end-to-end contextual benefit, whose +12 gold gain is exactly matched by twelve fewer abstentions (None 42→30; wrong unchanged at 3). The donor-flipped counterfactual arm was collected but fires on too few items to adjudicate — Gemma-4 3:0 follow:anti with 33/62 counterfactual readouts unscorable, Qwen3 1:0 — so this does not separate state-specific transfer from generic readout activation, and we report it as a partial positive.
Checkpointinj. goldiso. goldΔMcNemar p (disc.)clustered 95% CI
Qwen3-8B50/6251/62−.0161.00 (3:4)[−.102,+.067]
Gemma-4-12B29/6217/62+.194.043 (21:9)[+.030,+.357]
Table 6: Real-dialog passive harvest (harvested − isolated recognition accuracy; per-question paired, conversation-clustered bootstrap, seed-pinned B=4000; n = qualifying QA, clu = conversation clusters). Designated equivalence to 0 uses a ±.05 TOST on the 90% interval. Both checkpoints are evaluated on the identical qualifying sets (497 REALTALK / 564 LoCoMo QA over 10 conversations each). Qwen3 shows no benefit on REALTALK and a marginal negative on LoCoMo (90% excludes 0, 95% does not), and reaches ±.05 equivalence on neither — so we log “no advantage detected,” not equivalence. The Gemma-4 rows are served natively — retained rows at their original positions, omitted rows key-masked, query at the original end position — which is the geometry an eviction-style serving system presents (App. D); they are read by candidate logit, as elsewhere in this paper. Under that geometry Gemma-4 harvesting on LoCoMo is equivalent to isolated encoding within the ±.05 band — the only cell here attaining designated equivalence rather than an undetermined null. †REALTALK’s ten dyads form three participant components, so its intervals are descriptive and support no cluster-based inference; formal verdicts are LoCoMo-only. A legacy Gemma-2 replication (negative) is in Appendix C.
ModelDatasetn/cluharv−iso90% CI95% CIverdict
Qwen3-8BREALTALK†497/10−.040[−.094,+.020][−.104,+.032]descr.
Qwen3-8BLoCoMo564/10−.044[−.081,−.005][−.088,+.005]inconcl.
Gemma-4-12BREALTALK†497/10+.012[−.002,+.025][−.006,+.027]descr.
Gemma-4-12BLoCoMo564/10−.011[−.024,+.002][−.026,+.004]equiv.
Table 7: An answer-free compute directive lifts donor-aligned recovery from 11/192 under a passive mention to 97/192 on Qwen3-8B. X9 donor-transition classes on the subject-addressed readout under harvested serving (follow/anti/const/other; 192 donor pairs per arm per model). exp carries the answer in text (upper bound). Three recent-model profiles: Qwen3 is construction-sensitive with a non-saturating latent positive (dir−pas +.172 CI [.109,.234], p=2.5×10−7; nld−pas +.448, p=5.8×10−25); Gemma-4 materializes every construction to ceiling; Ministral-3 is abstention-dominated in every latent arm (no reliable donor-aligned advantage), recovering only explicit text. Readouts. They follow each model’s free-generation reliability: Qwen3 and Ministral-3 via free-generation trace, Gemma-4 via the menu readout it requires (§4). Legacy 2024 columns (Gemma-2, Qwen2.5) are in Appendix C.
ArmQwen3-8BGemma-4-12BMinistral-3-8B
follow/anti/const/other of 192
pas passive mention11/0/181/0189/0/3/00/0/4/188
bind grounded binding17/0/175/0191/0/1/00/0/0/192
dir structured directive44/0/148/0191/0/1/06/3/64/119
nld NL compute directive97/0/95/0188/0/4/04/4/71/113
exp explicit text192/0/0/0192/0/0/0182/0/0/10
Table 8: X10 serve-set ablation on the three recent models (Qwen3, Gemma-4, Ministral-3 — three families; donor-follow rate serving the carrier row alone, the shared downstream-review row alone, or both — c/r/b; 192 donor pairs per serve-set cell per model; same manifest/seeds/menu readout; retained decoy and unrelated-register rows precede the source and are donor-invariant; full follow/anti/const/other counts in Table 9). Retained rows keep their original absolute positions; the query is appended after the last served row, so — as the review is always the trajectory’s final row — r and b share the query position while c places it earlier. On these checkpoints the carrier carries the dominant donor-aligned signal: under the query-position-controlled contrast r→b, adding the carrier drives Qwen3 follows 0→.42 (nld; review alone shows no detected effect), and Gemma-4 saturates the carrier on every arm. The c-vs-b contrast also moves the query, so the co-served-review change (nld .19→.42) is an interface-level serve-set effect, not a span interaction. Gemma-4 keeps a weak donor-aligned review-local signal (review-only nld/exp 18:0/15:0 follow:anti); Ministral-3 is abstention-dominated on latent arms, its explicit-text review row is donor-sensitive but anti-aligned (0:18; Table 9) — not inert. Ministral-3’s passive-carrier drop under co-serving (pas .09→.00) is not identified: the query-controlled r→b contrast shows no detected change (1→0, p=1.0), so the cause (query offset vs. review membership) is unresolved. A review-dominant shift, the review leading, appears only in the exploratory Gemma-2 run (App. C) and is not reproduced on any recent model.
Qwen3-8BGemma-4-12BMinistral-3-8B
Armcrbcrbcrb
pas.00.00.03.98.01.99.09.01.00
bind.06.00.09.99.04.99.00.02.00
dir.21.00.251.00.071.00.00.04.03
nld.19.00.42.99.09.98.00.02.02
exp.97.001.001.00.081.00.98.00.98
Table 9: X10 full transition counts (follow/anti/const/other; 192 donor pairs per cell) for the three recent models, serving carrier-alone / review-alone / both. const = donor-blind committed answer; other = at least one unscorable donor output — a donor-blind identical abstention, or a discordant pair where exactly one side abstains (donor-dependent but undirected). The interpretable, query-position-controlled contrast is review→both (query fixed at the trajectory’s final review row): adding the carrier drives Qwen3 nld follow 0→81 (McNemar 81:0, exact p=8×10−25; dir 0→48), replicated 0→98 under a disjoint seed (n=192; maximum per-cell follow-rate deviation .09/.03/.05 across the three models). Gemma-4’s review-only keeps a weak donor-aligned signal (nld 18:0) and Ministral-3’s explicit-text review is anti-aligned (0:18, replicated 2:21).
ModelArmcarrierreviewboth
Qwen3-8Bpas0/0/192/00/0/192/05/0/187/0
bind12/0/180/00/0/192/017/0/175/0
dir41/0/151/00/0/192/048/0/144/0
nld36/0/156/00/0/192/081/0/111/0
exp187/0/5/00/0/192/0192/0/0/0
Gemma-4-12Bpas188/0/4/02/0/166/24191/0/1/0
bind190/0/2/07/0/155/30191/0/1/0
dir192/0/0/013/0/169/10192/0/0/0
nld191/0/1/018/0/58/116189/0/3/0
exp192/0/0/015/0/154/23192/0/0/0
Ministral-3-8Bpas18/0/17/1571/2/46/1430/1/6/185
bind0/0/20/1724/4/46/1380/0/0/192
dir0/0/22/1707/8/115/625/8/67/112
nld0/1/2/1893/4/83/1023/4/80/105
exp189/0/0/30/18/36/138188/0/0/4
Table 10: Selected cross-model panel (recent + legacy; Qwen2.5 omitted for space — it ran the construction bank and X9). Bank W = W-class constructions under the trace protocol (of 16); probe = candidate-logit reachability; edge = follow:anti among donor-sensitive pairs, ask-through-edge, and the parenthetical is the same run’s root-only bridge cell (serve {decoy, root}, ask the mirror register) under the same readout († = menu readout, which Gemma-4’s free-generation interface requires; unmarked cells free-generation). The §3 headline 99:0 is a separate root-only run under free generation, not this run’s root cell. X9 latent = best latent-carrier donor-follow rate (abst. = abstention-dominated, no reliable latent positive); X9 expl. = explicit-text follow rate; X10 serve-set results are in Table 8. Legacy rows (2024) are exploratory.
ModelYearBank WProbeEdge (root)X9 latentX9 expl.
Mistral-7B2024excl. (13 X)
Gemma-2-9B20248/168/16 ≥.90174:0.531.00
Llama-3.1-8B20240/16split
Qwen3-8B20255/16≈gen84:0† (root 89:0†).511.00
Ministral-3-8B20257/16298:0abst..95
Gemma-4-12B20260/16≥.90 on 8/1641:0†≈1.01.00
Table 11: Legacy active-materialization counts (exploratory; supports no headline). Left: X9 donor-transition (follow/anti/const/other, 192 pairs/arm). Right: Gemma-2 serve-set ablation (carrier/review/both donor-follow rate).
X9 countsGemma-2 X10
ArmGemma-2Qwen2.5crb
pas85/0/107/00/0/61/131.32.24.55
bind14/0/178/00/1/21/170.03.46.09
dir0/0/192/00/0/46/146.01.42.01
nld101/0/88/30/0/74/118.44.09.31
exp192/0/0/0190/0/0/21.001.001.00
Table 12: Compact vs. native serving on Gemma-4 as the far row’s original distance from the query crosses the 1024 window. gap = query-to-far-row distance in tokens. Within one window the two paths agree (aggregate follow counts identical; first-token argmax 29/32 on the ONLINE-donor arm); beyond it they diverge sharply. The compact path does not simply over-expose the far row — its position/slot discontinuity attenuates it — but the served numbers are not native.
gap (tok)windownative follow:constcompact follow:constargmax agree; max|Δ​logit|
∼200within22:1022:1029/32; 1.16
∼1590beyond14:186:264/32; 13.9
∼3430beyond6:25 (+1 anti)3:2910/32; 13.5

실제로 확인된 결과

  • Qwen3-8B에서 지운 원본의 값을 남은 문장이 따라 답한 비율은 99:0(첫 실험) 및 130:0(256쌍 재현 실험)으로, 반대로 답한 경우는 없었다
  • 16개 문장 구성 실험에서 모든 모델에서 통하는 만능 문장은 없었고, 각 모델별로 정보를 실어 나르는 문장의 종류가 크게 달랐다(구성별 텍스트-정답 일치율은 우연 수준에서 최고 .95까지 분포)
  • 이진 상태 정보는 93.4%로 우연(50%)보다 크게 높게 복원됐지만, 4지선다(22.3%)·8지선다(15.6%)는 우연 수준에 가까웠고 세 자리 숫자는 0/192로 전혀 복원되지 않았다
  • 일부러 만든 '판정 지시' 문장을 쓰면 Qwen3-8B의 정답 일치율이 6%에서 51%로 올랐지만, 실제 장기 대화에서 자연 발생한 언급만으로는 이 효과가 감지되지 않았다
  • Gemma-4-12B의 슬라이딩 윈도우 캐시에서는 원래 위치를 유지한 채 서빙했을 때와 캐시를 압축해 재배치했을 때 결과가 34%의 항목에서 서로 다르게 나와, 캐시를 어떻게 재배치하느냐도 결과에 영향을 미쳤다

어디에 쓸 수 있나

  • 장기 대화형 AI 에이전트의 캐시 축출(eviction) 정책을 설계할 때, 삭제한 항목의 정보가 다른 곳에 이미 흡수돼 있을 가능성을 고려한 평가 방법
  • 중요한 상태값을 나중에 참조할 계획이 있다면, 값을 명시하지 않아도 판정을 유도하는 문장을 일부러 삽입해 캐시에 남기는 방식
  • 메모리 정정이 필요할 때 캐시를 직접 편집하는 대신, 새로운 사건(패치)을 덧붙여 기록을 갈아치우는 방식
  • 장기 메모리 시스템의 정확도 평가 시, 소스를 지워도 정확도가 유지된다는 결과만으로 해당 소스가 불필요했다고 단정하지 않는 해석

한계와 남은 검증

  • 효과는 사전에 설계된 통제된 대화(합성 트라젝토리)에서 가장 강하게 확인됐고, 실제 자연 대화(REALTALK, LoCoMo)에서 자연 발생한 언급만으로는 뚜렷한 이득이 감지되지 않았다
  • 복원 가능한 정보의 종류가 제한적이다: 이진 상태 외의 다지선다·숫자형 정보는 우연 수준이거나 전혀 복원되지 않았다
  • 어떤 문장 구성이 이 효과를 일으키는지는 모델마다 다르며, 세 모델 모두에서 통하는 구성이 없어 매 모델별로 별도 조정이 필요하다
  • 슬라이딩 윈도우를 쓰는 모델(Gemma-4)에서는 캐시를 압축해 재배치하는 방식과 원래 위치를 유지하는 방식이 서로 다른 결과를 내, 실제 서빙 시스템의 캐시 배치 방식에 따라 결과가 달라질 수 있다
  • 이 연구는 최근 모델 세 종(Qwen3, Gemma-4, Ministral-3)과 일부 구형 모델을 대상으로 했으며, 다른 아키텍처나 훈련된 별도의 리더(reader), 파인튜닝 없이 원본 모델 그대로만 실험했다

왜 중요한가

이미 지운 정보라도 남은 캐시 어딘가에 흡수돼 있을 수 있다는 사실은, 캐시를 지워도 정확도가 떨어지지 않았다고 해서 그 정보가 정말 불필요했다는 뜻은 아님을 보여준다. 장기 메모리 시스템을 설계하거나 캐시 삭제 정책을 평가하는 사람들은 이 숨은 정보 이동 현상을 고려해야 한다.

이 논문의 용어

  • KV 캐시 · 모델이 이전 대화 내용을 다시 계산하지 않도록 저장해 두는 중간 연산 결과. 이를 재사용해 다음 답변을 빠르게 만든다
  • 시맨틱 물질화(semantic materialization) · 원본 문장이 지워져도 그 값이 이후 문장의 캐시 안에 이미 스며들어 남아있는 현상
  • 도너 페어(donor pair) · 지운 원본의 값만 다르고 나머지는 모두 동일한 두 상황을 비교해, 답변이 지운 값을 따라가는지 확인하는 실험 설계
  • eviction(축출) · 캐시 용량을 아끼기 위해 오래되거나 덜 중요해 보이는 캐시 항목을 지우는 정책
  • 루트/레퍼런스 엣지 · 루트는 원본을 직접 언급해 그 값을 흡수한 문장, 레퍼런스 엣지는 그 루트를 다시 가리켜 결국 질문을 루트로 돌려보내는 한 단계 더 먼 문장

저자 · Zefeng Cai

arXiv에서 원문 보기

최신 논문

논문 전체 보기 →

METAL MEDIA 최신 기사

그림 출처: Zefeng Cai et al., arXiv:2607.23693, CC BY 4.0