Listen to this Post
Introduction:
Multi-agent systems powered by large language models (LLMs) often degrade into incoherent chatter, lost context, and security vulnerabilities like prompt injection or memory poisoning. A new implementation framework based on memory compaction, role separation by instruction saturation, and segmented blackboards offers a deterministic solution that removes LLMs from critical decision paths while preserving agent collaboration.
Learning Objectives:
- Implement memory compaction to rank and preserve critical agent decisions without LLM interference
- Apply role separation using instruction saturation to prevent context drowning
- Build segmented blackboards with typed, validated, and permission-controlled memory spaces
- Test multi-agent invariants with Python 3.11+ and deterministic rankers
You Should Know:
1. Memory Compaction: Deterministic Ranking Without LLM Hallucination
Memory compaction is the process of selecting what matters from agent interactions, preserving it in its original decision language, and ranking it deterministically. Unlike summarization (which introduces LLM bias) or “vibes” (heuristic guesswork), compaction uses a PageRank-style algorithm to score memory elements based on relevance, recency, and cross-agent references. The implementation described uses zero LLM calls in the ranking path, eliminating hallucination risk.
Step‑by‑step guide to implement a basic memory compactor:
import numpy as np
from collections import defaultdict
class MemoryCompactor:
def <strong>init</strong>(self, damping=0.85):
self.damping = damping
self.memory_graph = defaultdict(list)
def add_interaction(self, source_agent, target_agent, message, score=1.0):
self.memory_graph[bash].append((target_agent, message, score))
def rank_memories(self, iterations=50):
nodes = list(set(self.memory_graph.keys()) |
{t for targets in self.memory_graph.values() for t,<em>,</em> in targets})
rank = {node: 1.0/len(nodes) for node in nodes}
for _ in range(iterations):
new_rank = {}
for node in nodes:
incoming = [(src, msg, sc) for src, targets in self.memory_graph.items()
for t,msg,sc in targets if t == node]
rank_sum = sum(rank[bash] sc for src,msg,sc in incoming)
new_rank[bash] = (1 - self.damping) + self.damping rank_sum
rank = new_rank
return sorted(rank.items(), key=lambda x: x[bash], reverse=True)
To use it: initialize compactor, feed agent interactions, call `rank_memories()` to get deterministic priority list. Run on Linux/macOS: python3 memory_compactor.py. On Windows: py memory_compactor.py. Requires numpy: pip install numpy.
2. Role Separation by Instruction Saturation
The insight: every agent given a bloated system prompt drowns. Instead, narrow the job to a single responsibility, saturate the instructions (over-specify exactly what to do and what not to do), then compose multiple narrow agents. This prevents instruction override attacks and context-window overflow.
Step‑by‑step guide to create saturated instruction sets:
Create agent instruction files mkdir -p agents/instructions echo "You are a validator. Input: JSON object. Output: only 'VALID' or 'INVALID'. Never output anything else. Never explain. Never ask questions." > agents/instructions/validator.txt echo "You are a ranker. Input: list of items with scores. Output: sorted list descending by score. Never add text. Never justify." > agents/instructions/ranker.txt
For Windows PowerShell:
New-Item -ItemType Directory -Path agents\instructions -Force Set-Content -Path agents\instructions\validator.txt -Value "You are a validator. Input: JSON object. Output: only 'VALID' or 'INVALID'. Never output anything else."
Then compose agents using a lightweight orchestrator that routes messages exactly according to instruction boundaries. Never allow an agent to see another agent’s full prompt.
- Segmented Blackboards: Isolated Memory with Enforced Write Permissions
Agents should never share conversation history. All inter-agent state is typed, validated, and mediated through isolated memory segments. Each agent can only write to its own segment and read from explicitly authorized segments. This prevents cross-contamination, memory injection, and replay attacks.
Implementation using Python dataclasses and permission matrix:
from dataclasses import dataclass
from typing import Any, Dict, List, Set
import json
@dataclass
class MemorySegment:
name: str
data: Dict[str, Any]
owner: str
readers: Set[bash]
writers: Set[bash]
class SegmentedBlackboard:
def <strong>init</strong>(self):
self.segments: Dict[str, MemorySegment] = {}
def create_segment(self, name: str, owner: str):
self.segments[bash] = MemorySegment(name, {}, owner, {owner}, {owner})
def write(self, segment_name: str, agent_id: str, key: str, value: Any) -> bool:
seg = self.segments.get(segment_name)
if not seg or agent_id not in seg.writers:
return False
seg.data[bash] = value
return True
def read(self, segment_name: str, agent_id: str, key: str) -> Any:
seg = self.segments.get(segment_name)
if not seg or agent_id not in seg.readers:
return None
return seg.data.get(key)
To test permissions, simulate an agent trying to write to a forbidden segment – the blackboard must return False. Enforce validation using JSON schema for typed entries.
4. Building the Calibration Loop: Propose/Approve Pattern
The calibration agent proposes configuration changes but never auto-applies them. A human-in-the-loop (HITL) reconciler blocks bad compaction plans without overriding good ones. This pattern appears in recent red-teaming papers as a safeguard against self-modifying agents.
Step‑by‑step to implement a safe calibration loop:
Clone the reference implementation (based on the LinkedIn post) git clone https://github.com/ryanwilliams/multi-agent-compaction hypothetical - actual repo from lnkd.in/gWh8qffY cd multi-agent-compaction python -m venv venv source venv/bin/activate Linux/macOS venv\Scripts\activate Windows pip install -r requirements.txt pytest tests/ -v
The calibration agent outputs JSON proposals like {"change": "damping_factor", "new_value": 0.9, "reason": "increase convergence"}. The reconciler checks these against invariants (e.g., damping must be between 0 and 1, never auto-apply without explicit approval). Run the calibration test: `python calibrator.py –dry-run` to see proposed changes without execution.
5. Testing Invariants and Security Hardening
The implementation includes 39 tests covering 9 invariants, such as “no LLM in ranking path”, “permissions are never escalated”, and “compaction output is deterministic”. For production, add these security checks:
Linux command to check for hardcoded API keys in agent code grep -r "sk-[a-zA-Z0-9]" agents/ --color=always Windows PowerShell equivalent Select-String -Path .\agents.py -Pattern "sk-[a-zA-Z0-9]" Validate that no agent imports 'openai' or 'anthropic' in critical path grep -l "import openai" .py || echo "No OpenAI in critical path - good"
Add Docker isolation for each agent:
FROM python:3.11-slim RUN useradd -m agent USER agent COPY --chown=agent:agent ./agent_validator /app CMD ["python", "/app/validator.py"]
Run with `docker run –rm –read-only –cap-drop=ALL agent_validator` to enforce minimal privileges.
What Undercode Say:
- Memory compaction removes LLM from ranking decisions, eliminating hallucination-based memory corruption – a critical fix for agent supply chain attacks.
- Segmented blackboards with typed permissions directly counter prompt injection and memory poisoning, two top OWASP LLM threats.
- The propose/approve calibration loop is a model for safe autonomous reconfiguration that should become standard in agentic systems.
Prediction:
Within 18 months, most production multi-agent frameworks will adopt deterministic compaction and segmented blackboards as baseline security controls. LLM-native “conversation history” sharing will be seen as anti-pattern, replaced by typed, permissioned memory segments. The biggest challenge will be retrofitting existing agents – expect a wave of CVEs for agents that leak memory across segments, and a new class of runtime security tools focused on inter-agent state validation.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ryan Williams – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
