Multi-Turn Memory Isolation

Mechanism

In the disclosed architecture the language model holds no memory of its own. Two of the five constraints that make up the disclosure's structural starvation technique establish this directly: the absence of external memory and stateless purging. Together they ensure that nothing carries from one inference call into the next inside the model, and that the model is never given a persistent store from which it could reconstruct prior state. Memory isolation in this disclosure is therefore not a region, a sandbox, or an allocator. It is the structural consequence of denying the model both a memory of the past and a place to keep one.

The absence of external memory means the language model does not have access to any persistent memory, knowledge base, retrieval store, or external data source beyond the bounded prompt context supplied for the current inference call. The model operates on that bounded prompt context and its trained parameters, and nothing else. If the information required to produce a correct proposal is not present in the bounded prompt context, the model cannot produce the proposal, and the absence of that proposal is the structurally correct outcome, because the agent's state does not contain the information that would justify it.

Stateless purging means that after each inference call the language model's context is purged. No residual state from a prior inference call persists into the next. The model does not accumulate context, does not build up a model of the agent's history, and does not develop an internal representation of the validation criteria. Each inference call is an independent event in which the model receives a bounded prompt, produces a proposal, and is then reset.

Continuity Lives in the Agent, Not the Model

The disclosure does not abandon multi-turn interaction. It relocates the memory. Multi-turn context is maintained not by the language model but by the agent. Each exchange in a multi-turn interaction produces governed mutations to the agent's fields: updates to the context block, extensions to the memory field, and modifications to the intent field. These governed mutations persist across exchanges in the agent's verified state, while the model that proposed them is purged after each call.

When the next exchange requires language model involvement, the agent constructs a bounded prompt context from its current verified state, which already includes the accumulated context from prior exchanges. The model receives this bounded prompt, produces its proposal, and is purged again. The continuity of the interaction is preserved in the agent's governed state, not in the model's context window. The carry-over is therefore deliberate and inspectable rather than incidental and opaque.

Why This Prevents Leakage

Because the only thing the model ever sees is a bounded prompt context derived from verified agent fields, there is no path by which one inference call's working state can bleed into another. The model is the structurally untrusted proposal generator of the disclosure: it produces candidate mutations and nothing more. Those candidate mutations flow through a unidirectional interface into the validation engine, and no return path exists by which the validation engine's internal state, the agent's field values, or governance decisions are exposed back to the model. The same one-way interface that keeps the model from learning the validation logic also keeps prior-call residue from reaching the next call, because there is no channel through which it could travel.

Statelessness additionally prevents the model from engaging in multi-turn adversarial optimization in which successive proposals incrementally probe the validation boundary. A model that cannot remember its previous rejection cannot refine its next attempt against it. Memory isolation here is thus simultaneously a leakage control and an adversarial-robustness control: the two are the same structural property viewed from two directions.

What Persistence Looks Like When It Is Governed

State that does survive across exchanges survives only by becoming part of the agent's governed state. An update to the context block, an extension of the memory field, or a modification of the intent field is a governed mutation: it is proposed, evaluated by the validation engine against the agent's resident constraints, and, if accepted, recorded in lineage. The multi-turn interaction history is therefore subject to the same governance, validation, and lineage constraints as all other agent state. Nothing persists by accident, and nothing persists unrecorded.

This is the structural inversion the disclosure relies on. In a conventional agent the model's context window is the memory, and whatever lands in it persists by default and is governed by nothing. In the disclosed architecture the model's context window is emptied after every call, and the only durable memory is the agent's verified state, every entry of which has a provenance chain traceable through a sequence of governed mutations.

Composition With Other Mechanisms

Memory isolation composes with the other structural starvation constraints. Prompt bounding limits the model's input to curated, verified agent state. Forced reliance on agent fields rejects any proposal that references information not present in the agent's verified fields. Intermediate rejection discards failed proposals without exposing the rejection rationale to the model. Stateless purging and the absence of external memory complete the set. None of the five constraints depends on the model being well-aligned; structural starvation produces safe behavior through architectural containment regardless of the model's alignment status, and it remains composable with any model-level alignment technique.

Memory isolation composes with the mutation engine, which annotates each candidate mutation with the identity of the originating model, the prompt context supplied to that model, a timestamp, and a hash of the raw proposal. Because every persisted unit of memory carries this provenance annotation, the boundary between one exchange's contribution and another's is recoverable from lineage. It also composes with the arbitration engine: when multiple models propose competing mutations, each model's output is an independent proposal evaluated on its own, and no model's purged context can influence another's, because none of them carries context at all.

Prior-Art Distinction

Conventional LLM agent frameworks treat the model's context window as the working memory of the agent. Context accumulates across turns and across tool calls within a turn, and the available remedies for contamination are heuristic: clear the window, rewrite the prompt, or hope the next turn's context dominates. Residual context from a prior call routinely affects the next. The disclosed mechanism replaces the model-held context window as the seat of memory entirely: the model is purged after every call and given no external store, so there is no buffer in which residue could accumulate.

Retrieval-augmented and external-memory agent designs add a persistent store the model can read from. The disclosed mechanism does the opposite: it supplies the model with no persistent memory, knowledge base, or retrieval store beyond the single bounded prompt context for the current call. Where those designs treat more model-accessible memory as a capability, the disclosure treats the absence of it as the safety property, because it eliminates the substrate on which both hallucination and cross-call leakage operate. Continuity is not lost; it is moved into the agent's governed state, where every retained value is validated and lineage-recorded rather than held in an ungoverned context window.

Disclosure Scope

Memory isolation, comprising the absence of external memory and the stateless purging of the language model's context after each inference call, together with the maintenance of multi-turn continuity in the agent's governed fields rather than in the model's context window, is disclosed in the cognition filing (U.S. Application No. 19/647,395 and its international counterpart) as part of the structural starvation technique and its multi-turn interaction handling. This article describes that disclosed mechanism.

The scope encompasses any agent architecture in which an integrated language model is denied persistent memory and external retrieval, is purged of its context after each inference call, and in which interaction continuity is preserved through governed mutations to the agent's verified fields subject to validation and lineage recording. It applies whether the model is invoked singly or as one of several models producing independent proposals, and it is composable with any model-level alignment technique without depending on the model being well-aligned.