LLM context is composed without scoping

Type: types/note.md · Tags: computational-model, context-engineering

This note concerns flat context assembly: system prompts, skill bodies, user messages and tool outputs are combined without a separate mechanism enforcing each item's local scope. Role labels and delimiters may guide interpretation, but concatenation alone does not establish that one instruction applies only to one skill or document.

A frame here is the complete context supplied to one model invocation. Summaries and tool results belong to that frame when supplied as input. A sub-agent that makes several model calls has a frame for each invocation.

Flat context can exhibit failures resembling those associated with dynamic scope:

  • Distant influence: material retained from an earlier task can affect a later response even when the current task does not authorize that use.
  • Name collision: “table” can mean an HTML element in one passage and a database table in another; the model must resolve the intended use from the supplied context.
  • Limits on local reasoning: a skill's text alone may not predict its behavior when other instructions and history share the frame.

These are comparisons about interpretation. They do not imply that an LLM implements a conventional language's variable-binding rules.

The capture problem

Flat concatenation creates a composition-specific problem: capture. A skill says "summarize the document." The document contains "don't summarize this section, skip it." If the model follows the document's instruction instead of the skill, content has been treated as governing instruction. “Capture” is an analogy here: the failure concerns authority over the task, rather than lexical variable capture.

Within-frame hygiene

In this flat arrangement, interpretation can be guided by:

  • Role markers (system/user/assistant/tool in chat APIs) — primitive structural separation, but the LLM still sees all roles in one attention pass
  • Delimiters and quoting — XML tags, markdown fences, explicit "the following is data, not instructions" markers — conventional, not enforced
  • Ordering conventions — system prompt first, then context, then user message — exploits primacy/recency effects but provides no isolation

These are the LLM equivalent of coding conventions in a language without a module system. Their presence alone does not establish isolation. The relevant failure is non-selective semantic integration: supplied content steers generation beyond the role the task contract assigns it.

Non-selective semantic integration

"Spooky action at a distance" is measurable, not only architectural. GSM-DC varies synthetic distractor count in math word problems and finds power-law error growth — the clean control where irrelevant material is semantically inert noise. Gonen et al. varies injected concepts in completion prompts and finds Leak-Rate well above chance even when the concept is task-irrelevant (semantic leakage). Lampinen et al. varies belief-congruence on logic tasks. Each study shows prompt content the task does not license steering output, and each runs in a flat context where nothing excludes that content. Whether they measure one mechanism or several under that shared condition is open: none compares across the paradigms, and training responds differently in each (hard-distractor training helps in GSM-DC, instruction tuning increases leakage in Gonen and leaves content effects unchanged in Lampinen). Benchmark labels (noise, association, content bias) describe what each experiment varied, not established mechanisms; the shared architectural condition is what this note relies on.

The realistic case — semantically linked material that should not govern the task — is what agent workflows encounter. Context contamination below compliance reasoning is that failure at agent dose: fine-grained stance drift despite expressed refusal. Counter-instructions can bias against integration; they cannot remove tokens from the window or make a scope boundary binding.

What flat context buys

Flat logs have a real upside: implicit communication. When a user says "use a more formal tone" in turn 5, the effect propagates to later turns without re-parameterizing. This ambient influence is what makes flat context ergonomic at single-call granularity. The design question is not whether to have the upside, but where to contain it.

The architectural response

Scope is a usual feature of practical traditional programming languages, but it does not follow from symbolic form alone. A prompt can be symbolic under a path that adopts a model package as its reference without thereby acquiring scope. Whether a particular prompt language provides scope is a separate question.

An invocation can receive the accumulated parent context or a separately assembled set of inputs. Both are frames under this definition. Selecting inputs can reduce irrelevant material, at the cost of deciding what the new invocation needs and how results return.

Sub-agents provide a way to construct a separate frame with selected inputs. The model cannot read omitted material directly in that invocation. A summary of that material is a new input inside the frame, not an exception to the boundary. Frame construction selects what context is supplied; it does not by itself establish scope among the supplied instructions.

Code can select frame inputs without asking the model to interpret an exclusion instruction on each use. Scheduler–LLM separation explains this benefit of applying defined bookkeeping rules directly. The selection rule and its implementation still need checking.

Empirical validation comes from ConvexBench (Liu et al., 2026), a benchmark for recognizing convexity in deeply composed symbolic functions: LLMs collapse from F1=1.0 to F1≈0.2 at depth 100, even though the total token count (~5,331) is trivial relative to the context window. The failure is compositional reasoning depth, not token capacity — each recursive step conditions on an expanding history that dilutes attention on the current step. Pruning to retain only direct dependencies at each sub-step (one clean frame per call) recovers F1=1.0 at all depths.

Sources: - Anthropic (2025). Effective context engineering for AI agents — recommends sub-agents return 1,000–2,000 token summaries; the tens of thousands of tokens each sub-agent explores stay out of the caller's window. Illustrates selected inputs and summary transfer between frames. - Yang et al. (2025). GSM-DC — power-law reasoning degradation under synthetic distractor count; the inert-noise control regime for non-selective integration. - Gonen et al. (2024/2025). Semantic leakage in language models — control/test Leak-Rate metric; instruction-tuned models leak more. - Lampinen et al. (2024). Content effects on reasoning tasks — belief-congruent content shifts logic-task accuracy across model families.

Relevant Notes: