@vintcessun: Just came across this article, pretty impressive. Essentially, when AI agents do parallel exploration or tree search, each checkpoint/rollback requires backing up the entire file and process state, taking hundreds of milliseconds. DeltaBox discovered that consecutive checkpoints are actually highly similar. So instead of copying everything, just record the changes. It introduces two OS-level mechanisms…

Just saw this article, pretty impressive. Essentially, when AI agents perform parallel exploration or tree search, each checkpoint/rollback requires backing up the entire file + process state, taking hundreds of milliseconds. DeltaBox discovered: consecutive checkpoints are actually highly similar. So instead of full duplication, only record changes. It developed two OS-level mechanisms: DeltaFS uses layered filesystem + copy-on-write freeze, DeltaCR uses incremental dump + direct fork from template process. Measured on SWE-bench, C/R takes only 14ms and 5ms respectively, directly allowing agents to explore several times more nodes within a fixed time. — # DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback Source: https://arxiv.org/html/2605.22781 Yunpeng Dong1, Jingkai He1,2, Yuze Hou1, Dong Du1,2✉, Zhonghu Xu3, Si Yu3, Yubin Xia1,2, Haibo Chen1,2 1Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University 2Engineering Research Center for Domain-specific Operating Systems, Ministry of Education, China 3Huawei Technologies Co., Ltd ###### Abstract. LLM-powered AI agents require high-frequency state exploration (e.g., test-time tree search and reinforcement learning), relying on rapid checkpoint and rollback (C/R) of the complete sandbox state, including files and process state (e.g., memory, contexts, etc.). Existing mechanisms duplicate the entire state, causing hundreds of milliseconds to seconds of latency per C/R, which severely bottlenecks deep search and large-scale fan-outs. This paper observes that subsequent checkpoints in AI agents are highly similar. Therefore, instead of full duplication, a sandbox shouldonly duplicate the changes between consecutive checkpoints(Key Insight). However, it is non-trivial to realize the idea, mainly due to the lack of OS support. This paper proposes a new OS-level abstraction,DeltaState, to enable the change-based transactional C/R for AI agents with two co-designed OS mechanisms. First,DeltaFSenables change-based filesystem C/R by organizing the file states into layers and dynamically freezing the writable layer and inserting a new one during checkpoint, reducing file updates to copy-on-write, and making rollback a simple layer switch. Second,DeltaCRenables change-based process state C/R using incremental dumps, and accelerates rollback by bypassing traditional pipelines to directlyfork()from a frozen template process. We then present DeltaBox, a novel agent sandbox achieving millisecond-level C/R through the two new mechanisms. Evaluations on SWE-bench and RL micro-benchmarks show DeltaBox completes checkpoint and rollback in millisecond-level latency (14 ms and 5 ms, respectively), empowering agents to explore substantially more nodes under fixed time budgets. AI Agent, Sandbox, Checkpoint/Restore, Overlayfs, CRIU, Copy-on-Write, State Management 11footnotetext:Corresponding author: Dong Du ([email protected] (https://arxiv.org/html/2605.22781v1/[email protected])).## 1.Introduction LLM-powered AI agents have emerged as a primary approach to automating complex software engineering tasks. From automated code repair(swebench)to web navigation(webarena), these agents operate by iteratively generating actions(yao2023reactsynergizingreasoningacting), executing them within a secure sandboxed environment(e2b), observing outcomes, and refining strategies. A recent trend to enhance agent capabilities is test-time compute scaling(snell2024scaling). State-of-the-art agents invest additional inference compute through systematic tree search (e.g., Monte Carlo Tree Search(lats)or Best-of-N sampling), exploring multiple candidate paths, verifying them against real execution feedback, and backtracking from failures. However, applying tree search to stateful OS-level environments creates a severe infrastructure bottleneck. In early text-based tasks (e.g., HotPotQA), rollback was (almost) cost-free, achieved by simply truncating prompt history. Conversely, for more complex agent tasks(zhang2025mobiagentsystematicframeworkcustomizable;openclaw), agent actions may produce irreversible side effects. E.g., for a coding agent:rmdeletes files,pip installmutates the package tree, andsedrewrites source code. Bothrollbackandforktherefore require rapid checkpoint and rollback111We use rollback and restore interchangeably in the paper. Although synonymous, rollback implies the agent’s viewpoint, whereas restore refers to the underlying sandbox mechanism.of the complete sandbox state. The sandbox state encompasses two tightly coupled dimensions: durable filesystem state (e.g., working directories, installed packages) and ephemeral process state (e.g., process memory, python interpreter heap, open file descriptors, etc.). These dimensions must be captured and restored jointly to prevent state divergence or context loss. Fast C/R becomes even more pressing with modern reasoning models (o1-class(openai-o1), DeepSeek-R1(deepseek-r1)), which internalize search within extended chains of thought but still execute code at each reasoning step via tool-use variants, trying alternative dependency installations, running test suites, and reverting failing patches. Execution-guided sampling allocates inference budget across many parallel candidate trajectories(bon-scaling;snell2024scaling), each often requiring an isolated sandbox clone. Within each trajectory, iterative debug-test loops (generate patch→\torun tests→\toanalyze failure→\torevise→\torepeat) demand fine-grained intermediate checkpoints. This creates a two-dimensional scaling challenge: horizontal scaling (many parallel trajectories, each needing a fast initial clone) and vertical depth (each trajectory’s internal search tree, requiring checkpoint/restore of intermediate states). Beyond test-time inference, training agent policies with reinforcement learning (RL)(10.1145/3779212.3790172;shao2024deepseekmathpushinglimitsmathematical;NEURIPS2025_a4277440)has emerged as a parallel infrastructure pressure point. Each RL training step issues a batch ofkkrollouts against a sandbox, scores them with a reward model, and updates the policy; production systems must repeatedly tear down and re-createkkindependentsandboxes per training step, each at a known-good warm starting state (the same testbed snapshot, with the same toolchain pre-loaded). Today’s deployed approaches rebuild this warm state by either committing a Docker layer per starting state and running a fresh container per rollout (latency dominated by container start and image pull), or by snapshotting and resuming a microVM per rollout (latency dominated by guest memory pre-touch and device re-attach). Both sit in the hundreds-of-milliseconds to seconds regime per fork; withkkin the tens to low hundreds, fork latency directly bounds training throughput. Existing systems manage the filesystem and process memory in isolation, typically achieving C/R by duplicating the entire state into a checkpoint image. While full duplication works well for scenarios like serverless computing that prioritize cold-start restores(faasnap;catalyzer;reap;10.5555/3767901.3767929), it is prohibitively slow for AI agents requiring high-frequency checkpoints on the critical path. Prior efforts face two main challenges: Challenge-1: High latency of agent checkpointing.Prior sandboxes usually focus on optimizations for restore but not checkpoint, e.g., in serverless computing(10.1145/3694715.3695966;10.5555/3767901.3767929;catalyzer;10.1145/3503222.3507732;280716;10.1145/3617232.3624871;10.1145/3694715.3695967;10.1145/3694715.3695947;10.1145/3694715.3695966), checkpointing happens offline which is usually a one-time cost, while restore directly impacts the cold start latency. As a result, current agent sandbox systems suffer high latency of checkpointing. E.g., E2B takes∼4{\sim}4seconds to pause a sandbox per 1 GiB of RAM(e2b-checkpoint). Other approaches, e.g., CRIU(criu)take seconds for multi-GiB process footprints. Docker commits take several seconds for non-trivial layer changes, and VM-level snapshots (e.g., Firecracker(firecracker)) incur hundreds of milliseconds to seconds of latency(faasnap). These latencies severely bottleneck deep search and large-scale RL fan-outs. Challenge-2: Lack of efficient C/R for durable file states.A significant challenge is how to efficiently checkpoint and restore the filesystem state of an agent sandbox. Current systems usually adopt file copying, which incurs high latency. Methods like docker commits, git stash/branch, and VM-level snapshots(firecracker)are all slow in such cases. This paper observes that subsequent checkpoints in AI agent workloads are highly similar, with only minor incremental changes between steps (e.g., a few new files or modified memory pages). Therefore, we argue that instead of duplicating the entire state, a sandbox shouldonly duplicate the changes between consecutive checkpoints(Key Insight). To this end, we present DeltaBox, an efficient, OS-level rollbackable sandbox tailored for stateful AI agents. DeltaBox achieves millisecond-level checkpoint/rollback through a new OS abstraction, DeltaState, which treats the filesystem and process memory as a transactional, change-based state pair. To support DeltaState, we introduce two co-designed OS mechanisms in DeltaBox: - •DeltaFS(filesystem state management,§ 4.1 (https://arxiv.org/html/2605.22781#S4.SS1)): DeltaFS enables change-based filesystem C/R. Inspired by OverlayFS, DeltaFS organizes file states into different layers, in which higher layers will overwrite lower layers. It introduces a new feature over OverlayFS, runtime hot layer switching, dynamically freezing the current writable layer to preserve historical states and inserting a new writable layer without unmounting. Alazy switchmechanism based on per-inode generation counters transparently redirects active file descriptors across checkpoint boundaries. File updates are reduced to file-level CoW, and restore becomes a simple layer switch. - •DeltaCR(process state management,§ 4.2 (https://arxiv.org/html/2605.22781#S4.SS2)): DeltaCR enables change-based memory C/R coupled to each DeltaFS transition. At every checkpoint it performsbothan incremental CRIU dump (for durability) and a template-creatingfork()(for low-millisecond restore), with both costs hidden inside the LLM I/O window. A bounded template pool with LRU eviction keeps memory usage capped; evicted templates fall back transparently to the CRIU slow path, affecting only restore latency, never correctness. A background async-warm thread runs concurrently with the resumed agent, absorbing post-restore CoW faults on the agent’s writable memory regions (e.g., Python heap) off the critical path. We implement DeltaFS as a standalone Linux filesystem and DeltaCR as an extension to CRIU, and incorporate the two key components in DeltaBox, an agent sandbox based on a Firecracker microVM. End-to-end evaluations show that a coupled checkpoint completes in approximately 14 ms (mean), while repeated restores via template fork complete in≤\leq6 ms (P95 across SWE-bench workloads). On SWE-bench MCTS workloads, DeltaBox reduces state-management overhead from 47–77% of trajectory time on coupled-FS baselines to 3–6%, enabling agents to explore more search nodes. This paper makes the following contributions: - •We articulate the AI-agent sandbox C/R bottleneck, identifying that full state duplication is prohibitively slow for tree search and RL workloads. We propose the key insight of change-based DeltaState management. - •We design DeltaFS, a runtime-reconfigurable overlayfs extension enabling unmount-free layer switching and lazy file descriptor redirection. - •We design DeltaCR, a process C/R system that couples incremental dumps with warm-templatefork()restores and asynchronous hot-page warm-up (async-warm). - •We extensively evaluate DeltaBox on SWE-bench and on RL fan-out micro-benchmarks, demonstrating an order-of-magnitude reduction in C/R latency. ## 2.Background and Motivation Table 1.Comparison of sandbox state management approaches for AI agents.DeltaBox provides coupled checkpoint/restore of both filesystem and process state by only duplicating the changes between consecutive checkpoints for efficiency.ApproachCkptRestoreWriteFSProcessArbitraryAgentLatencyLatencyAmplif.StateStateRollbackTransparentGit stash/branch100 ms–1 s100 ms–1 sLow✓✗✓✗shutil.copytree100 ms–10 s100 ms–10 sO(dir)O(\text{dir})✓✗✓✗Docker commit + restart50 ms–10 s1–10 sO(layer)O(\text{layer})✓✗✓✗Btrfs/LVM snapshot10–100 ms10–100 msLow✓✗✓✗Firecracker VM snapshot(faasnap)200 ms–2 s120–700 msO(VM)O(\text{VM})✓✓✓✓LangGraph Checkpointer<<1 ms<<1 ms—✗Logical†✓✗DSec(deepseek-v4)‡—‡WAL replayO(log)O(\text{log})✗✗✗✓CubeSandbox(cubesandbox)§148–226 ms§<<60 ms∥O(VM)O(\text{VM})✗✗✗✓DeltaBox (ours)14.57 ms5.14 ms¶O(4KB)O(\text{4KB})✓✓✓✓ †Saves Python graph state only; cannot undo OS-level side effects.‡DSec(deepseek-v4)recovers via WAL replay of cached outputs; latency proportional to replay depth.§Ckpt measured via cloud-hypervisor (CubeSandbox’s VMM): pause++snapshot++resume, 512 MB VM, 256 MB dirty; range 148–226 ms, median 154 ms (5 runs).∥Published<<60 ms is cold-start latency, not event-level snapshot rollback; the latter is on CubeSandbox’s roadmap.§ 6.2.1 (https://arxiv.org/html/2605.22781#S6.SS2.SSS1)approximates the planned mechanism via the underlying VMM + dm-snapshot.¶Fast path: 5.14 ms (FS switch 1.66 ms∥\|template fork 3.75 ms). Slow path (CRIU lazy-pages): 8.04 ms (FS switch 1.66 ms∥\|CRIU restore 7.25 ms). Both are means across SWE-bench workloads; seeTable. 4 (https://arxiv.org/html/2605.22781#S6.T4)for component breakdowns. ### 2.1.AI Agent Search Strategies Modern LLM-based agents employ tree-structured search strategies to solve complex tasks. In the SWE-bench benchmark(swebench), agents diagnose bugs in real-world open-source projects (e.g., Django, Pandas, SymPy) and produce correct patches. Other benchmarks such as OSWorld(osworld), AgentBench(agentbench), and WebArena(webarena)evaluate agents on desktop automation, database operations, and web navigation tasks requiring physical environment interactions. MCTS and LATS.Modern agents have moved beyond single linear generation (Fig. 1 (https://arxiv.org/html/2605.22781#S2.F1)), widely adopting systematic search strategies to explore complex task state spaces. MCTS is the classical tree-search paradigm that makes decisions through selection, expansion, evaluation, and backpropagation. Language Agent Tree Search (LATS)(lats)adapts MCTS to the LLM agent domain: UCT-guided selection identifies the most promising node for expansion, where the agent generates multiple candidate actions and executes each in a sandbox. Applying this paradigm to stateful OS-level environments, rather than the text-based tasks LATS was originally evaluated on, where rollback is free, requiresforkandrollbackas genuine OS-level C/R operations that must complete in milliseconds to avoid blocking the LLM’s inference rhythm. Refer to captionFigure 1.Pass rate on SWE-bench Verified.(a)Linear ReAct vs. MCTS across three coding models.(b)Base vs. RL-trained across three open-weight model families.Best-of-N (BoN) and execution-guided sampling.BoN launchesNNindependent solution trajectories from the same initial state and selects the best via an evaluation model. Recent work optimizes allocation of parallel inference samples(bon-scaling), and test-time scaling more broadly drives large sample budgets(snell2024scaling); agent leaderboards increasingly pair this with per-trajectory sandboxes that execute code and observe test results. This creates ahorizontalscaling demand: cloning the initial sandbox state intoNNparallel instances, with total overheadtcheckpoint+N×tclonet_{\text{checkpoint}}+N\times t_{\text{clone}}wheretclonet_