MaSRead: Content-Addressed Reading of Replicated Latent Stores

# MaSRead: Content-Addressed Reading of Replicated Latent Stores
Source: [https://arxiv.org/html/2608.11218](https://arxiv.org/html/2608.11218)
\\nameCarlos Baquero\\emailcbm@fe\.up\.pt \\addrFEUP & INESC TEC, Universidade do Porto, Porto, Portugal\\nameLuís Brito\\emailbritoluis@estg\.ipvc\.pt \\addrESTG, Instituto Politécnico de Viana do Castelo, Viana do Castelo, Portugal

###### Abstract

Independent agents that reason in latent space can share computed state as key–value cache fragments rather than text\. Merged by a conflict\-free replicated data type, these fragments form a store that converges under any delivery order or duplication\. Yet a later query, unknown at encode time, cannot reliably read the merged cache: colocated fragments interfere, so colocation is not addressability\. MaSRead addresses the read to content\. It routes through opaque keyed tag sets derived from fragment words and decodes each selected fragment under a hard attention mask that hides the rest\. Under lexical connectivity, a graph walk reaches the fragments required by a multi\-hop query\. Across chain, pipeline, symmetric, hub, and natural\-language stores, MaSRead recovers visited fragments in isolation, remains effective as unrelated fragments accumulate, and transfers to another model family\. After routing, materialized decoding depends on fragment length rather than total store size; end\-to\-end work still includes store\-dependent routing and one read per visited fragment\. The limits are explicit: lexical routing can miss disconnected evidence, and answer composition remains bounded by the frozen reader\. Thus a replicated latent store becomes selectively readable for later queries when the needed fragments connect to the query through content\.

Keywords:latent communication, multi\-agent systems, key\-value caches, content addressing, conflict\-free replicated data types

## 1Introduction

A growing line of work has language\-model agents reason and communicate in latent space rather than in text: instead of exchanging natural\-language messages, each agent encodes its input into the transformer’s key–value \(KV\) cache and passes that latent state on\(Yuet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib5); Zouet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib6); Jinet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib7)\)\. When many agents contribute, their latent states accumulate into a shared store, a replicated collection of KV fragments, each the distilled product of one agent’s reasoning over its own input \(Figure[1](https://arxiv.org/html/2608.11218#S1.F1)\)\. An agent monitoring a long stream of routine events need not forward the stream; it could instead reason over it and contribute only the latent of the one anomaly it found, so that the store holds distilled reasoning rather than raw text\. That compact, anomaly\-only*direct latent*contribution remains the paradigm’s motivation, not a property of our main experiments: their fragments are query\-blind encodings of text\. We do, however, exercise the nearest implementation supported by the present mechanism\. A query\-independent writer applies a fixed sensor rule to its local log and emits a compact finding; that finding, rather than the raw log, is encoded as a KV fragment and read only after replication\.

This exercise also makes the signature interface concrete\. The compact record contains controlled descriptor words such as*anomaly*,*outlier*, and*spike*; an authorized writer maps those words to opaque HMAC tags, while the timestamp and numerical measurement remain only in the KV payload and never enter the signature\. A later query reaches the fragment through a descriptor tag and recovers the number under the mask; a timestamp\-only query cannot route\. On 20 frozen logs, three contamination levels, and four query wordings, the writer extracts the exact anomalous value on18/2018/20logs, the routed masked read recovers it on216/240216/240query instances, and final composition returns it on208/240208/240\. Raw\-log and timestamp\-only controls never route\. A separate single\-log probe shows retention and salience in an undistilled query\-blind cache \(Appendix[A](https://arxiv.org/html/2608.11218#A1)\)\.

temperature log20\.3 20\.187\.620\.0…\\ldotsdocumentdocumentagent Aagent Bagent ClatentAlatentBlatentCmergedlatent storeCRDT: set\-union,order/dup\. robustqueryQQ\(unknown at encode\)colocated readinterferes×\\timesMaSReadcontent\-addressed✓distill \(query\-blind\)

Figure 1:The setting\. Independent agents encode their inputs into KV\-cache fragments*query\-blind*, distilling reasoning rather than forwarding text \(in the motivating picture, agent A contributes only the anomaly it found in a long stream\)\. The fragments merge into one replicated store under a conflict\-free, set\-union merge\. A query posed later, unknown when the fragments were made, is answered by reading the store: a naive colocated read interferes, while the content\-addressed masked signature read \(MaSRead\) routes to lexically connected fragments, reads them in isolation, and composes an answer\.Such a store is only useful if it can be read, and the reading problem is awkward in a way ordinary retrieval is not\. The fragments are encoded*query\-blind*, before any question is posed, so a query that arrives later must be answered from latent state that no contributing agent shaped for it\. The obvious approach is to*colocate*the fragments, laying their caches side by side and reading the concatenation\(Jinet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib7)\)\. We show this fails\. Colocated fragments interfere: a read aimed at one fragment is corrupted by the others, and the corruption worsens as the store grows \(Section[3](https://arxiv.org/html/2608.11218#S3)\)\. Colocation is not addressability\.

We repair the read with content addressing\. Each fragment carries a content\-derived*signature*, an enumerable set of opaque keyed tags derived from its words, and an authorized query client produces tags in the same domain\. The store routes by tag overlap, then decodes each selected fragment under a hard attention*mask*that admits only that fragment’s block, so the others cannot interfere\. The routing is lexical, and it is the mask, not the routing, that our control isolates: a read under the wrong mask returns the wrong fragment’s value rather than a cleaned\-up answer, which is what makes the repair addressing rather than denoising\. A query is answered by a short program over the store: seed on the query, walk a signature graph to the fragments it needs, read each under its mask, and compose the results \(Section[4](https://arxiv.org/html/2608.11218#S4)\)\. We call this the*masked signature read*\(MaSRead\)\. The store beneath it is a conflict\-free replicated data type: fragments are identified by a content hash and merged by set union, so it converges regardless of the order or the multiplicity in which fragments arrive, tolerating duplicate transmissions \(Section[2](https://arxiv.org/html/2608.11218#S2)\)\.

#### What we learn\.

The central result is not merely that one read implementation works\. Before a fragment enters the store,*payload formation*must decide what local finding to preserve; the routed anomaly exercise shows that an incorrect writer record is faithfully routed and cannot be repaired downstream\. The store/read path then has six separable obligations, and satisfying an earlier one does not satisfy the next\.*Storage and convergence*preserve the same immutable fragments at every replica, but do not make any one fragment selectively readable\.*Routing*must find the fragments required by a later query; our opaque signature walk does so only when a lexical path connects the query to them\.*Addressing*must then expose the selected fragment without exposing its neighbors: the wrong\-mask control shows that the hard mask selects which fragment is read, rather than merely denoising the colocated store\.*Recovery*asks whether the selected cache can be decoded into the content it holds, a model\-dependent step measured by fragment restatement\.*Isolation*asks whether unrelated stored fragments can alter that recovery; masking supplies selective access empirically, and materializing a located block makes its fragment\-level decoder input structurally independent of the rest of the store\. Finally,*composition*asks whether the reader can turn the recovered fragments into the final answer\. It remains a separate, reader\-bounded operation: successful routing and recovery do not imply successful reasoning over what was recovered\.

This decomposition makes an end\-to\-end score interpretable and is the paper’s main general lesson\. Failure can mean that evidence was absent, missed by routing, misaddressed, decoded incorrectly, contaminated by other fragments, or recovered but not composed; the remedies differ\. Our controls localize these cases: colocation fails at addressing although the information remains recoverable; the lexical walk fails on disconnected evidence; and some answer errors remain after full coverage and near\-exact restatement, locating the residual in composition \(Sections[4](https://arxiv.org/html/2608.11218#S4)and[5\.5](https://arxiv.org/html/2608.11218#S5.SS5); Appendices[A](https://arxiv.org/html/2608.11218#A1)and[H](https://arxiv.org/html/2608.11218#A8)\)\. In the anomaly exercise, the same accounting attributes all masked\-value misses to two incorrect target writer records, while8/2168/216correct masked recoveries are subsequently lost in composition\. Where routing holds, isolated recovery remains effective as unrelated fragments accumulate, including on natural\-language stores \(Sections[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)and[5\.3](https://arxiv.org/html/2608.11218#S5.SS3)\)\. Once a fragment is located and materialized, its decode cost depends on that fragment rather than total store size, although routing and the number of reads remain store\- and query\-dependent\.

We claim addressability, robustness to contamination, and read cost, not superiority over text retrieval\. Pipelines that store and re\-read text are a different regime: they presuppose that the source text is retained, which the setting we study does not provide\. We therefore treat text retrieval as orthogonal rather than as a baseline, and account for the trade\-off, read cost included, honestly in Section[7\.1](https://arxiv.org/html/2608.11218#S7.SS1)\.

Content addressing is one way to read a replicated latent store, by what a fragment contains; addressing by where a fragment sits in a canonical order is a complementary direction we leave to future work\. Our claim is narrow and, we believe, consequential: once agents reason in latent space, the store they produce can be read for queries they never saw, when those queries are connected by content to the fragments they need, and, once a fragment is located, at a read cost that does not grow with the store, provided it is addressed rather than merely colocated\.

### 1\.1Contributions

- •A diagnosis\.We show that a query\-blind, CRDT\-merged store of key\-value fragments cannot be read by decoding over the colocated whole: the fragments interfere and the failure worsens as the store grows, and a wrong\-mask control identifies the missing operation as addressing rather than denoising \(Sections[3](https://arxiv.org/html/2608.11218#S3)and[4](https://arxiv.org/html/2608.11218#S4)\)\.
- •A read mechanism\.We repair the read with the*masked signature read*\(MaSRead\): route to a fragment by a lexical signature of its content, decode it under a hard attention mask that isolates its block, and walk a signature graph to reach the several fragments a multi\-hop query needs \(Section[4](https://arxiv.org/html/2608.11218#S4)\)\.
- •An evaluation\.We measure the read query\-blind across four store structures, under contamination to many times the fragments a query needs, on natural\-language multi\-hop questions, and across two model families, and we separate the read’s accuracy from the agents’ latent computation\. A fixed\-rule sensor exercise additionally follows a compact writer finding through opaque routing, masked recovery, and final composition\. Where the lexical walk has coverage, the read recovers required fragments, isolates their recovery as unrelated content accumulates, and reads a located materialized fragment at a cost independent of store size \(Section[5](https://arxiv.org/html/2608.11218#S5); Appendices[A](https://arxiv.org/html/2608.11218#A1),[B](https://arxiv.org/html/2608.11218#A2),[C](https://arxiv.org/html/2608.11218#A3), and[G](https://arxiv.org/html/2608.11218#A7)\)\.
- •Two honest boundaries\.We locate rather than hide where the method stops: the store delivers the facts reliably, but composing them into an answer is bounded by the reader \(Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\), and the lexical routing fails deterministically when a required fragment shares no word with the query \(Appendix[H](https://arxiv.org/html/2608.11218#A8)\)\.

## 2The replicated latent store

### 2\.1The replicated latent\-store read problem

Writeriireceives a local inputxix\_\{i\}and, before the eventual query is known, produces an immutable elementei=\(idi,KVi,Ti,mi\)e\_\{i\}=\(\\mathrm\{id\}\_\{i\},\\mathrm\{KV\}\_\{i\},T\_\{i\},m\_\{i\}\)\. HereKVi\\mathrm\{KV\}\_\{i\}is its cache block,TiT\_\{i\}is the raw opaque\-tag sidecar, andmim\_\{i\}fixes the model, encoding, layout, and tag\-schema metadata needed to interpret the element\. A replica holds a setS⊆\{ei\}S\\subseteq\\\{e\_\{i\}\\\}and merges received state by union\. A later queryqqhas a task\-dependent required setR​\(q\)⊆SR\(q\)\\subseteq S: this set is available only for evaluation, not to the router\. The router returns an ordered visited setV​\(q,S\)V\(q,S\); a fragment reader maps each visited element to a recovered outputrfr\_\{f\}; and a composer maps\(q,\(rf\)f∈V\)\(q,\(r\_\{f\}\)\_\{f\\in V\}\)to the final answer\.

This decomposition separates three questions that a single accuracy number can confound\.*Addressing*asks whether a located fragment can be exposed without admitting the others\.*Routing*asks whetherR​\(q\)⊆V​\(q,S\)R\(q\)\\subseteq V\(q,S\)\.*Answering*asks whether the composer can use the recovered outputs\. MaSRead supplies the first operation, implements the second with a lexical walk, and delegates the third to the frozen reader\. Table[1](https://arxiv.org/html/2608.11218#S2.T1)records the resulting contract\.

Table 1:The replicated latent\-store read contract\. Structural statements concern state or decoder inputs, not model accuracy; empirical conditions are measured in Section[5](https://arxiv.org/html/2608.11218#S5)\.
### 2\.2Store state and convergence

We now make the store precise, because its structure is what makes the read problem hard\. Each agent, having encoded its input query\-blind under one shared, frozen model, contributes a*fragment*: the key–value cache of that encode and an immutable lexical\-addressing sidecar, named together by a content identifier\. The sidecar contains opaque pseudorandom tags rather than words; its construction is defined in Section[4](https://arxiv.org/html/2608.11218#S4)\. Because the model, normalization schema, and encoding are fixed and deterministic, the element and its name are a function of the input alone: two agents that encode the same input produce the same fragment under the same name, and two that encode different inputs produce distinct fragments, so identity is exact rather than semantic\. The identifier binds the cache, sidecar, schema and public key identifier, so two different sidecars cannot occupy the same element identity\. The state of the store is the set of fragments it has received, and it records which fragments are present and nothing else: not when a fragment arrived, nor in what company, nor how many times\.

Replicas of the store synchronize by exchanging and merging states, and the merge is set union\. Merging a fragment already present changes nothing, and two replicas hold the same set whatever the order in which they saw its fragments, so the merge is commutative, associative, and idempotent\. The store is thus a grow\-only set, the simplest state\-based conflict\-free replicated data type: under eventual delivery, replicas that gossip and merge states converge to the union of all fragments ever added, independent of the order, grouping, or multiplicity of delivery\(Shapiroet al\.,[2011](https://arxiv.org/html/2608.11218#bib.bib3); Preguiçaet al\.,[2018](https://arxiv.org/html/2608.11218#bib.bib4)\)\. Fragment identity is by content hash, so convergence is exact up to hash collisions, which we take to be negligible\.

To be read, the set is*rendered*into a single cache by placing each fragment’s block at a canonical range of positions, which fixes its rotary \(RoPE\) coordinates; because that placement is a deterministic function of the set, the render is byte\-identical across delivery orders, a construction we take from prior work on convergent cache merging and describe in Appendix[G](https://arxiv.org/html/2608.11218#A7)\(Baquero and Brito,[2026](https://arxiv.org/html/2608.11218#bib.bib57)\)\.

###### Proposition 1\(Convergence of complete elements\)

Assume that writers use the same model, tokenizer, normalization and tag schema, that encoding and rendering are deterministic, that elements are immutable and completely named by their payload identity, and that hash collisions are negligible\. Replicas that receive the same elements hold the same state independently of delivery order, grouping, and duplication\. For a fixed tagged query, deterministic rendering and tag traversal with the content\-derived tie\-break also produce the same render and visit order\.

ProofSet union is commutative, associative, and idempotent, so every delivery history with the same delivered elements yields the sameSS\. The boilerplate intersection, final tag sets, canonical layout, overlap scores, and content\-hash tie\-break are deterministic functions of\(S,q\)\(S,q\); applying them to equal inputs therefore yields equal renders and walks\. The proposition concerns agreement, not whether the walk reachesR​\(q\)R\(q\)or whether the model decodes correctly\.

One property of this state shapes everything that follows: it is a*set*, identified by content\. Rendering it does place each fragment at a position in the layout, but that position is fixed by the layout, not by the query, so a query has no position to ask for; its only handle is content\. A query, which the fragments were not encoded to answer, must therefore be answered by what the fragments contain\. The rendered cache is exactly the colocated store the next section reads: reading it whole, we will see, affords no such handle, and Section[4](https://arxiv.org/html/2608.11218#S4)recovers one by reading the same render under a mask\.

## 3Colocation is not addressability

The store of Section[2](https://arxiv.org/html/2608.11218#S2)is read by rendering its fragments into one colocated cache and decoding over the whole\. We now show that this read fails, and fails worse as the store grows\. Figure[2](https://arxiv.org/html/2608.11218#S3.F2)takes a store ofkksame\-family fragments, renders them together, and asks, query\-blind, for the value held by one designated fragment\. Atk=2k=2the colocated read is already unreliable, at0\.430\.43; byk=8k=8it has collapsed to0\.000\.00\. The fragments are not lost: the same store, read one fragment at a time under a mask to an oracle\-designated target block \(Section[4](https://arxiv.org/html/2608.11218#S4)\), answers every query, at0\.990\.99or above for everykk\. The information is present in the store, but reading it whole does not give reliable selective access to it, and the loss grows with the store\. Here the target fragment is oracle\-designated solely to isolate recovery; the figure is not evidence that the lexical walk finds it\. Query\-driven routing is evaluated later \(Section[5](https://arxiv.org/html/2608.11218#S5)\)\.

2481600\.250\.250\.50\.50\.750\.7511store sizekk\(colocated fragments\)read accuracycolocated readdesignated masked readFigure 2:Colocation is not addressability\. A store ofkksame\-family fragments is rendered together and read, query\-blind, for the value in one designated fragment \(n=100n=100per point; bars are95%95\\%Wilson intervals\)\. The target block is supplied by an oracle in both conditions, so this diagnostic tests isolation, not routing\. The colocated read collapses as the store grows, while the same fragments read one at a time under a mask to the target block stay at or near1\.001\.00\. The gap is the cost of not addressing\.The failure is interference, not loss\. Reading over the colocated cache, a read aimed at one fragment is not confined to it: the answer it commits to is drawn from the wrong fragment or fused across several\. Asked for the value in fragmentaa, the colocated read returns the value that sits in fragmentbb; asked to apply one fragment’s rule, it applies another’s\. We name this by the substituted answers we observe, not by a measured attention pattern, so we call it interference without asserting a specific route through attention\. The more fragments share the store, the more neighbours there are to confuse it, and the read collapses within a few fragments rather than degrading gently\.

This is the concrete form of the mismatch named in Section[2](https://arxiv.org/html/2608.11218#S2)\. The store is a set identified by content, with no position a query can name; the render supplies positions, but reading across them is what corrupts the answer\. To read the store is therefore to*isolate*the fragment a query wants from the rest, which colocation does the opposite of\. The next section builds that isolation, and shows with a control that what it restores is addressing rather than a merely cleaner read\.

Two qualifications frame everything that follows, because the failure above is a worst case\. It is sharpest when the fragments are lexically similar, as here, and when the store is large; on a small store of dissimilar fragments a colocated read can be adequate, and on clean natural text it can match an addressed read, as the evaluation will show \(Section[5](https://arxiv.org/html/2608.11218#S5)\)\. The value of addressing is not that colocation always fails but that, once a target is located, its isolated recovery does not admit neighbouring fragments as similarity, store size, or contamination changes, where a colocated read does\. That invariance is bought at a price, the read’s dependence on routing recall: a fragment a query cannot reach by content is a fragment the addressed read cannot use, and there a colocated read that keeps everything in view can do better \(Appendix[H](https://arxiv.org/html/2608.11218#A8)\)\. The evaluation reports both the invariance and its price\.

## 4Content\-addressed reads: the masked signature read

Section[3](https://arxiv.org/html/2608.11218#S3)left the read needing to isolate the fragment a query wants from the rest of the colocated store\. We supply that isolation by addressing the read to content, in three operations of which only the last is new here\. Fragments are identified by content hash \(Section[2](https://arxiv.org/html/2608.11218#S2)\), which merges and deduplicates the store but is not a handle a query holds\. A query instead*routes*to fragments by a lexical*signature*, and each located fragment is then*read*under a hard attention mask\.

A writer normalizes its fragment text locally: lowercase alphabetic content words, simple stemming, function\-word removal, and no digits\. Under a store\-scoped secret keyKK, each normalized wordwwbecomes the first128128bits of a domain\-separatedHMAC​\-​SHA256⁡\(K,d∥w\)\\operatorname\{HMAC\\mbox\{\-\}SHA256\}\(K,d\\mathbin\{\\\|\}w\), whereddis the ASCII prefixmasread/signature/v1followed by a zero byte\. The writer sends the resulting enumerable tag set with the cache and may then discard the source text\. Authorized query clients hold the same key and tag their query locally; storage replicas need neither the key nor any plain signature word\. Tags are pseudorandom identifiers, but equality is preserved within one key epoch\.

The transmitted set is the fragment’s raw tag set\. From the convergent element setSS, every replica removes the set\-wide boilerplateBSB\_\{S\}, the intersection of all raw tag sets, and usessigS​\(f\)=Tf∖BS\\mathrm\{sig\}\_\{S\}\(f\)=T\_\{f\}\\setminus B\_\{S\}as the final signature\. The set must remain enumerable because the walk of Algorithm[1](https://arxiv.org/html/2608.11218#alg1)grows its frontier by unioning a visited fragment’s tags\. A128128\-bit Bloom filter over the final set may accelerate membership tests but cannot replace it\. On the synthetic families digits never enter the tagger, so the numerical answers are not in the addressing metadata\. On natural\-language paragraphs an answer word may be tagged, but a keyless replica sees only its stable opaque identifier\.

A query is tagged into the same domain, and the read routes to the fragments whose signatures its tags select, preferring the largest overlap\. This is lexical routing, a relevance\-ranked walk rather than an exact address lookup, and we claim no more for it\. Having located a fragment, the read decodes over the render under a hard attention*mask*that admits only that fragment’s block and hides every other, so the interference of Section[3](https://arxiv.org/html/2608.11218#S3)cannot arise: the model attends to one fragment and reads it as if it stood alone\. The control in Table[2](https://arxiv.org/html/2608.11218#S4.T2)isolates this masking step; routing and composition are measured separately in Section[5](https://arxiv.org/html/2608.11218#S5)\.

A query is answered by a short program over the store \(Algorithm[1](https://arxiv.org/html/2608.11218#alg1)\)\. It*seeds*a frontier with the query’s tags and matches them, by set membership, against the fragments’ signatures; each matched fragment is visited, and its own signature tags are unioned into the frontier, so the search expands without ever enumerating a Bloom filter\. A fragment reached only through a tag that another fragment supplied is exactly a second hop\. The relevance\-prioritized graph walk continues over edges that join fragments sharing a lexical tag until no unvisited signature overlaps the frontier\. Each visited fragment is then*read*under its mask, and the recovered facts are*composed*into an answer\. We call the whole a*masked signature read*\(MaSRead\)\.

Algorithm 1The masked signature read \(MaSRead\)\.1:tagged query

TqT\_\{q\}; store where each fragment

ffcarries raw tag set

TfT\_\{f\}
2:

B←⋂fTfB\\leftarrow\\bigcap\_\{f\}T\_\{f\};

sig​\(f\)←Tf∖B\\mathrm\{sig\}\(f\)\\leftarrow T\_\{f\}\\setminus B
3:

F←TqF\\leftarrow T\_\{q\}⊳\\trianglerightfrontier of opaque lexical tags

4:

V←\[\]V\\leftarrow\[\\,\]⊳\\trianglerightvisited fragments, in order

5:whilesome unvisited

ffhas

sig​\(f\)∩F≠∅\\mathrm\{sig\}\(f\)\\cap F\\neq\\emptysetdo⊳\\trianglerighta set\-membership test

6:

f←f\\leftarrowthe unvisited fragment of largest overlap with

FF
7:append

ffto

VV;

F←F∪sig​\(f\)F\\leftarrow F\\cup\\mathrm\{sig\}\(f\)⊳\\trianglerightgrow the tag frontier

8:endwhile

9:return

Compose​\(MaskedRead​\(f\)​for each​f∈V\)\\textsc\{Compose\}\\big\(\\textsc\{MaskedRead\}\(f\)\\text\{ for each \}f\\in V\\big\)
10:**MaskedRead*​\(f\)\\textsc\{MaskedRead\}\(f\): decodeff’s block in the render under a hard mask that hides every other block\.*

###### Proposition 2\(Isolation of a materialized fragment read\)

Fix a located elementff\. Let materialization extractff’s KV block from the canonical render and reverse its layout offset, restoring the native coordinates at which it was encoded\. A decoder supplied only that materialized block has a fragment\-level input independent of every element inS∖\{f\}S\\setminus\\\{f\\\}\. Consequently, adding, removing, or changing other elements cannot change this fragment\-level computation\.

ProofAfter extraction and coordinate restoration, the decoder inputs are a function only offf, the fixed model, and the fixed restatement prompt\. No key or value tensor from another element is present\. The statement makes no accuracy claim and does not cover routing or composition: changingS∖\{f\}S\\setminus\\\{f\\\}may change whetherffis visited, may add other visited restatements, and may thereby change the final answer\.

The tags hide plain signature words from a replica withoutKK, not the structure of the index\. A replica observes repeated tags, signature sizes, co\-occurrence, the induced graph, repeated query tags, and which fragments a query visits; a key holder can also test dictionary words\. This is the familiar leakage trade\-off of searchable symmetric indexes\(Curtmolaet al\.,[2011](https://arxiv.org/html/2608.11218#bib.bib73); Cashet al\.,[2015](https://arxiv.org/html/2608.11218#bib.bib74)\), not zero\-knowledge search\. We use one key shared by authorized writers and query clients\. An oblivious pseudorandom function could keep that key from mutually distrustful writers, at the cost of an online cryptographic service, which we leave to future work\(Miao and Chase,[2020](https://arxiv.org/html/2608.11218#bib.bib75)\)\.

Table 2:Mechanism panel: Qwen3\-1\.7B, a two\-fragment store read query\-blind for the value in one designated fragment \(n=40n=40, at the shared\-unit similarity rung; a separate draw from Figure[2](https://arxiv.org/html/2608.11218#S3.F2), whose open\-read level varies with draw and rung, Appendix[H](https://arxiv.org/html/2608.11218#A8)\)\. The colocated read interferes; masking to the target block restores retrieval; a read under the*wrong*mask returns the partner fragment’s value, at0\.0000\.000correct\. The mask selects which fragment is read\. The same ordering holds at 4B and 8B \(Appendix[B](https://arxiv.org/html/2608.11218#A2)\)\.Table[2](https://arxiv.org/html/2608.11218#S4.T2)isolates the mechanism on the smallest store that interferes: two same\-family fragments, read query\-blind for the value in one of them\. The open read over the pair scores0\.6250\.625; masking to the target block restores it to1\.0001\.000\. The decisive row is the control: a read under the*wrong*mask, admitting the partner’s block instead of the target’s, scores0\.0000\.000, and its answers are the partner’s value\. This is what makes the repair*addressing*rather than denoising\. The mask does not clean up a noisy read; it selects which fragment is read, and under the wrong selection the model faithfully returns the wrong fragment\. Read accuracy is a function of which block the mask admits, which is what it means for the mask to be an address, and it recovers the isolation Section[3](https://arxiv.org/html/2608.11218#S3)showed colocation destroys\. Both this panel and Figure[2](https://arxiv.org/html/2608.11218#S3.F2)designate the target block, so they measure the mask on its own; whether the walk of Algorithm[1](https://arxiv.org/html/2608.11218#alg1)routes to that fragment from a query it never saw is a separate question, and the coverage it reaches is measured throughout Section[5](https://arxiv.org/html/2608.11218#S5)\.

A word on what these probes contain: the fragments hold explicit facts, so the read can be graded against a gold value; the distilled\-reasoning premise of Section[1](https://arxiv.org/html/2608.11218#S1), where a fragment holds the product of an agent’s reasoning rather than a stated fact, is exercised separately in Appendix[A](https://arxiv.org/html/2608.11218#A1)\. Two properties of the read we also defer\. The signature is lexical, a summary of content words, which fixes a precision boundary we return to in Section[7\.1](https://arxiv.org/html/2608.11218#S7.SS1)\. And the masked read above reads each block at its position in the render; a materialized variant reads it at a cost independent of store size, which we use in Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)\.

## 5Evaluation

Sections[3](https://arxiv.org/html/2608.11218#S3)and[4](https://arxiv.org/html/2608.11218#S4)measured the mask with a designated target\. We now measure the full read, routing included, end to end: each store is read query\-blind by Algorithm[1](https://arxiv.org/html/2608.11218#alg1)with no oracle anywhere, so the walk must find the fragments from the query’s lexical tags, read them under masks, and compose\. Alongside accuracy we report two diagnostics that localize any failure:*coverage*, the fraction of a query’s required fragments the walk actually reaches \(routing\), and whether each reached fragment is restated correctly \(recovery\)\. A gap that survives both is composition, in the reader rather than the store\.

Table 3:Claim–evidence map\. Each claim is paired with the control or failure boundary that limits its scope\. The routed anomaly exercise is a fixed\-rule computed\-payload example, not unsupervised anomaly discovery\.### 5\.1Breadth across store structures

We evaluate on synthetic stores of four families, chosen to span distinct structures; Table[4](https://arxiv.org/html/2608.11218#S5.T4)shows one instance of each\. Two are sequential: a*chain*of fictional\-unit conversions and an affine*pipeline*of machines, each fragment’s value feeding the next\. One is*symmetric*, a constraint system whose three fragments are solved jointly with none ordering the others\. The last is a*hub*, a single dense fragment indexed against two small tables\. Every store has three fragments, encoded query\-blind \(construction in Appendix[J](https://arxiv.org/html/2608.11218#A10)\)\.

Table 4:One instance of each store family \(k=3k=3fragments, abbreviated from the generator templates; the generators randomize the words and numbers\)\. The chain and pipeline pass one value along a sequence; the symmetric system couples all three fragments; the hub packs several items into its third fragment, each to be cross\-referenced against the other two\. Only the hub reads below ceiling \(Table[5](https://arxiv.org/html/2608.11218#S5.T5), Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\)\.Table[5](https://arxiv.org/html/2608.11218#S5.T5)reads each store query\-blind, pooled over three data seeds \(n=300n=300per cell\)\.

Table 5:The masked signature read across four store structures \(k=3k\{=\}3; Qwen3\-1\.7B; query\-blind; pooled over three data seeds,n=300n=300per cell\)\.*masked read*is MaSRead end to end;*ceiling*is the full\-text single\-context answer, a reference a masked read can match or exceed rather than an upper bound;*colocated*reads the same extracted facts alongside the whole merged render rather than in isolation, the naive colocation of Section[3](https://arxiv.org/html/2608.11218#S3);*no\-protocol*poses the query over the merged render alone, with neither the addressing nor the extracted facts;*coverage*is the fraction of required fragments the walk reaches;*hub*is the multi\-value readout \(hub store only\)\. The bracketed interval on the masked read is the95%95\\%Wilson binomial \(Appendix[I](https://arxiv.org/html/2608.11218#A9)\)\.The read reaches the full\-text ceiling on three of the four families: the chain, the pipeline, and the symmetric store all land at0\.970\.97or above, against ceilings at or near1\.001\.00, so this is not one lucky structure\. Two diagnostics say why\. Coverage is1\.001\.00everywhere: the walk reaches every required fragment from the query alone, which is where the routing deferred in Sections[3](https://arxiv.org/html/2608.11218#S3)and[4](https://arxiv.org/html/2608.11218#S4)is validated, and the near\-ceiling reads are content\-addressed end to end, not oracle\-masked\. And the no\-protocol control sits at floor, never above0\.080\.08: the colocated store holds the same content, yet read without addressing it yields almost nothing, so the read’s accuracy is addressing, not extra information\. On every structure the colocated read is below the masked read, replaying the interference of Section[3](https://arxiv.org/html/2608.11218#S3)\.

The hub is the exception, at0\.440\.44\. It is not a routing or a reading failure: coverage and the hub’s multi\-value readout are both1\.001\.00, so the store returns every fact the query needs\. What the frozen reader then fails is composing those facts into the answer, a read\-versus\-answer boundary we take up in Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\.

### 5\.2Scaling with contributing agents

A shared store grows as agents contribute, and most of what accumulates is irrelevant to any one query\. We test whether the read survives this: we take a store that reads well, merge in unrelated fragments drawn from a disjoint family that shares no words with the query, and read for the original target as the store fills\. Figure[3](https://arxiv.org/html/2608.11218#S5.F3)sweeps the number of unrelated fragmentsDDfrom0to6464, more than twenty times the fragments a query needs\.

08816163232646400\.250\.250\.50\.50\.750\.7511unrelated fragments added,DDread accuracymasked read \(MaSRead\)colocated readFigure 3:Scaling under contamination\. A chain store is read for its target asDDunrelated fragments, sharing no query word, are merged in \(n=50n=50per point\)\. The masked read stays near0\.900\.90out toD=64D=64, over twenty times the fragments a query needs; the colocated read over the same store collapses\. Coverage is1\.001\.00and the walk visits none of theDDunrelated fragments at every point\.The masked read holds near0\.900\.90across the whole sweep, undiminished as the store fills with unrelated fragments to twenty times what a query needs\. The colocated read over the same store collapses, from0\.940\.94to near zero byD=16D=16, a collapse consistent with the long\-context degradation a colocated read is subject to\(Liuet al\.,[2024](https://arxiv.org/html/2608.11218#bib.bib69)\)\. Why the addressed read does not move is visible in the walk: coverage stays at1\.001\.00and it visits*zero*of the unrelated fragments at everyDD, because a fragment that shares no word with the query has an empty signature intersection and never becomes a candidate\. Contamination cannot reach the read: the walk refuses the junk, and each masked read isolates its target regardless of what else the store holds\.

Cost separates into routing, per\-fragment recovery, and composition:

Ttotal​\(q,S\)=Troute​\(q,S\)\+∑f∈V​\(q,S\)Tread​\(Lf\)\+Tcompose​\(\|V​\(q,S\)\|\)\.T\_\{\\mathrm\{total\}\}\(q,S\)=T\_\{\\mathrm\{route\}\}\(q,S\)\+\\sum\_\{f\\in V\(q,S\)\}T\_\{\\mathrm\{read\}\}\(L\_\{f\}\)\+T\_\{\\mathrm\{compose\}\}\(\|V\(q,S\)\|\)\.\(1\)Only the reading of a single located fragment is independent of the store\. The full read is not: the walk scans the signatures and visits every fragment that shares a frontier tag, soTrouteT\_\{\\mathrm\{route\}\}generally grows with\|S\|\|S\|and, on a lexically connected store,\|V\|\|V\|can approach\|S\|\|S\|\. Every visited fragment is then read and included in composition\. What does not grow is the cost of reading one already located fragment\. An in\-place masked read does not have this property, because it attends over the whole render, whose length grows with every fragment merged; a*materialized*read does: the target block is extracted and decoded at the native positions it was encoded at \(Section[2](https://arxiv.org/html/2608.11218#S2)\), so its cost is the block’s own lengthO​\(Lf\)O\(L\_\{f\}\), independent of the store size\|S\|\|S\|\(Appendix[G](https://arxiv.org/html/2608.11218#A7)measures a fixed147147\-token decode as the render grows roughly eightfold\)\. The accuracy results above use the in\-place read; the materialized read is the same read relocated to fixed coordinates, and it is what the read\-cost claim of Section[1](https://arxiv.org/html/2608.11218#S1)refers to, once a fragment is located\. We report decoded\-block length, not wall\-clock latency, so this is an asymptotic argument about the located read, not an end\-to\-end timing result\.

### 5\.3Answering unknown queries on real text

The synthetic stores let us control structure; they do not tell us whether the read survives the lexical noise of real language\. We repeat the evaluation on two standard multi\-hop question\-answering sets: MuSiQue 2\-hop\(Trivediet al\.,[2022](https://arxiv.org/html/2608.11218#bib.bib68)\), the answerable subset, and HotpotQA bridge\(Yanget al\.,[2018](https://arxiv.org/html/2608.11218#bib.bib27)\),k=2k=2\. Each item’s supporting paragraphs become the fragments, encoded query\-blind, and we read for the answer the encoding never saw\. To probe contamination we addddof the dataset’s own distractor paragraphs, which are*topical*: they are about the same entities and share vocabulary with the query, so unlike the disjoint junk of Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)the walk has no lexical reason to skip them\. Table[6](https://arxiv.org/html/2608.11218#S5.T6)reports token\-overlapF1F\_\{1\}\(n=50n=50per row\)\. We report coverage here, as on the synthetic families, but not the per\-fragment restatement match: on free\-text paragraphs it is not a clean recovery diagnostic, since a non\-empty restatement is not evidence that the answer\-bearing fact was recovered, so on natural language the end\-to\-endF1F\_\{1\}and coverage are what we measure\.

Table 6:Real multi\-hop text, query\-blind \(n=50n=50per row\)\. Cells areF1F\_\{1\}; exact match follows the same pattern \(MuSiQue0\.220\.22then0\.340\.34; HotpotQA0\.420\.42then0\.440\.44\)\. Columns as in Table[5](https://arxiv.org/html/2608.11218#S5.T5);*cover/junk*is coverage of the supporting paragraphs and the number of thedddistractors the walk visited\. The masked read uses a6464\-token restatement budget; rerun at256256tokens the outputs are unchanged\.The contamination result of Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)holds on real text, and against harder noise\. With eight topical distractors the masked read holds,0\.440\.44on MuSiQue and0\.570\.57on HotpotQA, while both unaddressed reads collapse to near0\.030\.03: real distractors destroy a colocated read and leave the addressed one where it was\. The mechanism is not the one from Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)\. There the walk could refuse disjoint junk; here the distractors share the query’s words, so the walk cannot avoid them and in fact visits all eight \(junk\-visited=8=8, coverage1\.001\.00\)\. The read survives anyway, because what protects it is the mask, not the routing: each fragment is read in isolation, so a visited distractor produces its own restatement but cannot corrupt a supporting fragment’s masked read, whereas colocation fuses them and the answer degrades\. A visited distractor’s restatement does still enter the composition, so isolation bounds the damage rather than removing it; that the read holds here means the reader can set the irrelevant restatements aside, not that they were kept out\. On real text the isolation does the work that avoidance did on synthetic stores\.

Two honesty notes\. First, on a clean store the masked read does not win: with no distractors to interfere, both unaddressed reads are as good or better \(colocated0\.410\.41and no\-protocol0\.520\.52against0\.310\.31on MuSiQue,0\.650\.65and0\.610\.61against0\.580\.58on HotpotQA\), and the full\-text ceiling is higher still\. The read’s value is robustness to contamination, not clean\-store accuracy, and the honest baseline is that colocation is fine until the store is contaminated\. Even so, these are reads of the store and not recalled answers: a closed\-book baseline, the same questions with no store at all, scoresF1F\_\{1\}0\.070\.07on MuSiQue and0\.100\.10on HotpotQA, so the store’s contents, not the question alone, carry the answer\. Second, coverage on the clean store is below one,0\.750\.75on MuSiQue and0\.900\.90on HotpotQA: the lexical walk sometimes fails to reach the second hop when the query and the bridging paragraph share no surface word\. This lexical dependence is the read’s soft spot\. It is also why the masked read rises from the clean store to the contaminated one on MuSiQue, from0\.310\.31to0\.440\.44: the fuller walk over the larger store recovers second hops the clean walk missed \(coverage0\.750\.75to1\.001\.00\)\. A routing index that tolerates paraphrase rather than shared tokens would remove the dependence; we return to it in Section[7](https://arxiv.org/html/2608.11218#S7)\. The synthetic worst case makes the dependence deterministic: on the DISCOUNT family \(Appendix[H](https://arxiv.org/html/2608.11218#A8)\) one required fragment shares no routing word with the query or the others, so the walk never reaches it on any item, the masked read collapses to0\.010\.01, and a colocated read that keeps that fragment in view scores0\.840\.84\. The contamination\-robustness of Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)is therefore conditional on routing recall, and the store answers a query only when the query is connected by content to the fragments the answer needs\.

### 5\.4It is addressing, not latent computation

One confound remains\. The agents in this line reason in latent space before they encode, so a masked read might not be addressing a stored fact at all; it might be recovering something the agent*computed*during that reasoning, in which case the read would be entangled with latent computation and would fade if the agent did less of it\. We cut the confound by varying the agent’s latent budgetℓ\\ell, the number of latent reasoning steps it takes while encoding a fragment, down toℓ=0\\ell=0where it does none and the cache holds only the encoded text\. Reading off masked\-read accuracy acrossℓ∈\{0,20,40\}\\ell\\in\\\{0,20,40\\\}\(full grid,n=100n=100per cell, in Appendix[E](https://arxiv.org/html/2608.11218#A5)\), three of the four structures are flat: the chain holds0\.930\.93at everyℓ\\ell, the pipeline and the symmetric store stay at or above0\.990\.99\. Removing latent computation entirely costs nothing\. The read recovers the encoded fact; it does not depend on the agent having reasoned over it, which is what it means for the read to be addressing\.

The hub is again the exception, rising withℓ\\ellfrom0\.150\.15to0\.400\.40\. This is not the addressing being computed: coverage and hub extraction are1\.001\.00at everyℓ\\ell, so the walk reaches the fragment and the store returns its full contents regardless of the budget\. What moves withℓ\\ellis downstream of the store’s output, in composing the recovered values into the answer, and we do not localize it further; for the hub alone, then, the encoding agent’s latent computation does move the final answer, though it moves neither what is addressed nor what is extracted\. The deconfound also marks a claim we do not make\. Distilled latent state is why sharing caches is worthwhile \(Section[1](https://arxiv.org/html/2608.11218#S1)\), since an agent can pass computed state that has no text form, but the read does not require it: it fetches whatever the cache holds, computed or merely encoded\.

### 5\.5The boundary: reading versus answering

Every result so far has set the hub aside, and it is time to collect the debt\. The hub is where reading and answering come apart, and the gap has a precise location\. Table[7](https://arxiv.org/html/2608.11218#S5.T7)decomposes the hub read into a ladder, from what the store returns to what the reader does with it\.

Table 7:The hub, decomposed \(the hub family of Table[5](https://arxiv.org/html/2608.11218#S5.T5), a single query\-blind draw,n=100n=100\)\. The store returns every fact \(top block\); a symbolic composer, a deterministic rule over the decoded facts rather than the model, answers at0\.990\.99, so the read’s output determines the answer\. The frozen reader handed the same facts answers at0\.400\.40, below even its full\-text ceiling of0\.940\.94\. Nearly all the residual is composition, in the reader\.The store does its part completely\. Coverage, restatement, and hub extraction are all1\.001\.00, and the decoded facts are parseable at0\.990\.99: the read returns every value the answer needs, in usable form\. The decisive line is the next one\. A symbolic composer, a fixed rule applied to those decoded facts instead of the model, answers at0\.990\.99\. Nothing the answer requires is missing from the read; the read’s output already determines the answer\. Yet the frozen reader, handed the same decoded facts, answers at0\.400\.40, below even the0\.940\.94it reaches reading the full text in one context\. Nearly all of the residual is in the reader’s composition, not in the store or the routing; the symbolic composer is at0\.990\.99, not1\.001\.00\. And because the model reaches0\.940\.94from the full text, part of what it fails is composing from the read’s terse restatements rather than composition in the abstract\.

The hub is where this shows because it concentrates many values in one fragment\. In the store of Table[4](https://arxiv.org/html/2608.11218#S5.T4), a single fragment lists an inventory,*2 large red, 3 small green, 1 large blue*, and answering means looking each item up in the two rate tables and summing, so the reader must select and combine within one dense restatement, the operation it does worst; the chain, pipeline, and symmetric stores put one value in each fragment and never trigger it\. Nor is the copy budget the constraint: read at a256256\-token budget the hub still answers0\.360\.36, no better than at6464, so the limit is composing the recovered values, not fitting them into the restatement\. We do not claim to close this gap, and locating it is the point\. It is exactly the boundary the thesis draws: a content\-addressed read makes the relevant facts reliably available, and turning them into an answer is bounded by the reader\. A stronger or task\-tuned reader would move the0\.400\.40, but that is a property of the reader; the read has already done its work, as the symbolic composer’s0\.990\.99attests\.

## 6Related work

For a broad map of latent\-space methods spanning reasoning, memory, and communication, see the recent survey ofYuet al\.\([2026](https://arxiv.org/html/2608.11218#bib.bib5)\); we position here against the specific lines that bear on reading a merged store\.

#### Latent multi\-agent communication\.

A recent line has agents exchange hidden state rather than text\. LatentMAS\(Zouet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib6)\)prepends one agent’s KV cache to the next in sequence; Agent Primitives\(Jinet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib7)\)run parallel solvers whose caches a selector consumes; Interlat\(Duet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib8)\), cache\-to\-cache transfer\(Fuet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib42)\), and thought communication\(Zhenget al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib49)\)pass latent messages between models, and RecursiveMAS\(Yanget al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib40)\)loops hidden states through a trained link\. These papers study how to*produce and transfer*fragments; none, to our knowledge, defines how to*read*an unordered store of them for a query the producers never saw\. The closest reader, the Agent Primitives selector, sees every candidate at once, but its candidates are redundant complete solutions to be voted among, not jointly necessary fragments to be composed, so colocating them does not trigger the interference we study; the analogue is close rather than exact\.

#### KV caches: compression, reuse, and the addressing gap\.

Most KV\-cache work optimizes either how much cache to keep, through eviction and merging\(Xiaoet al\.,[2024](https://arxiv.org/html/2608.11218#bib.bib14); Zhang and others,[2023](https://arxiv.org/html/2608.11218#bib.bib15); Li and others,[2024](https://arxiv.org/html/2608.11218#bib.bib16); Wanget al\.,[2024](https://arxiv.org/html/2608.11218#bib.bib37)\), or how fast to reuse it, through block\-structured serving and prefix caching\(Kwonet al\.,[2023](https://arxiv.org/html/2608.11218#bib.bib20); Gimet al\.,[2024](https://arxiv.org/html/2608.11218#bib.bib54); Maet al\.,[2024](https://arxiv.org/html/2608.11218#bib.bib55)\); neither asks which cache entry answers a given query\. Closest to our setting is a 2025–2026 cluster that reuses*independently encoded*chunks and reports the failure we call colocation is not addressability: naively concatenating separately computed caches breaks the cross\-attention a joint prefill would have computed, at a large accuracy cost\(Yaoet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib60); Yanget al\.,[2025b](https://arxiv.org/html/2608.11218#bib.bib61),[a](https://arxiv.org/html/2608.11218#bib.bib59); Huet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib62)\)\. Their remedy is to*repair*the union so the chunks read together again, by recomputing a token subset\(Yaoet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib60); Huet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib62)\), aligning the attention distribution\(Yanget al\.,[2025b](https://arxiv.org/html/2608.11218#bib.bib61)\), or training link tokens\(Yanget al\.,[2025a](https://arxiv.org/html/2608.11218#bib.bib59)\); ProphetKV even steers the repair with the query\(Wanget al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib63)\)\. Like us, these systems precompute each chunk’s cache before any query, so encode\-time query\-blindness is not our difference\. The difference is at combine time: they assemble a per\-query retrieved set and repair its union with the query in hand, whereas we hold one persistent, growing, query\-independent store and never repair it, masking all but the one addressed fragment so the interference cannot arise rather than being recomputed away\. These systems diagnose a related failure of joint reading from independently encoded caches, which is evidence the phenomenon is real, but none of them tests selective access to a designated fragment; addressing, not repair, is the operation we add\.

#### Attention as content\-addressable memory\.

Treating a cache read as an address lookup has precedent\. Modern Hopfield networks show the transformer’s own update rule is an associative\-memory retrieval\(Ramsaueret al\.,[2021](https://arxiv.org/html/2608.11218#bib.bib65)\), and that this retrieval degrades from clean single\-pattern recovery to a blurred average as the stored patterns grow numerous or similar, which is the mechanistic reason a naive read over a contaminated pool is not a clean lookup and the motivation for our hard mask\. Memorizing Transformers\(Wuet al\.,[2022](https://arxiv.org/html/2608.11218#bib.bib66)\)make the read explicit, querying an external key\-value memory by approximate nearest neighbor, and Landmark Attention\(Mohtashami and Jaggi,[2023](https://arxiv.org/html/2608.11218#bib.bib67)\)routes to a block through a learned per\-block token, the closest precedent for route\-then\-read\. These retrievals are soft, similarity\-based, and learned within one model’s own sequence; ours routes by lexical overlap on an opaque tag signature, with optional Bloom acceleration\(Bloom,[1970](https://arxiv.org/html/2608.11218#bib.bib58)\), over multi\-party fragments merged after the fact\. Parallel Context Windows\(Ratneret al\.,[2023](https://arxiv.org/html/2608.11218#bib.bib64)\)is the ancestor of masking\-as\-isolation, but it isolates every window uniformly so that a fixed reader can attend to all of them, whereas we expose exactly one fragment by content\.

#### Learned latent memory\.

A parallel line builds latent memory that is written and later read, almost always with a trained reader or writer: differentiable cache augmentation\(Liuet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib43)\), uncertainty\-triggered synthesis\(Houet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib44)\), role\-aware or self\-generated agent memory\(Fuet al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib46); Zhanget al\.,[2025a](https://arxiv.org/html/2608.11218#bib.bib47)\), and reconstruction\-oriented factual memory\(Zhanget al\.,[2026](https://arxiv.org/html/2608.11218#bib.bib48)\)\. These stores are learned, and their memory is generated or consolidated rather than routed to\. What distinguishes ours is not single\- versus multi\-agent, since some of these are multi\-agent too, but that it is a replicated, multi\-writer set merged by content hash and training\-free: fragments keep the exact caches their producers wrote, are identified by content hash, and are read by a fixed signature match, with no learned reader between the store and the answer\.

#### Reading versus composing\.

Mechanistic studies of latent reasoning support our split between what the store delivers and what the reader must do\. Latent tokens transport and scaffold computation rather than perform it\(Zhanget al\.,[2025b](https://arxiv.org/html/2608.11218#bib.bib34)\), and multi\-hop composition is built by a model’s own attention over a sequential chain rather than by colocating independent vectors\(Zhuet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib36)\)\. Parallel Context Windows report the same split from the systems side, helping comparison questions answerable from independently read windows but hurting bridge questions that need one window conditioned on another\(Ratneret al\.,[2023](https://arxiv.org/html/2608.11218#bib.bib64)\)\. This is why a merged store needs an active, addressed read, and why, once the facts are recovered, composing them into an answer remains the frozen reader’s job, as the hub result and its widening on a weaker reader \(Appendix[C](https://arxiv.org/html/2608.11218#A3)\) show\.

#### Replicated state and text retrieval\.

The merge our store inherits is a conflict\-free replicated data type\(Shapiroet al\.,[2011](https://arxiv.org/html/2608.11218#bib.bib3); Preguiçaet al\.,[2018](https://arxiv.org/html/2608.11218#bib.bib4)\), established for these caches in the companion work\(Baquero and Brito,[2026](https://arxiv.org/html/2608.11218#bib.bib57)\); CRDT ideas have reached neural state at the weight level\(Gillespie,[2026](https://arxiv.org/html/2608.11218#bib.bib31)\), but without any read or query semantics\. Finally, our read is not text retrieval\. Retrieval\-augmented generation\(Lewis and others,[2020](https://arxiv.org/html/2608.11218#bib.bib18)\)and its latent\-space successors\(Heet al\.,[2025](https://arxiv.org/html/2608.11218#bib.bib56)\)fetch text or learned document representations selected for a known query; we address raw KV fragments produced query\-blind, and we set out the honest trade this makes against text retrieval in Section[7\.1](https://arxiv.org/html/2608.11218#S7.SS1)\.

## 7Limitations and discussion

The limitations follow the same routing–recovery–composition decomposition as the task definition\. First, routing is lexical\. A query reaches a fragment only through shared lexical terms \(represented as equal tags\), so a needed fragment that shares no routing token is never read: on the DISCOUNT family this happens on every item, and a colocated read that keeps everything in view does better there than the addressed read \(Appendix[H](https://arxiv.org/html/2608.11218#A8)\)\. On natural text the same dependence shows as a coverage below one when a bridging paragraph shares no surface word with the query \(Section[5\.3](https://arxiv.org/html/2608.11218#S5.SS3)\)\. A signature that matched by meaning rather than by shared tokens would remove this, and a learned or embedding\-based signature is the natural next step; we use a lexical one here because it is deterministic, disclosed, and needs no training, at the price of this recall boundary\.

Second, isolated recovery is not purely latent\. Writers and authorized query clients normalize text before mapping its words to opaque tags, and the reader recovers each fragment by decoding a short text restatement before composing\. Keyless replicas see no plain signature words, but the tags still expose equality, co\-occurrence and access patterns, so this is pseudonymized lexical addressing rather than private or semantic search\. This keeps the method training\-free and deterministic, but it is a step short of a read that stays in latent space from end to end\. A signature and a reader that operate on the cache without writer\-side text or decoded restatements are the direction we think most worth pursuing next\. Addressing a fragment by its position in a canonical order, rather than by its content, is a further complementary route we leave to future work\.

Third, final composition remains a reader property\. On the hub a symbolic composer over the read’s output answers at0\.990\.99while the frozen model answers at0\.400\.40\(Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\), and across model families the gap narrows as the reader strengthens \(Appendix[C](https://arxiv.org/html/2608.11218#A3)\)\. The store’s part and the reader’s part come apart: MaSRead isolates and recovers a located fragment, but a stronger or task\-tuned reader is needed to move the second number\.

The routed anomaly exercise exposes an additional upstream boundary\. Its writer is given an application threshold and emits a compact textual record before that record is encoded as KV; it is neither unsupervised anomaly discovery nor a direct latent\-to\-latent distillation protocol\. The writer misses or misrecords two of 20 target anomalies and falsely labels two of 160 normal windows\. MaSRead follows those records rather than fixture truth, as a content\-addressed store should\. A future system therefore needs to improve or verify payload formation separately from improving the read\.

Fourth, isolation is not constant\-time search\. Equation[1](https://arxiv.org/html/2608.11218#S5.E1)makes the distinction explicit: routing scans store metadata,\|V\|\|V\|may grow with lexical connectivity, and every visited fragment is recovered and composed\. Only the materialized read of one already located block is independent of\|S\|\|S\|\. We report decoded lengths and asymptotic structure rather than an end\-to\-end serving latency benchmark\.

Finally, the evidence has limits of scope\. The powered results are on one model family, Qwen at three scales, with a cross\-family check on Llama; the natural\-language evidence is two multi\-hop datasets atk=2k=2; and several cells are small \(n=20n=20to5050\), with intervals in Appendix[I](https://arxiv.org/html/2608.11218#A9)\. The synthetic families are lexically connected by construction, so their coverage of1\.001\.00is in part a property of the generator and not only of the router, which is why the DISCOUNT counterexample and the coverage below one on natural text are the honest tests of routing\.

### 7\.1Relation to text retrieval

The read we study is not text retrieval, and we do not benchmark against it\. A pipeline that stores and re\-reads text is a different regime: it presupposes that the source text is retained, which the setting here does not provide, and on encode\-only content it would likely win on verbatim accuracy and on storage\. We claim addressability, robustness to contamination, and read cost, not superiority over text on those axes; the point of the setting is that agents may share distilled reasoning rather than raw text, in which case there is no text to retrieve and the question is only whether the latent payload can be read at all\. A matched comparison is therefore needed to establish when a latent payload is preferable: it should hold source information and model capability fixed and measure storage, write cost, routing cost, recovery and final\-answer accuracy, and end\-to\-end latency\. We leave that regime\-selection study to future work rather than infer it from the present experiments\.

## 8Conclusion

When independent agents reason in latent space, their key\-value caches accumulate into a replicated store that a conflict\-free merge keeps convergent under any order or multiplicity of delivery\. That store holds what the agents worked out, but reading it whole does not recover it: the fragments interfere, and colocation is not addressability\. We repair the read by addressing it to content\. A masked signature read routes to a fragment by an opaque keyed lexical signature and decodes it under a hard attention mask that hides the rest\. When the required evidence is lexically connected to the query, a walk over the signature graph reaches its fragments\. On our chain, pipeline, symmetric, hub, and natural\-language stores, visited fragments are recovered in isolation; the recovery remains effective as unrelated fragments accumulate and transfers to a different model family\. Once a fragment is located, its materialized read cost does not grow with the store, although routing and the number of reads remain store dependent\.

We have been equally explicit about where the method stops\. The store delivers the facts a query needs when routing reaches them; composing them into an answer is bounded by the reader, and we locate that limit rather than hide it\. The routing is lexical beneath its opaque tags, so a fragment a query cannot reach by shared lexical terms is a fragment the read cannot use\. And the read is not yet purely latent: text is normalized by authorized endpoints for routing and is decoded again for recovery\. These boundaries define concrete directions for future work\. Most consequential is the last: a signature and reader that operate on the cache without decoding it to words would make the read latent from end to end\.

The claim we make is narrow\. Once agents reason in latent space, the store they produce can be read for queries they never saw, when those queries are connected by content to the fragments they need, provided the store is addressed rather than merely colocated\. Addressing, not merging, is the operation that makes a replicated latent store usable, and it is the operation this paper supplies\.

## Appendix AAnomaly probes: retention and routed extraction

### A\.1Retention and salience in one undistilled cache

A small probe supporting the motivation of Section[1](https://arxiv.org/html/2608.11218#S1): a single agent \(Qwen3\-1\.7B\) reads a short event stream*query\-blind*\. The stream is a ten\-entry temperature log, every reading near20∘20^\{\\circ\}C except one at87\.6∘87\.6^\{\\circ\}C\. The log precedes any question in the sequence, so by causal attention its KV cache does not depend on the question; a matched control replaces the anomaly with20\.520\.5\. Decoding is greedy\.

Behavioral\.Reading the query\-blind cache, the agent*names the anomaly on a generic prompt*: asked only “is there anything notable?” it answers “a notable spike in temperature at 08:25, reaching87\.6∘87\.6^\{\\circ\}C, significantly higher than the surrounding readings\.” Asked which reading is anomalous it returns87\.687\.6exactly\. On the control it reports “no significant anomalies or extreme values” and never emits87\.687\.6\.

Cache inspection\.We measure the attention each reading receives from the question tokens, averaged over all layers and heads \(a content\-to\-content comparison, which avoids the attention\-sink artifact of absolute attention mass\)\. The anomalous reading is the most attended of the ten \(Table[8](https://arxiv.org/html/2608.11218#A1.T8)\), receiving about1\.9×1\.9\\timesthe mean regular reading\.

Table 8:Attention each reading receives from the question tokens \(mean over all layers and heads; representative rows\)\. The anomaly is rank1/101/10\.Scope\.This first probe is illustrative \(one model, one toy stream\): it shows the anomaly is*retained, recoverable, and salient*under query\-blind encoding\. It does not demonstrate a compact computed payload\. Reproduce withpaperJMLR/probes/anomaly\_probe\.py\. The probe writes only to standard output, and no historical capture was retained\. The accompanying capture is an authorized greedy regeneration of this fixed fixture; its checksum, Qwen snapshot, and software environment are recorded in the results manifest\.

### A\.2Full\-system routed fixed\-rule extraction

We next test a compact computed payload without changing the MaSRead mechanism\. Each fixture contains one ten\-reading temperature window with exactly one value above40\.0∘40\.0^\{\\circ\}C, a matched all\-normal window, and up to seven unrelated all\-normal windows of the same textual form\. Before any read query is known, a Qwen3\-1\.7B writer receives one local window and the fixed application rule “anomaly iff one reading exceeds40\.0∘40\.0^\{\\circ\}C\.” It greedily emits exactly three fields: status, timestamp, and one\-decimal value\. A strict parser rejects malformed or incoherent output; it neither checks against fixture truth nor repairs or retries a result\.

For an anomaly record, the system adds a fixed controlled descriptor set \{anomaly,anomalous,outlier,spike,notable\}\. It then query\-blind encodes the compact record as a KV fragment and constructs the ordinary MaSRead sidecar\. As in Section[4](https://arxiv.org/html/2608.11218#S4), alphabetic content words are mapped to opaque HMAC–SHA256 tags; neither the measurement nor timestamp contributes a signature word\. The authorized query client maps its words under the same key\. Thus a query such as “report the outlier reading” can route throughoutlierand only then recover the numerical value from the masked payload\. A raw log has no usable signature after same\-format boilerplate removal, and a timestamp\-only query has no alphabetic bridge\.

We developed this version after preserving an unsuccessful preliminary writer smoke test that used an underspecified “obvious outlier” instruction\. We froze the threshold, prompt, strict parser, and direct non\-thinking chat protocol after a separate seed\-314159 writer gate and one disjoint full\-path smoke\. The evaluation then ran once on seed 42, items 1–20; the preliminary test’s observed item 0 was excluded prospectively\. For each item we evaluate four fixed query wordings withD∈\{1,3,7\}D\\in\\\{1,3,7\\\}routine windows, giving 240 end\-to\-end records and 180 distinct one\-shot writer records\. There are no output retries, exclusions, or gold repairs\.

Table 9:Routed fixed\-rule anomaly extraction\. Counts separate writer detection, opaque\-tag routing, masked recovery, and final composition; errors are retained\.The decomposition is exact\. One target is labeled normal and never routes; a second target is labeled anomalous but with the wrong timestamp and value\. Those two writer records account for every masked gold\-value failure\. Two normal windows are falsely labeled anomalous, producing the only routine visits and all\-normal control failures\. For the 18 correct target records, masked timestamp and value recovery is exact for every query andDD\. Final composition then preserves the value in208/216208/216such cases: three errors use a contaminated fact set created by a writer false positive, and five are truncated explanatory answers under the frozen 32\-token budget\. We observed no independent HMAC or selector failure\.

This is stronger than the retention probe because it exercises local finding formation, compact sharing, opaque routing, masked recovery, and composition in one system\. Its scope remains precise: it is threshold\-rule extraction through a textual compact\-record interface, not general anomaly discovery and not an agent emitting a directly distilled latent without an intermediate record\. Reproduce withpaperJMLR/probes/routed\_anomaly\_probe\.py; the frozen artifacts, protocol hash, environment, and complete failure audit are listed in the results manifest\.

## Appendix BScale: the read at 4B and 8B

The mechanism panel of Section[4](https://arxiv.org/html/2608.11218#S4)is measured at 1\.7B\. Here we repeat it at 4B and 8B \(Qwen3\-4B and Qwen3\-8B\), under the same query\-blind two\-fragment encodes and the same three reads\. Table[10](https://arxiv.org/html/2608.11218#A2.T10)gives all three scales\.

Table 10:Mechanism panel across scale \(query\-blind,n=40n=40pairs\)\. At every scale the masked read sits far above both the open read and the wrong\-mask control, so the mask, not the query, governs which fragment is read\. The masked row is1\.0001\.000,0\.7500\.750,0\.8750\.875: the 4B value is a non\-monotonic dip, not a trend\.The addressing result holds at every scale: the masked read is far above the open read and the wrong\-mask control throughout\. What changes with scale is only how completely masking removes the interference, and it does not change monotonically\. At 1\.7B masking dissolves it \(1\.0001\.000\)\. At 4B it suppresses rather than dissolves: the masked read \(0\.7500\.750\) sits well above the open read but below the isolated single\-fragment read, which is at ceiling there \(20/2020/20\)\. At 8B the masked read recovers to0\.8750\.875, at or above the isolated read, which is itself off ceiling at this scale under query\-blind decoding \(14/20=0\.7014/20=0\.70\)\. The 4B dip is therefore non\-monotonic, and the qualitative result, that the mask decides what is readable, is scale\-invariant\.

The end\-to\-end read holds at 8B as well\. Table[11](https://arxiv.org/html/2608.11218#A2.T11)runs the full protocol on the four families at 8B \(k=3k=3,n=50n=50\)\.

Table 11:End\-to\-end read at 8B \(Qwen3\-8B;k=3k=3; query\-blind;n=50n=50\)\. The masked read stays well above the colocated read on every family\. The no\-protocol control is at floor except on the hub, where the larger model answers the hub question from the merged cache without the read’s facts at0\.460\.46, above the colocated read there; so the ordering masked above colocated above control holds on the chains and the symmetric store but not on the hub\.The pattern of Section[5](https://arxiv.org/html/2608.11218#S5)survives the change of scale: the masked read is at or near ceiling on the chains, the colocated read collapses, and the control is at floor\. The two family\-level shifts are honest to report\. The hub reads higher at 8B \(0\.620\.62\) than at 1\.7B, but the no\-protocol control on the hub also rises to0\.460\.46, the larger model answering it from the merged cache without the read’s facts, so the hub’s margin over the control narrows rather than widens\. The symmetric family reads lower at 8B \(0\.780\.78\) than at 1\.7B; the depth behavior at 8B is in Appendix[D](https://arxiv.org/html/2608.11218#A4)\.

## Appendix CCross\-family replication \(Llama\)

The main results use the Qwen family at three scales \(Appendix[B](https://arxiv.org/html/2608.11218#A2)\)\. To test whether the read is specific to that family, we repeat the end\-to\-end read on Llama at two capacities, Llama\-3\.2\-3B and Llama\-3\.1\-8B\(Grattafiori and others,[2024](https://arxiv.org/html/2608.11218#bib.bib71); Meta AI,[2024](https://arxiv.org/html/2608.11218#bib.bib72)\), on the chain, pipeline, and symmetric families, query\-blind,n=50n=50per cell\. The recovered launchers record the exact Hugging Face repositoriesunsloth/Llama\-3\.2\-3B\-Instructandunsloth/Meta\-Llama\-3\.1\-8B\-Instruct, both with data seed4242\. Read\-only inspection of the execution host’s Hugging Face cache identifies one snapshot per repository, referenced bymainand timestamped before its run\. The pinned revisions are:

3B006f5dcd1393c3add266de40994ba96225e9689d8Ba2856192dd7c25b842431f39c179a6c2c2f627d1Table[12](https://arxiv.org/html/2608.11218#A3.T12)adds a*restate*column, the per\-fragment restatement exact match, which separates what the store returns from what the reader does with it\.

Table 12:Cross\-family read on Llama at two capacities \(query\-blind,n=50n=50per cell\)\. Columns are as in Table[5](https://arxiv.org/html/2608.11218#S5.T5), plus*restate*, the per\-fragment restatement exact match\. Coverage and restatement are high throughout, so routing and extraction transfer off the Qwen family; the masked read rises sharply from 3B to 8B, to the full\-text reference on the chain though below it on the pipeline and symmetric families, where the residual is composition \(Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\)\.Three things transfer off the Qwen family\. Coverage is1\.001\.00on every cell, so the signature walk reaches every required fragment on Llama as on Qwen\. The colocated read collapses, to at most0\.200\.20, while the masked read stays well above it, the interference of Section[3](https://arxiv.org/html/2608.11218#S3)again\. And restatement is faithful, from0\.890\.89at 3B to1\.001\.00at 8B, so the masked decode extracts the fragments’ contents rather than only routing to them: the store delivers the facts off\-family\.

What does not transfer as a constant is the absolute read accuracy, and it tracks the reader’s capability rather than the model family\. The masked read rises sharply from 3B to 8B, from0\.240\.24–0\.500\.50to0\.560\.56–0\.960\.96, matching the full\-text reference on the chain \(the0\.960\.96against0\.880\.88difference is within sampling noise atn=50n=50\) though staying below it on the pipeline and symmetric families\. That the variable is reader quality and not parameter count is clear from Qwen3\-1\.7B, which reads at0\.970\.97where the larger Llama\-3\.2\-3B reads at0\.240\.24; the two Llama models differ in both size and generation, so we do not separate scale from architecture, and claim only that a more capable reader reads the store better\.

Where the 8B read still sits below the reference, on the pipeline \(0\.720\.72against1\.001\.00\) and the symmetric store \(0\.560\.56against0\.900\.90\), extraction is not the obvious cause: restatement there is exact \(1\.001\.00and0\.990\.99\)\. That match counts numeric recovery, not whether every relation and binding was preserved, so unlike the hub’s symbolic\-composer test \(Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\) it shows the residual is consistent with composition rather than fully localizing it there\. The residual moves with the reader, widest at 3B, narrower at 8B, and closed on the chain; the cross\-family evidence is that the store and its addressed read transfer, and the answer quality that remains is bounded by the reader\.

## Appendix DDepth:k=5k\{=\}5stores

The main results use three\-fragment stores\. This appendix pushes the read to five, on two families that extend to depth: an additive chain in which every hop is jointly necessary, and a five\-way hub\.

Table 13:Five\-fragment stores at 1\.7B \(n=20n=20per cell\)\.*query\-anticipated*is a superseded reference in which the query was present while the fragments were encoded;*masked read*is the canonical query\-blind read\. The query\-blind read reaches the full\-text ceiling on both families with coverage1\.001\.00\.Depth is not the obstacle it first appears\. Read with the query present in the encode, the five\-fragment stores look hard,0\.600\.60on the chain and0\.050\.05on the hub\. That difficulty is an artifact of query\-anticipated encoding: the masked read of a fragment encoded alongside the query restates the embedded query text rather than the fragment’s content \(the sentence\-versus\-copy control of Appendix[F](https://arxiv.org/html/2608.11218#A6)\)\. Under the canonical query\-blind encode, which is also the reusable\-memory regime the paper targets, both families reach the ceiling with full coverage, so five\-fragment stores need no new mechanism\. The colocated read again sits below the masked read \(0\.650\.65and0\.750\.75\), the interference of Section[3](https://arxiv.org/html/2608.11218#S3)at depth\. One caveat: thisk=5k=5hub is a different, and easier, generator than thek=3k=3hub of Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\(its ceiling is1\.001\.00, not0\.920\.92\), so the depth result does not speak to that family’s compose boundary\.

The read holds up a depth ramp at 8B as well\. Table[14](https://arxiv.org/html/2608.11218#A4.T14)runsk=3k=3throughk=5k=5on the additive chain and the hub at 8B\.

Table 14:Depth ramp at 8B \(Qwen3\-8B; query\-blind;n=20n=20per cell\)\. Acrossk=3k=3tok=5k=5the masked read stays high while the colocated read collapses to zero and the control is at floor\.k=2k=2is the base case of the mechanism panel \(Appendix[B](https://arxiv.org/html/2608.11218#A2)\); the additive\-chain generator is degenerate at two fragments and is omitted here\. The hub here is the easier depth\-scalable generator of thek=5k=5table above, not the hub of Table[11](https://arxiv.org/html/2608.11218#A2.T11)and Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5), so its accuracy is not comparable to those\.At 8B the masked read stays between0\.800\.80and0\.950\.95as the store grows from three to five fragments, while the colocated read falls to zero byk=4k=4and the control stays at floor\. Deeper stores cost the addressed read a little accuracy but do not break it, and the gap over the colocated read widens with depth rather than closing\. Figure[4](https://arxiv.org/html/2608.11218#A4.F4)plots the same reads across the ramp\.

33445500\.250\.250\.50\.50\.750\.7511store sizekkaccuracyhub, maskedhub, colocatedchain, maskedchain, colocatedFigure 4:The 8B depth ramp fromk=3k=3tok=5k=5\(query\-blind,n=20n=20per point; the points of Table[14](https://arxiv.org/html/2608.11218#A4.T14)\)\. As the store grows the colocated read collapses on both families while the masked read stays high\.
## Appendix ELatent\-computation ablation: full grid

Section[5\.4](https://arxiv.org/html/2608.11218#S5.SS4)cuts the latent\-computation confound by varying the encoding agent’s latent budgetℓ\\ell, the number of latent reasoning steps it takes before it encodes a fragment\. Atℓ=0\\ell=0the agent does none and the cache holds only the encoded text\. Table[15](https://arxiv.org/html/2608.11218#A5.T15)gives the full grid: the masked read, query\-blind, seed4242,n=100n=100per cell, under the canonical read configuration of Appendix[J](https://arxiv.org/html/2608.11218#A10)\.

Table 15:Masked\-read accuracy as the encoding agent’s latent budgetℓ\\ellvaries \(query\-blind, seed4242,n=100n=100per cell\)\. Three families are flat: removing latent computation entirely costs nothing, so the read addresses the encoded fact rather than exploiting computation over it\. The hub rises withℓ\\ell, but its coverage and its exact hub extraction are1\.001\.00at every budget, so the store returns every value regardless ofℓ\\ell; what the extra steps move is downstream of that output, in composing the recovered values into the answer, not the addressing\.The three flat rows are the deconfound\. Their read is unchanged fromℓ=40\\ell=40down toℓ=0\\ell=0, where the agent contributes no computation at all, so the masked read recovers what was encoded rather than what was reasoned\. The hub is the one family whose answer moves withℓ\\ell, and the diagnostic rows localize the movement: at every budget the walk reaches the hub fragment \(coverage1\.001\.00\) and the store returns its full contents \(exact extraction1\.001\.00\), so the values the answer needs are present regardless ofℓ\\ell\. What the latent steps move is downstream of that output, in composing the recovered values into the answer, a property of the reader \(Section[5\.5](https://arxiv.org/html/2608.11218#S5.SS5)\) rather than of the addressing; we do not localize it further\.

## Appendix FSignature construction and negative results

#### Construction\.

A writer extracts its normalized word set locally, then maps every word to a128128\-bit tag using HMAC\-SHA256 with domain separatormasread/signature/v1and the store\-epoch key\. The public key identifier is the first128128bits of SHA\-256 of the key; the key itself is never serialized\. The immutable sidecar contains the raw enumerable tag set, its schema and key identifiers, and a digest binding those fields\. A payload identifier in turn binds the historical content hash to that sidecar digest\. Replicas reject mixed schema/key epochs, an invalid sidecar digest, or an invalid payload identity\. Key rotation therefore creates a new epoch and requires retagging\.

The set\-relative boilerplate intersection is computed after merge in tag space, not by the writer: adding an element can shrink that intersection and restore tags to existing final signatures\. A128128\-bit Bloom filter over each final tag set can accelerate membership tests \(*does this fragment contain tagtt*\), but the enumerable exact set grows the frontier; Algorithm[1](https://arxiv.org/html/2608.11218#alg1)never attempts to enumerate Bloom bits\. Matching and frontier growth are set operations and are order\-independent, while the visit order uses the existing content\-derived tie\-break\. The reported runs use exact tag overlap \(token\_overlap\); a model\-free audit over all available evaluation items verifies that substituting tags for normalized words leaves every seed score, visited set, and visit order unchanged\. Thus no model result is regenerated for this representation change\.

For the short synthetic signatures a128128\-bit Bloom filter has a negligible false\-positive rate; on long natural\-language paragraphs it is more saturated\. A false positive over\-visits: the extra fragment is isolated under its own mask, but its tags then enter the frontier and can draw in further fragments, so the cost can cascade rather than stopping at one visit\.

#### A text\-free selector does not work\.

We asked whether a fragment could be addressed with no writer\-side text at all, from its key\-value keys alone: a SimHash sketch over the fragment’s key tensors at a middle layer\. If it worked, selection would live in the same key space as the interference of Section[3](https://arxiv.org/html/2608.11218#S3)\. It does not\. Table[16](https://arxiv.org/html/2608.11218#A6.T16)compares it against the lexical signature \(n=40n=40pairs\)\.

Table 16:A text\-free selector built from the fragment’s key\-value keys, against the lexical signature \(n=40n=40pairs; sketch at layer1515, best over bit\-budgets\{16,32,64\}\\\{16,32,64\\\}\)\. The key\-sketch selects the right block only0\.450\.45to0\.780\.78of the time, and the masked read on its choice trails accordingly, where the lexical signature selects and reads at ceiling\. Addressing needs a lexical handle; opaque tags avoid disclosing the words themselves to keyless replicas while retaining equality and access\-pattern leakage \(Section[7\.1](https://arxiv.org/html/2608.11218#S7.SS1)\)\.
#### The query\-echo artifact\.

One further negative explains a difficulty that is not one\. When a fragment is encoded with the query already present, its block contains the query text, and a masked read can restate that embedded query rather than the fragment’s own content\. This is why five\-fragment stores looked hard under query\-anticipated encoding \(0\.600\.60on the chain,0\.050\.05on the hub\) and reached the ceiling once the query was removed \(Appendix[D](https://arxiv.org/html/2608.11218#A4)\)\. A sentence\-versus\-copy control localizes it: comparing a free sentence restatement, which can echo the embedded query, against a copy\-prompted restatement of the block attributes the gap to the echo rather than to a read deficit or to depth\. The paper’s canonical configuration encodes query\-blind and restates by copy prompt, so the artifact does not arise in any reported number\.

## Appendix GDeterminism and CRDT properties

This appendix states the convergence property behind Section[2](https://arxiv.org/html/2608.11218#S2)and the materialized read behind the cost claim of Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)\.

#### Convergence\.

The store is a grow\-only set of fragments keyed by content hash, and the merge is set union\. Union is commutative, associative, and idempotent, so replicas that have received the same fragments hold the same set regardless of the order or the multiplicity in which the fragments arrived, and converge once delivery is eventual; the agreement is exact up to hash collisions\. The consequence used throughout the paper is stronger than set agreement: the render of a set of fragments is*byte\-identical*under any permutation or duplication of the inputs, a determined RoPE layout rather than an order\-dependent concatenation\. That property, with its proof and its verification on the real key\-value state of Qwen3\-1\.7B \(2828layers\) and Qwen3\-4B \(3636layers\), is established in the companion work on cache merging\(Baquero and Brito,[2026](https://arxiv.org/html/2608.11218#bib.bib57)\); it is what makes the order and duplication robustness of this paper structural rather than something the read has to tolerate\.

#### The materialized read\.

The canonical layout places each fragment’s block at a determined position in the render: the first block keeps the native coordinates\[0,len\)\[0,\\text\{len\}\)it was encoded at, and each later block is rotated to begin where the previous one ends\. The offset is exactly what a query\-blind position cannot address \(Section[3](https://arxiv.org/html/2608.11218#S3)\), since the same fragment lands at a different offset in a different store\. An in\-place masked read leaves the block at its offset and decodes over the whole render, so its cost grows with the store\. A*materialized*read instead extracts the block and reverses its rotation by that offset, restoring the native coordinates near0, and reads it standalone\. Table[17](https://arxiv.org/html/2608.11218#A7.T17)runs both reads up akk\-ramp\.

Table 17:The read up akk\-ramp \(n=20n=20per cell\)\. The render grows roughly linearly with the store, from292292to23432343tokens, and the colocated read collapses\. Both masked reads stay at1\.001\.00; the materialized read attains it while decoding a fixed147147\-token block at everykk, so its cost is independent of the store size, which is the read\-cost claim of Section[5\.2](https://arxiv.org/html/2608.11218#S5.SS2)\. Both reads are at1\.001\.00over this range, so we do not observe the in\-place read degrading at larger offsets; materializing removes any such dependence by construction, since it reads at native coordinates regardless of the block’s offset in the render\.Both reads recover the target at every store size, so the materialized view is not a different mechanism but the same read relocated to fixed coordinates\. Its value is the cost: where the in\-place read attends over a render that grows with every fragment merged, the materialized read decodes a block whose length does not depend on how large the store has become\.

## Appendix HThe precision boundary

Both the failure the read repairs and the failure the read itself has are set by one thing: how lexically similar the fragments are\.

#### Interference is a lexical effect\.

The colocation interference of Section[3](https://arxiv.org/html/2608.11218#S3)is not uniform\. We read one fragment beside a single partner and vary the partner \(Table[18](https://arxiv.org/html/2608.11218#A8.T18)\)\. A partner from a different family leaves the read almost untouched \(0\.970\.97\); a partner that shares the template, or even one unit, drives it down to about0\.40\.4, and most of the errors are the partner’s value substituted for the target’s\. Interference, and therefore the need to address rather than colocate, arises precisely when fragments are lexically similar, as the evaluation families are by construction\.

Table 18:Interference as a function of partner similarity \(query\-blind read of one fragment beside one partner\)\. A dissimilar partner barely affects the read; a lexically similar one collapses it, mostly by substituting its own value\.
#### Routing recall is also lexical: thediscountboundary\.

The same dependence bounds the read from the other side\. The walk routes by shared words, so a required fragment that shares no routing token with the query or with an already\-visited fragment is never reached\. Thediscountfamily is built to contain exactly one such fragment: a store of a per\-unit price, a group\-discount rule, and a party composition, asked for the total\. The question seeds the walk on the discount\-rule and party fragments, which echo its words, but the price fragment shares no routing token and is omitted on every one of the100100items, so coverage is a fixed2/32/3\. Because the price is needed, the masked read collapses to0\.010\.01against a full\-text ceiling of1\.001\.00\. Here, unusually, the colocated read beats it, at0\.840\.84: keeping every fragment in scope preserves the price the walk cannot reach, so the addressed read’s own selectivity is the liability\. This is the deterministic worst case of the lexical\-mismatch soft spot of Section[5\.3](https://arxiv.org/html/2608.11218#S5.SS3): a routing index tolerant of paraphrase or meaning, rather than of shared tokens, would close it, and lexical routing cannot\.

## Appendix IStatistical procedures

#### Metrics\.

On the synthetic families the answer is an integer, and a cell’s accuracy is the fraction of items whose parsed, normalized answer equals the gold\. On the natural\-language sets the answer is a free\-form string, scored by the standard HotpotQA token\-levelF1F\_\{1\}and exact match; a cell reports the meanF1F\_\{1\}over its items\. Coverage is the fraction of a query’s required fragments the walk reaches, and hub extraction is the fraction of hub items whose full contents the read returns exactly\.

#### Intervals\.

Where an interval is shown, for example the bracketed intervals in the headline of Table[5](https://arxiv.org/html/2608.11218#S5.T5), it is the95%95\\%Wilson score interval for a binomial proportion\. We use the Wilson interval rather than the normal \(Wald\) approximation because several cells sit near0or11, where Wald intervals are too narrow and can leave the unit interval\. Tables without an interval report a point estimate at the sample size stated in their caption\.

#### Sample sizes\.

Each table and figure states its own per\-cellnn\. In summary: the headline isn=300n=300; the mechanism panel and the scale panel aren=40n=40pairs; the contamination sweep and the natural\-language rows aren=50n=50; the latent ablation and the read\-versus\-answer decomposition aren=100n=100; and the five\-fragment, depth, andkk\-ramp tables aren=20n=20per cell\.

#### Seeds and pooling\.

Decoding is greedy, so a run is deterministic given its data seed and the only randomness is which problems are drawn\. The headline of Table[5](https://arxiv.org/html/2608.11218#S5.T5)pools three independent data seeds \(4242,77,100100\), each drawing a fresh set of100100problems per family; the reported accuracy is computed over the pooled300300items and the Wilson interval is taken on that pooled count, so we pool the draws rather than averaging three per\-seed accuracies\. All other cells use the single data seed4242at the sample size given in their caption\.

## Appendix JDatasets and reproducibility

This appendix gives the store constructions and the exact read configuration behind every number in the paper\.

#### Synthetic stores\.

All four families are generated bydata\_partitioned\_k3\.py, three fragments each, with the numbers and content words drawn at random per item; Table[4](https://arxiv.org/html/2608.11218#S5.T4)shows one instance of each\. In every family the three fragment texts are produced without the question, which is a separate field, so the encode is query\-blind\.*Chain*\(unit conversion\): the fragments state1​big=K​mid1\\,\\text\{big\}=K\\,\\text\{mid\},1​mid=J​small1\\,\\text\{mid\}=J\\,\\text\{small\}, and a quantityNN\(a multiple ofK​JKJ\) in the small unit; the answer isN/\(K​J\)N/\(KJ\)\.*Pipeline*\(affine\): two machinesx↦P1​x\+Q1x\\mapsto P\_\{1\}x\+Q\_\{1\}andy↦P2​y\+Q2y\\mapsto P\_\{2\}y\+Q\_\{2\}and a starting countX0X\_\{0\}; the answer isP2​\(P1​X0\+Q1\)\+Q2P\_\{2\}\(P\_\{1\}X\_\{0\}\+Q\_\{1\}\)\+Q\_\{2\}\.*Symmetric*\(constraint system\): a ratioA=N​BA=NB, a differenceC=B−KC=B\-K, and a totalA\+B\+CA\+B\+C, solved jointly forAA\.*Hub*\(indexed lookup\): two rate tables, a colour\-to\-points map and a size\-to\-multiplier map, and one inventory fragment listing several \(colour, size, count\) items; the answer sumspoints⋅mult⋅count\\text\{points\}\\cdot\\text\{mult\}\\cdot\\text\{count\}over the items\. The headline of Table[5](https://arxiv.org/html/2608.11218#S5.T5)pools three data seeds \(4242,77,100100\),n=100n=100items per family per seed\.

#### Natural\-language stores\.

The two real\-text sources are built to the same interface: an item’s supporting paragraphs become the store’s fragments and its remaining paragraphs are held as distractors, of which we merge indd\. HotpotQA uses thedistractorvalidation split, keeping bridge questions with exactly two supporting paragraphs \(its∼8\{\\sim\}8context paragraphs are the distractors\)\. MuSiQue usesbdsaglam/musique\(answerable, validation\), keeping the 2\-hop subset with two supporting paragraphs \(its∼18\{\\sim\}18non\-supporting paragraphs are the distractors, a harder locate test by construction\)\. Both are scored by the standard HotpotQA token\-levelF1F\_\{1\}and exact match, on free\-form string answers\. We reportd=0d=0\(supporting only\) andd=8d=8\.

#### Model and read\.

The main results use Qwen3\-1\.7B\(Yang and others,[2025](https://arxiv.org/html/2608.11218#bib.bib70)\)with greedy decoding\. Fragments are encoded canonically and query\-blind, each with4040latent reasoning steps \(varied only in Appendix[E](https://arxiv.org/html/2608.11218#A5)\); the store merges by content hash into the byte\-identical render of Section[2](https://arxiv.org/html/2608.11218#S2)\. The read is the canonical configuration throughout: route by the lexical signature \(token\_overlap, the exact opaque tag set; the128128\-bit Bloom filter is an accelerator only, Appendix[F](https://arxiv.org/html/2608.11218#A6)\), decode each visited block under its mask into a copy\-prompted restatement of at most6464tokens, and compose\. The6464\-token budget is verified non\-truncating against a256256\-token rerun \(Section[5\.3](https://arxiv.org/html/2608.11218#S5.SS3)\)\. Cross\-model \(Llama\) and larger scales \(4B, 8B\) are in Appendix[C](https://arxiv.org/html/2608.11218#A3)and Appendix[B](https://arxiv.org/html/2608.11218#A2)\.

The Llama replication ran under Python 3\.11\.2, Transformers 4\.55\.4,huggingface\_hub0\.36\.2, Tokenizers 0\.21\.4, and PyTorch 2\.5\.1\+cu124 on Tesla V100\-SXM2\-32GB GPUs\. Exact model revisions are reported in Appendix[C](https://arxiv.org/html/2608.11218#A3); cache evidence and configuration\-file checksums are recorded in the accompanying results manifest and snapshot report\.

#### Commands\.

The end\-to\-end tables come fromscripts/b2\_self\_extract\.py, run from theLatentMASdirectory\. The designated mask andkk\-ramp diagnostics come fromscripts/probe\_block\_masked\.py, and the illustrative anomaly probe and routed fixed\-rule probe are the separate scripts named in Appendix[A](https://arxiv.org/html/2608.11218#A1)\. HMAC tag substitution is verified model\-free to leave exact routing unchanged; the key value therefore does not change these results when writer and query client agree\. The headline, for a single seed:

```
export MASREAD_SIGNATURE_KEY_HEX=<64-or-more-hex-characters>
python scripts/b2_self_extract.py --model_name Qwen/Qwen3-1.7B \
  --source k3 --families NEONYM,RELAY,CONSTRAINT,LOOKUP \
  --n_items 100 --data_seed 42 --canonical --query_blind \
  --extract_from masked_merged --selector token_overlap \
  --signature_encoding hmac --schedule traversal --restate_mode copy
```

#### Artifact availability\.

The implementation, frozen result records, provenance evidence, environment metadata, and CPU\-only verification tools are archived in the MaSRead reproducibility artifact at[https://doi\.org/10\.5281/zenodo\.21459415](https://doi.org/10.5281/zenodo.21459415)\. The archive does not redistribute model weights or raw dataset distributions; selected result records containing HotpotQA or MuSiQue excerpts retain the corresponding dataset attribution and license notices\.

## References

- C\. Baquero and L\. Brito \(2026\)Cache merging as a convergent replicated state for multi\-agent latent reasoning\.Note:arXiv:2607\.01308Cited by:[Appendix G](https://arxiv.org/html/2608.11218#A7.SS0.SSS0.Px1.p1.2),[§2\.2](https://arxiv.org/html/2608.11218#S2.SS2.p3.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- B\. H\. Bloom \(1970\)Space/time trade\-offs in hash coding with allowable errors\.Communications of the ACM13\(7\),pp\. 422–426\.Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px3.p1.1)\.
- D\. Cash, P\. Grubbs, J\. Perry, and T\. Ristenpart \(2015\)Leakage\-abuse attacks against searchable encryption\.InProceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security,pp\. 668–679\.External Links:[Document](https://dx.doi.org/10.1145/2810103.2813700)Cited by:[§4](https://arxiv.org/html/2608.11218#S4.p7.1)\.
- R\. Curtmola, J\. Garay, S\. Kamara, and R\. Ostrovsky \(2011\)Searchable symmetric encryption: improved definitions and efficient constructions\.Journal of Computer Security19\(5\),pp\. 895–934\.External Links:[Document](https://dx.doi.org/10.3233/JCS-2011-0426)Cited by:[§4](https://arxiv.org/html/2608.11218#S4.p7.1)\.
- Z\. Du, R\. Wang, H\. Bai, Z\. Cao, X\. Zhu, Y\. Cheng, B\. Zheng, W\. Chen, and H\. Ying \(2025\)Enabling agents to communicate entirely in latent space\.arXiv preprint\.Note:arXiv:2511\.09149Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.
- M\. Fu, X\. Xue, Y\. Li, Z\. He, S\. Huang, X\. Qu, Y\. Cheng, and Y\. Yang \(2026\)LatentMem: customizing latent memory for multi\-agent systems\.Note:arXiv:2602\.03036Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px4.p1.1)\.
- T\. Fu, Z\. Min, H\. Zhang, J\. Yan, G\. Dai, W\. Ouyang, and Y\. Wang \(2025\)Cache\-to\-cache: direct semantic communication between large language models\.Note:arXiv:2510\.03215; ICLR 2026Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.
- R\. Gillespie \(2026\)Conflict\-free replicated data types for neural network model merging: a two\-layer architecture enabling CRDT\-compliant model merging across 26 strategies\.Note:arXiv:2605\.19373Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- I\. Gim, G\. Chen, S\. Lee, N\. Sarda, A\. Khandelwal, and L\. Zhong \(2024\)Prompt cache: modular attention reuse for low\-latency inference\.InMachine Learning and Systems \(MLSys\),Note:arXiv:2311\.04934Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- A\. Grattafioriet al\.\(2024\)The llama 3 herd of models\.External Links:2407\.21783,[Link](https://arxiv.org/abs/2407.21783)Cited by:[Appendix C](https://arxiv.org/html/2608.11218#A3.p1.2)\.
- J\. He, R\. H\. Bai, S\. Williamson, J\. Z\. Pan, N\. Jaitly, and Y\. Zhang \(2025\)CLaRa: bridging retrieval and generation with continuous latent reasoning\.Note:arXiv:2511\.18659Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- Y\. Hou, Z\. Chen, T\. Wan, and Z\. Qin \(2026\)FlashMem: distilling intrinsic latent memory via computation reuse\.Note:arXiv:2601\.05505Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px4.p1.1)\.
- J\. Hu, W\. Huang, W\. Wang, H\. Wang, T\. Hu, Q\. Zhang, H\. Feng, X\. Chen, Y\. Shan, and T\. Xie \(2025\)EPIC: efficient position\-independent caching for serving large language models\.Note:ICML 2025External Links:2410\.15332,[Link](https://arxiv.org/abs/2410.15332)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- H\. Jin, K\. Peng, Y\. Yu, X\. Yuan, and H\. Wang \(2026\)Agent primitives: reusable latent building blocks for multi\-agent systems\.arXiv preprint\.Note:arXiv:2602\.03695Cited by:[§1](https://arxiv.org/html/2608.11218#S1.p1.1),[§1](https://arxiv.org/html/2608.11218#S1.p3.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.
- W\. Kwon, Z\. Li, S\. Zhuang, Y\. Sheng, L\. Zheng, C\. Yu, J\. E\. Gonzalez, H\. Zhang, and I\. Stoica \(2023\)Efficient memory management for large language model serving with PagedAttention\.InSymposium on Operating Systems Principles \(SOSP\),Note:arXiv:2309\.06180Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- P\. Lewiset al\.\(2020\)Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.InNeurIPS,Note:arXiv:2005\.11401Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- Y\. Liet al\.\(2024\)SnapKV: LLM knows what you are looking for before generation\.arXiv preprint\.Note:arXiv:2404\.14469Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- L\. Liu, J\. Pfeiffer, J\. Wu, J\. Xie, and A\. Szlam \(2025\)Deliberation in latent space via differentiable cache augmentation\.InInternational Conference on Machine Learning \(ICML\),Note:arXiv:2412\.17747Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px4.p1.1)\.
- N\. F\. Liu, K\. Lin, J\. Hewitt, A\. Paranjape, M\. Bevilacqua, F\. Petroni, and P\. Liang \(2024\)Lost in the middle: how language models use long contexts\.Transactions of the Association for Computational Linguistics12,pp\. 157–173\.External Links:[Link](https://aclanthology.org/2024.tacl-1.9/),[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00638)Cited by:[§5\.2](https://arxiv.org/html/2608.11218#S5.SS2.p2.5)\.
- D\. Ma, Y\. Wang, and T\. Lan \(2024\)Block\-attention for efficient prefilling\.Note:arXiv:2409\.15355; ICLR 2025Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- Meta AI \(2024\)Llama 3\.2: revolutionizing edge AI and vision with open, customizable models\.Note:Meta AI blogExternal Links:[Link](https://ai.meta.com/blog/llama-3-2-connect-2024-vision-edge-mobile-devices/)Cited by:[Appendix C](https://arxiv.org/html/2608.11218#A3.p1.2)\.
- P\. Miao and M\. Chase \(2020\)Private set intersection in the internet setting from lightweight oblivious PRF\.InAdvances in Cryptology – CRYPTO 2020,External Links:[Link](https://eprint.iacr.org/2020/729)Cited by:[§4](https://arxiv.org/html/2608.11218#S4.p7.1)\.
- A\. Mohtashami and M\. Jaggi \(2023\)Random\-access infinite context length for transformers\.InAdvances in Neural Information Processing Systems 36 \(NeurIPS 2023\),External Links:[Link](http://papers.nips.cc/paper_files/paper/2023/hash/ab05dc8bf36a9f66edbff6992ec86f56-Abstract-Conference.html)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px3.p1.1)\.
- N\. Preguiça, C\. Baquero, and M\. Shapiro \(2018\)Conflict\-free replicated data types CRDTs\.Note:arXiv:1805\.06358; Springer Encyclopedia entryCited by:[§2\.2](https://arxiv.org/html/2608.11218#S2.SS2.p2.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- H\. Ramsauer, B\. Schäfl, J\. Lehner, P\. Seidl, M\. Widrich, L\. Gruber, M\. Holzleitner, T\. Adler, D\. P\. Kreil, M\. K\. Kopp, G\. Klambauer, J\. Brandstetter, and S\. Hochreiter \(2021\)Hopfield networks is all you need\.In9th International Conference on Learning Representations, ICLR 2021,External Links:[Link](https://openreview.net/forum?id=tL89RnzIiCd)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px3.p1.1)\.
- N\. Ratner, Y\. Levine, Y\. Belinkov, O\. Ram, I\. Magar, O\. Abend, E\. Karpas, A\. Shashua, K\. Leyton\-Brown, and Y\. Shoham \(2023\)Parallel context windows for large language models\.InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),Toronto, Canada,pp\. 6383–6402\.External Links:[Link](https://aclanthology.org/2023.acl-long.352/),[Document](https://dx.doi.org/10.18653/v1/2023.acl-long.352)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px3.p1.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px5.p1.1)\.
- M\. Shapiro, N\. Preguiça, C\. Baquero, and M\. Zawirski \(2011\)Conflict\-free replicated data types\.InSymposium on Self\-Stabilizing Systems \(SSS\),Note:Also INRIA RR\-7506Cited by:[§2\.2](https://arxiv.org/html/2608.11218#S2.SS2.p2.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px6.p1.1)\.
- H\. Trivedi, N\. Balasubramanian, T\. Khot, and A\. Sabharwal \(2022\)MuSiQue: multihop questions via single\-hop question composition\.Transactions of the Association for Computational Linguistics10,pp\. 539–554\.External Links:[Link](https://aclanthology.org/2022.tacl-1.31/),[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00475)Cited by:[§5\.3](https://arxiv.org/html/2608.11218#S5.SS3.p1.5)\.
- S\. Wang, J\. Chen, Y\. Pan, H\. Huang, Y\. Hao, X\. Zou, W\. Xia, W\. Zhang, C\. Qiu, and P\. Wang \(2026\)ProphetKV: user\-query\-driven selective recomputation for efficient kv cache reuse in retrieval\-augmented generation\.External Links:2602\.02579,[Link](https://arxiv.org/abs/2602.02579)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- Z\. Wang, B\. Jin, Z\. Yu, and M\. Zhang \(2024\)Model tells you where to merge: adaptive KV cache merging for LLMs on long\-context tasks\.Note:arXiv:2407\.08454Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- Y\. Wu, M\. N\. Rabe, D\. Hutchins, and C\. Szegedy \(2022\)Memorizing transformers\.InThe Tenth International Conference on Learning Representations, ICLR 2022,External Links:[Link](https://openreview.net/forum?id=TrjbxzRcnf-)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px3.p1.1)\.
- G\. Xiao, Y\. Tian, B\. Chen, S\. Han, and M\. Lewis \(2024\)Efficient streaming language models with attention sinks\.InInternational Conference on Learning Representations \(ICLR\),Note:arXiv:2309\.17453Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- A\. Yanget al\.\(2025\)Qwen3 technical report\.External Links:2505\.09388,[Link](https://arxiv.org/abs/2505.09388)Cited by:[Appendix J](https://arxiv.org/html/2608.11218#A10.SS0.SSS0.Px3.p1.5)\.
- J\. Yang, B\. Hou, W\. Wei, Y\. Bao, and S\. Chang \(2025a\)KVLink: accelerating large language models via efficient kv cache reuse\.Note:NeurIPS 2025External Links:2502\.16002,[Link](https://arxiv.org/abs/2502.16002)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- X\. Yang, T\. Chen, and B\. Chen \(2025b\)APE: faster and longer context\-augmented generation via adaptive parallel encoding\.Note:ICLR 2025External Links:2502\.05431,[Link](https://arxiv.org/abs/2502.05431)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- X\. Yang, J\. Zou, R\. Pan, R\. Qiu, P\. Lu, S\. Diao, J\. Jiang, H\. Tong, T\. Zhang, M\. J\. Buehler, J\. He, and J\. Zou \(2026\)Recursive multi\-agent systems\.Note:arXiv:2604\.25917Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.
- Z\. Yang, P\. Qi, S\. Zhang, Y\. Bengio, W\. W\. Cohen, R\. Salakhutdinov, and C\. D\. Manning \(2018\)HotpotQA: a dataset for diverse, explainable multi\-hop question answering\.InEMNLP,Cited by:[§5\.3](https://arxiv.org/html/2608.11218#S5.SS3.p1.5)\.
- J\. Yao, H\. Li, Y\. Liu, S\. Ray, Y\. Cheng, Q\. Zhang, K\. Du, S\. Lu, and J\. Jiang \(2025\)CacheBlend: fast large language model serving for rag with cached knowledge fusion\.Note:EuroSys 2025External Links:2405\.16444,[Link](https://arxiv.org/abs/2405.16444)Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- X\. Yu, Z\. Chen, Y\. He, T\. Fu, G\. Dong, C\. Yang, C\. Xu, Y\. Ma, X\. Hu, Z\. Cao, J\. Xu, G\. Zhang, J\. Tao, J\. Zhang, S\. Ma, K\. Feng, H\. Huang, Y\. Li, R\. Chen, H\. Wang, C\. Wu, Z\. Su, X\. Xu, K\. Yao, K\. Wang, C\. Gao, Y\. Liao, R\. Huang, T\. Jin, Z\. Xue, C\. Tan, J\. Zhang, W\. Ren, Y\. Fu, Y\. Liu, Y\. Wang, X\. Yue, Y\. Jiang, and S\. Yan \(2026\)The latent space: foundation, evolution, mechanism, ability, and outlook\.Note:arXiv:2604\.02029Cited by:[§1](https://arxiv.org/html/2608.11218#S1.p1.1),[§6](https://arxiv.org/html/2608.11218#S6.p1.1)\.
- G\. Zhang, M\. Fu, and S\. Yan \(2025a\)MemGen: weaving generative latent memory for self\-evolving agents\.Note:arXiv:2509\.24704Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px4.p1.1)\.
- Y\. Zhang, B\. Tang, T\. Ju, S\. Duan, and G\. Liu \(2025b\)Do latent tokens think? a causal and adversarial analysis of chain\-of\-continuous\-thought\.Note:arXiv:2512\.21711Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px5.p1.1)\.
- Z\. Zhang, R\. Li, X\. Zhao, Y\. Zhang, W\. Wang, X\. Chen, and T\. Chua \(2026\)NextMem: towards latent factual memory for LLM\-based agents\.Note:arXiv:2603\.15634Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px4.p1.1)\.
- Z\. Zhanget al\.\(2023\)H2O: heavy\-hitter oracle for efficient generative inference of large language models\.InNeurIPS,Note:arXiv:2306\.14048Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px2.p1.1)\.
- Y\. Zheng, Z\. Zhao, Z\. Li, Y\. Xie, M\. Gao, L\. Zhang, and K\. Zhang \(2025\)Thought communication in multiagent collaboration\.Note:arXiv:2510\.20733; NeurIPS 2025 SpotlightCited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.
- H\. Zhu, S\. Hao, Z\. Hu, J\. Jiao, S\. Russell, and Y\. Tian \(2025\)Reasoning by superposition: a theoretical perspective on chain of continuous thought\.Note:arXiv:2505\.12514Cited by:[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px5.p1.1)\.
- J\. Zou, X\. Yang, R\. Qiu, G\. Li, K\. Tieu, P\. Lu, K\. Shen, H\. Tong, Y\. Choi, J\. He, J\. Zou, M\. Wang, and L\. Yang \(2025\)Latent collaboration in multi\-agent systems\.arXiv preprint\.Note:arXiv:2511\.20639Cited by:[§1](https://arxiv.org/html/2608.11218#S1.p1.1),[§6](https://arxiv.org/html/2608.11218#S6.SS0.SSS0.Px1.p1.1)\.