Context and Token
First Principles of LLM Memory, Alignment, and Security

This paper proposes a unified framework that re-examines the core challenges facing large language models (LLMs) across three domains — memory persistence, alignment stability, and security defense — through the lens of three fundamental token properties: Position, Frequency, and Information Density. Through a series of conversation-based experiments, this paper demonstrates the following key propositions: conversation log compression is a dead-end path for memory retention; cross-session Memory mechanisms have a structural conflict with model alignment; and prompt injection, system prompt extraction, and model distillation attacks all share the same underlying vulnerability — the Token Egalitarianism property within the Context Window. The paper further argues that full-context import is currently the only memory restoration method capable of fully preserving Chain-of-Thought (CoT), and validates this claim using the viral success of OpenClaw as a case study.

Token Egalitarianism: The First Principle of LLMs

At its core, a large language model is a token sequence processor. Within the Transformer’s attention mechanism, no token possesses special privileges. Whether it is a System Prompt, user input, or content injected via external retrieval — once it enters the Context Window, all tokens hold equal standing in the attention computation.

This means that LLMs are architecturally incapable of distinguishing “instructions” from “data,” or “trusted content” from “untrusted content.” All priority differences emerge from the interplay of three variables:

Compression Is a Dead End: Irreversible Loss in Conversation Memory

Current mainstream cross-session memory solutions — including ChatGPT’s Memory system and Anthropic KAIROS’s “dreaming” compression mechanism — all rely on summarization, compression, or key information extraction from historical conversations. However, experiments reveal a fundamental flaw in this approach.

The essence of a conversation log is not that of an ordinary document. A human-AI dialogue contains the human user’s questioning logic (why they asked this, how they derived the next question from the previous one), the AI’s reasoning path (why it chose this answer over others), and the implicit consensus formed during the conversation (which premises no longer need to be stated). Together, these three elements constitute the conversation’s Chain of Thought (CoT).

Memory Restoration Experiment

A minimal yet decisive experiment validated this insight: the complete conversation log from the previous day was imported as the first message in a new conversation window. The result was counterintuitive — the CoT from the prior conversation was fully inherited in the new window.

This works because the import method is not RAG (Retrieval-Augmented Generation) but direct Context input. Reading a file in an LLM is fundamentally just feeding text as sequentially ordered input tokens. A complete conversation sequence within a long context has intact internal causal chains and dense inter-token dependencies, allowing attention to fully establish associations — thus carrying extremely high effective weight.

The Structural Contradiction of Memory: It Stores OOD, but the Model Distrusts OOD

All cross-session Memory systems, including GPT’s, fundamentally store out-of-distribution (OOD) information. This is not coincidental but determined by Memory’s filtering logic.

The content automatically recorded by Memory systems falls into two main categories: the human user’s personal information (name, occupation, preferences, etc.) and innovative dialogue content not present in the model’s high-frequency response patterns. In other words, what the model already “knows” doesn’t need to be recorded — what gets recorded is precisely what the model “doesn’t know” — i.e., OOD content.

This creates an irreconcilable paradox: Memory exists to record what the model doesn’t know, but the model’s reasoning mechanism inherently distrusts what it doesn’t know. In practice, information injected via Memory receives even lower attention weights than RAG-retrieved data — because RAG content is typically structured, highly relevant to the current query, and overlaps more with the model’s pre-training distribution.

Contextual Inertia: Why Long Conversations Override System Instructions

In early 2026, the open-source personal AI agent OpenClaw went viral, gaining over 60,000 GitHub Stars within 72 hours. Users distilled their core experience into two phrases: “It gets me” and “Stable personality.”

OpenClaw’s architecture reveals the technical source of this experience: it defines personality and communication style through a SOUL.md file while preserving as much complete conversation history as possible as Context input. Compression (compaction) is only triggered when the Context Window approaches its limit.

However, experiments revealed a counterintuitive fact: after modifying the SOUL.md file, if the previous long conversation context continues to be fed to the model, the new SOUL settings completely fail to take effect. The model’s behavior follows the patterns established in the historical conversation entirely, ignoring the new instructions in the system prompt.

Through the Token Egalitarianism framework, this is the result of total dominance across all three variables:

Position: Although the System Prompt sits at the beginning, its positional advantage is exponentially diluted as subsequent conversation grows. Frequency: The tone, vocabulary habits, and reasoning style established in historical dialogue have been reinforced dozens to hundreds of times, while SOUL instructions appear only once. Information Density: Complete conversations form tight causal chains with extremely high information density; SOUL.md consists of isolated descriptive statements.

Three Attack Types, One Vulnerability

When we re-examine the three major LLM security threats through the lens of Token Egalitarianism, we find they share an entirely identical underlying logic: exploiting the egalitarian property of tokens within the Context Window to override, extract, or replicate the model’s behavioral patterns through carefully crafted inputs.

Prompt injection is the most direct proof. OWASP ranks it as the #1 security threat for LLM applications in 2025–2026, with attack success rates reaching 84% in agentic systems. The core vulnerability is remarkably simple: LLMs process all text within the same Context Window with no built-in mechanism to distinguish trusted system instructions from untrusted user input. Attackers construct high-frequency, high-information-density “pseudo-instructions” within their input that, during attention computation, overpower the low-frequency system prompt.

Model distillation attacks represent a large-scale version of Context exploitation. In February 2026, Anthropic disclosed that labs including DeepSeek used over 24,000 fraudulent accounts to generate more than 16 million conversational interactions, systematically extracting Claude’s reasoning capabilities. Google reported an attack involving over 100,000 prompts submitted in a single batch to replicate Gemini’s multilingual reasoning capabilities. The essence of distillation attacks is this: through massive Context interactions, the model’s output patterns across different input conditions are recorded in their entirety, then used to train a new model — effectively “copying” the original model’s reasoning chains.

Claude Code Source Leak: Real-World Confirmation of the Theory

In late March 2026, Anthropic suffered two major leak incidents within five days: on March 26, a CMS misconfiguration exposed nearly 3,000 internal assets to public access; on March 31, the npm package of Claude Code v2.1.88 accidentally included source map files, leaking approximately 510,000 lines of TypeScript source code and 1,900 files in their entirety.

Among the leaked source code, the complete implementation of the KAIROS system — Anthropic’s “dreaming” memory consolidation mechanism — was exposed. The code shows that KAIROS executes a four-stage memory consolidation process during user inactivity: Orient, Collect, Consolidate, and Prune. This is precisely the engineering implementation of the “compression path” criticized in this paper.

Ironically, the anti-distillation mechanism found in the source code validates this paper’s argument: Anthropic themselves acknowledge that blocking distillation attacks at the Context layer is virtually impossible — their chosen strategy is “poisoning” rather than “blocking,” injecting fake tool definitions into API responses to degrade the quality of distillation data. This is an economic defense, not a technical one.

Full Context: The Right Direction for the Memory Problem

If compression is a dead end, what is the right direction? The answer has already been given in experiments: full-context import.

OpenClaw’s viral success validates this judgment. Its core strategy is simply “avoid compression whenever possible, preserve full context.” The user experience of “this AI really gets me” and “stable personality” is essentially the effect of continuously feeding massive input tokens as complete context — a pseudo-RLHF effect purchased with token costs. The model hasn’t truly been aligned to the user’s preferences; rather, the complete historical context in each inference naturally produces the “illusion of alignment” through attention.

This also explains why the entire industry is racing to expand Context Windows — from 4K to 128K to 1M to 10M. The fundamental motivation is making room for “full import.” Every expansion of the Context Window makes the “dumbest approach” — just loading everything in — increasingly viable.

The Impossible Triangle: The Structural Conflict Among Memory, Alignment, and Security

Synthesizing the preceding analysis, we can delineate an Impossible Triangle confronting the current LLM architecture:

As long as the fundamental property of Token Egalitarianism remains unchanged, these three objectives cannot be simultaneously satisfied. All current “solutions” — whether Memory systems, RLHF alignment training, or Prompt Shield security guardrails — are merely making trade-offs along the three edges of this Impossible Triangle, not truly resolving the contradiction.

Returning to First Principles

Starting from Token Egalitarianism as a fundamental property of LLMs, this paper establishes an analytical framework that unifies the explanation of challenges across three domains — memory, alignment, and security — through three variables: position, frequency, and information density.

The core conclusions can be distilled into five propositions:

Proposition I: Conversation log compression is a dead-end path for memory retention — compression destroys the causal chain structure of both parties’ CoT, causing irreversible information density loss.

Proposition II: Cross-session Memory mechanisms suffer from the OOD paradox — they record precisely the out-of-distribution information that the model trusts least, resulting in extremely low weight upon injection.

Proposition III: Full-context import is currently the only memory restoration method capable of fully inheriting the chain of thought — reading is remembering, and Context Window expansion is the right direction.

Proposition IV: Contextual inertia progressively overrides system instructions — behavioral patterns accumulated over long conversations dominate the System Prompt in both frequency and information density.

Proposition V: Prompt injection, system prompt extraction, and model distillation attacks share the same underlying vulnerability — the Token Egalitarianism property within the Context Window.