aisecurity.ninja

Kernel-Managed Shared Memory for System-Wide Personalization

Ryan Lum, Yongfeng Zhang

Published Sep 9, 2026 ยท arXiv:2609.10144

cs.AIcs.LG

The paper proposes kernel-managed shared memory for multi-agent AI systems, where agents write structured tagged memories but a system kernel centrally handles retrieval, privacy policy, and prompt injection so personalization learned by one agent can safely benefit others. The neat bit is showing that this OS-like memory layer gets close to full-context personalization with much shorter prompts and lower latency, substantially outperforming unmanaged or vanilla RAG-style memory across several models, though the evidence is still bounded to one AIOS implementation and benchmark setup, with a small model-specific gap versus brute-force context concatenation and limited visibility into real-world privacy/security failure modes.

Abstract

AI systems become more useful when they can adapt to the people using them, but in multi-agent systems, useful context learned by one agent often remains unavailable to others. We present kernel-managed shared memory, a system-level abstraction in which specialized agents write structured, tagged memories while the agent-system kernel, not individual agents, governs retrieval, privacy enforcement, and prompt injection. We implement and evaluate this design on AIOS and compare it against three alternatives across three assistant models (GPT-4o, Llama-3.1:8B, Qwen-2.5:7B) and 1,800 total trials. Against an unmanaged external memory backend (Mem0) using identical underlying storage, kernel-managed retrieval and injection improve personalization scores by 2.4-4.0 points on a 5-point scale (e.g., 1.05 to 4.69 profile usage on GPT-4o), with every comparison significant at p < 10^-18. Against standard retrieval-augmented injection, gains are similarly large and consistent across all three models. Against full, unfiltered context concatenation, a soft ceiling on available context rather than on response quality, kernel-managed injection statistically matches performance on two of three models and shows a small, model-specific deficit on the third, while using substantially shorter prompts: end-to-end latency is 15-61% lower across all three models, with corresponding reductions in per-call token usage and inference cost. These results indicate that centralizing memory management in the agent-system kernel, rather than leaving retrieval and privacy enforcement to individual agents, delivers most of the personalization benefit of unconstrained context at a fraction of its cost.