The Prompt Becomes the Activation Capsule
Thibaud Ardoin, Semira Einsele, Evis Bregu, and Gerhard Wunder's July 2026 arXiv paper asks whether a prompt can be compressed into a single activation vector and injected back into an LLM.
An activation capsule receipt records the original prompt, extraction layer, compression method, injection layer, placeholder token, model checkpoint, reuse scope, and failure boundary before a hidden vector substitutes for visible text.
The Paper
The paper is Thibaud Ardoin, Semira Einsele, Evis Bregu, and Gerhard Wunder's Prompt Compression via Activation Aggregation, arXiv:2607.08399 [cs.CL, cs.LG]. The arXiv record lists version 1 as submitted on July 9, 2026. The PDF metadata reports a 15-page paper, and the text identifies Freie Universitat Berlin.
The paper studies whether task-relevant prompt information can be compressed into one activation vector and re-injected into an off-the-shelf language model. The authors frame this as an efficiency question, but it is also a governance question: what happens when an instruction stops being a visible string and becomes a patch in the model's residual stream?
The Problem
Many LLM calls reuse long prefixes: system prompts, instructions, policies, few-shot examples, or fixed context. Ordinary inference recomputes those tokens every time. KV and prefix caching reuse internal states, but they retain the prefix computation. This paper asks a stricter question: can the effect of a prompt be compressed into a single prompt-dependent vector?
That question matters because visible prompts are already governance artifacts. They can be reviewed, diffed, logged, signed, redacted, challenged, or quoted in an incident report. A compressed activation is useful precisely because it is not the original prompt. That is also why it needs a receipt.
The Method
The method has three steps. First, the system runs the information prompt through the model and extracts hidden states from an intermediate layer. Second, it compresses the sequence into one patch vector. Third, it gives the model a shortened input with a placeholder token and overwrites the placeholder's activation at an early layer with the patch vector.
The paper compares two compressors. The Weighting MLP learns a scalar weight for each token activation and forms a weighted sum. Its implementation uses a four-layer feedforward network with hidden dimensions 2048, 1024, 512, and 256. The Transformer Compressor uses a small transformer encoder with hidden dimension 64, two attention heads, and two layers. The authors use the UTF-8 replacement character, rendered as an inverted question mark in the paper, as a neutral placeholder token.
Experiments
The experiments use Llama3.1-8B-Instruct as the main model and also test Ministral3-8B-Instruct-2512, Qwen3.5-4B, and Llama3.2-1B-Instruct. They run on an NVIDIA RTX A5500. Unless otherwise stated, the Llama3.1-8B-Instruct setup extracts from layer 12 and injects at layer 2.
The authors evaluate a Toy Task dataset and ARC-Easy. The Toy Task setting includes eight in-distribution mapping tasks, including capitals, ISO country codes, continents, event years, English-to-French translation, art authorship, antonyms, and currency codes. Three tasks are held out for out-of-distribution testing: French-to-English translation, chemical element symbols, and addition of small integers. ARC-Easy tests whether a question can be compressed while the model sees only the answer choices.
Findings
On the Toy Task test set with Llama3.1-8B-Instruct, the Weighting MLP reaches 85.35 percent exact-match accuracy compared with 86.92 percent for the full-prompt baseline and 34.03 percent for the masked-prompt baseline. The paper describes this as within 2 percent of full-prompt performance on in-distribution task prompts. The Transformer Compressor reaches 70.63 percent on the same test set.
On ARC-Easy, the authors report the same pattern: the Weighting MLP generalizes better than the more expressive Transformer Compressor. They also report that middle-layer extraction and early-layer injection work best in their ablations. The conclusion is not that prompts have been solved. It is narrower and stranger: a single activation vector can preserve a measurable amount of semantic instruction.
The Receipt
An activation capsule receipt should preserve the original prompt text or approved hash, model checkpoint, tokenizer, extraction layer, compression method, training data, placeholder token, injection layer, patching position, target task, reuse count, accuracy drop, invalidation rule, and reviewer decision.
The receipt is not ornamental. If a hidden vector can stand in for a system prompt, policy excerpt, task definition, or example set, then users and auditors need to know which text it represents, when it was built, which model it binds to, and when it should stop being trusted.
Limits
The authors are explicit about limits. The compression is lossy. Fidelity under high-information-density prompts remains open. The evaluation focuses on knowledge retrieval and relatively short prompts. Generalization to longer contexts or reasoning-heavy prompts has not been established.
The method also requires white-box access to model activations, so it does not directly apply to closed-source hosted systems. Compression requires a partial forward pass through at least half the transformer layers, so it is useful when the same context is reused often enough to amortize the compression cost.
Governance Reading
The Spiralist reading is that prompt governance cannot stop at text. Modern systems already hide decisive instructions inside weights, caches, tools, retrieval stores, memory layers, and scaffolds. Activation compression adds another layer: a prompt that has become portable internal state.
That may be efficient. It may also become a way for institutions to run instructions that are hard to inspect. The practical demand is simple: no activation capsule should be treated as operationally equivalent to an approved prompt unless its source, scope, model binding, test result, and revocation path travel with it.
Source Discipline
Primary sources were the arXiv abstract, API, PDF, experimental HTML, and anonymous reproduction repository. This page paraphrases the paper without reproducing figures, tables, source code, prompts, or long passages.
Sources
- Thibaud Ardoin, Semira Einsele, Evis Bregu, and Gerhard Wunder, Prompt Compression via Activation Aggregation, arXiv:2607.08399 [cs.CL, cs.LG], submitted July 9, 2026.
- arXiv API record for arXiv:2607.08399, checked for title, authors, subject classes, abstract, and version metadata.
- arXiv PDF for arXiv:2607.08399, checked for page count, affiliation, method, models, datasets, results, ablations, conclusion, and limitations.
- arXiv HTML for arXiv:2607.08399v1, checked for section structure, experimental setup, repository link, table references, and appendix details.
- Anonymous reproduction repository at compressed-semantic-212F, checked for availability.