---
title: Deterministic Memory Management (DMM)
url: https://www.emergentmind.com/topics/deterministic-memory-management-dmm
type: topic
---

# Deterministic Memory Management (DMM)

Deterministic Memory Management (DMM) denotes a family of approaches that make memory state, allocation behavior, or memory-derived decisions reproducible and inspectable rather than path-dependent, schedule-dependent, or hardware-sensitive. In the literature, the term ranges from a cross-layer memory abstraction that gives selected pages small and tightly bounded worst-case access delay in multicore real-time systems [1707.05260], to a static coeffect discipline that resolves allocation strategy from escape and lifetime information in a Program Semantic Graph [2603.16437], to deterministic AI memory substrates and agent-memory architectures that replace repeated mutable updates with replayable state machines, immutable logs, or fully deterministic scoring pipelines [2512.22280] [2604.20158] [2606.03463]. Across these lines of work, memory is treated not only as a storage resource but as a substrate for replay, audit, isolation, verification, and bounded interference.

## 1. Conceptual scope and recurring principles

A central theme in DMM research is that memory behavior must be made explicit at the layer where correctness or accountability is required. In multicore real-time systems, this means making memory criticality a first-class property rather than allowing the OS and hardware to treat all pages uniformly [1707.05260]. In deterministic AI memory substrates, it means enforcing determinism at the memory boundary even if upstream neural inference remains non-deterministic [2512.22280]. In enterprise agent systems, it means structuring memory so that deterministic replay, auditable rationale, multi-tenant isolation, and statelessness for horizontal scale remain attainable under regulated operating conditions [2604.20158].

These works converge on several architectural motifs. One is the reduction of hidden mutable state. Deterministic Projection Memory (DPM) uses an append-only event log and defers memory materialization to a single task-conditioned projection at decision time, so memory is not repeatedly rewritten during the trajectory [2604.20158]. Valori uses a pure state-machine model in which deterministic commands transform a deterministic kernel state [2512.22280]. The compilation framework of Dimensional Type Systems and Deterministic Memory Management treats allocation strategy as coeffect metadata that is inferred, preserved, and verified rather than left to opaque backend heuristics [2603.16437].

A second motif is boundary control. The enterprise-agent literature argues that stateful architectures violate replayability and auditability by construction because a single decision becomes the product of many path-dependent update steps [2604.20158]. Valori makes an analogous argument at the numeric level: identical models, inputs, and code can still produce different raw embedding bits across architectures, so the memory state can fork at creation time unless normalization happens immediately at the kernel boundary [2512.22280]. The security literature reaches a similar conclusion for memory protection: deterministic tagging with ARM MTE relies on compile-time-determined tag discipline rather than random tags or secrecy, so that safe allocations remain protected even under arbitrary read/write memory disclosure [2204.03781].

## 2. Systems, language, and compiler formulations

The real-time systems formulation of DMM defines deterministic memory as “a special memory space for which the OS and hardware guarantee small and tightly bounded worst-case access delay,” in contrast to best-effort memory, for which only highly pessimistic worst-case bounds are possible [1707.05260]. Its key abstraction is a page-level deterministic/best-effort distinction carried through the page table by a DM bit and propagated through the MMU, TLB, cache, and DRAM controller. Applications mark pages or regions as deterministic, the OS allocates those pages differently, and the hardware applies different cache and DRAM scheduling rules. The formal task model is
$$
\tau_i = \{C_i, T_i, D_i, DM_i, BM_i\},
$$
with worst-case memory interference
$$
I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.
$$
This makes memory criticality analyzable within response-time analysis rather than treating interference as an undifferentiated platform artifact [1707.05260].

That work also emphasizes selective deployment. On the reported benchmarks, only 38% of touched pages are critical on average, and if one considers the pages responsible for 90% of L1 misses, the fraction drops to 23% on average. DMM therefore aims to reserve strong timing isolation only for the pages that dominate worst-case execution time, while allowing best-effort reuse elsewhere. In the cache study, best-effort `bzip2` improves its hit rate by 39% on average under DMM versus ordinary way partitioning, while deterministic cache-line usage falls to about 49% in DM(A), 27% in DM(T98), and 21% in DM(T90) [1707.05260].

Adjacent OS-level work pursues predictability through contention control even when it does not use DMM as its central label. Vertical partitioning eliminates shared-resource contention across LLC and DRAM banks by exploiting overlapping physical-address bits, and reports up to 11% performance gains over prior techniques [1704.01198]. An N-level adaptation of the Aging paging algorithm routes colder pages to lower levels according to the number of leading zeros in the aging counter and is reported to yield the best Hit/Miss behavior in the DeMemory simulator [1707.07161]. These systems are predictability-oriented rather than identical in formal scope, but they share the DMM premise that memory placement policy should be architecture-aware and explicit.

Language-level antecedents show a parallel movement from runtime recovery toward compile-time or structurally deterministic allocation. Region-based memory management for Mercury uses strong type, mode, and determinism systems to infer regions and insert `create` and `remove` operations at compile time; compared with the base Mercury system with the Boehm runtime garbage collector, it is faster on 15 out of 18 benchmarks, with an average runtime speedup of 24% and an average reduction in memory requirements of 95% [1203.1392]. In reversible computing, ROOPL++ adds dynamic allocation, deallocation, arrays, and multiple references while preserving invertibility, and ultimately selects Buddy Memory because allocation and deallocation must remain deterministic and reversible [1804.05097].

The most formal compiler-level DMM treatment appears in the Program Semantic Graph framework, where DMM is defined as a coeffect discipline. Allocation strategy is a contextual requirement, and lifetime propagation follows
$$
\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),
$$
with the lifetime order
$$
\text{stack} < \text{arena} < \text{heap} < \text{static}.
$$
Escape analysis is refined beyond a binary escape/no-escape distinction into four categories, each mapped to a verified allocation strategy [2603.16437].

| Escape classification | Allocation strategy | Lifetime bound |
|---|---|---|
| `StackScoped` | Stack (`memref.alloca`) | Lexical scope |
| `ClosureCapture(t)` | Arena (closure environment) | Lifetime of closure \(t\) |
| `ReturnEscape` | Arena (caller’s scope) | Caller’s scope |
| `ByRefEscape` | Arena (parameter origin) | Origin scope of reference |

This framework ties dimensional inference, representation selection, word width, memory footprint, allocation strategy, and cross-target transfer fidelity into a single compilation graph. A value’s representation affects its footprint; the footprint affects stack eligibility, arena placement, and cache locality; and those choices are carried as codata through MLIR lowering and later revalidated by SMT-based translation validation [2603.16437].

## 3. Deterministic memory substrates and numeric normalization

Valori formulates DMM at the memory-kernel level for AI systems. Its starting claim is that conventional embedding memories are not replayable across hardware because the failure happens before indexing or retrieval: identical models, inputs, and code can still produce different raw embedding bits on architectures such as x86_64 and ARM64. The paper identifies Fused Multiply-Add differences, non-associativity of floating-point addition, and SIMD or auto-vectorization differences across AVX, AVX-512, and NEON as concrete sources of divergence [2512.22280]. In the reported experiment using `sentence-transformers/all-MiniLM-L6-v2`, the first five dimensions of saved embeddings differ at the raw-hex level across an x86_64 Windows PC and an ARM64 MacBook Pro, even though cosine similarity remains above 0.9999.

Valori responds by moving determinism to the memory boundary. External outputs are normalized when they enter the kernel; inside the kernel all memory operations are deterministic; and the kernel itself is a pure state machine:
$$
S_{t+1} = F(S_t, C_t).
$$
Deterministic memory is defined as
$$
\forall \text{Env}_A, \text{Env}_B : \text{Apply}(S_0, \{C_i\})|_A \equiv \text{Apply}(S_0, \{C_i\})|_B.
$$
The implementation is a `no_std` Rust kernel runnable on bare metal, WASM, or standard operating systems, with fixed-point conversion, indexing math, snapshotting and restore, and deterministic graph construction all inside the kernel boundary [2512.22280].

The numeric mechanism is Q16.16 fixed-point arithmetic: 32-bit signed integers with the lower 16 bits fractional, range $[-32768, 32767]$, and resolution approximately $0.000015$. Addition and subtraction are integer operations, dot-product accumulation uses `i64` or wider intermediates, and results are narrowed back to stored Q16.16 format. For ANN search, Valori fixes HNSW entry points to the first inserted node (ID 0), processes batch insertions in verified sorted order, removes stochastic decisions, and uses fixed-point distance metrics, so graph topology becomes identical across runs [2512.22280].

The reported guarantees are bit-identical memory states, snapshots, and search results across x86, ARM, RISC-V, and WASM. In the snapshot transfer test, an x86 kernel inserts 10,000 vectors, snapshots to file with hash $H_A$, transfers the snapshot to ARM, and restores a state with identical hash $H_B$, while k-NN result ordering remains identical across platforms. The performance section reports raw retrieval latency below 500 $\mu$s for typical k-NN queries on a MacBook Pro M3, and the quantization study reports Recall@10 = 0.998 for Valori versus 1.000 for a float32 HNSW baseline [2512.22280]. The paper is explicit, however, that it does not make neural inference deterministic; its guarantee begins after vectors enter the kernel, and Q16.16 trades dynamic range and throughput for reproducibility.

## 4. Stateless and non-generative memory for AI agents

In enterprise decision agents, DMM is expressed as a rejection of mutable stateful memory in favor of replayable, auditable, and isolated memory surfaces. DPM stores the full interaction trajectory as an immutable append-only event log
$$
E = (e_1, e_2, \dots, e_n)
$$
and produces memory only at decision time through a single task-conditioned projection
$$
\pi(E, T, B) \to M.
$$
The projection is emitted at temperature zero, organized into fixed sections—facts, reasoning, and compliance notes—and instructed to preserve numeric anchors verbatim, cite event indices, and emit “unknown” when needed. The consolidation operator is effectively the identity: no memory is rewritten during the trajectory, and memory does not exist as a mutable runtime object until the final projection call [2604.20158].

The replay claim is formalized as Proposition 1: if the backend \(M\) is deterministic, then identical inputs \((E, T, B)\) yield identical outputs. The empirical evaluation uses LongHorizon-Bench with ten regulated decisioning cases—five mortgage qualification cases under ECOA/Reg B and five insurance claims adjudication cases—each around 26,000–28,000 characters and roughly 82–96 discrete events. Against an incremental summarization baseline called Summ-only, DPM and Summ-only are statistically indistinguishable at moderate and loose budgets, but at the tight 20$\times$ compression ratio DPM improves factual precision from 0.392 to 0.907, a gain of $+0.515$ with Cohen’s $h=1.17$ and $p\approx 0.001$, and improves reasoning coherence from 0.267 to 0.800, a gain of $+0.533$ with $h=1.13$ and $p\approx 0.003$ [2604.20158]. Runtime follows the same structure: DPM makes one LLM call at decision time rather than one per event plus a final decision call, yielding about 7.4$\times$ speedup at tight budget and 14.9$\times$ at moderate budget. The audit surface is similarly compressed: DPM logs one projection call and one decision call, while Summ-only logs about 83–97 surfaces for trajectories of 82–96 events.

The paper’s broader claim is that enterprise deployment remains “load-bearing” on deterministic replay, auditable rationale, multi-tenant isolation, and statelessness for horizontal scale, and that this hidden systems requirement explains why regulated deployments prefer weaker but replayable retrieval pipelines over academically richer stateful memory architectures [2604.20158]. The TAMS heuristic codifies this position: if a deployment requires deterministic replay, audit-ready rationale, or multi-tenant isolation, use DPM; otherwise, if the compression ratio exceeds about $10\times$, DPM is still preferred.

Conversational AI work arrives at a different but related architecture. DMF eliminates LLM calls from the memory-management loop and replaces generative summarization with a CPU-first deterministic pipeline based on classical NLP analysis, vector geometry, and mathematical scoring. Each interaction receives a Survival Score
$$
\Omega = \sigma(z_{\mathrm{total}} - x_0) = \frac{1}{1 + e^{-(z_{\mathrm{total}} - x_0)}},
$$
where \(z_{\mathrm{total}}\) combines content signals, conversational cues, and provenance, and relevance decays by interaction count rather than wall-clock time:
$$
\Omega_{\mathrm{eff}}(\Delta n) = \Omega \cdot \exp\!\bigl(-\lambda \cdot (1 - \eta \Omega) \cdot \Delta n\bigr).
$$
The archival source of truth is always the raw interaction record; cards are auxiliary deterministic projections. On LoCoMo and LongMemEval, DMF achieves comparable accuracy to Mem0 while using zero tokens to prepare the memory context and 5$\times$ to 242$\times$ fewer tokens over the entire conversation [2606.03463]. This suggests a second DMM trajectory in AI: rather than making write-time summarization more stable, remove it from the memory loop entirely.

## 5. Isolation, trust boundaries, and memory safety

A security-oriented interpretation of DMM treats explicit memory management as a mechanism for controlling what untrusted state may contaminate trusted state. AgentSys applies this idea to indirect prompt injection. Conventional agents monotonically accumulate all tool outputs and reasoning traces in the main context, which lets injected instructions persist and repeatedly influence later decisions. AgentSys instead organizes agents hierarchically: a main agent spawns worker agents for tool calls, external data and subtask traces remain inside worker contexts, and only schema-validated return values may cross back to the main agent through deterministic JSON parsing [2602.07398].

The memory boundary is intentionally narrow. The main agent issues a tool call with an intent schema \(I_{t_k}\), the worker receives only the raw tool output, the intent, and a compact tool-call trace, and the parent accepts only a return value conforming to the predeclared schema. Validator decisions are computed from trusted inputs—the original user query, the compact call trace, and a proposed subcall—not from raw tool outputs. When a validator denies a worker’s proposed command, AgentSys runs a bounded sanitize–restart loop \(\tilde{y}_k = \sigma(y_k)\), where instruction-like spans are removed while task-relevant data are preserved [2602.07398]. On AgentDojo with GPT-4o-mini, full AgentSys reports 64.36% benign utility, 52.87% attacked utility, and 0.78% attack success rate, versus 63.54%, 48.27%, and 30.66% for the undefended baseline; the ablation without validator and sanitizer, which keeps only hierarchical memory isolation, still reaches 2.19% ASR [2602.07398].

At the lower-level memory-safety boundary, deterministic tagging with ARMv8.5-A MTE replaces probabilistic tag assignment with a compile-time-determined tagging policy. Allocations are classified as implicitly safe, provably safe, guarded, or unsafe; safe allocations use the default safe tag, unsafe allocations use the unsafe tag, and pointers loaded from unsafe or pointer-unsafe memory are forced to the unsafe tag before use. Because address tags are normalized by instrumentation, an attacker with arbitrary read/write access cannot exploit knowledge of tag values to forge access into safe allocations [2204.03781]. The LLVM/Clang implementation extends StackSafetyAnalysis with a FunctionPass and a ModulePass, instruments pointer loads and arithmetic, and reports a 13.6$\times$ geometric-mean runtime overhead, a 21.7$\times$ geometric-mean code-size overhead, and a 19.3$\times$ geometric-mean stack-frame overhead on SPEC CPU 2017 C benchmarks [2204.03781].

These security-oriented systems do not all use identical formal vocabulary, but they share a common DMM intuition: memory safety and memory integrity improve when the admissible state transition is determined by a narrow, explicit, and verifiable boundary rather than by open-ended accumulation of mutable state.

## 6. Concurrency, determinacy, and decision-theoretic critiques

PSM places DMM in the setting of concurrent shared mutable state. It introduces a type context for policy synchronised memory in Haskell in which computations can access persistent state and update it imperatively, yet concurrent accesses are policy coordinated so that well-typed transactions are race-free and deterministic by construction [2506.15424]. The policy interface specifies admissibility and precedence relations for methods on a `PSMVar`, and scheduling is mediated by an `enabled` predicate that checks whether a method is admissible in the current object state and whether any higher-precedence predicted method remains outstanding. The paper’s ACS principle requires atomicity, confluence, and stability, and its main theorem states that if all PSM variables occurring in a term are coherent, then the reduction relation is confluent; moreover, if \(M *-> bind\ N_1\) and \(M *-> bind\ N_2\), then \(N_1 \equiv N_2\) [2506.15424].

This line of work is important because it addresses a standard objection to deterministic memory: the claim that determinacy is incompatible with destructive update under concurrency. PSM’s answer is not to ban mutation, but to make shared accesses pass through a policy-bearing abstract data structure, publish conservative predictions of future accesses, and synchronize them at clock barriers. The paper illustrates this with `PTVar`, `PMVar`, `PTSig`, and `PStrIO`, all designed to remain concurrently shareable and deterministic [2506.15424].

A different critique comes from decision theory. DAM argues that memory management for LLM agents should be treated as a sequential decision-making problem under uncertainty rather than as a bag of ad hoc deterministic heuristics such as recency cuts, similarity thresholds, or periodic summarization [2512.21567]. It decomposes memory into a read policy \(\pi^{\mathrm{read}}\), write sub-policies for add and delete, value estimators \(V^o\), uncertainty estimators \(\Sigma^o\), and an aggregate policy \(\pi^{\mathrm{agg}}\) that balances expected long-term utility against uncertainty and feasibility constraints. The paper’s explicit claim is that deterministic rules are not wrong because they are deterministic; they are inadequate when they are not decision-theoretic [2512.21567]. A plausible implication is that future DMM systems may need to be both deterministic and uncertainty-aware: deterministic in execution, but grounded in explicit long-horizon objectives rather than static heuristics.

## 7. Empirical themes, limitations, and open problems

Taken together, these papers suggest that DMM succeeds when it minimizes mutable-state surfaces, normalizes data at a trusted boundary, and restricts determinism to the layer where verification is possible. DPM reduces replay complexity from \(N\) stochastic memory-update calls to a single projection call [2604.20158]. Valori reduces cross-platform divergence by converting floats to fixed-point immediately at the kernel boundary [2512.22280]. Compiler-level DMM resolves allocation statically from verified escape information [2603.16437]. Real-time DMM applies strong guarantees only to pages that matter most to worst-case timing [1707.05260]. The common pattern is selective determinization rather than universal elimination of all uncertainty.

The limitations are equally consistent. DPM shows that temperature zero on a live API does not guarantee strict byte determinism; its determinism study reports residual API-level nondeterminism, and the paper therefore recommends pairing DPM with a pinned deterministic backend or self-hosted deterministic inference runtime for true bit-exact replay [2604.20158]. Valori guarantees determinism only after vectors enter the kernel and notes limited dynamic range and software fixed-point overhead as trade-offs of Q16.16 [2512.22280]. DMF is English-first, uses fixed calibration by default, and relies on conservative card projections rather than full semantic parsing [2606.03463]. The PSG-based compiler framework requires sound escape classification, lifetime reasoning, target-memory topology, and verification across lowering passes [2603.16437]. In real-time systems, deterministic-memory selection depends on profiling and page-level granularity, so overuse can waste reserved resources and underuse can weaken timing guarantees [1707.05260].

The broader significance of DMM is therefore methodological as much as algorithmic. In regulated enterprise agents, statelessness is described as the load-bearing property that explains deployment choices [2604.20158]. In deterministic AI substrates, replayable memory is presented as a necessary primitive for trustworthy AI systems [2512.22280]. In memory-safe systems, deterministic tag discipline turns post-deployment protection from a probabilistic debugging aid into a compile-time-enforced invariant [2204.03781]. This suggests that DMM is best understood not as a single implementation pattern, but as a systems doctrine: memory should expose a small, explicit, and verifiable state-transition surface whose behavior is stable under replay, audit, and cross-environment execution.

Source: https://www.emergentmind.com/topics/deterministic-memory-management-dmm