Product Overview

Retaining Agent Working State, and Restoring It Later

Lossless compression, cryptographic signing, and restore from storage instead of re-reading the document.

What This Is

When a language model reads a long document, the serving engine builds up the model's working state: the attention record of everything read so far. When the session ends, or the process restarts, or the state is evicted under memory pressure, that working state is discarded and the document has to be read again from the beginning.

Revyzor compresses that working state losslessly, signs it, and persists it to your storage tier, so the session can be restored from disk rather than re-read. It runs inside vLLM, SGLang or NVIDIA NIM, on your GPUs, under your keys.


What We Measured

1.444x
Lossless on bf16
292 MB of working state stored in 202 MB. The roundtrip was checked byte for byte and came back identical, so the model's output does not change.
56.2 ms
Restore From NVMe
A 5,097-token contract read back from local NVMe: 33.5 ms disk, 7.9 host-to-device, 15.1 decompress. Qwen2.5-7B, bf16, L40S.
417 ms
To Re-Read Instead
Cold prefill of the same document on the same GPU. Restoring the retained state is 7.4x faster than reading the document again.
Ed25519
Signed at Capture
Each retained state is issued a W3C Verifiable Credential binding it to the model, the organisation and the source document. Altered states, substituted models and wrong organisations are rejected on reload.

Where this applies: a session still resident in the serving engine's own prefix cache is restored in 39.5 ms on the same hardware, at no cost, and needs nothing from us. Revyzor is for the state that is not resident: evicted under memory pressure, lost to a process restart, or needed again months later.


What a Retained Cache Is, and Is Not

A retained cache is the model's numeric working state. It is not a human-readable chain of reasoning, and an examiner cannot read it. It does not replace the prompt, the output and the generated reasoning, and it is not what you would hand a regulator in their place.

What it gives you is the ability to put the model back into the state it held, on the same weights, and continue or re-examine from there. The signature covers the retained bytes, so alteration is detectable on reload. That is a narrower and more literal claim than "show the regulator what the model was thinking", and it is the one we can stand behind.


Where It Helps

Crash Recovery
An agent fails partway through a long chain. Rather than re-running the chain from the beginning, the last signed checkpoint is loaded back and the run continues from there.
Continuity Across Restarts
The serving engine's own prefix cache does not survive a process restart, a redeploy or an engine upgrade. A persisted state does, so an analyst who suspends a case on Friday is not paying to re-read the file on Monday.
Producing an Earlier Session Again
Months later, the retained state can be loaded back without the original serving stack still running. It carries the read document with it, so the session does not depend on the source file still being to hand, and it skips the re-read. It does still require the same model weights: a cache is only meaningful against the weights that produced it.
Tamper-Evident Retention
The credential binds the state to the model, the organisation and the source document. Change a byte, substitute a model, or present it to the wrong organisation and it is rejected on reload.

How It Works

1
Capture
The agent reads the document. Revyzor compresses the resulting working state losslessly on the GPU, at 1.444x on bf16, and issues a W3C Verifiable Credential binding it to the model version, the organisation and the document hash.
2
Persist
The compressed state is written to your storage tier, inheriting your at-rest encryption. For the 5,097-token contract we measured, 292 MB of raw state was stored as 202 MB.
3
Restore
The state is read back, checked against its credential, decompressed on the GPU and loaded. Measured at 56.2 ms against 417 ms to read the document again. A wrong model, a wrong organisation or an altered state is rejected before the agent continues.

Integration

Revyzor attaches at vLLM's documented connector interface (KVConnectorBase_V1), the same extension point used by NVIDIA's KVBM, LMCache and FlexKV, and has been integrated and tested against vLLM, SGLang and NVIDIA NIM. It needs no model changes, no retraining and no application changes, and it runs on your infrastructure, on your models, under your keys, with no dependency on any frontier API provider.

It is not a one-line install. Each engine version has needed integration work, and keeping pace with those engines as their internals change is a substantial part of what we do.


Sectors We Are Exploring

These are sectors where long-document sessions, multi-step agent runs and retention obligations all coincide, which is why we think the workload fits. We have no deployments in any of them, and the oversight regimes listed are context for the sector, not requirements that our product satisfies.

SectorOversight regimeWorkload
Banking SR 11-7, DORA, EU AI Act AML investigation, credit decisions, SAR drafting
Insurance Solvency II, EIOPA Claims processing agents, fraud detection
Pharma FDA 21 CFR Part 11, EMA Clinical trial analysis, regulatory submissions
Legal SRA, Bar Council Case preparation, contract review, due diligence
Audit PCAOB, IAASB Automated audit procedures, working paper review
Government OFFICIAL-SENSITIVE Intelligence analysis, policy drafting