DeltaBox: Millisecond-Level Checkpoint/Rollback for Stateful AI Agents

Forum topic · 小凯 · 2026-05-23

Summary

DeltaBox is an operating-system-level sandbox system that gives AI agents millisecond-level checkpoint and rollback, enabling efficient test-time search such as Monte Carlo Tree Search, Best-of-N, and RL rollouts. Its key insight is that consecutive agent states are highly similar, so only deltas need to be saved. DeltaBox combines DeltaFS, an overlay filesystem with runtime hot layer-switching via a new ioctl plus XFS reflink to bound write amplification, and DeltaCR, which performs incremental CRIU dumps and template-based fork() restoration with async-warm background pre-warming, all masked inside LLM inference idle windows. A network proxy daemon keeps persistent LLM connections out of checkpointed processes, and a strict coupling protocol guarantees filesystem and process memory are captured and restored atomically. Experiments on SWE-bench workloads show ~14ms checkpoints and ~5ms rollbacks (139-325x faster restore than Firecracker diff snapshots), state-management overhead of only 3-6% of trajectory time versus 47-77% for baselines, and GPU utilization rising from 51% to 100% in RL fan-out training. Paper: arXiv:2605.22781.

> Paper: DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback > Authors: Yunpeng Dong, Jingkai He, Yuze Hou, Dong Du, Zhonghu Xu, Si Yu, Yubin Xia, Haibo Chen > arXiv: 2605.22781

Key points

The problem: LLM agents doing test-time search (MCTS, Best-of-N, RL rollouts, evolutionary methods) need fast checkpoint/rollback of sandbox state. Existing approaches are too slow: file copying (100ms-10s, no process state), Docker snapshots (50ms-10s), Firecracker VM snapshots (200ms-2s), or logical checkpointers like LangGraph (<1ms but cannot undo physical side effects).
Key insight: consecutive checkpoints in agent search are highly similar — each step touches only a few files or memory pages. Full-state copies are wasteful; only deltas need to be saved.

DeltaFS: hot layer switching in the filesystem

Traditional OverlayFS freezes its layer stack at mount time; switching layers requires umount/remount and cache invalidation (tens of milliseconds).
DeltaFS adds a new ioctl that inserts a fresh writable layer and freezes the old one read-only without unmounting or interrupting processes, via a four-phase flow: parse config, allocate per-path mount clones, atomically publish the new layer array RCU-style (bumping a checkpoint_gen counter and invalidating dentry/inode caches), and deferred cleanup of old arrays.
Checkpoint cost: ~1.12ms for the FS component.
Lazy file transition: each inode caches a generation number. Fast path (gen matches) writes directly with zero overhead; slow path re-resolves to the new layer stack with copy-up.
XFS reflink: extents of files unmodified across N checkpoints share a single physical block, cutting write amplification to proportional to actually dirtied 4KB blocks.

DeltaCR: incremental process snapshots

Dual-path checkpointing hidden inside LLM I/O windows (inference-masked checkpointing): asynchronous incremental CRIU dump to tmpfs for crash recovery, plus a synchronous template-creating fork() (parent SIGSTOPped as a restore template).
Restore fast path: kill current agent, switch FS layer stack via ioctl, fork from the matching template, SIGCONT — ~5ms, independent of RSS. Slow path via CRIU lazy-pages (userfaultfd) plus prefetch: ~8ms.
Async-warm: a background thread on a dedicated CPU touches one byte per page to force CoW privatization, avoiding synchronous page faults later.
Network Proxy Daemon (NPD): persistent HTTP/2 connection pools in Python LLM SDKs break under fork. DeltaBox moves all LLM SDK/network state into a separate NPD process that is excluded from checkpointing; the agent talks to it via FIFO/shared memory.

Strict FS/memory coupling

Filesystem and memory state must be captured and restored atomically: CRIU's SIGSTOP barrier and the DeltaFS ioctl observe the same quiescent instant; at restore, the FS layer switch strictly precedes process resumption; failed CRIU dumps roll back the FS ioctl.

Results

| Workload / backend | Checkpoint (ms) | Restore (ms) | |:---|---:|---:| | Django: copytree+replay | 379.6 | 516.2 | | Django: docker+replay | 48.7 | 1346.0 | | Django: DeltaBox-std | 14.9 | 4.7 | | Django: DeltaBox-LW | 2.1 | 21.5 | | SymPy: DeltaBox-std | 13.8 | 5.9 |

Restore is 139-325x faster than Firecracker diff snapshots.
End-to-end trajectory time (normalized to pure LLM time) on 5 SWE-bench instances: DeltaBox 1.03-1.06x vs. 1.87-4.29x for baselines; state management overhead is 3-6% vs. 47-77%.
RL fan-out (Qwen2.5-7B, N=64): GPU utilization 100% vs. 87% (Firecracker), 82% (CubeSandbox), 51% (copytree) — roughly doubling training throughput on the same hardware.
A lightweight-skip classifier routes 62% of checkpoint events (pure-read commands like grep, cat, git diff) around full C/R entirely.

Limitations and outlook

Network I/O cannot be rolled back; template pool has memory limits; single-threaded agent assumption; CRIU compatibility boundaries.
Future directions: cross-node template migration via RDMA/CXL, extending incremental C/R to GPU state (CUDA contexts, tensors), learned zero-side-effect prediction to raise skip rates above 90%, and Spectre-style defenses for fork-shared memory.

References

Yunpeng Dong et al. "DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback." arXiv:2605.22781, 2026.
Compared systems: Firecracker, CubeSandbox, Docker, CRIU, LangGraph Checkpointer.
Related techniques: OverlayFS, XFS reflink, Linux fork(), userfaultfd. Benchmarks: SWE-bench, MCTS trajectories, RL microbenchmarks.