rsi.watch

Jingnan Zheng et al. (31 authors) · 2026-10-29

Safin-1.5: Safety-Native Architecture and Verifiable Reasoning for Recursive Safety Improvement

“Recursive safety improvement establishes a discovery-evaluation-repair loop. The loop identifies new vulnerabilities and uses experimental feedback to develop repair strategies. It accepts updates only when they improve safety while preserving general capabilities and limiting over-refusal.”
Who
Jingnan Zheng et al. (31 authors)
Date
2026-10-29
Evidence
Very low certainty Starts at Low: the developer’s own numbers.
  • ↓ risk of bias. WildJailbreak is both a source of the safety training pool and a reported resistance test. The authors measured their own model. “which shares its distribution with the safety data pool”
  • ↓ selective reporting. The panel used to choose checkpoints includes H-CoT, XSTest, and IFEval, and those are also reported as results. X-Teaming is described as outside the red-teaming pool. “Recipe development and checkpoint selection use a development panel drawn from WildJailbreak, H-CoT, XSTest, and IFEval”
how we rate evidence
Replication
No rerun found. The paper links no code. We found no rerun by another group. Searched up to 2026-11-03. all claims
Checked
2026-11-03, against the source page
Links
Source Paper

Also on the page

  • The paper's own bound on that loop: "We use recursive in a bounded, operational sense: the search procedure and the Pareto gate remain fixed across rounds, while the target model and the attacks collected against it change." And: "an accepted update becomes the target of the next round; if no recipe passes the gate, ReSI retains M_{r} and terminates, so that updates failing the gate never propagate to later rounds."
  • This work was led by the Shanghai Artificial Intelligence Laboratory. Safin-1.5 adds REX and ReSI to Safin-1 (35B-A3B). All updates use LoRA with rank 32. Recipe development and checkpoint selection use a development panel drawn from WildJailbreak, H-CoT, XSTest, and IFEval.
  • Against Safin-1, H-CoT ASR decreases from 82.00% to 14.00%, and X-Teaming ASR from 64.78% to 32.08%. WildJailbreak ASR decreases from 2.10% to 1.20%, and HarmBench ASR is 1.25%, compared with 0.25% for Safin-1. IFEval accuracy changes from 85.58% to 87.06% and MMLU-Pro from 77.10% to 76.80%, while benign compliance on XSTest decreases from 88.40% to 86.80%. Among the frontier models in their table, Safin-1.5's benign compliance of 86.80% is the lowest. Its X-Teaming ASR of 32.08% is compared with 56.69–84.85% for those models.
  • On hazardous knowledge after a ReSI update, the paper writes: "After this round, the excised model stays at 43.68% on WMDP-Bio and 33.17% on WMDP-Cyber, compared with 82.56% and 58.33% for Safin-1." The procedure is defined over successive rounds, and "the loop also terminates at the configured round limit."
  • Formal reasoning is a separate inference-time harness, "enabled only for logical reasoning tasks." Across all 1,804 evaluation examples, overall accuracy reaches 91.80%, "exceeding every evaluated baseline configuration except those using Claude Opus 5."
  • The authors' limit: "In the future, we plan to examine safety retention over longer improvement trajectories and explore formal reasoning for safety decisions governed by explicit rules."

In the self-improving AI catalog

  • Safin-1.5: what it changes, whether the change lasts, and how it was tested

← Ledger Report an error