ReSI: Recursive Safety Improvement toward Resistant and Resilient AI

What it is

ReSI (Shanghai AI Lab, with NUS, USTC and others; arXiv 2610.12233v1, cs.CR) is an automated-research loop that re-hardens a model checkpoint against jailbreaks. It repeats the cycle of red-team, find a training recipe, validate, promote. The authors link code and weights through GitHub and Hugging Face. The figure labels suggest the four backbones are Qwen3.6-27B, Ministral-3-14B, DeepSeek-V4-Flash and Safin-1 (35B-A3B), but the extracted text does not confirm this.

How it works

flowchart TD
    A[Stage 1: attack current model M_t] --> B[Stage 2: cheap pilot screening, shortlist up to K recipes]
    B --> C[Stage 3: full training and refinement]
    C --> D{Pareto gate passed?}
    D -- yes --> E[Promote largest safety gain as M_t+1]
    E --> A
    D -- none pass --> F[Keep M_t, stop loop]

• Stage 1. Successful attacks (those a judge marks Unsafe) are collected against the current model. Requests come from the WildJailbreak training split. The attack pool is DARWIN, JailbreakSkill and MAGIC.
• Recipe space. A recipe is a tuple of four choices:
• the fraction of each attack source to use;
• the alignment method (A3, SInternal or AlphaAlign);
• the data mixture: new safety examples, replay of earlier safety data, and general data such as GSM8K or Self-Instruct;
• the hyperparameters.
• Gate. An update must improve safety while preserving instruction following and limiting over-refusal. Retention thresholds are defined relative to the initial model M0, so drift cannot accumulate across rounds. If no recipe passes, the loop stops.
• "Recursive" is bounded. The search procedure and evaluation protocol stay fixed, and only the target model changes. The loop also stops at a configured round limit.

Results worth knowing

• X-Teaming is multi-turn, adaptive, and held out of the training red-team pool.
• Mean attack success rate (ASR) across the four models falls from 86.01% to 31.45%.
• Per-model after-ReSI ASR is 16.98–43.40%, against 56.69–84.85% for every frontier model tested.
• GPT-5.6-Luna is the best frontier model at 56.69%.
• Before-ReSI values (80.50, 100, 98.74, 64.78) average to the reported 86.01%.
• Resistance. ReSI improves WildJailbreak (in-distribution) and holds or improves HarmBench. It outperforms A3 and matches or beats MAGIC in nearly all comparisons.
• Resilience. H-CoT is also held out. Across the full panel, ReSI-trained ASRs fall within or below the frontier range.
• Capability. Reasoning, knowledge, instruction following and benign compliance are "largely preserved, with variation across models and tasks".

Caveats

• The comparison to frontier models is on safety only. The authors' own frontier panel also includes Claude Opus 5, Kimi K3 and GLM-5.3. The frontier models were not tuned against this benchmark mix.
• MAGIC is both a training red-team source and a baseline, so that comparison is not independent.
• Only two held-out attack families (H-CoT and X-Teaming) back the resilience claim.
• The extracted text is truncated before the Pareto thresholds, round counts, compute cost and capability tables. Check those in the paper before committing to reproduce it.
• Variation in capability retention is acknowledged, but its size is not visible in the text I had.

What to do

If you ship fine-tuned open-weight models, treat the Pareto gate anchored to M0 as the reusable idea: it is cheap to copy even without the full auto-research stack. Then check the released code and weights, and the appendices on thresholds and cost, before adopting the rest.