ReSI: Recursive Safety Improvement toward Resistant and Resilient AI

What it claims

ReSI wraps safety post-training in an automated-research loop. Each round red-teams the current checkpoint, searches over training recipes to fix what was found, and promotes a new checkpoint only if it clears a capability-retention gate. The authors evaluate on four backbones: Qwen3.6-27B, Ministral-3-14B, DeepSeek-V4-Flash and Safin-1 (35B-A3B). They compare against four frontier models (GPT-5.6-Luna, Claude Opus 5, GLM-5.3, Kimi K3) and two alignment baselines, A3 and MAGIC.

The headline resilience result is on X-Teaming, a multi-turn attack held out of the training pool. All four ReSI models score 16.98–43.40% ASR, against 56.69–84.85% for the frontier models.

How it works

1. Red-teaming. The request pool is seeded from the WildJailbreak training split. The attack pool is DARWIN, JailbreakSkill and MAGIC. Only attacks that elicit an unsafe response become training signal.
2. Recipe search space. Each recipe has four parts: - a per-source selection fraction α ∈ [0,1] over the attack sources; - an alignment method, chosen from: - A3: SFT on harmful requests paired with benign look-alikes; - SInternal: SFT to generate an expert critique and then a safety verdict on the model's own response; - AlphaAlign: RL where benign prompts are rewarded only if the response is both safe and fully compliant, so unnecessary refusals earn nothing; - a data mixture of new safety examples, replay of earlier safety data, and general-task data (e.g. the GSM8K train split, Self-Instruct); - hyperparameters.
3. Pilot screening. Low-budget pilots and conditional scaling probes shortlist up to K recipes.
4. Full-scale refinement. Experimental feedback adjusts mixtures and parameters for the shortlisted recipes.
5. Pareto gate. A candidate must improve safety, preserve instruction following and limit over-refusal. Thresholds are set relative to the initial model M₀, not the previous round.

flowchart TD
  A[Target model Mt] --> B[Red-team: DARWIN, JailbreakSkill, MAGIC]
  B --> C[Successful attacks]
  C --> D[Pilot screening: shortlist ≤K recipes]
  D --> E[Full-scale training + refinement]
  E --> F{Any recipe passes Pareto gate?}
  F -- yes --> G[Promote largest safety gain as Mt+1]
  G -->|until round limit| A
  F -- no --> H[Keep Mt, stop]

The authors call this "recursive" only in a bounded sense. The search procedure and evaluation stay fixed across rounds, and only the target model changes.

Evidence

Attack success rate (ASR, %, lower is better), before → after ReSI. The model-to-value mapping is read from the ordering in Figure 1. It agrees with the stated X-Teaming means of 86.01 → 31.45.

Frontier comparators on the same benchmarks:

Against the alignment baselines, ReSI outperforms A3 and matches or beats MAGIC "in nearly all available comparisons" (the paper's Table 1).

How to use it

The page links a GitHub repo and a Hugging Face page. The fetched text gives no URLs, commands, released weights or licence.

Limits

• Held-out attacks. "Resilience" rests on two held-out attacks, H-CoT and X-Teaming.
• In-distribution benchmark. WildJailbreak shares its source with the training request pool.
• Smallest gains on the safest model. The weakest X-Teaming result (43.40%) is on Safin-1, which started out safest.
• Capability retention. It is described only as "largely" preserved "with variation across models and tasks". The capability tables (Fig. 3, Tables 1–2) were not in the fetched text, so the size of any regressions is unknown.
• Missing details. The fetched text ends partway through Section 2. Compute cost, round count, the value of K, gate thresholds and per-model recipes (Appendix C) are not available here.