Evolutionary Safety of Recursive Self-Improving AI: Taxonomy, Risk Discovery, and Evaluation
Not on the map. Why?
Abstract (arXiv)
Artificial intelligence is advancing rapidly, with increasingly capable systems taking larger roles in reasoning, decision-making, scientific discovery, and autonomous development. As AI begins to participate in its own improvement, from model training and experience accumulation to agent evolution and automated AI development, the prospect of recursive self-improvement (RSI) is becoming increasingly relevant. This transition raises a fundamental safety question: how can safety be maintained when the system, its accumulated experience, and even the process producing its successors continue to change? We introduce Evolutionary Safety as a perspective for studying safety under persistent and recursive self-improvement. It concerns not only whether an AI system is safe at a particular moment, but how safety properties change, persist, accumulate, and propagate throughout evolution. We characterize recurring manifestations, including intent drift, error accumulation, experience contamination, safety-property erosion, evaluator drift, and risk propagation. We then develop a taxonomy spanning persistent agent state, model state, evaluation and environmental feedback, computational substrate, and meta-level update mechanisms. Building on this taxonomy, we examine how evolutionary risks can be discovered and evaluated across states, updates, trajectories, and lineages, and derive governance principles for modification, selection, authorization, provenance, and recovery. Finally, we outline open problems toward maintaining safety guarantees as AI systems become increasingly persistent, adaptive, and recursively self-improving. Project resources and proposed evaluation systems are available at https://chaunceykung.github.io/evolutionary-safety-rsi.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 84 of its 122 references that are in the map. First posted on arXiv 25 Sep 2026.
Builds on
84 of 122 references.
References · 84
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
- 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,442
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2018Continual Lifelong Learning with Neural Networks: A Reviewcited by 1,330
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2022Scaling Laws for Reward Model Overoptimizationcited by 1,095
- 2024The AI Scientist: Towards Fully Automated Open-Ended Scientific Discoverycited by 1,071
- 2025A-MEM: Agentic Memory for LLM Agentscited by 1,063
- 2017Constrained Policy Optimizationcited by 983
- 2025AlphaEvolve: A coding agent for scientific and algorithmic discoverycited by 867
- 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 836
38 more
- 2016Learning to learn by gradient descent by gradient descentcited by 620
- 2023Identifying the Risks of LM Agents with an LM-Emulated Sandboxcited by 548
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
- 2024Generative Verifiers: Reward Modeling as Next-Token Predictioncited by 480
- 2024MLE-bench: Evaluating Machine Learning Agents on Machine Learning Engineeringcited by 469
- 2024AFlow: Automating Agentic Workflow Generationcited by 432
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
- 2025Accelerating scientific discovery with Co-Scientistcited by 401
- 2021Safe Learning in Robotics: From Learning-Based Control to Safe Reinforcement Learningcited by 371
- 2017Population Based Training of Neural Networkscited by 367
- 2023SOTOPIA: Interactive Evaluation for Social Intelligence in Language Agentscited by 367
- 2025Darwin Godel Machine: Open-Ended Evolution of Self-Improving Agentscited by 356
- 2025Absolute Zero: Reinforced Self-play Reasoning with Zero Datacited by 344
- 2022The Effects of Reward Misspecification: Mapping and Mitigating Misaligned Modelscited by 328
- 2024JudgeBench: A Benchmark for Evaluating LLM-based Judgescited by 318
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agentscited by 306
- 2024Frontier Models are Capable of In-context Schemingcited by 287
- 2023Self-Consuming Generative Models Go MADcited by 250
- 2023AI Control: Improving Safety Despite Intentional Subversioncited by 229
- 2025R-Zero: Self-Evolving Reasoning LLM from Zero Datacited by 228
- 2024Meta-Rewarding Language Models: Self-Improving Alignment with LLM-as-a-Meta-Judgecited by 204
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
- 2025A Comprehensive Survey of Self-Evolving AI Agents: A New Paradigm Bridging Foundation Models and Lifelong Agentic Systemscited by 183
- 2024RM-Bench: Benchmarking Reward Models of Language Models with Subtlety and Stylecited by 176
- 2025A Survey of Self-Evolving Agents: What, When, How, and Where to Evolve on the Path to Artificial Super Intelligencecited by 170
- 2025Agentic Misalignment: How LLMs Could Be Insider Threatscited by 158
- 2023Self-Taught Optimizer (STOP): Recursively Self-Improving Code Generationcited by 148
- 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 131
- 2024Emergent social conventions and collective bias in LLM populationscited by 123
- 2023ChatEDA: A Large Language Model Powered Autonomous Agent for EDAcited by 122
- 2024A Note on Shumailov et al. (2024): `AI Models Collapse When Trained on Recursively Generated Data'cited by 115
- 2024On scalable oversight with weak LLMs judging strong LLMscited by 99
- 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
- 2024Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbationcited by 92
- 2024Prover-Verifier Games improve legibility of LLM outputscited by 85
- 2025Auditing language models for hidden objectivescited by 83
- 2025Your Agent May Misevolve: Emergent Risks in Self-evolving LLM Agentscited by 62
- 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 48
50 most cited of 84 All 84 (JSON)
Built on by
Not cited yet.