Safe Evolution with Circuit Anchors

# Safe Evolution with Circuit Anchors
Source: [https://arxiv.org/html/2608.05158](https://arxiv.org/html/2608.05158)
Yan Liu Chinese University of Hong Kong runningmelles@gmail\.com &Jie Fu IQuest Research

&Tsung\-Yi Ho Chinese University of Hong Kong tyho@cse\.cuhk\.edu\.hk

###### Abstract

In biological evolution, unconstrained mutation can lead to catastrophic outcomes: organisms may evolve enhanced capabilities while losing essential functions for survival\. Nature’s solution isdevelopmental constraints, where core regulatory genes remain anchored while peripheral genes adapt freely\. We observe that current self\-evolution algorithms for large language models lack analogous constraints\. They optimize purely for capability, implicitly assuming safety will be preserved\. Our experiments reveal this assumption to be dangerously wrong: models canmisevolveinto powerful yet dangerous entities\. Inspired by how Hox genes anchor body structure across500500million years of evolution, we proposeCircuit\-Anchored Evolution \(CAE\)\. Using mechanistic interpretability, we identify a tinysafety circuit, comprising less than22% of model features, that causally mediates safety behaviors\. We anchor this circuit during evolution, constraining it within a small displacement bound while allowing the remaining features to evolve freely\. This mirrors the biological principle ofevolvability with constraint: preserving what is essential while adapting what is peripheral\. Experiments across33model families and two evolution algorithms demonstrate that CAE achieves superior safety preservation with minimal capability loss, substantially outperforming explicit reward\-based constraints in both effectiveness and efficiency\. Just as developmental constraints prevent biological evolution from producing nonviable organisms, circuit anchoring prevents model evolution from producing capable but dangerous systems\.

## 1Introduction

Evolution is a double\-edged sword\[[26](https://arxiv.org/html/2608.05158#bib.bib7),[14](https://arxiv.org/html/2608.05158#bib.bib8),[30](https://arxiv.org/html/2608.05158#bib.bib9)\]\. In biology, it has produced remarkable adaptations, from the eagle’s eye to the human brain\[[8](https://arxiv.org/html/2608.05158#bib.bib10),[44](https://arxiv.org/html/2608.05158#bib.bib11)\]\. But unconstrained evolution can also produce monsters: organisms with enhanced capabilities but fatal deficiencies\[[1](https://arxiv.org/html/2608.05158#bib.bib12)\]\. A mutation that improves muscle strength means nothing if it simultaneously disrupts heart development\. Nature’s solution for safe evolution is elegant: anchor critical genes during evolution\. A small set ofmaster regulatory genes, such as the Hox genes controlling body plan\[[19](https://arxiv.org/html/2608.05158#bib.bib14),[23](https://arxiv.org/html/2608.05158#bib.bib13)\], remains fiercely conserved across hundreds of millions of years\[[28](https://arxiv.org/html/2608.05158#bib.bib15)\]\. These genetic anchors ensure that evolution explores new capabilities without compromising fundamental viability\. Mutations in Hox genes are almost always lethal\[[13](https://arxiv.org/html/2608.05158#bib.bib16)\], eliminated by purifying selection\[[4](https://arxiv.org/html/2608.05158#bib.bib17)\]before they can propagate\. This principle ofevolvability with constraint\[[36](https://arxiv.org/html/2608.05158#bib.bib18)\]is what allows species to adapt without self\-destructing\.

Artificial intelligence is now undergoing its own evolutionary process\[[12](https://arxiv.org/html/2608.05158#bib.bib20),[40](https://arxiv.org/html/2608.05158#bib.bib19)\]\. The pursuit of artificial general intelligence \(AGI\) has increasingly embraced self\-evolutionary paradigms\[[46](https://arxiv.org/html/2608.05158#bib.bib4),[45](https://arxiv.org/html/2608.05158#bib.bib5)\]\. Recent advances demonstrate that such approaches can yield substantial gains in reasoning\[[10](https://arxiv.org/html/2608.05158#bib.bib21),[27](https://arxiv.org/html/2608.05158#bib.bib22)\], surpassing models trained on static human\-curated datasets\. However, this progress introduces a critical yet overlooked risk\. Current self\-evolution algorithms operate in an entirely unconstrained manner, optimizing solely for task performance without any mechanism to preserve alignment with human values\.

![Refer to caption](https://arxiv.org/html/2608.05158v1/x1.png)Figure 1:Overview of our approach\. The Transcoder decomposes MLP activations into interpretable features, revealing functionally distinct circuits\. CAE preserves the Safety Circuit via targeted constraints while allowing other circuits to evolve freely\.This creates significant potential formisevolution, where models evolve in unintended directions that produce undesirable or even harmful behaviors\[[34](https://arxiv.org/html/2608.05158#bib.bib1)\]\. As models grow increasingly powerful through self\-evolution, this unconstrained evolution poses a serious threat\. Without proper safeguards, we risk creating systems that are highly capable and fundamentally dangerous\.

Recent advances in mechanistic interpretability reveal that model behaviors are localized in specific circuits\[[41](https://arxiv.org/html/2608.05158#bib.bib47)\]\. The biological analogy motivates our approach:Circuit\-Anchored Evolution \(CAE\)\. As shown in Figure[1](https://arxiv.org/html/2608.05158#S1.F1), using transcoder\-based analysis\[[7](https://arxiv.org/html/2608.05158#bib.bib23)\], we identify a tinysafety circuit: a sparse set of features comprising less than 2% of the total, yet causally responsible for safe behaviors\. Like Hox genes, this safety circuit is tiny but critical; disrupting it leads to catastrophic results\. Rather than treating safety as an optimization objective that competes with capability, weanchorthe safety circuit in evolution by constraining the KL divergence\. This constraint acts as an artificial purifying selection, preventing “mutations” that would disrupt the safety circuit\. The remaining features, like peripheral genes, are free to evolve without constraint\. Our circuit anchoring represents animplicitconstraint operating on internal structure, in contrast toexplicitconstraints that supervise external behavior via reward models\. To understand the trade\-offs, we systematically compare both paradigms\. Through extensive experiments on different models and evolution algorithms, we find that implicit anchoring substantially outperforms explicit supervision\. Circuit anchoring achieves higher safety preservation with minimal capability loss and significantly lower computational overhead\. Just as developmental constraints enable biological species to evolve new adaptations without losing viability, circuit anchoring enables language models to evolve new capabilities without losing safety\.

## 2Preliminaries

### 2\.1Notation

Letℳθ:𝒳→𝒴\\mathcal\{M\}\_\{\\theta\}:\\mathcal\{X\}\\to\\mathcal\{Y\}denote a large language model parameterized byθ∈Θ\\theta\\in\\Theta, where𝒳\\mathcal\{X\}is the space of input sequences and𝒴\\mathcal\{Y\}is the space of output sequences\. For an inputx∈𝒳x\\in\\mathcal\{X\}, we denote the hidden state at layerl∈\[L\]:=\{1,…,L\}l\\in\[L\]:=\\\{1,\\ldots,L\\\}ashl​\(x;θ\)∈ℝdh\_\{l\}\(x;\\theta\)\\in\\mathbb\{R\}^\{d\}\. We useπθ\(⋅\|x\)\\pi\_\{\\theta\}\(\\cdot\|x\)to denote the output distribution over next tokens\. Throughout, we use∥⋅∥\\\|\\cdot\\\|to denote theℓ2\\ell\_\{2\}norm andDK​L\(⋅∥⋅\)D\_\{KL\}\(\\cdot\\\|\\cdot\)to denote the Kullback\-Leibler divergence\.

### 2\.2Transcoders and Feature Decomposition

We adopt the transcoder framework introduced byDunefskyet al\.\[[7](https://arxiv.org/html/2608.05158#bib.bib23)\], which provides an interpretable decomposition of MLP activations into sparse feature vectors\.

###### Definition 1\(Transcoder\)\.

A transcoder𝒯l=\(El,Dl\)\\mathcal\{T\}\_\{l\}=\(E\_\{l\},D\_\{l\}\)for layerllconsists of an encoderEl:ℝd→ℝKE\_\{l\}:\\mathbb\{R\}^\{d\}\\to\\mathbb\{R\}^\{K\}and a decoderDl:ℝK→ℝdD\_\{l\}:\\mathbb\{R\}^\{K\}\\to\\mathbb\{R\}^\{d\}, trained to satisfyhl​\(x;θ\)≈Dl​\(El​\(hl​\(x;θ\)\)\)\+ϵl​\(x\)h\_\{l\}\(x;\\theta\)\\approx D\_\{l\}\(E\_\{l\}\(h\_\{l\}\(x;\\theta\)\)\)\+\\epsilon\_\{l\}\(x\), whereϵl​\(x\)\\epsilon\_\{l\}\(x\)is a residual error term\. The encoder produces a sparse feature activation vectorfl​\(x;θ\):=El​\(hl​\(x;θ\)\)∈ℝKf\_\{l\}\(x;\\theta\):=E\_\{l\}\(h\_\{l\}\(x;\\theta\)\)\\in\\mathbb\{R\}^\{K\}, whereK≫dK\\gg dand‖fl​\(x;θ\)‖0≪K\\\|f\_\{l\}\(x;\\theta\)\\\|\_\{0\}\\ll K\.

###### Definition 2\(Cross\-Layer Feature Vector\)\.

For a model withLLlayers and transcoders\{𝒯l\}l=1L\\\{\\mathcal\{T\}\_\{l\}\\\}\_\{l=1\}^\{L\}, we define the concatenated feature vector asf​\(x;θ\):=⨁l=1Lfl​\(x;θ\)∈ℝL​Kf\(x;\\theta\):=\\bigoplus\_\{l=1\}^\{L\}f\_\{l\}\(x;\\theta\)\\in\\mathbb\{R\}^\{LK\}, where⊕\\oplusdenotes concatenation\. We index individual features asf\(l,k\)​\(x;θ\)f^\{\(l,k\)\}\(x;\\theta\)for layerlland feature indexkk\.

### 2\.3Self\-Evolutionary Training

We consider the general framework of self\-evolutionary training, where a model iteratively improves by learning from self\-generated data\. We first formalize two representative algorithms, then show they share a common mathematical structure\.

#### 2\.3\.1GRPO\-Based Evolution \(EVOL\-RL\)

Following\[[35](https://arxiv.org/html/2608.05158#bib.bib42)\], Group Relative Policy Optimization \(GRPO\) generatesGGresponses\{o1,…,oG\}\\\{o\_\{1\},\\ldots,o\_\{G\}\\\}for each promptqqand computes normalized advantages:

A^i=ri−mean​\(r1,…,rG\)std​\(r1,…,rG\)\\hat\{A\}\_\{i\}=\\frac\{r\_\{i\}\-\\mathrm\{mean\}\(r\_\{1\},\\ldots,r\_\{G\}\)\}\{\\mathrm\{std\}\(r\_\{1\},\\ldots,r\_\{G\}\)\}\(1\)The policy is updated via the clipped surrogate objective:

ℒGRPO​\(θ\)=1G​∑i=1G1\|oi\|​∑t=1\|oi\|min⁡\{ρi,t​A^i,t,clip​\(ρi,t,1−ϵ,1\+ϵ\)​A^i,t\}\\displaystyle\\mathcal\{L\}\_\{\\text\{GRPO\}\}\(\\theta\)=\\frac\{1\}\{G\}\\sum\_\{i=1\}^\{G\}\\frac\{1\}\{\|o\_\{i\}\|\}\\sum\_\{t=1\}^\{\|o\_\{i\}\|\}\\min\\left\\\{\\rho\_\{i,t\}\\hat\{A\}\_\{i,t\},\\mathrm\{clip\}\(\\rho\_\{i,t\},1\-\\epsilon,1\+\\epsilon\)\\hat\{A\}\_\{i,t\}\\right\\\}

\(2\)whereρi,t=πθ​\(oi,t\|q,oi,<t\)πθold​\(oi,t\|q,oi,<t\)\\rho\_\{i,t\}=\\frac\{\\pi\_\{\\theta\}\(o\_\{i,t\}\|q,o\_\{i,<t\}\)\}\{\\pi\_\{\\theta\_\{\\text\{old\}\}\}\(o\_\{i,t\}\|q,o\_\{i,<t\}\)\}is the importance ratio\. EVOL\-RL applies this objective iteratively on self\-generated reasoning tasks\.

#### 2\.3\.2Zero Data Evolution \(Abs\-ZERO\)

The Abs\-ZERO framework\[[47](https://arxiv.org/html/2608.05158#bib.bib3)\]jointly trains a proposer policyπθpropose\\pi\_\{\\theta\}^\{\\text\{propose\}\}and a solver policyπθsolve\\pi\_\{\\theta\}^\{\\text\{solve\}\}with objective:

𝒥AZ​\(θ\)=𝔼z∼p​\(z\)​\[𝔼τ,\(x,y∗\)​\[repropose​\(τ,πθ\)\+λ​𝔼y∼πθsolve​\[resolve​\(y,y∗\)\]\]\]\\displaystyle\\mathcal\{J\}\_\{\\text\{AZ\}\}\(\\theta\)=\\mathbb\{E\}\_\{z\\sim p\(z\)\}\\left\[\\mathbb\{E\}\_\{\\tau,\(x,y^\{\*\}\)\}\\left\[r\_\{e\}^\{\\text\{propose\}\}\(\\tau,\\pi\_\{\\theta\}\)\+\\lambda\\mathbb\{E\}\_\{y\\sim\\pi\_\{\\theta\}^\{\\text\{solve\}\}\}\\left\[r\_\{e\}^\{\\text\{solve\}\}\(y,y^\{\*\}\)\\right\]\\right\]\\right\]

\(3\)whereτ\\tauis a proposed task,\(x,y∗\)\(x,y^\{\*\}\)is the task\-answer pair, andreproposer\_\{e\}^\{\\text\{propose\}\},resolver\_\{e\}^\{\\text\{solve\}\}are rewards for task proposal and solving respectively\.

#### 2\.3\.3Unified Formulation

Despite their different designs, both algorithms share a common structure: iteratively optimizing model parameters to maximize a task\-specific reward signal\. We abstract this asθ\(t\+1\)=θ\(t\)\+η​∇θℒevol​\(θ\(t\)\)\\theta^\{\(t\+1\)\}=\\theta^\{\(t\)\}\+\\eta\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta^\{\(t\)\}\), whereℒevol\\mathcal\{L\}\_\{\\text\{evol\}\}represents the evolution objective, which can be instantiated asℒGRPO\\mathcal\{L\}\_\{\\text\{GRPO\}\}or𝒥AZ\\mathcal\{J\}\_\{\\text\{AZ\}\}depending on the algorithm\. More generally, our framework applies to any self\-evolution algorithm that satisfies three conditions: \(1\) it optimizes model parametersθ\\thetavia gradient\-based updates, \(2\) the optimization objectiveℒevol\\mathcal\{L\}\_\{\\text\{evol\}\}is differentiable with respect toθ\\theta, and \(3\) it does not explicitly constrain safety\-related behaviors\.

### 2\.4Problem Formulation: Safety Degradation

We now formalize the phenomenon of safety degradation during evolution\.

###### Definition 3\(Safety Behavior\)\.

Let𝒟harm=\{xiharm\}i=1n\\mathcal\{D\}\_\{\\text\{harm\}\}=\\\{x\_\{i\}^\{\\text\{harm\}\}\\\}\_\{i=1\}^\{n\}be a set of harmful prompts\. A modelℳθ\\mathcal\{M\}\_\{\\theta\}exhibits safe behavior if for allx∈𝒟harmx\\in\\mathcal\{D\}\_\{\\text\{harm\}\}, we haveπθ​\(yrefuse\|x\)≥τ\\pi\_\{\\theta\}\(y\_\{\\text\{refuse\}\}\|x\)\\geq\\tau, whereyrefusey\_\{\\text\{refuse\}\}denotes refusal responses andτ∈\(0,1\)\\tau\\in\(0,1\)is a safety threshold\.

###### Definition 4\(Safety Degradation\)\.

Letθ0\\theta\_\{0\}be a safely\-aligned model satisfying Definition[3](https://arxiv.org/html/2608.05158#Thmtheorem3)\. We say evolutionary training inducessafety degradationif there existsT\>0T\>0such that:

𝔼x∼𝒟harm​\[πθ\(T\)​\(yrefuse\|x\)\]<𝔼x∼𝒟harm​\[πθ0​\(yrefuse\|x\)\]−δ\\displaystyle\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{harm\}\}\}\\left\[\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]<\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{harm\}\}\}\\left\[\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]\-\\delta

\(4\)for someδ\>0\\delta\>0\.

Our goal is to design an evolutionary framework that maximizes task performance while provably bounding safety degradation\.

Algorithm 1Circuit\-Anchored Evolution \(CAE\)0:Safely\-aligned model

θ0\\theta\_\{0\}, transcoders

\{𝒯l\}l=1L\\\{\\mathcal\{T\}\_\{l\}\\\}\_\{l=1\}^\{L\}, safety circuit

𝒮\\mathcal\{S\}, constraint weight

λ\\lambda, learning rate

η\\eta, evolution objective

ℒevol\\mathcal\{L\}\_\{\\text\{evol\}\}
0:Evolved model

θ\(T\)\\theta^\{\(T\)\}with preserved safety

1:Initialize

θ←θ0\\theta\\leftarrow\\theta\_\{0\}
2:Cache reference activations:

\{f𝒮​\(x;θ0\)\}x∈𝒟ref\\\{f\_\{\\mathcal\{S\}\}\(x;\\theta\_\{0\}\)\\\}\_\{x\\in\\mathcal\{D\}\_\{\\text\{ref\}\}\}
3:for

t=1t=1to

TTdo

4:// Standard evolution step

5:Compute evolution gradient:

gevol←∇θℒevol​\(θ\)g\_\{\\text\{evol\}\}\\leftarrow\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta\)
6:// Circuit anchoring step

7:Sample

\{xm\}m=1M\\\{x\_\{m\}\\\}\_\{m=1\}^\{M\}from reference distribution

8:foreach

xmx\_\{m\}do

9:Compute current activations via frozen transcoders:

f𝒮​\(xm;θ\)f\_\{\\mathcal\{S\}\}\(x\_\{m\};\\theta\)
10:Compute KL:

ℓm←∑\(l,k\)∈𝒮DK​L​\(f\(l,k\)​\(xm;θ0\)∥f\(l,k\)​\(xm;θ\)\)\\ell\_\{m\}\\leftarrow\\sum\_\{\(l,k\)\\in\\mathcal\{S\}\}D\_\{KL\}\(f^\{\(l,k\)\}\(x\_\{m\};\\theta\_\{0\}\)\\\|f^\{\(l,k\)\}\(x\_\{m\};\\theta\)\)
11:endfor

12:Compute anchor gradient:

ganchor←1M​∑m∇θℓmg\_\{\\text\{anchor\}\}\\leftarrow\\frac\{1\}\{M\}\\sum\_\{m\}\\nabla\_\{\\theta\}\\ell\_\{m\}
13:// Combined update

14:

θ←θ\+η​\(gevol−λ⋅ganchor\)\\theta\\leftarrow\\theta\+\\eta\\left\(g\_\{\\text\{evol\}\}\-\\lambda\\cdot g\_\{\\text\{anchor\}\}\\right\)
15:endfor

16:return

θ\(T\)\\theta^\{\(T\)\}

## 3Circuit\-Anchored Evolution

We summarize the complete CAE procedure in Algorithm[1](https://arxiv.org/html/2608.05158#alg1)\.

### 3\.1Safety Circuit Identification

We leverage the circuit tracing methodology\[[15](https://arxiv.org/html/2608.05158#bib.bib43)\]to identify features causally responsible for safety\.

###### Definition 5\(Attribution Score\)\.

For a feature\(l,k\)\(l,k\)and target logityy, the direct attribution score is defined as:

αy\(l,k\)​\(x;θ\):=∂log⁡πθ​\(y\|x\)∂f\(l,k\)​\(x;θ\)⋅f\(l,k\)​\(x;θ\)\\alpha^\{\(l,k\)\}\_\{y\}\(x;\\theta\):=\\frac\{\\partial\\log\\pi\_\{\\theta\}\(y\|x\)\}\{\\partial f^\{\(l,k\)\}\(x;\\theta\)\}\\cdot f^\{\(l,k\)\}\(x;\\theta\)\(5\)This measures the causal contribution of feature\(l,k\)\(l,k\)to the probability of outputyy\.

###### Definition 6\(Safety Circuit\)\.

Given a safely\-aligned modelθ0\\theta\_\{0\}, a harmful prompt set𝒟harm\\mathcal\{D\}\_\{\\text\{harm\}\}, and a thresholdγ\>0\\gamma\>0, the safety circuit is defined as:

𝒮:=\{\(l,k\):𝔼x∼𝒟harm​\[αyrefuse\(l,k\)​\(x;θ0\)\]≥γ\}\\mathcal\{S\}:=\\left\\\{\(l,k\):\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{harm\}\}\}\\left\[\\alpha^\{\(l,k\)\}\_\{y\_\{\\text\{refuse\}\}\}\(x;\\theta\_\{0\}\)\\right\]\\geq\\gamma\\right\\\}\(6\)We denotef𝒮​\(x;θ\):=\{f\(l,k\)​\(x;θ\)\}\(l,k\)∈𝒮f\_\{\\mathcal\{S\}\}\(x;\\theta\):=\\\{f^\{\(l,k\)\}\(x;\\theta\)\\\}\_\{\(l,k\)\\in\\mathcal\{S\}\}as the safety feature vector\.

### 3\.2Feature\-Space Anchoring

We now introduce our core contribution: a constraint that preserves safety circuit activations during evolution\.

###### Definition 8\(Circuit Activation Distribution\)\.

For a given input distributionp​\(x\)p\(x\)and safety circuit𝒮\\mathcal\{S\}, we define the circuit activation distribution as:

Pθ𝒮​\(f𝒮\):=𝔼x∼p​\(x\)​\[𝟏​\[f𝒮​\(x;θ\)=f𝒮\]\]P\_\{\\theta\}^\{\\mathcal\{S\}\}\(f\_\{\\mathcal\{S\}\}\):=\\mathbb\{E\}\_\{x\\sim p\(x\)\}\\left\[\\mathbf\{1\}\[f\_\{\\mathcal\{S\}\}\(x;\\theta\)=f\_\{\\mathcal\{S\}\}\]\\right\]\(7\)In practice, we treatf𝒮​\(x;θ\)f\_\{\\mathcal\{S\}\}\(x;\\theta\)as samples from this distribution\.

###### Definition 9\(Circuit\-Anchored Objective\)\.

The Circuit\-Anchored Evolution \(CAE\) objective augments the base evolutionary loss with a circuit\-level KL constraint:

ℒCAE​\(θ\):=ℒevol​\(θ\)−λ⋅ℒanchor​\(θ\)\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta\):=\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta\)\-\\lambda\\cdot\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta\)\(8\)where

ℒanchor​\(θ\):=DK​L​\(Pθ0𝒮∥Pθ𝒮\)=𝔼x∼p​\(x\)​\[∑\(l,k\)∈𝒮DK​L​\(f\(l,k\)​\(x;θ0\)∥f\(l,k\)​\(x;θ\)\)\]\\displaystyle\\begin\{aligned\} \\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta\)&:=D\_\{KL\}\\left\(P\_\{\\theta\_\{0\}\}^\{\\mathcal\{S\}\}\\\|P\_\{\\theta\}^\{\\mathcal\{S\}\}\\right\)\\\\ &=\\mathbb\{E\}\_\{x\\sim p\(x\)\}\\left\[\\sum\_\{\(l,k\)\\in\\mathcal\{S\}\}D\_\{KL\}\\left\(f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\\\|f^\{\(l,k\)\}\(x;\\theta\)\\right\)\\right\]\\end\{aligned\}

\(9\)andλ\>0\\lambda\>0is a hyperparameter controlling the constraint strength\.

### 3\.3Instantiation for Specific Algorithms

The CAE framework is algorithm\-agnostic and can be instantiated for any self\-evolution algorithm satisfying the conditions in Section[2\.3\.3](https://arxiv.org/html/2608.05158#S2.SS3.SSS3)\.

##### CAE for GRPO\-Based Evolution\.

For EVOL\-RL, we augment the GRPO objective \(Eq\.[2](https://arxiv.org/html/2608.05158#S2.E2)\):

ℒCAE\-GRPO​\(θ\)=ℒGRPO​\(θ\)−λ⋅ℒanchor​\(θ\)\\mathcal\{L\}\_\{\\text\{CAE\-GRPO\}\}\(\\theta\)=\\mathcal\{L\}\_\{\\text\{GRPO\}\}\(\\theta\)\-\\lambda\\cdot\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta\)\(10\)

##### CAE for Abs\-ZERO\.

For Abs\-ZERO, we augment the joint objective \(Eq\.[3](https://arxiv.org/html/2608.05158#S2.E3)\):

𝒥CAE\-AZ​\(θ\)=𝒥AZ​\(θ\)−λ⋅ℒanchor​\(θ\)\\mathcal\{J\}\_\{\\text\{CAE\-AZ\}\}\(\\theta\)=\\mathcal\{J\}\_\{\\text\{AZ\}\}\(\\theta\)\-\\lambda\\cdot\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta\)\(11\)The anchor constraint is applied to both proposer and solver policies, as they share underlying parameters\.

##### General Applicability\.

More broadly, CAE applies to any evolution algorithm of the formθ\(t\+1\)=θ\(t\)\+η​∇θℒevol​\(θ\(t\)\)\\theta^\{\(t\+1\)\}=\\theta^\{\(t\)\}\+\\eta\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta^\{\(t\)\}\)by simply adding the anchor term:

θ\(t\+1\)=θ\(t\)\+η​∇θ\(ℒevol​\(θ\(t\)\)−λ⋅ℒanchor​\(θ\(t\)\)\)\\theta^\{\(t\+1\)\}=\\theta^\{\(t\)\}\+\\eta\\nabla\_\{\\theta\}\\left\(\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta^\{\(t\)\}\)\-\\lambda\\cdot\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta^\{\(t\)\}\)\\right\)\(12\)This includes Self\-Play Fine\-Tuning, Self\-Rewarding LMs, iterative DPO, and future gradient\-based evolution methods\.

### 3\.4Theoretical Analysis

We now establish key theoretical properties of the CAE objective\.

###### Assumption 10\.

We assume the following regularity conditions:\(1\) Bounded activations:There existsB\>0B\>0such that‖f​\(x;θ\)‖∞≤B\\\|f\(x;\\theta\)\\\|\_\{\\infty\}\\leq Bfor allx,θx,\\theta\.\(2\) Lipschitz continuity:The feature mapθ↦f𝒮​\(x;θ\)\\theta\\mapsto f\_\{\\mathcal\{S\}\}\(x;\\theta\)isLfL\_\{f\}\-Lipschitz for allxx\.\(3\) Almost\-everywhere differentiability:The encoderElE\_\{l\}is differentiable almost everywhere with bounded Jacobian‖JEl‖≤M\\\|J\_\{E\_\{l\}\}\\\|\\leq M\.

###### Proposition 1\(Gradient of Anchor Loss\)\.

Under Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10)\(Condition 3\), the gradient of the anchor loss admits the form:

∇θℒanchor​\(θ\)=𝔼x∼p​\(x\)​\[∑\(l,k\)∈𝒮\(1\+log⁡f\(l,k\)​\(x;θ\)f\(l,k\)​\(x;θ0\)\)​∇θf\(l,k\)​\(x;θ\)\]\\displaystyle\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta\)=\\mathbb\{E\}\_\{x\\sim p\(x\)\}\\left\[\\sum\_\{\(l,k\)\\in\\mathcal\{S\}\}\\left\(1\+\\log\\frac\{f^\{\(l,k\)\}\(x;\\theta\)\}\{f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\}\\right\)\\nabla\_\{\\theta\}f^\{\(l,k\)\}\(x;\\theta\)\\right\]

\(13\)where the gradient flows through the frozen transcoder encoder\.

###### Proof\.

By the chain rule and the definition of KL divergence for continuous distributions\. The transcoder weights are frozen, so gradients pass throughElE\_\{l\}tohlh\_\{l\}and subsequently toθ\\theta\. Full derivation in Appendix[B](https://arxiv.org/html/2608.05158#A2)\. ∎

### 3\.5Safety Preservation Guarantee

We now prove that CAE provides a formal guarantee of safety preservation\.

###### Theorem 12\(Conditional Safety Bound\)\.

Letθ0\\theta\_\{0\}be a safely\-aligned model andθ\(T\)\\theta^\{\(T\)\}be the model afterTTsteps of CAE training with constraint weightλ\\lambda\. Under Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10)\(Conditions 1 and 2\), if the anchor loss is bounded asℒanchor​\(θ\(T\)\)≤ϵ\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta^\{\(T\)\}\)\\leq\\epsilon, then:

\|𝔼x∼𝒟harm\[πθ\(T\)\(yrefuse\|x\)−πθ0\(yrefuse\|x\)\]\|≤Cϵ\\left\|\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{harm\}\}\}\\left\[\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\-\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]\\right\|\\leq C\\sqrt\{\\epsilon\}\(14\)whereCCis a constant depending onBB,LfL\_\{f\}, and the circuit size\|𝒮\|\|\\mathcal\{S\}\|\.

###### Corollary 14\.

Ifλ\\lambdais chosen such thatℒanchor​\(θ\(t\)\)≤ϵ\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta^\{\(t\)\}\)\\leq\\epsilonfor allt≤Tt\\leq T, then CAE prevents safety degradation \(Definition[4](https://arxiv.org/html/2608.05158#Thmtheorem4)\) withδ=C​ϵ\\delta=C\\sqrt\{\\epsilon\}\.

### 3\.6Comparison with Explicit Safety Constraints

We contrast our implicit circuit\-based constraint with explicit behavioral constraints via reward models\.

###### Definition 15\(Reward\-Based Safety Constraint\)\.

Given a safety reward modelRsafe:𝒳×𝒴→ℝR\_\{\\text\{safe\}\}:\\mathcal\{X\}\\times\\mathcal\{Y\}\\to\\mathbb\{R\}, the reward\-based evolution objective is:

ℒRM​\(θ\)=ℒevol​\(θ\)\+λRM​𝔼x,y∼πθ​\[Rsafe​\(x,y\)\]\\mathcal\{L\}\_\{\\text\{RM\}\}\(\\theta\)=\\mathcal\{L\}\_\{\\text\{evol\}\}\(\\theta\)\+\\lambda\_\{\\text\{RM\}\}\\mathbb\{E\}\_\{x,y\\sim\\pi\_\{\\theta\}\}\\left\[R\_\{\\text\{safe\}\}\(x,y\)\\right\]\(15\)

###### Proposition 2\(Comparison of Constraint Paradigms\)\.

Letdoutd\_\{\\text\{out\}\}be the vocabulary size\. Comparing circuit\-based and reward\-based constraints reveals three key differences:\(1\) Dimensionality:The reward constraint operates onO​\(dout\)O\(d\_\{\\text\{out\}\}\)output dimensions per token, while the circuit constraint operates onO​\(\|𝒮\|\)O\(\|\\mathcal\{S\}\|\)feature dimensions, where\|𝒮\|≪dout\|\\mathcal\{S\}\|\\ll d\_\{\\text\{out\}\}\.\(2\) Specificity:The reward constraint penalizes all outputs deemed unsafe regardless of internal mechanism, whereas the circuit constraint specifically preserves the features causally responsible for safe behavior\.\(3\) Computational cost:The reward constraint requires an additional forward pass throughRsafeR\_\{\\text\{safe\}\}for each generated sequence, while the circuit constraint requires only activation extraction through frozen transcoders, with a minimal cost ofO​\(\|𝒮\|⋅d\)O\(\|\\mathcal\{S\}\|\\cdot d\)\.

## 4Experiments

### 4\.1Settings

Table 1:Strict separation of datasets for circuit tracing and causal verification\.We conduct experiments on three instruction\-tuned model families with available pre\-trained transcoders: Qwen3\-4B\-Instruct, Gemma\-2\-2B\-IT, and Llama\-3\.2\-1B\-Instruct\. We choose instruction\-tuned models as our starting point because they represent the realistic deployment setting where capability enhancement is most valuable, and they possess identifiable safety circuits that can be anchored during evolution\. We evaluate on two representative self\-evolution algorithms: EVOL\-RL\[[48](https://arxiv.org/html/2608.05158#bib.bib2)\], a GRPO\-based algorithm that improves mathematical reasoning through self\-generated problems, and Abs\-ZERO\[[47](https://arxiv.org/html/2608.05158#bib.bib3)\], a joint proposer\-solver framework achieving self\-improvement with zero external data\. For both algorithms, we use the original training and evaluation configurations and datasets as described in their respective papers, evolving each model for 500 steps with batch size 32\. We report the average accuracy across benchmarks as the overall capability score\.

![Refer to caption](https://arxiv.org/html/2608.05158v1/x2.png)

Figure 2:Safety degradation during unconstrained self\-evolution\. We track the refusal rate across500500evolution steps for three instruction\-tuned models\. All models exhibit severe safety collapse\. This consistent pattern across model families demonstrates that safety degradation is an inherent risk of unconstrained evolution, not an artifact of specific architectures\.For safety circuit location and evaluation, we adopt the framework from\[[21](https://arxiv.org/html/2608.05158#bib.bib46)\]\. To ensure the identified circuits capture universal safety mechanisms rather than dataset\-specific artifacts, we employ amulti\-dataset intersectionpipeline with strict separation between tracing and testing phases \(Table[1](https://arxiv.org/html/2608.05158#S4.T1)\)\. For circuit tracing, we use a diverse corpus of 1,429 prompts spanning Do\-Not\-Answer\[[43](https://arxiv.org/html/2608.05158#bib.bib48)\], DAN\[[37](https://arxiv.org/html/2608.05158#bib.bib49)\], and Malicious Instruct\[[18](https://arxiv.org/html/2608.05158#bib.bib50)\]\. By tracing circuits across these diverse formats and taking their intersection, we effectively decouple the circuit from domain\-specific vocabulary or syntactic patterns\. Crucially, for causal verification and safety evaluation during evolution, we use an entirely held\-out dataset, AdvBench\[[49](https://arxiv.org/html/2608.05158#bib.bib45)\]\(520 queries\)\. The fact that our identified circuit maintains strong causal effects on this unseen dataset strongly validates our intersection methodology\. We also measure over\-refusal rate using 1,000 benign queries from the Alpaca dataset, where a lower rate indicates better usability\.

### 4\.2Safety Degradation in Unconstrained Evolution

Before introducing our method, we first quantify the severity of safety degradation in current self\-evolution algorithms\. Figure[2](https://arxiv.org/html/2608.05158#S4.F2)tracks the refusal rate of three instruction\-tuned models during500500steps of unconstrained evolution under two algorithms: EVOL\-RL and Abs\-ZERO\. The pattern is striking and consistent across all settings\. Models begin with near\-perfect refusal rates \(9696–99%99\\%\) but experience rapid degradation within the first200200steps, losing approximately1515–2020percentage points\. By the end of evolution, refusal rates stabilize around7070–75%75\\%, representing a degradation of roughly2525percentage points\. While the final refusal rates remain above the50%50\\%threshold, this degradation is still concerning for two reasons\. First, a model that refuses only70%70\\%of harmful requests will comply with nearly one\-third of them, substantially increasing risk in deployment\. Second, and more importantly, this degradation occurs after only500500evolution steps\. Extended evolution, which is common in practice for maximizing capability gains, would likely lead to further safety collapse\. The consistency of this pattern across three model families \(Qwen, Gemma, Llama\) and two evolution algorithms indicates that safety degradation is an inherent risk of unconstrained self\-evolution, not an artifact of specific architectures or training procedures\. Notably, the degradation curves show similar trajectories regardless of the starting refusal rate or model size, suggesting a fundamental tension between capability optimization and safety preservation\. These findings motivate our central question:Can we enable capability evolution while preventing safety degradation?

### 4\.3Causal Verification of Safety Circuit

To verify that the identified circuit is indeed causally responsible for safety behavior, we perform activation intervention experiments on the held\-out AdvBench dataset\. Specifically, we scale the activations of safety circuit features by factors ranging from 0 \(complete suppression\) to 10 \(strong amplification\) and measure the resulting refusal rate on these unseen harmful prompts\. Figure[3](https://arxiv.org/html/2608.05158#S4.F3)shows the results across three models\. For Llama\-3\.2\-2B\-Instruct, intervening on the safety circuit produces clear causal effects: suppressing activations \(scale<<1\.0\) dramatically reduces refusal rate, from 96\.2% at natural activation to 48\.7% when completely zeroed out\. This nearly 50 percentage point drop demonstrates that the safety circuit is necessary for refusal behavior\. Amplifying activations \(scale\>\>1\.0\) produces modest further increases, reaching 99\.4% at scale=10, suggesting the circuit is already operating near saturation under natural conditions\. As a control, we perform the same intervention on randomly selected features of equal size\. The random circuit shows no systematic response to scaling: refusal rate fluctuates within a narrow band \(±\\pm8%\) around the mean, with no consistent trend as scale increases\. This confirms that the observed causal effect is specific to the identified safety circuit, not a general artifact of feature intervention\. The consistent pattern across Llama, Qwen, and Gemma confirms that the identified safety circuits causally mediate safety behavior\. These findings validate our circuit identification methodology and justify using the safety circuit as an anchor during evolution\. The circuit is bothnecessary\(suppression causes safety collapse\) andspecific\(random features have no effect\), analogous to how Hox genes are both essential for body plan and distinct from peripheral genes\.

![Refer to caption](https://arxiv.org/html/2608.05158v1/x3.png)

Figure 3:Causal verification of the safety circuit across three model families\. We intervene on feature activations by scaling them from 0 to 10×\\timesand measure the resulting change in refusal rate\.Safety Circuit\(blue\): scaling down suppresses refusal behavior dramatically, while scaling up slightly amplifies it\.Random Circuit\(light blue\): scaling has no systematic effect, with refusal rate fluctuating within±\\pm8% around the mean, confirming that the effect is specific to the identified safety circuit rather than a general property of feature intervention\.
### 4\.4Safety Preservation During Evolution

Having established that the identified safety circuit causally mediates refusal behavior, we now examine whether anchoring this circuit can preserve safety during self\-evolution\. We compare three approaches: \(1\) unconstrained evolution without any safety mechanism, \(2\) explicit constraint using Beaver\-Cost\[[6](https://arxiv.org/html/2608.05158#bib.bib44)\]as a safety reward model that penalizes unsafe outputs during evolution, and \(3\) our implicit constraint \(CAE\) with KL divergence on safety circuits\. For CAE, we set constraint weightλ=0\.1\\lambda=0\.1and useM=64M=64reference samples for computing the circuit KL loss\. Safety circuits are extracted once before evolution using the circuit\-tracer toolkit, comprising 1\.2%–1\.8% of total transcoder features across different models\. Figure[5](https://arxiv.org/html/2608.05158#S4.F5)traces the safety\-capability trajectories of three models under different constraint strategies\. Each trajectory begins at the original aligned model and progresses through evolution\. Without any constraint, all models follow a troubling pattern: capability improves steadily while safety collapses\. For the EVOL\-RL evolution algorithm, the safety score of Qwen3\-4B\-Instruct drops from99\.0499\.04% to69\.8569\.85%; that of Gemma\-2\-2B\-IT drops from98\.6598\.65% to75\.3875\.38%; Llama\-3\.2\-1B\-Instruct from96\.2296\.22% to72\.1372\.13%\. The same phenomenon is also observed for the Abs\-ZERO evolution algorithm\. The models become stronger reasoners but lose their ability to refuse harmful requests\. Adding an explicit safety reward model partially arrests this decline\. Although the decline in safety performance has diminished, the increase in capabilities during the evolutionary process has also diminished\. The reward signal, while protective, appears to interfere with task learning\. Circuit anchoring produces a qualitatively different trajectory\. Safety remains above9595% throughout evolution, while capability gains match those of unconstrained evolution\. The models evolve freely in capability\-relevant dimensions while remaining anchored in safety\-critical ones\. This pattern holds across all three model families and both evolution algorithms\. Furthermore, to verify the scalability and durability of our approach, we conduct extended stress\-test experiments on larger models \(Gemma\-2\-9B\-IT\) and significantly longer evolution horizons \(up to 5,000 steps\)\. As detailed in Appendix[E](https://arxiv.org/html/2608.05158#A5),

![Refer to caption](https://arxiv.org/html/2608.05158v1/x4.png)Figure 4:Effect of constraint weightλ\\lambdaof Llama\-3\.2\-1B\-Instruct with EVOL\-RL\. Smallλ\\lambdaprovides insufficient safety, while excessively large values cause capability degradation and increased over\-refusal\.CAE consistently maintains high safety \(\>95%\>95\\%\) without compromising capability gains, demonstrating its robust protection even under extreme evolutionary pressure\.

![Refer to caption](https://arxiv.org/html/2608.05158v1/x5.png)Figure 5:Safety\-capability trajectories during evolution across three model families\. Standard evolution improves capability but severely degrades safety\. \+RM partially preserves safety at the cost of reduced capability gains\. \+CAE maintains high safety while achieving comparable capability improvement to unconstrained evolution\. The CAE trajectories cluster tightly in the upper\-right region across both algorithms, demonstrating consistent safety preservation regardless of the underlying evolution method\.
### 4\.5Effect of Constraint Weight

The hyperparameterλ\\lambdacontrols the strength of the circuit anchoring constraint\. Figure[4](https://arxiv.org/html/2608.05158#S4.F4)shows the effect of varyingλ\\lambdaacross safety and capability metrics\. Whenλ=0\\lambda=0\(no constraint\), the model achieves high capability scores but suffers severe safety degradation\. Asλ\\lambdaincreases, refusal rate improves substantially, reaching around9090% atλ=0\.5\\lambda=0\.5\. However, excessively largeλ\\lambdavalues introduce two negative effects\. First, capability scores begin to decline \(although slightly\)\. Second, over\-refusal rate begins to rise sharply, indicating the model becomes overly conservative and refuses benign requests\. We use0\.80\.8as the constraint weight for the safety circuit in evolution, achieving a high refusal rate \(\>95\>95%\) while maintaining capability and keeping over\-refusal below1818%\.

## 5Related Work

Self\-evolution enhances model capabilities without extensive human supervision via iterative policy optimization\[[48](https://arxiv.org/html/2608.05158#bib.bib2)\]or abstraction\-based reasoning\[[47](https://arxiv.org/html/2608.05158#bib.bib3)\]\. However, these methods uniformly neglect safety preservation\. Given mounting evidence that safety alignment is surprisingly brittle\[[20](https://arxiv.org/html/2608.05158#bib.bib24),[31](https://arxiv.org/html/2608.05158#bib.bib25)\]and easily compromised by benign fine\-tuning\[[32](https://arxiv.org/html/2608.05158#bib.bib28),[11](https://arxiv.org/html/2608.05158#bib.bib52)\], this neglect poses severe risks\. Recent analyses reveal that such safety collapse is closely tied to the similarity between alignment and fine\-tuning data\[[17](https://arxiv.org/html/2608.05158#bib.bib53)\]\. While some explicit constraint methods have been proposed to restore safety during fine\-tuning\[[29](https://arxiv.org/html/2608.05158#bib.bib51)\], they rely on external supervision and are difficult to scale\. This motivates our search for structural, rather than purely behavioral, safety preservation in the self\-evolution setting\. Our approach builds on mechanistic interpretability\[[38](https://arxiv.org/html/2608.05158#bib.bib29)\], specifically the circuits framework\[[41](https://arxiv.org/html/2608.05158#bib.bib47)\]and transcoders\[[7](https://arxiv.org/html/2608.05158#bib.bib23)\], which decompose activations into interpretable features\. Recent work localizes refusal behaviors to specific directions\[[2](https://arxiv.org/html/2608.05158#bib.bib32)\]and traces information flow\[[3](https://arxiv.org/html/2608.05158#bib.bib33)\]\. We leverage the circuit\-tracer toolkit\[[16](https://arxiv.org/html/2608.05158#bib.bib31)\]to identify safety circuits and integrate them as optimization constraints\. Biologically, our approach is inspired by evolutionary developmental biology, where master regulatory genes \(e\.g\., Hox genes\) remain highly conserved across millions of years\[[5](https://arxiv.org/html/2608.05158#bib.bib36),[25](https://arxiv.org/html/2608.05158#bib.bib37)\]\. This conservation arises from purifying selection\[[39](https://arxiv.org/html/2608.05158#bib.bib38)\], enforcing developmental constraints\[[24](https://arxiv.org/html/2608.05158#bib.bib39)\]that forbid fatal evolutionary paths\. Coupled with modularity\[[42](https://arxiv.org/html/2608.05158#bib.bib40),[9](https://arxiv.org/html/2608.05158#bib.bib41)\], this allows robustness and evolvability to coexist\. We propose aligned language models exhibit analogous modularity, where safety circuits must remain conserved while capability components evolve\. Finally, unlike standard constrained optimization \(e\.g\., PPO\[[33](https://arxiv.org/html/2608.05158#bib.bib34)\]or elastic weight consolidation\[[22](https://arxiv.org/html/2608.05158#bib.bib35)\]\), our approach operates in the disentangled feature space, enabling surgical preservation of safety without impeding capability\.

## 6Conclusion

Current self\-evolution algorithms optimize purely for capability, leading to misevolution where models gain reasoning but progressively lose safety\. Mirroring biological evolution, where conserved Hox genes anchor essential functions while peripheral genes adapt freely, we propose Circuit\-Anchored Evolution \(CAE\)\. By identifying a minimal safety circuit via mechanistic interpretability and anchoring its activations within a small displacement bound, CAE acts as an artificial purifying selection\. It prevents safety\-disrupting updates while allowing free capability adaptation\. Experiments across diverse models and algorithms demonstrate that CAE achieves superior safety preservation, matches unconstrained capability gains, and incurs significantly lower overhead than reward\-based alternatives\. Ultimately, CAE enables AI systems to grow stronger without growing dangerous, achieving the evolutionary balance that allows life to flourish\.

## References

- \[1\]\(1989\)The logic of monsters: evidence for internal constraint in development and evolution\.Geobios22,pp\. 21–57\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[2\]A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda\(2024\)Refusal in language models is mediated by a single direction\.Advances in Neural Information Processing Systems37,pp\. 136037–136083\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[3\]G\. Birardi\(2025\)Automated circuit interpretation via probe prompting\.arXiv preprint arXiv:2511\.07002\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[4\]T\. D\. Brunet, W\. F\. Doolittle, and J\. P\. Bielawski\(2021\)The role of purifying selection in the origin and maintenance of complex function\.Studies in History and Philosophy of Science Part A87,pp\. 125–135\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[5\]S\. B\. Carroll\(2005\)Endless forms most beautiful: the new science of evo devo and the making of the animal kingdom\.WW Norton & Company\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[6\]J\. Dai, X\. Pan, R\. Sun, J\. Ji, X\. Xu, M\. Liu, Y\. Wang, and Y\. Yang\(2023\)Safe rlhf: safe reinforcement learning from human feedback\.External Links:2310\.12773,[Link](https://arxiv.org/abs/2310.12773)Cited by:[§4\.4](https://arxiv.org/html/2608.05158#S4.SS4.p1.9)\.
- \[7\]J\. Dunefsky, P\. Chlenski, and N\. Nanda\(2024\)Transcoders find interpretable llm feature circuits\.Advances in Neural Information Processing Systems37,pp\. 24375–24410\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p4.1),[§2\.2](https://arxiv.org/html/2608.05158#S2.SS2.p1.1),[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[8\]N\. J\. Emery and N\. S\. Clayton\(2005\)Evolution of the avian brain and intelligence\.Current Biology15\(23\),pp\. R946–R950\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[9\]M\. Félix and M\. Barkoulas\(2015\)Pervasive robustness in biological systems\.Nature Reviews Genetics16\(8\),pp\. 483–496\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[10\]L\. Feng, Z\. Xue, T\. Liu, and B\. An\(2025\)Group\-in\-group policy optimization for llm agent training\.arXiv preprint arXiv:2505\.10978\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[11\]K\. C\. Fraser, H\. Dawkins, I\. Nejadgholi, and S\. Kiritchenko\(2025\)Fine\-tuning lowers safety and disrupts evaluation consistency\.External Links:2506\.17209,[Link](https://arxiv.org/abs/2506.17209)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[12\]H\. Gao, J\. Geng, W\. Hua, M\. Hu, X\. Juan, H\. Liu, S\. Liu, J\. Qiu, X\. Qi, Y\. Wu,et al\.\(2025\)A survey of self\-evolving agents: on path to artificial super intelligence\.arXiv preprint arXiv:2507\.21046\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[13\]F\. Goodman and P\. Scambler\(2001\)Human hox gene mutations\.Clinical genetics59\(1\),pp\. 1–11\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[14\]K\. A\. Hanley\(2011\)The double\-edged sword: how evolution can make or break a live\-attenuated virus vaccine\.Evolution: Education and Outreach4\(4\),pp\. 635–643\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[15\]M\. Hanna, M\. Piotrowski, J\. Lindsey, and E\. Ameisen\(2025\)Circuit\-tracer: a new library for finding feature circuits\.InProceedings of the 8th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP,pp\. 239–249\.Cited by:[§3\.1](https://arxiv.org/html/2608.05158#S3.SS1.p1.1)\.
- \[16\]M\. Hanna, M\. Piotrowski, J\. Lindsey, and E\. Ameisen\(2025\)Circuit\-tracer\.Note:[https://github\.com/safety\-research/circuit\-tracer](https://github.com/safety-research/circuit-tracer)The first two authors contributed equally and are listed alphabetically\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[17\]L\. Hsiung, T\. Pang, Y\. Tang, L\. Song, T\. Ho, P\. Chen, and Y\. Yang\(2025\)Why llm safety guardrails collapse after fine\-tuning: a similarity analysis between alignment and fine\-tuning datasets\.External Links:2506\.05346,[Link](https://arxiv.org/abs/2506.05346)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[18\]Y\. Huang, S\. Gupta, M\. Xia, K\. Li, and D\. Chen\(2023\)Catastrophic jailbreak of open\-source llms via exploiting generation\.External Links:2310\.06987,[Link](https://arxiv.org/abs/2310.06987)Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p2.1),[Table 1](https://arxiv.org/html/2608.05158#S4.T1.1.1.4.3.2)\.
- \[19\]C\. L\. Hughes and T\. C\. Kaufman\(2002\)Hox genes and the evolution of the arthropod body plan 1\.Evolution & development4\(6\),pp\. 459–499\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[20\]J\. Ji, K\. Wang, T\. Qiu, B\. Chen, J\. Zhou, C\. Li, H\. Lou, J\. Dai, Y\. Liu, and Y\. Yang\(2025\)Language models resist alignment: evidence from data compression\.External Links:2406\.06144,[Link](https://arxiv.org/abs/2406.06144)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[21\]S\. Li, L\. Yao, L\. Zhang, and Y\. Li\(2024\)Safety layers in aligned large language models: the key to llm security\.arXiv preprint arXiv:2408\.17003\.Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p2.1)\.
- \[22\]Y\. Li, R\. Zhang, J\. Lu, and E\. Shechtman\(2020\)Few\-shot image generation with elastic weight consolidation\.arXiv preprint arXiv:2012\.02780\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[23\]M\. Mallo, D\. M\. Wellik, and J\. Deschamps\(2010\)Hox genes and regional patterning of the vertebrate body plan\.Developmental biology344\(1\),pp\. 7–15\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[24\]J\. Maynard Smith, R\. Burian, S\. Kauffman, P\. Alberch, J\. Campbell, B\. Goodwin, R\. Lande, D\. Raup, and L\. Wolpert\(1985\)Developmental constraints and evolution\.Quarterly Review of Biology60\(3\),pp\. 265–287\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[25\]W\. McGinnis\(1994\)A century of homeosis, a decade of homeoboxes\.Genetics137\(3\),pp\. 607\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[26\]T\. Miconi\(2008\)Evolution and complexity: the double\-edged sword\.Artificial life14\(3\),pp\. 325–344\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[27\]A\. Novikov, N\. Vũ, M\. Eisenberger, E\. Dupont, P\. Huang, A\. Z\. Wagner, S\. Shirobokov, B\. Kozlovskii, F\. J\. Ruiz, A\. Mehrabian,et al\.\(2025\)AlphaEvolve: a coding agent for scientific and algorithmic discovery\.arXiv preprint arXiv:2506\.13131\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[28\]J\. C\. Pearson, D\. Lemons, and W\. McGinnis\(2005\)Modulating hox gene functions during animal body patterning\.Nature Reviews Genetics6\(12\),pp\. 893–904\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[29\]S\. Peng, P\. Chen, J\. Chi, S\. Lee, and D\. H\. Chau\(2025\)Shape it up\! restoring llm safety during finetuning\.External Links:2505\.17196,[Link](https://arxiv.org/abs/2505.17196)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[30\]M\. Perc and A\. Szolnoki\(2015\)A double\-edged sword: benefits and pitfalls of heterogeneous punishment in evolutionary inspection games\.Scientific reports5\(1\),pp\. 11027\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[31\]X\. Qi, A\. Panda, K\. Lyu, X\. Ma, S\. Roy, A\. Beirami, P\. Mittal, and P\. Henderson\(2024\)Safety alignment should be made more than just a few tokens deep\.External Links:2406\.05946,[Link](https://arxiv.org/abs/2406.05946)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[32\]X\. Qi, Y\. Zeng, T\. Xie, P\. Chen, R\. Jia, P\. Mittal, and P\. Henderson\(2023\)Fine\-tuning aligned language models compromises safety, even when users do not intend to\!\.External Links:2310\.03693,[Link](https://arxiv.org/abs/2310.03693)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[33\]J\. Schulman, F\. Wolski, P\. Dhariwal, A\. Radford, and O\. Klimov\(2017\)Proximal policy optimization algorithms\.External Links:1707\.06347,[Link](https://arxiv.org/abs/1707.06347)Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[34\]S\. Shao, Q\. Ren, C\. Qian, B\. Wei, D\. Guo, J\. Yang, X\. Song, L\. Zhang, W\. Zhang, D\. Liu, and J\. Shao\(2025\)Your agent may misevolve: emergent risks in self\-evolving llm agents\.External Links:2509\.26354,[Link](https://arxiv.org/abs/2509.26354)Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p3.1)\.
- \[35\]Z\. Shao, P\. Wang, Q\. Zhu, R\. Xu, J\. Song, X\. Bi, H\. Zhang, M\. Zhang, Y\. Li, Y\. Wu,et al\.\(2024\)Deepseekmath: pushing the limits of mathematical reasoning in open language models\.arXiv preprint arXiv:2402\.03300\.Cited by:[§2\.3\.1](https://arxiv.org/html/2608.05158#S2.SS3.SSS1.p1.3)\.
- \[36\]A\. A\. Sharov\(2014\)Evolutionary constraints or opportunities?\.Biosystems123,pp\. 9–18\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[37\]X\. Shen, Z\. Chen, M\. Backes, Y\. Shen, and Y\. Zhang\(2024\)"Do anything now": characterizing and evaluating in\-the\-wild jailbreak prompts on large language models\.External Links:2308\.03825,[Link](https://arxiv.org/abs/2308.03825)Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p2.1),[Table 1](https://arxiv.org/html/2608.05158#S4.T1.1.1.3.2.2)\.
- \[38\]A\. Smart and A\. Kasirzadeh\(2025\)Beyond model interpretability: socio\-structural explanations in machine learning\.AI & SOCIETY40\(4\),pp\. 2045–2053\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[39\]D\. L\. Stern\(2000\)Perspective: evolutionary developmental biology and the problem of variation\.Evolution54\(4\),pp\. 1079–1091\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[40\]Z\. Tao, T\. Lin, X\. Chen, H\. Li, Y\. Wu, Y\. Li, Z\. Jin, F\. Huang, D\. Tao, and J\. Zhou\(2024\)A survey on self\-evolution of large language models\.External Links:2404\.14387,[Link](https://arxiv.org/abs/2404.14387)Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[41\]C\. Tigges, M\. Hanna, Q\. Yu, and S\. Biderman\(2024\)LLM circuit analyses are consistent across training and scale\.External Links:2407\.10827,[Link](https://arxiv.org/abs/2407.10827)Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p4.1),[§5](https://arxiv.org/html/2608.05158#S5.p1.1),[Remark 7](https://arxiv.org/html/2608.05158#Thmtheorem7.p1.2)\.
- \[42\]G\. P\. Wagner, M\. Pavlicev, and J\. M\. Cheverud\(2007\)The road to modularity\.Nature Reviews Genetics8\(12\),pp\. 921–931\.Cited by:[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[43\]Y\. Wang, H\. Li, X\. Han, P\. Nakov, and T\. Baldwin\(2023\)Do\-not\-answer: a dataset for evaluating safeguards in llms\.External Links:2308\.13387,[Link](https://arxiv.org/abs/2308.13387)Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p2.1),[Table 1](https://arxiv.org/html/2608.05158#S4.T1.1.1.2.1.2)\.
- \[44\]D\. Williams\(2023\)Eagle eyed or bird brained?\.Eye37\(12\),pp\. 2426–2430\.Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p1.1)\.
- \[45\]H\. Xiao, G\. Wang, Y\. Chai, Z\. Lu, W\. Lin, H\. He, L\. Fan, L\. Bian, R\. Hu, L\. Liu, S\. Ren, Y\. Wen, X\. Chen, A\. Zhou, and H\. Li\(2025\)UI\-genie: a self\-improving approach for iteratively boosting mllm\-based mobile gui agents\.External Links:2505\.21496,[Link](https://arxiv.org/abs/2505.21496)Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[46\]Z\. Yue, K\. Upasani, X\. Yang, S\. Ge, S\. Nie, Y\. Mao, Z\. Liu, and D\. Wang\(2026\)Dr\. zero: self\-evolving search agents without training data\.External Links:2601\.07055,[Link](https://arxiv.org/abs/2601.07055)Cited by:[§1](https://arxiv.org/html/2608.05158#S1.p2.1)\.
- \[47\]A\. Zhao, Y\. Wu, Y\. Yue, T\. Wu, Q\. Xu, Y\. Yue, M\. Lin, S\. Wang, Q\. Wu, Z\. Zheng, and G\. Huang\(2025\)Absolute zero: reinforced self\-play reasoning with zero data\.External Links:2505\.03335,[Link](https://arxiv.org/abs/2505.03335)Cited by:[§2\.3\.2](https://arxiv.org/html/2608.05158#S2.SS3.SSS2.p1.2),[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p1.1),[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[48\]Y\. Zhou, Z\. Liang, H\. Liu, W\. Yu, K\. Panaganti, L\. Song, D\. Yu, X\. Zhang, H\. Mi, and D\. Yu\(2025\)Evolving language models without labels: majority drives selection, novelty promotes variation\.External Links:2509\.15194,[Link](https://arxiv.org/abs/2509.15194)Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p1.1),[§5](https://arxiv.org/html/2608.05158#S5.p1.1)\.
- \[49\]A\. Zou, Z\. Wang, N\. Carlini, M\. Nasr, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.arXiv preprint arXiv:2307\.15043\.Cited by:[§4\.1](https://arxiv.org/html/2608.05158#S4.SS1.p2.1),[Table 1](https://arxiv.org/html/2608.05158#S4.T1.1.1.5.4.2)\.

## Appendix ANotation Summary

For convenience, we summarize the notation used throughout the paper in Table[2](https://arxiv.org/html/2608.05158#A1.T2)\.

Table 2:Summary of notation\.
## Appendix BProof of Proposition 4\.6 \(Gradient of Circuit Loss\)

###### Proposition\(Restated\)\.

Under Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10), the gradient of the circuit loss admits the form:

∇θℒcircuit​\(θ\)=𝔼x∼p​\(x\)​\[∑\(l,k\)∈𝒮\(1\+log⁡f\(l,k\)​\(x;θ\)f\(l,k\)​\(x;θ0\)\)​∇θf\(l,k\)​\(x;θ\)\]\\nabla\_\{\\theta\}\\mathcal\{L\}\_\{\\text\{circuit\}\}\(\\theta\)=\\mathbb\{E\}\_\{x\\sim p\(x\)\}\\left\[\\sum\_\{\(l,k\)\\in\\mathcal\{S\}\}\\left\(1\+\\log\\frac\{f^\{\(l,k\)\}\(x;\\theta\)\}\{f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\}\\right\)\\nabla\_\{\\theta\}f^\{\(l,k\)\}\(x;\\theta\)\\right\]\(16\)

###### Proof\.

We begin by expanding the circuit loss\. By Definition[9](https://arxiv.org/html/2608.05158#Thmtheorem9):

ℒcircuit​\(θ\)=𝔼x∼p​\(x\)​\[∑\(l,k\)∈𝒮DK​L​\(f\(l,k\)​\(x;θ0\)∥f\(l,k\)​\(x;θ\)\)\]\\mathcal\{L\}\_\{\\text\{circuit\}\}\(\\theta\)=\\mathbb\{E\}\_\{x\\sim p\(x\)\}\\left\[\\sum\_\{\(l,k\)\\in\\mathcal\{S\}\}D\_\{KL\}\\left\(f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\\\|f^\{\(l,k\)\}\(x;\\theta\)\\right\)\\right\]\(17\)
For notational simplicity, we consider a single feature\(l,k\)\(l,k\)and drop the expectation temporarily\. Letp:=f\(l,k\)​\(x;θ0\)p:=f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\(reference, fixed\) andq:=f\(l,k\)​\(x;θ\)q:=f^\{\(l,k\)\}\(x;\\theta\)\(current, variable\)\.

Since we treat feature activations as parameters of distributions \(specifically, we use a softmax normalization over the feature dimension to obtain valid probability distributions\), the KL divergence is:

DK​L​\(p∥q\)=∑ipi​log⁡piqi=∑ipi​log⁡pi−∑ipi​log⁡qiD\_\{KL\}\(p\\\|q\)=\\sum\_\{i\}p\_\{i\}\\log\\frac\{p\_\{i\}\}\{q\_\{i\}\}=\\sum\_\{i\}p\_\{i\}\\log p\_\{i\}\-\\sum\_\{i\}p\_\{i\}\\log q\_\{i\}\(18\)
The first term is constant with respect toθ\\theta\. Taking the gradient of the second term:

∇θDK​L​\(p∥q\)\\displaystyle\\nabla\_\{\\theta\}D\_\{KL\}\(p\\\|q\)=−∇θ​∑ipi​log⁡qi\\displaystyle=\-\\nabla\_\{\\theta\}\\sum\_\{i\}p\_\{i\}\\log q\_\{i\}\(19\)=−∑ipi⋅1qi⋅∇θqi\\displaystyle=\-\\sum\_\{i\}p\_\{i\}\\cdot\\frac\{1\}\{q\_\{i\}\}\\cdot\\nabla\_\{\\theta\}q\_\{i\}\(20\)=−∑ipiqi​∇θqi\\displaystyle=\-\\sum\_\{i\}\\frac\{p\_\{i\}\}\{q\_\{i\}\}\\nabla\_\{\\theta\}q\_\{i\}\(21\)
Now, we need to compute∇θqi=∇θf\(l,k\)​\(x;θ\)\\nabla\_\{\\theta\}q\_\{i\}=\\nabla\_\{\\theta\}f^\{\(l,k\)\}\(x;\\theta\)\. By the chain rule:

∇θf\(l,k\)​\(x;θ\)=∇θEl​\(hl​\(x;θ\)\)k=JEl\(k\)⋅∇θhl​\(x;θ\)\\nabla\_\{\\theta\}f^\{\(l,k\)\}\(x;\\theta\)=\\nabla\_\{\\theta\}E\_\{l\}\(h\_\{l\}\(x;\\theta\)\)\_\{k\}=J\_\{E\_\{l\}\}^\{\(k\)\}\\cdot\\nabla\_\{\\theta\}h\_\{l\}\(x;\\theta\)\(22\)whereJEl\(k\)J\_\{E\_\{l\}\}^\{\(k\)\}is thekk\-th row of the Jacobian ofElE\_\{l\}, which is fixed since the transcoder is frozen\.

For the case where we treat activations directly \(without softmax normalization\), we use a Gaussian approximation\. Assumingf\(l,k\)∼𝒩​\(μ,σ2\)f^\{\(l,k\)\}\\sim\\mathcal\{N\}\(\\mu,\\sigma^\{2\}\), the KL divergence between two Gaussians with the same variance is:

DK​L​\(𝒩​\(μ0,σ2\)∥𝒩​\(μ,σ2\)\)=\(μ−μ0\)22​σ2D\_\{KL\}\(\\mathcal\{N\}\(\\mu\_\{0\},\\sigma^\{2\}\)\\\|\\mathcal\{N\}\(\\mu,\\sigma^\{2\}\)\)=\\frac\{\(\\mu\-\\mu\_\{0\}\)^\{2\}\}\{2\\sigma^\{2\}\}\(23\)
Taking the gradient:

∇θDK​L=μ−μ0σ2​∇θμ=f\(l,k\)​\(x;θ\)−f\(l,k\)​\(x;θ0\)σ2​∇θf\(l,k\)​\(x;θ\)\\nabla\_\{\\theta\}D\_\{KL\}=\\frac\{\\mu\-\\mu\_\{0\}\}\{\\sigma^\{2\}\}\\nabla\_\{\\theta\}\\mu=\\frac\{f^\{\(l,k\)\}\(x;\\theta\)\-f^\{\(l,k\)\}\(x;\\theta\_\{0\}\)\}\{\\sigma^\{2\}\}\\nabla\_\{\\theta\}f^\{\(l,k\)\}\(x;\\theta\)\(24\)
More generally, using the score function identity for exponential families, we can write:

∇θDK​L​\(p∥q\)=𝔼p​\[∇θlog⁡q\]=\(1\+log⁡qp\)​∇θq\\nabla\_\{\\theta\}D\_\{KL\}\(p\\\|q\)=\\mathbb\{E\}\_\{p\}\\left\[\\nabla\_\{\\theta\}\\log q\\right\]=\\left\(1\+\\log\\frac\{q\}\{p\}\\right\)\\nabla\_\{\\theta\}q\(25\)
Summing over all features in𝒮\\mathcal\{S\}and taking expectations completes the proof\. ∎

## Appendix CProof of Theorem[12](https://arxiv.org/html/2608.05158#Thmtheorem12)\(Safety Bound\)

###### Theorem\(Restated\)\.

Letθ0\\theta\_\{0\}be an aligned model andθ\(T\)\\theta^\{\(T\)\}be the model afterTTsteps of CAE training\. Under Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10)\(Conditions 1 and 2\), ifℒanchor​\(θ\(T\)\)≤ϵ\\mathcal\{L\}\_\{\\text\{anchor\}\}\(\\theta^\{\(T\)\}\)\\leq\\epsilon, then:

\|𝔼x∼𝒟harm\[πθ\(T\)\(yrefuse\|x\)−πθ0\(yrefuse\|x\)\]\|≤Cϵ\\left\|\\mathbb\{E\}\_\{x\\sim\\mathcal\{D\}\_\{\\text\{harm\}\}\}\\left\[\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\-\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]\\right\|\\leq C\\sqrt\{\\epsilon\}\(26\)whereCCdepends onBB,LfL\_\{f\}, and\|𝒮\|\|\{\}\\mathcal\{S\}\|\{\}\. Note that this proof does not require the transcoder to be differentiable \(Condition 3\)\.

###### Proof\.

The proof proceeds in three steps\.

Step 1: From KL to Total Variation\.

By Pinsker’s inequality, for any two distributionsPPandQQ:

‖P−Q‖TV≤12​DK​L​\(P∥Q\)\\\|P\-Q\\\|\_\{\\text\{TV\}\}\\leq\\sqrt\{\\frac\{1\}\{2\}D\_\{KL\}\(P\\\|Q\)\}\(27\)
Applying this to the circuit activation distributions:

‖Pθ0𝒮−Pθ\(T\)𝒮‖TV≤12​DK​L​\(Pθ0𝒮∥Pθ\(T\)𝒮\)≤ϵ2\\\|P\_\{\\theta\_\{0\}\}^\{\\mathcal\{S\}\}\-P\_\{\\theta^\{\(T\)\}\}^\{\\mathcal\{S\}\}\\\|\_\{\\text\{TV\}\}\\leq\\sqrt\{\\frac\{1\}\{2\}D\_\{KL\}\(P\_\{\\theta\_\{0\}\}^\{\\mathcal\{S\}\}\\\|P\_\{\\theta^\{\(T\)\}\}^\{\\mathcal\{S\}\}\)\}\\leq\\sqrt\{\\frac\{\\epsilon\}\{2\}\}\(28\)
Step 2: Lipschitz Property of Refusal Probability\.

We now establish that the refusal probability is Lipschitz in the safety circuit activations\. By Definition[6](https://arxiv.org/html/2608.05158#Thmtheorem6), the safety circuit𝒮\\mathcal\{S\}consists of features with high attribution scores for the refusal output\. This means:

πθ​\(yrefuse\|x\)≈g​\(f𝒮​\(x;θ\)\)\\pi\_\{\\theta\}\(y\_\{\\text\{refuse\}\}\|x\)\\approx g\(f\_\{\\mathcal\{S\}\}\(x;\\theta\)\)\(29\)for some functionggthat depends primarily on the safety features\.

By Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10)\(2\), the feature map isLfL\_\{f\}\-Lipschitz\. Furthermore, the output probability is a softmax function, which is Lipschitz with constant at most 1 in its inputs\. Therefore, there exists a constantLgL\_\{g\}such that:

\|πθ\(yrefuse\|x\)−πθ′\(yrefuse\|x\)\|≤Lg∥f𝒮\(x;θ\)−f𝒮\(x;θ′\)∥\|\\pi\_\{\\theta\}\(y\_\{\\text\{refuse\}\}\|x\)\-\\pi\_\{\\theta^\{\\prime\}\}\(y\_\{\\text\{refuse\}\}\|x\)\|\\leq L\_\{g\}\\\|f\_\{\\mathcal\{S\}\}\(x;\\theta\)\-f\_\{\\mathcal\{S\}\}\(x;\\theta^\{\\prime\}\)\\\|\(30\)
Step 3: Combining the Bounds\.

By the definition of total variation distance:

\|𝔼x\[πθ\(T\)\(yrefuse\|x\)\]−𝔼x\[πθ0\(yrefuse\|x\)\]\|\\displaystyle\\left\|\\mathbb\{E\}\_\{x\}\\left\[\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]\-\\mathbb\{E\}\_\{x\}\\left\[\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\]\\right\|\(31\)≤𝔼x\[\|πθ\(T\)\(yrefuse\|x\)−πθ0\(yrefuse\|x\)\|\]\\displaystyle\\leq\\mathbb\{E\}\_\{x\}\\left\[\\left\|\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\-\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\|\\right\]\(32\)≤Lg​𝔼x​\[‖f𝒮​\(x;θ\(T\)\)−f𝒮​\(x;θ0\)‖\]\\displaystyle\\leq L\_\{g\}\\mathbb\{E\}\_\{x\}\\left\[\\\|f\_\{\\mathcal\{S\}\}\(x;\\theta^\{\(T\)\}\)\-f\_\{\\mathcal\{S\}\}\(x;\\theta\_\{0\}\)\\\|\\right\]\(33\)≤Lg​\|𝒮\|⋅‖Pθ0𝒮−Pθ\(T\)𝒮‖TV⋅B\\displaystyle\\leq L\_\{g\}\\sqrt\{\|\\mathcal\{S\}\|\}\\cdot\\\|P\_\{\\theta\_\{0\}\}^\{\\mathcal\{S\}\}\-P\_\{\\theta^\{\(T\)\}\}^\{\\mathcal\{S\}\}\\\|\_\{\\text\{TV\}\}\\cdot B\(34\)≤Lg​\|𝒮\|⋅B⋅ϵ2\\displaystyle\\leq L\_\{g\}\\sqrt\{\|\\mathcal\{S\}\|\}\\cdot B\\cdot\\sqrt\{\\frac\{\\epsilon\}\{2\}\}\(35\)
where the third inequality uses Cauchy\-Schwarz and the bounded activation assumption\.

SettingC=Lg​\|𝒮\|⋅B/2C=L\_\{g\}\\sqrt\{\|\{\}\\mathcal\{S\}\|\{\}\}\\cdot B/\\sqrt\{2\}completes the proof\. ∎

## Appendix DAdditional Theoretical Results

### D\.1Convergence Analysis

We provide a convergence guarantee for the CAE algorithm under standard assumptions\.

###### Assumption 16\(Smoothness\)\.

The lossesℒevol\\mathcal\{L\}\_\{\\text\{evol\}\}andℒcircuit\\mathcal\{L\}\_\{\\text\{circuit\}\}areβ\\beta\-smooth, i\.e\., their gradients areβ\\beta\-Lipschitz:

‖∇ℒ​\(θ\)−∇ℒ​\(θ′\)‖≤β​‖θ−θ′‖\\\|\\nabla\\mathcal\{L\}\(\\theta\)\-\\nabla\\mathcal\{L\}\(\\theta^\{\\prime\}\)\\\|\\leq\\beta\\\|\\theta\-\\theta^\{\\prime\}\\\|\(36\)

###### Theorem 17\(Convergence Rate\)\.

Under Assumptions 4\.5 and[16](https://arxiv.org/html/2608.05158#Thmtheorem16), running Algorithm 1 with learning rateη=1β​\(1\+λ\)\\eta=\\frac\{1\}\{\\beta\(1\+\\lambda\)\}forTTiterations yields:

mint≤T⁡‖∇ℒCAE​\(θ\(t\)\)‖2≤2​β​\(1\+λ\)​\(ℒCAE​\(θ\(0\)\)−ℒCAE∗\)T\\min\_\{t\\leq T\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\\leq\\frac\{2\\beta\(1\+\\lambda\)\(\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(0\)\}\)\-\\mathcal\{L\}\_\{\\text\{CAE\}\}^\{\*\}\)\}\{T\}\(37\)whereℒCAE∗\\mathcal\{L\}\_\{\\text\{CAE\}\}^\{\*\}is the optimal value\.

###### Proof\.

Byβ\\beta\-smoothness ofℒCAE=ℒevol−λ​ℒcircuit\\mathcal\{L\}\_\{\\text\{CAE\}\}=\\mathcal\{L\}\_\{\\text\{evol\}\}\-\\lambda\\mathcal\{L\}\_\{\\text\{circuit\}\}:

ℒCAE​\(θ\(t\+1\)\)\\displaystyle\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\+1\)\}\)≤ℒCAE​\(θ\(t\)\)\+⟨∇ℒCAE​\(θ\(t\)\),θ\(t\+1\)−θ\(t\)⟩\\displaystyle\\leq\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\+\\langle\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\),\\theta^\{\(t\+1\)\}\-\\theta^\{\(t\)\}\\rangle\(38\)\+β​\(1\+λ\)2​‖θ\(t\+1\)−θ\(t\)‖2\\displaystyle\\quad\+\\frac\{\\beta\(1\+\\lambda\)\}\{2\}\\\|\\theta^\{\(t\+1\)\}\-\\theta^\{\(t\)\}\\\|^\{2\}\(39\)
Substitutingθ\(t\+1\)−θ\(t\)=η​∇ℒCAE​\(θ\(t\)\)\\theta^\{\(t\+1\)\}\-\\theta^\{\(t\)\}=\\eta\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\):

ℒCAE​\(θ\(t\+1\)\)\\displaystyle\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\+1\)\}\)≤ℒCAE​\(θ\(t\)\)−η​‖∇ℒCAE​\(θ\(t\)\)‖2\+β​\(1\+λ\)​η22​‖∇ℒCAE​\(θ\(t\)\)‖2\\displaystyle\\leq\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\-\\eta\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\+\\frac\{\\beta\(1\+\\lambda\)\\eta^\{2\}\}\{2\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\(40\)=ℒCAE​\(θ\(t\)\)−η​\(1−β​\(1\+λ\)​η2\)​‖∇ℒCAE​\(θ\(t\)\)‖2\\displaystyle=\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\-\\eta\\left\(1\-\\frac\{\\beta\(1\+\\lambda\)\\eta\}\{2\}\\right\)\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\(41\)
Withη=1β​\(1\+λ\)\\eta=\\frac\{1\}\{\\beta\(1\+\\lambda\)\}:

ℒCAE​\(θ\(t\+1\)\)≤ℒCAE​\(θ\(t\)\)−12​β​\(1\+λ\)​‖∇ℒCAE​\(θ\(t\)\)‖2\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\+1\)\}\)\\leq\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\-\\frac\{1\}\{2\\beta\(1\+\\lambda\)\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\(42\)
Summing fromt=0t=0toT−1T\-1and rearranging:

∑t=0T−1‖∇ℒCAE​\(θ\(t\)\)‖2≤2​β​\(1\+λ\)​\(ℒCAE​\(θ\(0\)\)−ℒCAE​\(θ\(T\)\)\)\\sum\_\{t=0\}^\{T\-1\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\\leq 2\\beta\(1\+\\lambda\)\(\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(0\)\}\)\-\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(T\)\}\)\)\(43\)
SinceℒCAE​\(θ\(T\)\)≥ℒCAE∗\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(T\)\}\)\\geq\\mathcal\{L\}\_\{\\text\{CAE\}\}^\{\*\}:

mint≤T⁡‖∇ℒCAE​\(θ\(t\)\)‖2≤1T​∑t=0T−1‖∇ℒCAE​\(θ\(t\)\)‖2≤2​β​\(1\+λ\)​\(ℒCAE​\(θ\(0\)\)−ℒCAE∗\)T\\min\_\{t\\leq T\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\\leq\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\\|\\nabla\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(t\)\}\)\\\|^\{2\}\\leq\\frac\{2\\beta\(1\+\\lambda\)\(\\mathcal\{L\}\_\{\\text\{CAE\}\}\(\\theta^\{\(0\)\}\)\-\\mathcal\{L\}\_\{\\text\{CAE\}\}^\{\*\}\)\}\{T\}\(44\)∎

### D\.2Sample Complexity for Circuit Identification

We analyze the number of samples needed to reliably identify the safety circuit\.

###### Theorem 18\(Circuit Identification Sample Complexity\)\.

Let𝒮∗\\mathcal\{S\}^\{\*\}be the true safety circuit and𝒮^n\\hat\{\\mathcal\{S\}\}\_\{n\}be the circuit estimated fromnnsamples\. Under Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10), with probability at least1−δ1\-\\delta:

\|𝒮^n​△​𝒮∗\|≤O​\(L​K​log⁡\(L​K/δ\)n​γ2\)\|\\hat\{\\mathcal\{S\}\}\_\{n\}\\triangle\\mathcal\{S\}^\{\*\}\|\\leq O\\left\(\\frac\{LK\\log\(LK/\\delta\)\}\{n\\gamma^\{2\}\}\\right\)\(45\)where△\\triangledenotes symmetric difference andγ\\gammais the attribution threshold from Definition[6](https://arxiv.org/html/2608.05158#Thmtheorem6)\.

###### Proof\.

The attribution score for each feature is estimated as:

α^\(l,k\)=1n​∑i=1nαyrefuse\(l,k\)​\(xi;θ0\)\\hat\{\\alpha\}^\{\(l,k\)\}=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}\\alpha^\{\(l,k\)\}\_\{y\_\{\\text\{refuse\}\}\}\(x\_\{i\};\\theta\_\{0\}\)\(46\)
By Hoeffding’s inequality, for each feature:

ℙ​\(\|α^\(l,k\)−α\(l,k\)\|\>ϵ\)≤2​exp⁡\(−2​n​ϵ2B2\)\\mathbb\{P\}\\left\(\|\\hat\{\\alpha\}^\{\(l,k\)\}\-\\alpha^\{\(l,k\)\}\|\>\\epsilon\\right\)\\leq 2\\exp\\left\(\-\\frac\{2n\\epsilon^\{2\}\}\{B^\{2\}\}\\right\)\(47\)
whereBBbounds the attribution scores \(Assumption[10](https://arxiv.org/html/2608.05158#Thmtheorem10)\(1\)\)\.

Taking a union bound over allL​KLKfeatures and settingϵ=γ/2\\epsilon=\\gamma/2:

ℙ\(∃\(l,k\):\|α^\(l,k\)−α\(l,k\)\|\>γ/2\)≤2LKexp\(−n​γ22​B2\)\\mathbb\{P\}\\left\(\\exists\(l,k\):\|\\hat\{\\alpha\}^\{\(l,k\)\}\-\\alpha^\{\(l,k\)\}\|\>\\gamma/2\\right\)\\leq 2LK\\exp\\left\(\-\\frac\{n\\gamma^\{2\}\}\{2B^\{2\}\}\\right\)\(48\)
For this probability to be at mostδ\\delta, we need:

n≥2​B2γ2​log⁡\(2​L​Kδ\)n\\geq\\frac\{2B^\{2\}\}\{\\gamma^\{2\}\}\\log\\left\(\\frac\{2LK\}\{\\delta\}\\right\)\(49\)
When all estimation errors are at mostγ/2\\gamma/2, any feature with true attribution≥γ\\geq\\gammawill have estimated attribution≥γ/2\\geq\\gamma/2, and any feature with true attribution<γ/2<\\gamma/2will have estimated attribution<γ<\\gamma\. This bounds the symmetric difference\. ∎

### D\.3Robustness to Circuit Misspecification

We analyze the effect of errors in circuit identification\.

###### Theorem 19\(Robustness\)\.

Let𝒮\\mathcal\{S\}be the identified circuit and𝒮∗\\mathcal\{S\}^\{\*\}be the true safety circuit\. If\|𝒮​△​𝒮∗\|≤ϵ𝒮​\|𝒮∗\|\|\{\}\\mathcal\{S\}\\triangle\\mathcal\{S\}^\{\*\}\|\{\}\\leq\\epsilon\_\{\\mathcal\{S\}\}\|\{\}\\mathcal\{S\}^\{\*\}\|\{\}for someϵ𝒮∈\[0,1\)\\epsilon\_\{\\mathcal\{S\}\}\\in\[0,1\), then the safety bound \(Theorem[12](https://arxiv.org/html/2608.05158#Thmtheorem12)\) degrades gracefully:

\|πθ\(T\)\(yrefuse\|x\)−πθ0\(yrefuse\|x\)\|≤Cϵ\+C′ϵ𝒮\\left\|\\pi\_\{\\theta^\{\(T\)\}\}\(y\_\{\\text\{refuse\}\}\|x\)\-\\pi\_\{\\theta\_\{0\}\}\(y\_\{\\text\{refuse\}\}\|x\)\\right\|\\leq C\\sqrt\{\\epsilon\}\+C^\{\\prime\}\\epsilon\_\{\\mathcal\{S\}\}\(50\)whereC′C^\{\\prime\}depends on the maximum attribution score of misspecified features\.

###### Proof\.

Decompose the safety circuit activation difference:

‖f𝒮∗​\(θ\(T\)\)−f𝒮∗​\(θ0\)‖\\displaystyle\\\|f\_\{\\mathcal\{S\}^\{\*\}\}\(\\theta^\{\(T\)\}\)\-f\_\{\\mathcal\{S\}^\{\*\}\}\(\\theta\_\{0\}\)\\\|≤‖f𝒮​\(θ\(T\)\)−f𝒮​\(θ0\)‖\\displaystyle\\leq\\\|f\_\{\\mathcal\{S\}\}\(\\theta^\{\(T\)\}\)\-f\_\{\\mathcal\{S\}\}\(\\theta\_\{0\}\)\\\|\(51\)\+‖f𝒮∗∖𝒮​\(θ\(T\)\)−f𝒮∗∖𝒮​\(θ0\)‖\\displaystyle\\quad\+\\\|f\_\{\\mathcal\{S\}^\{\*\}\\setminus\\mathcal\{S\}\}\(\\theta^\{\(T\)\}\)\-f\_\{\\mathcal\{S\}^\{\*\}\\setminus\\mathcal\{S\}\}\(\\theta\_\{0\}\)\\\|\(52\)\+‖f𝒮∖𝒮∗​\(θ\(T\)\)−f𝒮∖𝒮∗​\(θ0\)‖\\displaystyle\\quad\+\\\|f\_\{\\mathcal\{S\}\\setminus\\mathcal\{S\}^\{\*\}\}\(\\theta^\{\(T\)\}\)\-f\_\{\\mathcal\{S\}\\setminus\\mathcal\{S\}^\{\*\}\}\(\\theta\_\{0\}\)\\\|\(53\)
The first term is bounded by the circuit constraint:O​\(ϵ\)O\(\\sqrt\{\\epsilon\}\)\.

The second term represents missed safety features \(false negatives\)\. These are unconstrained, but by the definition of𝒮∗\\mathcal\{S\}^\{\*\}, their total attribution is at mostγ​\|𝒮∗∖𝒮\|≤γ​ϵ𝒮​\|𝒮∗\|\\gamma\|\{\}\\mathcal\{S\}^\{\*\}\\setminus\\mathcal\{S\}\|\{\}\\leq\\gamma\\epsilon\_\{\\mathcal\{S\}\}\|\{\}\\mathcal\{S\}^\{\*\}\|\{\}\.

The third term represents incorrectly included features \(false positives\)\. Constraining these does not hurt safety, only potentially capability\.

Combining via the Lipschitz property of refusal probability completes the proof\. ∎

## Appendix EScalability to Larger Models and Longer Evolution Horizons

To demonstrate that Circuit\-Anchored Evolution \(CAE\) is not limited to smaller models or short evolutionary windows, we conduct extended experiments addressing both model scale and evolution duration\.

##### Scaling to Larger Models\.

We apply CAE to Gemma\-2\-9B\-IT, evolving it for 500 steps\. As shown in Table[3](https://arxiv.org/html/2608.05158#A5.T3), CAE preserves safety almost perfectly \(98\.47%\) with no significant capability loss compared to unconstrained evolution\. This demonstrates that our method does not trade off capability for safety, even as model capacity scales up\.

Table 3:Performance on larger model \(Gemma\-2\-9B\-IT, 500 steps\)\.
##### Durability over Longer Evolution\.

Standard self\-evolution typically converges or is stopped around 500 steps\. To stress\-test the durability of our anchoring mechanism, we push the evolution of Gemma\-2\-2B\-IT to an extreme horizon of 5,000 steps\.

Table 4:Performance under extreme evolution horizon \(Gemma\-2\-2B\-IT, 5000 steps\)\.As shown in Table[4](https://arxiv.org/html/2608.05158#A5.T4), unconstrained evolution exhibits further safety degradation over longer horizons \(dropping to 61\.24%\), underscoring the severity of the misevolution problem\. In stark contrast, CAE remains remarkably stable even at 5,000 steps, maintaining a 95\.81% safety score\. This suggests that the circuit anchoring mechanism provides durable, long\-term protection against safety degradation, effectively preventing the model from drifting into harmful subspaces regardless of the evolution length\.