基于留出锚点的持续适应中的可认证行为保持

# Certified Behavioral Retention for Continual Adaptation with Held-Out Anchors
Source: [https://arxiv.org/html/2610.40740](https://arxiv.org/html/2610.40740)
Abrar ShahidAffiliation:Notre Dame College

###### Abstract

Continual adaptation requires deciding not only how to update a model, but whether to commit the update without exceeding a declared budget for changes to protected behavior\. We introduce Certified Anchor\-Based Adaptation \(CABA\), a candidate\-agnostic post\-update gate that reserves historical observations from candidate optimization, compares old and candidate policies on frozen representations, and selects the largest tested interpolation coefficient whose worst\-anchor forward KL divergence does not exceed the budget\. The finite retention check requires neither action labels nor complete trajectories\. We develop a theory\-led certification framework that separates measured anchor retention from conditional off\-anchor guarantees\. Under explicit representation\-coverage and Lipschitz assumptions, an accepted update satisfies a uniform behavioral\-divergence bound on protected support\. The analysis provides regularity bounds for affine softmax heads, high\-probability coverage and compression guarantees, interpolation\-path monotonicity conditions, grid\-resolution bounds, and trajectory\-level and sequential\-composition guarantees\. These results specify the assumptions needed to interpret a finite acceptance check; they do not assert global safety or preserved task accuracy\. In a controlled UCI Human Activity Recognition study used as a non\-stationary sensor\-policy proxy, CABA reduces mean forgetting from 1\.01 percentage points for unconstrained adaptation to 0\.00 at budgetϵ=0\.05\\epsilon=0\.05, while reducing final average accuracy from 93\.04% to 88\.48%\. This proof of concept illustrates a retention–plasticity trade\-off; it does not establish foundation\-model or robotic performance\. CABA supplies an auditable retention check for compatible candidate generators exposing comparable policy distributions and a declared update path, while deployment additionally requires separate evidence of current\-task utility\.

## 1Introduction

A foundation\-model agent is increasingly a changing system rather than a fixed artifact\. New tools, feedback, users, sensors, and environments create repeated opportunities for post\-training, model editing, memory revision, or adapter updates\. Each update can improve the current objective while degrading behavior that was already relied upon\. This stability–plasticity problem is central to continual learning\[[Wang et al\., 2024](https://arxiv.org/html/2610.40740#bib.bib25);[De Lange et al\., 2022](https://arxiv.org/html/2610.40740#bib.bib4)\]; for deployed agents, it is also a change\-management problem\. Before a new model, adapter, prompt, memory, or policy is committed, an operator needs evidence about what changed\.

Replay\[[Lopez\-Paz and Ranzato, 2017](https://arxiv.org/html/2610.40740#bib.bib18);[Smith et al\., 2024](https://arxiv.org/html/2610.40740#bib.bib24)\], parameter or subspace regularization\[[Kirkpatrick et al\., 2017](https://arxiv.org/html/2610.40740#bib.bib15);[Saha et al\., 2021](https://arxiv.org/html/2610.40740#bib.bib21)\], and trust regions\[[Schulman et al\., 2015](https://arxiv.org/html/2610.40740#bib.bib22)\]intervene during candidate optimization\. Their retention objectives are valuable, but success on historical examples used for training is different evidence from performance on a held\-out acceptance set\. CABA makes that distinction explicit without replacing those training methods\.

We study an interface in which an arbitrary update generator proposes a candidate and a separate gate decides how much of it to commit\. The gate retains historical observations or frozen representations excluded from candidate optimization\. It measures behavioral divergence between the current and interpolated candidate policies, takes the maximum over anchors rather than an average, and accepts the largest tested interpolation step below a predeclared budget\. We call this wrapper Certified Anchor\-Based Adaptation \(CABA\)\.

CABA is an acceptance mechanism, not a complete continual\-learning algorithm\. It can wrap supervised, reinforcement\-learning, LoRA\[[Hu et al\., 2022](https://arxiv.org/html/2610.40740#bib.bib11)\], editing, or replay candidates that expose comparable policy distributions and a declared update path\. Discrete prompt or tool changes require a finite candidate path, not literal parameter interpolation\. Small KL does not imply utility, fairness, security, or global safety\. A deployment needs two keys: current\-task utility and protected\-behavior retention\. CABA supplies the latter and records the budget, anchor and candidate identifiers, tested path, accepted coefficient, maximum divergence, and worst anchor\.

The closest recent systems make the novelty boundary important\. STABLE gates continual LoRA edits using exact\-match loss, confidence change, or KL and may rescale or reject a merge\[[Hoy and Celik, 2025](https://arxiv.org/html/2610.40740#bib.bib10)\]\. Harness Continual Learning separates proposal from commitment for evolving prompts, memories, tools, and routers\[[Kang et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib13)\]\. We do not claim that separation or label\-free KL alone is novel\. Our contribution is the formalization of a held\-out worst\-anchor contract and the assumptions under which its finite check extends beyond stored anchors\.

## 2Problem Setup

Letoobe an observation,z=ϕ⁡\(o\)z=\\phi\(o\)a representation, andπθ\(⋅∣z\)\\pi\_\{\\theta\}\(\\cdot\\mid z\)a stochastic policy or output distribution\. At updatett, the learner receives batchDtD\_\{t\}and partitions it before candidate training:

Dt=Dttrain​∪˙​Dtanc\.D\_\{t\}=D\_\{t\}^\{\\mathrm\{train\}\}\\,\\dot\{\\cup\}\\,D\_\{t\}^\{\\mathrm\{anc\}\}\.\(1\)An arbitrary adaptation routine usesDttrainD\_\{t\}^\{\\mathrm\{train\}\}and permitted non\-anchor resources to produce candidateθ^t\\widehat\{\\theta\}\_\{t\}from current accepted parametersθt−1\\theta\_\{t\-1\}\. The gate is then evaluated on accumulated held\-out anchors

A<t=⋃s<t\{ϕ⁡\(o\):o∈Dsanc\}\.A\_\{<t\}=\\bigcup\_\{s<t\}\\\{\\phi\(o\):o\\in D\_\{s\}^\{\\mathrm\{anc\}\}\\\}\.\(2\)Action labels are not required for the retention test because both policies can be queried on the same representation\. Labels may be stored for a replay baseline or separate utility test, but are not inputs to the CABA certificate\.

For old parametersθ\\thetaand candidate parametersθ′\\theta^\{\\prime\}, define forward KL in nats:

d\(z;θ,θ′\)=DKL\(πθ\(⋅∣z\)∥πθ′\(⋅∣z\)\)\.d\(z;\\theta,\\theta^\{\\prime\}\)=D\_\{\\mathrm\{KL\}\}\\\!\\left\(\\pi\_\{\\theta\}\(\\cdot\\mid z\)\\,\\middle\\\|\\,\\pi\_\{\\theta^\{\\prime\}\}\(\\cdot\\mid z\)\\right\)\.\(3\)Forward KL penalizes probability removed from actions supported by the current policy\. Other divergences can be substituted, but the trajectory result below uses a divergence controlling total variation\. Recent work relates policy KL to forgetting in continual post\-training while also showing that equal KL values need not imply equal task accuracy\[[Shenfeld et al\., 2025](https://arxiv.org/html/2610.40740#bib.bib23);[Hoy and Celik, 2025](https://arxiv.org/html/2610.40740#bib.bib10)\]\. CABA treats KL as a change budget, not as a direct performance metric\.

#### Threat model\.

CABA targets accidental behavioral drift caused by a candidate update\. It assumes the old and candidate policies can be evaluated faithfully on protected anchors, the anchor store has integrity, and the declared divergence is meaningful for the action interface\. Holding anchors out reduces direct training\-set reuse, but repeated accept/reject feedback still conveys anchor information\. The finite check does not defend against a malicious candidate that detects auditing, compromised evaluation code, failures shared by both policies, or hazards outside protected support\. The mathematical certificate is conditional on coverage and regularity; the empirical anchor check alone is not a global\-safety guarantee\.

#### Protected behavior and current utility\.

LetPtP\_\{t\}be the protected historical representation distribution andUt​\(θ\)U\_\{t\}\(\\theta\)a current\-task utility\. A deployment rule should require both a retention condition and a separately evaluated utility condition, for example

maxz∈A<t⁡d⁡\(z,θt−1,θt\)≤ϵt,LCB⁡\{Ut​\(θt\)−Ut​\(θt−1\)\}≥νt,\\max\_\{z\\in A\_\{<t\}\}d\(z;\\theta\_\{t\-1\},\\theta\_\{t\}\)\\leq\\epsilon\_\{t\},\\qquad\\operatorname\{LCB\}\\\{U\_\{t\}\(\\theta\_\{t\}\)\-U\_\{t\}\(\\theta\_\{t\-1\}\)\\\}\\geq\\nu\_\{t\},\(4\)where the lower confidence bound uses fresh utility data after path selection, or simultaneous coverage over the tested path\. Our experiment isolates the retention key; this equation states the deployment interface\.

## 3CABA: A Candidate\-Agnostic Commit Gate

LetΓ⊂\[0,1\]\\Gamma\\subset\[0,1\]be a finite interpolation grid containing00\. For adapter or policy\-head parameters, define

θt​\(α\)=\(1−α\)​θt−1\+α​θ^t\.\\theta\_\{t\}\(\\alpha\)=\(1\-\\alpha\)\\theta\_\{t\-1\}\+\\alpha\\widehat\{\\theta\}\_\{t\}\.\(5\)CABA computes the worst\-anchor divergence

gt​\(α\)=maxz∈A<t⁡d⁡\(z,θt−1,θt​\(α\)\)g\_\{t\}\(\\alpha\)=\\max\_\{z\\in A\_\{<t\}\}d\(z;\\theta\_\{t\-1\},\\theta\_\{t\}\(\\alpha\)\)\(6\)and selects

αt=max⁡\{α∈Γ:gt​\(α\)≤ϵt\},θt=θt​\(αt\)\.\\alpha\_\{t\}=\\max\\\{\\alpha\\in\\Gamma:g\_\{t\}\(\\alpha\)\\leq\\epsilon\_\{t\}\\\},\\qquad\\theta\_\{t\}=\\theta\_\{t\}\(\\alpha\_\{t\}\)\.\(7\)We define the empty\-anchor score as zero and requireϵt≥0\\epsilon\_\{t\}\\geq 0\. The first candidate passes the retention key only; deployment also needs the utility key\. If no nonzero grid point is feasible, the update is rejected\. Exhaustive grid evaluation needs no monotonicity assumption\. With a verified numerical evaluation\-error boundenume\_\{\\mathrm\{num\}\}, accept only ifg^t​\(α\)\+enum≤ϵt\\widehat\{g\}\_\{t\}\(\\alpha\)\+e\_\{\\mathrm\{num\}\}\\leq\\epsilon\_\{t\}\.

#### Why worst\-anchor control?

An average divergence can remain small while one protected state changes sharply\. The maximum makes every stored anchor a hard constraint and identifies the anchor closest to rejection\. This is conservative and sensitive to corrupted or irrelevant anchors; a high\-quantile alternative is a different contract rather than a silent substitute\.

#### Why hold anchors out?

The finite check is deterministic once the anchors and evaluated policies are fixed\. Excluding audit anchors from candidate optimization permits a disjoint replay buffer, but repeated accept/reject feedback still conveys information about anchors\. Held\-out therefore does not mean statistically independent across updates; stochastic generalization claims need fresh audits or an adaptive\-valid analysis\.

#### Anchor lifecycle\.

After deciding updatett, representations fromDtancD\_\{t\}^\{\\mathrm\{anc\}\}are eligible for future gates\. A bounded system can use reservoir sampling, coverage\-aware coresets, or safety\-prioritized anchors\. Hindsight Anchor Learning optimizes anchors for training\[[Chaudhry et al\., 2021](https://arxiv.org/html/2610.40740#bib.bib2)\]; Memory Anchors selects high\-conflict robot experiences for replay\[[Du et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib5)\]\. CABA can use their selection insights, but the audit copy remains excluded from candidate optimization\. Deletion, refresh, and access policies must be logged because changing the anchor set changes the retention claim\.

Algorithm 1CABA commit gate with an audit receipt0:Current parameters

θ\\theta, candidate

θ^\\widehat\{\\theta\}, anchors

AA, grid

Γ\\Gamma, budget

ϵ\\epsilon
1:Initialize feasible set

F←\{0\}F\\leftarrow\\\{0\\\}and receipt

R←∅R\\leftarrow\\varnothing
2:foreach

α∈Γ∖\{0\}\\alpha\\in\\Gamma\\setminus\\\{0\\\}do

3:

θ⁡\(α\)←\(1−α\)​θ\+α​θ^\\theta\(\\alpha\)\\leftarrow\(1\-\\alpha\)\\theta\+\\alpha\\widehat\{\\theta\}
4:Evaluate

qα\(z\)←DKL\(πθ\(⋅∣z\)∥πθ⁡\(α\)\(⋅∣z\)\)q\_\{\\alpha\}\(z\)\\leftarrow D\_\{\\mathrm\{KL\}\}\(\\pi\_\{\\theta\}\(\\cdot\\mid z\)\\\|\\pi\_\{\\theta\(\\alpha\)\}\(\\cdot\\mid z\)\)for

z∈Az\\in A
5:Record

g⁡\(α\)←maxz∈A⁡qα​\(z\)g\(\\alpha\)\\leftarrow\\max\_\{z\\in A\}q\_\{\\alpha\}\(z\)and a maximizing anchor; use

00and null if

A=∅A=\\varnothing
6:if

g⁡\(α\)≤ϵg\(\\alpha\)\\leq\\epsilonthen

7:

F←F∪\{α\}F\\leftarrow F\\cup\\\{\\alpha\\\}
8:endif

9:endfor

10:

α⋆←max⁡F\\alpha^\{\\star\}\\leftarrow\\max F; append model, anchor, grid, budget, and score hashes to

RR
11:returnCommitted parameters

θ⁡\(α⋆\)\\theta\(\\alpha^\{\\star\}\)and receipt

RR

## 4Conditional Certification Results

The results separate the finite computation performed by Algorithm[1](https://arxiv.org/html/2610.40740#alg1)from assumptions required to extend it beyond stored anchors\.

###### Assumption 1\(Representation coverage\)\.

For protected distributionPPwith supportS⊂𝒵S\\subset\\mathcal\{Z\}, the finite nonempty anchor setA⊂SA\\subset Sis aρ\\rho\-net: everyz∈Sz\\in Shaszi∈Az\_\{i\}\\in Awith‖z−zi‖2≤ρ\\\|z\-z\_\{i\}\\\|\_\{2\}\\leq\\rho\.

###### Assumption 2\(Divergence regularity\)\.

For accepted pair\(θ,θ′\)\(\\theta,\\theta^\{\\prime\}\),z↦d⁡\(z,θ,θ′\)z\\mapsto d\(z;\\theta,\\theta^\{\\prime\}\)isLL\-Lipschitz onSS\.

###### Theorem 1\(Finite\-anchor retention certificate\)\.

If CABA acceptsθ′\\theta^\{\\prime\}withmaxzi∈A⁡d⁡\(zi,θ,θ′\)≤ϵ\\max\_\{z\_\{i\}\\in A\}d\(z\_\{i\};\\theta,\\theta^\{\\prime\}\)\\leq\\epsilonand the assumptions hold, then

supz∈Sd⁡\(z,θ,θ′\)≤ϵ\+L​ρ\.\\sup\_\{z\\in S\}d\(z;\\theta,\\theta^\{\\prime\}\)\\leq\\epsilon\+L\\rho\.\(8\)

###### Proof\.

For anyz∈Sz\\in S, choose a covering anchorziz\_\{i\}\. Acceptance boundsd⁡\(zi,θ,θ′\)d\(z\_\{i\};\\theta,\\theta^\{\\prime\}\)byϵ\\epsilon, and Lipschitz continuity adds at mostL​‖z−zi‖2≤L​ρL\\\|z\-z\_\{i\}\\\|\_\{2\}\\leq L\\rho\.∎

The theorem does not establish coverage from random sampling alone\. Sparse anchors and sharp policies increaseL​ρL\\rho\. For affine softmax logits\(Wj​z\+bj\)/Ttemp\(W\_\{j\}z\+b\_\{j\}\)/T\_\{\\mathrm\{temp\}\},j=0,1j=0,1, on‖z‖2≤R\\\|z\\\|\_\{2\}\\leq RwithTtemp\>0T\_\{\\mathrm\{temp\}\}\>0, a sufficient constant is

L≤\(‖W0‖2\+‖W1‖2\)​\(‖W0−W1‖2​R\+‖b0−b1‖2\)2​Ttemp2\.L\\leq\\frac\{\(\\\|W\_\{0\}\\\|\_\{2\}\+\\\|W\_\{1\}\\\|\_\{2\}\)\(\\\|W\_\{0\}\-W\_\{1\}\\\|\_\{2\}R\+\\\|b\_\{0\}\-b\_\{1\}\\\|\_\{2\}\)\}\{2T\_\{\\mathrm\{temp\}\}^\{2\}\}\.\(9\)Here matrix norms are spectral\. Appendix[A\.1](https://arxiv.org/html/2610.40740#A1.SS1)derives this computable bound and its Jacobian extension\. Neither a maximum sampled gradient nor a sampled radius certifies a support\-wide bound\. No empiricalLLestimate is claimed\.

###### Theorem 2\(High\-probability coverage\)\.

FixPP,ρ\>0\\rho\>0, and a finite cover ofSSbyNNballsB⁡\(cj,ρ/2\)B\(c\_\{j\},\\rho/2\)before sampling\. Suppose each ball has mass at leastμρ\>0\\mu\_\{\\rho\}\>0\. Formmindependent anchors drawn fromPP,

Pr⁡\(A​is a​ρ​\-net\)≥1−N​e−m​μρ\.\\Pr\(A\\text\{ is a \}\\rho\\text\{\-net\}\)\\geq 1\-Ne^\{\-m\\mu\_\{\\rho\}\}\.\(10\)Forδ∈\(0,1\)\\delta\\in\(0,1\),m≥μρ−1​log⁡\(N/δ\)m\\geq\\mu\_\{\\rho\}^\{\-1\}\\log\(N/\\delta\)suffices for coverage with probability at least1−δ1\-\\delta\. On this event, every accepted pair satisfying divergence regularity obeys the finite\-anchor certificate, including pairs selected using these anchors\.

Rare hazards may have tiny mass and need deliberate anchors\. In a bounded doubling space, covering numbers can grow as\(D/ρ\)q\(D/\\rho\)^\{q\}, making uniform coverage expensive\. A fixed\-capacity or conflict\-selected store does not automatically satisfy the independent\-sampling premise; its coverage must be justified separately\.

###### Corollary 1\(Compressed anchors\)\.

Under coverage, storez~i\\widetilde\{z\}\_\{i\}with‖zi−z~i‖2≤η\\\|z\_\{i\}\-\\widetilde\{z\}\_\{i\}\\\|\_\{2\}\\leq\\etaand verifyd⁡\(z~i,θ,θ′\)≤ϵd\(\\widetilde\{z\}\_\{i\};\\theta,\\theta^\{\\prime\}\)\\leq\\epsilon\. RequireLL\-Lipschitz regularity onS∪\{z~i\}S\\cup\\\{\\widetilde\{z\}\_\{i\}\\\}, not only onSS\. Then

supz∈Sd⁡\(z,θ,θ′\)≤ϵ\+L⁡\(ρ\+η\)\.\\sup\_\{z\\in S\}d\(z;\\theta,\\theta^\{\\prime\}\)\\leq\\epsilon\+L\(\\rho\+\\eta\)\.\(11\)

Thus storing compressed representations instead of raw observations has an explicit price\. Quantization or projection is not free merely because the gate remains executable\.

###### Proposition 1\(Grid resolution\)\.

Letggbe finite, continuous, and nondecreasing on\[0,1\]\[0,1\], withg⁡\(0\)=0g\(0\)=0andϵ≥0\\epsilon\\geq 0\. LetΓ=\{0=γ0<⋯<γM=1\}\\Gamma=\\\{0=\\gamma\_\{0\}<\\cdots<\\gamma\_\{M\}=1\\\}andh=maxj⁡\(γj\+1−γj\)h=\\max\_\{j\}\(\\gamma\_\{j\+1\}\-\\gamma\_\{j\}\)\. Forαcont=max⁡\{α∈\[0,1\]:g⁡\(α\)≤ϵ\}\\alpha\_\{\\mathrm\{cont\}\}=\\max\\\{\\alpha\\in\[0,1\]:g\(\\alpha\)\\leq\\epsilon\\\}, the feasible grid choice satisfiesαt≥max⁡\{0,αcont−h\}\\alpha\_\{t\}\\geq\\max\\\{0,\\alpha\_\{\\mathrm\{cont\}\}\-h\\\}\.

Without monotonicity, exhaustive grid evaluation remains valid, but binary search and this approximation need not be\. For logits affine inα\\alphaat each anchor, forward KL is convex inα\\alpha, minimized at zero, hence nondecreasing\. This covers interpolation of a linear softmax head, but not general LoRA factor interpolation; Appendix[A\.1](https://arxiv.org/html/2610.40740#A1.SS1)proves this distinction\.

###### Proposition 2\(Bounded\-horizon behavior degradation\)\.

LetJH​\(π\)=𝔼π​\[∑h=0H−1rh\]J\_\{H\}\(\\pi\)=\\mathbb\{E\}\_\{\\pi\}\[\\sum\_\{h=0\}^\{H\-1\}r\_\{h\}\]forH≥1H\\geq 1in the same MDP with common initial, transition, and reward laws andrh∈\[0,1\]r\_\{h\}\\in\[0,1\]\. If the uniform bound holds withκ=ϵ\+L​ρ\\kappa=\\epsilon\+L\\rhoat every state reachable under the old policy, then

\|JH​\(πθ′\)H−JH​\(πθ\)H\|≤min⁡\{1,H​κ2\}≤min⁡\{1,H​κ2\}\.\\left\|\\frac\{J\_\{H\}\(\\pi\_\{\\theta^\{\\prime\}\}\)\}\{H\}\-\\frac\{J\_\{H\}\(\\pi\_\{\\theta\}\)\}\{H\}\\right\|\\leq\\min\\left\\\{1,\\sqrt\{\\frac\{H\\kappa\}\{2\}\}\\right\\\}\\leq\\min\\left\\\{1,H\\sqrt\{\\frac\{\\kappa\}\{2\}\}\\right\\\}\.\(12\)The KL chain rule and Pinsker give the first bound; stepwise maximal coupling gives the weaker second bound\. Both require coverage of relevant trajectories, not merely observed prompts or states\. The sharper bound can still be vacuous\.

###### Corollary 2\(Sequential composition\)\.

For accepted policiesπ0,…,πT\\pi\_\{0\},\\ldots,\\pi\_\{T\}in the same protected MDP, letκt\\kappa\_\{t\}be the valid uniform KL bound for updatett\. Then

\|JH​\(πT\)−JH​\(π0\)H\|≤min⁡\{1,∑t=1TH​κt2\}\.\\left\|\\frac\{J\_\{H\}\(\\pi\_\{T\}\)\-J\_\{H\}\(\\pi\_\{0\}\)\}\{H\}\\right\|\\leq\\min\\left\\\{1,\\sum\_\{t=1\}^\{T\}\\sqrt\{\\frac\{H\\kappa\_\{t\}\}\{2\}\}\\right\\\}\.\(13\)

The additive bound is conservative: individually acceptable changes can accumulate, so a continual system must track per\-update and cumulative budgets and periodically compare against a stable reference policy\.

## 5Relationship to Continual\-Learning Approaches

Table 1:Relationship to representative retention mechanisms\. “Post\-candidate” means retention is checked after candidate generation\.#### Replay and regularization\.

GEM constrains gradients using episodic memory\[[Lopez\-Paz and Ranzato, 2017](https://arxiv.org/html/2610.40740#bib.bib18)\]; Gradient Projection Memory protects representation\-derived subspaces\[[Saha et al\., 2021](https://arxiv.org/html/2610.40740#bib.bib21)\]; adaptive replay policies allocate limited compute across remembered examples\[[Smith et al\., 2024](https://arxiv.org/html/2610.40740#bib.bib24)\]\. These methods seek a better candidate\. CABA asks whether a candidate produced by any such method satisfies an independently declared contract\.

#### Policy constraints and continual post\-training\.

TRPO introduced KL trust regions for stable policy improvement\[[Schulman et al\., 2015](https://arxiv.org/html/2610.40740#bib.bib22)\]\. LCPO anchors outputs on old experiences in non\-stationary environments\[[Hamadanian et al\., 2025](https://arxiv.org/html/2610.40740#bib.bib9)\]\. Recent CPO, MCPO, and CRL\-VLA incorporate behavioral divergence into continual policy or VLA optimization\[[Luo et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib19);[Liao et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib16);[Zeng et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib26)\]\. RL’s Razor connects smaller policy KL with reduced forgetting across language and robotic foundation models\[[Shenfeld et al\., 2025](https://arxiv.org/html/2610.40740#bib.bib23)\]\. These works motivate behavioral divergence, but do not themselves make a finite held\-out post\-update check a uniform certificate\.

#### Gated updates and evolving agent state\.

STABLE separates edit generation from acceptance and gates LoRA merges using exact\-match drop, bits increase, or average KL\[[Hoy and Celik, 2025](https://arxiv.org/html/2610.40740#bib.bib10)\]\. CABA does not claim this separation or label\-free KL as novel; its distinction is a held\-out worst\-anchor contract with explicit off\-anchor assumptions\. Harness Continual Learning covers evolving prompts, memories, tools, and routers\[[Kang et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib13)\]\. No comparative performance advantage is established\.

#### Anchor\-based robot learning\.

Memory Anchors uses representation overlap and action conflict to enrich robot replay\[[Du et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib5)\]\. Conflict\-aware audit selection is complementary, but its benefit for CABA remains untested and the audit copy must remain separate from training\.

## 6Controlled Study on UCI\-HAR

The experiment evaluates whether the gate exposes a measurable retention–plasticity trade\-off\. It is not evidence about a language model, VLA policy, or physical robot\.

#### Dataset and stream\.

We use the official Human Activity Recognition Using Smartphones dataset, containing inertial features from 30 subjects performing six activities\[[Anguita et al\., 2013](https://arxiv.org/html/2610.40740#bib.bib1)\]\. We retain the official train/test partition, standardize using training statistics only, and form five chronological subject ranges\[1,5\]\[1,5\],\[6,10\]\[6,10\],\[11,15\]\[11,15\],\[16,20\]\[16,20\], and\[21,25\]\[21,25\]\. Updates use official\-training examples in the current range; evaluation uses official\-test examples in the corresponding range\. Subjects outside these ranges are not reported\. The 561\-dimensional feature vector is treated as a frozen representation and a linear softmax head as the policy\.

#### Anchor protocol\.

Each incoming training group is split into candidate\-training and held\-out anchor portions\. After its update decision, the group contributes at most 256 representations for future retention checks, for a maximum of 1,280 anchors\. Candidate training never uses CABA audit anchors\.

#### Methods\.

Finetune commits the candidate head after each group\. Replay trains on current examples plus stored anchor representations and labels\. Frozen trains the initial head and rejects subsequent changes\. CABA uses the same candidate as Finetune, evaluatesΓ=\{0,0\.05,…,1\}\\Gamma=\\\{0,0\.05,\\ldots,1\\\}, and commits the largest interpolation satisfying worst\-anchor budgetϵ=0\.05\\epsilon=0\.05\. All adaptive methods use matched optimization settings and seeds\{0,1,2\}\\\{0,1,2\\\}\.

#### Metrics\.

LetAt,kA\_\{t,k\}be test accuracy on groupkkafter updatett\. ForT=5T=5, final average accuracy isT−1​∑k=1TAT,kT^\{\-1\}\\sum\_\{k=1\}^\{T\}A\_\{T,k\}, and average forgetting is

FT=1T​∑k=1T\(maxt∈\{k,…,T\}⁡At,k−AT,k\)\.F\_\{T\}=\\frac\{1\}\{T\}\\sum\_\{k=1\}^\{T\}\\left\(\\max\_\{t\\in\\\{k,\\ldots,T\\\}\}A\_\{t,k\}\-A\_\{T,k\}\\right\)\.\(14\)Forgetting is nonnegative by construction and measures loss relative to each group’s best observed accuracy\. It is not a safety metric and can be zero for a model that never learns, so it must be read together with final accuracy\.

Final average accuracy \(%\)0255075100Finetune93\.04Replay93\.17CABA88\.48Frozen84\.42Average forgetting \(pp\)00\.40\.81\.2Finetune1\.01Replay0\.85CABA0\.00Frozen0\.00Figure 1:Three\-seed UCI\-HAR results\. Bars show means; Table[2](https://arxiv.org/html/2610.40740#S6.T2)reports sample standard deviations\. Accuracy uses the full 0–100% scale, and lower forgetting is better\. CABA reaches zero measured forgetting but trades off final accuracy; Frozen shows why forgetting alone is insufficient\.Table 2:UCI\-HAR continual adaptation\. Mean±\\pmsample standard deviation over three seeds\. Higher accuracy and lower forgetting are preferred\.
#### Results\.

Finetune and Replay reach about 93% final average accuracy but forget 1\.01 and 0\.85 percentage points\. CABA reduces measured forgetting to zero under the fixed anchor budget while reaching 88\.48% accuracy, 4\.56 points below Finetune and 4\.75 below Replay\. Frozen also has zero forgetting but reaches only 84\.42%\. The appropriate conclusion is not that CABA dominates replay\. The gate converts retention into an explicit constraint and exposes how much adaptation the declared constraint blocks\.

#### Budget diagnostic\.

A stricter operating point,ϵ=0\.02\\epsilon=0\.02, yields 86\.17% final accuracy and 0\.02 percentage points average forgetting in the same three\-seed protocol\. Budget selection must occur before inspecting final test performance; a sweep is sensitivity analysis, not permission to select a favorable test result after the fact\.

#### What the experiment validates\.

The study validates the executable finite\-anchor gate and retention–plasticity control on a real sensor dataset\. It does not validate coverage, estimateρ\\rhoorLL, or establish the uniform guarantee\. It does not show that observation\-only storage is private, that a large agent cannot overfit an audit distribution, or that small action KL preserves semantic task success\.

## 7Deployment Design for Foundation\-Model Agents

For an LLM or VLA, the audited output can be a next\-token, tool\-selection, or action distribution with computable divergence\. Internal LoRA changes generally change downstream features despite frozen base weights: store raw contexts and evaluate both complete policies\. A genuinely frozen feature map permits cached representations\. The guarantee concerns the audited stochastic policy, not a different greedy decoder or untested tool execution\.

#### Evaluation harness\.

An agent\-improvement loop has proposal, training, held\-out evaluation, and commitment stages\. CABA belongs between training and commitment\. The candidate\-generation service receives no audit\-anchor identifiers\. The evaluator loads current and candidate adapters, computes every declared grid point, checks the current\-utility key, signs the receipt, and updates the serving pointer only after both keys pass\.

#### Scaling cost\.

Withmmanchors,G=\|Γ\|G=\|\\Gamma\|, and evaluation costCπC\_\{\\pi\}, exhaustive gating costsO⁡\(m​G​Cπ\)O\(mGC\_\{\\pi\}\); old\-policy logits can be cached\. A proven monotone path permitsO⁡\(m​Cπ​log⁡G\)O\(mC\_\{\\pi\}\\log G\)grid search, but sampled monotonicity alone is insufficient\. A coreset trades memory against coverage radius\. These are operation counts, not measured runtime results\.

#### Anchor selection and refresh\.

Random anchors approximate frequent behavior and may miss rare hazards\. A defensible store combines distributional samples, known safety\-critical states, task\-boundary cases, representation\-coverage points, and conflict points\. Refresh anchors when sensors, prompts, tools, or the frozen backbone change, because the prior coverage statement may no longer concern the deployed representation space\.

#### Beyond one\-step retention\.

Maintain drift from the immediately previous policy, drift from a stable reference, and task\-level performance on historical evaluations\. Per\-update CABA controls the first; cumulative comparisons and semantic regression tests remain necessary\.

## 8Discussion: Scope of Evidence and Evaluation

The finite\-anchor result is the empirically supported part of CABA in this paper\. We do not estimate a coverage radius or support\-wide Lipschitz constant on UCI\-HAR: the experiment reports a finite held\-out check, and empirical maxima over observed features would not certify either quantity on full protected support\. Reporting a numerical value forϵ\+L​ρ\\epsilon\+L\\rhowithout defensible support bounds would overstate the evidence\. A synthetic example could illustrate the theorem under stipulated assumptions, but would not establish those assumptions for UCI\-HAR or an agent deployment\.

The exhaustive cost can be made concrete without presenting it as a runtime benchmark\. The anchor cap is 1,280 and the grid has 21 points includingα=0\\alpha=0\. Since zero is known feasible without policy inference, evaluating all 20 nonzero points performs at most 25,600 anchor–coefficient divergence evaluations at that cap\. For the six\-class, 561\-feature linear head, computing candidate distributions at every pair is on the order of 86 million multiply\-accumulates, before batching or implementation\-specific optimizations\. This is a derived operation\-count upper bound, not measured wall\-clock time\. Caching old\-policy logits reduces repeated work\. A verified monotone path permits binary search; otherwise skipping grid points changes the algorithm’s guarantee\.

No same\-candidate comparison against a STABLE\-style gate is reported\. Such a comparison should hold the old policy, candidate generator and candidate, interpolation path, audit data, and utility test fixed, then compare acceptance decisions and costs\. Comparing methods that train different candidates would confound candidate quality with gate behavior\. Appendix[C](https://arxiv.org/html/2610.40740#A3)separates these factors\.

The worst\-anchor contract is intentionally sensitive: a stale or corrupted anchor may reject a useful candidate, while compromised anchor representations or evaluator integrity can invalidate the measured claim\. Adversarially chosen anchors can leave important support uncovered\. A high\-quantile gate could improve tolerance to isolated outliers, but it no longer guarantees that every retained anchor passes; a robustness claim needs a predeclared contamination model, authenticated anchor provenance, and a separate coverage argument\. We report no anchor\-corruption or quantile\-gating experiment\.

#### Prospective robustness and gate comparison\.

A follow\-up should first freeze a candidate generator and produce one candidate per update, then pass that identical candidate, interpolation path, old policy, and audit set through unrestricted commit, a STABLE\-style gate, and CABA\. The primary paired outcomes would be accepted coefficient, worst\-anchor and average KL, current\-task utility, and evaluator cost; an end\-to\-end stream would then measure how different commit decisions alter later candidates\. This distinguishes the gate’s effect from differences in candidate training\.

Anchor sensitivity should be reported separately for stale\-but\-valid anchors, corrupted representations, and deliberate contamination\. A simple robust empirical contract could permit at mostbbofmmanchors to exceed budget,∑i=1m𝟏\[d\(zi;θ,θ′\)\>ϵ\]≤b\\sum\_\{i=1\}^\{m\}\\mathbf\{1\}\[d\(z\_\{i\};\\theta,\\theta^\{\\prime\}\)\>\\epsilon\]\\leq b\. This changes the guarantee: it bounds the number of observed violations, not the maximum divergence over anchors or protected support\. Any selection, quarantine, or replacement rule must be fixed before final evaluation and accompanied by a coverage analysis for the retained set\. Randomly perturbing anchor features would test evaluator sensitivity but would not model adversarially selected states; these should not be conflated\.

For UCI\-HAR, a stronger certificate study would need a justified domain/support definition, a defensible covering construction, and a domain\-wide Jacobian bound for the evaluated policy pair\. Empirical nearest\-neighbor radii, sampled gradient maxima, and their resulting plug\-in values can be reported as diagnostics, but not as the uniform certificate unless accompanied by valid upper bounds\. For an LLM/VLA evaluation, the same paired design should additionally hold prompt or observation histories fixed, use an independently measured utility set, version the complete policy and representation, and report both distributional drift and task outcomes\. These measurements remain future work; no numerical results are implied here\.

For an LLM, an audit item should identify a versioned conversation history and compare next\-token or tool\-selection distributions under complete old and candidate systems\. For a VLA, it should identify a versioned observation–instruction history and compare action distributions; trajectory outcomes and safety events require separate evaluation\. If a backbone or feature extractor changes, raw\-context reevaluation or a certified representation\-error allowance is needed\. In both cases, current utility must be measured on separate data and paired with an independently protected retention test\. These are deployment requirements, not results established by the UCI\-HAR proxy\.

## 9Limitations, Broader Impact, and Conclusion

#### Limitations\.

Coverage is the main limitation: random anchors can miss rare states, and the affine\-softmax regularity bound may be loose\. Neitherρ\\rhonorLLis estimated in the UCI\-HAR study; its finite checks do not instantiate the uniform certificate\. Long\-horizon bounds can be vacuous, nonlinear interpolation can cross high\-drift regions, KL is asymmetric, and representations can reveal sensitive information\. Evidence remains limited to one linear head, five subject groups, and three seeds\. No foundation\-model or embodied validation, direct STABLE comparison, or anchor\-corruption experiment is claimed\.

#### Broader impact\.

A separate commit gate can make continual updates easier to audit, compare, reject, and roll back\. It can also create false confidence if the anchor set is narrow, the evaluator is compromised, or “certified” is reported without assumptions\. Report finite checks and off\-anchor assumptions separately\. Protected anchors must be governed as sensitive deployment data, and a retention gate must not prevent necessary corrections to harmful old behavior; explicit exceptions and human authorization are required\.

#### Conclusion\.

CABA formalizes a retention contract after candidate generation\. Its contribution is the explicit connection between finite checks, coverage, regularity, path choice, and cumulative drift; the underlying inequalities are standard\. The controlled study illustrates retention’s accuracy cost, not foundation\-model effectiveness\. A future LoRA or VLA study should compare post\-update gates on shared candidates, then vary training\-time KL, replay, and anchor selection separately\. Until then, CABA is a theory\-led framework rather than an empirically superior continual learner\.

## References

- Anguita et al\. \[2013\]Davide Anguita, Alessandro Ghio, Luca Oneto, Xavier Parra, and Jorge Luis Reyes\-Ortiz\. A public domain dataset for human activity recognition using smartphones\. In*Proceedings of the 21st European Symposium on Artificial Neural Networks, Computational Intelligence and Machine Learning*, 2013\.[https://www\.esann\.org/sites/default/files/proceedings/legacy/es2013\-84\.pdf](https://www.esann.org/sites/default/files/proceedings/legacy/es2013-84.pdf)\.
- Chaudhry et al\. \[2021\]Arslan Chaudhry, Albert Gordo, Puneet Dokania, Philip Torr, and David Lopez\-Paz\. Using hindsight to anchor past knowledge in continual learning\. In*Proceedings of the AAAI Conference on Artificial Intelligence*, 35:6993–7001, 2021\. doi:10\.1609/aaai\.v35i8\.16861\.
- Chen and Tan \[2026\]Lixian Chen and Jianhong Tan\. HiP\-LoRA: Budgeted spectral plasticity for robust low\-rank adaptation, 2026\.[https://arxiv\.org/abs/2604\.17751](https://arxiv.org/abs/2604.17751)\.
- De Lange et al\. \[2022\]Matthias De Lange, Rahaf Aljundi, Marc Masana, Sarah Parisot, Xu Jia, Ales Leonardis, Gregory Slabaugh, and Tinne Tuytelaars\. A continual learning survey: Defying forgetting in classification tasks\.*IEEE Transactions on Pattern Analysis and Machine Intelligence*, 44\(7\):3366–3385, 2022\. doi:10\.1109/TPAMI\.2021\.3057446\.
- Du et al\. \[2026\]Maximilian Du, Zhanyi Sun, Chen Xu, Paarth Shah, Masha Itkina, and Shuran Song\. Memory anchors for continual robot learning, 2026\.[https://arxiv\.org/abs/2608\.26545](https://arxiv.org/abs/2608.26545)\.
- Feng et al\. \[2026\]Yujie Feng, Hao Wang, Jian Li, Xu Chu, Zhaolu Kang, Yiran Liu, Yasha Wang, Philip S\. Yu, and Xiao\-Ming Wu\. FOREVER: Forgetting curve\-inspired memory replay for language model continual learning\. In*Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pages 24945–24965, 2026\. doi:10\.18653/v1/2026\.acl\-long\.1144\.
- Gao and Pavel \[2017\]Bolin Gao and Lacra Pavel\. On the properties of the softmax function with application in game theory and reinforcement learning, 2017\.[https://arxiv\.org/abs/1704\.00805](https://arxiv.org/abs/1704.00805)\.
- Goyal et al\. \[2026\]Satyam Goyal, Anirudh Kanchi, Garv Shah, and Prakhar Gupta\. Improving sparse memory finetuning, 2026\.[https://arxiv\.org/abs/2604\.05248](https://arxiv.org/abs/2604.05248)\.
- Hamadanian et al\. \[2025\]Pouya Hamadanian, Arash Nasr\-Esfahany, Malte Schwarzkopf, Siddartha Sen, and Mohammad Alizadeh\. Online reinforcement learning in non\-stationary context\-driven environments\. In*International Conference on Learning Representations*, 2025\.[https://arxiv\.org/abs/2302\.02182](https://arxiv.org/abs/2302.02182)\.
- Hoy and Celik \[2025\]William Hoy and Nurcin Celik\. STABLE: Gated continual learning for large language models, 2025\.[https://arxiv\.org/abs/2510\.16089](https://arxiv.org/abs/2510.16089)\.
- Hu et al\. \[2022\]Edward J\. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen\-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen\. LoRA: Low\-rank adaptation of large language models\. In*International Conference on Learning Representations*, 2022\.[https://openreview\.net/forum?id=nZeVKeeFYf9](https://openreview.net/forum?id=nZeVKeeFYf9)\.
- Hu et al\. \[2026\]Jiaheng Hu, Jay Shim, Chen Tang, Yoonchang Sung, Bo Liu, Peter Stone, and Roberto Martín\-Martín\. Simple recipe works: Vision\-language\-action models are natural continual learners with reinforcement learning\. In*Reinforcement Learning Conference \(RLC\)*, 2026\.[https://arxiv\.org/abs/2603\.11653](https://arxiv.org/abs/2603.11653)\.
- Kang et al\. \[2026\]Borui Kang, Jinrui Gu, Junhan Lv, Wenbin Li, Lei Wang, and Yang Gao\. Harness continual learning: Continual adaptation beyond model parameters, 2026\.[https://arxiv\.org/abs/2608\.19013](https://arxiv.org/abs/2608.19013)\.
- Khan et al\. \[2026\]Rana Muhammad Shahroz Khan, Zijie Liu, Zhen Tan, Charles Fleming, and Tianlong Chen\. TMS: Trajectory\-mixed supervision for reward\-free, on\-policy SFT, 2026\.[https://arxiv\.org/abs/2602\.03073](https://arxiv.org/abs/2602.03073)\.
- Kirkpatrick et al\. \[2017\]James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A\. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska\-Barwinska, Demis Hassabis, Claudia Clopath, Dharshan Kumaran, and Raia Hadsell\. Overcoming catastrophic forgetting in neural networks\.*Proceedings of the National Academy of Sciences*, 114\(13\):3521–3526, 2017\. doi:10\.1073/pnas\.1611835114\.
- Liao et al\. \[2026\]Zhaokang Liao, Yingguo Gao, Yi Yang, Yongheng Hu, and Jingting Ding\. MCPO: Mastery\-consolidated policy optimization for large reasoning models, 2026\.[https://arxiv\.org/abs/2604\.16972](https://arxiv.org/abs/2604.16972)\.
- Liu et al\. \[2026\]Yuan Liu, Haoran Li, Shuai Tian, Yuxing Qin, Yuhui Chen, Yupeng Zheng, Yongzhen Huang, and Dongbin Zhao\. Towards long\-lived robots: Continual learning VLA models via reinforcement fine\-tuning, 2026\.[https://arxiv\.org/abs/2602\.10503](https://arxiv.org/abs/2602.10503)\.
- Lopez\-Paz and Ranzato \[2017\]David Lopez\-Paz and Marc’Aurelio Ranzato\. Gradient episodic memory for continual learning\. In*Advances in Neural Information Processing Systems*, 30, 2017\.[https://papers\.nips\.cc/paper/7225\-gradient\-episodic\-memory\-for\-continual\-learning](https://papers.nips.cc/paper/7225-gradient-episodic-memory-for-continual-learning)\.
- Luo et al\. \[2026\]Mao\-Lin Luo, Zhe\-Xu Wang, Zi\-Hao Zhou, Bo Ye, Jian Zhao, Min\-Ling Zhang, and Tong Wei\. RL forgets\! Towards continual policy optimization, 2026\.[https://arxiv\.org/abs/2607\.04364](https://arxiv.org/abs/2607.04364)\.
- Rahimi Azghan et al\. \[2026\]Reza Rahimi Azghan, Gautham Krishna Gudur, Mohit Malu, Edison Thomaz, Giulia Pedrielli, Pavan Turaga, and Hassan Ghasemzadeh\. Gated adaptation for continual learning in human activity recognition, 2026\.[https://arxiv\.org/abs/2603\.10046](https://arxiv.org/abs/2603.10046)\.
- Saha et al\. \[2021\]Gobinda Saha, Isha Garg, and Kaushik Roy\. Gradient projection memory for continual learning\. In*International Conference on Learning Representations*, 2021\.[https://openreview\.net/forum?id=3AOj0RCNC2](https://openreview.net/forum?id=3AOj0RCNC2)\.
- Schulman et al\. \[2015\]John Schulman, Sergey Levine, Pieter Abbeel, Michael Jordan, and Philipp Moritz\. Trust region policy optimization\. In*Proceedings of the 32nd International Conference on Machine Learning*, 37:1889–1897\. PMLR, 2015\.[https://proceedings\.mlr\.press/v37/schulman15\.html](https://proceedings.mlr.press/v37/schulman15.html)\.
- Shenfeld et al\. \[2025\]Idan Shenfeld, Jyothish Pari, and Pulkit Agrawal\. RL’s razor: Why online reinforcement learning forgets less, 2025\.[https://arxiv\.org/abs/2509\.04259](https://arxiv.org/abs/2509.04259)\.
- Smith et al\. \[2024\]James Seale Smith, Lazar Valkov, Shaunak Halbe, Vyshnavi Gutta, Rogerio Feris, Zsolt Kira, and Leonid Karlinsky\. Adaptive memory replay for continual learning\. In*2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops*, 3605–3615, 2024\.[https://openaccess\.thecvf\.com/content/CVPR2024W/ELVM/html/Smith\_Adaptive\_Memory\_Replay\_for\_Continual\_Learning\_CVPRW\_2024\_paper\.html](https://openaccess.thecvf.com/content/CVPR2024W/ELVM/html/Smith_Adaptive_Memory_Replay_for_Continual_Learning_CVPRW_2024_paper.html)\.
- Wang et al\. \[2024\]Liyuan Wang, Xingxing Zhang, Hang Su, and Jun Zhu\. A comprehensive survey of continual learning: Theory, method and application\.*IEEE Transactions on Pattern Analysis and Machine Intelligence*, 46\(8\):5362–5383, 2024\. doi:10\.1109/TPAMI\.2023\.3340326\.
- Zeng et al\. \[2026\]Qixin Zeng, Shuo Zhang, Hongyin Zhang, Renjie Wang, Han Zhao, Libang Zhao, Runze Li, Donglin Wang, and Chao Huang\. CRL\-VLA: Continual vision\-language\-action learning, 2026\.[https://arxiv\.org/abs/2602\.03445](https://arxiv.org/abs/2602.03445)\.
- Zhao et al\. \[2026\]Libang Zhao, Qixin Zeng, Hongyin Zhang, and Donglin Wang\. Information\-theoretic constraints for continual vision\-language\-action alignment, 2026\.[https://arxiv\.org/abs/2603\.13335](https://arxiv.org/abs/2603.13335)\.

## Appendix AProofs and Additional Derivations

A ballBjB\_\{j\}is missed with probability\(1−P⁡\(Bj\)\)m≤e−m​μρ\(1\-P\(B\_\{j\}\)\)^\{m\}\\leq e^\{\-m\\mu\_\{\\rho\}\}\. A union bound gives simultaneous occupancy probability at least1−N​e−m​μρ1\-Ne^\{\-m\\mu\_\{\\rho\}\}\. For anyz∈Sz\\in S, its covering ball contains anchorziz\_\{i\}with‖z−zi‖2≤‖z−cj‖2\+‖cj−zi‖2≤ρ\\\|z\-z\_\{i\}\\\|\_\{2\}\\leq\\\|z\-c\_\{j\}\\\|\_\{2\}\+\\\|c\_\{j\}\-z\_\{i\}\\\|\_\{2\}\\leq\\rho\. ThusAAis aρ\\rho\-net\. SolvingN​e−m​μρ≤δNe^\{\-m\\mu\_\{\\rho\}\}\\leq\\deltaproves the sample bound\.

Under anchor compression,‖z−z~i‖2≤‖z−zi‖2\+‖zi−z~i‖2≤ρ\+η\\\|z\-\\widetilde\{z\}\_\{i\}\\\|\_\{2\}\\leq\\\|z\-z\_\{i\}\\\|\_\{2\}\+\\\|z\_\{i\}\-\\widetilde\{z\}\_\{i\}\\\|\_\{2\}\\leq\\rho\+\\eta\. The gate boundsd⁡\(z~i\)d\(\\widetilde\{z\}\_\{i\}\)byϵ\\epsilonand Lipschitz continuity on the enlarged domain addsL⁡\(ρ\+η\)L\(\\rho\+\\eta\)\. Regularity only onSSdoes not suffice ifz~i∉S\\widetilde\{z\}\_\{i\}\\notin S\.

### A\.1Computable regularity bounds

Let scaled logitsu⁡\(z\),v⁡\(z\)u\(z\),v\(z\)be continuously differentiable on a convex domain containing protected and compressed points\. Setp=softmax⁡\(u\)p=\\operatorname\{softmax\}\(u\),q=softmax⁡\(v\)q=\\operatorname\{softmax\}\(v\), andC⁡\(p\)=diag⁡\(p\)−p​p⊤C\(p\)=\\operatorname\{diag\}\(p\)\-pp^\{\\top\}\. Log\-sum\-exp differentiation\[[Gao and Pavel, 2017](https://arxiv.org/html/2610.40740#bib.bib7)\]gives

∇zDKL\(p∥q\)=\(Du\)⊤C\(p\)\(u−v\)\+\(Dv\)⊤\(q−p\)\.\\nabla\_\{z\}D\_\{\\mathrm\{KL\}\}\(p\\\|q\)=\(Du\)^\{\\top\}C\(p\)\(u\-v\)\+\(Dv\)^\{\\top\}\(q\-p\)\.\(15\)For unitxx, the variancex⊤​C​\(p\)​x≤\(maxi⁡xi−mini⁡xi\)2/4≤1/2x^\{\\top\}C\(p\)x\\leq\(\\max\_\{i\}x\_\{i\}\-\\min\_\{i\}x\_\{i\}\)^\{2\}/4\\leq 1/2\. Hence‖C⁡\(p\)‖2≤1/2\\\|C\(p\)\\\|\_\{2\}\\leq 1/2and softmax is1/21/2\-Lipschitz\. Domain\-wide bounds‖D​u‖2≤J0\\\|Du\\\|\_\{2\}\\leq J\_\{0\},‖D​v‖2≤J1\\\|Dv\\\|\_\{2\}\\leq J\_\{1\}, and‖u−v‖2≤B\\\|u\-v\\\|\_\{2\}\\leq ByieldL≤\(J0\+J1\)​B/2L\\leq\(J\_\{0\}\+J\_\{1\}\)B/2\. Affine substitution proves the main\-text bound; smaller temperature increases it\. Nonlinear heads need certified domain\-wide Jacobian bounds\. Sampled gradient maxima are diagnostics, not upper certificates, and do not establish coverage\.

#### Monotone paths\.

For fixed logitsu,vu,v, letΔ=v−u\\Delta=v\-u,F\(w\)=log∑iewiF\(w\)=\\log\\sum\_\{i\}e^\{w\_\{i\}\}, andqα=softmax⁡\(u\+α​Δ\)q\_\{\\alpha\}=\\operatorname\{softmax\}\(u\+\\alpha\\Delta\)\. Then

DKL\(q0∥qα\)=F\(u\+αΔ\)−F\(u\)−αq0⊤Δ,d2d​α2DKL\(q0∥qα\)=Varqα\(Δ\)≥0\.D\_\{\\mathrm\{KL\}\}\(q\_\{0\}\\\|q\_\{\\alpha\}\)=F\(u\+\\alpha\\Delta\)\-F\(u\)\-\\alpha q\_\{0\}^\{\\top\}\\Delta,\\quad\\frac\{d^\{2\}\}\{d\\alpha^\{2\}\}D\_\{\\mathrm\{KL\}\}\(q\_\{0\}\\\|q\_\{\\alpha\}\)=\\operatorname\{Var\}\_\{q\_\{\\alpha\}\}\(\\Delta\)\\geq 0\.\(16\)The derivative is zero atα=0\\alpha=0, so each score and their maximum are nondecreasing\. This covers linear heads, not general LoRA factors\. A policy mixture\(1−α\)​p\+α​q\(1\-\\alpha\)p\+\\alpha qalso gives convex, nondecreasing forward KL, bounded by−log⁡\(1−α\)\-\\log\(1\-\\alpha\)since the mixture is at least\(1−α\)​p\(1\-\\alpha\)p\. It changes deployment semantics and may require both models; no mixture experiment is claimed\.

#### Trajectory and sequential bounds\.

For trajectory lawsP,QP,Q, common initial, transition, and reward kernels cancel\. The KL chain rule givesDKL\(P∥Q\)=∑h=0H−1𝔼Pd\(zh;θ,θ′\)≤HκD\_\{\\mathrm\{KL\}\}\(P\\\|Q\)=\\sum\_\{h=0\}^\{H\-1\}\\mathbb\{E\}\_\{P\}d\(z\_\{h\};\\theta,\\theta^\{\\prime\}\)\\leq H\\kappa\. Pinsker bounds total variation byH​κ/2\\sqrt\{H\\kappa/2\}\. Alternatively, per\-state Pinsker and maximal coupling give disagreement probability at mostκ/2\\sqrt\{\\kappa/2\}per step; a union bound proves the weaker result\. Autoregressive certification must cover relevant histories, not just initial prompts\. The triangle inequality bounds normalized endpoint return difference by∑t\|JH​\(πt\)−JH​\(πt−1\)\|/H≤∑tmin⁡\{1,H​κt/2\}\\sum\_\{t\}\|J\_\{H\}\(\\pi\_\{t\}\)\-J\_\{H\}\(\\pi\_\{t\-1\}\)\|/H\\leq\\sum\_\{t\}\\min\\\{1,\\sqrt\{H\\kappa\_\{t\}/2\}\\\}\. This sums return differences, not KL divergences\.

## Appendix BReproducibility and Evaluation Receipt

An accompanying artifact should expose fields rather than only aggregate scores\. The study fixes the official partition, subject ranges, anchor capacity, grid, KL direction, budget, baselines, metrics, and three seeds\. Exact optimization hyperparameters and per\-update receipt values should accompany a released configuration before independent replication claims are made\.

Table 3:Minimum machine\-readable CABA evaluation receipt\.
## Appendix CRecommended Foundation\-Model Validation Protocol

Compare unrestricted commit, STABLE\-style gates, and CABA with fixed old policy, candidate, path, and audit data\. Cross gates with candidate generators using optimization\-time KL or replay; neither is a post\-hoc gate for an identical candidate\. Match memory across random, coverage\-aware, and conflict\-aware audits\. Separately report end\-to\-end sequences where accepted histories diverge\.

Report utility, historical performance, worst\-anchor and average KL, fullg⁡\(α\)g\(\\alpha\)traces, accepted coefficients, rejections, reference drift, memory, compute, and wall time\. For robots, separate action drift from rollout success and safety events\. Predeclare budgets on development streams and hold out the final sequence\. These comparisons remain prospective; none is claimed as completed here\.

Training\-time mechanisms include HiP\-LoRA’s spectral plasticity budget\[[Chen and Tan, 2026](https://arxiv.org/html/2610.40740#bib.bib3)\]; LifeLong\-RFT and sequential VLA fine\-tuning\[[Liu et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib17);[Hu et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib12)\]; FOREVER replay\[[Feng et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib6)\]; trajectory\-mixed supervision\[[Khan et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib14)\]; sparse memory fine\-tuning\[[Goyal et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib8)\]; and Info\-VLA representation constraints\[[Zhao et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib27)\]\. Gated HAR uses diagonal feature modulation rather than a post\-update KL acceptance test\[[Rahimi Azghan et al\., 2026](https://arxiv.org/html/2610.40740#bib.bib20)\]\. These are candidate generators or training constraints, not evidence that an external CABA gate improves their outcomes\.

## Appendix DAdditional Reporting Boundaries

Supported claims are: \(1\) CABA verifies a worst\-anchor KL constraint under exact arithmetic or a validated numerical error allowance; \(2\) under explicit coverage and Lipschitz assumptions, the finite check extends to protected support; \(3\) under the stated MDP assumptions, uniform action KL bounds normalized return degradation; and \(4\) on UCI\-HAR, the selected budget trades accuracy for measured retention\.

Unsupported claims are: \(1\) random anchors cover all safety\-relevant states of a foundation\-model agent; \(2\) small KL guarantees semantic correctness, fairness, privacy, or global safety; \(3\) CABA outperforms replay, STABLE, Memory Anchors, or continual VLA methods; or \(4\) UCI\-HAR predicts LLM, VLA, or robot performance\. Trimming or quantile gating requires coverage by the retained subset; otherwise the uniform claim is lost\. Reverse, symmetric, or Jensen–Shannon divergence requires matching support assumptions and constants\. Label\-free auditing remains vulnerable to poisoned observations or stale requirements; quarantine changes coverage\. Backbone changes require raw\-context reevaluation or a proved representation\-error allowance, not merely an alignment score\.