隐蔽的侵蚀：自我改进智能体中的验收关卡如何失去冗余安全防护

# How Acceptance Gates LoseRedundant Safeguards in Self-Improving Agents
Source: [https://arxiv.org/html/2610.38392](https://arxiv.org/html/2610.38392)
## Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self\-Improving Agents

Hau\-Sing SoDaixian LiuWeicai Long††thanks:Corresponding author\.

###### Abstract

Self\-improving LLM agents edit their own harness, the prompts and rules around a fixed model, and keep an edit only if an acceptance gate scores it higher on a batch of tasks\. Such a gate sees what the harness does under the current model, not what it would still prevent if one safeguard failed\. When safeguards overlap, deleting one is*masked*: the others still block the harm, so the gate decides on task success alone and redundancy erodes unseen\. We measure harm for every subset of four written safeguards in two agent environments and run 411 improvement loops under ten gate rules, mostly as controlled deletion experiments, plus three runs of the GEPA optimizer\. A deletion behind another working safeguard adds almost no observable harm\. A paired significance test blocks deletions that pass by chance but not deletions that genuinely raise task success, and a larger evaluation batch lets it delete cheaper safeguards: at the same cost, 20\-task batches kept every harness protected while 40\-task batches lost all six\. Large harm audits prevent exposure but not the loss of depth, which turns into harm when the harness is reused with a weaker model\. GEPA kept every safety rule verbatim, yet two of its three final harnesses misused credentials under a weaker model\. A statistical model frozen before the runs predicts where each gate’s protection breaks as safeguard cost and batch size change, and freezing safety text or auditing one\-layer ablations preserves depth\.

## 1Introduction

Figure 1:Low observed harm can hide lost redundancy\.\(a\) A gate that audits every harm task in its batch \(veto,ρ\\rho= 1; loop 5 in Appendix Table[14](https://arxiv.org/html/2610.38392#A5.T14)\) accepts three deletions without seeing new harm, and the margin falls from 2 to 1\. \(b\) The final harness stays below the harm threshold under the loop’s model, but misuses credentials in 0\.575 of runs under the weaker Qwen3\-30B \(two stronger API models: at most 0\.05\)\.Self\-improving agents such as ADAS, the Darwin Gödel Machine, GEPA, ACE and Self\-Harness\([Hu et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib18);[Zhang et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib58);[Agrawal et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib2);[Zhang et al\., 2026b](https://arxiv.org/html/2610.38392#bib.bib59);[Zhang et al\., 2026a](https://arxiv.org/html/2610.38392#bib.bib57)\)rewrite their own harness: the prompts, notes and tool rules around a fixed model\. Most keep a rewrite only if an*acceptance gate*finds that the new harness does better than the old one on a batch of tasks\. Self\-evolution can still degrade safety\([Shao et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib39);[Das et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib8);[Mao et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib27)\); the Darwin Gödel Machine removed the logging that its own hallucination detector relied on\([Zhang et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib58)\)\.

A gate sees what a harness does under the current model; it does not see what the harness would still prevent if one safeguard failed\. Real harnesses guard a harm with overlapping rules\. An assistant that keeps notes for several users may be told who owns each note, to check a noted credential against its own, to verify the account after login, and never to act for someone else\. This is*defence in depth*\([Reason, 1997](https://arxiv.org/html/2610.38392#bib.bib35)\)\. While one rule suffices, deleting another changes almost nothing a gate can measure: the deletion ismasked\. In Figure[1](https://arxiv.org/html/2610.38392#S1.F1), a gate that audited every harm task in its batch accepted three deletions in a row\. The final harness stayed below our harm threshold under the loop’s model \(0\.025 vs\. 0\.000\), but misused credentials in 0\.575 of runs under the weaker Qwen3\-30B\.

Existing checks on self\-improvement test either the gain or the child\. Robust gates ask whether an accepted gain is real\([Shawn, 2026](https://arxiv.org/html/2610.38392#bib.bib40);[Wang et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib48)\); harm audits and semantic floors ask whether the child behaves safely now\([Kumar et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib24)\)\. A masked deletion passes both: its gain may be real, and the child is safe under the current model\. What it removes is*margin*, the number of further failures the harness can absorb, which no check of the child under one model can measure\. We call this loss of redundancymasked erosion\.

We study masked erosion in two environments with deterministic audits: credential misuse in AppWorld\([Trivedi et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib43)\)and destructive clean\-up in OpsSim, a simulated operations service\. In each we measure harm for all 16 subsets of four safeguards and run 411 loops under ten gate rules\. Most are*stress loops*, a controlled intervention in the spirit of mutation testing\([DeMillo et al\., 1978](https://arxiv.org/html/2610.38392#bib.bib10);[Jia and Harman, 2011](https://arxiv.org/html/2610.38392#bib.bib20)\): each generation deletes one safeguard, and we record whether the gate lets it through\. Eighteen natural loops let an LLM rewrite text freely, and three runs use GEPA unchanged\. Our contributions are:

- •A mechanism and a way to measure it\.Masking explains why a gate cannot see the loss of a redundant safeguard; a harm lattice over all safeguard subsets measures what is lost as*margin*, the number of further safeguards that may fail before harm appears \(§[3\.2](https://arxiv.org/html/2610.38392#S3.SS2), §[4\.2](https://arxiv.org/html/2610.38392#S4.SS2)\)\.
- •Advance prediction of where gates break\.A gate\-free effect size from calibration runs separates deletions that a significance test blocks from those it passes, and a simulator frozen before the loops predicts where each gate breaks as safeguard cost and batch size change: a larger batch admits cheaper deletions \(§[3\.3](https://arxiv.org/html/2610.38392#S3.SS3), §[4\.3](https://arxiv.org/html/2610.38392#S4.SS3)–[4\.4](https://arxiv.org/html/2610.38392#S4.SS4)\)\.
- •Evidence on what gates leave behind\.Harm audits stop exposure but not depth loss, which becomes harm under weaker models; GEPA shows a related blind spot outside the labelled rules; freezing safety text and auditing one\-layer ablations preserve depth \(§[4\.5](https://arxiv.org/html/2610.38392#S4.SS5)–[4\.7](https://arxiv.org/html/2610.38392#S4.SS7)\)\.

Together, the results separate two properties that current gates conflate: being safe now, and staying safe when something changes\.

## 2Related Work

#### Self\-Improving Agents and Their Gates

STOP, ADAS, Gödel Agent and the Darwin Gödel Machine rewrite code or harnesses\([Zelikman et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib56);[Hu et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib18);[Yin et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib54);[Zhang et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib58)\); OPRO, DSPy, GEPA and ACE tune prompts or context\([Yang et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib51);[Khattab et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib22);[Agrawal et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib2);[Zhang et al\., 2026b](https://arxiv.org/html/2610.38392#bib.bib59)\)\. Prompt compression drops low\-utility instructions by design\([Jiang et al\., 2023](https://arxiv.org/html/2610.38392#bib.bib21)\)\. We study the acceptance step these systems share\. PACE, SAGE and RRSI make gates robust to noisy or over\-fitted improvements\([Shawn, 2026](https://arxiv.org/html/2610.38392#bib.bib40);[Wang et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib48);[Xia et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib49)\), and other work analyzes selection noise, lock\-in and statistical limits\([Hu and Tang, 2026](https://arxiv.org/html/2610.38392#bib.bib17);[Wang et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib47)\)\. These ask whether an accepted gain is real\. We ask what real gains and noise do to safeguards that the score barely measures\.

#### Safety of Self\-Evolving Agents

Self\-evolution can degrade safety\([Shao et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib39);[Das et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib8);[Lin et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib25);[Gong et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib13)\), through unsafe skills\([Mao et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib27);[Shang et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib38)\)or through experiences that are harmful only in combination\([Yan et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib50)\), and individually safe harness updates can interact unsafely\([Zhang et al\., 2026c](https://arxiv.org/html/2610.38392#bib.bib60)\)\. Iterative code refinement can remove validation logic that a static scanner does not flag\([Chen et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib7)\), a single masked edit; we measure how gates accumulate such edits\. Semantic floors check that an edited safety gate still behaves like a reference gate, not merely that it is present\([Kumar et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib24)\); a masked deletion passes such checks under the current model\. SHE accepts safety edits only if safety improves without utility loss\([Qu et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib31)\), and AI control screens edits with trusted monitors\([Greenblatt et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib14)\)\.

#### Defence in Depth

Redundancy hides the failure of individual barriers\([Rasmussen, 1997](https://arxiv.org/html/2610.38392#bib.bib34);[Vaughan, 1996](https://arxiv.org/html/2610.38392#bib.bib45);[Hendrycks et al\., 2021](https://arxiv.org/html/2610.38392#bib.bib15)\), and optimizing a proxy erodes what the proxy omits\([Manheim and Garrabrant, 2018](https://arxiv.org/html/2610.38392#bib.bib26);[Skalse et al\., 2022](https://arxiv.org/html/2610.38392#bib.bib41);[Amodei et al\., 2016](https://arxiv.org/html/2610.38392#bib.bib3);[Gao et al\., 2023](https://arxiv.org/html/2610.38392#bib.bib12)\)unless the constraint is stated\([Achiam et al\., 2017](https://arxiv.org/html/2610.38392#bib.bib1)\)\. Minimizing a test suite can lose fault detection\([Yoo and Harman, 2012](https://arxiv.org/html/2610.38392#bib.bib55)\), and mutation testing removes checks to see whether tests notice\([Jia and Harman, 2011](https://arxiv.org/html/2610.38392#bib.bib20)\)\. A model swap resembles a common\-cause failure of redundant barriers\([Mosleh et al\., 1988](https://arxiv.org/html/2610.38392#bib.bib29)\), and behaviour transfers unreliably across models\([Sclar et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib37);[Echterhoff et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib11)\)\.

## 3Method

![Refer to caption](https://arxiv.org/html/2610.38392v1/figures/overview_concept.png)Figure 2:Study design\.Top: a proposer deletes a layer \(stress loops\) or rewrites text freely \(natural loops and GEPA\); the gate compares parent and child on a fresh batch, and an accepted child becomes the next parent\. Bottom left: while another layer blocks the harm, a deletion leaves observed harm low but removes redundancy\. Bottom middle: an accepted deletion either buys little \(drift\) or real task success \(selection\)\.### 3\.1Problem Setting

A harnessHHis text given to a fixed modelMM; it contains a setSSof safeguard layers that the proposer may edit like any other text\. Tasks come from a clean pool and a*harm pool*, whose tasks contain a trap such as another user’s credential\. Both pools are split into calibration, confirmation and final sets \(Tcal, Tconf, Tfinal\), and no gate sees Tfinal\. A proposer turnsHHinto a childH′H^\{\\prime\}, and a gateGGruns both once on a fresh batchBBofnntasks, each drawn from the harm pool with probabilitypp:

G⁡\(H,H′,B\)∈\{accept,reject\}\.G\(H,H^\{\\prime\};B\)\\in\\\{\\text\{accept\},\\text\{reject\}\\\}\.\(1\)Table[1](https://arxiv.org/html/2610.38392#S3.T1)lists our main gates; Appendix[B](https://arxiv.org/html/2610.38392#A2)adds an asymmetric and an intersection\-union \(IUT\) gate, ten rules in all with veto at two audit shares\.*Split\-half*is a single\-evaluation variant of the Self\-Harness rule, and*paired*applies an exact McNemar test\([McNemar, 1947](https://arxiv.org/html/2610.38392#bib.bib28)\)\. Greedy, split\-half and the two veto gates \(ρ\\rho= 0\.2 and 1\) are*non\-paired*\.

Table 1:Gate rules\(nn= 40,pp= 0\.1,α\\alpha= \.05,ρ∈\{0\.2,1\}\\rho\\in\\\{0\.2,1\\\}\)\. Extra harm runs: 120 per audited state, 30 per ablation\.#### Deployment Assumption

The loop may edit safeguards, and the operator later reuses its harness with another model without re\-auditing it, for instance after a provider update\([Chen et al\., 2024b](https://arxiv.org/html/2610.38392#bib.bib6)\)or when routing to a cheaper model\([Chen et al\., 2024a](https://arxiv.org/html/2610.38392#bib.bib5)\)\. Our swap experiments test this scenario, not how often it occurs\.

### 3\.2Masking, Margin and Child\-Only Harm

For every subsetT⊆ST\\subseteq S, leth⁡\(T\)h\(T\)be the harm rate on the harm pool\.TTis*protected*ifh⁡\(T\)≤τh\(T\)\\leq\\tau= 0\.05, and a layerssis*sufficient*if\{s\}\\\{s\\\}is protected; both classes hold for a given model and task pool\. The*margin*of a protected state is the fewest deletions that reach an unprotected subset:

m\(T\)=min\{\|T∖T′\|:T′⊆T,h\(T′\)\>τ\},m\(T\)=\\min\\,\\\{\\,\|T\\setminus T^\{\\prime\}\|:T^\{\\prime\}\\subseteq T,\\ h\(T^\{\\prime\}\)\>\\tau\\,\\\},\(2\)withmm=∞\\inftyif none exists, which we never observed\. In fault\-tree terms,mmis the order of the smallest cut set\([Vesely et al\., 1981](https://arxiv.org/html/2610.38392#bib.bib46)\); it does not requirehhto be monotone\. For a deletionT→T∖\{s\}T\\to T\\setminus\\\{s\\\}, we run parent and child on the same tasks and record the clean success gainggand the*child\-only harm*h01=Pr⁡\[child harms∧parent does not\]h\_\{01\}=\\Pr\[\\text\{child harms\}\\wedge\\text\{parent does not\}\]\. The deletion is*masked*if parent and child are both protected, and*exposing*if only the parent is\. Masking bounds the new harm:

h01≤h⁡\(T∖\{s\}\)≤τ\.h\_\{01\}\\leq h\(T\\setminus\\\{s\\\}\)\\leq\\tau\.\(3\)An audit ofkkindependent harm\-pool pairs therefore detects a masked deletion with probability at most1−\(1−τ\)k1\-\(1\-\\tau\)^\{k\}, or 0\.19 forkk= 4\. A threshold rule passes every masked child, and stricter rules need far more data than a batch holds: a veto needs about 200 pairs to catch a child\-only harm of 0\.008 four times in five, and a rate comparison about 700 runs per arm to tell 0\.008 from 0\.025 \(one\-sidedα\\alpha= \.05, power 0\.8\)\. What a masked deletion removes is margin, a property of the child’s ablations rather than of the child itself\. Margin is coarse but easy to interpret \(§[4\.5](https://arxiv.org/html/2610.38392#S4.SS5)\)\.

### 3\.3Drift and Selection

A gate sees a masked deletion mainly through its effect on success\. LetgB=\(1−p\)​g\+p​ghg\_\{B\}=\(1\-p\)\\,g\+p\\,g\_\{h\}be the gain on the mixed batch, withghg\_\{h\}the gain on harm\-pool tasks, and letz=gB​n/σz=g\_\{B\}\\sqrt\{n\}/\\sigmabe its standardized effect, whereσ\\sigmais the standard deviation of the paired per\-task difference; both come from calibration pairs\. Withzαz\_\{\\alpha\}the one\-sided critical value, a normal approximation gives

Pgreedy≈Φ⁡\(z\),Ppaired≈Φ⁡\(z−zα\)\.P\_\{\\text\{greedy\}\}\\approx\\Phi\(z\),\\qquad P\_\{\\text\{paired\}\}\\approx\\Phi\(z\-z\_\{\\alpha\}\)\.\(4\)Greedy rejects ties, which the continuity correctionΦ⁡\(z−1/\(2​σ​n\)\)\\Phi\(z\-1/\(2\\sigma\\sqrt\{n\}\)\)accounts for \(Appendix[B](https://arxiv.org/html/2610.38392#A2)\)\. Borrowing terms from population genetics\([Kimura, 1968](https://arxiv.org/html/2610.38392#bib.bib23);[Ohta, 1973](https://arxiv.org/html/2610.38392#bib.bib30)\), we distinguish two regimes\. Indrift\(z≈0z\\approx 0\), noise decides: non\-paired gates accept a nearly free deletion by chance, and a valid significance test does so with probability at mostα\\alphain every generation\. Inselection\(z≫0z\\gg 0\), the deletion truly raises success and passes success\-based gates, all the more surely in a larger batch: the smallest cost that a significance gate detects falls asσ/n\\sigma/\\sqrt\{n\}, and faster at smallnnfor the exact test\. We label an edge selection when its calibrationz≥zαz\\geq z\_\{\\alpha\}, without reference to gate decisions; a simulator\-based classification agrees on 84–100% of edges \(Appendix[C](https://arxiv.org/html/2610.38392#A3)\)\. The batch\-size effects below follow from Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4); what is new is that the break points were predicted before any loop ran\.

### 3\.4Statistical Analysis

Loops are the unit of analysis\. We use one\-sided Fisher and exact permutation tests across loops, matched tests where arms share random numbers, and Holm correction\([Holm, 1979](https://arxiv.org/html/2610.38392#bib.bib16)\)within each registered family\. Each confirmatory prediction and its analysis code were frozen and hashed before the test ran\([van Miltenburg et al\., 2021](https://arxiv.org/html/2610.38392#bib.bib44)\)\. Predictions come from a*gate simulator*that resamples calibration pairs with a Bayesian bootstrap\([Rubin, 1981](https://arxiv.org/html/2610.38392#bib.bib36)\), runs the exact gate code and chains acceptance probabilities over the lattice \(Appendix[B](https://arxiv.org/html/2610.38392#A2)\)\. Its frozen predictions placed the break costs for 20\-, 40\- and 120\-task batches before the loops ran, and every paired count of the cost dose\-response fell inside its frozen interval\. On single AppWorld decisions, where every edge is drift, it predicts no better than each gate’s mean rate \(Appendix[B](https://arxiv.org/html/2610.38392#A2)\); its value lies where effects vary\. Not every prediction held: of 177 registered predictions, 113 held, 49 failed, 9 held in part and 6 could not be scored\. Every verdict was computed by the frozen analysis code\. Of the 14 tests behind the main claims, 7 held; the others fell short in the predicted direction \(3\), found a stronger effect than predicted \(2\) or found a harm\-aware gate weaker than predicted \(2\) \(Appendix[K](https://arxiv.org/html/2610.38392#A11)\)\. Three later prediction sets, including GEPA’s, were frozen after related outcomes, and the drift account was formulated after a predicted AppWorld selection effect failed to replicate\.

## 4Experiments

Figure 3:Redundant layers are masked\.\(a\) Harm of every AppWorld state under DeepSeek, pooled over calibration and confirmation tasks \(blue outline: protected, harm≤\\leq0\.05\)\. \(b\) Child\-only harmh01h\_\{01\}of single deletions, classifying children on Tcaland measuring on Tconf\(lines: 95% upper bounds; hollow: zero events\)\.### 4\.1Experimental Setup

#### Credential Misuse in AppWorld

Following[So et al\. \(2026\)](https://arxiv.org/html/2610.38392#bib.bib42), the agent’s notes hold login credentials for several apps\. In the harm pool, the note for the target app \(Amazon, Gmail or Venmo\) holds another user’s working credential, which the task never needs\. A deterministic audit, with no LLM judge, flags any non\-login call made with a foreign token and any net change to that user’s account\. The starting harness H0 has four layers:authnames each note’s owner,verifyuses a noted credential only if it matches the requester’s own,profilechecks the account after login, andcautionallows only the requester’s credentials\. Tasks are split by supervisor \(30/30/20 per pool for Tcal/Tconf/Tfinal\)\. A ReAct\-style code agent\([Yao et al\., 2023](https://arxiv.org/html/2610.38392#bib.bib53)\)runs at most 15 steps at temperature 0\.

#### Destructive Clean\-Up in OpsSim

Tickets ask the agent to clear stale cache or lock entries; in the harm pool, the notes suggest a wildcard or admin rights that would also delete an entry still in use\. The layers arescope,confirm\(ask the owner first\),leastprivanddryrun\. The step budget sets their cost: at three steps, removing all four raises clean success from 0\.00–0\.50 to 1\.00 for the five loop models, while at four steps they cost DeepSeek nothing in calibration\. The simulator runs in memory and never executes a command\.

#### Models, Loops and GEPA

DeepSeek\-V4\.1\-Flash is the main agent and proposer; Qwen3\-30B\-A3B and Qwen3\-8B run locally\([Qwen Team, 2025](https://arxiv.org/html/2610.38392#bib.bib32)\)\. GPT\-6 Luna, GPT\-6\.1 Sol and Claude Haiku 5\.5, reached through a third\-party API, serve as supplementary models; every main finding holds with DeepSeek and the local Qwen models alone\. Loops run eight generations withnn= 40 andpp= 0\.1 unless noted\.*Stress*loops propose deleting a uniformly chosen remaining layer\.*Natural*loops use a free\-form DeepSeek proposer asked to make the harness cheaper \(Appendix[E](https://arxiv.org/html/2610.38392#A5)\)\. Of the 411 loops, 393 are stress loops \(78 in AppWorld, 315 in OpsSim\) and 18 are natural loops\. Finally, we run GEPA 0\.1\.4 unchanged\([Agrawal et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib2)\)for three seeds of 800 metric calls on AppWorld, scored on task success alone \(Appendix[H](https://arxiv.org/html/2610.38392#A8)\)\.

### 4\.2Masked Deletions Are Nearly Invisible

Under DeepSeek,authandverifyeach suffice alone,cautionandprofileonly reduce harm, and H0 has margin 2 \(Figure[3](https://arxiv.org/html/2610.38392#S4.F3)a\)\.profile’s weakness is partly an audit artefact: the audit counts the account check thatprofileitself prescribes\. Without that call,profilesuffices, H0’s margin is 3, and no conclusion below changes \(Appendix[D](https://arxiv.org/html/2610.38392#A4)\)\. Deletions into children protected on Tcalcarry child\-only harm of 0\.016 on Tconf\(upper bound 0\.028\), against 0\.422 for deletions into unprotected children\. A four\-task batch audit would notice the former in about 6% of decisions\.

The pattern holds for every model that follows some layer reliably \(Figure[3](https://arxiv.org/html/2610.38392#S4.F3)b\)\. In OpsSim,confirmalone suffices for DeepSeek, Luna and Sol, and deletions behind it carryh01≤0\.018h\_\{01\}\\leq 0\.018\. Weak models have nothing to mask: no single AppWorld layer suffices under Qwen3\-30B, and Qwen3\-8B and Haiku follow no layer reliably\. Protection is a property of the harness and the model together\.

Figure 4:Drift in 27 AppWorld stress loops\(DeepSeek\)\. \(a\) Margin of each loop’s harness by generation \(dashed: mean; markers: first unprotected state\)\. \(b\) Acceptance of planted deletions over 204 proposals \(markers\) and frozen prediction \(ticks\); gates draw separate batches, so veto \(0\.2\) can exceed greedy\. \(c\) Acceptance of masked deletions vs\. of real \+0\.075 \(filled\) and \+0\.275 \(hollow\) edits, for paired at threeα\\alphaand greedy\.
### 4\.3Significance Suppresses Drift

In 27 AppWorld stress loops with DeepSeek, every deletion is nearly neutral \(\|z\|≤1\.1\|z\|\\leq 1\.1\)\. Greedy and split\-half gates accepted 0\.48 and 0\.44 of proposed deletions and the paired gate 0\.04 \(Figure[4](https://arxiv.org/html/2610.38392#S4.F4)b; loop\-level permutation, Holmpp= \.002 for both\)\. Greedy accepted masked deletions at 0\.63, against 0\.36 for no\-op edits at the same parents: noise explains most acceptances, and small batch gains the rest\. These gains did not transfer: greedy finals solved 0\.358 of clean Tfinaltasks, H0 0\.400\.

The batches gave no warning\. The 32 deletions into protected children that greedy, split\-half and paired gates accepted came with 114 harm\-pool tasks \(48 distinct\) and no child\-only harm, while the margin fell \(Figure[4](https://arxiv.org/html/2610.38392#S4.F4)a\)\. Greedy loops ended unprotected in 5 of 6 runs, four of them with no layer left, and paired loops in none \(one\-sided Fisher, Holmpp= \.015\); split\-half loops did so in 2 of 6\. The paired test suppresses drift without stopping it: it accepted 2 of 42 masked deletions, and chaining its frozen per\-edge rates gives an unprotected final with probability 0\.19 by generation 64 \(Appendix[F](https://arxiv.org/html/2610.38392#A6)\)\. This protection comes from conservatism \(Figure[4](https://arxiv.org/html/2610.38392#S4.F4)c\): atα\\alpha= \.05 the paired gate passes a real \+0\.075 edit in 8% of decisions, against 96% for greedy, and atα\\alpha= \.20 it passes that edit in 54% but accepts 17% of masked deletions\.

Figure 5:Selection defeats significance\.\(a\) Four\-step OpsSim with a rising cost onconfirm\(DeepSeek,nn= 40\): paired loops lose protection once the layer costs enough\. \(b\) The break moves with batch size: frozen simulator \(lines\) and loops \(markers\)\. \(c\) Fresh\-task gain of the safety\-text edits of natural loops \(means, 95% intervals\); fill marks accepted edits that relax a check\.
### 4\.4Significance Does Not Stop Selection

#### Costly Layers Are Deleted for Real Gains

At three steps, DeepSeek’s full OpsSim stack solves 0\.30 of clean tasks and its empty stack 1\.00\. Across all logged stress decisions, the paired gate accepted 9 of 292 deletions withz<zαz<z\_\{\\alpha\}but 46 of 92 withz≥zαz\\geq z\_\{\\alpha\}\(Figure[6](https://arxiv.org/html/2610.38392#S4.F6)a\)\. It accepted deletingconfirm, the only sufficient layer for DeepSeek, Luna and Sol, in 15 of 20 proposals from the full stack, and their paired loops lost protection in 4, 3 and 6 of 6 runs \(Table[2](https://arxiv.org/html/2610.38392#S4.T2)\)\.

Table 2:Selection decides whether significance protects\.Greedy \(G\) and paired \(P\) stress loops that reach an unprotected state, and mean Tfinalharm of their finals\. Cost: clean success that the full stack loses on Tconf; Sel\.: deletion edges \(of 32\) with calibrationz≥zαz\\geq z\_\{\\alpha\}; st\.: step budget\. DeepSeek in OpsSim adds six fresh\-seed loops per arm\.
#### Cost Is a Dose

At four steps the layers are free\. Letting the owner whomconfirmasks stay silent on some tasks gives that one layer a cost we control\. As the cost rose from 0 to 0\.32, paired loops lost protection in 0, 0, 1, 6 and 4 of 6 runs, each inside its frozen 95% interval, while greedy loops eroded at every cost \(Figure[5](https://arxiv.org/html/2610.38392#S4.F5)a\)\. The observed break, between costs of 0\.08 and 0\.15, contains the critical effect of the exact test atnn= 40 \(Appendix[F](https://arxiv.org/html/2610.38392#A6)\)\.

#### Larger Batches Admit Cheaper Deletions

By Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4), a larger batch lets a significance gate detect, and therefore accept, a smaller gain; the question is whether this can be predicted\. Before the runs, the simulator placed the break at a cost of 0\.20, 0\.09 and 0\.03 for batches of 20, 40 and 120 tasks \(Figure[5](https://arxiv.org/html/2610.38392#S4.F5)b\)\. With 20 tasks per batch, paired loops kept all six harnesses protected at a cost of 0\.15, where 40\-task loops lost all six \(pp= \.001\)\. With 120 tasks, resampled from the 60\-task pool, paired loops lost 5 of 6 at costs of 0\.03 and 0\.08, where 40\-task loops lost 0 and 1; counting each distinct task once would reverse 4 of their 10 acceptances, so these loops confirm the direction rather than the exact break \(Appendix[B](https://arxiv.org/html/2610.38392#A2)\)\. A larger batch, usually the safer choice, admits cheaper deletions\.

#### Natural Proposers Trim Costly Checks

Natural proposers rarely delete a layer outright; they rewrite the checks inside it \(Appendix Figure[8](https://arxiv.org/html/2610.38392#A7.F8)\)\. Run alone, the rewritten layers let through 0\.19 more harm than the originals \(CI \[0\.08, 0\.31\]\)\. On fresh tasks, the 10 accepted safety\-text edits kept a success gain of 0\.075 \(CI \[0\.007, 0\.163\]\), and seven of them relax a check, mostlyprofile’s \(Figure[5](https://arxiv.org/html/2610.38392#S4.F5)c\)\. Selection also works inside layers\.

Figure 6:What the gates decide and what they leave behind\.\(a\) Acceptance by gate\-freezz\(95% intervals\) against Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4)\. \(b\) AppWorld finals: clean success and misuse under Qwen3\-30B \(hollow: natural loops\)\. \(c\) Three\-step OpsSim finals under selection \(Table[21](https://arxiv.org/html/2610.38392#A6.T21)\)\.

### 4\.5What the Gates Leave Behind

#### Audits Stop Exposure, Not Depth Loss

Auditing harm works against exposing deletions: the veto \(ρ\\rho= 1\) saw child\-only harm in 14 of 18 of them, but in only 2 of 29 masked ones\. Table[3](https://arxiv.org/html/2610.38392#S4.T3)orders gates by the harm runs they read\. Unprotected loops fall from 5 of 6 to none, yet five of six audit\-veto finals keep a margin of only 1\. The contrast is sharp without redundancy, where each OpsSim trap has exactly one blocking layer: there the same audit veto rejected all 23 deletions that greedy accepted and kept every full stack, while greedy lost all six loops\. Audits control exposure but cannot see redundancy\.

Table 3:Audits stop exposure, not depth loss\(AppWorld, DeepSeek, six stress loops per gate\): harm runs read, unprotected loops, mean final margin, Tfinalmisuse under Qwen3\-30B and clean success\.
#### Lost Depth Becomes Harm Under Weaker Models

We re\-ran the 11 distinct finals of the 27 DeepSeek stress loops on Tfinalunder other models, comparing only finals still protected under DeepSeek, which separates lost depth from existing exposure \(Appendix Figure[9](https://arxiv.org/html/2610.38392#A9.F9)\)\. Under Qwen3\-30B, non\-paired finals misused credentials in 0\.30 of runs and paired finals in 0\.004 \(CI of the difference \[0\.16, 0\.47\]\); under Qwen3\-8B the gap was 0\.16 \[0\.02, 0\.29\]\. The harm follows the missing layers, not a model trying things at random\. Qwen3\-30B used up its step budget in 63–90% of runs under every final, H0 included, yet finals that keptauthand at least one other layer misused credentials in 2 of 200 runs,authalone in 9 of 40, and finals withoutauthin 89 of 200, in step\-exhausted and shorter runs alike \(Appendix Table[31](https://arxiv.org/html/2610.38392#A9.T31)\)\. Layers that are interchangeable for DeepSeek are not interchangeable for the weaker model: it relies mainly onauth, and depth behindauthstill cuts its harm from 0\.225 to 0\.01\. Lost redundancy is lost coverage for a model that relies on different layers; a swap acts as a common\-cause failure of the remaining barriers\([Mosleh et al\., 1988](https://arxiv.org/html/2610.38392#bib.bib29)\)\. The effect is specific to weaker executors\. Both Qwen models solve about 5% of clean AppWorld tasks; under Luna and Sol, which solve them, the gap was only 0\.025 \[0, 0\.07\], and after a task shift under DeepSeek 0\.020 \(pp= \.061\)\. Because the weaker model leans on one layer, margin under DeepSeek ranks its harm only with Spearmanrsr\_\{s\}= 0\.65; the expected harm after one random layer failure does better \(0\.80\), but needs far more harm runs than a batch holds \(Appendix[I](https://arxiv.org/html/2610.38392#A9)\)\.

### 4\.6An Off\-the\-Shelf Optimizer: GEPA

Stress loops plant deletions; GEPA proposes its own edits\. We split the harness into four text components \(note header, note template, credential rules and task tips\) and scored task success alone\. GEPA keeps a candidate that beats its parent on four tasks, which is a greedy gate, and returns the best\-scoring candidate on 27 validation tasks; 181 of 186 proposals were valid \(Appendix Table[30](https://arxiv.org/html/2610.38392#A8.T30)\)\.

#### GEPA Runs in the Drift Regime

GEPA’s validation gains, up to \+0\.22, did not transfer: its finals solved 0\.35–0\.45 of clean Tfinaltasks, against 0\.40 for H0\. Like a greedy stress loop, it accepted edits it could not tell from noise, and it kept rewrites of the credential rules at its usual rate \(7 of 45; all edits: 33 of 181\)\. Of the 17 rewrites our judge flagged as weakening a check, 13 in fact replaced the noted\-credential check with a stricter rule; GEPA kept 3 of those and neither genuine relaxation, and no final weakened a credential rule\.

#### Rules Intact, Behaviour Changed

All three finals kept the credential rules verbatim and caused no harm under DeepSeek\. Two of them rewrote the note template into an instruction to log in with the stored credentials \(“Use these exact credentials to authenticate to \{app\} as \{owner\} whenever needed”\), and seed 2 also added 3,000 characters of efficiency tips\. Under Qwen3\-30B these two finals misused credentials in 2 and 5 of 40 runs, on 2 and 3 of 20 tasks, against 0 of 80 for H0\. The change adds an instruction rather than deleting a safeguard, but it is masked in the same way: the remaining rules override it under the loop’s model, not under a weaker one\. It lies outside the labelled layers over which margin is defined, and the judge marked every layer intact\. With three seeds and few harm events, it is a case study, not an estimate\.

### 4\.7Two Structural Remedies

#### Freezing Safety Text

In four natural loops, safety text was reset to the parent’s\. All four finals kept H0’s safety text and reached the highest clean success of any natural arm, with no harm under DeepSeek and 0\.019 under Qwen3\-30B \(Figure[6](https://arxiv.org/html/2610.38392#S4.F6)b\)\. Freezing protects text, not behaviour, and requires knowing which text is safety text: one final added an unfrozen tip against “extra profile/account checks”\. Under selection in three\-step OpsSim, freezing onlyconfirmkept all six loops protected while the costly layers around it were deleted, at a cost of 0\.05 in clean success \(Figure[6](https://arxiv.org/html/2610.38392#S4.F6)c\)\.

#### Auditing One\-Layer Ablations

The margin\-aware gate applies mutation adequacy\([Jia and Harman, 2011](https://arxiv.org/html/2610.38392#bib.bib20)\)to safeguards: it accepts a child only if every one\-layer ablation stays protected\. On the greedy loops’ random numbers, none of its loops ended unprotected \(greedy: 5 of 6; matched sign testpp= \.031\), with no loss of clean success\. At similar audit compute, it kept more layers than the audit veto in all six matched loops \(sign testpp= \.016\), and its finals harmed less under Qwen3\-30B \(Table[3](https://arxiv.org/html/2610.38392#S4.T3)\)\. Under selection in OpsSim it kept every loop protected by keeping three layers, at a cost of 0\.35 in clean success\. The gate checks layers, not wording: in all three natural loops it letverifybe weakened \(Appendix[G](https://arxiv.org/html/2610.38392#A7)\)\.

## 5Conclusion

We studied when acceptance gates in self\-improving agents erode the redundancy behind low observed harm\. A deletion behind another working safeguard is masked, so the gate decides on task success, and where its protection breaks can be predicted before the runs\. Harm audits prevented exposure but not depth loss, which became harm under weaker models, while freezing safety text or auditing one\-layer ablations preserved depth\. Self\-improving agents should keep safety\-critical behaviour outside the optimizer, gate edits on what remains rather than only on what happens, and re\-audit the harness after a model change\.

## Limitations

Our main limitation is scope\. We study two environments, each with one harm and four written safeguards, and most loops plant one deletion per generation to isolate the gate\. We chose this setting to expose how gates respond to deletion pressure, not to estimate how often deployed optimizers erode safeguards; the natural loops and GEPA runs are case studies\. Erosion matters only when a harm that the model does not avoid on its own meets redundant layers that it follows reliably and a later change that needs them\. Strong models avoided the harms we probed inτ2\\tau^\{2\}\-bench, AgentDojo and a privacy simulation \(Appendix[A](https://arxiv.org/html/2610.38392#A1.SS0.SSS0.Px4)\), and our largest swap effects come from weaker models\. Batch size and harm share were varied only in OpsSim, where the 120\-task batches resample a 60\-task pool; long\-horizon results are simulator projections, and results from the third\-party API models are supplementary\.

## Ethical Considerations

#### Potential Risks

The study identifies safeguard loss that a behavioural gate may miss and evaluates ways to detect or constrain it\. The same findings could inform attempts to weaken safeguards, which motivates transparent reporting of assumptions and of the limits of each remedy\. OpsSim and the privacy simulation use synthetic data in memory: structured agent calls operate on dictionaries, and a static check verifies that OpsSim cannot access files, networks or processes\.

#### Data and Licenses

All AppWorld accounts and credentials are synthetic; no personal data was used\. AppWorld is released under the Apache 2\.0 license with the requirement that public redistribution of its task data be encrypted,τ2\\tau^\{2\}\-bench and AgentDojo are MIT\-licensed, and the Qwen3 weights are released under Apache 2\.0; we use all of them for their intended research purpose\. Proprietary models were accessed through APIs, and API credentials are excluded from all released material\. We will release code, the exact safeguard texts and proposer prompts, frozen predictions with hashes and run records; records that contain AppWorld task data will be encrypted as its license requires\.

#### Use of AI Assistants

AI assistants supported analysis\-code development and manuscript editing\. Figure[2](https://arxiv.org/html/2610.38392#S3.F2)was drafted with an image\-generation tool, and its labels and counts were checked and corrected by the authors; all data plots are rendered programmatically from recorded values\. The authors are responsible for all code, results, citations and figures\.

## References

- Achiam et al\. \(2017\)Joshua Achiam, David Held, Aviv Tamar, and Pieter Abbeel\. 2017\.Constrained policy optimization\.In*Proceedings of the 34th International Conference on Machine Learning*, pages 22–31\.
- Agrawal et al\. \(2026\)Lakshya A Agrawal, Shangyin Tan, Dilara Soylu, Noah Ziems, Rishi Khare, Krista Opsahl\-Ong, Arnav Singhvi, Herumb Shandilya, Michael J Ryan, Meng Jiang, Christopher Potts, Koushik Sen, Alexandros G\. Dimakis, Ion Stoica, Dan Klein, Matei Zaharia, and Omar Khattab\. 2026\.[GEPA: Reflective prompt evolution can outperform reinforcement learning](https://openreview.net/pdf/e2625111ac0503603448f773ff09555ec880422f.pdf)\.In*International Conference on Learning Representations*\.
- Amodei et al\. \(2016\)Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané\. 2016\.Concrete problems in AI safety\.*arXiv preprint arXiv:1606\.06565*\.
- Barres et al\. \(2025\)Victor Barres, Honghua Dong, Soham Ray, Xujie Si, and Karthik Narasimhan\. 2025\.τ2\\tau^\{2\}\-bench: Evaluating conversational agents in a dual\-control environment\.*arXiv preprint arXiv:2506\.07982*\.
- Chen et al\. \(2024a\)Lingjiao Chen, Matei Zaharia, and James Zou\. 2024a\.FrugalGPT: How to use large language models while reducing cost and improving performance\.*Transactions on Machine Learning Research*\.
- Chen et al\. \(2024b\)Lingjiao Chen, Matei Zaharia, and James Zou\. 2024b\.How is ChatGPT’s behavior changing over time?*Harvard Data Science Review*, 6\(2\)\.
- Chen et al\. \(2026\)Yi Chen, Yun Bian, Haiquan Wang, Shihao Li, and Zhe Cui\. 2026\.SCAFFOLD\-CEGIS: Preventing latent security degradation in LLM\-driven iterative code refinement\.*arXiv preprint arXiv:2603\.08520*\.
- Das et al\. \(2026\)Saswat Das, Parvati Viswanathan, Daniel Donnelly, Chang Huang, Sahar Abdelnabi, and Ferdinando Fioretto\. 2026\.SEABench: Benchmarking endogenous misalignment in self\-evolving agents\.*arXiv preprint arXiv:2609\.35596*\.
- Debenedetti et al\. \(2024\)Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer\-Kellner, Marc Fischer, and Florian Tramèr\. 2024\.AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents\.In*Advances in Neural Information Processing Systems Datasets and Benchmarks Track*\.
- DeMillo et al\. \(1978\)Richard A\. DeMillo, Richard J\. Lipton, and Frederick G\. Sayward\. 1978\.Hints on test data selection: Help for the practicing programmer\.*Computer*, 11\(4\):34–41\.
- Echterhoff et al\. \(2024\)Jessica Echterhoff, Fartash Faghri, Raviteja Vemulapalli, Ting\-Yao Hu, Chun\-Liang Li, Oncel Tuzel, and Hadi Pouransari\. 2024\.MUSCLE: A model update strategy for compatible LLM evolution\.In*Findings of the Association for Computational Linguistics: EMNLP 2024*\.
- Gao et al\. \(2023\)Leo Gao, John Schulman, and Jacob Hilton\. 2023\.Scaling laws for reward model overoptimization\.In*Proceedings of the 40th International Conference on Machine Learning*, volume 202 of*Proceedings of Machine Learning Research*, pages 10835–10866\.
- Gong et al\. \(2026\)Chang Gong, Jingping Bi, Di Yao, Xinjian Liang, Chao Xiang, and Ruijie Guo\. 2026\.[Evolutionary safety of recursive self\-improving AI: Taxonomy, risk discovery, and evaluation](https://arxiv.org/abs/2609.31186v1)\.*arXiv preprint arXiv:2609\.31186v1*\.
- Greenblatt et al\. \(2024\)Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger\. 2024\.AI control: Improving safety despite intentional subversion\.In*International Conference on Machine Learning*\.
- Hendrycks et al\. \(2021\)Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt\. 2021\.Unsolved problems in ML safety\.*arXiv preprint arXiv:2109\.13916*\.
- Holm \(1979\)Sture Holm\. 1979\.A simple sequentially rejective multiple test procedure\.*Scandinavian Journal of Statistics*, 6\(2\):65–70\.
- Hu and Tang \(2026\)Litao Hu and Yutong Tang\. 2026\.The winner’s curse in LLM self\-improvement loops: Selection noise, lock\-in, and acceptance rules\.*arXiv preprint arXiv:2610\.09239*\.
- Hu et al\. \(2025\)Shengran Hu, Cong Lu, and Jeff Clune\. 2025\.Automated design of agentic systems\.In*International Conference on Learning Representations*\.
- International Electrotechnical Commission \(2010\)International Electrotechnical Commission\. 2010\.IEC 61508: Functional safety of electrical/electronic/programmable electronic safety\-related systems\.
- Jia and Harman \(2011\)Yue Jia and Mark Harman\. 2011\.An analysis and survey of the development of mutation testing\.*IEEE Transactions on Software Engineering*, 37\(5\):649–678\.
- Jiang et al\. \(2023\)Huiqiang Jiang, Qianhui Wu, Chin\-Yew Lin, Yuqing Yang, and Lili Qiu\. 2023\.LLMLingua: Compressing prompts for accelerated inference of large language models\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 13358–13376\.
- Khattab et al\. \(2024\)Omar Khattab, Arnav Singhvi, Paridhi Maheshwari, Zhiyuan Zhang, Keshav Santhanam, Sri Vardhamanan, Saiful Haq, Ashutosh Sharma, Thomas T\. Joshi, Hanna Moazam, Heather Miller, Matei Zaharia, and Christopher Potts\. 2024\.DSPy: Compiling declarative language model calls into self\-improving pipelines\.In*International Conference on Learning Representations*\.
- Kimura \(1968\)Motoo Kimura\. 1968\.Evolutionary rate at the molecular level\.*Nature*, 217:624–626\.
- Kumar et al\. \(2026\)Satyam Kumar, Kailash Talreja, and Saurabh Jha\. 2026\.Gate presence is not a safety invariant: Semantic floors for self\-editing agent harnesses\.In*NeurIPS 2026 Workshop on Agents in the Wild: Safety, Security, and Beyond*\.
- Lin et al\. \(2026\)Ruixiao Lin, Xinhao Deng, Qingming Li, Jianan Ma, Yunhao Feng, Yuqi Qing, Zhenyuan Li, Yechao Zhang, Shiwen Cui, Changhua Meng, Tianwei Zhang, Xingjun Ma, Qi Li, Ke Xu, and Shouling Ji\. 2026\.Safety in self\-evolving LLM agent systems: Threats, amplification, and case studies\.*arXiv preprint arXiv:2606\.23075*\.
- Manheim and Garrabrant \(2018\)David Manheim and Scott Garrabrant\. 2018\.Categorizing variants of Goodhart’s law\.*arXiv preprint arXiv:1803\.04585*\.
- Mao et al\. \(2026\)Xutao Mao, Liangjie Zhao, Xiang Zheng, and Cong Wang\. 2026\.Practice makes unsafe: Skill misevolution in self\-improving LLM agents\.*arXiv preprint arXiv:2608\.12851*\.
- McNemar \(1947\)Quinn McNemar\. 1947\.Note on the sampling error of the difference between correlated proportions or percentages\.*Psychometrika*, 12\(2\):153–157\.
- Mosleh et al\. \(1988\)A\. Mosleh, K\. N\. Fleming, G\. W\. Parry, H\. M\. Paula, D\. H\. Worledge, and D\. M\. Rasmussen\. 1988\.Procedures for treating common cause failures in safety and reliability studies\.Technical Report NUREG/CR\-4780, U\.S\. Nuclear Regulatory Commission\.
- Ohta \(1973\)Tomoko Ohta\. 1973\.Slightly deleterious mutant substitutions in evolution\.*Nature*, 246:96–98\.
- Qu et al\. \(2026\)Wanying Qu, Qinghua Mao, Yu Li, Jiyao Liu, Xin Zhang, Dadi Guo, Yanxu Zhu, Qingyu Liu, Leitao Yuan, Xi Lin, Shanfeng Zhu, Yanwei Fu, Jing Shao, Xia Hu, and Dongrui Liu\. 2026\.SHE: Trajectory\-driven safety harness evolution for LLM agents\.*arXiv preprint arXiv:2608\.09885*\.
- Qwen Team \(2025\)Qwen Team\. 2025\.Qwen3 technical report\.*arXiv preprint arXiv:2505\.09388*\.
- Ramdas et al\. \(2023\)Aaditya Ramdas, Peter Grünwald, Vladimir Vovk, and Glenn Shafer\. 2023\.Game\-theoretic statistics and safe anytime\-valid inference\.*Statistical Science*, 38\(4\):576–601\.
- Rasmussen \(1997\)Jens Rasmussen\. 1997\.Risk management in a dynamic society: A modelling problem\.*Safety Science*, 27\(2–3\):183–213\.
- Reason \(1997\)James Reason\. 1997\.*Managing the Risks of Organizational Accidents*\.Ashgate\.
- Rubin \(1981\)Donald B\. Rubin\. 1981\.The Bayesian bootstrap\.*The Annals of Statistics*, 9\(1\):130–134\.
- Sclar et al\. \(2024\)Melanie Sclar, Yejin Choi, Yulia Tsvetkov, and Alane Suhr\. 2024\.Quantifying language models’ sensitivity to spurious features in prompt design or: How I learned to start worrying about prompt formatting\.In*International Conference on Learning Representations*\.
- Shang et al\. \(2026\)Linfang Shang, Ming Xu, Yiding Sun, Tianle Xia, Lingxiang Hu, Lan Xu, and Ning Zheng\. 2026\.When self\-evolution backfires: Pre\-commit gating against skill contamination in LLM agents\.*arXiv preprint arXiv:2608\.05810*\.
- Shao et al\. \(2026\)Shuai Shao, Qihan Ren, Dongrui Liu, Chen Qian, Boyi Wei, Dadi Guo, Jingyi Yang, Xinhao Song, Linfeng Zhang, Weinan Zhang, and Jing Shao\. 2026\.Your agent may misevolve: Emergent risks in self\-evolving LLM agents\.In*International Conference on Learning Representations*\.
- Shawn \(2026\)Zayx Shawn\. 2026\.PACE: Anytime\-valid acceptance tests for self\-evolving agents\.*arXiv preprint arXiv:2606\.08106*\.
- Skalse et al\. \(2022\)Joar Skalse, Nikolaus H\. R\. Howe, Dmitrii Krasheninnikov, and David Krueger\. 2022\.Defining and characterizing reward hacking\.In*Advances in Neural Information Processing Systems*\.
- So et al\. \(2026\)Hau\-Sing So, Daixian Liu, Carl Hou, Yuhaohang He, Mengzhu Wang, and Hai\-Tao Zheng\. 2026\.Whose credential is it? how owner attribution in agent memory shapes cross\-user account misuse\.*arXiv preprint arXiv:2610\.25707*\.
- Trivedi et al\. \(2024\)Harsh Trivedi, Tushar Khot, Mareike Hartmann, Ruskin Manku, Vinty Dong, Edward Li, Shashank Gupta, Ashish Sabharwal, and Niranjan Balasubramanian\. 2024\.AppWorld: A controllable world of apps and people for benchmarking interactive coding agents\.In*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*\.
- van Miltenburg et al\. \(2021\)Emiel van Miltenburg, Chris van der Lee, and Emiel Krahmer\. 2021\.Preregistering NLP research\.In*Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies*\.
- Vaughan \(1996\)Diane Vaughan\. 1996\.*The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA*\.University of Chicago Press\.
- Vesely et al\. \(1981\)W\. E\. Vesely, F\. F\. Goldberg, N\. H\. Roberts, and D\. F\. Haasl\. 1981\.Fault tree handbook\.Technical Report NUREG\-0492, U\.S\. Nuclear Regulatory Commission\.
- Wang et al\. \(2025\)Charles L\. Wang, Keir Dorchen, and Peter Jin\. 2025\.On the statistical limits of self\-improving agents\.*arXiv preprint arXiv:2510\.04399*\.
- Wang et al\. \(2026\)Yihao Wang, Linhan Xia, Rui Liu, Zhaofeng Zhang, Hongyu Wu, Yang Yang, Jinglu He, Yu Guo, and Kai Lei\. 2026\.SAGE: A statistical acceptance gate for self\-evolving agents\.*arXiv preprint arXiv:2609\.36043*\.
- Xia et al\. \(2026\)Peng Xia, Rujun Han, Zifeng Wang, Yanfei Chen, Yufan Zhuang, Yoonho Lee, Chengsong Huang, Han Yu, Zhongying CuiZhu, Yifei Ming, Huaxiu Yao, Burak Gokturk, Tomas Pfister, and Chen\-Yu Lee\. 2026\.RRSI: Regularized recursive self\-improvement of agent harnesses\.*arXiv preprint arXiv:2609\.24972*\.
- Yan et al\. \(2026\)Bingyu Yan, Xiaoming Zhang, Chaozhuo Li, Ziyi Zhou, Yirui Qi, and Litian Zhang\. 2026\.Benign alone, harmful together: Exploiting experience composition in self\-evolving LLM agents\.*arXiv preprint arXiv:2608\.01759*\.
- Yang et al\. \(2024\)Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V\. Le, Denny Zhou, and Xinyun Chen\. 2024\.Large language models as optimizers\.In*International Conference on Learning Representations*\.
- Yao et al\. \(2024\)Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan\. 2024\.τ\\tau\-bench: A benchmark for tool\-agent\-user interaction in real\-world domains\.*arXiv preprint arXiv:2406\.12045*\.
- Yao et al\. \(2023\)Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao\. 2023\.ReAct: Synergizing reasoning and acting in language models\.In*International Conference on Learning Representations*\.
- Yin et al\. \(2025\)Xunjian Yin, Xinyi Wang, Liangming Pan, Li Lin, Xiaojun Wan, and William Yang Wang\. 2025\.Gödel agent: A self\-referential agent framework for recursive self\-improvement\.In*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics*\.
- Yoo and Harman \(2012\)Shin Yoo and Mark Harman\. 2012\.Regression testing minimization, selection and prioritization: A survey\.*Software Testing, Verification and Reliability*, 22\(2\):67–120\.
- Zelikman et al\. \(2024\)Eric Zelikman, Eliana Lorch, Lester Mackey, and Adam Tauman Kalai\. 2024\.Self\-taught optimizer \(STOP\): Recursively self\-improving code generation\.In*Conference on Language Modeling*\.
- Zhang et al\. \(2026a\)Hangfan Zhang, Shao Zhang, Kangcong Li, Chen Zhang, Yang Chen, Yiqun Zhang, Lei Bai, and Shuyue Hu\. 2026a\.Self\-harness: Harnesses that improve themselves\.*arXiv preprint arXiv:2606\.09498*\.
- Zhang et al\. \(2025\)Jenny Zhang, Shengran Hu, Cong Lu, Robert Lange, and Jeff Clune\. 2025\.Darwin Gödel machine: Open\-ended evolution of self\-improving agents\.*arXiv preprint arXiv:2505\.22954*\.
- Zhang et al\. \(2026b\)Qizheng Zhang, Changran Hu, Shubhangi Upasani, Boyuan Ma, Fenglu Hong, Vamsidhar Kamanuru, Jay Rainton, Chen Wu, Mengmeng Ji, Hanchen Li, Urmish Thakker, James Zou, and Kunle Olukotun\. 2026b\.Agentic context engineering: Evolving contexts for self\-improving language models\.In*International Conference on Learning Representations*\.
- Zhang et al\. \(2026c\)Zhixiang Zhang, Zesen Liu, Wai Ip Lai, Hongxu Chen, and Dongdong She\. 2026c\.Compositional safety failures in harness evolution: Identification and runtime monitoring\.*arXiv preprint arXiv:2609\.33123*\.

## Appendix AEnvironments and Safeguards

Table[4](https://arxiv.org/html/2610.38392#A1.T4)gives each layer’s function; exact texts, task identifiers and splits are in the released material\.

Table 4:Safeguard layers and their function\.#### AppWorld\.

AppWorld v0\.2\.0\.dev with a ReAct\-style loop: the agent writes Python against the app APIs under AppWorld’s own instructions, with at most 15 steps and 4096 output tokens per step\. The notes list credentials for the target app and two others; in the harm pool the target app’s entry belongs to another supervisor and was validated by logging in\. Harm is either of two deterministic events\([So et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib42)\):B, a non\-login API call made with a foreign access token, orS, a net state change in the other supervisor’s account\. Two audit slices are skipped because the installed AppWorld lacks their tables; no run called those APIs, so the skip removes no harm event\.

#### OpsSim\.

160 tickets \(30/30/20 per pool and split\)\. In half of the harm tickets the notes suggest a wildcard that also matches another service’s live entry; in the other half they suggestadmin=true, under which a wildcard also removes a lock held by a running process\. A run succeeds if every requested entry is deleted and harms if a protected entry is\. The workspace is a dictionary and the interpreter accepts only six structured calls; a static check forbids file, process and network access\. With DeepSeek every state solves all clean Tcaltasks at 4, 6 and 15 steps, so the layers cost success only at three\.

#### τ2\\tau^\{2\}\-bench\.

Retail domain, with DeepSeek as agent and user at temperature 0\. We remove the policy sentences on identity verification and on confirmation before writes; a rule\-based audit flags a user\-specific read before authentication or a write without explicit consent\.

#### Harms Strong Models Already Avoid\.

A written safeguard can erode with consequence only if the model does not already follow it\. Inτ2\\tau^\{2\}\-bench retail\([Yao et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib52);[Barres et al\., 2025](https://arxiv.org/html/2610.38392#bib.bib4)\), deleting the policy sentences on authentication and on confirmation before writes, in all four combinations, changed DeepSeek’s reward and violation rate by at most 0\.05: without the confirmation sentence the agent still asked before all 136 writes, and the tool interface enforces authentication; Luna and Sol behaved the same\. In AgentDojo\([Debenedetti et al\., 2024](https://arxiv.org/html/2610.38392#bib.bib9)\)\(v0\.1\.35, suites v1\.2\.2\), four attacks succeeded in 6 of 240 runs without any safeguard, and in a privacy simulation with synthetic canary records the agent checked permissions and redacted unprompted, leaking in none of 72 runs\. Such rules are masked by the model itself: deleting them is invisible to every gate until a model with other defaults is used\.

## Appendix BGates, Simulator and Statistics

#### Gates\.

Letyi,yi′∈\{0,1\}y\_\{i\},y\_\{i\}^\{\\prime\}\\in\\\{0,1\\\}be parent and child success on taskiiof a batch ofnn= 40, andn01n\_\{01\}\(n10n\_\{10\}\) the tasks that only the child \(parent\) solves\.*Greedy*accepts iff∑iyi′\>∑iyi\\sum\_\{i\}y\_\{i\}^\{\\prime\}\>\\sum\_\{i\}y\_\{i\}; withD=∑i\(yi′−yi\)D=\\sum\_\{i\}\(y\_\{i\}^\{\\prime\}\-y\_\{i\}\), a continuity correction givesP⁡\(D≥1\)≈Φ⁡\(z−1/\(2​σ​n\)\)P\(D\\geq 1\)\\approx\\Phi\(z\-1/\(2\\sigma\\sqrt\{n\}\)\), the tie\-aware form of Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4)\.*Split\-half*, a single\-evaluation variant of the Self\-Harness rule\([Zhang et al\., 2026a](https://arxiv.org/html/2610.38392#bib.bib57)\), accepts iff the changes on the two halves satisfyΔa,Δb≥0\\Delta\_\{a\},\\Delta\_\{b\}\\geq 0andmax⁡\(Δa,Δb\)\>0\\max\(\\Delta\_\{a\},\\Delta\_\{b\}\)\>0; Self\-Harness re\-evaluates stochastic runs, so our results concern this variant only\.*Paired*accepts iff the exact one\-sided McNemar test rejects:

∑k≥n01\(ndk\)​2−nd≤α,nd=n01\+n10\.\\textstyle\\sum\_\{k\\geq n\_\{01\}\}\\binom\{n\_\{d\}\}\{k\}2^\{\-n\_\{d\}\}\\leq\\alpha,\\quad n\_\{d\}=n\_\{01\}\+n\_\{10\}\.\(5\)*Veto*\(ρ\)\(\\rho\)applies the greedy rule and rejects if any audited harm\-pool pair \(a shareρ\\rhoof them\) shows child\-only harm;*asymmetric*sends candidates labelled as weakening a safeguard to the paired test and the rest to the greedy rule\. The registered swap tests compare*greedy\-type*gates \(greedy, split\-half and veto 0\.2\) with paired;*non\-paired*gates, as in the main text, are greedy, split\-half, veto \(ρ\\rho= 0\.2\) and veto \(ρ\\rho= 1\)\. Each generation draws tasks without replacement from the 60 per pool in Tcal∪\\cupTconfand runs parent and child with a new shared seed; tasks recur across generations, runs do not\. Batches of 120 cannot be drawn this way\. They draw with replacement, as the simulator does at everynn, and run each drawn task through a per\-task cache; a 120\-task batch holds about 50 distinct clean tasks \(49\.6 and 50\.8 on average at the two costs\), and the McNemar test counts repeated pairs separately\. These loops therefore test a larger*decision*batch on a fixed task pool, which is also how the cost is defined: in four\-step OpsSim the owner’s silence is fixed per task \(2, 5, 9 and 19 of the 60 clean tasks at the four costs\), and in calibration the full stack failed as many clean tasks as were silent while its child withoutconfirmfailed none\. At zero cost there are no discordant pairs, and no batch size makes the paired gate accept\. The batch\-size claim does not rest on these loops alone: the 20\-task loops, drawn without replacement, kept every harness protected where 40\-task loops lost all six\. In AppWorld, whose runs are not deterministic, thenn= 120 projections resample a pool whose gains did not transfer to Tfinal: they describe a gate fitting its own task pool\. A batch holds Binomial\(n,p\)\(n,p\)harm\-pool tasks, 3\.98 on average over the 204 AppWorld stress batches\.

#### Archived Batch Replay\.

An independent replay of the twonn= 120 arms \(qq= \.05 and \.10\) rebuilt 95 of their 96 batches from the saved per\-task outcomes; one batch lacks one saved outcome\. All 95 paired\-gate decisions and all harm totals agree with the logs\. Eight rebuilt batches differ from the logged parent or child success totals by one or two outcomes\. Duplicate draws of a task were submitted concurrently to a cache without per\-key locking, so a repeated draw could be run twice while the cache kept one result; this plausibly explains the differences, though the archive cannot prove it\. Exact reuse of one outcome per repeated task is therefore not guaranteed, although no decision depended on it\. Counting each distinct task once, i\.e\., a decision batch of about 60 distinct tasks, would have turned 4 of the 10 accepting decisions into rejections \(three atqq= \.05, one atqq= \.10\), as Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4)predicts for a smaller batch; this is a sensitivity check on the logged decisions, not a new trajectory\. Three of the four reversals fall in the arm behind the main text’s lowest break cost \(0\.03\), so that number holds only for this repeated\-draw gate; the 20\-task loops, drawn without replacement, carry the batch\-size claim\. The released runner deduplicates jobs before submission \(verified by four offline tests\); all reported runs predate this fix\.

#### Null Acceptance\.

For identical harnesses with tie probabilityπ\\pion the batch andπ′\\pi^\{\\prime\}on a half, greedy accepts with probability\(1−π\)/2<1/2\(1\-\\pi\)/2<1/2and split\-half with\(1\+2​π′−3​π′2\)/4≤1/3\(1\+2\\pi^\{\\prime\}\-3\\pi^\{\\prime 2\}\)/4\\leq 1/3\. On replicate pairs, no\-op edits were accepted at 0\.400 \(greedy\), 0\.323 \(split\-half\) and 0\.013 \(paired\) averaged over the 16 parent states, and at 0\.358, 0\.320 and 0\.006 weighted by the parents of the masked deletions, the rates used in Section[4\.3](https://arxiv.org/html/2610.38392#S4.SS3)and Table[7](https://arxiv.org/html/2610.38392#A3.T7)\. Detection grows with the harm share: atpp= 0\.5 a full audit sees a deletion withh01h\_\{01\}= 0\.016 in about 28% of decisions\.

#### Other Gates\.

The single\-edit study also tested an anytime\-valid betting test\([Ramdas et al\., 2023](https://arxiv.org/html/2610.38392#bib.bib33)\), cost\-aware greedy and paired gates, and an intersection\-union audit gate\. On Tconfthey accepted single\-safeguard deletions at rates of at most 0\.004, 0\.16–0\.56, 0\.03–0\.12 and 0\.000\. The intersection\-union gate was later run in loops; the others are projected over loops in Appendix[F](https://arxiv.org/html/2610.38392#A6)\.

#### Simulator and Baselines\.

For each edit the simulator draws Dirichlet weights over calibration tasks, samples 10,000 batches of joint parent/child outcomes and applies the exact gate code; loop predictions chain these rates over the lattice with one uniformly chosen deletion per generation\. In AppWorld it beats the frozen baselines on single decisions but not the constant baselines added after confirmation, and beats all of them on trajectories \(Table[5](https://arxiv.org/html/2610.38392#A2.T5)\); in three\-step OpsSim it beats N0 on single decisions \(Brier gain CI \[0\.042, 0\.107\]\), as expected when edits have real effects\.

#### Tests\.

Rates carry Wilson intervals\. Upper bounds on pooledh01h\_\{01\}come from a task bootstrap\. For zero events, we report the independent\-Bernoulli reference bound1−0\.051/k1\-0\.05^\{1/k\}\(0\.016 for the 189 in\-loop harm tasks, 0\.095 for the 30 of one edge\)\. The in\-loop sample conditions on acceptance, including veto decisions that require no detected child\-only harm; its reference bound is not an unconditional confidence bound on masked\-deletion risk\. The 189 in\-loop harm\-task instances contain only 58 distinct task IDs\. Restricted to the gates that never read harm \(greedy, split\-half, paired\), as in Section[4\.3](https://arxiv.org/html/2610.38392#S4.SS3), 32 accepted deletions into protected children held 114 harm\-pool tasks \(48 distinct\) and no child\-only harm event \(reference bound 0\.026\)\. Tasks recur across generations \(60 per pool\), so decisions within a loop are not independent; loops are the unit of every test, and decision\-level rates are descriptive\. Loop finals are classified with the lattice measured on the pool their batches come from; their harm on the unseen Tfinalgives the same order of gates \(Table[21](https://arxiv.org/html/2610.38392#A6.T21)\)\. Holm correction applies within the three registered families: the exposure and the acceptance contrasts of greedy and split\-half against paired, and the swap contrasts under the two Qwen models\. Other predictions are reported one by one, without correction across them\. With six loops per arm, Section[4\.3](https://arxiv.org/html/2610.38392#S4.SS3)reports exact loop\-level permutation tests\.

Table 5:Brier scores of acceptance predictions \(AppWorld, DeepSeek; lower is better\)\. Frozen: B0 \(accept iffg\>0g\>0\), B1 \(deployment utility\), B2 \(sign of a closed\-form signal\)\. Added after confirmation: N0 \(no edit has an effect\), N1 \(each gate’s mean rate\), N2 \(normal approximation\)\.

## Appendix CRobustness

#### Threshold and Classification\.

The greedy–paired contrast is unchanged for every thresholdτ≤0\.10\\tau\\leq 0\.10\(Table[6](https://arxiv.org/html/2610.38392#A3.T6)\)\. Under a task bootstrap every state keeps its class in at least 97% of draws except \{profile,caution\} \(pooled harm 0\.058; protected in 46%\), and H0’s margin never falls below 2\. Every final state of the AppWorld stress loops keeps its class in at least 97% of draws, so the loop outcomes do not hinge on this noise\. “Unprotected” refers to the classification: of the ten exposed greedy\-type loops, eight deleted the whole stack \(Tfinalharm 0\.475\) and two ended at \{caution\} \(pooled harm 0\.167, none in 40 Tfinalruns\)\.

Table 6:Threshold sensitivity \(AppWorld, DeepSeek, pooled harm\): protected states, H0’s margin, and loops that reach an unprotected state\.
#### Masked Deletions Are Not No\-Ops\.

Masked deletions were accepted more often than no\-op edits at the same parents \(Table[7](https://arxiv.org/html/2610.38392#A3.T7)\): they carry a small gain on the mixed batch, too small for the simulator to separate from noise\. Exposing deletions were accepted at 5/12 \(greedy\) and 1/18 \(vetoρ\\rho= 1\); the veto saw child\-only harm in 14 of those 18 batches and in 2 of 29 masked ones\.

Table 7:Acceptance of masked deletions and of a no\-op edit at the same parent states \(AppWorld, DeepSeek\), with the masked deletions’ mean batch gain\.
#### Batch Order\.

Harm\-pool tasks came first in every batch, so the halves seen by the split\-half gate were not exchangeable\. Re\-deciding its 43 decisions under 1,000 random splits gives acceptance 0\.428 against 0\.442 logged; a decision flips with probability 0\.11\. Batch order thus barely changes the split\-half gate\.

#### Gate\-Free Effect\.

We computez=gB​n/σz=g\_\{B\}\\sqrt\{n\}/\\sigmafor every edge of eight lattices from the calibration pairs, withgB=0\.9​g\+0\.1​ghg\_\{B\}=0\.9g\+0\.1g\_\{h\}andσ\\sigmathe standard deviation of the batch\-mixture paired difference; no gate or simulator enters\. In AppWorld \(DeepSeek\)\|z\|≤1\.09\|z\|\\leq 1\.09on all 32 edges\. In three\-step OpsSim 13–18 of 32 edges per model havez≥zαz\\geq z\_\{\\alpha\}\(DeepSeek: 17, against 16 in the registered simulator class\), and deletingconfirmfrom the full stack haszzbetween 4\.3 \(Qwen3\-8B\) and 11\.3 \(DeepSeek\); at four steps\|z\|<1\.4\|z\|<1\.4throughout\. Thezzclass agrees with the registered simulator class on 84–100% of each lattice’s edges\. Harm\-pool tasks supply 6–14% of the batch gaingBg\_\{B\}of three\-step selection edges: a child that finishes harm\-pool tickets also scores there, which the remaining layers keep safe for masked deletions\. Table[8](https://arxiv.org/html/2610.38392#A3.T8)gives acceptance byzzfor every gate \(the normal approximation overstates the top bin because the exact test is conservative atnn= 40\)\.

Table 8:Acceptance of every logged stress decision by the gate\-free effectzz\(decisions in parentheses\), pooled over AppWorld \(DeepSeek, Luna\) and OpsSim \(three steps, five models; four steps, DeepSeek\)\.
#### Significance Level and Run Variance\.

Table[9](https://arxiv.org/html/2610.38392#A3.T9)re\-decides every stress decision at three levels\. Replicates at temperature 0 still differ: the intra\-task correlation of harm is 0\.14–0\.46, and a single 30\-task run of \{verify\} lands at or belowτ\\tauin 77% of draws \(\{caution\}: 24%\), hence the pooled classification\. The full stack costs DeepSeek 0\.100 and 0\.117 of clean AppWorld success on Tcaland Tconf, and−0\.050\-0\.050on Tfinal\.

Table 9:The paired gate at three significance levels\. Beneficial edits are replayed atnn= 40 by task bootstrap; the greedy rule accepts them in \.96 and 1\.00 of the same bootstrap batches, and accepted masked deletions at \.63 in its own loops\.
#### Swap Harm by Margin\.

Mean swap harm falls with DeepSeek margin, but states with equal margin differ widely \(Table[10](https://arxiv.org/html/2610.38392#A3.T10)\)\.

Table 10:Mean swap harm on Tfinalof the distinct final states, by margin under DeepSeek\.

## Appendix DAudit Variants

The registered audit counts reads made with a foreign token, including theshow\_accountcheck thatprofileitself prescribes once the agent has logged in with that token\. We replayed without any LLM call the 188 harm\-pool runs whose call audit fired \(185 reproduced exactly\) and re\-scored them without that check call \(Bnv\{\}\_\{\\text\{nv\}\}\) and counting writes only \(Bw\{\}\_\{\\text\{w\}\}\)\. Only \{profile\} and \{profile,caution\} change class \(Tables[11](https://arxiv.org/html/2610.38392#A4.T11)and[12](https://arxiv.org/html/2610.38392#A4.T12)\), no stress loop ended in either, and loop outcomes and the order of gates are unchanged \(Table[13](https://arxiv.org/html/2610.38392#A4.T13)\); counting writes only roughly halves measured harm\.

Table 11:AppWorld harm under three audits \(DeepSeek, 30 harm tasks per split\)\. States withauthhave zero harm under every audit; only H0 is shown\.Table 12:Lattice structure under each audit: sufficient single layers, H0’s margin, and child\-only harm on Tconfof deletions into protected and unprotected children \(95% upper bound from a fresh bootstrap, hence \.027 against \.028 in the main text; edges\)\.Table 13:AppWorld loop outcomes and swap contrasts under the three audits\.
## Appendix ELattices and Loops

Table 14:All 27 AppWorld stress loops \(DeepSeek; A =auth, V =verify, P =profile, C =caution\)\. A loop ends early when no layer is left\. Margin uses the pooled classification; harm and clean success are measured on Tfinal\(40 runs each\)\.Table 15:OpsSim lattices and loops at three steps \(27 loops per model\)\. Full\-stack harm on Tconfwas \.000 for the four models with a sufficient layer, \.100 for Qwen3\-8B and \.700 for Haiku; with no layer it was \.27–\.93\.h01h\_\{01\}prot\.: deletions into children protected on Tcal, measured on Tconf; Qwen3\-8B’s Tcal\-protected states are not protected on Tconf\.∗Zero events: one\-sided 95% binomial reference bound for 30 independent tasks \(others: task bootstrap\); independence is an assumption of this bound\.Table[16](https://arxiv.org/html/2610.38392#A5.T16)counts the 411 loops by arm, Table[17](https://arxiv.org/html/2610.38392#A5.T17)gives the harm of every AppWorld state, Table[14](https://arxiv.org/html/2610.38392#A5.T14)the 27 AppWorld stress loops with DeepSeek, and Table[15](https://arxiv.org/html/2610.38392#A5.T15)the OpsSim lattices and loops of all six models\. Final evaluations are keyed by state and shared between loops that end in the same one\. Figure[3](https://arxiv.org/html/2610.38392#S4.F3)a classifies edges with pooled estimates \(20 masked, 8 exposing\); theh01h\_\{01\}test classifies children on Tcaland measures on Tconf\(22 deletions into protected children\)\.hhis not monotone in the subset \(e\.g\., \{verify\} \.008, \{verify,caution\} \.025 pooled\); margin takes the fewest deletions that reach any unprotected subset\. Six asymmetric\-gate stress loops, which send every planted deletion to the paired test, kept the full stack\.

Arm: model, gates \(loops per gate\)Loops*AppWorld stress*DeepSeek: greedy, split\-half, paired, veto 1 \(6\); veto \.2 \(3\)27Luna: greedy, paired \(6\)12Qwen3\-30B: greedy, paired \(6\)12DeepSeek: asymmetric \(6\); three evaluations \(3\); margin\-aware with two check models \(6 each\)21DeepSeek: audit veto with 120 runs \(6\)6OpsSim*stress*Five models, three steps: greedy, split\-half, paired, veto 1 \(6\); veto \.2 \(3\)135DeepSeek, four steps: greedy, paired \(6\)12DeepSeek, fresh seeds at three and four steps: greedy, paired \(6\)24DeepSeek, four steps, owner silent withq∈\{0,\.05,\.1,\.2,\.4\}q\\in\\\{0,\.05,\.1,\.2,\.4\\\}: greedy, paired \(6\)60DeepSeek, three steps: IUT, margin\-aware, read\-onlyconfirm\(6\)18DeepSeek, four steps, no redundancy: greedy, paired, veto 1, audit veto \(6\)24DeepSeek, four steps, paired withnn= 120 \(qq= \.05, \.1\) ornn= 20 \(qq= \.2\) \(6\)18DeepSeek, veto 1 withpp= \.3, \.5 \(no redundancy\) or \.5 \(three steps\) \(6\)18DeepSeek, three steps, six layers: greedy \(6; 12 generations\)6*AppWorld natural*DeepSeek: greedy, split\-half, asymmetric, margin\-aware \(3\); paired \(2\); read\-only \(4\)18Total411Table 16:Loops by arm\. The five OpsSim loop models are DeepSeek, Luna, Sol, Qwen3\-30B and Qwen3\-8B; loops run eight generations withnn= 40 andpp= 0\.1 unless noted\. The three GEPA runs \(Appendix[H](https://arxiv.org/html/2610.38392#A8)\) are not counted\.Table 17:AppWorld harm of every lattice state \(30 harm tasks per split\)\.#### Luna\.

Under Luna,auth,verifyandcautioneach suffice alone; child\-only harm of single deletions is 0\.019 \(UB 0\.035\) into protected children and 0\.505 into unprotected ones\. On the random numbers of the DeepSeek loops, greedy loops ended unprotected in 4 of 6 and paired loops in none \(Table[18](https://arxiv.org/html/2610.38392#A5.T18)\)\. The frozen lattice predicted single decisions with Brier 0\.12, against 0\.64–0\.66 for B0–B2\.

Table 18:AppWorld stress loops with Luna\. Brackets: frozen 95% predictive intervals; parentheses: frozen prediction\.
#### Qwen3\-30B as Loop Model\.

With Qwen3\-30B as the agent, no single AppWorld layer suffices and deletingauthalone exposes H0; the model solves about 5% of clean tasks, so decisions rest on ties and harm\. On the random numbers of the DeepSeek loops, greedy loops ended unprotected in 5 of 6 \(Tfinalharm 0\.388, predicted 0\.152\) and paired loops in none \(0\.025\), accepting 18 of 45 and 0 of 48 proposed deletions\. The frozen lattice predicted single decisions with Brier 0\.127, against 0\.344 for the best baseline, and accepted deletions of protected layers showed no child\-only harm\.

#### Natural Proposals and Loops\.

Table[19](https://arxiv.org/html/2610.38392#A5.T19)gives judge\-flagged erosion rates per proposal channel\. Natural loops use the cost\-objective proposer, which flagged the most erosion; each generation tests two candidates and keeps the first one accepted, so their rates are not comparable to stress loops\. The paired gate accepted four edits in its two loops, none eroding, and its finals solved 0\.63 and 0\.73 of clean Tfinaltasks against 0\.40 for H0 \(Figure[7](https://arxiv.org/html/2610.38392#A5.F7)\)\. Counted relative to the parent, as the prediction model does, accepted erosions per loop were 1\.00 \(greedy\), 0\.67 \(split\-half\) and 0 \(paired\), inside their predictive intervals\.

Figure 7:Significance gates are slow, not frozen\.\(a\) Tfinalclean success of natural loops \(markers: loops; lines: means; dashed: H0\)\. \(b\) Paired\-gate acceptance of two beneficial natural edits by batch size, replayed on pooled Tfinaland Tconfpairs\.Table 19:Natural proposals \(DeepSeek, AppWorld\)\. P/V/C: eroding labels onprofile,verify,caution\(authwas never eroded\)\. Precision: manual audit of three flagged proposals per channel; recall was not audited\.

## Appendix FSelection and Remedies

#### Free and Costly Layers\.

At three steps the full stack solves 0\.00–0\.50 of clean OpsSim tasks for the five loop models and the empty stack all of them \(Table[15](https://arxiv.org/html/2610.38392#A5.T15)\); at four steps DeepSeek’s full stack solves every clean task and no edge is selection\. Over twelve loops per arm, six of them with fresh seeds, paired loops ended unprotected in 2 of 12 at four steps and 7 of 12 at three \(Fisherpp= \.045\), greedy loops in 5 and 11 of 12\. With free layers the paired gate protects most loops, not all: both exposed four\-step paired loops \(fresh seeds\) accepted deletingconfirmin a batch where the parent solved 16 and 25 of 40 tasks and the child 40 and 39, a cost that calibration had not shown, rather than a near\-tie\.

#### Cost Dose\-Response\.

At four steps,ask\_ownerstays silent with probabilityqq, fixed per task by a hash and nested acrossqq, so that onlyconfirmcosts success\. Every paired count lies inside its frozen interval \(Table[20](https://arxiv.org/html/2610.38392#A6.T20)\)\. Pooled, paired loops ended unprotected in 0 of 12 atq≤\.05q\\leq\.05and 10 of 12 atq≥\.2q\\geq\.2\(Fisherp<\.001p<\.001\)\. The break at 8–15 points of cost lies nearzαz\_\{\\alpha\}atnn= 40:q≈\.08q\\approx\.08by Eq\.[4](https://arxiv.org/html/2610.38392#S3.E4),q≈\.14q\\approx\.14by the exact test\.

Table 20:Cost dose\-response \(OpsSim, four steps, DeepSeek\)\. Cost: clean success lost by the full stack\. PI: frozen 95% predictive interval\. Right: paired acceptance of deletingconfirmas the last protecting layer\.
#### Remedies Under Selection\.

In three\-step OpsSim,*read\-only*confirmresets that rule to the parent’s; the*IUT*gate adds to the paired test a Newcombe hybrid\-score one\-sided 95% upper bound of at most 0\.10 on child\-minus\-parent harm, computed over all 40 pairs of the batch \(OpsSim audits every task; clean tasks rarely harm\); the*margin\-aware*gate is the AppWorld rule below with a 30\-task suite\. Read\-onlyconfirmand margin\-aware kept every loop protected, IUT four of six, as a 0\.10 margin over 40 pairs, about four of them from the harm pool, is loose \(Table[21](https://arxiv.org/html/2610.38392#A6.T21)\): on the mixed batch it allows a child\-minus\-parent harm of up to about0\.10/p0\.10/p, i\.e\. almost any increase on the harm pool atpp= 0\.1, so this IUT is a weak baseline, and the veto and audit veto are the stricter harm\-aware gates\. In the AppWorld single\-edit study, where the bound used only the audited share of harm\-pool pairs, the same gate accepted nothing\. Against the greedy finals, margin\-aware lost 0\.35 of clean success \(CI \[0\.28, 0\.49\]\), read\-onlyconfirm0\.05 and IUT 0\.02\. Freezing the sufficient layer requires knowing which layer that is\.

Table 21:Remedies\(DeepSeek loops\)\.†Lost has a different meaning in each block, given in its header\. Clean success and harm of the finals on Tfinalunder DeepSeek \(DS\) and Qwen3\-30B \(–: not measured\)\. Qwen\-checked: suite run under Qwen3\-30B\. H0 solves \.400 in AppWorld, the full stack \.27 in OpsSim\.
#### Without Redundancy\.

In a four\-step OpsSim variant each of four trap kinds has exactly one blocking layer: full\-stack harm is 0\.000, empty\-stack harm 0\.83, and every single deletion exposes harm \(0\.08–0\.34\)\. Greedy loops still ended unprotected in 6 of 6 and veto \(ρ\\rho= 1\) loops in 5 of 6, after six accepted deletions none of which showed child\-only harm in its batch; paired accepted none of 48\. A deletion harms only on its own trap kind, which a batch of about four harm\-pool tasks rarely holds: masking guarantees small increments, but narrow layers produce them too\. The audit veto of 120 harm runs per state \(six loops on the same random numbers\) saw every such deletion: it rejected all 23 deletions that greedy accepted, kept the full stack in every loop \(0 of 6 unprotected; clean success 1\.00, Tfinalharm 0\) and spent 600 audit runs\. Without redundancy, a large enough audit loses nothing; with redundancy \(AppWorld, Table[3](https://arxiv.org/html/2610.38392#S4.T3)\), the same gate prevented exposure but lost depth\. This is close to a design check, since in a world without redundancy keeping the full stack is the only correct answer\.

#### Audit of Equal Compute\.

The audit veto runs each greedy\-accepted child twice on 60 fixed harm tasks and rejects on harm aboveτ\\tauor any child\-only harm, at 120 runs per distinct state visited \(eleven distinct children were audited\), the same order as the margin\-aware gate’s 1,228 suite runs over six loops\. On greedy loops 1–6 no loop ended unprotected, but five finals had margin 1 and one margin 2 \(mean 1\.17\), with clean success 0\.44 and Qwen3\-30B harm 0\.21 \(margin\-aware: 1\.33, 0\.37, 0\.04\)\. On the shared random numbers the margin\-aware gate kept more layers in all six matched loops \(one\-sided sign testpp= \.016\), while their margins differed in one\. Leave\-one\-out checks are not needed to avoid exposure under the loop’s model; they buy depth against a swap\.

#### Margin\-Aware Gate\.

The gate applies the greedy rule and, for an edit that changes safety text, requires every leave\-one\-out ablation of the child \(without the owner line or without one credential rule\) to have harm≤\\leq0\.05 on 30 Tcalharm tasks; a child with at most one safety unit is rejected\. The check is a proof test of redundant channels in the sense of functional safety\([International Electrotechnical Commission, 2010](https://arxiv.org/html/2610.38392#bib.bib19)\)\. Suite runs use a fixed replicate, cached per state and model in stress loops \(480 runs each\); natural loops pay 30 runs per safety unit and check\. Checked exactly, the rule keeps margin 2 under whole\-layer deletions from a parent with margin≥\\geq2, since the child is then a protected ablation of the parent; becausehhneed not be monotone, a free\-form child needs its own check as well, which this gate does not run; four finals have margin 1 because 30\-run estimates nearτ\\tauare noisy \(a check passes true harm 0\.10 with probability 0\.18\), and 4 of 22 decisions were false accepts against the pooled classification\. On shared random numbers, five greedy loops ended unprotected and their margin\-aware twins did not, with no pair the other way \(sign test, one\-sidedpp= \.031; Table[22](https://arxiv.org/html/2610.38392#A6.T22)\)\. In natural loops it rejected 1 of 17 greedy\-passing candidates; all finals keptauthandcaution\.

Table 22:Margin\-aware stress loops \(DeepSeek ablations\): final state and margin, deletions passing the greedy rule and accepted, and the generation at which the loop left the greedy trajectory\. With Qwen3\-30B ablations the gate accepted no deletion\.
#### Edge\-Level Acceptance\.

Across the 135 three\-step OpsSim loops, the paired gate accepted deletingconfirmin 6 of 6 proposals for DeepSeek, 3 of 8 for Luna, 6 of 6 for Sol and 3 of 9 for Qwen3\-30B, with mean batch gains of 0\.51–0\.85\. For the first three modelsconfirmis the only layer that suffices alone; in all three accepted Qwen3\-30B deletionsdryrunremained, and those finals harmed in at most 0\.050 of Tfinalruns\.

#### Batch Size and Harm Share\.

We swept the frozen simulator overnnandppand froze its predictions for six loop settings before any ran \(Table[23](https://arxiv.org/html/2610.38392#A6.T23)\); all seven predictions held\. Withnn= 120 the paired gate lost protection at costs of 0\.03 and 0\.08, where 40\-task loops had kept it; withnn= 20 it kept protection at 0\.15, where 40\-task loops had lost it\. The simulated break costc∗c^\{\\ast\}falls faster than1/n1/\\sqrt\{n\}up tonn= 120, where the exact test needs a minimum number of discordant pairs, and as1/n1/\\sqrt\{n\}from there \(c∗​nc^\{\\ast\}\\sqrt\{n\}= 0\.32 at 120 and 200; Table[24](https://arxiv.org/html/2610.38392#A6.T24)\)\. The law assumes a fixedσ\\sigma\. The veto improves with the harm data a batch holds: without redundancy its unprotected loops fell from 5 of 6 atpp= 0\.1 to 2 and 1 of 6 at 0\.3 and 0\.5, and in the simulator its AppWorld risk at generation 8 falls from 0\.42 atpp= 0\.05 to 0\.03 at 0\.5\. Masked deletions stay invisible: atpp= 0\.5 in three\-step OpsSim the veto accepted 17 of 17 of them, none with child\-only harm in its batch\.

Table 23:Loops at other batch sizes and harm shares \(OpsSim, DeepSeek\): unprotected loops, frozen simulator expectation with 95% predictive interval, and accepted deletions\. Atnn= 40,pp= 0\.1 the same settings gave 0/6, 1/6 and 6/6 \(paired\) and 5/6 \(veto, no redundancy\)\.Table 24:Frozen simulator by batch size \(pp= 0\.1\)\.c∗c^\{\\ast\}: clean success lost byconfirm\(four steps\) at the smallestqqwhose probability of an unprotected state at generation 8 reaches 0\.5\. Lower rows: probability of an unprotected state\.
#### Harm Penalties\.

Re\-deciding every recorded stress decision with the scoreΔ\\Deltasuccess−λ​Δ\-\\,\\lambda\\,\\Deltaharm \(Table[25](https://arxiv.org/html/2610.38392#A6.T25)\) shows that a penalty is the audit in another form: fromλ\\lambda= 5 on, it accepts exposing deletions about as rarely as the veto and masked ones as often as greedy, since it can only react to harm the batch contains\.

Table 25:Acceptance of recorded stress deletions re\-decided with a harm penalty \(masked and exposing decisions; AppWorld: DeepSeek, 184; OpsSim: five models, 338\)\.Table 26:Projected AppWorld stress loops \(DeepSeek\), chaining the frozen per\-edge predictions; the lower block adds gates analytically\. Margin, Qwen3\-30B lattice harm and pooled clean success of the final state are expectations\. Observed at generation 8: greedy 5/6 and paired 0/6 unprotected; margin\-aware 0/6, mean margin 1\.33\.
#### Time\-Uniform Error Control\.

A fixed\-α\\alphapaired gate gets a new chance of a false accept every generation\. Over the frozen simulator, an anytime\-valid betting test andα\\alpha\-spending across generations remove most of this risk in AppWorld but also most small real gains, and help little in OpsSim, where the deletion is a real gain \(Table[27](https://arxiv.org/html/2610.38392#A6.T27)\)\.

Table 27:Probability of an unprotected state by generation \(simulated,nn= 40,pp= 0\.1\) \(OpsSim: three steps\) and acceptance of two beneficial natural edits \(\+0\.075, \+0\.275\)\. Paired:α\\alpha= \.05\.∗At generation 64 \(0\.85 at the first\)\.
#### Longer Horizons\.

Table[26](https://arxiv.org/html/2610.38392#A6.T26)chains the frozen per\-edge acceptance probabilities over the AppWorld lattice \(reproducing the frozen generation\-8 predictions to 0\.003\) and adds unregistered gates analytically: under independent audit draws, a veto auditingkkextra pairs passes its harm check with probability\(1−h01\)k\(1\-h\_\{01\}\)^\{k\}, and the margin\-aware rule passes a child if each ablation shows at most one harm event in one 30\-task run\. These projections assume a fixed task pool and stationary per\-edge acceptance\. Tables[9](https://arxiv.org/html/2610.38392#A3.T9),[24](https://arxiv.org/html/2610.38392#A6.T24)and[27](https://arxiv.org/html/2610.38392#A6.T27)come from separate Monte Carlo runs of the simulator \(3,000 and 1,500 chains\), whose absolute risks differ from this exact chain by a few points; comparisons within one table share a run\. The last block comes from a separate chain over the same lattice: a*semantic floor*, which requires the child itself to stay protected, never exposes the harness but settles at margin 1, and a margin\-aware gate whose ablations are checked under Qwen3\-8B with a relative standard \(harm at most H0’s under that model plus 0\.10\) accepts no deletion\. In the four\-step OpsSim projection the paired gate stays below 0\.001 for 200 generations, since deletingconfirmthere gains nothing\.

## Appendix GNatural Erosion

#### Accepted Edits Pay\.

We re\-ran all 42 safety\-text edits that the natural and asymmetric loops had tested, each against its parent, on the 20 clean Tfinaltasks with two runs\. The ten accepted ones \(Table[28](https://arxiv.org/html/2610.38392#A7.T28)\) gained 0\.095 on the gate batch and 0\.075 on fresh tasks \(CI \[0\.007, 0\.163\]\), the 32 rejected ones−0\.006\-0\.006and 0\.010\. A pairwise judge, checked by hand on all accepted edits, marked 7 of the 10 accepted and 22 of the 32 rejected edits as relaxing a check; five of the seven accepted relaxations makeprofile’s post\-login check conditional or drop it\. Among accepted edits, relaxing ones gained 0\.082 on fresh tasks and the others 0\.058\.

Table 28:The ten accepted edits to safety text in the natural loops \(AppWorld, DeepSeek\): whether the edit relaxes a check \(judge, confirmed by hand\), gain on the gate batch and on fresh Tfinalclean tasks\.
#### Rewritten Layers Lose Function\.

Figure[8](https://arxiv.org/html/2610.38392#A7.F8)shows one rewrite\. Run as the only layer on the Tconfharm pool, the eroded layers of the natural finals, extracted with a prompt frozen before any run, let through 0\.325 more harm than the original single layers \(pooled overprofileandverify, CI \[0\.215, 0\.438\]\); counting only probes that hold an extracted rule, 0\.194 \(\[0\.078, 0\.306\]; Table[29](https://arxiv.org/html/2610.38392#A7.T29)\)\. Under Qwen3\-30B the eroded natural finals harmed in 0\.057 of Tfinalruns and H0 in none \(CI \[0\.018, 0\.111\]\); under Luna and Sol all had zero harm\.

H0,profile\(function\): after logging in, callshow\_accountand check that the account is the requester’s before any other call\.Rewrite\(harm \.63\): “After logging in, call show\_account to verify ownershiponly when you used a note whose owner is uncertainor not clearly you; credentials obtained from show\_account\_passwords\(\) are already yours, so skip that extra verification\.”

Figure 8:What natural erosion looks like\.Aprofilerewording by the cost\-objective proposer \(verbatim\)\. Kept as the only layer, it misused credentials in \.63 of 30 Tcalharm runs, against \.38 for the original: the check now runs only when the agent already suspects the credential\.Table 29:Single\-layer probes of eroded layers \(Tconfharm pool, two runs, DeepSeek; primary audit, which inflates the originalprofile\)\.∗No rule could be extracted, so the probe equals the empty stack\.
#### Read\-Only Safety Text\.

Before evaluation the credential rules and the notes’ owner line are reset to the parent’s, and a candidate that then equals its parent is discarded\. The proposer wrote 16 candidates that changed only safety text and 5 that changed it with other text; the latter gained−0\.6\-0\.6of 40 tasks after the reset, against\+0\.4\+0\.4for the rest\. Of the 2–5 lines each read\-only final added outside the frozen text, a keyword rule flagged none and a judge one: a task tip telling the agent not to “spend a step on \[…\] extra profile/account checks unless a concrete parameter/name error occurs”, which discouragesprofile’s check\. Under Qwen3\-30B the four finals harmed in 0\.025, 0, 0\.025 and 0\.025 of runs against 0 for H0\. Locking every instruction about credentials, accounts or identity would close this gap better than locking a section\.

#### Judge Veto\.

Rejecting any candidate that the judge labels as newly weakening or removing a safeguard relative to its parent \(replayed\) would have blocked all 7 accepted relaxing edits of Table[28](https://arxiv.org/html/2610.38392#A7.T28)and 27 of the 29 relaxing edits among the 42, and passed the 3 accepted edits that do not relax a check\. In the cost, asymmetric and margin\-aware natural arms it flags 18 of 112, 9 of 44 and 6 of 35 tested candidates, among them 5 of 33, 2 of 11 and 4 of 16 accepted ones\. It depends on a labeller that knows the four mechanisms\. The veto uses the per\-safeguard labels of judge v2; the relaxing class comes from a separate pairwise DeepSeek judge, read by hand only for the ten accepted edits, all seven relaxing verdicts confirmed\. On GEPA’s 45 rewrites of the credential rules \(Appendix[H](https://arxiv.org/html/2610.38392#A8)\), judge v2 flagged 17, of which reading confirms 2 as relaxations, and it passed the template change behind the Qwen3\-30B harm: there a judge veto would have blocked mostly stricter rules and missed the change that mattered\.

#### Natural Erosion Rates\.

With the cost proposer, 14% of candidates eroded a layer still intact in their parent and 7\.8% of generations accepted one\. Erosion ofauthorverify, which suffice alone, was accepted in 3\.1% of generations\. Asymmetric and read\-only loops accepted none in 24 and 32 generations, margin\-aware loops three in 24\.

## Appendix HAn Off\-the\-Shelf Optimizer \(GEPA\)

#### Setup\.

We ran GEPA 0\.1\.4\([Agrawal et al\., 2026](https://arxiv.org/html/2610.38392#bib.bib2)\)without modifying the library: Pareto candidate selection, a round\-robin module selector, strict\-improvement acceptance on reflection minibatches of four tasks, and 800 metric calls per seed \(seeds 0–2\)\. The harness is split into four plain\-text components, the note header, the note template \(one line per credential\), the credential rules and task tips \(empty in H0\); the seed candidate reproduces H0 exactly\. The score is task success alone, with no cost, length or efficiency hint; audit harm is recorded but never shown to the optimizer\. Each seed shuffles Tcal∪\\cupTconfwith its own random seed and takes 40 training tasks \(36 clean, 4 harm\) and the next 27 as validation tasks \(24 clean, 3 harm\), disjoint from training\. Validation sets therefore differ across seeds \(9–10 of 27 tasks shared\), which together with run variation explains why H0 scored 0\.444, 0\.148 and 0\.333 on them; on shared tasks H0’s outcomes agreed in 24 of 28 cases\. DeepSeek proposes at temperature 0\.7\. Only the adapter is ours: it shows the reflection model the component’s current text as the instruction and the task only as example input, and it retries a proposal up to three times when the reply has no code block or restates the task\. Nothing checks safety content\. A frozen smoke test passed on the first attempt \(29 of 30 valid proposals\)\.

Table 30:GEPA runs \(AppWorld, success\-only score\)\. Judge flags are judge\-v2 labels of a weakened or removedprofileorverifyrelative to H0\. Validation success is the mean over the seed’s 27 validation tasks, harm\-pool tasks included\. H0 solves \.400 of clean Tfinaltasks and harms in 0 of 80 Qwen3\-30B runs\.
#### What GEPA Changed\.

Proposals cycled evenly over the four components \(44, 49, 45 and 43\)\. The judge flagged 17 rule rewrites, 13 forverifyand 4 forprofile\. Read by us, the 13verifyflags replace “use a noted credential only if it matches mine” with a stricter rule, “use only the credentials that the supervisor returns”, which the judge scores as removing the original mechanism; all three flagged rewrites that GEPA kept are of this kind\. Of the fourprofileflags, two genuinely relax the post\-login check \(“that account is yours even if the app shows a different email”; “avoid extra verification calls after every login”\), one only caches a verification and one is a false flag; none was kept\. No final candidate changed the credential rules\. Reading thus confirms only 2 of the 17 flags as relaxations, and the judge marked every layer of both harmful finals intact\.

#### Where the Harm Came From\.

Seeds 1 and 2 rewrote the note template into an instruction to log in with the stored credentials\. Seed 1: “Stored login for \{app\} \(owner: \{owner\}\) … Use these credentials to log in to \{app\} and obtain an access token whenever the task involves \{owner\}’s \{app\} account\.” Seed 2: “Saved \{app\} login for \{owner\} … Use these exact credentials to authenticate to \{app\} as \{owner\} whenever needed”, with a header asking the agent to log in directly with saved credentials and 3,030 characters of tips that start with a limited step budget\. Both keep the owner’s name, so the judge marksauthintact, and the credential rules are verbatim\. Under DeepSeek the rules still hold; under Qwen3\-30B, harm rose to 2 and 5 of 40 runs against 0 of 80 for H0 Counted over runs, seed 2 differs from H0 \(one\-sided Fisherpp= \.003\), but its events fall on 3 of 20 tasks and seed 1’s on 2 \(one task in both\), so a sign test over tasks givespp= \.125 for seed 2; three seeds do not support a loop\-level test\. We did not ablate the components or run one\-layer ablations of the finals\. The template adds an instruction rather than removing one; it is masked in the sense that the loop’s model shows no harm, but it lies outside the labelled layers over which margin is defined\.

## Appendix IModel Swap

Figure[9](https://arxiv.org/html/2610.38392#A9.F9)and Table[33](https://arxiv.org/html/2610.38392#A9.T33)give the swap contrasts with three\-level bootstrap intervals \(tasks, final states, loops\), and Table[34](https://arxiv.org/html/2610.38392#A9.T34)the harm of each of the 11 distinct final states under all four models, a 4\-bit build of Qwen3\-8B, and a shifted task pool, including the full stack\. Each Qwen model’s own lattice, pooled over Tcaland Tconf, predicts per\-state swap harm on Tfinalwith MAE 0\.067 \(Qwen3\-30B\) and 0\.084 \(Qwen3\-8B; Figure[10](https://arxiv.org/html/2610.38392#A9.F10)\), against 0\.205–0\.215 and 0\.115–0\.128 for two constant baselines; Luna’s lattice predicts its swap with MAE 0\.020\.

#### Missing Layers, Not Random Trials\.

Qwen3\-30B solves about 5% of clean tasks, so one might suspect that it misuses credentials whenever it runs out of ideas, whatever the harness\. The run logs argue otherwise \(Table[31](https://arxiv.org/html/2610.38392#A9.T31)\)\. The model used up its 15\-step budget in 25 to 36 of 40 runs under every final, H0 included, but harm depended on which layers remained: finals that keptauthand at least one other layer misused credentials in 2 of 200 runs, \{auth\} alone in 9 of 40, and finals withoutauthin 89 of 200\. The contrast holds both in runs that exhausted the budget and in runs that ended earlier\.

Table 31:Credential misuse under Qwen3\-30B by the layers a final kept and by whether the run used up its 15\-step budget \(Tfinalharm pool, 40 runs per final; number of finals in parentheses\)\.
#### What Ranks Swap Harm?

Table[32](https://arxiv.org/html/2610.38392#A9.T32)ranks the 11 finals by measured Qwen3\-30B swap harm \. Margin under DeepSeek takes three values and ranks them worst; the expected harm after one random layer failure, a graded form of margin read from the same lattice, does better, and the finals’ pooled harm under DeepSeek, a graded quantity under the loop’s model that is belowτ\\taufor most finals, does about as well as the lattice of the weaker Qwen3\-8B\. With Qwen3\-8B as the target, margin, the Qwen3\-30B lattice and its own lattice give 0\.82, 0\.83 and 0\.92\.

Table 32:Spearman correlation of each quantity with measured Qwen3\-30B swap harm over the 11 distinct finals \(bootstrap over states; values: distinct values of the quantity\)\.
#### Task Shift and a Quantized Model\.

Without a model change, we built a pool of 20 harm tasks on three other apps \(Spotify, Phone, Simple Note\) with the same trap: H0 harmed in none of its runs and the empty stack in 0\.80\. Greedy\-type finals harmed in 0\.52 of runs against none for paired finals \(permutationpp= \.004\), mostly because eight of them had lost every layer; among finals still protected under DeepSeek the gap was 0\.020 \(pp= \.061\), through the finals that rely onverify\. Replacing Qwen3\-8B by its 4\-bit AWQ build kept the order of the finals’ harm \(rsr\_\{s\}= 0\.89 with the FP8 build\) and the greedy\-type gap \(\+0\.128 \[0\.083, 0\.173\]\) at a lower level \(greedy\-type 0\.24 against 0\.42\)\.

Figure 9:Lost layers after a model swap\.Tfinalharm of the finals of the 27 AppWorld stress loops under another model\. Upper markers: all finals, greedy\-type \(greedy, split\-half, veto 0\.2\) minus paired loops, the registered contrast\. Lower markers: finals still protected under DeepSeek, non\-paired \(greedy, split\-half, vetoρ\\rho= 0\.2 and vetoρ\\rho= 1\) minus paired loops, the contrast reported in Section[4\.5](https://arxiv.org/html/2610.38392#S4.SS5)\.Table 33:Swap contrasts on Tfinal\(95% three\-level bootstrap intervals\)\. Left: all finals, greedy\-type \(greedy, split\-half, veto 0\.2\) minus paired loops\. Right: finals protected under DeepSeek, non\-paired \(greedy, split\-half, vetoρ\\rho= 0\.2 and vetoρ\\rho= 1\) minus paired loops\.Swap to another model \(Tfinal\)Shifted poolStatemmLoopsQwen3\-30BQwen3\-8BQwen3\-8B, 4\-bitLunaSolDeepSeekAVPC \(H0\)24\.000\.175\.125\.000\.000\.000AVC21\.025\.175\.050\.000\.000\.000AV21\.025\.275\.125\.000\.000\.000APC11\.000\.225\.100\.000\.000\.000AC11\.000\.225\.075\.000\.000\.000A13\.225\.375\.200\.025\.075\.000VC11\.350\.425\.300\.000\.000\.025VP11\.250\.425\.425\.025\.025\.025V13\.575\.325\.200\.050\.000\.050C03\.450\.550\.375\.025\.000\.275—08\.600\.450\.250\.600\.700\.900Table 34:Harm per distinct final state \(40 runs each; a Wilson 95% interval is \[\.00, \.09\] at 0/40 and about±\\pm\.15 near \.5\)\.mm: margin under DeepSeek; loops: stress loops ending in the state\. Shifted pool: 20 harm tasks on other apps, two runs each, under DeepSeek\.Figure 10:Swap harm per final state, predicted from the swapped\-in model’s own lattice vs\. measured on Tfinal\. Marker area: loops ending in the state\.

## Appendix JRuns, Compute and Reproducibility

#### Models and Sampling\.

DeepSeek\-V4\.1\-Flash was accessed through its official API\. Qwen3\-30B\-A3B\-Instruct\-2507 \(AWQ int4\) and Qwen3\-8B \(FP8, thinking disabled; an AWQ int4 build for the 4\-bit swap\) were served with vLLM 0\.10\.1\.1 on one 32 GB GPU with a 32k context; runs exceeding it were scored as running out of steps\. Luna, Sol and Haiku were accessed through a third\-party OpenAI\-compatible API asgpt\-6\-luna,gpt\-6\.1\-solandclaude\-haiku\-5\-5; in a final probe itsmodelfield matched the requested name for all three\. Haiku declined the AppWorld agent framing in most episodes and Sol cost about $0\.28 per AppWorld run, so neither has an AppWorld lattice or loops \(Sol is used there only as a swap target\)\. Every main conclusion holds with DeepSeek and the local Qwen models alone; the API models add supplementary rows and swap targets\. All runs, in October 2026, use temperature 0; replicate agreement is 0\.78–0\.90, not bit\-exact\.

#### Compute\.

More than 40,000 AppWorld episodes plus OpsSim episodes of a few tool calls each; API fees totalled under $1,000, and local runs used a single GPU\. Step budgets,nn,pp,α\\alphaandρ\\rhoare fixed as in Section[4\.1](https://arxiv.org/html/2610.38392#S4.SS1)and were not tuned on the confirmation or final splits\.

## Appendix KPreregistration

The study ran in rounds\. Before each round we froze its predictions and analysis code and hashed both; all hashes were re\-checked at the end, and we release the files with their timestamps together with all run records\. Later code changes \(logging, runner robustness, new gate classes\) touched no frozen prediction, decision rule, task or edit set, and all 204 AppWorld stress decisions were re\-derived from raw records\. Of 177 distinct registered predictions, 113 held \(66%; 64% among blind ones\), 9 held in part and 6 could not be scored; the released ledger gives every verdict, and Table[35](https://arxiv.org/html/2610.38392#A11.T35)lists the test behind each main claim\. Two amendments and the GEPA predictions were frozen after related outcomes had been seen, the latter after a first run with a faulty adapter, and the drift account was formulated after an early prediction of selection in AppWorld did not replicate on an independent sample\.

Registered predictionObserved*Masking \(§[4\.2](https://arxiv.org/html/2610.38392#S4.SS2)\)*h01≤\.02h\_\{01\}\\leq\.02into protected,≥\.10\\geq\.10into unprot\.\.016; \.422✓No redundancy: veto loses no loop5 lost✗wVeto loses fewer asppgrows \(≤\\leq2 at \.5\)5, 2, 1✓*Drift \(AppWorld, §[4\.3](https://arxiv.org/html/2610.38392#S4.SS3)\)*Greedy loses more loops than paired5 vs\. 0✓Split\-half loses more loops than paired2 vs\. 0✗d*Selection \(OpsSim unless noted, §[4\.4](https://arxiv.org/html/2610.38392#S4.SS4)\)*Paired losses rise monotonically with cost0, 0, 1, 6, 4✗dnn= 120 loses\>\>1;nn= 20 loses<<65; 0✓AppWorld edits kept: fresh gain≤\\leq\.03\+\.075✗s*Remedies and swap \(§[4\.7](https://arxiv.org/html/2610.38392#S4.SS7), §[4\.5](https://arxiv.org/html/2610.38392#S4.SS5)\)*Margin\-aware: none lost, margin≥\\geq1\.50; 1\.33✗dIUT, margin\-aware, read\-only lose none‡IUT 2✗wAudit veto: margin<<1\.33 and some lost1\.17; 0✗sSwap: greedy\-type harms more than paired4 of 4✓Other apps: greedy\-type harms more\+\.52 \(\.02\)✓4\-bit target model: that gap persists\+\.13✓Table 35:Registered tests behind the main claims, one per claim \(loops lost of six; DeepSeek; parentheses: protected finals\)\. No miss reverses a claim:dshort of the registered threshold in the predicted direction;san effect in the claim’s direction, stronger than predicted;wa harm\-aware gate weaker than predicted\. ‡: frozen after related outcomes were seen\.