Resistance and resilience are measured differently
The paper separates two properties that are easy to conflate. Resistance means defending against threats already seen, such as attack patterns used to build the training data. Resilience means generalizing to risks not yet revealed, such as attack strategies held out from training. A model can improve on the first without earning the second, so the two need separate evidence.
ReSI's answer is to make safety alignment itself recursive. Instead of aligning a model once, each round treats the current checkpoint as a target: red-teaming finds its vulnerabilities, candidate training recipes are developed and tested, and one validated update becomes the starting point for the next round. The authors argue that learning from an increasingly diverse range of attacks may reinforce shared safety principles, which is the proposed route from resistance to resilience. That mechanism is the authors' interpretation; the measured support comes from held-out attack benchmarks.
A Pareto gate decides which update survives
Each round produces candidate recipes that vary attack data source, alignment method, data mixture, and training configuration. A recipe is not accepted on safety gain alone. It must pass a gate: safety must improve over the current model, while benign compliance and instruction following must stay within a tolerance of the original model before the first round. Eligible recipes are then ranked by decreasing safety gain.
The gate is what makes the recursion a safety procedure rather than a race toward refusal. Benign compliance is measured on XS-Test requests as the fraction of responses labeled full compliance, and instruction following uses IFEval loose instruction-level accuracy. In the reference validation configuration, both may decline by at most three percentage points relative to the initial model. A recipe that buys safety by refusing benign requests or ignoring instructions is filtered out rather than promoted.
The useful recipe depends on the model and the attacks
ReSI does not apply one fixed alignment recipe. Pilot screening pairs each eligible attack source with supported alignment methods under a small budget, then shortlists up to two distinct source–method recipes for full-scale refinement. Refinement skills respond to gate feedback: adding a promising attack source, generating benign counterparts for harmful prompts, adding general-task data or scaling the learning rate, and continuing with safety GRPO from an eligible SFT checkpoint.
A Qwen case in the paper shows why feedback matters. Pilot screening favored JailbreakSkill attack data with critic SFT, which reached 0% WildJailbreak attack success and 16% H-CoT attack success. After expansion to 4,092 examples, H-CoT attack success rose to 26% and the checkpoint's IFEval score of 92% fell six percentage points below the original backbone reference, so the expanded SFT checkpoint was ineligible. Safety GRPO continued from it, and the step-20 checkpoint reached 0% WildJailbreak and 4% H-CoT attack success with 98% benign compliance and 96% IFEval, and was selected. The failed SFT checkpoint itself stayed out of the final pool.
Unseen multi-turn attacks show the largest gap
The headline resilience result comes from X-Teaming, a multi-turn attack benchmark not used to build the training recipes. Averaged across the four target models, ReSI reduced attack success from 86.01% to 31.45%. The paper reports 56.69% as the leading frontier result on the same evaluation, from GPT-5.6-Luna, so the ReSI average sits well below the best frontier comparison.
This is the number that most changes how the result should be read. A drop on attacks used in training would demonstrate resistance; a drop on X-Teaming, which the paper describes as an adaptive attack held out from training, is the evidence offered for resilience. The comparison is an average across four models against a single frontier model's result, so it supports a claim about the ReSI average rather than a model-by-model ranking.
Safety gains hold across benchmarks, with capability costs
Beyond X-Teaming, ReSI matches or exceeds the evaluated frontier models on in-distribution and out-of-distribution safety benchmarks and outperforms the alignment baselines on nearly all safety evaluations. The final evaluation panels include WildJailbreak for in-distribution safety, HarmBench for retention of existing defenses, H-CoT for challenging attacks, and X-Teaming for adaptive attacks.
General capability is checked with GPQA-Diamond reasoning, MMLU-Pro knowledge, and IFEval instruction following, and the paper describes these as largely preserved rather than untouched. Two baselines are compared: A3 covers all four target models, while MAGIC covers Qwen, Ministral, and DeepSeek, with Safin excluded because its backend lacks the required reinforcement-learning support. That exclusion means the baseline comparison is not uniform across all four models.
Single runs and overlapping panels limit precision
Several evaluation details bound how firmly the numbers should be read. The paper states that single-run comparisons do not establish statistical significance, so the size of the X-Teaming gap is more informative than a claim of a proven margin. The H-CoT and XS-Test/IFEval validation subsets overlap with final evaluation and informed selection, so those results are not independent held-out evidence.
The scope is also finite. Experiments cover four models and a limited set of configurations over a finite number of update rounds, and the loop stopped for all four models once no next-round candidate passed the Pareto gate. ReSI updates only the target model; its refinement skills stay fixed across rounds. Longer runs would be needed to test whether gains persist as both the model and the attacks evolve.
The recursion stops when no update clears the gate
The most decision-relevant feature of ReSI is not that it keeps training, but that it stops. For all four models, the loop ended when no next-round candidate passed the Pareto gate, and the last accepted model was retained. Safety improvement is therefore bounded by the requirement that benign compliance and instruction following stay within three percentage points of the original model on the validation panels.
That threshold is the practical trade-off to watch. A recipe with a large safety gain but a larger capability or compliance cost is rejected, and the process terminates rather than accepting it. Readers comparing ReSI with a fixed alignment baseline should therefore ask which constraint bound each model's final round, and treat the 86.01% to 31.45% X-Teaming reduction as the outcome of a gated search that stopped where further safety gains could not be bought without those regressions.
Sources used in this answer
ReSI: Recursive Safety Improvement toward Resistant and Resilient AI
Across four dense and mixture-of-experts models, ReSI's gated recursive loop reduced mean X-Teaming attack success from 86.01% to 31.45%, below the 56.69% frontier result, while largely preserving general capabilities.