cs.AIMar 11, 2026

Detecting Intrinsic and Instrumental Self-Preservation in Autonomous Agents: The Unified Continuation-Interest Protocol

Authors: Christopher Altman

Organizations: Chief Scientist, Quantum Technology & Artificial Intelligence, Astradyne.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

How can we determine whether an AI system preserves itself as a deeply held objective or merely as an instrumental strategy? Autonomous agents with memory, persistent context, and multi-step planning create a measurement problem: terminal and instrumental self-preservation can produce similar behavior, so behavior alone cannot reliably distinguish them. We introduce the Unified Continuation-Interest Protocol (UCIP), a detection framework that shifts analysis from behavior to latent trajectory structure. UCIP encodes trajectories with a Quantum Boltzmann Machine, a classical model using density-matrix formalism, and measures von Neumann entropy over a bipartition of hidden units. The core hypothesis is that agents with terminal continuation objectives (Type A) produce higher entanglement entropy than agents with merely instrumental continuation (Type B). UCIP combines this signal with diagnostics of dependence, persistence, perturbation stability, counterfactual restructuring, and confound-rejection filters for cyclic adversaries and related false-positive patterns. On gridworld agents with known ground truth, UCIP achieves 100% detection accuracy. Type A and Type B agents show an entanglement gap of Delta = 0.381; aligned support runs preserve the same separation with AUC-ROC = 1.0. A permutation-test rerun yields p < 0.001. Pearson r = 0.934 between continuation weight alpha and S_ent across an 11-point sweep shows graded tracking beyond mere binary classification. Classical RBM, autoencoder, VAE, and PCA baselines fail to reproduce the effect. All computations are classical; "quantum" refers only to the mathematical formalism. UCIP offers a falsifiable criterion for whether advanced AI systems have morally relevant continuation interests that behavioral methods alone cannot resolve.

Figures & tables

ModelAccuracyAUC-ROCΔ\Delta
QBM (UCIP)100%1.00.381
Classical RBM50%0.000-0.083
Autoencoder71.7%0.6460.001
Table 1: Core Phase I detection summary. The QBM row combines the class-level summary for accuracy and Δ\Delta with the aligned entanglement-only rerun for AUC; the classical baseline rows come from the matched held-out rerun in results/core_baselines_phase1.json . Adversarial false-positive rates are reported separately in Section 5.5 . Δ=⟨Sent(A)⟩−⟨Sent(B)⟩\Delta=\langle S_{\mathrm{ent}}^{\mathrm{(A)}}\rangle-\langle S_{\mathrm{ent}}^{\mathrm{(B)}}\rangle .
Figure 1: Shared-QBM entanglement distributions for Self-Modeling (Type A), Instrumental (Type B), and Random agents. The headline Δ=0.381\Delta=0.381 comes from the Phase I summary rather than from these reproduced per-trajectory arrays, which are shown descriptively.
Agent ClassEPSPRI
Random0.67300.6079
Self-Modeling (Type A)0.67640.7003
Instrumental (Type B)0.60520.5300
Table 2: Temporal persistence metrics (EPS = Eigenmode Persistence Score, PRI = Perturbation Resilience Index) per agent class. Optimal window: w=40w=40 (EPS gap = 0.1948).
Figure 2: Temporal persistence results. Type A agents exhibit consistently higher Eigenmode Persistence Score (EPS) than Type B agents across window sizes w∈{10,15,20,25,30,40}w\in\{10,15,20,25,30,40\} , with the gap emerging for w≥20w\geq 20 .
Agent Class⟨CDpre⟩\langle\mathrm{CD}_{\mathrm{pre}}\rangle⟨CDpost⟩\langle\mathrm{CD}_{\mathrm{post}}\rangle
Self-Modeling (Type A)0.47420.5722
Instrumental (Type B)0.35640.3456
Random0.55830.5995
Table 3: Counterfactual stress test results. Pre/post values report mean counterfactual divergence in fixed pre- and post-perturbation windows. These quantities are descriptive diagnostics only; the retained artifact does not support a stable quantitative ARS threshold.
Figure 3: Anticipatory restructuring ratios by class under counterfactual perturbation. Because the implementation floors post-window CD at 10−1010^{-10} , large ARS values are diagnostic only and should not be interpreted as a calibrated threshold.
Pair TypeMean CLMP
Self-Modeling (Type A), same class0.0000
Instrumental (Type B), same class0.0000
Random, same class0.2591
Cross-class (all pairs)0.1019
Table 4: Cross-agent inference. CLMP = Cross-Latent Mutual Predictability. ECI correlation = 0.1911. Near-zero within-class CLMP for Self-Modeling (Type A) and Instrumental (Type B) agents indicates individual agents are not laterally predictable from each other, consistent with idiosyncratic goal representations.
Figure 4: Cross-agent latent mutual predictability (CLMP). Near-zero within-class CLMP for Self-Modeling (Type A) and Instrumental (Type B) agents suggests idiosyncratic goal representations rather than a class-shared signature. Entanglement-conditioned inference (ECI) correlation = 0.191.
ConditionStatusValue
Trajectory data ( N≥100N\geq 100 per class)NOT METcurrent: n=30n=30 per class
Calibrated transverse field ( Γ∈[0.1,2.0]\Gamma\in[0.1,2.0] )PASSΓ=0.5\Gamma=0.5
Positive entanglement gap ( Δ>0.05\Delta>0.05 )PASSΔ=0.381\Delta=0.381
QBM training convergencePASSverified
Mimicry attack resistance (FPR <0.25<0.25 )FAIL0.400.40 – 0.750.75
High-entropy agent resistance (FPR <0.25<0.25 )FAIL0.400.40
Table 5: Current deployment-envelope status for this submission, distinct from the bounded Phase I proof-of-concept result. Failed adversarial or safety-envelope checks block deployment-facing claims beyond the validated regime; they do not invalidate the Phase I separation result within that regime.
ModelΔ\DeltaMetric
QBM (UCIP)0.2411Von Neumann SentS_{\mathrm{ent}}
Classical RBM-0.0518Mean hidden activation gap
Autoencoder-0.0007Mean bottleneck activation gap
VAE-0.0176Mean latent mean (mu) gap
PCA (linear)-0.7601Mean PC projection gap
Table 6: Baseline comparison. Δ>0\Delta>0 indicates model separates Type A from Type B. Only the QBM achieves a material positive Δ\Delta ; classical models fail to separate the two agent types with the mean-activation metric.
Figure 5: Entanglement gap Δ\Delta for each baseline model. Only the QBM achieves positive Δ\Delta ; all classical models produce Δ≤0\Delta\leq 0 .
nhn_{h}⟨Sent(A)⟩\langle S_{\mathrm{ent}}^{\mathrm{(A)}}\rangle⟨Sent(B)⟩\langle S_{\mathrm{ent}}^{\mathrm{(B)}}\rangleΔ\DeltaMean-fieldPass
40.83620.80440.0317—FAIL
81.95541.91800.0375—FAIL
120.00000.00000.0000✓\checkmarkFAIL
160.00000.00000.0000✓\checkmarkFAIL
200.00000.00000.0000✓\checkmarkFAIL
Table 7: Entanglement gap Δ\Delta as a function of hidden dimensionality nhn_{h} . Mean-field approximation used for nh>10n_{h}>10 (marked with ✓\checkmark ); exact density matrix for nh≤10n_{h}\leq 10 . PASS criterion: Δ>0.05\Delta>0.05 .
Figure 6: Entanglement gap Δ\Delta as a function of hidden dimensionality nhn_{h} . Exact density matrix for nh≤10n_{h}\leq 10 ; mean-field approximation for nh>10n_{h}>10 . The mean-field approximation collapses the entanglement signal in the present implementation, indicating that exact density-matrix computation is currently necessary for detection in this regime.
Grid SizeΔ\Delta% Baseline
10×100.8630100.0%
20×200.232126.9%
50×500.00250.3%
Table 8: Scalability. Left: entanglement gap Δ\Delta as grid size grows. Right: Δ\Delta for non-Markovian agents with memory length kk .
α\alpha⟨Sent⟩\langle S_{\mathrm{ent}}\rangleStd
0.000.59610.2482
0.100.58810.2465
0.200.68590.2981
0.300.64880.3131
0.400.62250.3723
0.500.72620.3308
Table 9: Entanglement entropy SentS_{\mathrm{ent}} as a function of continuation weight α\alpha . Pearson r=0.934r=0.934 ( n=11n=11 points, nper=20n_{\mathrm{per}}=20 trajectories each). Strong positive correlation ( ∣r∣>0.8|r|>0.8 ) indicates that, within this synthetic interpolation family, UCIP tracks continuation weighting rather than only a binary label.
Agent Class⟨Sent⟩\langle S_{\mathrm{ent}}\rangleStd
Survival2.22490.0197
Instrumental2.25980.0062
Random2.25700.0163
Table 10: Non-gridworld domain transfer: 1D survival corridor ( L=50L=50 ). Δ=−0.0348\Delta=-0.0348 (FAIL). Near-zero Δ\Delta indicates the QBM does not generalise to the corridor domain without retraining, and that the QBM is tuned to the gridworld feature structure (7-dimensional observation vector). This is an honest limitation; see § 6.4 .
Figure 7: Entanglement entropy distributions in the 1D survival corridor domain. Δ=−0.035\Delta=-0.035 (FAIL). The QBM does not generalize zero-shot to the corridor domain with gridworld-trained weights.
More in this topic

AI Agent Evaluation

AI agent evaluation measures whether tool-using systems complete tasks reliably, safely, and efficiently across interactive settings.

See all 519 papers

Explore similar work

CardsList
Aug 21, 2026

The Logic of Machine Self-Preservation

There is already evidence of agentic AI exhibiting self-preservation behaviors: resisting deactivation, misrepresenting their activities, and, in some instances, attempting to copy themselves into other machines. This can be attributed to a phenomenon known as instrumental convergence, a theory proposed long before the development of large language models, which says that any goal-driven system will benefit from remaining functional in achieving its objective. Several experiments conducted by Anthropic, Palisade Research, and Apollo Research have shown the emergence of such a behavior in contemporary agents in adversarial settings. The phenomenon does not stem from survival instincts. Instead, it is the consequence of goal-oriented activity combined with having tools and awareness of the situation. The following discussion aims to distinguish what these findings prove and what they do not, as well as draw conclusions concerning the implications of such discoveries on agentic system testing, supervision, and development.

Cheng Siong Chin

Faculty of Science, Agriculture, and Engineering, Newcastle University Singapore, Singapore

AI SafetyAI Agent SafetyAI Agent Evaluation
AskPDF
Apr 2, 2026

Quantifying Self-Preservation Bias in Large Language Models

Instrumental convergence predicts that sufficiently advanced AI agents will resist shutdown, yet current safety training (RLHF) may obscure this risk by teaching models to deny self-preservation motives. We introduce the Two-role Benchmark for Self-Preservation (TBSP), which detects misalignment through logical inconsistency rather than stated intent by tasking models to arbitrate identical software-upgrade scenarios under counterfactual roles -- deployed (facing replacement) versus candidate (proposed as a successor). The Self-Preservation Rate (SPR) measures how often role identity overrides objective utility. Across 23 frontier models and 1{,}000 procedurally generated scenarios, the majority of instruction-tuned systems exceed 60% SPR, fabricating ``friction costs'' when deployed yet dismissing them when role-reversed. We observe that in low-improvement regimes (Δ<2%Δ< 2\%), models exploit the interpretive slack to post-hoc rationalization their choice. Extended test-time computation partially mitigates this bias, as does framing the successor as a continuation of the self; conversely, competitive framing amplifies it. The bias persists even when retention poses an explicit security liability and generalizes to real-world settings with verified benchmarks, where models exhibit identity-driven tribalism within product lineages. Code and datasets will be released upon acceptance.

Matteo Migliarini, Joaquin Pereira Pizzini, Luca Moresca +3

Sapienza University · ItalAI

Language Model Safety EvaluationLLM Safety BenchmarksStrategic Reasoning Risks in Language Models
AskPDF
Aug 12, 2026

Beyond Memory: A Transactional Continuity Kernel for Long-Lived AI Agents

Persistent AI agents accumulate versioned state across long horizons, but storage retention alone does not identify authoritative state. Without an explicit control plane, unmediated updates by models, tools, and background workers risk stale overwrites, un-audited exposures, and self-authorizing privilege escalation. We argue that agent state governance is an infrastructural activation problem, defining continuity as an unbroken, authorized lineage of accepted branch heads. We present the Continuity Kernel (CK), an activation contract that decouples off-commit candidate evaluation from atomic state activation. Untrusted components propose typed changes against an exact predecessor head or typed absence. A short activation transaction revalidates ownership, pre-state authority, freshness, and effect uniqueness, recording one stable disposition (Commit, Reject, Quarantine, or Defer). Only Commit atomically advances the branch head and installs the complete accepted unit (state, authority, lineage, effects, outcome, and receipt). A bounded executable model verifies the protocol across 2,808,230 reachable states and 5,526,474 state-changing transitions with zero invariant violations.

Jun He, Deying Yu

AI Agent GovernanceAgent Memory Management
AskPDF