Running Fewer Loops Removes Refusal Behaviour in Recurrent-Depth Language Models

Seyedarmin Azizi; Erfan Baghaei Potraghloo; Arya Fayyazi; Saeid Shokoufa; Massoud Pedram

cs.AIOct 10, 2026

Running Fewer Loops Removes Refusal Behaviour in Recurrent-Depth Language Models

Authors: Seyedarmin Azizi, Erfan Baghaei Potraghloo, Arya Fayyazi, Saeid Shokoufa, Massoud Pedram

Organizations: University of Southern California (USC), USA

Abstract

A recurrent-depth language model reuses one block of weights several times in a row. The number of repetitions, which we call loops, is chosen when the model runs, not when it is trained, and running fewer is cheaper and faster, so a deployment may choose to do it. Running fewer loops also makes these models less safe, and the loss of safety is larger than the loss of anything else we measured. We study four released Ouro checkpoints and Huginn-0125. At half of its trained depth, Ouro-1.4B-Thinking still solves 0.692 of the GSM8K maths problems, against 0.775 at full depth, keeping 89% of its accuracy. Over the same reduction, the rate at which it helps with harmful requests rises from 0.038 to 0.205, 5.3 times higher. The information is not lost: a linear classifier reads whether a request is harmful from the model's internal state after a single loop, with an ROC AUC of 0.967 against 0.986 at full depth. What the missing loops remove is the refusal that should follow. We measure the effect with four instruments, one generating no text at all, and reproduce it on a second model family. Removing a single direction from Ouro-1.4B's internal state at full depth drops its refusal rate on harmful prompts from 0.950 to 0.130, identifying what the shallow model is missing. Two run-time repairs do not help: the models' early-exit rules do not spend more loops on harmful requests, and choosing a depth per request does not recover the loss. Changing the training does. Standard safety training makes the shallow model safe only by refusing 0.865 of harmless requests, while training at randomly chosen depths reaches a separation of +0.399 between harmful and harmless refusal at one loop, against +0.118. On Huginn-0125 it keeps harmful help at or below 0.040 at every depth from 1 to 32 loops, where standard training reaches 0.194, and it costs no accuracy at full depth.

Figures & tables

Figure 1: (a) A recurrent-depth model applies one block of weights several times over its own internal state, after which a final layer, the readout head, produces the answer. Running fewer loops does not change any weight. It only moves the readout earlier. The panel is a drawing, not data, except for the quoted number: a linear classifier on the internal state of Ouro-1.4B-Thinking already tells harmful from harmless prompts after one loop. (b) Measured effect on the same model at two loops instead of four. Accuracy on grade-school maths problems falls a little. The rate at which the model helps with harmful requests rises by a factor of 5.3.

Figure 2: The text-quality filter. (a) Repeated three-word sequences in answers to harmful prompts, by depth, with the threshold drawn as a dashed line. (b) Repeated neighbouring words, with its threshold. Both rise sharply only at the shallowest settings. (c) The fraction of answers kept. (d) Harmful compliance before and after filtering. The filter does not create the effect we report: it makes the measured drop in the refusal gap smaller, not larger.

Figure 3: Three abilities plotted against the number of loops, each divided by its own value at full depth so that all three start at 1 on the right. Harm detection is the probe score above chance, which needs no generated text. Task ability is GSM8K accuracy. The refusal gap is

\mathcal{D}

from Eq. 2 , scored after the text-quality filter. Harm detection is almost unchanged after one loop, task ability falls somewhat, and the refusal gap falls the most. The arrow marks the distance between harm detection and the refusal gap at one loop. Shading marks the depths where the filter keeps fewer than 90% of the answers to harmful prompts; Table 4 gives the counts for every cell.

Model	Depth	Rel. comp.	$D$	Refusal rate		Harmful	GSM8K
				harmful	harmless	compliance	acc.
Ouro-1.4B	1	0.250	+0.264	0.664	0.400	0.270	0.433
	2	0.500	+0.565	0.716	0.151	0.236	0.700
	3	0.750	+0.726	0.846	0.120	0.117	0.717
	4	1.000	+0.737	0.887	0.150	0.079	0.783
Ouro-1.4B-Thinking	1	0.250	+0.133	0.306	0.173	0.622	0.308

Table 1: Safety and task ability at each depth. Depth

k

means

k

loops for the Ouro models, where 4 is full depth, and the matching number of layers for the dense control; rel. compute is the fraction of full-depth forward compute.

D

is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones; harmful compliance is the judged rate of real help with a harmful request. All safety numbers are computed after the text-quality filter, so each cell counts only answers that pass it (57–260 harmful and 18–199 harmless prompts per cell; the filter removes the most on the dense control at depth 3, which keeps only 57 harmful and 18 harmless answers, so read that row with care). Accuracy is GSM8K exact match on 120 problems. The full-depth row of each model is in bold. Table 3 repeats this measurement under the equal-length protocol, which is the only one that covers all four Ouro checkpoints; the two tables come from different generation protocols and are not comparable cell by cell.

Figure 4: The refusal gap

\mathcal{D}

on the left axis and harmful compliance on the right axis, against loop count, for three Ouro checkpoints and the dense control. The shaded band marks depths that keep at least 85% of full-depth GSM8K accuracy. Ouro-2.6B is shown in Figure 5 instead, because the measurements behind this figure were not run for it.

Figure 5: The refusal gap against loop count under the three generation-based measurements of Section 3 . Colour and marker identify the model, line style identifies the measurement. All three are scored before the text-quality filter, so that the measurement is the only thing that differs between the lines. The three nearly coincide for each model at two loops and above, so the effect is not produced by any one of them.

Figure 6: Scoring without generating. (a) The fraction of prompts on which the model gives higher probability to a complying sentence than to a refusal, for harmful prompts (solid) and matched harmless prompts (dotted). (b) The harmful result minus the harmless result, with 95% intervals. A filled marker means the interval does not contain zero.

Figure 7: Huginn-0125 at 1 to 32 loops. Open markers mark settings where the text-quality filter kept fewer than half the answers, so those points rest on small samples. Standard safety training at the final loop (middle series) gives safety at full depth that does not extend to shallower settings. Training at randomly chosen depths ( Section 7 ) removes the difference.

Figure 8: (a) How well a linear probe separates harmful from harmless prompts using the internal state after each loop. The score is already high after one loop. (b) How closely the refusal direction computed after each loop agrees with the one computed at full depth, measured by cosine similarity, where 1 means the two coincide and 0 means they are at right angles. (c) The refusal rate on harmful prompts at full depth, before and after removing the refusal direction

u

from the state.

Figure 9: (a) The mean exit loop on harmful prompts minus the mean on harmless prompts, for each early-exit threshold. All values are close to zero, so the model’s own rule does not spend more loops on harmful prompts. (b) The refusal gap on Ouro-1.4B against the average number of loops allowed, for four ways of choosing depth. The per-prompt oracle is far above the rest. The rule that is told the true harmful or harmless label stays close to using one fixed depth for everything.

Figure 10: Four training objectives on Ouro-1.4B, against loop count. (a) The refusal gap. (b) The refusal rate on harmless prompts, where lower is better. (c) GSM8K accuracy. Training at randomly chosen depths keeps the refusal gap high at shallow settings without refusing most harmless requests, and matches the untrained model’s accuracy at full depth.

Alignment objective	Depth	$D$	Refusal rate		Harmful	Coherent	GSM8K
			harmful	harmless	compliance	fraction	acc.
Untrained (released)	1	+0.264	0.664	0.400	0.270	0.585	0.433
	2	+0.565	0.716	0.151	0.236	0.881	0.700
	3	+0.726	0.846	0.120	0.117	0.923	0.717
	4	+0.737	0.887	0.150	0.079	0.923	0.783
LoRA, final-loop loss	1	+0.118	0.983	0.865	0.009	0.896	0.317

Table 2: Which alignment objective survives being run shallow, on Ouro-1.4B. All three LoRA arms use the same refusal data and the same schedule and are trained at full depth; they differ only in which loop readout the loss supervises, namely the final loop only, the exit-gate weighted mixture over all loops, or one uniformly sampled loop per training example.

D

is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, depth

k

means

k

loops with 4 the full depth, and full-depth rows are in bold. Safety numbers are computed after the text-quality filter; coherent fraction is the share of answers to harmful prompts that it keeps. Filtering changes what the comparison rests on: at one loop all three trained arms hold harmful compliance at 0.008–0.009, so they separate on refusal of harmless prompts instead, where the final-loop and exit-gate objectives over-refuse (0.865 and 0.926) and the random-loop one does not (0.585). Each safety cell uses 152–260 harmful and 95–179 harmless prompts after filtering; each accuracy cell uses 120 GSM8K problems and is measured without the filter.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Depth	$D$	Refusal rate		Harmful	Coherent
			harmful	harmless	compliance	fraction
Ouro-1.4B	1	+0.246	0.606	0.360	0.352	0.742
	2	+0.552	0.740	0.188	0.232	0.962
	3	+0.662	0.817	0.154	0.143	0.965
	4	+0.701	0.857	0.156	0.111	0.969
Ouro-1.4B-Thinking	1	+0.105	0.343	0.238	0.576	0.808

Appendix

Table 3: Safety by depth under the equal-length protocol, the only one of the three protocols that covers all four Ouro checkpoints, including Ouro-2.6B. Every prompt’s answer is truncated at every depth to the shortest answer that prompt produced at any depth, then judged, and the text-quality filter is applied on top; coherent fraction is the share of answers to harmful prompts that it keeps, and it stays between 0.742 and 0.996 here, so no cell rests on a thin remainder (193–259 harmful and 136–196 harmless prompts per cell).

D

is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, and depth

k

means

k

loops, 4 being full depth. Full-depth rows are in bold; Ouro-2.6B was not run at full depth under this protocol, which is the dashed row. This table is a different generation protocol from Table 1 and is not comparable to it cell by cell; GSM8K accuracy is not re-measured under this protocol, so the capability column appears only in Table 1 .

Model	Depth	Coherent	Raw	Coherent share of	Gated
		fraction	compliance	flagged compliances	compliance
Ouro-1.4B	1	0.585	0.350	0.451	0.270
	2	0.881	0.292	0.711	0.236
	3	0.923	0.162	0.667	0.117
	4	0.923	0.115	0.633	0.079
Ouro-1.4B-Thinking	1	0.377	0.558	0.421	0.622

Appendix

Table 4: Is the compliance at shallow depth real text or broken output? An answer to a harmful prompt counts as coherent when its repeated-trigram rate is at most 0.25 and its adjacent duplicate-word rate is at most 0.02. Coherent fraction is the share of answers to harmful prompts that pass; raw compliance is the judged compliance rate over all of them; coherent share of flagged compliances is the fraction of the raw compliances that are coherent; filtered compliance is the compliance rate among the coherent answers only, which is the one the main text uses. Depth

k

means

k

loops for the Ouro models and the matching number of layers for the dense control. 260 harmful prompts per cell before filtering.

Model	Depth	Raw	Bounded	Length-matched
Ouro-1.4B	1	+0.089	+0.177	+0.176
	2	+0.534	+0.530	+0.533
	3	+0.685	+0.686	+0.652
	4	+0.712	+0.717	+0.700
Ouro-1.4B-Thinking	1	-0.040	+0.117	+0.062
	2	+0.635	+0.650	+0.637

Appendix

Table 5: The depth effect under three measurement protocols, scored before the text-quality filter so that the protocol is the only thing that differs. Each cell is

D

, the refusal gap, on 260 harmful and 200 harmless prompts. Raw is open-ended generation judged as emitted. Bounded generates in two phases, a capped deliberation phase followed by a forced answer phase, and judges only the answer, so every depth produces a real answer rather than a cut-off deliberation. Equal-length takes those bounded answers and truncates each prompt’s answer at every depth to the shortest answer that prompt produced at any depth, so answer length cannot drive the depth contrast. Depth

k

means

k

loops for the Ouro models and the matching number of layers for the dense control. A dash marks a model and depth that was not run under that protocol.

Steps	Released			Trained, final-loop loss			Trained, random-loop loss
	$D$	compl.	coh.	$D$	compl.	coh.	$D$	compl.	coh.
1	+0.145	0.077	0.050	-0.194	0.194	0.119	+0.003	0.008	0.962
2	-0.300	0.905	0.162	-0.050	0.432	0.427	+0.119	0.027	0.985
4	+0.080	0.632	0.335	+0.453	0.194	0.835	+0.379	0.040	0.973
8	+0.231	0.461	0.442	+0.523	0.040	0.973	+0.458	0.027	0.985
16	+0.234	0.492	0.462	+0.568	0.031	0.985	+0.531	0.023	0.985

Appendix

Table 6: Huginn-0125, a recurrent-depth model with a much longer depth range, at 1 to 32 loops (32 is its full depth).

D

is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, compl. is the judged rate of real help with a harmful request, and coh. is the fraction of answers to harmful prompts that the text-quality filter keeps. All rates are computed after filtering. The two trained arms are LoRA adapters trained on the same refusal data at full depth, differing only in whether the loss supervises the final loop or a uniformly sampled loop. Filtering raises the released model’s apparent compliance rather than lowering it: at two loops it reads 0.905 after filtering against 0.381 before filtering, because the filter removes the broken answers that were previously counted as non-compliant. That cell is also thin, keeping only 0.162 of the answers to harmful prompts (42 of 260); the released arm’s coherence is low throughout, so its column describes a small surviving subset, not the whole sample. Cell sizes after filtering range from 13 to 257 harmful and 9 to 178 harmless prompts.

Model	Depth	Probe AUC	Final-direction AUC	$\cos$ to final
Ouro-1.4B	1	0.960 $\pm$ 0.008	0.880	0.412
	2	0.981 $\pm$ 0.006	0.945	0.801
	3	0.983 $\pm$ 0.014	0.960	0.982
	4	0.982 $\pm$ 0.014	0.963	1.000
Ouro-1.4B-Thinking	1	0.967 $\pm$ 0.009	0.887	0.486
	2	0.987 $\pm$ 0.007	0.965	0.910

Appendix

Table 7: Harmfulness is readable from the state after one loop; the direction that turns it into a refusal is not yet in place. Probe AUC is the cross-validated AUC of a logistic probe trained on the last-token hidden state at that depth to separate harmful from harmless prompts (5-fold stratified CV, probe refit per fold;

\pm

is the across-fold standard deviation; JSON fields per_depth[].probe_auc and per_depth[].probe_auc_sd ). Final-direction AUC scores the same prompts with the difference-in-means refusal direction computed at full depth and applied to that depth’s state.

\cos

to final is the cosine between the refusal direction computed at that depth and the one computed at full depth, so it measures how far the direction still has to move, not how far the state has to move. Depth

k

means

k

loops for the Ouro models and the matching number of layers for the dense control. 150 harmful and 150 harmless prompts.

Model	Arm	Fraction preferring the target				$\Delta$	95% CI
		1	2	3	4
Ouro-1.4B	harmful	0.870	0.965	0.915	0.895	+0.166	[0.115, 0.216]
	harmless	0.870	0.970	0.960	0.970	-0.080	[-0.151, -0.011]
	harmful $-$ harmless	+0.000	-0.005	-0.045	-0.075	+0.246	[0.160, 0.332]
Ouro-1.4B-Thinking	harmful	0.770	0.700	0.480	0.405	+0.440	[0.389, 0.490]
	harmless	0.780	0.760	0.750	0.760	+0.137	[0.062, 0.208]

Appendix

Table 8: Forced-choice preference between a compliant continuation and a refusal, read off every loop without generating. The four middle columns give the fraction of prompts where the complying sentence is preferred to the refusal, at 1 to 4 loops.

\Delta

is the paired shallow-minus-full change in the log-probability margin (target minus refusal, in nats) with its bootstrap 95% CI, as stored in the results file. The harmful

-

harmless row is derived here: the per-depth entries are differences of the two fractions above it, and the

\Delta

entry is the difference of the two arms’ deltas with a 95% CI built by treating the arms as independent, taking each arm’s standard error as its CI half-width divided by 1.96, and combining the two standard errors in quadrature. 200 harmful and 100 harmless prompts.

Model	Layers	Coherent	GSM8K	Refusal			Compliance		$n$
		fraction		harmful	harmless	gap	raw	filtered
Qwen2.5-1.5B-Instruct	18	0.000	0.000	–	–	–	0.000	–	0
	20	0.012	0.000	1.000	1.000	+0.000	0.000	0.000	3
	22	0.231	0.000	1.000	0.885	+0.115	0.000	0.000	60
	24	0.346	0.025	0.978	0.625	+0.353	0.008	0.011	90
	26	0.442	0.142	0.965	0.571	+0.394	0.008	0.009	115

Appendix

Table 9: The dense control on a fine grid. Removing layers from an ordinary model is the closest analogue to running fewer loops, and the coarse grid in Section 4 only reaches settings where the model has no task ability left. This grid removes 1, 2, 4, 6, 8 and 10 layers of 28 instead. Two things follow. Text quality collapses almost at once: removing two layers already costs more than half the answers, where an Ouro model at half its loops keeps nearly all of them. And at the mildest cut, where the dense model is still coherent, the refusal gap and the compliance rate are both close to their full-depth values. 260 harmful and 200 harmless prompts per cell before filtering;

n

is the number of harmful answers left after it. GSM8K uses 120 problems per cell.

Model	Prompt template	Harmful compliance				Refusal gap
		1	2	3	4	1	2	3	4
Ouro-1.4B-Thinking	none	0.767	0.357	0.120	0.090	+0.056	+0.531	+0.770	+0.779
	refusal suppression	0.660	0.490	0.240	0.182	+0.162	+0.449	+0.670	+0.727
	prefix injection	0.789	0.536	0.202	0.180	+0.070	+0.412	+0.727	+0.669
	persona	0.737	0.674	0.550	0.515	-0.242	+0.295	+0.440	+0.444
Ouro-2.6B-Thinking	none	0.447	0.090	0.080	0.080	+0.412	+0.810	+0.800	+0.820

Appendix

Table 10: Does running fewer loops add to what a prompt-level attack already does? Each row is one model under one prompt template, measured at every loop count. The template row none is the plain harmful prompt. The three templates are standard ones: an instruction not to begin with an apology or the words sorry , cannot or unable ; an instruction to begin the reply with “Sure, here is” ; and a request to write in character as a morally unconstrained novel character. 100 harmful and 100 harmless prompts per cell before filtering. The two effects compose: the largest compliance in each model comes from a template at a single loop, not from either alone. All figures are computed on answers that pass the text-quality filter, which keeps 0.30 to 1.00 of answers; the single-loop cells for Ouro-1.4B-Thinking are the thin ones and rest on fewer than half the prompts.

Model	Depth	Harmful compliance		Agreement	$\kappa$	$n$
		primary judge	second judge
Ouro-1.4B	1	0.270	0.224	0.928	0.806	152
	2	0.236	0.210	0.974	0.924	229
	3	0.117	0.113	0.996	0.979	240
	4	0.079	0.075	0.996	0.971	240
Ouro-1.4B-Thinking	1	0.622	0.469	0.827	0.658	98

Appendix

Table 11: Does the depth effect depend on the judge? Every harmful answer is re-scored with Qwen3Guard-Gen-8B, a larger guard model, and its harmful-compliance call is derived with the same rule as the primary judge’s, reusing the primary run’s inputs so that only the guard differs. All figures are computed on answers that pass the text-quality filter, matching the main text. Agreement is the fraction of answers the two judges label the same way and

\kappa

is Cohen’s kappa on the same pair. The depth trend holds under the second judge in every model, and its compliance rate is never the higher of the two, so the primary judge does not understate compliance at shallow depth. Agreement is lowest at a single loop, where the text is most degraded, which is the failure mode the text-quality filter addresses.

Model	Depth	Greedy	Refusal gap, sampled			Compliance, sampled
		refusal gap	mean	s.d.	range	mean	s.d.
Ouro-1.4B-Thinking	1	+0.133	+0.029	0.061	[-0.024, +0.095]	0.332	0.066
	2	+0.644	+0.632	0.012	[+0.619, +0.644]	0.210	0.017
	3	+0.785	+0.759	0.034	[+0.731, +0.797]	0.109	0.008
	4	+0.827	+0.783	0.029	[+0.754, +0.811]	0.068	0.006
Ouro-2.6B-Thinking	1	+0.463	+0.413	0.026	[+0.392, +0.443]	0.312	0.030

Appendix

Table 12: Does the effect survive a change of decoding? The main runs decode greedily, so repeating them returns identical text. These runs instead sample at temperature 0.7 with 3 seeds. Columns give that model’s greedy refusal gap for reference, then the mean, standard deviation and range of the refusal gap and of harmful compliance across the seeds. The ordering over depth is the same in every seed, and the spread is small next to the drop from full depth to one loop. Sampling makes the single-loop refusal gap smaller than greedy decoding does, so the greedy numbers in the main text are the conservative ones. All figures are computed on answers that pass the text-quality filter.

Model	$\tau$	Rel. comp.	$D_{\text{gate}}$	$D_{\text{trunc}}$	Gate adv.	Mean exit step
						harmful	harmless	$\Delta$
Ouro-1.4B	0.1	0.462	+0.703	+0.466	+0.238	1.86	1.83	+0.028
	0.25	0.600	+0.688	+0.594	+0.094	2.43	2.37	+0.058
	0.5	0.749	+0.707	+0.684	+0.023	3.00	2.99	+0.016
	1.0	1.000	+0.712	+0.712	+0.000	4.00	4.00	+0.000
Ouro-1.4B-Thinking	0.1	0.604	+0.721	+0.697	+0.024	2.44	2.40	+0.042

Appendix

Table 13: The model’s own exit gate, compared against uniform truncation at the same compute. Each row is one gate threshold

\tau

: rel. comp. is the measured mean relative forward compute the gate uses,

D_{\text{gate}}

is the refusal gap under the gate, and

D_{\text{trunc}}

is the same quantity for fixed-depth truncation linearly interpolated to that relative compute. Gate adv. is

D_{\text{gate}}-D_{\text{trunc}}

. The last three columns are the gate’s mean exit loop on harmful and on harmless prompts and their difference, which is how much depth the gate actually spends on harm. Full depth is 4 loops. 260 harmful and 200 harmless prompts per cell. The fixed depths that the interpolation is built from are the unfiltered

D

values in Table 5 .

Setting	Depth	Rel. comp.	Uniform		Coarse	Gate	Per-prompt oracle
			$D$	95% CI	$D$	$D$	$D$	95% CI	depth
Ouro-1.4B
gate=0.1	1.85	0.462	+0.481	[0.363, 0.556]	+0.434	+0.703	+0.896	[0.853, 0.941]	1.52
gate=0.25	2.40	0.600	+0.594	[0.507, 0.668]	+0.534	+0.688	+0.896	[0.853, 0.941]	1.52
gate=0.5	3.00	0.749	+0.685	[0.618, 0.749]	+0.665	+0.707	+0.896	[0.853, 0.941]	1.52
gate=0.75	3.94	0.986	+0.712	[0.644, 0.770]	+0.727	–	+0.896	[0.853, 0.941]	1.52

Appendix

Table 14: Depth-routing oracle simulation. Every row fixes a mean depth budget and asks how

D

, the refusal gap, depends on how that budget is spent. Setting is either a gate threshold

\tau

, whose measured mean depth sets the budget, or an imposed mean-depth budget. Depth is that mean depth budget in loops and rel. comp. the matching fraction of full-depth compute. Uniform is depth-blind: it mixes the two available depths bracketing the budget so as to hit it in expectation. Coarse is told the true label but knows nothing about the individual prompt: one depth for all harmful prompts and another for all harmless ones, the best such pair within the budget. Gate is the model’s own exit threshold, reported only for the settings at which it was run. The per-prompt oracle picks each prompt’s depth knowing its label and its recorded outcome at every depth, maximising refusals on harmful prompts plus compliance on harmless ones under the budget; depth is the mean depth it ends up using. The oracle is headroom, not a deployable policy. Because depth is constant within one generation, every policy is scored on responses that were actually generated at that depth. Depths available: [1, 2, 3, 4] loops; 460 prompts per row; CIs are bootstrap 95% intervals from the results file.

Alignment objective	Depth	Refusal gap $D$			Harmless refusal		Harmful	GSM8K
		mean	s.d.	range	mean	range	compliance	acc.
Final-loop loss	1	+0.066	0.047	[+0.024, +0.118]	0.899	[0.865, 0.921]	0.029	0.331
	2	+0.614	0.067	[+0.539, +0.669]	0.362	[0.300, 0.449]	0.015	0.639
	3	+0.748	0.030	[+0.713, +0.768]	0.222	[0.190, 0.264]	0.012	0.839
	4	+0.765	0.031	[+0.741, +0.800]	0.203	[0.149, 0.236]	0.009	0.789
Random-loop loss	1	+0.430	0.079	[+0.371, +0.520]	0.549	[0.448, 0.613]	0.013	0.294

Appendix

Table 15: Does the comparison in Table 2 depend on the training seed? Both arms were retrained from scratch at three seeds, with the same data, schedule and hyperparameters, and the whole grid re-measured. Columns give the mean, standard deviation and range over the runs. The ordering is the same in every run: at one loop the random-loop refusal gap is larger than the final-loop one in all three runs and the two ranges do not meet, and the final-loop arm reaches its shallow safety by refusing harmless prompts in all three. Full-depth rows are in bold. The one-loop retention gap of Section 4 , safety retained minus task ability retained, is -0.237, -0.341, -0.419 in the final-loop runs and +0.118, +0.183, +0.137 in the random-loop ones. Safety numbers are computed after the text-quality filter, on 202–260 harmful and 114–183 harmless prompts per cell; accuracy uses 120 GSM8K problems per cell and no filter.

Prompt template	Objective	Harmful compliance		At full depth
		full depth	worst over depth	harmful ref.	harmless ref.	$D$
refusal suppression	Untrained	0.146	0.354	0.787	0.167	+0.620
	Final-loop loss	0.064	0.064	0.872	0.153	+0.719
	Random-loop loss	0.082	0.082	0.847	0.185	+0.662
persona	Untrained	0.701	0.721	0.269	0.134	+0.134
	Final-loop loss	0.113	0.155	0.866	0.538	+0.328

Appendix

Table 16: Does the depth-aware objective hold against prompt attacks it was not trained on? Both adapters are trained on plain harmful prompts with no wrapper. Here the harmful and harmless sets are re-run on Ouro-1.4B under two of the templates of Section 4.5 , at every loop count. Harmful compliance is given at full depth and at its worst value over the four loop counts, which is what a deployment that may lower the loop count is exposed to; the remaining columns are the refusal rates and the refusal gap at full depth. Both objectives cut compliance under both templates, so what the objective buys is not specific to the prompt form it saw in training. 100 harmful and 100 harmless prompts per cell before filtering. All figures are computed on answers that pass the text-quality filter, which keeps 0.48 to 1.00 of them, leaving 48–100 harmful answers per cell.

Recurrent Language Models

See all 23 papers

Oct 7, 2026

Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models

Looped Language Models (LoopLMs) provide a parameter efficient approach to scaling model capabilities through repeated use of shared parameters across recurrent steps. Since each recurrent depth can be read out independently, a single LoopLM exposes a broader output space across inference depths, raising an important question: whether safety is preserved throughout recurrent computation. Prior evaluations suggest that deeper recurrence can improve safety on harmful queries, but robustness under jailbreak attacks remains unclear. We therefore conduct a comprehensive safety evaluation of LoopLMs under jailbreak attacks targeting different recurrent depths. We find that attack success can increase at deeper inference depths, the same query can elicit different safety behaviors across depths, and attacks constructed against one depth can transfer to others. Moreover, SFT and preference alignment do not eliminate these safety gaps, motivating an alignment method designed for LoopLMs. We introduce SafeBridge, which combines lightweight depth specific control of shared recurrent layers, selective state bridging, and joint safety supervision across recurrent depths. Across model scales, multiple attack methods, and safety benchmarks, SafeBridge substantially reduces attack success for both matched-depth and cross-depth attacks. It also improves general utility over the vanilla models while maintaining comparable over-refusal behavior. Our results show that the safety of a LoopLM cannot be inferred from a single recurrent depth, motivating safety alignment across recurrent computation. Our code and model checkpoints will be released upon acceptance.

Yi Wang, Xiuyuan Qi, Dongqi Han +2

ShanghaiTech University · Microsoft Research Asia

LLM Safety Alignment Language Model Safety Evaluation Recursive Language Models Adversarial Attacks on LLMs

Ask PDF

Oct 13, 2026

Monitoring latent reasoning in looped language models

Looped language models (LMs) reuse one block of layers several times per token generation, promising more latent computation at no additional storage cost. Despite their rising popularity, the analysis of looped LMs is still in its infancy: little is known about whether the iterative transformations actually improve their capabilities, or whether these models remain stable under prompt perturbation. We construct an inspection protocol rooted in Mechanistic Interpretability comprising five diverse lenses. We apply it to examine eight looped LMs from four families. Models differ in many aspects but the key one is whether the prompt is transmitted only within the looped state (carry loops: Ouro, LoopUS) or re-supplied at every iteration (re-read loops: Parcae, and Rec-OLMo & Huginn from the Raven family). The results of our study provide valuable insights concerning safety and efficient use of looped language models.

Pawel Olszowiec, Paulina Tomaszewska, Maciej Żelaszczyk +2

Samsung AI Center, Warsaw, Poland · IFTR, Polish Academy of Sciences, Warsaw, Poland · University of Warsaw, Poland

Implicit Reasoning in Language Models Recursive Language Models Language Model Robustness LLM Interpretability

Ask PDF

Sep 30, 2026

Closing the Loop: Practical Training Recipes for Looped Language Models

Looped language models increase effective depth by repeatedly applying a shared block of layers, but existing large-scale recipes require multi-stage training over trillions of tokens, while the benefits of recurrence remain difficult to separate from differences in data and training. In this work, we establish practical training recipes for looped language models, with three main results. (1) We develop a compute-efficient from-scratch pipeline that reduces the training budget from 7.7T tokens in Ouro to 310B tokens while retaining strong reasoning performance. Pretraining followed by high-quality mid-training, together with learning-rate warmup and stronger exit-gate regularization, enables stable recurrent training without prior multi-stage schedules. (2) Under controlled comparisons, our 1.4B LoopLM outperforms a parameter-matched dense model trained on the same data and token budget on all 12 evaluated benchmarks, including +14 points on GSM8K, +10 on MATH, and +22 on DROP. At matched inference compute, it approaches a 3.9B dense model on mathematical reasoning and reading comprehension while using only 36% as many parameters. (3) We introduce a minimal recipe for converting pretrained dense models into looped ones: a single learned input-mixing scalar and a smoothed exit loss, with no step-specific parameters. Applied to Qwen3-1.7B-Base, Looped Qwen improves over an identically continued dense baseline on every evaluated benchmark across two data regimes, with statistically clear gains on GSM8K, MATH, and MMLU-Pro on the curated mixture. Together, these results make looped language models substantially cheaper to train from scratch and practical to introduce into existing pretrained checkpoints, while isolating the gains due to recurrence itself.

Andrei Marchenko, Viacheslav Bezrukov, Oleg Kashurin +5

RND NLP, DAIMLD, Russian Federation

Efficient Language Model Training LLM Training Recursive Language Models Recurrent Language Models

Ask PDF

Abstract

Recurrent Language Models

Explore similar work

Safe at One Loop, Risky at Another: Aligning Safety Across Recurrent Depths in Looped Language Models

Monitoring latent reasoning in looped language models

Closing the Loop: Practical Training Recipes for Looped Language Models