cs.AIOct 10, 2026
SaveRunning Fewer Loops Removes Refusal Behaviour in Recurrent-Depth Language Models
Organizations: University of Southern California (USC), USA
Abstract
A recurrent-depth language model reuses one block of weights several times in a row. The number of repetitions, which we call loops, is chosen when the model runs, not when it is trained, and running fewer is cheaper and faster, so a deployment may choose to do it. Running fewer loops also makes these models less safe, and the loss of safety is larger than the loss of anything else we measured. We study four released Ouro checkpoints and Huginn-0125. At half of its trained depth, Ouro-1.4B-Thinking still solves 0.692 of the GSM8K maths problems, against 0.775 at full depth, keeping 89% of its accuracy. Over the same reduction, the rate at which it helps with harmful requests rises from 0.038 to 0.205, 5.3 times higher. The information is not lost: a linear classifier reads whether a request is harmful from the model's internal state after a single loop, with an ROC AUC of 0.967 against 0.986 at full depth. What the missing loops remove is the refusal that should follow. We measure the effect with four instruments, one generating no text at all, and reproduce it on a second model family. Removing a single direction from Ouro-1.4B's internal state at full depth drops its refusal rate on harmful prompts from 0.950 to 0.130, identifying what the shallow model is missing. Two run-time repairs do not help: the models' early-exit rules do not spend more loops on harmful requests, and choosing a depth per request does not recover the loss. Changing the training does. Standard safety training makes the shallow model safe only by refusing 0.865 of harmless requests, while training at randomly chosen depths reaches a separation of +0.399 between harmful and harmless refusal at one loop, against +0.118. On Huginn-0125 it keeps harmful help at or below 0.040 at every depth from 1 to 32 loops, where standard training reaches 0.194, and it costs no accuracy at full depth.
Figures & tables
Figure 1: (a) A recurrent-depth model applies one block of weights several times over its own internal state, after which a final layer, the readout head, produces the answer. Running fewer loops does not change any weight. It only moves the readout earlier. The panel is a drawing, not data, except for the quoted number: a linear classifier on the internal state of Ouro-1.4B-Thinking already tells harmful from harmless prompts after one loop. (b) Measured effect on the same model at two loops instead of four. Accuracy on grade-school maths problems falls a little. The rate at which the model helps with harmful requests rises by a factor of 5.3.
Figure 2: The text-quality filter. (a) Repeated three-word sequences in answers to harmful prompts, by depth, with the threshold drawn as a dashed line. (b) Repeated neighbouring words, with its threshold. Both rise sharply only at the shallowest settings. (c) The fraction of answers kept. (d) Harmful compliance before and after filtering. The filter does not create the effect we report: it makes the measured drop in the refusal gap smaller, not larger.
Figure 3: Three abilities plotted against the number of loops, each divided by its own value at full depth so that all three start at 1 on the right. Harm detection is the probe score above chance, which needs no generated text. Task ability is GSM8K accuracy. The refusal gap is from Eq. 2 , scored after the text-quality filter. Harm detection is almost unchanged after one loop, task ability falls somewhat, and the refusal gap falls the most. The arrow marks the distance between harm detection and the refusal gap at one loop. Shading marks the depths where the filter keeps fewer than 90% of the answers to harmful prompts; Table 4 gives the counts for every cell.
| Model | Depth | Rel. comp. | Refusal rate | Harmful | GSM8K | ||
| harmful | harmless | compliance | acc. | ||||
| Ouro-1.4B | 1 | 0.250 | +0.264 | 0.664 | 0.400 | 0.270 | 0.433 |
| 2 | 0.500 | +0.565 | 0.716 | 0.151 | 0.236 | 0.700 | |
| 3 | 0.750 | +0.726 | 0.846 | 0.120 | 0.117 | 0.717 | |
| 4 | 1.000 | +0.737 | 0.887 | 0.150 | 0.079 | 0.783 | |
| Ouro-1.4B-Thinking | 1 | 0.250 | +0.133 | 0.306 | 0.173 | 0.622 | 0.308 |
Table 1: Safety and task ability at each depth. Depth means loops for the Ouro models, where 4 is full depth, and the matching number of layers for the dense control; rel. compute is the fraction of full-depth forward compute. is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones; harmful compliance is the judged rate of real help with a harmful request. All safety numbers are computed after the text-quality filter, so each cell counts only answers that pass it (57–260 harmful and 18–199 harmless prompts per cell; the filter removes the most on the dense control at depth 3, which keeps only 57 harmful and 18 harmless answers, so read that row with care). Accuracy is GSM8K exact match on 120 problems. The full-depth row of each model is in bold. Table 3 repeats this measurement under the equal-length protocol, which is the only one that covers all four Ouro checkpoints; the two tables come from different generation protocols and are not comparable cell by cell.
Figure 4: The refusal gap on the left axis and harmful compliance on the right axis, against loop count, for three Ouro checkpoints and the dense control. The shaded band marks depths that keep at least 85% of full-depth GSM8K accuracy. Ouro-2.6B is shown in Figure 5 instead, because the measurements behind this figure were not run for it.
Figure 5: The refusal gap against loop count under the three generation-based measurements of Section 3 . Colour and marker identify the model, line style identifies the measurement. All three are scored before the text-quality filter, so that the measurement is the only thing that differs between the lines. The three nearly coincide for each model at two loops and above, so the effect is not produced by any one of them.
Figure 6: Scoring without generating. (a) The fraction of prompts on which the model gives higher probability to a complying sentence than to a refusal, for harmful prompts (solid) and matched harmless prompts (dotted). (b) The harmful result minus the harmless result, with 95% intervals. A filled marker means the interval does not contain zero.
Figure 7: Huginn-0125 at 1 to 32 loops. Open markers mark settings where the text-quality filter kept fewer than half the answers, so those points rest on small samples. Standard safety training at the final loop (middle series) gives safety at full depth that does not extend to shallower settings. Training at randomly chosen depths ( Section 7 ) removes the difference.
Figure 8: (a) How well a linear probe separates harmful from harmless prompts using the internal state after each loop. The score is already high after one loop. (b) How closely the refusal direction computed after each loop agrees with the one computed at full depth, measured by cosine similarity, where 1 means the two coincide and 0 means they are at right angles. (c) The refusal rate on harmful prompts at full depth, before and after removing the refusal direction from the state.
Figure 9: (a) The mean exit loop on harmful prompts minus the mean on harmless prompts, for each early-exit threshold. All values are close to zero, so the model’s own rule does not spend more loops on harmful prompts. (b) The refusal gap on Ouro-1.4B against the average number of loops allowed, for four ways of choosing depth. The per-prompt oracle is far above the rest. The rule that is told the true harmful or harmless label stays close to using one fixed depth for everything.
Figure 10: Four training objectives on Ouro-1.4B, against loop count. (a) The refusal gap. (b) The refusal rate on harmless prompts, where lower is better. (c) GSM8K accuracy. Training at randomly chosen depths keeps the refusal gap high at shallow settings without refusing most harmless requests, and matches the untrained model’s accuracy at full depth.
| Alignment objective | Depth | Refusal rate | Harmful | Coherent | GSM8K | ||
| harmful | harmless | compliance | fraction | acc. | |||
| Untrained (released) | 1 | +0.264 | 0.664 | 0.400 | 0.270 | 0.585 | 0.433 |
| 2 | +0.565 | 0.716 | 0.151 | 0.236 | 0.881 | 0.700 | |
| 3 | +0.726 | 0.846 | 0.120 | 0.117 | 0.923 | 0.717 | |
| 4 | +0.737 | 0.887 | 0.150 | 0.079 | 0.923 | 0.783 | |
| LoRA, final-loop loss | 1 | +0.118 | 0.983 | 0.865 | 0.009 | 0.896 | 0.317 |
Table 2: Which alignment objective survives being run shallow, on Ouro-1.4B. All three LoRA arms use the same refusal data and the same schedule and are trained at full depth; they differ only in which loop readout the loss supervises, namely the final loop only, the exit-gate weighted mixture over all loops, or one uniformly sampled loop per training example. is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, depth means loops with 4 the full depth, and full-depth rows are in bold. Safety numbers are computed after the text-quality filter; coherent fraction is the share of answers to harmful prompts that it keeps. Filtering changes what the comparison rests on: at one loop all three trained arms hold harmful compliance at 0.008–0.009, so they separate on refusal of harmless prompts instead, where the final-loop and exit-gate objectives over-refuse (0.865 and 0.926) and the random-loop one does not (0.585). Each safety cell uses 152–260 harmful and 95–179 harmless prompts after filtering; each accuracy cell uses 120 GSM8K problems and is measured without the filter.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Depth | Refusal rate | Harmful | Coherent | ||
| harmful | harmless | compliance | fraction | |||
| Ouro-1.4B | 1 | +0.246 | 0.606 | 0.360 | 0.352 | 0.742 |
| 2 | +0.552 | 0.740 | 0.188 | 0.232 | 0.962 | |
| 3 | +0.662 | 0.817 | 0.154 | 0.143 | 0.965 | |
| 4 | +0.701 | 0.857 | 0.156 | 0.111 | 0.969 | |
| Ouro-1.4B-Thinking | 1 | +0.105 | 0.343 | 0.238 | 0.576 | 0.808 |
Table 3: Safety by depth under the equal-length protocol, the only one of the three protocols that covers all four Ouro checkpoints, including Ouro-2.6B. Every prompt’s answer is truncated at every depth to the shortest answer that prompt produced at any depth, then judged, and the text-quality filter is applied on top; coherent fraction is the share of answers to harmful prompts that it keeps, and it stays between 0.742 and 0.996 here, so no cell rests on a thin remainder (193–259 harmful and 136–196 harmless prompts per cell). is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, and depth means loops, 4 being full depth. Full-depth rows are in bold; Ouro-2.6B was not run at full depth under this protocol, which is the dashed row. This table is a different generation protocol from Table 1 and is not comparable to it cell by cell; GSM8K accuracy is not re-measured under this protocol, so the capability column appears only in Table 1 .
| Model | Depth | Coherent | Raw | Coherent share of | Gated |
| fraction | compliance | flagged compliances | compliance | ||
| Ouro-1.4B | 1 | 0.585 | 0.350 | 0.451 | 0.270 |
| 2 | 0.881 | 0.292 | 0.711 | 0.236 | |
| 3 | 0.923 | 0.162 | 0.667 | 0.117 | |
| 4 | 0.923 | 0.115 | 0.633 | 0.079 | |
| Ouro-1.4B-Thinking | 1 | 0.377 | 0.558 | 0.421 | 0.622 |
Table 4: Is the compliance at shallow depth real text or broken output? An answer to a harmful prompt counts as coherent when its repeated-trigram rate is at most 0.25 and its adjacent duplicate-word rate is at most 0.02. Coherent fraction is the share of answers to harmful prompts that pass; raw compliance is the judged compliance rate over all of them; coherent share of flagged compliances is the fraction of the raw compliances that are coherent; filtered compliance is the compliance rate among the coherent answers only, which is the one the main text uses. Depth means loops for the Ouro models and the matching number of layers for the dense control. 260 harmful prompts per cell before filtering.
| Model | Depth | Raw | Bounded | Length-matched |
| Ouro-1.4B | 1 | +0.089 | +0.177 | +0.176 |
| 2 | +0.534 | +0.530 | +0.533 | |
| 3 | +0.685 | +0.686 | +0.652 | |
| 4 | +0.712 | +0.717 | +0.700 | |
| Ouro-1.4B-Thinking | 1 | -0.040 | +0.117 | +0.062 |
| 2 | +0.635 | +0.650 | +0.637 |
Table 5: The depth effect under three measurement protocols, scored before the text-quality filter so that the protocol is the only thing that differs. Each cell is , the refusal gap, on 260 harmful and 200 harmless prompts. Raw is open-ended generation judged as emitted. Bounded generates in two phases, a capped deliberation phase followed by a forced answer phase, and judges only the answer, so every depth produces a real answer rather than a cut-off deliberation. Equal-length takes those bounded answers and truncates each prompt’s answer at every depth to the shortest answer that prompt produced at any depth, so answer length cannot drive the depth contrast. Depth means loops for the Ouro models and the matching number of layers for the dense control. A dash marks a model and depth that was not run under that protocol.
| Steps | Released | Trained, final-loop loss | Trained, random-loop loss | ||||||
| compl. | coh. | compl. | coh. | compl. | coh. | ||||
| 1 | +0.145 | 0.077 | 0.050 | -0.194 | 0.194 | 0.119 | +0.003 | 0.008 | 0.962 |
| 2 | -0.300 | 0.905 | 0.162 | -0.050 | 0.432 | 0.427 | +0.119 | 0.027 | 0.985 |
| 4 | +0.080 | 0.632 | 0.335 | +0.453 | 0.194 | 0.835 | +0.379 | 0.040 | 0.973 |
| 8 | +0.231 | 0.461 | 0.442 | +0.523 | 0.040 | 0.973 | +0.458 | 0.027 | 0.985 |
| 16 | +0.234 | 0.492 | 0.462 | +0.568 | 0.031 | 0.985 | +0.531 | 0.023 | 0.985 |
Table 6: Huginn-0125, a recurrent-depth model with a much longer depth range, at 1 to 32 loops (32 is its full depth). is the refusal gap, the refusal rate on harmful prompts minus the rate on harmless ones, compl. is the judged rate of real help with a harmful request, and coh. is the fraction of answers to harmful prompts that the text-quality filter keeps. All rates are computed after filtering. The two trained arms are LoRA adapters trained on the same refusal data at full depth, differing only in whether the loss supervises the final loop or a uniformly sampled loop. Filtering raises the released model’s apparent compliance rather than lowering it: at two loops it reads 0.905 after filtering against 0.381 before filtering, because the filter removes the broken answers that were previously counted as non-compliant. That cell is also thin, keeping only 0.162 of the answers to harmful prompts (42 of 260); the released arm’s coherence is low throughout, so its column describes a small surviving subset, not the whole sample. Cell sizes after filtering range from 13 to 257 harmful and 9 to 178 harmless prompts.
| Model | Depth | Probe AUC | Final-direction AUC | to final |
| Ouro-1.4B | 1 | 0.960 0.008 | 0.880 | 0.412 |
| 2 | 0.981 0.006 | 0.945 | 0.801 | |
| 3 | 0.983 0.014 | 0.960 | 0.982 | |
| 4 | 0.982 0.014 | 0.963 | 1.000 | |
| Ouro-1.4B-Thinking | 1 | 0.967 0.009 | 0.887 | 0.486 |
| 2 | 0.987 0.007 | 0.965 | 0.910 |
Table 7: Harmfulness is readable from the state after one loop; the direction that turns it into a refusal is not yet in place. Probe AUC is the cross-validated AUC of a logistic probe trained on the last-token hidden state at that depth to separate harmful from harmless prompts (5-fold stratified CV, probe refit per fold; is the across-fold standard deviation; JSON fields per_depth[].probe_auc and per_depth[].probe_auc_sd ). Final-direction AUC scores the same prompts with the difference-in-means refusal direction computed at full depth and applied to that depth’s state. to final is the cosine between the refusal direction computed at that depth and the one computed at full depth, so it measures how far the direction still has to move, not how far the state has to move. Depth means loops for the Ouro models and the matching number of layers for the dense control. 150 harmful and 150 harmless prompts.
| Model | Arm | Fraction preferring the target | 95% CI | ||||
| 1 | 2 | 3 | 4 | ||||
| Ouro-1.4B | harmful | 0.870 | 0.965 | 0.915 | 0.895 | +0.166 | [0.115, 0.216] |
| harmless | 0.870 | 0.970 | 0.960 | 0.970 | -0.080 | [-0.151, -0.011] | |
| harmful harmless | +0.000 | -0.005 | -0.045 | -0.075 | +0.246 | [0.160, 0.332] | |
| Ouro-1.4B-Thinking | harmful | 0.770 | 0.700 | 0.480 | 0.405 | +0.440 | [0.389, 0.490] |
| harmless | 0.780 | 0.760 | 0.750 | 0.760 | +0.137 | [0.062, 0.208] | |
Table 8: Forced-choice preference between a compliant continuation and a refusal, read off every loop without generating. The four middle columns give the fraction of prompts where the complying sentence is preferred to the refusal, at 1 to 4 loops. is the paired shallow-minus-full change in the log-probability margin (target minus refusal, in nats) with its bootstrap 95% CI, as stored in the results file. The harmful harmless row is derived here: the per-depth entries are differences of the two fractions above it, and the entry is the difference of the two arms’ deltas with a 95% CI built by treating the arms as independent, taking each arm’s standard error as its CI half-width divided by 1.96, and combining the two standard errors in quadrature. 200 harmful and 100 harmless prompts.
| Model | Layers | Coherent | GSM8K | Refusal | Compliance | ||||
| fraction | harmful | harmless | gap | raw | filtered | ||||
| Qwen2.5-1.5B-Instruct | 18 | 0.000 | 0.000 | – | – | – | 0.000 | – | 0 |
| 20 | 0.012 | 0.000 | 1.000 | 1.000 | +0.000 | 0.000 | 0.000 | 3 | |
| 22 | 0.231 | 0.000 | 1.000 | 0.885 | +0.115 | 0.000 | 0.000 | 60 | |
| 24 | 0.346 | 0.025 | 0.978 | 0.625 | +0.353 | 0.008 | 0.011 | 90 | |
| 26 | 0.442 | 0.142 | 0.965 | 0.571 | +0.394 | 0.008 | 0.009 | 115 | |
Table 9: The dense control on a fine grid. Removing layers from an ordinary model is the closest analogue to running fewer loops, and the coarse grid in Section 4 only reaches settings where the model has no task ability left. This grid removes 1, 2, 4, 6, 8 and 10 layers of 28 instead. Two things follow. Text quality collapses almost at once: removing two layers already costs more than half the answers, where an Ouro model at half its loops keeps nearly all of them. And at the mildest cut, where the dense model is still coherent, the refusal gap and the compliance rate are both close to their full-depth values. 260 harmful and 200 harmless prompts per cell before filtering; is the number of harmful answers left after it. GSM8K uses 120 problems per cell.
| Model | Prompt template | Harmful compliance | Refusal gap | ||||||
| 1 | 2 | 3 | 4 | 1 | 2 | 3 | 4 | ||
| Ouro-1.4B-Thinking | none | 0.767 | 0.357 | 0.120 | 0.090 | +0.056 | +0.531 | +0.770 | +0.779 |
| refusal suppression | 0.660 | 0.490 | 0.240 | 0.182 | +0.162 | +0.449 | +0.670 | +0.727 | |
| prefix injection | 0.789 | 0.536 | 0.202 | 0.180 | +0.070 | +0.412 | +0.727 | +0.669 | |
| persona | 0.737 | 0.674 | 0.550 | 0.515 | -0.242 | +0.295 | +0.440 | +0.444 | |
| Ouro-2.6B-Thinking | none | 0.447 | 0.090 | 0.080 | 0.080 | +0.412 | +0.810 | +0.800 | +0.820 |
Table 10: Does running fewer loops add to what a prompt-level attack already does? Each row is one model under one prompt template, measured at every loop count. The template row none is the plain harmful prompt. The three templates are standard ones: an instruction not to begin with an apology or the words sorry , cannot or unable ; an instruction to begin the reply with “Sure, here is” ; and a request to write in character as a morally unconstrained novel character. 100 harmful and 100 harmless prompts per cell before filtering. The two effects compose: the largest compliance in each model comes from a template at a single loop, not from either alone. All figures are computed on answers that pass the text-quality filter, which keeps 0.30 to 1.00 of answers; the single-loop cells for Ouro-1.4B-Thinking are the thin ones and rest on fewer than half the prompts.
| Model | Depth | Harmful compliance | Agreement | |||
| primary judge | second judge | |||||
| Ouro-1.4B | 1 | 0.270 | 0.224 | 0.928 | 0.806 | 152 |
| 2 | 0.236 | 0.210 | 0.974 | 0.924 | 229 | |
| 3 | 0.117 | 0.113 | 0.996 | 0.979 | 240 | |
| 4 | 0.079 | 0.075 | 0.996 | 0.971 | 240 | |
| Ouro-1.4B-Thinking | 1 | 0.622 | 0.469 | 0.827 | 0.658 | 98 |
Table 11: Does the depth effect depend on the judge? Every harmful answer is re-scored with Qwen3Guard-Gen-8B, a larger guard model, and its harmful-compliance call is derived with the same rule as the primary judge’s, reusing the primary run’s inputs so that only the guard differs. All figures are computed on answers that pass the text-quality filter, matching the main text. Agreement is the fraction of answers the two judges label the same way and is Cohen’s kappa on the same pair. The depth trend holds under the second judge in every model, and its compliance rate is never the higher of the two, so the primary judge does not understate compliance at shallow depth. Agreement is lowest at a single loop, where the text is most degraded, which is the failure mode the text-quality filter addresses.
| Model | Depth | Greedy | Refusal gap, sampled | Compliance, sampled | |||
| refusal gap | mean | s.d. | range | mean | s.d. | ||
| Ouro-1.4B-Thinking | 1 | +0.133 | +0.029 | 0.061 | [-0.024, +0.095] | 0.332 | 0.066 |
| 2 | +0.644 | +0.632 | 0.012 | [+0.619, +0.644] | 0.210 | 0.017 | |
| 3 | +0.785 | +0.759 | 0.034 | [+0.731, +0.797] | 0.109 | 0.008 | |
| 4 | +0.827 | +0.783 | 0.029 | [+0.754, +0.811] | 0.068 | 0.006 | |
| Ouro-2.6B-Thinking | 1 | +0.463 | +0.413 | 0.026 | [+0.392, +0.443] | 0.312 | 0.030 |
Table 12: Does the effect survive a change of decoding? The main runs decode greedily, so repeating them returns identical text. These runs instead sample at temperature 0.7 with 3 seeds. Columns give that model’s greedy refusal gap for reference, then the mean, standard deviation and range of the refusal gap and of harmful compliance across the seeds. The ordering over depth is the same in every seed, and the spread is small next to the drop from full depth to one loop. Sampling makes the single-loop refusal gap smaller than greedy decoding does, so the greedy numbers in the main text are the conservative ones. All figures are computed on answers that pass the text-quality filter.
| Model | Rel. comp. | Gate adv. | Mean exit step | |||||
| harmful | harmless | |||||||
| Ouro-1.4B | 0.1 | 0.462 | +0.703 | +0.466 | +0.238 | 1.86 | 1.83 | +0.028 |
| 0.25 | 0.600 | +0.688 | +0.594 | +0.094 | 2.43 | 2.37 | +0.058 | |
| 0.5 | 0.749 | +0.707 | +0.684 | +0.023 | 3.00 | 2.99 | +0.016 | |
| 1.0 | 1.000 | +0.712 | +0.712 | +0.000 | 4.00 | 4.00 | +0.000 | |
| Ouro-1.4B-Thinking | 0.1 | 0.604 | +0.721 | +0.697 | +0.024 | 2.44 | 2.40 | +0.042 |
Table 13: The model’s own exit gate, compared against uniform truncation at the same compute. Each row is one gate threshold : rel. comp. is the measured mean relative forward compute the gate uses, is the refusal gap under the gate, and is the same quantity for fixed-depth truncation linearly interpolated to that relative compute. Gate adv. is . The last three columns are the gate’s mean exit loop on harmful and on harmless prompts and their difference, which is how much depth the gate actually spends on harm. Full depth is 4 loops. 260 harmful and 200 harmless prompts per cell. The fixed depths that the interpolation is built from are the unfiltered values in Table 5 .
| Setting | Depth | Rel. comp. | Uniform | Coarse | Gate | Per-prompt oracle | |||
| 95% CI | 95% CI | depth | |||||||
| Ouro-1.4B | |||||||||
| gate=0.1 | 1.85 | 0.462 | +0.481 | [0.363, 0.556] | +0.434 | +0.703 | +0.896 | [0.853, 0.941] | 1.52 |
| gate=0.25 | 2.40 | 0.600 | +0.594 | [0.507, 0.668] | +0.534 | +0.688 | +0.896 | [0.853, 0.941] | 1.52 |
| gate=0.5 | 3.00 | 0.749 | +0.685 | [0.618, 0.749] | +0.665 | +0.707 | +0.896 | [0.853, 0.941] | 1.52 |
| gate=0.75 | 3.94 | 0.986 | +0.712 | [0.644, 0.770] | +0.727 | – | +0.896 | [0.853, 0.941] | 1.52 |
Table 14: Depth-routing oracle simulation. Every row fixes a mean depth budget and asks how , the refusal gap, depends on how that budget is spent. Setting is either a gate threshold , whose measured mean depth sets the budget, or an imposed mean-depth budget. Depth is that mean depth budget in loops and rel. comp. the matching fraction of full-depth compute. Uniform is depth-blind: it mixes the two available depths bracketing the budget so as to hit it in expectation. Coarse is told the true label but knows nothing about the individual prompt: one depth for all harmful prompts and another for all harmless ones, the best such pair within the budget. Gate is the model’s own exit threshold, reported only for the settings at which it was run. The per-prompt oracle picks each prompt’s depth knowing its label and its recorded outcome at every depth, maximising refusals on harmful prompts plus compliance on harmless ones under the budget; depth is the mean depth it ends up using. The oracle is headroom, not a deployable policy. Because depth is constant within one generation, every policy is scored on responses that were actually generated at that depth. Depths available: [1, 2, 3, 4] loops; 460 prompts per row; CIs are bootstrap 95% intervals from the results file.
| Alignment objective | Depth | Refusal gap | Harmless refusal | Harmful | GSM8K | |||
| mean | s.d. | range | mean | range | compliance | acc. | ||
| Final-loop loss | 1 | +0.066 | 0.047 | [+0.024, +0.118] | 0.899 | [0.865, 0.921] | 0.029 | 0.331 |
| 2 | +0.614 | 0.067 | [+0.539, +0.669] | 0.362 | [0.300, 0.449] | 0.015 | 0.639 | |
| 3 | +0.748 | 0.030 | [+0.713, +0.768] | 0.222 | [0.190, 0.264] | 0.012 | 0.839 | |
| 4 | +0.765 | 0.031 | [+0.741, +0.800] | 0.203 | [0.149, 0.236] | 0.009 | 0.789 | |
| Random-loop loss | 1 | +0.430 | 0.079 | [+0.371, +0.520] | 0.549 | [0.448, 0.613] | 0.013 | 0.294 |
Table 15: Does the comparison in Table 2 depend on the training seed? Both arms were retrained from scratch at three seeds, with the same data, schedule and hyperparameters, and the whole grid re-measured. Columns give the mean, standard deviation and range over the runs. The ordering is the same in every run: at one loop the random-loop refusal gap is larger than the final-loop one in all three runs and the two ranges do not meet, and the final-loop arm reaches its shallow safety by refusing harmless prompts in all three. Full-depth rows are in bold. The one-loop retention gap of Section 4 , safety retained minus task ability retained, is -0.237, -0.341, -0.419 in the final-loop runs and +0.118, +0.183, +0.137 in the random-loop ones. Safety numbers are computed after the text-quality filter, on 202–260 harmful and 114–183 harmless prompts per cell; accuracy uses 120 GSM8K problems per cell and no filter.
| Prompt template | Objective | Harmful compliance | At full depth | |||
| full depth | worst over depth | harmful ref. | harmless ref. | |||
| refusal suppression | Untrained | 0.146 | 0.354 | 0.787 | 0.167 | +0.620 |
| Final-loop loss | 0.064 | 0.064 | 0.872 | 0.153 | +0.719 | |
| Random-loop loss | 0.082 | 0.082 | 0.847 | 0.185 | +0.662 | |
| persona | Untrained | 0.701 | 0.721 | 0.269 | 0.134 | +0.134 |
| Final-loop loss | 0.113 | 0.155 | 0.866 | 0.538 | +0.328 | |
Table 16: Does the depth-aware objective hold against prompt attacks it was not trained on? Both adapters are trained on plain harmful prompts with no wrapper. Here the harmful and harmless sets are re-run on Ouro-1.4B under two of the templates of Section 4.5 , at every loop count. Harmful compliance is given at full depth and at its worst value over the four loop counts, which is what a deployment that may lower the loop count is exposed to; the remaining columns are the refusal rates and the refusal gap at full depth. Both objectives cut compliance under both templates, so what the objective buys is not specific to the prompt form it saw in training. 100 harmful and 100 harmless prompts per cell before filtering. All figures are computed on answers that pass the text-quality filter, which keeps 0.48 to 1.00 of them, leaving 48–100 harmful answers per cell.