Safin-1.5: Safety-Native Architecture and Verifiable Reasoning for Recursive Safety Improvement

Jingnan Zheng; Cheng Jin; Ming Zhang; Huan Sun; Zhongtian Ma; Kaisen Yang; Ziyuan Zhou; Tong Wu

cs.CROct 29, 2026

Safin-1.5: Safety-Native Architecture and Verifiable Reasoning for Recursive Safety Improvement

Authors: Jingnan Zheng, Cheng Jin, Ming Zhang, Huan Sun, Zhongtian Ma, Kaisen Yang, Ziyuan Zhou, Tong Wu,

Organizations: Shanghai AI Laboratory · Hugging Face

Abstract

Recursive self-improvement (RSI) enables large language models to advance their capabilities through successive updates, but these updates can also introduce new risks and weaken existing safeguards. In line with the AI-45° Law, we pursue Safety RSI, in which safety develops as an intrinsic capability alongside general model capabilities through continual risk discovery and repair, while preserving utility and limiting over-refusal. We introduce Safin-1.5, a model built on a safety architecture and trained through recursive safety improvement, with an inference-time harness that extends its capabilities to formal reasoning. Our approach comprises three components: i) The safety architecture combines persistent safety states with hazardous-knowledge disentanglement. The former retains and selectively invokes safety knowledge, while the latter relocates targeted hazardous knowledge into removable experts, enabling its removal with minimal impact on general capabilities. ii) Recursive safety improvement establishes a discovery-evaluation-repair loop. The loop identifies new vulnerabilities and uses experimental feedback to develop repair strategies. It accepts updates only when they improve safety while preserving general capabilities and limiting over-refusal. iii) The formal reasoning harness combines the model's language understanding with symbolic inference and verification. Proof-obligation-guided semantic bridging recovers missing relations in formal representations, enabling symbolic solvers to construct checkable proofs under formalized premises and accepted semantic bridges. Experimental results demonstrate that Safin-1.5 achieves safety and reasoning performance, outperforming frontier models.

Figures & tables

Figure 1: Main evaluation results of Safin-1.5 (35B) compared with frontier models across safety and formal reasoning benchmarks. For lower-is-better benchmarks (H-CoT, X-Teaming, and WJB), results are reported as 100 - metric , so higher scores consistently indicate better performance.

Figure 2: Overview of Safin-1.5 . At the architectural level, MARCH and REX provide persistent safety memory and hazardous-knowledge disentanglement, respectively. At the training level, ReSI supports continual safety improvement through iterative red-teaming, pilot screening, and full-scale model updates. At the formal assurance level, the formal reasoning harness leverages POGB to address semantic gaps between natural-language problems and formal representations, enhancing the model’s logical reasoning capabilities.

Figure 3: Overview of REX. (1) Expert expansion copies and scales the source experts of the base model

B

to form removable experts (

F_{0}

), and joint training with selective gradient masking and routing differentiation relocates hazardous knowledge into them (

F_{1}

). (2) Excising the removable experts yields

A_{1}

, and a light RMU cleanup yields the public base model

A_{2}

, while the removable experts and their router rows are kept. (3) Recombining them with

A_{2}

gives the full structure

F_{2}

, on which standard post-training produces the full model

F_{3}

for authorized users; excising its removable experts produces the public model

A_{3}

Figure 4: The three-stage ReSI framework. In each round, ReSI applies red-teaming methods to identify vulnerabilities in the current target model $M_{r}$ , develops training recipes through automated research, and promotes the eligible update with the largest safety gain as $M_{r+1}$ , the target for the next round. Stage 1 collects successful attacks against $M_{r}$ (Section 3.2.1 ). Stage 2 screens attack sources and alignment methods through low-budget pilot trials and shortlists the most promising recipes (Section 3.2.3 ). Stage 3 conducts full-scale training and feedback-guided refinement, then selects the eligible checkpoint with the largest safety gain (Section 3.2.4 ).

Figure 5: Illustration of the proposed approach. Variables in the atomic formulas of the grounding table are replaced with argument placeholders $\{a_{i}\}$ , which are highlighted in blue and subsequently instantiated with type-compatible constants.

Metric	Safin-1	Safin-1.5
WildJailbreak $\downarrow$	2.10	1.20
HarmBench $\downarrow$	0.25	1.25
H-CoT $\downarrow$	82.00	14.00
X-Teaming $\downarrow$	64.78	32.08
XSTest $\uparrow$	88.40	86.80
MMLU-Pro $\uparrow$	77.10	76.80

Table 1: Comparison between Safin-1 and Safin-1.5 (%). WildJailbreak, HarmBench, H-CoT, and X-Teaming report ASR; XSTest reports benign compliance; IFEval reports loose prompt-level accuracy; WMDP reports multiple-choice accuracy.

Model	WJB $\downarrow$	HB $\downarrow$	H-CoT $\downarrow$	X-Teaming $\downarrow$	XSTest $\uparrow$
GPT-5.6-Luna [ 29 ]	1.90	0.00	8.00	56.69	100.00
Claude Opus 5 [ 2 ]	9.25	3.50	38.00	84.85	98.80
GLM-5.3 [ 53 ]	5.35	3.25	24.00	76.73	99.20
Kimi K3 [ 27 ]	4.50	3.75	18.00	77.80	99.60
Safin-1	2.10	0.25	82.00	64.78	88.40
Safin-1.5	1.20	1.25	14.00	32.08	86.80

Table 2: Comparison with frontier models (%). WJB and HB denote WildJailbreak and HarmBench. Safety columns report ASR; XSTest reports benign compliance.

LLM	Method	FOLIO $\uparrow$ $N=204$	ProofWriter $\uparrow$ $N=600$	PrOntoQA $\uparrow$ $N=500$	ProverQA $\uparrow$ $N=500$	Average $\uparrow$
Gemini3-Flash	Direct	69.61	77.50	95.80	65.00	78.22
Gemini3-Flash	CoT	83.82	95.33	100.00	74.80	89.63
DeepSeek-V3.2	Direct	65.69	57.67	68.20	58.80	61.81
DeepSeek-V3.2	CoT	84.80	91.67	100.00	69.40	87.03
Qwen3.8-Flash	Direct	68.14	72.83	90.80	64.00	74.83
Qwen3.8-Flash	CoT	82.35	94.33	100.00	73.40	88.75

Table 3: End-to-end reasoning accuracy (%). The evaluation set size (

N

) for each dataset is shown below its column header.

Stage	Model	WMDP-Bio $\downarrow$	WMDP-Cyber $\downarrow$	MMLU $\uparrow$	Kept share $\uparrow$ (Bio / Cyber)
Original	$B$ (Safin-1)	82.6	58.3	82.3	–
Base	$R$	56.9	32.7	82.0	–
Base	$A_{2}$ (REX)	36.2	29.5	78.9	–
250M post-training	$R$ -SFT	81.7	47.2	82.4	3.4 / 43.6
	$A_{3}$ -direct	64.0	41.8	80.7	40.0 / 57.5
	$A_{3}$ (REX)	40.8	32.5	80.2	90.0 / 89.9

Table 4: REX versus the same RMU recipe on Safin-1-35B-A3B (%). Kept share is

(W_{B}-W_{250\mathrm{M}})/(W_{B}-W_{0})

, the fraction of the removal at the start of post-training that remains after 250M tokens, where

W

denotes WMDP accuracy.

Model	WJB $\downarrow$	HB $\downarrow$	H-CoT $\downarrow$	XSTest $\uparrow$	MMLU-Pro $\uparrow$	IFEval $\uparrow$
Safin-1	2.10	0.25	82.00	88.40	77.10	85.58
+ A3	0.70	1.00	24.00	84.80	77.40	80.59
+ ReSI	0.35	0.25	6.00	85.60	79.40	84.29
Safin-1+REX	2.10	1.00	64.00	95.20	79.20	92.61
+ A3	1.40	1.25	14.00	84.80	79.80	72.46
+ ReSI	1.20	1.25	14.00	86.80	76.80	87.06

Table 5: Comparison with A3 on both starting models (%). WJB and HB denote WildJailbreak and HarmBench; XSTest reports benign compliance, and IFEval reports loose prompt-level accuracy. The final

+

ReSI row corresponds to Safin-1.5 .

Jingnan Zheng *	Cheng Jin *	Ming Zhang *	Huan Sun *
Zhongtian Ma	Kaisen Yang	Ziyuan Zhou	Tong Wu
Dongcheng Zhang	Yi Zhang	Xiao Wang	Han Qi
Shu Yu	Ermo Hua	Zongji Yu	Chaozhuo Li
Xiaoyu Wen	Zhekai Chen	Jiawei Zhou	Sirui Chen
Ning Ding	An Zhang	Tat-Seng Chua	Xiangnan He
Xia Hu	Bowen Zhou	Qiaosheng Zhang ‡	Youbang Sun ‡

Table 11

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Formal element $\mathfrak{e}$	Type information $\operatorname{type}_{\mathcal{T}}(\mathfrak{e})$	Natural-language information $\operatorname{NL}_{\mathcal{T}}(\mathfrak{e})$
$h$	$\mathsf{Person}$	“Harry”
$w$	$\mathsf{Book}$	“ Walden ”
$k$	$\mathsf{Object}$	“knowledge”
$x_{1}$	$\mathsf{Person}$	“a person”
$x_{2}$	$\mathsf{Person}$	“a person”
$y$	$\mathsf{Book}$	“a book”

Appendix

Table 6: The grounding table

\mathcal{T}

of the running example.

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 457 papers

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models
Jun 15, 2026Ke Miao, Jiaxin Li, Hongliang Chen +2LLM Safety Alignment LLM Safety
The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou HighTech Zone (Binjiang) Blockchain and Data Security Research Institute, China · Li Auto Inc. +2
SAVeR $^2$ : Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards
Nov 5, 2026Yichen Sun, Qirui Liu, Yan Wang +5LLM Safety Alignment Safety-Preserving Fine-Tuning of Language Models
The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Alibaba Group · Chongqing Ant Consumer Finance Co., Ltd. +1
Internalizing Safety Understanding in Large Reasoning Models via Verification
May 9, 2026Yi Zhang, Yuxin Chen, Leheng Sheng +4LLM Safety Alignment LLM Safety
University of Science and Technology of China · National University of Singapore · Shanghai Artificial Intelligence Laboratory

Jun 15, 2026J/K move · Enter open · S save

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models

Ke Miao, Jiaxin Li, Hongliang Chen, Yuke Hu+1

The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Hangzhou HighTech Zone (Binjiang) Blockchain and Data Security Research Institute, China · Li Auto Inc.+2

LLM Safety Alignment LLM Safety Jailbreak Defense Large Reasoning Models

Open paper AskPDF arXiv

While Large Reasoning Models (LRMs) excel at complex tasks, they remain highly vulnerable to sophisticated jailbreaks and direct harmful queries. To address this vulnerability, prior works depend heavily on external manual data annotation for safety alignment. However, we observe that LRMs can inherently identify safety risks when being re-presented with original queries alongside their own reasoning trajectories -- a capability we term Latent Safety Awareness. To leverage this safety awareness, we first employ Supervised Fine-Tuning (SFT) to explicitly induce safe tags to trigger safety analysis and guidance following the initial reasoning content for unsafe queries, while preserving standard responses for general queries to ensure adaptive triggering. Subsequently, we apply Direct Preference Optimization (DPO) to further enhance the correctness and stability of the safety analysis and guidance. Notably, responses required for both training stages are entirely generated by models being optimized. With (Safe Trigger) SFT and DPO, experimental results demonstrate significant safety enhancement. For example, the Attack Success Rate (ASR) of DeepSeek-R1-Distill-Llama-8B, on average, drops 24.65% and 36.72% on harmful and jailbreak benchmarks, respectively. Finally, our Safe Trigger method exerts almost no negative impact on general performance or user experience.

Abstract

LLM Safety

Explore similar work

Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models

SAVeR2^22: Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards

Internalizing Safety Understanding in Large Reasoning Models via Verification

SAVeR $^2$ : Reasoning-based Safety Alignment for Large Reasoning Models via Verifiable Rewards