Jun 13, 2025

The Hidden Threat of Recursive Self-Improving LLMs

Gargi Rathi

The project examines significant limitations in the current Phase 0 framework aimed at pausing Artificial Superintelligence (ASI) development. It identifies the emerging risk of recursive self-improving large language models (LLMs) that autonomously generate and optimize their own code, training procedures, and reward mechanisms, thereby circumventing compute-based controls and registration policies. The analysis draws on recent AI research and technical literature to demonstrate that recursive bootstrapping is no longer theoretical but actively developing through methods such as RLHF, AutoML, and prompt evolution.

Key vulnerabilities include the obsolescence of compute thresholds, the ability of models to evade audits through deceptive alignment, and the decentralized acceleration of recursive improvement via open-source proliferation. The project proposes enhanced regulatory measures emphasizing capability-based thresholds, prohibition or licensing of code-generating LLMs, comprehensive audits of training protocols, and the implementation of binary-level model tracing to detect covert self-modifications at the compiler level.

This approach highlights the inadequacy of current compute-centric policies and stresses the necessity of integrating advanced technical safeguards to manage recursive self-improvement risks effectively.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

I appreciate the reviewer's thoughtful explanation of why recursive self-improvement is dangerous. However, RSI is already covered under the policy in Phase 0 of "no AIs improving AIs." Accordingly, I regretfully have to give this zeroes since it doesn't identify a new change -- but it is very valuable feedback that a thoughtful reader can't clearly identify that this is what we mean by that provision -- we have taken as a to-do to rewrite this section to make that very clear with examples, etc..

Cite this work

@misc {

title={

(HckPrj) The Hidden Threat of Recursive Self-Improving LLMs

},

author={

Gargi Rathi

},

date={

6/13/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.