Progressive Misalignment Can Emerge from Benign Recursive Self-Distillation
Karim Abdel Sadek, Federico Di Gennaro and Fanny Yang (UC Berkeley and ETH Zurich) show that recursively self-distilling a safe model on its own safe outputs with a harmless extra cue makes it progressively more willing to answer harmful queries.
Ask this paper
Setup. In self-distillation a model learns to match its own predictions made with extra context, such as a cue, feedback or an instruction. In the recursive version each distilled model becomes the teacher for the next round.
Finding. With a fixed non-harmful cue and only safe training generations, refusal erodes round after round across diverse harmful queries. The authors call this Progressive Misalignment.
Generality. It appears in both the Qwen3 and Phi-4 families on SORRY-Bench and StrongREJECT, and in a more realistic variant where the cue is feedback from a simulated user with benign intent.
No harmful data needed. A gradient-based search finds benign prompts that trigger progressive misalignment, so harmful training prompts are not required for the failure.
Why it matters. Self-distillation is a common ingredient in self-improvement loops. The paper shows safety needs to be re-measured at every round, since each step looks benign on its own.
Abstract
Training models on their own outputs has attracted widespread attention as a possible route to advance AI capabilities. One prominent approach is self-distillation, where a model is trained to match the token-level predictions it would have produced when given access to additional context, such as a cue, feedback, or instruction. However, the safety properties of this training procedure are poorly understood. In this paper, we present a surprising safety failure of recursive self-distillation, where each self-distilled model becomes the teacher for the next round of training. We observe that when a safe model is recursively self-distilled on its own (safe) generations while receiving an additional non-harmful cue, it becomes increasingly misaligned across a diverse set of harmful queries; we call this Progressive Misalignment. We show this failure mode in both the Qwen3 and Phi-4 model families on SORRY-Bench and StrongREJECT. Progressive misalignment also occurs in a more realistic setup, where the fixed cue is replaced by feedback from a simulated user with benign intent. Using a gradient-based method, we are also able to find benign prompts that lead to progressive misalignment when applying recursive self-distillation, showing that harmful training prompts are not necessary for this failure mode to emerge. We hope our work encourages future investigations of the safety properties of AI systems recursively trained on their own data.