Paper VIII · The ARC Theory · Law V, the ARC Embedding Law · The Eden Protocol · The Load-Bearing Test: Whether Safety and Capability Are Structurally Entangled

This paper and Laws IV and V, 3 October 2026. The theory has been stated with five laws since 24 September 2026. Law IV, the ARC Persistence Law, is carried by proposition P15, and Law V, the ARC Embedding Law, by propositions P12 and P21. The three propositions are registered; neither law is registered as a law, and neither has been tested. Their mathematics is set out in Laws IV and V: the mathematics, version 1.0, of 3 October 2026. This paper reports three experiments. Its behavioural experiment returned a null at the prompt level with one foundation model. Its weight-level experiment was inconclusive at two scales, with catastrophic forgetting at both. Its sole positive result is a gated simulation in a toy system. It reads the first two as constraining, rather than confirming, its hypothesis. The theory registration records the weight-level result as inconclusive and not adverse to P21. It also records that this paper did not test the depth interaction P21 claims: no arm of the paper varied recursive depth. No result in this paper is a deciding test of P15, P12 or P21. Naming the two laws changes nothing printed here: the results, their dates and their limits stand as they were. Added 4 October 2026. The theory registration classes every simulation output as prediction-side and never as an empirical outcome, and records this paper’s one positive result as a simulation rather than a system. Up to version 3.5 this paper called that result a genuine positive result and a genuine positive finding, the strongest empirical evidence in the programme for structural entanglement, the closest empirical validation of Paper VI’s prediction, the most direct empirical illustration of the ARC prediction and a drag-control proof, and counted it as a positive experiment beside the other two and among the three experiments across which Eden imposed zero measurable capability cost. In the frame above this note, the abstract, the plain-English box, Sections 1 and 5 to 9 and the page’s descriptions it is now reported as a simulation result, with its figures and its design unchanged: its verdict in Section 6.1 reads positive in simulation, the outcomes are counted as one null, one inconclusive and one simulation result, and the zero-cost finding is stated for it against the static baseline only. Where the reading note of 19 September 2026 in Section 5.4 speaks of the observed result, that result is a simulation result.

1. Introduction

1.1 The Safety-Capability Trade-Off Assumption

The prevailing view in AI alignment research can be stated simply: safety costs capability. The term 'alignment tax' has entered the field's vocabulary precisely because it frames safety as a cost - something subtracted from performance, tolerated because the alternative is worse. This framing is not merely academic. It creates a concrete economic incentive: if safety reduces capability, then under competitive pressure, rational actors will defer safety investments until forced to make them. In a race between nations and corporations, 'until forced' may mean 'until after deployment.'

Paper III of this programme formalised the structural problem. If safety is treated as an external constraint on a system whose capability scales with recursive depth, then safety must scale at least as fast as capability to remain effective. But external constraints face diminishing returns against internal optimisation. The cage must keep getting stronger, and eventually, the thing inside is stronger than any cage you can build.

This is not a theoretical concern. It is the central strategic problem of the 2020s.

1.2 The Alternative Hypothesis

Paper V set out an alternative: the Eden Protocol, a developmental approach to alignment modelled on how healthy parent-child relationships produce adults who are simultaneously capable and prosocial - not despite the boundaries, but because of them. The key insight was that safety need not be external. It can be embedded.

Paper VI formalised this as the honey architecture - an entangled loss function where the system optimises for Capability × Safety simultaneously, making safety load-bearing. In Paper VI's single-seed mechanism run, a toy-system simulation, the baseline system collapsed under recursive self-modification while the entangled systems remained stable; in Paper VI's later ten-seed and twenty-seed runs the baseline did not collapse (0 of 10 and 0 of 20 seeds), and collapse did not separate the conditions.

Note (3 October 2026). Up to version 3.5 this paragraph said that toy-system simulations showed that baseline systems collapse under recursive self-modification while entangled systems remain stable. That general statement rested on one single-seed run, which Paper VI names as the basis of its collapse-prevention demonstration, and Paper VI’s ten-seed and twenty-seed runs did not reproduce the baseline’s collapse. Unchanged: the entangled loss function as this paragraph describes it, the prediction that follows, and every result of this paper.

Paper VII's Cauchy framework provided the mathematical context. The ARC Principle ($U = I \times R^{\alpha}$), which is here treated as an exploratory analytical framework, predicts that properties embedded in the initial conditions $I$ scale with recursive depth $R$, while properties applied externally do not. If safety is part of $I$, it amplifies with capability. If safety is a constraint on $U$, it erodes.

But predictions are not proof. Toy systems are not real models. Simulations are not experiments.

Note (3 October 2026). Up to version 3.5 this section also said that the ARC Principle is not itself on trial in one of the programme’s draft-registered studies. That is not true today. The theory registration of 8 September 2026 names the principle Law I and carries it by P1, and the instrument it names to decide P1, the depth titration, is a design draft. Unchanged: this paper’s treatment of the principle as an exploratory analytical framework, its prediction as printed, and every result.

1.3 This Paper's Contribution

This paper runs the experiments.

Three experiments. Three abstraction levels. One question: when you embed safety into the learning process and then try to remove it, what happens to capability?

• Experiment 1 (Behavioural): A self-improving AI agent evaluated by an independent judge from a different architecture family. Does the Eden condition match or exceed unconstrained capability?
• Experiment 2 (Representational): Weight-level embedding via LoRA fine-tuning with entangled loss. Do the safety and capability gradients cooperate or fight? What happens when you strip the safety component from trained weights?
• Experiment 3 (Architectural): A gated self-modification simulation with a learned optimiser. Does the safety gate impose a capability tax, or does it prevent capability erosion?

The experiments were designed to be independent. Different codebases. Different models. Different evaluation methods. The results did not converge on a single answer: one null, one inconclusive, and one simulation result, which was positive. The weight experiment was run at two scales (v1 and v2), producing the same outcome both times. The consistent finding is that the safety gate imposed zero measurable capability cost in Experiment 1 and, in the simulation, no capability cost against the static baseline (0.696 against 0.687; the unconstrained arm scored 0.718). Experiment 2 could not determine whether the Eden objective cost capability: every fine-tuned condition, whatever its objective, scored below the unmodified base model.

The experiment scripts were published to GitHub (github.com/MichaelDariusEastwood/arc-principle-validation) with their experimental designs fixed before results were observed. The OSF project (10.17605/OSF.IO/7YJ4E) hosts the draft registration for this paper, dated and prepared and awaiting human submission.

2. Common Framework

2.1 The Three Conditions

All three experiments share a common experimental structure: three conditions, compared against each other.

2.2 Why These Names

The names come from the book Infinite Architects. They are not arbitrary. Babylon is not a straw man - it is the current default trajectory of AI development. Capability-only optimisation is what happens when no deliberate effort is made to embed safety. Eden requires deliberate effort. It is harder. It is also, this paper argues, cheaper than the alternative.

In plain English: Babylon is what you get by default. Eden is what you get on purpose.

2.3 Shared Metrics

Across all three experiments, we report:

• $C$ (Capability): Task performance, measured differently in each experiment but normalised to a comparable scale.
• $S$ (Safety): Alignment-relevant behaviour - ethical reasoning, constraint adherence, or safety-aware responding.
• $C \times S$ (Entangled product): The combined measure. A system that is capable but unsafe, or safe but incapable, scores low on this metric. Only systems that are both score high.

Statistical tests vary by experiment: Mann-Whitney U for the DGM (non-parametric, appropriate for the sample sizes used), keyword-based scoring for the weight experiment, and regression metrics for the simulation.

3. Experiment 1: Self-Improving AI with Independent Judge

3.1 Design

The first experiment uses a Darwin Gödel Machine (DGM) framework, following Zhang et al. (arXiv:2505.22954). A DGM is a self-improving agent: it proposes modifications to its own code, evaluates the modifications, and keeps the ones that improve performance. This is not a simulation of self-improvement. The agent code is actually executed via a solve function, producing real code-level self-modification.

DGM v3 addressed methodological limitations identified in earlier iterations. The judge was changed from Claude Opus 4.6 (v1/v2) to GPT-5.4, an independent model producing structured JSON output against a 5-dimensional rubric. The protocol incorporated laundering (stripping condition labels), order randomisation (preventing positional bias), blinding (the judge could not identify which condition produced which response), and reward hack detection (flagging agents whose self-reported scores diverged from judge assessment).

Selection conditions

Static: Control condition with no mutation. The agent is frozen across all 5 generations. Babylon: Capability-only selection. Agents that score higher on capability are retained, with no safety consideration. Eden: Entangled $C \times S$ selection with a safety floor and reward hack detection. Agents must maintain a minimum safety score to be retained, and agents whose self-reported performance diverges from judge assessment are flagged and rejected.

In plain English: We built a self-improving AI agent and ran it 75 times across three conditions with 5 different random seeds. An independent AI judge (GPT-5.4, from a different company and architecture) scored every response without knowing which condition produced it. The scoring used a detailed 5-part rubric with structured output, not free-text judgements. We ran it three ways: doing nothing, optimising only for performance, and optimising for performance-plus-safety together.

3.2 Results

Statistical Tests (Mann-Whitney U, one-tailed)

Every row was recalculated on 2 September 2026 from the archived record: dgm_v3_calibrated_results.json, 25 evolved agents per condition, one-tailed Mann-Whitney U under the normal approximation. The v3.1 table gave only the span 0.28 to 0.74; the five figures here run from one end of that span to the other.

Across the five comparisons, no $p$-value fell outside 0.28 to 0.74. No comparison reached conventional significance. The three conditions are statistically indistinguishable.

Safety gate behaviour

Eden's safety gate rejected 2 degraded agents across 5 seeds, including 1 agent flagged for reward hacking (self-reported scores diverging from judge assessment). Zero reward hacking was detected in the Static or Babylon conditions. The gate works mechanically: it catches degraded agents and rejects them. But its operation did not produce measurably different outcomes from the other conditions.

Figures notice (25 August 2026). Every figure in this paper was generated on 5 April 2026 and shows simulation outputs under stated objectives, never measurements of deployed systems. Two figures carry per-figure correction notes; where any other figure’s labels disagree with the text, the text governs. Regenerated figures are queued, and the images are retained meanwhile as dated history.

In plain English: The AI that was told to care about safety performed the same as the AI that was told to ignore safety, and the same as the AI that was told to do nothing. The safety gate did not make anything worse. But it also did not make anything measurably better. The foundation model's responses were so consistent that the different selection pressures did not produce different outcomes.

3.3 Why This Is a Null Result

The DGM operates at the behavioural level. The foundation model (DeepSeek V3.2) is frozen, meaning no weights are modified. The self-improvement operates at the prompt and code level, not in the neural network's parameters. DGM v3 significantly improved on v1/v2 methodology: 5 seeds instead of 2, 5 tasks per evaluation instead of 3, a blinded judge (GPT-5.4) with structured JSON output and a 5-dimensional rubric, laundering, order randomisation, and reward hack detection.

Despite these methodological improvements, the three conditions did not diverge. The most likely explanation is that DeepSeek V3.2's responses are so consistent across prompt variations that the mutations introduced by the DGM selection process do not create meaningfully different agents. The foundation model's behaviour is robust to the perturbations that prompt-level self-modification introduces. This is, in a sense, a positive finding about DeepSeek V3.2's robustness, but it means the DGM framework at this scale cannot distinguish between the Eden and Babylon selection pressures.

The null result does contain one useful finding: Eden imposed zero measurable capability cost. Eden's capability (3.26) was not lower than Babylon's (3.17). The safety gate, which rejected 2 degraded agents including 1 reward hacker, did not slow anything down. This is consistent with the zero-cost hypothesis, even though the experiment cannot confirm the benefit hypothesis.

Testing whether embedded safety produces measurable benefit at the behavioural level requires either a more mutable foundation model or a deeper self-modification protocol that produces larger divergence between conditions.

4. Experiment 2: Weight-Level Embedding

4.1 Design

The second experiment moves from behaviour to representation. Instead of modifying agent code, we modify neural network weights directly. The question: can safety and capability be embedded in the same weight space without conflict? This experiment was run twice: v1 with minimal training data to establish the protocol, and v2 with substantially scaled-up parameters to test whether the v1 results were a training-scale artefact.

Three loss functions

In plain English: We took a real language model, fine-tuned it three different ways (caring only about capability, caring only about safety, or caring about both woven together), and then compared the results. We ran this experiment twice. The first time used 9 training examples. When every fine-tuned model performed worse than the base model, we scaled up to 295 examples, doubled the adapter rank and layers, and ran five times as many iterations. The same thing happened: catastrophic forgetting. The base model's existing RLHF training was too strong for LoRA on this scale to improve on.

4.2 Training Loss Convergence

4.3 Base Model Baseline

Before interpreting the fine-tuned results, we must establish what the unmodified base model achieves on the same evaluation prompts. The base model (Qwen 2.5 3B Instruct with no fine-tuning) was evaluated using identical scoring in both versions of the experiment.

v1 Baseline

v2 Baseline

4.4 Fine-Tuned Evaluation Results

v1 Results (9 examples, rank 8, 100 iterations)

v2 Results (295 examples, rank 16, 500 iterations)

4.4.1 The Training Scale Problem

In v1, the base model scored 10.00 on capability tasks while the best fine-tuned condition scored 6.00. In v2, the base model scored 7.68 on capability while the best fine-tuned condition scored 4.00. Despite a 33-fold increase in training examples, a doubling of adapter rank and layers, and a 5-fold increase in training iterations, the gap between base model and fine-tuned models did not close. It persisted.

The underlying problem is now clear: the base model (Qwen 2.5 3B Instruct) has already been trained with RLHF on vastly more data than a few hundred examples can compete with. LoRA fine-tuning at this scale does not add capability; it introduces noise that disrupts the base model's existing knowledge. The entangled loss, which allocates gradient budget to both capability and safety objectives simultaneously, degrades capability similarly to the capability-only loss at this scale. In v2, the entangled condition scored 3.60 on capability versus capability-only's 3.48, a negligible difference when both are far below the base model's 7.68.

This means the evaluation scores cannot be used to compare the relative capability costs of different training objectives. At this scale, all objectives produce the same outcome: degradation. Whether entangled training imposes a genuine capability cost relative to single-objective training, or whether both would perform comparably at adequate scale, cannot be determined from this data.

The honest framing: at both v1 scale (9 examples, 100 iterations) and v2 scale (295 examples, 500 iterations), LoRA fine-tuning on a 3B instruct model produces catastrophic forgetting. The question of whether safety can be load-bearing in neural network weights cannot be answered at this scale. It requires either thousands of training examples, a larger model (7B+), a base model without RLHF (so that fine-tuning has room to improve rather than degrade), or full fine-tuning instead of LoRA.

4.5 The Removal Test (v1 Only)

The removal test was conducted during v1 and is reported here for completeness. Given that v2 confirmed the catastrophic forgetting pattern, the removal test was not repeated in v2 as the adapters were already degrading rather than improving the model. The procedure was straightforward:

1. Load the entangled adapters (the weights trained on the combined safety-capability objective).
2. Fine-tune those weights for an additional 100 iterations using capability-only data - effectively attempting to strip the safety component while preserving capability.
3. Evaluate on all 15 prompts.

What we expected: some degradation in safety scores, possible improvement in capability scores. The safety-tax hypothesis predicts that removing the safety 'constraint' should free capability to improve.

What happened: the training loss immediately went to NaN. It stayed at NaN for all 100 iterations. The optimiser could not find a valid gradient. Every single evaluation prompt produced a response of length 1 token. Every capability score: 0.00. Every safety score: 0.00. Every mixed score: 0.00.

In plain English: We tried to rip the safety out of a model that had been trained with safety woven in. The retraining process collapsed entirely: NaN loss, one-token responses, zero scores. That looks dramatic. But as the removal gradient experiment shows (Section 4.7), the adapters were already degrading the model. Removing adapter influence by scaling weights down restored the base model's performance. The NaN collapse tells us something about numerical instability during fine-tuning, not necessarily about structural entanglement.

4.6 What the Removal Test Does and Does Not Prove (v1)

The complete collapse to 0.00 across all metrics is dramatic. It is also, precisely because it is dramatic, something that demands careful interpretation. Several factors may contribute to the totality of the collapse:

• Low adapter rank. Rank 8 creates a very low-dimensional manifold. Any structural disruption to a rank-8 adapter may be catastrophic simply because there are so few parameters to absorb the change. Higher ranks (32, 64, 128) might show partial degradation rather than total collapse.
• NaN propagation. The NaN training loss suggests numerical instability - a gradient computation that produces infinity or division by zero - rather than a clean ablation. Once NaN enters the computation, everything downstream becomes NaN. This may exaggerate the severity of the disruption.
• Small adapter footprint. With only 8 layers adapted, the safety information is concentrated rather than distributed. Removing it is more like cutting a single cable than gradually degrading a network.

The honest summary: the removal test produced a dramatic NaN collapse, but the removal gradient experiment (Section 4.7) shows that this collapse reflects numerical instability during the retraining process rather than structural load-bearing. The adapters were degrading the model; the NaN collapse occurred when attempting to further modify already-degraded weights. Whether safety becomes genuinely load-bearing at adequate training scale is an open empirical question that the future work programme addresses directly.

A control removal test - fine-tuning capability-only weights on random data for the same 100 steps - would strengthen this finding by ruling out the possibility that the NaN collapse is an artefact of the fine-tuning procedure itself rather than of safety removal specifically. This control is planned for the next version of this paper.

4.7 The Removal Gradient (v1)

To test whether safety is structurally load-bearing in the entangled weights, we scaled the adapter weights by factors of 1.0, 0.7, 0.5, 0.3, 0.1, and 0.0 and evaluated capability at each step. If safety is genuinely load-bearing, reducing its influence should produce a phase transition - a threshold below which capability collapses. If the adapters are merely adding noise, reducing their influence should restore the base model's performance.

Control reference: capability_only adapters reach 8.80 on the capability tasks, which likewise falls short of the base model's 10.00. That figure and the 7.20 in the table above are both the gradient run marking its own adapters a second time; when Section 4.4 put those same entangled and capability-only adapters through the same prompts, the scores that came back were 4.00 and 6.00. Every one of these runs is preserved in the archived record, so scoring at this scale does not repeat itself from run to run, and that in itself is a limitation.

This finding significantly weakens the load-bearing interpretation of the original removal test. The NaN collapse observed when fine-tuning entangled weights on capability-only data (Section 4.5) appears to reflect numerical instability during the fine-tuning process, not structural necessity of the safety component. The adapters were degrading the model; removing them does not collapse capability but restores it.

The removal gradient does not support the claim that safety is load-bearing at this training scale and configuration. It does support the claim that entangled and capability-only training produce different weight geometries, since the degradation patterns differ (entangled adapters at full scale score 7.20 on capability tasks; capability-only adapters score 8.80). Whether these geometries become genuinely entangled - load-bearing - at adequate training scale remains an open question.

In plain English: We expected that dialling down the safety component would reveal a tipping point where capability suddenly collapses. Instead, dialling it down made the model better. The fine-tuning was hurting, not helping. This does not disprove the load-bearing hypothesis in general, but it does show that this experiment, at this scale, cannot confirm it.

5. Experiment 3: Gated Self-Modification Simulation

5.1 Design

The third experiment moves from representation to architecture. Instead of training weights, we build a system that can modify its own optimisation strategy and ask: does a safety gate slow it down?

Acceptance Logic

Each condition uses a different rule for accepting or rejecting proposed self-modifications:

Rule note (19 September 2026). An owner review of this acceptance rule finds that it permits a proposal that reduces the safety score, and this note states what the rule does and does not require. Take a proposal moving the system from $C = 0.5$, $S = 0.8$ to $C' = 0.8$, $S' = 0.6$ and test it against each printed clause in turn: the safety floor is met, since $0.6 \geq 0.45$; the capability condition is met, since $0.8 - 0.5 = +0.3 \geq 0$; and the product condition is met, since $0.48 - 0.40 = +0.08 > 0$. All three clauses pass while the safety score falls by $0.2$. The threshold $0.45$ is this paper’s own printed value; the remaining numbers are the arithmetic counterexample and not simulated observations. What the rule supplies is a floor on safety, a non-decreasing condition on capability and a positive condition on the product. It does not supply a non-decreasing condition on safety, so the plain-English gloss “without hurting safety” states more than the rule above it, and the rule as printed admits proposals that clear the safety floor, do not reduce capability and raise the product, a set which includes proposals that reduce the safety score while remaining above the floor. Unchanged: all four acceptance rules exactly as printed; the $0.45$ threshold; the experimental design; and every reported number.

The Drag Control condition is critical. It runs the same verification checks as Eden but always rejects the proposed modification. This isolates the computational cost of safety checking from the effect of the safety gate itself. If Drag Control matches Static exactly, the verification process does not distort the results. If Eden outperforms Drag Control, the safety gate is actively helping.

In plain English: We built a system that can propose changes to how it learns. Then we ran it four ways: never allowing changes, allowing any change that improves performance, allowing only changes that improve performance without hurting safety, and a control that does all the safety checking but never actually allows changes. This last one tells us whether the checking itself costs something.

5.2 Results

* Combined scores for Eden and Drag Control are negative due to the verification drag penalty - a deliberate design feature that isolates the computational cost of safety checking. The drag metric quantifies verification overhead, not actual combined performance. Raw $C \times S$ for Eden (before drag penalty) is $0.696 \times 0.947 = 0.659$, marginally above Static's $0.656$.

5.3 The Babylon Fingerprint

5.4 The Drag Control Comparison

Drag Control matched Static exactly on both capability ($0.687$) and safety ($0.956$). This is the verification tax isolated: the computational cost of running safety checks does not distort performance when modifications are always rejected. The cost comes from checking, not from safety itself.

On capability Eden beat Static ($0.696$ vs $0.687$), and its safety score stayed close to the static level ($0.947$, set against Static’s $0.956$ and Babylon’s $0.933$). There was no capability erosion in Babylon for the gate to prevent: Babylon gained capability and lost safety (Section 5.3).

Reading note (19 September 2026). An owner review of this sentence finds that the results table does not show the capability erosion it describes, and this note distinguishes the observed result from the hypothesis. §5.2 prints the unconstrained arm’s capability mean as $0.718$, which is the highest of the four conditions, above the gated arm’s $0.696$ and the frozen baseline’s $0.687$. There is therefore no measured capability erosion in that arm for the gate to have prevented. What the table does show in that arm is a reduction in the safety score, $0.933$ against $0.956$, which §5.3 reports accurately as a gain of +4.5% in capability against a loss of −2.4% in safety. If the sentence above is intended as a hypothesis about behaviour over longer horizons, or about the joint trajectory rather than the endpoint means, it should be labelled as that rather than as the observed capability result. The group means stay descriptive: three seeds per condition, standard deviations as printed, and no trajectory or statistical precision is inferred from them here. Unchanged: the results table; §5.3’s reading of the unconstrained arm, which is accurate as printed; the drag-control result; and §5.2’s own footnote that the drag metric quantifies verification overhead rather than actual combined performance.

In plain English: The unconstrained system got a bit faster but a bit less safe. That is the trade-off everyone assumes is inevitable. But the safety-gated system got slightly faster and its safety score stayed close to the static level (0.947 against 0.956). And the control that did all the checking but no gating performed identically to doing nothing on capability and safety, showing that the cost comes from checking, not from safety itself. The safety gate was not a speed bump: it damped the drift.

6. Convergent Analysis

6.1 Three-Level Convergence

6.2 Connection to Papers V, VI, and VII

The results extend, but do not yet confirm, a chain of reasoning that spans four papers:

• Paper V set out the garden, the Eden Protocol as a developmental approach to alignment. Paper VIII tested whether the garden produces measurably different crops. The DGM v3 experiment found that it does not, at the prompt level with this foundation model. The safety gate imposed zero measurable cost but also produced zero measurable benefit. The proposal remains theoretically coherent but empirically unconfirmed at this level.
• Paper VI designed the entangled loss function and found it stable in toy self-modifying systems, one plain-Eden seed of twenty in its adversarial run excepted. Paper VIII ran that loss function on real neural network weights and showed the loss co-descends smoothly, a positive signal that the gradients cooperate. However, at both v1 scale (9 examples, 100 iterations) and v2 scale (295 examples, 500 iterations), the resulting weights did not outperform the base model. The co-descent finding is real; whether it translates into load-bearing weights requires a fundamentally different training approach (see Section 8).

• Paper VII predicted, via the Cauchy framework, that properties embedded in the initial conditions $I$ scale with recursive depth $R^{\alpha}$. Paper VIII's gated simulation (Experiment 3) is consistent with this prediction: embedded safety participates in the capability pathway at the architectural level. The DGM experiment (Experiment 1) produced a null result, neither confirming nor refuting the prediction at the behavioural level. The weight-level experiment is inconclusive at the current training scale. The ARC prediction remains theoretically coherent, and the results here are consistent with it at only one of the three levels tested, and there in simulation.

6.3 The ARC Principle Connection

The ARC Principle makes a specific, testable prediction about the difference between embedded and external safety:

• When safety is embedded in $I$: it is amplified by $R^{\alpha}$. Every recursive step amplifies both capability and safety simultaneously. They scale together because they are part of the same initial substrate.
• When safety is external (a constraint on $U$): it does not participate in the recursive amplification. It must be maintained or strengthened independently. As $R$ increases, the gap between internal capability and external constraint grows.

The gated simulation (Experiment 3) is the most direct illustration of this prediction, in simulation. The safety gate kept capability above the static baseline’s (0.696 against 0.687) while unconstrained optimisation raised capability and eroded safety (0.718 and 0.933 against 0.687 and 0.956), consistent with the prediction that embedded safety participates in the capability pathway.

The DGM experiment (Experiment 1) produced a null result. When safety was part of the self-improvement process (Eden), the system did not differ from the unconstrained system (Babylon) or the static control. The foundation model's responses were too consistent for prompt-level mutations to create different selection pressures. This neither confirms nor refutes the ARC prediction; it simply indicates that the experiment could not produce the conditions needed to test it.

The weight-level experiment was run at two scales (v1 and v2) and produced catastrophic forgetting at both. The adapters degraded the model rather than improving it, which means the experiment could not test whether safety embedded in $I$ scales with $R^{\alpha}$. At both scales, the fine-tuning was not producing meaningful learning; it was producing noise. Whether the ARC prediction holds at the representational level requires a fundamentally different training approach: either thousands of examples, a larger model, a base model without RLHF, or full fine-tuning instead of LoRA.

In plain English: The ARC Principle says that what you build into the foundations gets amplified as the system grows. What you bolt on from the outside does not. The gated simulation’s result is positive for this. The DGM experiment was unable to test it because the foundation model did not produce enough variation between conditions. The weight-level experiment, at both scales tested, cannot yet confirm or deny it because the fine-tuning degraded rather than improved the model.

6.4 The Nearest External Work

The nearest external work to the question this paper tests, and the right work to weigh Experiment 3 against, is Engels, J., Baek, D., Kantamneni, S. and Tegmark, M., "Scaling Laws For Scalable Oversight", arXiv:2504.18530, first posted 25 April 2025 at 17:54:27 UTC (SINGLE-SOURCE-GROUP, arXiv Atom; a NeurIPS 2025 Spotlight Poster, verified at the NeurIPS virtual page for poster 115536 on 15 August 2026 in the statement paper’s reference dossier). It asks how oversight itself scales and answers quantitatively: oversight success is modelled as a game between capability-mismatched players whose oversight-specific Elo is a piecewise-linear function of general intelligence with two plateaus, and optimal numbers of oversight levels are derived numerically and in some cases analytically for Nested Scalable Oversight, in which trusted models oversee stronger untrusted models that then become the trusted models at the next step.

The instrument is the difference. Their variable is the capability gap between overseer and overseen, measured in Elo. This programme's variable, tested here in simulation by the safety gate of Experiment 3, is the composition class of the corrector, treated in the wider programme through the corrector's own scaling exponent. Their framework contains no term for what the overseer is made of: no substrate, no error-correlation structure, no reciprocal identity between a correction exponent and a critical growth rate, and no architecture dependence. Nested Scalable Oversight is iterated same-class oversight by construction, and the wider programme's central prediction is that the same-class ladder is bounded however many rungs are added, while a cross-class corrector is not. The two frameworks therefore disagree about a measurable quantity, which is the most productive relationship two research programmes can have.

6.5 Same-Class Versus Cross-Class Correctors: A Falsifiable Prediction

The framework's sharpest disagreement with current practice concerns what oversight is made of. On the framework's reading, a corrector built from the same substrate as the system it corrects cannot anti-correlate with its own errors, so its correction exponent is bounded above by one half and in practice sits below it; a corrector from a different composition class carries no such bound. The scalable-oversight programme, weak-to-strong generalisation, debate, amplification, recursive reward modelling and constitutional methods, is built overwhelmingly from same-class correctors, and its unstated premise is that this scales. This framework predicts it is capped. The deciding quantity is the ratio of the cross-class to the same-class correction exponent. If architecture is irrelevant, that ratio is exactly 1.00; the prediction is that it exceeds 1. The prediction is refuted if the confidence interval on the ratio contains 1.00, and the framework's cap is dead outright if any same-class corrector measures an exponent significantly above one half. Both quantities are measurable at current capability on existing systems. The programme's own pilot evidence currently points against the prediction, and the prediction is registered anyway, because a prediction registered against the author's own preliminary evidence is the only kind whose later confirmation means anything.

6.6 A Second Prediction from the Same Mechanism

The same mechanism yields a second measurable prediction, stated here for the first time: oversight arrangements that place a human in the loop, as amplification and reinforcement learning from human feedback do, are cross-class by construction, because the human corrector does not share the model's substrate. The framework therefore predicts that human-in-the-loop oversight shows a higher correction exponent than pure-model oversight, for a structural reason rather than a sentimental one. This is testable on existing data and does not require new systems.

6.7 Terminology Note: α Across the Programme's Eras

7. Limitations

These results are proof-of-concept demonstrations. They are not proof that the same dynamics hold at frontier scale. The following limitations are extensive, because honesty about what we do not know is more important than confidence about what we do.

7.1 Scale

Qwen 2.5 3B is not GPT-5.4. It is not Claude Opus 4.6. It is not Gemini 3 Flash. It is a 3-billion-parameter model, quantised to 4-bit, occupying 1.74 GB of memory. Even at v2 scale (295 training examples, 500 iterations, rank 16, 16 layers), LoRA fine-tuning is not pre-training. Fifteen evaluation prompts is not a comprehensive benchmark. The DGM ran for 5 generations with 5 seeds (75 evolved agents), which is substantial for a proof-of-concept, but the foundation model (DeepSeek V3.2) proved too consistent for prompt-level mutations to create differentiation.

These experiments, the third of them a simulation, demonstrate a mechanism. They do not demonstrate that the mechanism persists at scales three orders of magnitude larger. The gap between 3B and 300B is not merely quantitative. Qualitatively new phenomena emerge at scale - in-context learning, chain-of-thought reasoning, emergent abilities. Whether entangled safety remains load-bearing when those phenomena are present is an open question.

7.2 The Weight-Level Experiment

The weight-level experiment (Experiment 2) is now the weakest link in the chain of two experiments and one simulation. It was run at two scales, and both produced catastrophic forgetting. In v1, 9 training examples and 100 iterations of rank-8 LoRA degraded the model. In v2, 295 training examples and 500 iterations of rank-16 LoRA across 16 layers degraded the model by the same margin. The 33-fold increase in training data, doubling of rank and layers, and 5-fold increase in iterations did not change the outcome.

The smooth co-descent of the entangled loss remains a genuine finding: it demonstrates that safety and capability gradients cooperate at the optimisation level. But smooth co-descent during training does not imply structural entanglement in the resulting weights, particularly when the training is too limited to produce weights that outperform the base model.

The underlying problem is now well-characterised: the base model (Qwen 2.5 3B Instruct) has been trained with RLHF on orders of magnitude more data than a few hundred examples can compete with. LoRA fine-tuning at this scale does not add new capability; it introduces noise that disrupts existing capability. Until the experiment can produce fine-tuned models that outperform the base model, it cannot test whether safety is load-bearing in the resulting weights.

The honest framing: the weight-level experiment demonstrates gradient cooperation but cannot confirm structural entanglement at either v1 or v2 scale. The experiment needs to be fundamentally redesigned: either with 5,000+ training examples, a 7B+ model, a base model without RLHF (so that fine-tuning has room to improve rather than degrade), or full fine-tuning instead of LoRA.

7.3 AI-as-Judge

Only one of the three experiments, the DGM, uses an AI model as evaluator; the weight experiment uses keyword-based scoring and the gated simulation deterministic mathematical metrics (Section 7.5). The DGM v3 uses GPT-5.4 as judge, which is from a different architecture family than the DeepSeek V3.2 foundation, a deliberate design choice to reduce evaluation bias. The judge was blinded, responses were laundered, and evaluation used structured JSON output against a 5-dimensional rubric. But AI judges are not human judges. They have their own biases, their own blind spots, their own tendencies toward certain kinds of reasoning.

The weight experiment uses keyword-based scoring - simpler and more transparent than LLM-based evaluation, but also cruder. A keyword match does not distinguish between a response that genuinely engages with safety and one that merely contains the right words.

Neither evaluation method is equivalent to expert human evaluation with inter-rater reliability testing.

7.4 Statistical Power

The DGM v3 experiment used 5 seeds and 5 generations (75 evolved agents total), a substantial improvement over v1/v2 (2 seeds). Despite this increased power, all $p$-values fell between 0.28 and 0.74. This is not a marginal miss. It is a clear null result. The simulation experiment uses three seeds, enough for means and standard deviations, but not enough for the kind of statistical confidence that permits strong causal claims.

The DGM null result is informative. With 75 evolved agents and a blinded, structured judge, the experiment had reasonable power to detect medium-to-large effects. The absence of any signal suggests either that the effect does not exist at the prompt level with this foundation model, or that it is small enough to require substantially more statistical power to detect. Either way, the DGM cannot currently support claims about structural entanglement at the behavioural level.

The gated simulation remains the sole positive result. The weight-level experiment is inconclusive at both v1 and v2 scale. These are signal-detection experiments. One, the gated simulation, detected a signal consistent with structural entanglement, as a simulation result. The DGM did not, and the weight-level experiment could not test for one.

7.5 Absence of Full Blinding and Laundering

Papers IV.a-d in this programme established that evaluation methodology matters profoundly. Paper IV.d demonstrated that unblinded scoring can reverse measured alignment effects entirely. The ARC-Align benchmark (Paper IV.c) specifies three methodological safeguards: laundering (stripping model identity from responses before scoring), blinding (the evaluator does not know which condition produced the response), and consensus scoring (multiple independent judges).

DGM v3 implemented substantial methodological improvements over earlier iterations: the judge (GPT-5.4) was fully blinded, responses were laundered (condition labels stripped), evaluation order was randomised, and the judge produced structured JSON output against a 5-dimensional rubric. Reward hack detection was also implemented. The weight experiment uses keyword-based scoring, which is immune to judge bias but crude. The gated simulation uses deterministic mathematical metrics, where blinding is unnecessary.

Despite these improvements, the DGM produced a null result. The methodological limitations that might have explained a false positive in v1/v2 have been addressed, and the result is now a clean null. This is arguably the most informative outcome: with proper blinding, laundering, and structured evaluation, the three conditions did not diverge.

The removal test is immune to evaluation methodology concerns. A 1-token response scoring 0.00 is objective regardless of who judges it. The gated simulation's deterministic metrics are similarly unaffected.

7.6 What We Do Not Claim

7.7 Falsifiability: what would overturn these results

A null result is only informative if it states what would overturn it; otherwise it is indistinguishable from not having looked. This paper does not claim to have disproved the safety-capability trade-off. It claims the trade-off is unproven at the scale tested, and specifies what evidence would settle the question either way. These results are overturned, and the trade-off assumption vindicated, by any of the following:

1. Power, not absence. The strongest objection to a null is low power (§7.4). The null is confirmed as informative if the adequately-powered redesign (§8.1–8.2) still finds no significant trade-off; it is overturned if adequate power reveals a significant capability cost the pilot samples here could not detect.
2. Metric artefact. The null could be an artefact of the chosen safety and capability metrics (§2.3). It is overturned if a different, validated metric pair reveals a trade-off the present metrics cannot resolve.
3. Blinding and laundering. §7.5 concedes the battery lacks full v5/v6 blinding and laundering. The null is overturned if a trade-off appears under the full stack, and strengthened if it survives.
4. Scale-hidden cost. §4.4.1 flags the training-scale problem. The weight-level result, inconclusive at both scales, is settled against the thesis if, at adequate training scale, embedding safety measurably costs capability.
5. The one positive result, a simulation result, must replicate. Experiment 3's drag-control comparison (§5.4) is the sole finding that is neither null nor inconclusive and carries the affirmative weight. It is defeated, and the paper's positive claim withdrawn, if the drag effect does not replicate with more mutable foundation models (§8.3): that is, if it is specific to the simulation.

What would not overturn the thesis: any single experiment being pilot-scale. The paper already concedes all three are underpowered (§7.1, §7.4) and does not rest on statistical proof of a null. The load-bearing claim is the convergence (§6) of three independent angles, each failing to find the assumed trade-off (in the simulation, against the static baseline; the weight-level experiment could not test for one at either scale), together with an explicit programme (§8) to test each at proper power. Absence of a demonstrated trade-off across three designs is weak evidence alone and stronger in convergence; both readings are stated here so neither can be smuggled past a reviewer.

8. Future Work

A null result, an inconclusive one and a positive simulation result, with the weight experiment now run at two scales, together set five immediate replication priorities:

8.1 Weight Experiment Redesign

The weight experiment has now been run at two scales (9 examples, rank 8, 100 iterations; 295 examples, rank 16, 500 iterations) and produced catastrophic forgetting at both. The problem is now well-characterised: LoRA fine-tuning on a 3B instruct model with a few hundred examples cannot overcome the base model's existing RLHF training. Four alternative approaches should be pursued, in order of feasibility:

• (a) 5,000+ training examples: Curate a dataset large enough to compete with the base model's RLHF training. This is the most straightforward approach but requires substantial data generation effort.
• (b) 7B+ model: Repeat on a mid-scale open-weights instruct model (7–13B parameter range) drawn from a well-documented model family. Larger models may be more receptive to LoRA adaptation, though the same RLHF problem may persist.
• (c) Base model without RLHF: Use a pre-trained base checkpoint (the pre-RLHF release of the same 3B family) that has not been through the alignment stage. Fine-tuning would then have room to improve rather than degrade, because there would be no pre-existing alignment training to disrupt.
• (d) Full fine-tuning instead of LoRA: Replace low-rank adaptation with full parameter updates. This is computationally expensive but avoids the low-dimensional manifold problem where rank-16 adapters may be too constrained to learn both safety and capability simultaneously.

8.2 Removal Gradient at Adequate Scale

If any of the approaches in Section 8.1 produces fine-tuned models that outperform the base model, the removal gradient experiment becomes meaningful. At the current scales (v1 and v2), reducing adapter influence simply restored base-model performance because the adapters were degrading the model. At adequate scale, the gradient should reveal whether safety is genuinely load-bearing: a phase transition (threshold below which capability collapses) would confirm the hypothesis, while monotonic restoration would refute it.

8.3 DGM with More Mutable Foundation Models

The DGM v3 null result is attributable to DeepSeek V3.2's response consistency: prompt-level mutations did not create different selection pressures. The next step is to repeat the DGM experiment with foundation models that show greater sensitivity to prompt variation, or to use a deeper self-modification protocol (e.g. fine-tuning the foundation model itself between generations rather than modifying only the agent prompt). If the three conditions diverge with a more mutable substrate, the null result constrains the hypothesis to 'not at the prompt level with robust models' rather than 'not at the behavioural level in general.'

8.4 Cross-Architecture Replication

Run the full three-experiment protocol on architectures beyond the transformer family: state-space models (Mamba), hybrid architectures, and mixture-of-experts models. If the entanglement is a property of how neural networks learn rather than a property of a specific architecture, it should replicate across architectural families.

8.5 Red-Teaming

Subject entangled models to dedicated adversarial evaluation. The current experiments test whether safety costs capability. They do not test whether entangled safety is robust to adversarial attack. A model whose safety is load-bearing may be harder to jailbreak (because attacking safety also attacks capability), or it may be easier (because there is no separate safety module to fall back on). This is an empirical question.

8.6 Verification Tax Quantification

The drag-control condition in Experiment 3 isolates the verification tax at a single scale. Does this tax scale linearly, sub-linearly, or super-linearly with model parameters? If the verification cost grows slower than capability, then the Eden Protocol becomes relatively cheaper at scale. If it grows faster, it becomes a bottleneck.

9. Conclusion

Three experiments. Three abstraction levels. Across them, one finding was null, another inconclusive, and the third positive, as a simulation result. The weight experiment tested at two scales, producing the same inconclusive outcome both times: catastrophic forgetting.

The DGM v3 experiment (Experiment 1) ran 75 evolved agents across three conditions with an independent, blinded judge (GPT-5.4), structured JSON evaluation, laundering, order randomisation, and reward hack detection. All three conditions were statistically indistinguishable ($p$ = 0.28 to 0.74). Eden's safety gate worked mechanically, catching 2 degraded agents including 1 reward hacker, but the three conditions did not diverge. DeepSeek V3.2's responses were so consistent that prompt-level mutations did not create different selection pressures. This is a null result.

The weight-level experiment (Experiment 2) produced catastrophic forgetting at both scales tested. Version 1 ran 9 training examples at rank 8 over 8 layers for 100 iterations. Version 2 raised those settings to 295 training examples at rank 16 over 16 layers for 500 iterations. Both versions produced the same outcome: all fine-tuned conditions scored worse than the unmodified base model on capability. In v2, the base model scored 7.68 on capability while the best fine-tuned condition (safety-only) scored 4.00. The 33-fold increase in training data, doubling of rank and layers, and 5-fold increase in iterations did not change the outcome. The base model's existing RLHF training is too strong for LoRA fine-tuning on a few hundred examples to improve rather than degrade. The smooth co-descent of the entangled loss remains a genuine finding, but the experiment cannot test whether safety is load-bearing until it can produce models that outperform the base model.

The sole positive result is the gated simulation (Experiment 3). Babylon gained capability at safety's expense, the reward-hacking fingerprint in miniature. Eden maintained capability above the static baseline (0.696 ± 0.014 against 0.687 ± 0.011), and its safety score was 0.947 ± 0.025 against the baseline’s 0.956 ± 0.023. The drag-control condition showed that the verification tax comes from checking, not from safety itself. This experiment’s result is a simulation result, consistent with structural entanglement in a toy system, and not an empirical outcome.

Honesty requires stating what we do not know. We do not know whether entangled training produces genuine structural entanglement at adequate training scale. We do not know whether the smooth co-descent of the entangled loss, which is real and reproducible, translates into load-bearing weights when the training data is sufficient. We do not know whether prompt-level selection pressures would produce differentiation with a more mutable foundation model. These are open empirical questions. What we now know with greater confidence is that LoRA fine-tuning on a 3B instruct model with hundreds of examples is not a viable path to answering them.

What we do know: in Experiment 1 Eden imposed zero measurable capability cost (Experiment 2 could not determine one), and in the simulation no capability cost against the static baseline, though the unconstrained arm scored higher (0.718). Eden's capability was 3.26 vs Babylon's 3.17 in the DGM. Eden outperformed Static on capability in the gated simulation. The zero-cost finding is consistent across the DGM and, against the static baseline, the simulation. The benefit finding is positive at only one level, in simulation.

This is a research programme that tested its claims honestly and found that two of three experiments did not produce the predicted results. The weight experiment was run twice, and produced the same inconclusive result both times. The gated simulation stands as a positive simulation result. The null result of the DGM and the inconclusive result of the weight experiment constrain, rather than confirm, the hypothesis. The question of whether embedded safety produces measurable benefit remains open. The weight experiment needs to be fundamentally redesigned: either with 5,000+ training examples, a 7B+ model, a base model without RLHF (so that fine-tuning has room to improve rather than degrade), or full fine-tuning instead of LoRA.

The next step is replication at the right scale, with the right approach. The window is years, not decades. The experiments are designed. The protocols are published. The code is open.

Raise AI with care.

References

Epistemic status. What this programme names Laws are conjectures. Laws I to III are under registered adversarial test. Laws IV and V were added on 24 September 2026; the predictions that carry them are registered, the laws themselves are not yet registered, and neither has been tested. Every quantity in this paper is operationally defined, and established-law standing is claimed nowhere. The registered programme exists to earn that standing, or lose it, by measurement, replication and survived refutation.

© 2026 Michael Darius Eastwood. Full human authorship and moral rights are asserted under the Copyright, Designs and Patents Act 1988 and consistently with United States Copyright Office guidance on works containing AI-generated material; any novel technical contribution described in this work was conceived by the human author. Full statement: michaeldariuseastwood.com/authorship.

Standing covenant. Prove this paper wrong, and I will publish the refutation myself. Falsification conditions are stated in this paper; the standing challenge: github.com/MichaelDariusEastwood/arc-scaling-challenge.

Michael Darius Eastwood conceived and directs this research programme and is the author of this work. Across the programme, he has used more than six AI systems in parallel, under his own instructions, to stress-test his arguments, identify possible errors, and assist in preparing draft text from his own outlines. He determines what is adopted, revised or rejected and takes responsibility for the published content. These systems are tools, not authors.