Safin-1: Safety from Within through Memory-Native State Evolution
Ming Zhang, Kaisen Yang, Shu Yu, Ermo Hua, Zhekai Chen, Cheng Jin, Jingnan Zheng, Yi Zhang and 10 others
Shanghai AI Laboratory
Published August 31, 2026 · on the feed September 2, 2026 · ▲ 20 · arXiv 2609.00092
The abstract
Long-horizon complex tasks require foundation models to accumulate information, maintain internal states, and adapt over extended interactions. Safety should be an intrinsic property of the model itself, rather than a behavioral constraint relying solely on external safeguards or post-hoc alignment such as supervised fine-tuning. This motivates Safety from Within, where safety-relevant capabilities are represented and invoked through the model's native computation. We present Safin-1, a family of foundation models realizing this principle through memory routing and state evolution. Safin-1 is built on Memory-Anchor Routing across Context History (MARCH), a network architecture that maintains structured memory states and selectively retrieves relevant historical information through content-conditioned routing. It supports test-time adaptation of persistent capability states without repeatedly modifying the backbone, enabling controlled specialization over a shared foundation. We investigate this interface on downstream safety tasks through a Safety State, demonstrating effective state-based adaptation with substantial safety improvements. More broadly, the routed-state interface unifies contextual memory and persistent capability adaptation within the model's native computation, reframing memory from a passive record of prior context into an active substrate for maintaining and evolving model behavior. Evaluations across general capabilities, long-context understanding, retrieval, and efficiency further validate Safin-1. These findings provide a path toward safety as a state-native and adaptively maintainable capability. This work is only an initial architectural exploration of Safety from Within, and substantial further work is needed to realize this broader vision.
The Brief
3:08A short podcast summary of the paper. Written and voiced by AI.
Transcript
Safin-1. Safety from Within through Memory-Native State Evolution. By Ming Zhang and seventeen others, from the Shanghai AI Laboratory. Published on the thirty-first of August. Its code repository is a placeholder: a readme, and nothing to run yet.
Long-horizon complex tasks ask a foundation model to accumulate information, maintain internal states and adapt over extended interactions. Safety, meanwhile, tends to be applied from outside: external safeguards, or post-hoc alignment such as supervised fine-tuning, constraining behaviour after the model is built. The authors argue that safety should instead be an intrinsic property of the model itself. They call the principle Safety from Within: safety-relevant capabilities represented and invoked through the model's own native computation.
The two concerns meet in one place. A model that must keep and adapt state over a long interaction already needs somewhere inside it to hold that state. If safety is to come from within rather than from outside, it needs a place in the model's own computation as well, and the question the work takes up is whether these can be the same place.
Safin-1 is a family of foundation models that realizes this principle through memory routing and state evolution. The move is to ask more of memory. Rather than a passive record of prior context, memory becomes an active substrate for maintaining and evolving the model's behaviour. Contextual memory and persistent capability adaptation are unified in one routed-state interface, inside the model's native computation, and safety is one of the capabilities held there.
The architecture underneath is MARCH, which stands for Memory-Anchor Routing across Context History. It maintains structured memory states, and it selectively retrieves relevant historical information through content-conditioned routing. The same design supports test-time adaptation of persistent capability states, without repeatedly modifying the backbone, which allows controlled specialization over a shared foundation. To study this interface on downstream safety tasks, the authors use what they call a Safety State.
Read together, those pieces describe a division of labour. The backbone stays shared and is not repeatedly rewritten. What changes is a persistent state that the routing reaches into. Specializing the model, including making it safer, becomes a matter of adapting that state at test time instead of modifying the backbone once again.
On those safety tasks, state-based adaptation proves effective, with substantial safety improvements. Beyond safety, evaluations across general capabilities, long-context understanding, retrieval and efficiency are reported as further validating Safin-1. Those broader evaluations are what let Safin-1 be called a foundation model and not only a safety mechanism: the claim covers general ability, long contexts and efficiency too. The abstract gives no figures for any of them, so how large the improvements are cannot be said here.
The authors are careful about scope. They call this only an initial architectural exploration of Safety from Within, and say substantial further work is needed to realize the broader vision. What they offer is a path: safety as a capability that is native to the model's state and can be maintained by adaptation, rather than a fence built around the model after the fact.
Paper Quest · 7 chapters · about 42 min
Play this paper
Learn it by doing: make the calls the authors made, guess the result before you see it, and defend it in a viva graded on your own words. Chapter 1 is right here.
Chapter 1 🧩 · The problem
Long tasks need memory. Safety needs a home. What if they share one?
You are building a model for long tasks: it must keep track of what happened over a long interaction and adapt as it goes. It needs somewhere inside to hold that state.
The road ahead
- 1 · The problem ~7 min A model for long tasks needs an inner place to hold its state, while safety usually sits outside it and costs a backbone rewrite each time.
- 2 · What came before ~3 min
- 3 · The key idea ~9 min Save snapshots of the recurrent state as a memory bank that tokens route into, then add a learned Safety State to that same bank, backbone frozen.
- 4 · Choose your own research ~3 min
- 5 · Build the method ~8 min Build routed memory into the backbone, train it for general skill, then freeze it and learn a Safety State that tokens route to.
- 6 · The experiment ~7 min You’ll guess: Adapting only a learned Safety State, with the backbone left untouched: how much did it change safety on downstream safety tasks?
- 7 · The viva ~5 min Three questions from the examiners, answered in your own words. Win it for the paper’s trophy.
Free, with Google or an email address. Your stars and progress are kept.