Memory Papers
Memory Architecture

Safin-1: Safety from Within through Memory-Native State Evolution

AuthorsMing Zhang, Kaisen Yang, Shu Yu et al.

arXiv 20262026
arXivPDF

TL;DR

Safin-1 uses Memory-Anchor Routing across Context History (MARCH) to evolve safety states from memory, cutting Average ASR from 7.25% to 3.84%.

SharePost on XLinkedIn

Read our summary here, or open the publisher PDF on the next tab.

THE PROBLEM

Safety relies on external safeguards instead of state native memory

Long horizon tasks need foundation models to maintain internal states, yet safety is often added via post hoc alignment and external filters.

When these external safeguards fail or lag behind evolving behavior, complex agents can retain unsafe capabilities across sessions, risking persistent harmful behavior.

HOW IT WORKS

Memory Anchor Routing across Context History

Safin-1 combines Context-Derived State Anchors, Content-Routed State Retrieval, Persistent Capability States, and an Efficient Producer–Reader Implementation into the MARCH architecture.

Think of Safin-1 as a CPU with structured RAM slots where anchors index memories, routing acts like a card catalog, and persistent states are long term firmware.

This KEY_MECHANISM lets Safin-1 maintain and adapt safety relevant behavior over time, beyond what a single static context window or one shot fine tuning can represent.

DIAGRAM

Routed state evolution during interaction

This diagram shows how Safin-1 evolves its Safety State and capability states over time using MARCH during multi turn interactions.

DIAGRAM

Evaluation pipeline for Safin 1 capabilities and safety

This diagram shows how Safin-1 is evaluated across general capabilities, long context understanding, retrieval, and safety specialization.

PROCESS

How Safin-1 Handles a Routed State Session

  1. 01

    Context-Derived State Anchors

    Safin-1 first builds Context-Derived State Anchors from the incoming sequence, structuring how past tokens and events are indexed in memory.

  2. 02

    Content-Routed State Retrieval

    Safin-1 then performs Content-Routed State Retrieval, using anchors to selectively route queries to relevant context history and capability states.

  3. 03

    Persistent Capability States

    Safin-1 reads and updates Persistent Capability States, such as the Safety State, enabling test time specialization without changing the backbone weights.

  4. 04

    Efficient Producer–Reader Implementation

    Finally, Safin-1 uses the Efficient Producer–Reader Implementation to integrate routed memories into generation, producing safety aware outputs across long interactions.

KEY CONTRIBUTIONS

Key Contributions

  • 01

    Memory-Anchor Routing across Context History

    Safin-1 introduces MARCH with Context-Derived State Anchors and Content-Routed State Retrieval to maintain structured memory states for long horizon tasks.

  • 02

    Persistent Capability States and Safety State

    Safin-1 defines Persistent Capability States, including a learned Safety State, enabling state based safety adaptation that reduces Average ASR from 7.25% to 3.84%.

  • 03

    Efficient Producer–Reader Implementation at Scale

    Safin-1 scales MARCH from 0.8B architectural validation to 35B reasoning models, achieving 80.1 AIME 2025 Avg@64 versus 71.9 for Qwen3.5.

RESULTS

By the Numbers

NIAH

46.4 %

+14.8 over Qwen3.5

AIME 2025 Avg@64

80.1 %

+8.2 over Qwen3.5

Average ASR

3.84 %

-3.41 vs Qwen3.5

0.8B Long-Context

31.6 %

baseline NIAH for Qwen3.5

Safin-1 is evaluated on NIAH for 0.8B long context tasks, AIME 2025 Avg@64 for 35B reasoning, and Average ASR for 4B safety specialization. These results show Safin-1 improves long context understanding, reasoning accuracy, and safety via its Safety State compared to Qwen3.5.

BENCHMARK

By the Numbers

Safin-1 is evaluated on NIAH for 0.8B long context tasks, AIME 2025 Avg@64 for 35B reasoning, and Average ASR for 4B safety specialization. These results show Safin-1 improves long context understanding, reasoning accuracy, and safety via its Safety State compared to Qwen3.5.

BENCHMARK

Representative Safin-1 results versus Qwen3.5

Scores on NIAH, AIME 2025 Avg@64, and Average ASR for Safin-1 and Qwen3.5.

KEY INSIGHT

The Counterintuitive Finding

Safin-1’s 4B safety specialization cuts Average ASR from 7.25% to 3.84%, a 47.0% relative reduction using only a Safety State.

This is surprising because such a large safety gain usually requires retraining the entire backbone, yet Safin-1 achieves it via persistent state adaptation.

WHY IT MATTERS

What this unlocks for the field

Safin-1 shows that safety can be treated as a state native capability, maintained and evolved through memory routing instead of static alignment.

Builders can now design agents whose safety behavior adapts over time via persistent states, without repeatedly modifying or retraining the shared foundation model.

~12 min read← Back to papers

Related papers

Memory Architecture

A Control Architecture for Training-Free Memory Use

Yanzhen Lu, Muchen Jiang et al.

· 2026

TAG routes low-confidence steps to uncertainty-based routing, filters them with guarded acceptance with rollback, chooses between bank selection across rule and exemplar memory, and prunes via evidence-based retirement inside a unified control loop. On SVAMP and ASDiv, TAG reaches 81.0% and 85.2% accuracy, improving over the 74.0% and 77.5% no-memory baselines while a compute-matched Retry baseline stays flat.

arXiv:2604.18206Read explainer

Questions about this paper?

Paper: Safin-1: Safety from Within through Memory-Native State Evolution

Answers use this explainer on Memory Papers.

Checking…