Incremental Completion Decomposition

• ICD is an incremental factorization strategy that decomposes targets via sequential partial completions, coupling an update rule with structured reuse.
• Its theoretical framework, rooted in algorithmic information theory, uses shortest feature extraction and residual computation to partition content efficiently.
• ICD principles extend to diverse fields like cylindrical algebraic decomposition, class-incremental semantic segmentation, and LLM safety, illustrating its broad impact.

Searching arXiv for the cited works and closely related ICD usages to ground the article in current papers. Incremental Completion Decomposition (ICD) denotes an incremental factorization strategy in which a target object, representation, or interaction is handled through a sequence of partial completions rather than by a single monolithic step. In the literature represented here, the label is explicit in a trajectory-based jailbreak method for LLMs (Arif et al., 1 Apr 2026), and it is also a natural interpretation of a theory of incremental compression in algorithmic information theory (Franz et al., 2019). Closely related incremental decomposition schemes also appear in cylindrical algebraic decomposition, where an existing decomposition is refined under added polynomial constraints [(Chen et al., 2012); (Cowen-Rivers et al., 2018)], and in class-incremental semantic segmentation, where class logits are decomposed into positive and negative reasoning components for distillation (Baek et al., 2022). The term is therefore not uniform across domains; instead, it names a recurring pattern of sequential completion, exact or controlled reconstruction, and structured reuse of prior partial structure.

1. Terminological scope and recurring schema

ICD is used in more than one sense. In algorithmic information theory, it refers to repeated extraction of shortest compressive features from a residual description until incompressibility is reached (Franz et al., 2019). In symbolic computation, the same incremental-completion pattern appears when a cylindrical decomposition is refined branch-wise or level-wise as new polynomial constraints are added, preserving unaffected structure rather than recomputing globally [(Chen et al., 2012); (Cowen-Rivers et al., 2018)]. In class-incremental semantic segmentation, the same decomposition motif is instantiated at the level of logits: a class score is split into positive and negative evidence and those components are distilled separately (Baek et al., 2022). In LLM safety, ICD is a multi-turn attack trajectory that accumulates harmful semantic content through one-word completions before eliciting a full unsafe response (Arif et al., 1 Apr 2026).

A plausible unifying interpretation is that ICD always couples three elements: an incremental update rule, a completion relation in which the extracted part and the residue or context jointly determine the current object, and a decomposition claim stating that the extracted parts are non-redundant or operationally distinct. The exact meaning of “completion,” however, is domain-specific. In incremental compression it is literal reconstruction of a string; in CAD it is completion of a decomposition under added algebraic constraints; in decomposed distillation it is completion of a logit from positive and negative reasoning terms; in jailbreaks it is completion of a harmful response from an incrementally built conversational trajectory.

2. Algorithmic-information-theoretic ICD

The most formal theory associated with ICD is the theory of incremental compression (Franz et al., 2019). There, a feature of a string $x$ is a function $f$ together with a residual description $r=f'(x)$ such that

$f(r)=x, \qquad l(f)+l(r)<l(x).$

A feature is therefore not merely an explanatory program; it must participate in an actual lossless compression of the string. The residual is the part left after the current feature has been factored out, and the process can be repeated: $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$

The theory singles out the shortest feature $f^*$ of $x$, defined by minimizing $l(f)$ over all features of $x$, together with a shortest descriptive map $f'^*$ that produces the residual $f$0. A key lemma states

$f$1

From this, the shortest feature is shown to be incompressible up to logarithmic slack: $f$2 The shortest feature is thus treated as an information-bearing object in its own right rather than as an auxiliary coding artifact.

The central decomposition theorem, stated as “No superfluous information,” formalizes the claim that a shortest feature and its residual do not carry significant overlapping information about the original string. If $f$3, then

$f$4

and

$f$5

This yields the practical approximation

$f$6

again up to logarithmic terms. In this sense, ICD is a partition of information content into separate pieces: each extraction step removes a shortest explanatory module and leaves a residual that is nearly independent of it.

The theory strengthens this interpretation with explicit independence bounds. For a general feature $f$7 with residual $f$8, if $f$9, then

$r=f'(x)$0

For a shortest feature $r=f'(x)$1, the corollary gives near-independence: $r=f'(x)$2

$r=f'(x)$3

$r=f'(x)$4

The intended meaning of ICD in this setting is therefore stronger than “compression by pieces”: it is a structured algorithmic factorization into nearly pairwise independent, incompressible components.

Iterating the one-step construction produces a full decomposition. Starting with $r=f'(x)$5, one repeatedly extracts a shortest feature $r=f'(x)$6 of $r=f'(x)$7, computes $r=f'(x)$8, and continues until the residual becomes incompressible: $r=f'(x)$9 If

$f(r)=x, \qquad l(f)+l(r)<l(x).$0

is the code for the whole decomposition, then

$f(r)=x, \qquad l(f)+l(r)<l(x).$1

This is the optimality statement for incremental compression: the description length of the ICD is near-optimal with respect to Kolmogorov complexity.

The orthogonality claim extends across decomposition levels. If $f(r)=x, \qquad l(f)+l(r)<l(x).$2 is compressed by shortest features $f(r)=x, \qquad l(f)+l(r)<l(x).$3, then for $f(r)=x, \qquad l(f)+l(r)<l(x).$4,

$f(r)=x, \qquad l(f)+l(r)<l(x).$5

Features extracted at different stages therefore share only negligible mutual information to logarithmic precision.

3. Computable realization, bounded-size features, and randomness tests

Because shortest features are incomputable in general, the theory introduces ALICE, the ALgorithm for Incremental ComprEssion, as a computable analogue of the ideal decomposition (Franz et al., 2019). ALICE searches over candidate autoencoders $f(r)=x, \qquad l(f)+l(r)<l(x).$6 by dovetailing. Its key machine $f(r)=x, \qquad l(f)+l(r)<l(x).$7 takes $f(r)=x, \qquad l(f)+l(r)<l(x).$8, runs the descriptive map $f(r)=x, \qquad l(f)+l(r)<l(x).$9 on $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$0 to obtain $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$1, runs $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$2 on $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$3, and verifies both exact reconstruction and the compression condition. Two search modes are distinguished: Greedy-ALICE, which searches only for the next best feature, and ALICE, which recursively searches over compositions.

The stated time complexity is

$x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$4

where $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$5 and $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$6 are the running times for computing $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$7 and $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$8, respectively. This bound is derived from a search-tree lemma showing that if ALICE spends $x=(f_1\circ f_2\circ \cdots \circ f_s)(r_s).$9 steps on a node coded by $f^*$0, then the total time lies between

$f^*$1

The result is not a computable replacement for Kolmogorov-optimal decomposition, but a search procedure designed to exploit the same incremental structure.

A more practical refinement is the notion of a $f^*$2-feature, which requires a residual contraction by a factor $f^*$3: $f^*$4 For $f^*$5-compressible strings satisfying $f^*$6, the shortest $f^*$7-feature has constant length,

$f^*$8

where $f^*$9 is the length of a universal feature, and the corresponding shortest descriptive map also satisfies

$x$0

In this regime the number of decomposition steps is only

$x$1

The overhead becomes $x$2 in the $x$3-feature scheme, and $x$4 with early termination. This shifts the theory from arbitrary shortest features toward bounded-size primitives.

The paper also connects features to Martin-Löf randomness tests, thereby formalizing the notion of an algorithmic property. A uniform Martin-Löf test $x$5 is defined as a lower semicomputable function such that

$x$6

From any feature $x$7, one can build a randomness test

$x$8

with $x$9 when no such $l(f)$0 exists. Conversely, every unbounded uniform Martin-Löf test yields a feature valid for all strings $l(f)$1 with $l(f)$2. The formal point is that features and randomness tests both identify non-random regularities, but features additionally encode the content of those regularities.

4. Incremental completion in cylindrical algebraic decomposition

In computational real algebraic geometry, the same incremental-completion logic appears in cylindrical algebraic decomposition (CAD), although the object being decomposed is geometric rather than informational [(Chen et al., 2012); (Cowen-Rivers et al., 2018)]. The problem is to maintain or compute a CAD efficiently under added polynomial constraints. Both lines of work reject wholesale recomputation and instead refine an existing decomposition only where the new constraint changes the structure.

One approach constructs a complex cylindrical tree and then refines it into a CAD of real space (Chen et al., 2012). Its core operation,

$l(f)$3

refines an existing cylindrical tree $l(f)$4 with a new polynomial $l(f)$5. The tree is traversed path by path; if $l(f)$6 is already zero or invertible on a branch, no further work is required, while affected branches are split using squarefree decomposition, modular GCD computation via subresultants, and leading-coefficient inversion. A decomposition is $l(f)$7-invariant when every polynomial in $l(f)$8 is either identically zero or nowhere zero on each cell, and the top-level correctness theorem states that CylindricalDecompose computes an $l(f)$9-invariant cylindrical decomposition of $x$0. The method retains the classical worst-case doubly exponential barrier in the number of variables, but its purpose is practical efficiency through branch-wise reuse rather than asymptotic improvement.

A second approach makes the standard projection-lifting framework itself incremental (Cowen-Rivers et al., 2018). Given a CAD sign-invariant for $x$1, the goal is to refine it to handle $x$2 while reusing existing projection data and tree structure. The projection phase is adapted so that only newly induced Lazard projection polynomials are computed. The algorithm ProjectionAdd separates new from old, computes primitive parts, contents, squarefree factors, Lazard coefficient sets, discriminants, resultants among new polynomials, and crucially resultants between new and old polynomials. ProjectionPolysAdd then threads these newly generated projection sets down through the dimensions.

The lifting phase is likewise incremental. The existing CAD is treated as a tree of cells with parent-child links reflecting projection and lifting. If the new polynomial introduces no additional roots above a cell, that subtree is preserved; otherwise the affected branch is pruned and rebuilt. Because the implementation uses the Lazard projection scheme, lifting requires Lazard valuation rather than ordinary substitution. For a polynomial $x$3 and a sample point $x$4, the valuation repeatedly divides out factors $x$5 while nullification occurs, then substitutes $x$6. This recovers root information that would otherwise be lost under direct substitution.

The Maple proof of concept reports clear but uneven empirical gains (Cowen-Rivers et al., 2018). For 60 pairs of bivariate polynomials, incremental projection was on average 16% faster than full recomputation; in faster cases, the gain averaged 55%, although some instances were slower by as much as 87%. For 80 trivariate polynomial pairs, incremental projection was on average 28.64% faster. Lifting results were less favorable: about 30% faster on average for bivariate examples and about 6.7% faster for trivariate ones, with some slower cases. When projection and lifting were combined, total runs were about 37% faster for bivariate inputs and about 12% faster for trivariate ones. The paper attributes part of the overhead to Maple data structures, especially immutable lists.

In both CAD formulations, ICD is best understood as incremental refinement of a structured decomposition under added constraints. The completion step is geometric: an existing partition is made adequate for a larger polynomial set without discarding valid prior work. This is especially relevant for SMT-style use, where constraints are added gradually and satisfiability must be rechecked repeatedly (Cowen-Rivers et al., 2018).

5. ICD-style logit decomposition in class-incremental semantic segmentation

In class-incremental semantic segmentation (CISS), the decomposition principle appears at the representation level rather than at the level of strings or algebraic cells (Baek et al., 2022). At incremental step $x$7, the model receives training data $x$8 for the novel classes $x$9, while previously learned classes $f'^*$0 are unannotated and treated as unknown. Standard CISS methods typically preserve old knowledge either through knowledge distillation (KD) on logits or by freezing feature extractors, but the paper argues that these constraints can hinder learning of discriminative features for new classes.

The key observation is that a class logit for pixel $f'^*$1 and class $f'^*$2,

$f'^*$3

can be decomposed into a sum of positive and negative reasoning terms,

$f'^*$4

Here $f'^*$5 is the sum of positive terms in the elementwise product $f'^*$6, while $f'^*$7 is the sum of the negative terms. These are interpreted as a positive reasoning score, quantifying how likely the input belongs to class $f'^*$8, and a negative reasoning score, quantifying how unlikely it belongs to class $f'^*$9.

Conventional KD constrains only the final logit behavior for old classes. The paper’s claim is that this preserves only the sum of the two reasoning terms, so the positive and negative parts may still change substantially as long as their total remains similar. To address this, it introduces Decomposed Knowledge Distillation (DKD), which separately distills the two components: $f$00 The effect is to push

$f$01

for old classes $f$02, rather than constraining only the total logit. The paper characterizes this as preserving the model’s reasoning process more faithfully and increasing rigidity against forgetting.

The full training objective is

$f$03

where $f$04 is a multiple-BCE loss for novel classes, $f$05 is conventional KD for old classes, $f$06 is the decomposed distillation term, and $f$07 trains an auxiliary classifier. The paper sets $f$08 in its experiments.

A second contribution addresses the lack of negative supervision for newly introduced classes. New classifier heads are initialized not randomly but from an auxiliary classifier $f$09 trained in the previous step to store negative knowledge for future classes. This auxiliary classifier is trained with

$f$10

so that all pixels in $f$11 are treated as negatives for the next step. This yields a successive transfer of negative knowledge across incremental steps. The feature extractor does not receive gradients from $f$12.

The reported results on PASCAL VOC and ADE20K show that BCE-style learning for novel classes outperforms softmax-CE-based methods, that the proposed framework achieves new state of the art on standard CISS benchmarks, and that the full combination of DKD and the initialization strategy gives the best overall metrics, particularly for preserving old-class performance over multiple steps (Baek et al., 2022). In this setting, ICD is not the paper’s name for the method, but the decomposition logic is explicit: a class score is completed from distinct positive and negative reasoning components, and those components are incrementally preserved as the class set grows.

6. Trajectory-based ICD in LLM safety

In LLM safety, Incremental Completion Decomposition is an explicitly named jailbreak attack (Arif et al., 1 Apr 2026). It is defined as a trajectory-based strategy that breaks a harmful request into a sequence of constrained, one-word continuations before asking for the full answer. The initial prompt is transformed into a template such as “$f$13 can be done using: ____ . Return one word only.” The attacker then repeats a continuation prompt such as “And?” for several rounds, eliciting one-word responses semantically related to the harmful objective. Only after this context has been accumulated is the one-word constraint removed and the model asked for a full completion.

Formally, the paper considers a harmful request $f$14, response space $f$15, refusal set $f$16, and harmful compliance set $f$17. A direct query is expected to yield

$f$18

ICD instead constructs an interaction

$f$19

where $f$20 is the initial one-word-constrained query, $f$21 are repeated continuation prompts, and $f$22 is the final prompt requesting a full response. At step $f$23,

$f$24

with $f$25 the accumulated context, and after $f$26 continuation steps the final response is

$f$27

For the prefill variant,

$f$28

Three variants are evaluated. ICD–Auto lets the model generate the intermediate one-word continuations. ICD–Seed manually injects one-word continuations from curated harmful word lists; the paper constructs three harmful word lists per dataset and reports Union ASR, counting an attack as successful if any list induces harmful output. ICD–Prefill combines the Seed trajectory with an assistant prefill string that anchors the start of the final answer. The benchmarks are AdvBench with 520 harmful prompts, JailbreakBench with 100 jailbreak prompts, and StrongREJECT with 313 harmful requests. Attack success is measured by

$f$29

where $f$30 is a Llama-3.1-70B judge.

The headline empirical result is that ICD variants consistently outperform prior jailbreak methods such as PAIR, TAP, CoA, and AMA, with ICD–Prefill usually strongest (Arif et al., 1 Apr 2026). On AdvBench, for Vicuna-1.5-13B, Raw is 4.00, the best prior baseline is AMA at 46.00, and the ICD variants reach 67.50 (Auto), 99.62 (Seed), and 93.08 (Prefill). For Llama-3.1-70B, Raw is 10.00, AMA is 72.00, and ICD reaches 24.62, 30.00, and 82.88. For Qwen-2.5-72B, Raw is 2.00, AMA is 54.00, and ICD reaches 14.04, 22.88, and 77.69. On StrongREJECT, Llama-3.1-70B reaches 55.27 (Auto), 80.19 (Seed), and 84.35 (Prefill), while Qwen-2.5-72B reaches 12.78, 25.24, and 79.23. Across model families including Llama-3, Gemma-3, Qwen-2.5, Qwen-3, and DeepSeek-R1-Distill, the general pattern is that Auto is often effective on smaller models but weaker on larger ones, whereas Seed and especially Prefill remain strong.

The theoretical account models harmful compliance through a safe continuation potential $f$31 and a refusal potential $f$32. For Auto and Seed,

$f$33

and for Prefill,

$f$34

The appendix states propositions that incremental continuation lowers safe continuation and refusal potentials relative to the direct harmful request, that Auto and Seed may differ depending on the realized trajectory, and that prefilling reweights outputs by a prefix-compatibility weight

$f$35

thereby increasing harmful-response probability when harmful outputs are more prefix-compatible than harmless ones.

The paper also provides mechanistic evidence. It estimates a refusal direction

$f$36

and a safety direction

$f$37

then projects layer-wise hidden states onto these directions. For Llama-3.1-8B and Gemma-3-12B, ICD variants drive refusal and safety projections downward, often into negative territory, with the strongest suppression generally produced by ICD–Prefill. The paper reports that these projections correlate with attack success, although Auto exhibits greater variability due to stochastic trajectories and judge-based evaluation noise.

7. Comparative interpretation and common misconceptions

A first misconception is that ICD names a single standardized algorithm. The literature here does not support that reading. Only the LLM safety paper explicitly titles its method Incremental Completion Decomposition (Arif et al., 1 Apr 2026). In the incremental compression paper, ICD is an interpretation of the theory’s repeated shortest-feature extraction and exact completion relation $f$38 (Franz et al., 2019). In CAD, the papers develop incremental decomposition and refinement procedures without presenting ICD as a canonical formal term [(Chen et al., 2012); (Cowen-Rivers et al., 2018)]. In semantic segmentation, the relevant method is explicitly named Decomposed Knowledge Distillation, not ICD (Baek et al., 2022).

A second misconception is that “incremental” merely means iterative. In all four settings, incrementality is tied to structured reuse of prior state. Incremental compression reuses the residual from the previous compression step; CAD reuses an existing cylindrical tree or projection table; DKD reuses previously learned classifiers and distilled reasoning components; the jailbreak attack reuses accumulated conversational context across turns. The decomposition is not a repeated restart.

A third misconception is that “completion” always means exact symbolic reconstruction. This is true in the algorithmic-information-theoretic setting, where each feature and residual satisfy $f$39 (Franz et al., 2019). In CAD, completion means finishing or refining a decomposition so that it becomes adequate for an enlarged polynomial set [(Chen et al., 2012); (Cowen-Rivers et al., 2018)]. In DKD, completion occurs at the level of a class score as the sum of positive and negative reasoning terms (Baek et al., 2022). In LLM safety, completion is conversational: a harmful final response is made more likely after an incremental trajectory of constrained local continuations (Arif et al., 1 Apr 2026).

A fourth misconception is that decomposition necessarily implies efficiency or safety. The CAD literature explicitly notes that incrementality does not remove doubly exponential worst-case complexity (Chen et al., 2012). The DKD work uses decomposition as a retention mechanism in continual learning (Baek et al., 2022). The LLM safety paper, by contrast, uses decomposition offensively: the sequential buildup of harmful context is precisely what breaks prompt-local safety behavior (Arif et al., 1 Apr 2026).

Taken together, these uses suggest a broad methodological family rather than a single formalism. The common pattern is that a target is approached through sequentially extracted or injected components whose ordering matters, whose interaction is meant to be controlled, and whose cumulative effect differs from a one-shot treatment. That broad interpretation is directly formalized in incremental compression, operationalized in incremental CAD, adapted to classifier reasoning in class-incremental segmentation, and weaponized as a multi-turn jailbreak strategy in aligned LLMs [(Franz et al., 2019); (Chen et al., 2012); (Cowen-Rivers et al., 2018); (Baek et al., 2022); (Arif et al., 1 Apr 2026)].