Router-Prompt Co-Evolution Strategy

• Router-Prompt Co-Evolution Strategy is a design approach where routing and prompting are jointly optimized to adapt system behavior and improve task-specific outcomes.
• It partitions inputs among specialized LLM agents and evolves prompt strategies based on continuous feedback, enhancing accuracy and reliability.
• Applications span vulnerability detection, prompt-injection defense, and adaptive tutoring, yielding measurable performance improvements in various metrics.

Router-Prompt Co-Evolution Strategy denotes a class of large-language-model system designs in which routing and prompting are treated as mutually dependent optimization variables rather than as separate layers. In these systems, a router partitions inputs by category, expert, prompt slot, safety state, or model choice, while prompt updates specialize the behavior of the routed component; the resulting behavioral changes then alter the evidence and supervision available to subsequent router updates. Across recent work, this closed-loop pattern appears in coarse-to-fine vulnerability detection, prompt-injection defense, heterogeneous test-time prompt learning, multi-agent question answering, adaptive tutoring, and diversity-oriented model selection (Wu et al., 26 Jan 2026, Liu et al., 27 Aug 2025, Xu et al., 9 Jun 2026, Huang et al., 6 Apr 2026, Chang et al., 18 Jun 2026, Liu et al., 2 Apr 2026).

1. Core concept and representative formulations

Across the cited literature, the strategy takes several concrete forms. In MulVul, a Router agent first predicts the top-$k$ coarse CWE categories and forwards the input to specialized Detector agents, while prompts for both Router and Detectors are optimized offline by Cross-Model Prompt Evolution (Wu et al., 26 Jan 2026). In EEVEE, a router partitions a mixed multi-dataset stream into $K$ prompt slots, and prompt learning is interleaved with router learning so that task clusters and slot-specialized prompt behaviors improve together (Xu et al., 9 Jun 2026). In EvolveRouter, a graph-based router ranks a pool of 24 LLM agents, while router diagnostics are used to rewrite underperforming agent instructions; the refined agents then provide cleaner supervision for the next router round (Huang et al., 6 Apr 2026).

A second formulation casts the router as a safety gate. The AEGIS adaptation maps defender prompts to router or guard prompts that classify inputs as benign versus injection or unsafe and choose route actions from $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$, while attacker prompts and defender prompts are alternately co-evolved against one another (Liu et al., 27 Aug 2025). A third formulation uses online policy adaptation over a fixed prompt library. In adaptive tutoring, the router chooses one of 20 expert-authored pedagogical prompt families from a contextual bandit policy; during deployment, prompts remain fixed for safety, but the routing policy continuously reweights prompt usage from live feedback, producing a weaker but operationally important form of co-evolution (Chang et al., 18 Jun 2026).

These variants share a common structural claim: the optimal prompt depends on the routing policy, and the optimal routing policy depends on the prompt-conditioned behavior of the routed experts. EEVEE makes this dependency explicit by stating that better routing decisions produce cleaner per-slot learning signals, and better per-slot prompts make routing quality observable; EvolveRouter states the same dependency in closed-loop form, with router diagnostics guiding agent improvement and refined agents providing cleaner supervision for routing (Xu et al., 9 Jun 2026, Huang et al., 6 Apr 2026).

2. Architectural patterns

The most common architectural pattern is discrete input partitioning followed by prompt specialization. MulVul operates coarse-to-fine: the Router consumes raw code $x$ and its SCALE structured representation $T(x)$, retrieves global evidence $E_R$, and returns a ranked list of top-$k$ coarse categories; specialized Detectors then receive contrastive evidence $E_m$ from in-category positives, clean negatives, and out-of-category hard negatives, and output fine-grained CWE predictions and explanations (Wu et al., 26 Jan 2026). EEVEE adopts an analogous partition-and-specialize design for heterogeneous task streams, but the routed objects are prompt slots rather than CWE detectors; the router assigns each input to one of $K$ retained prompts, and each slot evolves on routed data to mitigate cross-dataset interference (Xu et al., 9 Jun 2026).

A second pattern is query-conditional routing over a set of already heterogeneous agents. EvolveRouter builds a heterogeneous graph with query, agent, and entity nodes, trains a RouterGNN to score query-agent compatibility, and then performs adaptive inference: agents are queried in router rank order, and the system stops when router-weighted answer agreement is strong enough (Huang et al., 6 Apr 2026). The tutoring system uses a lighter-weight version of the same idea: the router observes a subject-topic representation and selects one pedagogical strategy from a discrete prompt pool, with 80% greedy exploitation and 20% stochastic sampling for exploration (Chang et al., 18 Jun 2026). The diversity-routing work extends this architecture to model selection for open-ended generation, where the router predicts the best model for each prompt under a diversity-coverage objective; the accompanying synthesis proposes prompt co-evolution by jointly optimizing model routing and prompting strategy (Liu et al., 2 Apr 2026).

Safety-oriented systems replace expert selection with action selection. In the AEGIS adaptation, the router or guard prompt sits upstream of the application model and is evaluated by whether it correctly flags malicious inputs and preserves benign traffic. The attacker attempts to induce unsafe routing, bypass filtering, or trigger harmful tool calls; the defender attempts to maximize correct detection and benign pass-through while managing false positives and false negatives (Liu et al., 27 Aug 2025). This makes routing itself the object of prompt hardening.

A plausible broader interpretation includes systems that do not learn an explicit router but do learn a controller that decides what information to present next. CAIP asks the model which context types it needs—Neighboring $N(P)$, Similar $K$0, or Referenceable $K$1—and iteratively assembles only the requested configuration context under a token budget; Verified Prompt Programming sends verifier-localized feedback back into the prompt loop to decide what correction should be attempted next (Jiang et al., 2024, Mondal et al., 2023). This suggests that router-prompt co-evolution can also be realized as controlled context selection rather than only as expert gating.

3. Optimization mechanisms

The central algorithmic choice is how to break the circular dependence between routing and prompting. MulVul resolves it by offline staged evolution. Stage I evolves the Router prompt population for Recall@$K$2; Stage II evolves each Detector prompt population for F1 within its coarse category. A generator LLM, Claude Opus 4.5, mutates and refines prompts, while a distinct executor LLM, GPT-4o, runs the task and reports fitness. The paper’s stated rationale is that decoupling generation and evaluation mitigates the self-correction bias inherent in single-model optimization (Wu et al., 26 Jan 2026).

AEGIS uses adversarial alternating optimization. With the defender fixed, attacker prompts are improved using Textual Gradient Optimization (TGO+), a gradient-like natural-language update mechanism built from error strings, LLM feedback, and a gradient buffer. With the attacker fixed, defender prompts are updated by the same mechanism. This proceeds for $K$3 GAN-like iterations or until convergence, with co-evolution, gradient buffering, and multi-objective optimization all reported as materially important in the ablations (Liu et al., 27 Aug 2025).

EEVEE uses interleaved router and prompt learning phases under a three-stage schedule of initialization, exploration, and convergence. Router evolution is discrete and black-box: candidate routers are generated by mutation and reflection, scored by downstream accuracy plus consistency and balance regularizers during evolution, and selected by downstream accuracy at the final stage. Prompt evolution is also discrete: slot-specific prompts are mutated or reflected, admitted only if they beat the empty-prompt floor and remain on a Pareto frontier defined by per-example correctness vectors (Xu et al., 9 Jun 2026). This is a strict co-evolutionary design in which routing and prompting are updated in alternating blocks rather than jointly differentiated.

EvolveRouter combines supervised router training with conservative prompt rewriting. It first executes all agents on training queries, converts token-level F1 scores into soft routing targets, and trains the RouterGNN by minimizing a KL divergence to those targets. It then collects failure archives, per-agent severity, and router weight statistics; a rewriter LLM proposes minimal prompt edits for selected agents, and a validation gate accepts only rewrites that do not introduce unacceptable regression. The router is fine-tuned from the previous checkpoint after accepted prompt changes rather than retrained from scratch (Huang et al., 6 Apr 2026).

Online adaptation introduces another mechanism. In the tutoring system, the router is an actor-critic network trained with PPO in a single-step contextual bandit regime with $K$4, and co-evolution occurs through policy reweighting over a fixed prompt set rather than direct prompt mutation (Chang et al., 18 Jun 2026). SCOPE and Helix generalize the design space further: SCOPE synthesizes trace-based guidelines into tactical and strategic memories and then sketches a router over prompt experts, while Helix replaces question-side optimization with router-side optimization under planner scheduling, critique, and mediator validation (Pei et al., 17 Dec 2025, Zhu et al., 20 Mar 2026).

4. Objectives, metrics, and formal criteria

Router-Prompt Co-Evolution Strategy is defined less by a single optimization algorithm than by a family of objective pairings. In MulVul, router fitness is coverage-oriented, $K$5, while detector fitness is category-specific $K$6; the final evaluation uses macro-averaged fine-grained metrics,

$K$7

$K$8

The router itself does not implement an explicit softmax or probability computation; instead, the LLM outputs a ranked list of coarse categories based on prompt-guided reasoning and retrieved evidence (Wu et al., 26 Jan 2026).

In AEGIS, the attack and defense objectives are explicitly adversarial. Core metrics are

$K$9

with companion false-positive and false-negative rates. The representative defender objective is

$$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$0

and TGO+ uses scalarized scores such as $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$1 to steer prompt edits (Liu et al., 27 Aug 2025).

EEVEE formalizes router quality as a score rather than as a gradient loss:

$$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$2

where $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$3 is downstream accuracy, $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$4 combines compactness and separation, and $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$5 rewards non-collapsed slot usage and balance. Prompt evolution in slot $$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$6 maximizes validation performance subject to two constraints: beating the empty-prompt floor and remaining on the Pareto front of non-dominated prompt candidates (Xu et al., 9 Jun 2026).

EvolveRouter uses soft routing supervision derived from agent quality. For each query, a soft target distribution is formed by temperature-scaling per-agent F1 scores, and the router minimizes

$$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$7

At inference time it introduces a stopping criterion over the top-$$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$8 consulted agents:

$$\{ \text{pass-through}, \text{sanitize}, \text{clarify}, \text{refuse}, \text{route-to-tool-X}, \text{escalate} \}$$9

and stops at the smallest $x$0 such that $x$1 (Huang et al., 6 Apr 2026).

Other domains instantiate different rewards. The tutoring router observes context $x$2, selects a prompt family, and is trained on a calibrated pedagogical reward

$x$3

where the 14 binary features are extracted from conversation transcripts (Chang et al., 18 Jun 2026). Diversity-oriented routing optimizes a set-level objective:

$x$4

which measures the total quality scores assigned to each unique answer in the predicted set relative to the best possible answer set of the same size (Liu et al., 2 Apr 2026).

5. Empirical behavior across domains

The empirical record shows that co-evolution is most persuasive when the routed experts are genuinely heterogeneous. MulVul, evaluated on PrimeVul with 6,968 vulnerable and 229,764 benign C/C++ functions across 10 categories and 130 CWE types, achieved 34.79\% Macro-F1 at type level, outperforming the best baseline by 10.21 points, or 41.5\% relative. Its ablations reported 34.56\% for the full system, 21.80\% without retrieval, 28.61\% without agents, and 22.80\% without evolution; cross-model prompt evolution was reported to yield a 51.6\% relative improvement over manual prompts, and type-level Macro-F1 peaked at $x$5 (Wu et al., 26 Jan 2026). In the safety setting, AEGIS reported attacker ASR reaching 1.0, defense TPR reaching 0.84, and TNR remaining comparable at 0.89; removing the gradient buffer degraded final performance by roughly 15–20\%, and single-metric optimization produced detectors with poor TNR (Liu et al., 27 Aug 2025).

Task-heterogeneous systems show analogous gains. EEVEE improved average multi-benchmark scores by 10.38 points over Qwen3-4B-Instruct and by 24.32 points over DeepSeek-V3.2, and reported positive cumulative retention of +41.53 in an incremental multi-benchmark setting where GEPA and ACE ended at $x$6 and $x$7 respectively. On Qwen3-4B-Instruct, the full system scored 51.75, compared with 43.58 for a default router, 37.18 for a manual fixed router, and 42.88 for a two-stage variant without co-evolution (Xu et al., 9 Jun 2026). EvolveRouter outperformed AgentRouter across all five QA benchmarks; on TriviaQA it reported 69.83 F1 versus 62.75 and 60.00 EM versus 51.33, while adaptive collaboration reduced agent calls from 24 to an average of 2.9–7.4 per query, a 69–88\% reduction (Huang et al., 6 Apr 2026).

In online adaptation settings, co-evolution can manifest as policy drift over a fixed prompt library. The tutoring system reported a simulation benchmark score of 0.694 versus 0.647 and 0.64 for two static baselines ($x$8), and online A/B testing over $x$9 conversations from 359 students showed that the router shifted from analytical to scaffolding strategies. The adaptive prompt selection mechanism maintained pedagogical quality, reduced interactions by around 3 turns ($T(x)$0), and the stochastic router arm reached a 28.1\% exercise conversion rate, compared with 19.1\% for greedy routing and 19.6\% for the baseline arm (Chang et al., 18 Jun 2026).

For open-ended generation, router learning already improves diversity even before full prompt co-evolution is implemented. On NB-WildChat, the trained router achieved 26.3\% diversity coverage versus 23.8\% for the single best model baseline, and router-selected top-2 ensembling reached 26.7\%. On NB-Curated, the Binary MLP with model-agnostic encodings reached 40.7\% versus 38.6\% for the top-overall baseline (Liu et al., 2 Apr 2026). These results do not by themselves establish a closed-loop router-prompt method, but they provide a natural empirical substrate for one.

6. Limitations, boundary conditions, and adjacent research

The main limitations are domain specificity, supervision cost, and instability under distribution shift. MulVul was evaluated only on C/C++ code in PrimeVul, requires iterative offline evolution plus $T(x)$1 online LLM calls per input, and did not thoroughly test transfer of evolved prompts beyond GPT-4o as executor (Wu et al., 26 Jan 2026). AEGIS was developed in an assignment-grading prompt-injection setting and explicitly notes stronger adaptive attackers, toolchain exploits, and multi-turn strategies as unresolved extensions (Liu et al., 27 Aug 2025). The tutoring system relies on a discrete, expert-vetted prompt pool; prompts were not updated online, sparse downstream labels remain a limitation, and long-tail subjects converge more slowly (Chang et al., 18 Jun 2026).

Black-box co-evolution also introduces search-specific fragility. EEVEE depends on labeled adaptation data, uses stochastic mutation and reflection rather than differentiable optimization, and is sensitive to slot count, annealing, and per-slot budget, even though the reported averages are stable across tested configurations (Xu et al., 9 Jun 2026). EvolveRouter reports poor task transferability of routers across datasets with different reasoning demands, prompt drift from LLM rewriting, and sensitivity to adaptive-collaboration hyperparameters such as $T(x)$2, $T(x)$3, and $T(x)$4 (Huang et al., 6 Apr 2026). Diversity routing likewise shows that model-specific query encodings improve in-domain performance but hurt out-of-domain generalization, and routing is prompt-specific across G-1, G-2, and G-All generation strategies (Liu et al., 2 Apr 2026).

Adjacent work broadens the concept while also revealing boundary conditions. SCOPE introduces trace-based guideline synthesis, dual-stream routing between tactical and strategic memories, and perspective-driven exploration, but explicitly states that it does not include a learned router policy that selects among prompt experts during execution; its router component is presented as a concrete integration rather than as the evaluated system (Pei et al., 17 Dec 2025). Helix proposes an adaptation in which a Router-Architect co-evolves with prompts under planner-guided decomposition and mediator validation, making semantic preservation and synergy explicit constraints (Zhu et al., 20 Mar 2026). CAIP and Verified Prompt Programming show that iterative context selection and verifier-localized feedback can serve router-like control functions in the absence of explicit expert gating (Jiang et al., 2024, Mondal et al., 2023).

A further boundary condition appears in the evolutionary routing literature. The decomposition study on evolutionary mixture-of-LoRA architectures reports that the router rewrite carries the measured gain on its widened-1536 substrate, while lifecycle operations are a net drag, and the synthetic sandbox locates a regime boundary: evolutionary search on the routing channel is load-bearing only when adapters are pre-aligned to the task (Kumaresan, 11 May 2026). This suggests that prompt-induced pre-alignment may be a practical prerequisite for effective router evolution in some systems. In automatic algorithm design, EvoPH and the swarm-intelligence co-evolution framework extend the idea even further by treating routing as archive gating, island migration, or prompt-template control over algorithmic operators, rather than only as expert selection at inference time (Liu et al., 29 Sep 2025, Cen et al., 10 Dec 2025).

Taken together, the literature does not define a single canonical Router-Prompt Co-Evolution Strategy. Instead, it defines a research family whose unifying principle is reciprocal adaptation: routing partitions the problem space, prompting shapes specialist behavior, and each side is updated using signals created by the other. The strongest current evidence supports this principle when tasks are heterogeneous, experts are meaningfully complementary, and optimization is explicitly designed to prevent collapse, overfitting, or self-confirming prompt edits (Wu et al., 26 Jan 2026, Xu et al., 9 Jun 2026, Huang et al., 6 Apr 2026).