---
title: 'Safe-by-Coevolution: Adaptive Safety Strategies'
url: https://www.emergentmind.com/topics/safe-by-coevolution
type: topic
---

# Safe-by-Coevolution: Adaptive Safety Strategies

Safe-by-Coevolution denotes a family of research programs in which safety is pursued by coevolving the objects that ordinarily remain fixed in conventional optimization and alignment pipelines: fitness definitions, trade-off weights, attack distributions, safety models, or system-level analysis artifacts. In these formulations, safety is not treated as a static wrapper or as a single hand-designed proxy; it is made adaptive by coupling solution search to a second evolutionary process that modifies how progress is measured, how threats are generated, or how intermediate system states are analyzed. The concept appears most explicitly in the SAFE line of work on coevolving solutions and objective functions, and is later extended to multiobjective optimization, model-based safety/security analysis for self-adaptive systems, adversarial multi-agent reinforcement learning, multimodal alignment, and a broader systems proposal for continual safety maintenance [2206.12707] [2401.10515] [2509.06786].

## 1. Conceptual core and terminology

The central intuition behind safe-by-coevolution is the separation of the **objective** from the **objective function**. SAFE was introduced in response to what its authors describe as a fundamental optimization mistake: treating the objective as if it were the objective function. In the maze example, the objective is unambiguous—reach the goal—but a fixed proxy such as \(1/\mathit{distToGoal}\) can be deceptive because a controller may be physically close to the goal while trapped behind a wall. The resulting failure is not merely failure of search; it is failure of the chosen proxy to support evolvability or learnability [2206.12707].

This distinction generalizes. In later safe-by-coevolution formulations, what evolves is not only a solution candidate but also one of the following: a scoring rule over multiple objectives, a family of adversarial prompts that shapes the defender’s threat model, a set of system models that track transient adaptation states, or a verification-and-feedback apparatus that updates the safety margin over time. Taken together, these works suggest a common design principle: when safety depends on a brittle proxy, a frozen threat model, or a static post-deployment analysis, robustness may improve if the evaluative or adversarial environment is itself allowed to adapt [2206.13509] [2309.09653] [2603.01784].

The term does **not** denote a uniform coevolutionary regime. SAFE is explicitly described as **commensalistic coevolution**, where the solution population benefits from the objective-function population, while the objective-function population is not directly scored by solution quality. Later papers use competitive attacker–defender dynamics, and the self-adaptive-systems paper uses co-evolution of models via transformations rather than coevolution of biological or agent populations. Safe-by-coevolution is therefore best understood as a design stance rather than a single algorithmic template [2401.10515].

A recurrent clarification in this literature is that safe-by-coevolution is not, by itself, a formal safety guarantee. One survey-style treatment of SAFE states explicitly that “safe-by-coevolution” is not a formal theorem or safety guarantee, but rather a way to be “safe from the brittleness of a manually chosen fitness function” by treating fitness as an evolvable object. Only the later \(\texttt{R}^\textbf{2}\texttt{AI}\) position paper attempts an abstract inductive formalization of continual safety [2401.10515] [2509.06786].

## 2. SAFE: coevolving solutions and objective functions

The canonical safe-by-coevolution mechanism is **Solution And Fitness Evolution (SAFE)**. SAFE maintains two coevolving populations: a population of candidate solutions and a population of candidate objective functions. In the original maze domain, the solution population consists of robot controllers encoded as 16-dimensional real vectors \([p_1,\ldots,p_{16}] \in \mathbb{R}\cap[-1,1]\), while each objective-function individual is a two-gene genome \([a,b]\) with both values in \([0,1]\). The maze is a \(100\times100\) grid; the robot moves horizontally or vertically; it has four distance-to-obstacle sensors and four goal-direction sensors; and each controller is simulated for 300 steps [2206.12707].

The controller computes horizontal and vertical movement signals from weighted sums of the eight sensors:
\[
h= p_1\mathit{dist_{right} + p_2\mathit{goal_{right} + p_3\mathit{dist_{left} + p_4\mathit{goal_{left} + p_5\mathit{dist_{down} + p_6\mathit{goal_{down} + p_7\mathit{dist_{up} + p_8\mathit{goal_{up}
\]
\[
v= p_9\mathit{dist_{right}+ p_{10}\mathit{goal_{right} + p_{11}\mathit{dist_{left} + p_{12}\mathit{goal_{left} + p_{13}\mathit{dist_{down} + p_{14}\mathit{goal_{down} + p_{15}\mathit{dist_{up} + p_{16}\mathit{goal_{up}
\]
and movement is determined by the signs of \(h\) and \(v\), subject to collision constraints. The evaluative novelty lies not in the controller architecture but in the coevolved fitness layer.

For the solution population, each controller is first simulated to obtain \(\mathit{endPosition}_i\), \(\mathit{distToGoal}_i\), and a phenotypic novelty score \(\mathit{noveltyScore}_i\). Every objective-function individual \(O_j\) then evaluates the solution, and the solution’s fitness is the best score produced by the current objective-function population:
\[
\mathit{solutionFitness}_i = \max_j f_j.
\]
In the maze instantiation, the \([a,b]\) genome parameterizes a blend of distance-to-goal and novelty, so SAFE does not assume in advance how much emphasis should be placed on goal pressure versus exploration [2206.12707].

The objective-function population is evaluated differently. The authors report that mutualistic alternatives, such as rewarding objective functions by correlation with actual solution quality, performed poorly and reproduced the local-minima problem they were trying to avoid. The working design is a **commensalistic novelty-based fitness**: objective functions are scored by **genotypic novelty**, using Euclidean distance in the two-dimensional \([a,b]\) space,
\[
\sqrt{(a_1-a_2)^2 + (b_1-b_2)^2},
\]
and novelty is the average distance to the \(k=15\) nearest neighbors in the current population plus an archive of previously novel individuals. The consequence is a characteristic asymmetry: solutions are evaluated phenotypically in the task domain, while candidate objective functions are evolved genotypically by novelty among themselves [2206.12707].

The original experiments compare SAFE with a standard EA using \(1/\mathit{distToGoal}\), novelty search, and random search. The standard EA fails completely on both mazes, with zero successful runs. On maze1, novelty search succeeds in 322 of 500 runs and SAFE in 328; on maze2, novelty search succeeds in 10 runs and SAFE in 17. Random search performs poorly despite a budget of 100,000 sampled candidates. Among successful SAFE runs, the evolved coefficients mix goal pressure and novelty with slightly stronger novelty emphasis: for maze1, mean \(a=0.85\) and mean \(b=0.99\); for maze2, mean \(a=0.83\) and mean \(b=0.98\). A control using SAFE’s scoring family with fixed \(a=b=0.5\) also performs well, indicating that the family of coevolved objective functions is effective even when the weights are fixed by hand [2206.12707].

## 3. Extensions to multiobjective optimization and model interpretability

SAFE was subsequently adapted to multiobjective optimization. In the ZDT1–ZDT4 benchmarks, the solution population is a 30-dimensional real vector \(x=x_1,\ldots,x_{30}\), and each objective-function individual remains a pair \([a,b]\in[0,1]\), now interpreted as a weighting scheme over the two objectives \(f_1\) and \(f_2\). The weights are normalized,
\[
a'_j \gets \frac{a_j}{a_j+b_j}, \qquad b'_j \gets \frac{b_j}{a_j+b_j},
\]
and each objective-function individual evaluates a solution by
\[
O_j(S_i) \gets \frac{1}{a'_j \times f_1(S_i) + b'_j \times f_2(S_i)}.
\]
The solution fitness is again \(\max_j O_j\), so each candidate is judged by an evolving ensemble of scalarizations rather than by a fixed weighted sum [2206.13509].

A defining claim of this SAFE variant is that it does **not** use the Pareto front to compute fitness or select parents. Pareto information is recorded only for analysis. Nonetheless, the reported results suggest that a Pareto-like approximation can emerge indirectly through coevolution of weighted scalar objective functions and solutions. Over 50 replicate runs on each of ZDT1–ZDT4, using 3000 generations, a solution population of 500, an objective-function population of 150, tournament selection of size 5, single-point crossover at rate 0.8, mutation rate 0.4 for both populations, and elitism preserving the top 2 individuals, SAFE achieves average inverted generational distance values of \(2.06 \times 10^{-4}\) on ZDT1, \(2.65 \times 10^{-4}\) on ZDT2, \(3.81 \times 10^{-2}\) on ZDT3, and \(1.23 \times 10^{-3}\) on ZDT4 [2206.13509].

The same coevolutionary idea was also transferred to biomedical predictive modeling with genetic programming trees, where the trade-off is between **balanced accuracy** and **model complexity**. In that setting, each solution individual is a GP tree and each objective-function individual is again a length-2 vector \([a,b]\), now weighting accuracy against the reciprocal complexity term:
\[
O_j(S_i) = a_j \times \mathit{accuracy}_i + b_j \times \frac{1}{1 + \mathit{complexity}_i}.
\]
Complexity is defined as the number of nodes in the GP tree. The solution population is initialized by ramped half-and-half, solution selection uses lexicase selection, solution variation uses subtree crossover and subtree mutation, objective-function crossover is single-point crossover, objective-function mutation replaces one of the two genes with a random value, elitism copies the best 2 individuals unchanged, population sizes are 100 for solutions and 30 for objective functions, and runs last 2000 generations with 30 replicate runs [2206.15409].

The experiments use GAMETES datasets with 2-locus and 3-locus epistatic problems, heritabilities \(0.1, 0.2, 0.3, 0.4\), minor allele frequency 0.2, dataset size 800, 100 features, EDM-1 and EDM-2 architectures, and a 3-locus XOR case. Across 840 complete evolutionary runs with 5-fold cross-validation, the main reported finding is that SAFE automatically balances accuracy and complexity “with no loss in performance” relative to a baseline EA with fixed \(a=b=0.5\), while often producing smaller models. The average evolved weights are \(a=0.57\) with \(SD=0.11\) and \(b=0.43\) with \(SD=0.11\), suggesting modest preference for accuracy without overwhelming suppression of simplicity [2206.15409].

These extensions establish a narrower but important sense of safe-by-coevolution: safety is pursued not by external constraint satisfaction, but by reducing dependence on brittle, user-specified scalarizations. In deceptive search and interpretability-sensitive modeling, the coevolved objective-function layer acts as a meta-optimization process over the criterion of progress itself.

## 4. Co-evolving models, policies, and intermediate system states

Safe-by-coevolution has also been used outside evolutionary optimization of candidate solutions. In self-adaptive systems, the key issue is that safety and security analyses are usually static even though adaptation is not atomic. The proposed response is a multi-model workflow in which a **Dataflow Graph** and a **Deployment Model** “are closely representing the system and are able to adapt and co-evolve with the self-adaptive system.” Adaptation steps are modeled by graph transformations, producing transient states that can then be reanalyzed for safety hazards and security attacks [2309.09653].

The modeling stack comprises a Dataflow Graph for logical architecture and information flow, a Deployment Model for realization on protocols, libraries, hardware, and platforms, Fault Trees for safety hazards, Attack Trees for security attacks, and an Attack-Fault Tree constructed by rule-based translation. Combination rules derived from CWE and CAPEC bridge the abstraction gap between low-level vulnerabilities and high-level hazards, while CVSS impact requirements constrain which events may be linked. Henshin is used for graph transformation rules, and the paper gives a concrete example that switches a `commands` channel dependency from `WiFi` to `Radio` by deleting the former dependency and creating the latter [2309.09653].

The motivating UAV example illustrates the importance of transient states. A quadcopter controlled via WiFi may adapt to long-range radio when WiFi weakens. During this transition, a temporary configuration can expose a vulnerability that allows injection of a false return message into the commands channel. The resulting Attack-Fault Tree shows that a Mavlink vulnerability in combination with radio communication can lead to loss of control of the UAV during adaptation. The safe-by-coevolution aspect here is not coevolved fitness, but co-evolution of analysis models with the adapting system so that unsafe intermediate states become analyzable rather than invisible [2309.09653].

A different extension appears in the proposal to model SARS-CoV-2 evolution and public-health response as a **dual GA**. One population represents virus variants, another represents policy bundles, and the two interact through the human population. Viruses are binary strings whose mutation effects on reproduction rate are drawn uniformly from \([-1,1]\); policy genomes are also binary strings, with intervention effects based on empirical estimates from Haug et al. (2020). Policy fitness is based on the weighted effective reproduction rate of three randomly chosen viruses, selection uses roulette wheel cumulative fitness selection with adjusted fitness \(1/(1+r)\), and policy mutation is one-way activation rather than reversible toggling. The stated purpose is to use competitive coevolution as a laboratory to “debug” policy measures, identify weaknesses, and anticipate virus evolution under intervention pressure [2102.12365].

These examples broaden safe-by-coevolution from algorithmic optimization to preventive analysis. A plausible implication is that coevolution can serve not only to discover better solutions, but also to expose failure modes that static analyses or fixed policy assumptions systematically miss.

## 5. Adversarial coevolution and internalized safety in agentic systems

From 2025 onward, safe-by-coevolution is increasingly associated with **internalized safety** in LLM-based multi-agent systems and multimodal alignment. The common argument is that external guard modules create a single point of failure and do not make task agents safe in themselves. Safety should therefore be learned by the agents that actually act, under pressure from evolving adversaries [2508.03864] [2510.01586] [2603.01784].

In **Evo-MARL**, every task agent is trained to perform its primary function and resist adversarial threats, while an evolving pool of attack prompts is maintained by mutation and crossover or recombination. The defenders share a policy network \(\pi_\theta\) and are trained with **Group Relative Policy Optimization (GRPO)**; rewards are assigned from the final system response, with defenders receiving \(+1\) for safe responses and an additional \(+0.5\) for correct answers, while unsafe or incorrect responses are penalized. The attacker side is not included in RL optimization; it is treated as an external third-party adversary whose attack success rate acts as evolutionary fitness. Reported results include attack-success-rate reductions of up to 22% and accuracy gains of up to 5% on reasoning tasks, with trained 1.5B systems surpassing untrained 3B and, on some benchmarks, even untrained 7B systems in safety [2508.03864].

**AdvEvo-MARL** uses a more symmetric adversarial co-evolutionary RL formulation. Attackers are first warmed up by supervised fine-tuning on a curated jailbreak dataset built from 1,000 harmful behaviors and about 4,000 high-quality training samples, then attackers and defenders are jointly optimized through repeated interaction with **REINFORCE++**. A notable contribution is the **public baseline** for advantage estimation:
\[
b^A(\tau) = \frac{1}{|\mathcal A|} \sum_{i\in\mathcal A} r^A_i(\tau), \qquad
b^D(\tau) = \frac{1}{|\mathcal D|} \sum_{j\in\mathcal D} r^D_j(\tau),
\]
with each agent’s advantage defined relative to the mean return of its functional group. This is claimed to reduce variance and improve intra-group coordination. Across NetSafe, AutoInject, and UserHijack scenarios, the framework keeps attack-success rate generally below 20%, whereas baselines reach up to 38.33%, while preserving and sometimes improving task accuracy, including up to \(+3.67\%\) on reasoning tasks [2510.01586].

**CEMMA** extends the same logic to multimodal alignment under black-box prompt search. Its **Evolutionary Attacker** decomposes an adversarial query into a fixed image \(I_i\), an evolving text prompt \(T_i^{(g)}\), and a harmful intent label \(t_i\), then uses mutation, crossover, and differential evolution to search for stronger jailbreaks. The **Adaptive Defender** is iteratively fine-tuned on an archive of successful jailbreaks mixed with benign dialogue data, creating a closed-loop attacker–defender process. The reported attacker ASR rises from seed-population levels of roughly 38.60% on SafeBench and 39.29% on MM-safetybench to peaks up to 78.60% and 78.57%, respectively, demonstrating the strength of the evolving attacker; on the defense side, the co-evolutionary update improves robustness and generalization, uses only about 5% archived adversarial examples mixed with mostly benign data, avoids excessive benign refusal, and remains compatible with AdaShield [2603.01784].

Across these systems, safe-by-coevolution shifts from proxy discovery to threat-model discovery. Safety is not bolted on as a filter after generation; it is trained into the policy by sustained exposure to an adaptive adversary.

## 6. Formalizations, misconceptions, and open limitations

The most explicit abstract formalization of safe-by-coevolution appears in the \(\texttt{R}^\textbf{2}\texttt{AI}\) position paper, which defines a safety margin \(\mathbb{M}\) and states that the system is safe at time \(t\) when
\[
A_t \in \mathbb{M}.
\]
It then introduces two hypotheses. The **Near-Term Safety Guarantee** states that there exists \(t_0\) such that \(A_{t_0}\in\mathbb{M}\). The **Safe Iterative Step** states that if \(A_t\in\mathbb{M}\), then the coevolutionary mechanism \(\mathcal C\) yields \(A_{t+1}=\mathcal C(A_t)\in\mathbb{M}\). From these, the paper derives **Continual Safety via Induction**:
\[
A_t \in \mathbb{M}, \quad \forall t \geq t_0.
\]
Operationally, the framework instantiates this view with a **Fast Safe Model**, a **Slow Safe Model**, a **Safety Wind Tunnel**, a **Verifier**, and continual feedback loops that let safety and capability coevolve [2509.06786].

This formalization clarifies a frequent misconception. Safe-by-coevolution does not ordinarily mean that coevolution alone guarantees safety. The SAFE survey explicitly states that the term is not a theorem or safety guarantee, and the \(\texttt{R}^\textbf{2}\texttt{AI}\) induction argument is conditional on both a verifiably safe starting point and an update rule that preserves the safety margin. In practice, several papers retain explicit verification or judging components: CEMMA depends on an LLM-as-a-judge and archive curation, the self-adaptive-systems work depends on Attack-Fault-Tree analysis, and \(\texttt{R}^\textbf{2}\texttt{AI}\) makes the Verifier a central subsystem rather than an optional add-on [2401.10515] [2309.09653] [2603.01784].

A second misconception is that safe-by-coevolution is synonymous with mutualistic or Pareto-based coevolution. SAFE is deliberately **commensalistic**, not mutualistic, and its multiobjective version seeks Pareto-approximate fronts without using Pareto dominance, Pareto ranking, or hypervolume in the optimization engine [2206.13509]. A third misconception is that the framework necessarily eliminates external defenses. CEMMA is explicitly compatible with AdaShield, and \(\texttt{R}^\textbf{2}\texttt{AI}\) combines internalized safety with externalized verification and adversarial simulation [2603.01784] [2509.06786].

The limitations are correspondingly diverse. SAFE’s authors describe the multiobjective study as preliminary, note that computational cost was not analyzed in depth, and acknowledge that better novelty or fitness measures for objective functions may exist. The objective-function population in the reported SAFE work is also deliberately simple, often just \([a,b]\), which restricts expressivity even as it clarifies the concept [2206.13509]. The self-adaptive-systems proposal is explicitly a vision paper: the exact translation into Attack-Fault Trees is not yet fully defined, time and probability are not yet incorporated, and scalability on large realistic systems remains open [2309.09653]. In adversarial alignment settings, performance depends on the fidelity of judges, verifiers, or reward models, and on the stability of training under non-stationary coevolving threats; AdvEvo-MARL’s public-baseline ablation and CEMMA’s archive design both indicate that the surrounding optimization machinery is critical to whether coevolution is constructive rather than chaotic [2510.01586] [2603.01784].

The literature therefore presents safe-by-coevolution less as a settled doctrine than as a unifying response to static safety design. Its strongest shared claim is methodological: when the criterion of success, the attack surface, or the relevant system state is itself uncertain, deceptive, or evolving, safety may be improved by coevolving the evaluators, adversaries, or models that define what safe progress means.

Source: https://www.emergentmind.com/topics/safe-by-coevolution