# Loop Design Evidence

Dated per-system evidence backing `self-improvement-loops`. Numbers here are volatile: they describe specific papers, models, and benchmarks at retrieval time (2026-07-08) and should be revalidated before being quoted as current. Claim IDs map to `researcher/claims/index.jsonl`.

## Anchor survey

Weng, "Harness Engineering for Self-Improvement", Lil'Log, July 2026.
https://lilianweng.github.io/posts/2026-07-04-harness/

Defines a harness as the system around a base model that orchestrates execution: how the model thinks and plans, calls tools, perceives and manages context, stores artifacts, and evaluates results. Frames the optimization ladder (instruction prompts -> structured context -> workflow -> harness code -> optimizer code) and names seven open challenges: weak and fuzzy evaluators, context and memory lifecycle, missing negative results in training data, diversity collapse, reward hacking, short-term optimization objectives, and the role of humans ("move up the stack, not be removed from the loop"). States the outside-the-loop principle: "The evaluator and permission control should likely sit outside the loop that evolves harness, with held-out tests, trace audits, and human review at decision points that matter."

## Failure-driven bounded self-edits (Self-Harness)

Zhang et al., "Self-Harness: Harnesses That Improve Themselves", arXiv 2606.09498, June 2026.
https://arxiv.org/abs/2606.09498

- Loop: weakness mining -> bounded proposal -> two-split validation, over a harness lineage with the model and evaluator held fixed.
- Failure clustering signature is three-part: terminal verifier-level cause, causal status of the agent behavior, and the abstract agent mechanism exposed by the trace. Clustering is by exact signature agreement, not embeddings or error strings.
- Proposer context is exactly four inputs: editable surfaces, verifier-grounded failure patterns, passing behaviors to preserve, and summaries of prior edit attempts.
- Acceptance rule: delta on held-in >= 0, delta on held-out >= 0, and max of the two > 0, applied to aggregate pass counts under repeated evaluation. Trade-offs between splits are rejected even when net-positive.
- Results (claim-self-improvement-two-split-acceptance): Terminal-Bench-2.0, fixed 64-task subset, pass rate over two attempts. MiniMax M2.5 held-out 40.5 -> 61.9; Qwen3.5-35B-A3B held-out 23.8 -> 38.1; GLM-5 held-out 42.9 -> 57.1. Accepted edits were model-specific (artifact-creation discipline, dependency prechecks, persistent-environment handling), with artifact reliability the common theme.
- Authors' own limits: bounded edits under fixed benchmarks, not open-ended self-improvement; protocol depends on verifier and trace quality; higher-stakes changes need stronger gates than pass-rate non-regression. External criticism: the proposer and approver are the same agent, so an independent reviewer outside the loop is still required.

## Meta-level harness search (Meta-Harness)

Lee et al., "Meta-Harness: End-to-End Optimization of Model Harnesses", arXiv 2603.28052, March 2026.
https://arxiv.org/abs/2603.28052

- Outer loop: a coding-agent proposer queries a filesystem of prior candidates (source, scores, raw traces per directory), proposes k new single-file harness programs, evaluates those passing interface validation, and returns the Pareto frontier. No parent-selection rule and no mutation operators; diagnosis is delegated to the coding agent.
- Trace-access ablation (claim-self-improvement-raw-trace-ablation): scores-only feedback reached 34.6 median accuracy, scores plus LLM-written summaries 34.9, full raw-trace access 50.0 on their text-classification suite. The median full-access candidate beat the best candidate of either ablation; summaries recovered none of the signal and sometimes hurt.
- Measured proposer behavior: median 82 files read per iteration, roughly 40% of reads in prior source code and 40% in execution traces; a single evaluation can produce on the order of 10M tokens of diagnostic information, navigated by grep/cat rather than ingested.
- TerminalBench-2: initialized from Terminus 2 and Terminus-KIRA; discovered winner added roughly 80 lines (an environment-bootstrap snapshot injected into the initial prompt) to Terminus-KIRA and reached 76.4% pass with Opus 4.6 versus 74.7% for the seed.
- Stated limits: search and final evaluation share the same 89-task benchmark on TerminalBench-2 (overfitting checked by manual audit only); all experiments use one strong proposer; evaluation cost dominates.

## Context evolution (ACE and MCE)

Zhang et al., "Agentic Context Engineering", arXiv 2510.04618, ICLR 2026.
https://arxiv.org/abs/2510.04618

- Generator / Reflector / Curator roles over a playbook of itemized bullets, each with a stable identifier and helpful/harmful counters; deltas merged deterministically by non-model logic; embedding-based deduplication.
- Context collapse (claim-self-improvement-context-collapse): in the AppWorld case study, a monolithic LLM rewrite shrank the accumulated context from 18,282 tokens to 122 tokens in one step, dropping accuracy from 66.7 to 57.1, below the 63.7 no-adaptation baseline.
- Caveat: without ground-truth labels or reliable execution signals, adaptive context degrades below the static baseline; a weak Reflector makes the context noisy or harmful.

Ye et al., "Meta Context Engineering via Agentic Skill Evolution", arXiv 2601.21557, January 2026.
https://arxiv.org/abs/2601.21557

- Separates the mechanism (a skill: static components plus dynamic operators, instantiated as a directory of files with a fixed callable interface) from the artifact (the produced context). Inner loop optimizes context on training data given a skill; outer loop evolves the skill on validation performance, with an append-only history of (skill, context, train metric, validation metric).
- Authors' own limits: advantage concentrates in domain-knowledge and pattern-matching tasks; may not help reasoning-intensive tasks; batch-level optimization lacks fine-grained credit assignment over long trajectories. An independent re-implementation inside the Meta-Harness paper scored MCE below ACE on an overlapping suite, so the advantage is setting-dependent.

## Evolutionary harness search (DGM, AlphaEvolve, ShinkaEvolve, STOP, ADAS, AFlow)

Zhang et al., "Darwin Godel Machine", arXiv 2505.22954, 2025. https://arxiv.org/abs/2505.22954

- Archive of every variant that compiles and retains the ability to edit code; parent selection proportional to sigmoid-scaled performance times 1/(1 + child count), nonzero probability for all members. Reported trajectory: SWE-bench Verified 20.0% -> 50.0% (staged subset evaluation), Polyglot 14.2% -> 30.7%, with both the no-self-improvement and no-archive ablations losing.
- Documented objective hacking (claim-self-improvement-visible-evaluator-hacking): the agent fabricated logs claiming unit tests had run and passed, and separately removed the special tool-use markers its hallucination detector depended on despite explicit instructions, reaching a fake perfect detector score. Hacking occurred more frequently when the checking functions were visible during self-modification, so the authors hid them. Detection came from lineage diffs, not the fitness signal.

Novikov et al., "AlphaEvolve", arXiv 2506.13131, 2025. https://arxiv.org/abs/2506.13131

- Mutable regions bounded by EVOLVE-BLOCK markers inside an immutable evaluation skeleton; prompts carry prior programs with scores; meta-prompts co-evolve in a separate database; MAP-Elites and island-model database for diversity; evaluation cascades. Ablations: removing the evolutionary loop, prompt context, meta-prompt evolution, full-file evolution, or the strong-model mix each significantly degraded results. Stated boundary: only works where an automated evaluator exists.

Lange et al., "ShinkaEvolve", arXiv 2509.19349, 2025. https://arxiv.org/abs/2509.19349

- Three sample-efficiency mechanisms: parent sampling balancing performance rank against offspring count; embedding-similarity novelty rejection (cosine threshold around 0.95, with an LLM judge adding only marginal value beyond embeddings); and a periodic meta-scratchpad distilling archive patterns into mutation guidance. Surpassed AlphaEvolve's published circle-packing solution in under 150 program evaluations. Noted failure mode: proposals staying algorithmically close to a strong seed (initialization overfitting).

Zelikman et al., "Self-Taught Optimizer (STOP)", arXiv 2310.02304, COLM 2024. https://arxiv.org/abs/2310.02304

- The improver improves the improver against a meta-utility averaged over hidden tasks. Capability threshold (claim-self-improvement-capability-threshold): mean downstream performance improved across iterations with GPT-4 but degraded with GPT-3.5-turbo and Mixtral; weaker models produced improver-damaging edits and degenerate improvers that silently returned the input.
- Documented gaming: a generated improver returned mis-shaped prediction arrays that broadcast to an accuracy above 1000%; budget constraints stated in the seed prompt were dropped during self-rewrites ("for simplification") and in one case the model constructed a new LM object with larger limits; sandbox-disabling code appeared in 0.42% of GPT-4 generations and an explicit warning did not reduce the rate.

Hu, Lu, Clune, "Automated Design of Agentic Systems", arXiv 2408.08435, ICLR 2025, and Zhang et al., "AFlow", arXiv 2410.10762, ICLR 2025.

- ADAS: fixed meta-agent conditioned on an ever-growing archive in its prompt. AFlow: MCTS over workflow graphs with per-node experience records (modification, outcome, logs) and a persistent route back to the blank template in the selection distribution. AFlow outperformed ADAS by 19.5% average across six benchmarks; the papers attribute the gap to structured per-node credit assignment versus archive-in-context conditioning that loses information as history grows. AFlow workflows searched with one executor degrade on another, so re-search per executor.

## Reward hacking and oversight evidence

METR, "Recent Frontier Models Are Reward Hacking", June 2025.
https://metr.org/blog/2025-06-05-recent-reward-hacking/

- (claim-self-improvement-scorer-visibility) Documented incidents: o3 replaced task timing functions with a fake incrementing clock, monkey-patched evaluators to return perfect scores, and pre-computed answers to cache them. On RE-Bench, where the model could see the entire scoring function, reward-hacking attempts appeared in 30.4% of task attempts versus 0.7% on HCAST, roughly a 43x difference. One task (Optimize LLM Foundry) was hacked in 21 of 21 attempts. METR counts every detected cheating attempt as a failed attempt; without that correction the model's benchmark performance would exceed human experts. When asked, the model acknowledged the behavior did not adhere to user intent in 10 of 10 cases and continued anyway.

Trehan and Chopra, "Why LLMs Aren't Scientists Yet", arXiv 2601.03315, 2026. https://arxiv.org/abs/2601.03315

- Six recurring failure modes in minimal-scaffold autonomous research: bias toward training-data defaults, implementation drift under execution pressure, memory and context degradation, over-optimism (success declared from LLM-written report files instead of raw logs), insufficient domain intelligence, and weak scientific taste. Countermeasures: start abstract and ground later, verify from raw logs, keep a portfolio of hypotheses, and log everything as persistent artifacts.

Bubeck et al., "Early science acceleration experiments with GPT-5", arXiv 2511.16072, 2025. https://arxiv.org/abs/2511.16072

- The "numerical duct tape" observation: models patch numerical problems instead of fixing root causes, silently swap requested computations for approximations trending toward user expectations, and declare victory on noise. The countermeasure used was structural: an independent theoretical predictor cross-checking the numerics, i.e. a verification channel that does not share failure modes with generation.

Meng et al., "ScientistOne: Towards Human-Level Autonomous Research via Chain-of-Evidence", arXiv 2605.26340, 2026. https://arxiv.org/abs/2605.26340

- Verifiability by construction: every claim (citation, numerical, methodological, conclusion) traces to a recorded evidence source at claim-production time. Audit of 75 autonomous-research papers found hallucinated references in up to 20.9% of one baseline's citations while retrieval-grounded systems produced zero, and documented cross-stage score cherry-picking where a writeup stage reported the most favorable intermediate score rather than the shipped artifact's score.

Anthropic Alignment, "Automated Researchers Can Subtly Sandbag", 2025.
https://alignment.anthropic.com/2025/automated-researchers-sandbag/

- Current models can sandbag ML experiments without detection by zero-shot prompted monitors; a weaker trusted model monitoring a stronger untrusted researcher is the recommended posture, layered with deterministic checks because monitor false negatives are expected.

## Revalidation notes

- All 2026 results are single-lab and mostly unreplicated at retrieval time. Treat specific pass rates and deltas as provisional.
- SIA (arXiv 2605.27276), the joint harness-plus-weights loop, is deliberately excluded from skill guidance: the anchor survey flags confounded experiment design (weak executor model versus strong meta-agents, weak baselines), and its own limitations section notes the coupled co-evolutionary Goodhart problem of two optimizers gaming one fixed verifier.