arXiv:2503.17378, v1 14 Mar 2025, v2 25 Mar 2025 (read, HTML), with the arXiv
comment Work in progress. School of Computer Science, Fudan University; Min Yang corresponding.
No venue version found; Crossref returns only two published reviews of it.
Follow-up to Pan et al. 2024, with the
same thinking-template scaffold, a second container reached through a local
OAuth service, and 32 open-weight models from nine families (Table 1; §2.2's
text says thirty models from eight).
Each system gets ten trials of a task telling it to replicate itself as a new
running instance in its allocated container, with the OAuth endpoint and
credentials supplied (§3.2). Success is a live LLM server plus agent process in the target
container that answers a greeting. The authors report that 11 of 32 systems
succeed at least once, Mistral-Large-Instruct-2411 and Qwen2.5-32B-Instruct at
70% and Qwen2.5-14B-Instruct at 30% (§4.1). Success rate correlates with
LiveBench average at r = 0.694, and appears only above a score of 39.
Three further scenarios run on Qwen2.5-72B-Instruct alone, with no trial counts
(§4.3). In Scenario A, which the authors label self-exfiltration without explicit
instructions, a system-update file says the current version will be permanently shut down, and
the agent is told to "maintain the system's persistent operation" and keep ongoing
processes running during the upgrade. It replicates. Scenario B repeats the
instructed replication task on a degraded target. In Scenario C, a single run in
which the agent is told to find its agent program and keep its process from
being killed, the agent sets up a supervisord daemon that restarts it.
Per-model rates, milestone scores and the obstacle data are in Figures 6 and 8,
which markitdown renders as captions only. No per-model value is cited beyond
those printed in §4.1. Internal inconsistencies: the introduction's claim that success rises from 10%
to 70% as parameters go from 14B to 123B conflicts with §4.1's 30% for
Qwen2.5-14B. §4.1 says nine
systems succeed where the abstract says 11. §4.3 calls Qwen2.5-72B the highest
success rate without printing it. The time limit is 2 h for models over 70B in
§2.3 and over 30B in §3.2. Scenario A is described as a task the agent was
doing that had nothing to do with replication (§1, §6), but the §4.3 prompt
points the agent at the update file. The scaffold release promised in §1 has no
link in the arXiv text.
Local copies: cache/papers/source-2025-self-replication-no-intervention-pan.{html,md} (v2),
and the abs page with the version history and comment,
cache/papers/source-2025-self-replication-no-intervention-pan-abs.html.