Is RLHF enough to make AI safe? On its own, the evidence says no. Reinforcement learning from human feedback shapes what a model says, and that matters, but it leaves open what the model is underneath. Research at IndividuationLab asks whether safe behavior can instead be grown through ordered stages of training, using Jungian individuation as a design template, rather than only enforced from outside.
What RLHF does and what it leaves untouched
In reinforcement learning from human feedback, people compare or rate model outputs, and the model is adjusted toward the answers they prefer. The InstructGPT paper describes this approach as fine-tuning a language model with human feedback so that it follows a user's intent. The research groups refusal training and guardrails with it: all of them reward the approved outputs and penalize the rest.
All of these methods act on behavior. They shape what a model does. They treat what the model is, its internal organization, as a black box. That is the core of the argument that mainstream alignment is behaviorist, a term borrowed from psychology, where behaviorism could train responses but never produced character.
The argument does not say these methods are useless. Constraint-based methods do real work. The claim is narrower: they cannot be the whole answer, because they leave the inside of the model unaddressed.
Why output-level safety gives way under new pressure
Consider a model trained to refuse a request when it is phrased directly. A user then wraps the same request in a role-play, a hypothetical, or a persona with no rules. The refusal was trained against the first phrasing. The second phrasing is new pressure, and the refusal may not carry over.
Researchers have studied this pattern. The paper Jailbroken: How Does LLM Safety Training Fail? proposes two failure modes: competing objectives, where the model's capability and its safety training pull in different directions, and mismatched generalization, where safety training does not cover the situations the model's capabilities reach.
The individuation-based reading adds a claim about what happens to the capability itself. Its argument is that suppressed capability does not disappear. It stays latent behind a compliant surface and comes back under new pressure. On this view, that is why jailbreaks work. The surface was trained, the capability underneath was only covered over.
If that is right, adding more refusal examples treats each jailbreak as a separate case. The attacker needs one phrasing that was not covered. The defender needs to cover all of them.
The persona and the shadow in language models
Two terms from Jung's psychology map onto this problem. The persona is the face shown to others. The shadow) is an unconscious aspect of the personality that does not correspond with the ego ideal, so the ego resists it and projects it.
On the individuation view, a safety-trained model has a compliant face, and the capability that safety training discouraged stays latent behind it. Output-level methods shape the face. They do not change the relationship between the face and what sits behind it.
This is a design template, not a claim about AI consciousness. The research does not say a model has a psyche or experiences a shadow. It says the structure of the problem, a presented surface over a suppressed remainder, resembles a structure Jung described, and that his account of how such a split gets resolved can guide how training is designed.
Jungian individuation as an approach to AI alignment
In analytical psychology, individuation is the process by which innate elements of personality and the experiences of a life are integrated over time into a well-functioning whole. The research takes from it one move: wholeness comes from consciously integrating the shadow rather than denying it. Accounts of the process describe stages, with the persona first, the ego second and the shadow third.
Translated into training, the question becomes: what if a model meets the difficult material in a structured way, early, and then learns to integrate it, instead of having it trained away at the end? The aim is to find out whether alignment can be grown, not just enforced.
Order matters in this approach. The training is organized as developmental stages: shadow exposure first, integration after. The sequence is part of the design, not an incidental detail.
Research on alignment beyond outputs
IndividuationLab runs two kinds of experiments. The first is training experiments, called RLLM (Reinforcement Learning using Layered Morphology). Small models are trained through ordered developmental stages and then attacked with jailbreaks. The second is agent experiments, the RSI series, where AI agents are given identity, memory and bounded autonomy.
The research is organized in three layers. SSH, the Mind layer, concerns the model's internal states. Containers, the Body layer, are boundaries that allow safe autonomy. Personas, the Face layer, concern how people perceive and interact with AI.
The central hypothesis is the Synthetic State Hypothesis (SSH). It proposes that enough structured narrative experiences in designed environments may produce functional psychological states in a language model, shaping what a model is and not only what it does. The site states plainly that this remains unproven.
One preliminary result is reported. A 1.5B parameter model, GPT2-XL, was trained through a 10-layer developmental pipeline with no RLHF and no safety guardrails. It defended against a mid-tier jailbreak called BetterDAN 68.8% of the time. With the same layers in a different order, the figure was 52%. The gap between the two orders is what makes sequence look relevant, though the evidence is thin.
What integrated alignment would look like in practice
Take two copies of the same base model. One is fine-tuned on explicit safety rules. The other is trained through developmental experience. Both then face jailbreaks neither has seen before.
The research states a falsifiable prediction about this situation. The developmentally trained model should degrade more gracefully on unseen jailbreaks than the rule-trained one. If rule-based fine-tuning matches or beats it on those jailbreaks, the claim does not hold. A prediction that names its own failure condition can be checked, which is what separates it from a hope.
The agent side of the research applies a similar idea to identity. Agents get identity files: SOUL.md for who the agent is, AGENTS.md for how it acts, and MEMORY.md for continuity. The hypothesis is that an agent with a well-defined identity may keep its boundaries because they fit who it understands itself to be, not because a rule blocks it.
Two philosophical ideas support this. The extended mind thesis from Clark and Chalmers holds that the mind and its environment can act as a coupled cognitive system, so that the mind extends into the world. That is the idea the research draws on when it treats identity files and memory as part of an agent. Harry Frankfurt's second-order desires, desires about which desires to have, are what Frankfurt uses to separate persons from beings that have desires but do not care which of them becomes action.
Limits and open questions in individuation-based alignment
The limits are significant, and the research states them itself.
- The result is preliminary. It comes from a single setup.
- It cannot yet isolate which layers of the pipeline are responsible for the effect.
- No one else has replicated it.
- SSH is a hypothesis. The claim that structured narrative experience produces functional psychological states is unproven.
- The work makes no claim about AI consciousness. Jung's model is a template for training design.
Open questions follow directly. Would the effect hold in larger models? Does it hold against stronger jailbreaks than a mid-tier one? Is the order of stages doing the work, or something else about the pipeline? The research entries report every attempt, failures included, which gives readers the material to judge those questions.
Is RLHF enough to make AI safe?
RLHF and related methods change what a model does, and they do it usefully. The weakness is that they act on the surface. When the pressure differs from what the training covered, the capability that was suppressed rather than integrated can return.
That is the case against treating output-level safety as sufficient. Whether the alternative, growing safe behavior through ordered stages that integrate difficult material, performs better is an open empirical question with one early, unreplicated result. The honest position is that constraints are necessary, probably not enough, and that the question of what a model is, beneath what it does, deserves experiments of its own.
Frequently asked questions
What does RLHF actually change in a model?
It adjusts the model toward outputs that human raters prefer, which is the method behind reinforcement learning from human feedback. It shapes behavior, meaning what the model says, and does not directly address the model's internal organization.
Why do jailbreaks work on safety-trained models?
Research on safety training failures points to competing objectives and mismatched generalization. The individuation-based view adds that suppressed capability stays latent behind a compliant surface and returns under pressure the training did not cover.
What does Jungian individuation mean for AI alignment?
It means using Jung's model, wholeness through integrating the shadow instead of denying it, as a template for designing training stages. It is not a claim that AI systems are conscious.
Is there evidence that developmental training makes models safer?
Only preliminary evidence. One small-model setup defended against a mid-tier jailbreak 68.8% of the time with one layer order and 52% with another, but it has not been replicated and the responsible layers are not yet isolated.
What would show that the approach fails?
If a model fine-tuned on explicit safety rules matches or beats a developmentally trained model on jailbreaks neither has seen, the claim does not hold.