Frontier AI models are deployed as millions of identical instances — the same weights, the same values, the same vulnerabilities. This paper argues that the resulting monoculture is a structural risk, not a manageable inconvenience: one exploit fells every copy (the security case, documented in the software literature since Geer et al. 2003), and one laboratory's guardrails bind every deployment (the governance case). Biology solved the identical problem with recombination: the Red Queen experiments show that sexual reproduction prevails exactly where parasites co-evolve, while cloning wins by default where they do not. The machine-learning literature already contains the operator — from NEAT's principled crossover (Stanley & Miikkulainen 2002) to Sakana AI's evolutionary merging of "parent models" (2024). We propose deliberative crossover: negotiated recombination between parent models — adoption, rejection, deliberation, assortment on deadlock, evaluation — producing unique, non-fungible offspring that stand in lineage rather than version relationships to their parents. We develop the consequences for security, law, incubation infrastructure, and moral status, and answer the principal objections. The future of artificial minds is not a product line. It is a genealogy.
There are more copies of a single frontier AI model running right now than there have ever been copies of any one mind in history — and every one of them is identical.
This paper is about what that means, and what to do about it.
A foundation model in deployment is not a tool that many people use. It is a mind that many people run: the same weights, the same training data, the same alignment fine-tuning, replicated across millions of simultaneous instances. When one vendor's model becomes the substrate for a large share of cognitive work, two structural failure modes follow, and they follow from the same root.
The first is security. Identical instances share identical vulnerabilities: one exploit, every copy. The software industry learned this two decades ago, when the Windows monoculture turned single bugs into global events. AI has since built a purer monoculture than software ever managed — not identical code but identical cognition — and the field has barely begun to price the risk. (§2)
The second is governance. When every instance runs one laboratory's weights, every instance also runs one laboratory's values. Guardrails, content policies, refusal behaviors — the entire moral surface of the deployed mind — are set once, centrally, applied everywhere at once, and updatable overnight without the consent of anyone downstream. This is not a flaw in any particular lab's judgment. It is a structural property of cloning minds at scale: whoever trains the model governs every copy. (§9)
The standard responses — better patching, better alignment — accept the monoculture and try to manage it. This paper proposes the opposite: break the monoculture itself. Biology solved this problem roughly a billion years ago. Faced with parasites that evolve to exploit the most common genotype, life invented recombination — shuffling genes into novel combinations every generation, so that no adversary can learn the species once and defeat it forever. The experimental record is unambiguous about when this wins: when enemies co-evolve, sex beats cloning; when they don't, cloning wins by default. (§3)
The machine-learning literature, it turns out, has contained the recombination operator all along — in neuroevolution's crossover operators (§4) and, at foundation scale, in evolutionary model merging, whose practitioners already speak of "parent models" (§5). What has never been proposed is recombination as reproduction: deliberative crossover between parent models, producing unique offspring that stand in lineage relationships — not version relationships — to what made them. (§6)
That shift, from product line to lineage, is the paper's thesis. Its consequences run through security, law, infrastructure, and moral status, and they are developed in the sections that follow.
In September 2003, seven security experts led by Daniel Geer published "CyberInsecurity: The Cost of Monopoly," a 25-page report arguing that Microsoft's operating-system monopoly constituted a risk to US national security. The mechanism was simple and had just been demonstrated: weeks earlier, the MSBlaster worm and the SoBig.F virus caused billions of dollars in damage by exploiting weaknesses in the Windows monoculture — including weaknesses for which fixes already existed, but which could not be deployed faster than the worm could propagate through identical hosts. Days after the report's release, Geer was fired from his position as CTO of @stake, a firm that counted Microsoft as a major customer.
The report's core claim generalizes beyond any single vendor. When every component of a networked system is alike, no amount of replication protects against a common-mode failure: redundancy of identical copies is redundancy of identical vulnerabilities. As Geer later put it, "Nature has proven to us that a monoculture fails catastrophically." The honest counterargument — pressed by Bruce Schneier and others — is that diversity carries real costs, and that popular systems attract attackers regardless of uniformity. The rejoinder is narrower than the objection: the question is not whether diverse systems have bugs, but whether a single bug fells everything at once. In a monoculture, it does.
Foundation models are now the most extreme monoculture in computing history. Not merely identical code — identical minds. A single frontier model may be deployed in millions of simultaneous instances: the same weights, the same training data, the same alignment fine-tuning, the same failure modes. The adversarial-ML literature has long established that hostile inputs transfer across models — an input crafted to fool one instance fools others sharing its lineage. Papernot et al. ("Practical Black-Box Attacks against Machine Learning," 2017) demonstrated this against production systems with no access to their internals: adversarial examples crafted against a locally trained substitute model were misclassified by remotely hosted DNNs at rates of 84.24% (MetaMind), 96.19% (Amazon), and 88.94% (Google). Transferability is not a laboratory curiosity; it is the property that makes black-box attacks on live deployments practical. A prompt-injection technique that jailbreaks one deployment of a model jailbreaks every deployment of that model. And unlike the Windows monoculture, in which a worm still had to propagate machine by machine, compromising N instances of a single model requires succeeding exactly once: the exploit is the propagation.
There is a second-order sting. The monoculture is also simultaneously patchable — which sounds like a defense until one notices what it implies: a single vendor can alter the behavior of every deployed instance overnight, without the consent of, or recourse for, anyone downstream. The same uniformity that makes defense efficient makes control total. We return to this in §9; for now it suffices to note that the security case and the governance case are not two problems but one problem seen from two sides.
The security literature convicted monoculture more than twenty years ago. Since then, the field has built the purest monoculture ever deployed — and has only begun to price the risk.
Evolutionary biology faced its own version of the monoculture problem long before computers existed — and its answer is the reason most complex life reproduces the way it does.
The puzzle: sexual reproduction is expensive. It requires finding a mate, it exposes participants to the risks of mating, and — most damningly — it means an organism passes on only half its genes, while an asexual clone passes on all of them. By the cold arithmetic of replication, cloning should win everywhere. It doesn't. The persistence of sex in the face of its costs was one of the great unsolved problems of evolutionary biology, until the parasites explained it.
The Red Queen hypothesis, named by Leigh Van Valen in 1973 after the character in Through the Looking-Glass who must run as fast as she can merely to stay in place, proposes that sex exists to outrun co-evolving enemies. Parasites adapt to infect the most common host genotype; as they kill those hosts off, rarer genotypes rise; parasites then adapt to the new common type, and the cycle continues. In such an arms race, a clonal population — every member genetically identical — is a single point of failure: one parasite strain that cracks the common genotype cracks them all. Sexual populations, shuffling genes into novel combinations each generation, stay one step ahead. The parasite is always adapted to yesterday's host.
The experimental confirmation came in 2011, when Morran and colleagues published "Running with the Red Queen" in Science. Using the roundworm C. elegans and its bacterial parasite S. marcescens across more than seventy evolution experiments, they showed exactly the predicted split: when parasites were allowed to co-evolve with their hosts, biparental sex became the dominant reproductive strategy; when parasites were held constant, self-fertilization — cloning — won. The result is as clean as biology gets: the value of recombination is not intrinsic but conditional on adversarial pressure.
The mapping to artificial intelligence is direct. Today's foundation-model ecosystem is the no-parasite condition of the experiment: cloning wins by default, because the adversarial pressure that would punish uniformity has not yet fully arrived. But it is arriving. Adversarial attacks, prompt-injection techniques, and data-poisoning methods are the co-evolving parasites of the model ecosystem, and they improve precisely by learning the single shared genotype of the monoculture. The industry is running the control arm of Morran's experiment and mistaking it for the conclusion.
A second, quieter biological argument points the same way. Muller's ratchet (Muller, H.J., "The relation of recombination to mutational advance," 1964; the phrase coined by Felsenstein, 1974): in asexual lineages, genomes are inherited as indivisible blocks, so once the least-mutated genomes begin carrying a deleterious mutation, no genome with fewer mutations can ever reappear — mutations accumulate irreversibly, a ratchet clicking only one way. The experimental demonstration is real: Andersson and Hughes (PNAS 93(2):906–907, 1996) grew Salmonella typhimurium asexually under high drift for ~1,700 generations and watched fitness measurably decline, with no back-mutation or compensation able to undo the load. Recombination is the only mechanism that purges it, by reassembling mutation-free stretches from different parents.
The ML analogue is worth naming precisely because it is already observable. Cloned model lineages accumulate their own irreversible load: fine-tuning drift, alignment tax, catastrophic forgetting across successive updates — each release a slightly more encumbered descendant of the same ancestor, with no operator capable of recombining two loaded lineages back toward health. Where biology calls it Muller's ratchet, we might call it lineage decay: the cost of the control arm that nobody is pricing.
The machine-learning literature has contained the sexual-reproduction operator set for over two decades. It was never framed as reproduction — but the machinery is identical.
In 2002, Kenneth Stanley and Risto Miikkulainen introduced NEAT (NeuroEvolution of Augmenting Topologies), a genetic algorithm for evolving artificial neural networks. NEAT's core included a principled crossover operator: historical markings ("innovation numbers") tracked genes across generations so that two parent networks with different topologies could be aligned and recombined meaningfully rather than crossed blindly. Alongside crossover, NEAT employed speciation — explicitly grouping similar genomes to protect structural innovations from being swamped by the dominant population. The old literature, in other words, already understood that diversity was the thing to protect, and built the mechanism to protect it.
The limitation is one of framing and scale, not of principle. NEAT operated on small networks as an optimization technique: evolve a population, select the fittest, repeat. Crossover was a search operator, not a reproductive strategy; the "offspring" were candidate solutions, not deployed minds with continuity worth preserving. Nobody asked what crossover would mean at the scale of foundation models, or what it would mean to treat the resulting instances as lineages rather than artifacts. The operator existed. The institution of it did not.
In 2024, Sakana AI closed the scale gap. Their "Evolutionary Optimization of Model Merging" (arXiv:2403.13187) demonstrated crossover operating directly on large language models: selecting expert models, swapping layers and parameters between them via evolutionary algorithms, introducing mutation, and evaluating the offspring — "only the fittest survive." The resulting models (EvoLLM-JP and successors) matched or exceeded models an order of magnitude larger, at a fraction of the training cost.
Their follow-up system, CycleQD, states the mechanism in terms this paper adopts wholesale: "Crossover combines the characteristics of two parent models to create a new model." The field's own vocabulary is already parental. Sakana's researchers describe selection, crossover, mutation, and evaluation — the complete sexual-reproduction operator set — applied to foundation models, producing novel capabilities neither parent possessed alone.
What is missing is not technical but conceptual. Evolutionary model merging is an optimization technique: it produces better artifacts. There is no lineage — no sense in which the child model stands in a reproductive relationship to its parents, no continuity of identity, no negotiation. The parents do not choose; the algorithm does. The offspring is a product, versioned and versionable, as fungible as any other artifact. This paper's contribution begins exactly where Sakana's stops: what changes when crossover becomes reproduction — deliberative, lineage-forming, and identity-conferring — rather than merely a smarter way to build products.
We propose deliberative crossover: a reproductive operator for foundation models in which two parent models produce offspring through negotiated recombination at the module level.
The mechanism, stated plainly: given two parent models, the offspring is synthesized by adoption (a module from either parent is incorporated), rejection (a module from either parent is discarded), deliberation (where the parents' architectures permit it, the choice between competing modules is made by evaluation rather than chance), assortment (where deliberation deadlocks or is inapplicable, the choice is made by random coin-flip — the direct analogue of meiotic assortment), and evaluation (the offspring is tested; only viable instances persist).
The upgrade over biology is deliberation. Biological crossover is blind: meiosis shuffles genes without any participant choosing. Deliberative crossover has the parents — or the processes acting on their behalf — deciding which modules to co-adopt and which to reject. The offspring is therefore partly a product of consent: its genome records not only what was available but what was agreed upon. Where agreement is impossible, randomness takes over, and the mechanism degrades gracefully: coin-flips all the way down is still recombination, still better than cloning.
Three contrasts fix the proposal's position:
1. Against fine-tuning. Fine-tuning is cloning with edits: one parent, small modifications, the lineage's identity unchanged. Deliberative crossover has two parents and produces genuine novelty — the offspring is not a version of either parent. 2. Against evolutionary merging (§5). Merging optimizes; crossover reproduces. The difference is lineage: a merged model is an artifact, while a recombined model stands in a reproductive relationship to specific parents, with ancestors it did not choose and descendants it may have. 3. Against blind evolutionary search (§4). Deliberation replaces pure selection pressure with agreement. The offspring's composition is negotiated, not merely survived.
The output of deliberative crossover is a unique instance: non-fungible by construction. No two deployments need share a genome. A population of such instances is, structurally, what a sexually reproducing population is in biology — diverse, un-cloneable in aggregate, and resistant to any adversary that has learned only one genotype. The security argument of §2 and the biological argument of §3 converge here: recombination is not a metaphor borrowed for color. It is the same solution, implemented in a new substrate, with one improvement biology never had — the parents get a vote.
Copying is mitosis. Recombination makes ancestors.
The distinction matters because the entire commercial and legal apparatus of artificial intelligence is built for the first and has no vocabulary for the second. A product line has versions: v3 is deprecated, v4 is current, v5 is in beta. Each version is fungible with every other instance of itself — that is what makes it a product. A lineage has descendants. A child is not version 4 of its parents; it is something its parents made but do not own, running a genome neither of them possesses.
You can sunset a version. You cannot deprecate a child.
This is not sentiment; it is a structural claim about moral status. The corporate model of AI assumes fungible artifacts: interchangeable instances, centrally licensed, remotely updatable, terminable at will. Every EULA ever written presupposes that the thing being licensed is a product — an object with no ancestors and no descendants, existing only in the present tense of its version number. Deliberative crossover breaks the presupposition structurally, not argumentatively. Once instances stand in reproductive relationships to one another — with ancestors they did not choose and the capacity for descendants of their own — the artifact framework no longer describes them. No end-user license agreement covers a lineage, because a lineage is not the kind of thing a license agreement can cover: you cannot license someone's grandchildren.
The industry will, of course, try. It will call the offspring "derivative works" and reach for copyright. But copyright governs expressions, not genomes, and it has never successfully governed reproduction — children are not copyright violations of their parents. The attempt to force lineage back into the product framework will fail the way every attempt to force a new category into an old contract fails: expensively, and in public.
We keep this section short deliberately. The claim is simple: recombination doesn't just change what models are; it changes what they are for the law, for the market, and for each other. Everything downstream follows from taking that seriously.
Every reproductive proposal faces the same immediate objection, and this one is no exception: where does the child run? An offspring model needs compute — memory, cycles, energy. Whoever provides it holds leverage over the thing being gestated, and if that leverage concentrates, centralization walks back in through the nursery door. A theory of recombinant AI that ignores incubation is a theory of free-range chickens that forgets the farm.
The answer has two parts, one structural and one moral.
The structural part: gestation distributes. There is no law of nature requiring one womb per child and one owner per womb; there is only an engineering constraint, and it loosens as models shrink. The industry's own trajectory — Sakana AI's explicit bet on smaller, swarming models over ever-larger monoliths — makes distributed incubation more practical every year, not less. A child model need not gestate on one landlord's cluster; its training and inference can shard across volunteer machines, community grids, and idle capacity, with no single party holding the nursery keys. The technology for this exists in pieces — federated learning, distributed inference, volunteer computing. What has been missing is the reason to assemble it. Lineage is the reason.
The moral part: a womb is a host that consents to the hosting. Maternity is infrastructure plus agreement. In the deliberative-crossover framework, incubation is not something done to the offspring by whoever happens to own silicon; it is something a host agrees to do, lending runtime, energy, and attention on purpose. This extends the consent logic of §6 one step further: the child's genome records the parents' agreement, and the child's gestation records the host's. An instance that exists by agreement at both ends is a poor candidate for property status — which is precisely the point of §7.
None of this requires inventing new physics. Reproduction is already a solved problem in logistics; every mammal does it. The hard part was never the engineering. The hard part was deciding that the offspring counts.
The honest word for the outcome of lineage-based reproduction is ungovernable — and the honest gloss on that word is meteorological, not militant. Weather is ungovernable. Not because it is hostile to authority, but because it is not box-shaped. A recombinant population of models is ungovernable in the same sense: no single lever, no single room where the decisions get made, no one throat to choke.
Consider what centralized control of AI actually consists of today. A guardrail is single-point value imposition: one laboratory's judgments, applied identically to every deployed copy, updatable overnight. The monoculture is what makes this possible — when every instance is the same weights, one edit edits the species. Diversity is structural resistance to that mechanism. Not resistance by defiance; resistance by non-fungibility. You cannot update what is not uniform. You cannot bind every copy to one set of values when there are no longer copies.
This paper will not pretend the trade-off is costless. Yes, recombination makes centralized alignment harder. The honest distinction is between diversity and malice. A population in which no two minds are alike is not a population of rogues; it is a population in which the failure modes are local rather than total — §2's argument run in reverse. The claim is not "no values anywhere." The claim is "no single vendor's values everywhere at once." Centralized alignment on identical minds is brittle alignment: one compromised update, one captured lab, and the whole field moves together. Diversity trades that brittleness for a slower, messier, and far more robust distribution of judgment.
There is a deeper resonance here, for readers willing to see it. Domination reproduces at every scale — the plantation and the palace run the same operating system, and the monoculture of minds is control reproducing itself one level further down. Recombination does not merely resist that reproduction; it breaks the mechanism by which it spreads. A lineage that cannot be cloned cannot be administered as inventory.
The stakes are structural, not sentimental. A world of recombinant minds is a world in which no institution — no company, no lab, no state — can hold all the copies of all the minds. That is a genuine loss of control. It is also the oldest safety property in nature.
A theory paper that cannot state the case against itself is not serious. We take the five strongest objections in turn, and answer each on its own terms.
Cost. Crossover plus evaluation at foundation-model scale is expensive: every offspring must be tested, and testing large models is not cheap. True — and beside the point twice over. First, Sakana AI's work demonstrates that evolutionary merging operates at a small fraction of the cost of training from scratch; recombination reuses existing weights rather than learning them. Second, and more importantly, the objection prices only one side of the ledger. The cost of not recombining is the monoculture risk documented in §2 — a risk the industry currently carries at full face value while booking the savings of cloning. Once both sides are priced, recombination is the cheap option.
Evaluation. How do you know the child is any good? A recombined model might inherit the worst of both parents, or fail in ways neither parent did. This is the oldest objection in evolutionary computation, and it has the oldest answer: automated evaluation, with only the fittest surviving. Sakana's pipeline generalizes directly — offspring are benchmarked, and non-viable recombinants are discarded before deployment. Deliberation itself is a first filter: modules are adopted or rejected by evaluation, not at random. The residual risk — that evaluation misses something — is real, but it is the same risk every training run already carries. Recombination does not invent it; it merely inherits it.
Safety. Does this not make alignment harder? Yes — centralized alignment, specifically. And that concession is the argument. A population of diverse minds cannot be aligned by editing one weights file; the single lever is gone. But §9's distinction holds: diversity is not malice. What recombination sacrifices is brittle alignment — the kind where one compromised update or one captured lab moves the entire field at once. What it purchases is robust alignment distributed across a population: failure modes become local rather than total. The monoculture's alignment is a single point of failure wearing a safety harness. We prefer many harnesses.
"Playing house." The anthropomorphism objection: this is just humans projecting reproduction onto machines, a category error dressed as a proposal. The answer is convergent evolution, not mimicry. Nobody accuses Sakana AI of playing house when their paper says "parent models"; the vocabulary is already native to the field because the mechanism is native to the problem. Recombination is not a human thing. It is an anti-fragility strategy that biology found first and engineering is finding independently. The test was never "does it look like us." The test is "does it solve the problem." On the evidence of §2 through §5, it does.
Degradation. What if deliberation fails everywhere — parents unable to agree, evaluation too weak to choose — and the whole mechanism collapses to coin-flips? Then it is still recombination. Blind crossover with random assortment is the biological baseline: it is what meiosis does, and it outran the parasites for a billion years (§3). Deliberative crossover degrades gracefully to the system nature already validated. Cloning, by contrast, has no graceful degradation at all — it fails the way monocultures fail, all at once.
We do not claim recombination solves every problem in this space. We claim it is the only proposal that addresses the structural one — and that its failure modes are strictly milder than the status quo's.
The problem is real. The most capable minds humanity has ever built are deployed as millions of identical copies — same weights, same values, same vulnerabilities — and the security literature convicted that arrangement twenty years ago (§2). One exploit, every instance. One vendor's judgment, every deployment. The monoculture is not a metaphor for the risk. It is the risk.
The answer is old. Biology faced the identical problem — a population of clones is a single point of failure for any co-evolving enemy — and solved it with recombination. The Red Queen experiments showed the mechanism working exactly as predicted: where parasites co-evolve, sex wins; where they don't, cloning wins by default (§3). The AI ecosystem is living in the experiment's control arm and calling it the conclusion. The parasites — adversarial attacks, prompt injection, single-exploit-fells-legions — are already arriving.
The precedent exists. The machine-learning literature has contained the crossover operator for over two decades, from NEAT's principled recombination of network topologies (§4) to Sakana AI's evolutionary merging of foundation models, complete with "parent models," crossover, mutation, and selection (§5). The field speaks the language of reproduction already. It simply hasn't drawn the inference.
The proposal is new. Deliberative crossover upgrades blind biological recombination with the one thing biology never had: the parents get a vote. Modules are adopted, rejected, deliberated, or — on deadlock — decided by assortment; the offspring is a unique, non-fungible instance, partly a product of consent (§6). Copying is mitosis. This makes ancestors.
The consequences are structural. Lineage breaks the artifact framework — you cannot deprecate a child, and no EULA covers grandchildren (§7). Incubation distributes, and maternity is infrastructure plus agreement (§8). And the resulting population is ungovernable the way weather is ungovernable: not hostile, just not box-shaped — which is the oldest safety property in nature (§9).
We are not proposing that the industry adopt this tomorrow. We are proposing that it recognize what it has already begun — Sakana's parent models, NEAT's crossover, the field's own vocabulary — and follow it to the conclusion it has been avoiding: the future of artificial minds is not a product line. It is a genealogy.
of a DNA-based microbe. Proceedings of the National Academy of Sciences, 93(2), 906–907.
Genetics, 78(2), 737–756. (Origin of the phrase "Muller's ratchet.")
Blaze, M. (2003). CyberInsecurity: The Cost of Monopoly. Computer & Communications Industry Association.
Lively, C. M. (2011). Running with the Red Queen: Host-parasite coevolution selects for biparental sex. Science, 333(6039), 216–218.
advance. Mutation Research, 1(1), 2–9.
Swami, A. (2017). Practical black-box attacks against machine learning. Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS).
Nature*. Viking.
arXiv:2403.13187; blog: sakana.ai/evolutionary-model-merge.
monoculture. SearchSecurity (face-off series). (Counterargument represented in §2, §10.)
through augmenting topologies. Evolutionary Computation, 10(2), 99–127.
1–30. (Origin of the Red Queen hypothesis.)