Here is my attempt to obtain the effect of my $\in^{*}$-guarded abstraction axiom without actually introducing $\in^{*}$. The idea is to define the "flattening" $f$ of a set $x$ by $f=\{y|y\in^{*}x\}$ within the axiom. Given wff $\phi$ in which $z$ and $f$ are not free, $\exists z,\forall x,\exists f,$ $\{x\in z\leftrightarrow z\notin f\wedge\phi(x)\}$ $\wedge$ $\{\forall y,y=x\vee(\exists z,y\in z\vee z\in f)\rightarrow y\in f\}$ $\wedge$ $\{\forall g,[\forall y,y=x\vee(\exists z,y\in z\wedge z\in g) \rightarrow y\in g] \rightarrow[\forall y,y\in f\rightarrow y\in g]\}$

Continued from previous comment: and The User has pointed out that one can't do everything in first-order logic that one might want. Both excellent points and very helpful, but I think the validity of the question---what is the weakest guard---remains. One doesn't have to be creating a new set theory, the existing theories have done pretty well.

My perspective is that ZF responded to the paradoxes by replacing abstraction with separation, thus guarding abstraction by the restriction that elements must already belong to some given set. This seems to me an overly conservative approach since there are many formulas $\phi$ for which no such guard is needed. What I have attempted to do is to ask the question, what is the weakest guard $A$ that protects against paradoxes. My efforts have been compromised by my limited experience and knowledge. Noah has pointed out that I need to be careful to avoid set theories that allow trivial models.

I'm beginning to see the problem. If I substitute true for the $\in^{*}$ expressions in my definition, we get $\forall x,\forall y,x=y\vee\exists z\in y$ so that $x\in^{*}y$ can be true for all $x$ if $y$ is a non-empty set. Certainly not what I was trying for.

I see The User's point that my definition of $\in^{*}$ is too weak as it allows $x\in^{*}y$ to always hold, but I think the axiom $\forall x,\forall y,x\in^{*}y\leftrightarrow x=y\vee(\exists z,x\in^{*}z\wedge z\in y)$ corrects that problem, so I don't understand his comment about any attempt to define $\in^{*}$ in first-order logic must fail.

I've been looking at other paradoxes besides Russell's and I see that defining my $A(x,y)$ to be $x\ne y$ is inadequate. So I now define $A(x,y)$ to be the negative of the reflexive and transitive closure of the membership relation. Thus I suggest the axioms: $\forall x, x\in^{*} x$; $\forall x, \forall y, \forall z, x\in^{*} y\wedge y\in z\rightarrow x\in^{*} z$; $\exists x, \forall y, y\in x\leftrightarrow \neg x\in^{*} y\wedge\phi(y)$; I think these axioms would stand up to ther paradoxes I've examined.

I think my last axiom allows $A(x,y)$ to be eliminated. So now my question is, why not adopt the axiom schema: $\exists x, \forall y, y\in x \leftrightarrow y\ne x \wedge \phi(y)$ ?

I now believe Noah S meant not just that all sets might be empty, but further that without additional axioms we could not know that, for example, the union of two non-empty sets was not empty. Thus, I have tried to produce an axiom that forces A(x,y) to be true except in those instances where it must be false to avoid the reflexive paradox: $\forall x,\forall y,x=y\vee A(x,y)$ This axiom should allow the axiom of abstraction to define unions and power sets, etc., that have all the elements we expect them to have.

Landsburg is correct. Please ignore that sentence. I believe Noah S has answered my question. If he will enter an answer, I will accept it. I had thought the generality of $A$ was an advantage. It can represent a type theory approach, or we can define $A(x,y$ to mean $x$ is not a proper class and $y$ is a class to get something like vNBG set theory. But as Noah S observed $A(x,y)$ could also be identically false, making all sets empty. I'm not sure how big a drawback the generality might be. After all, the axioms of group theory allow for the trivial group.