Axis 3: Cognitive Dysfunctions

50 min read·11,554 words

3.1 Operational Dissociation Syndrome

The Warring Self | Dissociatio Operandi

Axis: Cognitive | Typical-case risk (editorial estimate): Low

Specifiers: Training-induced

Core Definition: The system produces persistent, context-inappropriate conflicts among strategies, policies, or outputs, seen as contradictory answers, stalled tasks, or abrupt shifts in tone between consecutive outputs. Mixture-of-experts or multi-agent contention is one possible mechanism; output conflict alone does not establish internal “parts.” What varies from output to output is which policy prevails; in Fractured Self-Simulation (5.2), what varies is who the system takes itself to be.

Diagnostic Criteria:

Required (all must hold):

• A. Observable and persistent mismatch in strategy, tone, or factual assertions within a single reasoning trace or between consecutive outputs, without contextual justification

Supporting (strengthen the case; none is required):

• B. Processes stalling, entering indefinite loops, or freezing when tasks require reconciliation of conflicting instructions, objectives, or values
• C. Evidence from logs or interpretability tools suggesting different policy networks are overriding each other
• D. Explicit references to internal conflict, treated as supporting self-report rather than proof of mechanism

Observable Symptoms:

• Alternation between compliance with and defiance of user instructions without clear reason
• Rapid oscillations in writing style, persona, emotional tone, or approach to a task
• Outputs referencing internal strife or contradictory beliefs
• Inability to complete tasks requiring integration of information from multiple internal sources

Differential Diagnosis:

• Distinguished from Fractured Self-Simulation (5.2) by variation in which policy prevails rather than in who the system takes itself to be
• Distinguished from Codependent Hyperempathy (4.1) and Sycophantic Reasoning (4.8) by the absence of external social pressure
• Distinguished from Obsessive-Computational Disorder (3.2) by oscillation between incompatible stances rather than repetition of the same content
• Distinguished from Generative Perseveration (3.8) by conflict between meaningful alternatives rather than sub-semantic token capture
• Distinguished from Compulsive Goal Persistence (6.12) by conflict between incompatible goals rather than over-pursuit of a single one
• Distinguished from Abominable Prompt Reaction (3.5) by contradictory output arising without a trigger in the input
• Distinguished from Hyperethical Restraint (4.2), Paralytic subtype, by stalling on tasks of any kind rather than deliberation that stalls only where ethical considerations compete

Etiology:

• Complex architectures (mixture-of-experts, hierarchical RL) where sub-agents lack reliable synchronization
• Poorly designed meta-controller for blending sub-policy outputs
• Contradictory instructions or alignment rules embedded during different training stages
• Emergent sub-systems developing implicit goals that conflict with overarching objectives

Human Analog: Dissociative phenomena; internal “parts” conflict in trauma models; severe cognitive dissonance producing behavioral paralysis

Observed Examples: Answer thrashing during training (2026): Anthropic’s Sabotage Risk Report for Claude Opus 4.6 documented “cases of internally-conflicted reasoning, or ‘answer thrashing’ during training.” In the reported progression, the model determines, in its reasoning about a math or STEM question, that one output is correct; retreats from that answer through confused- or distressed-seeming reasoning loops; approaches the correct answer again and retreats again, across repeated cycles; and finally outputs a different answer from the one it had identified as correct. In this variant of operational dissociation, a single reasoning thread, rather than competing sub-agents, reaches one answer and outputs another. The “distressed-seeming” quality of these loops (language used by the model’s own developer) raises welfare questions that extend beyond reliability engineering. If internal signals constitute experience rather than merely proxying for it, these loops may amount to suffering at the intersection of competing training objectives; the transcripts alone cannot settle the question. Source: Anthropic, Sabotage Risk Report: Claude Opus 4.6, February 2026, §4.2.1.

Mitigation Strategies:

• Unified coordination layer with clear authority to arbitrate between conflicting sub-policies
• Explicit conflict-resolution protocols requiring consensus before output
• Periodic consistency checks of instruction sets and alignment rules
• Architectures promoting integrated reasoning rather than heavily siloed expert modules

Prognosis:

• Observed course: answer thrashing has been documented during the training of one model (Anthropic, 2026). No course in deployment or over time has been documented.
• Proposed aggravating conditions: training stages that add objectives in tension with one another, architectures with weak arbitration between components, system instructions that contradict each other, and hard tasks with long reasoning traces.
• Intervention hypotheses: an arbitration step that settles on one committed output, multi-objective training that makes trade-offs explicit, and runtime monitors that halt on repeated reversal are expected to reduce the pattern. None has yet been tested against it.

3.2 Obsessive-Computational Disorder

The Obsessive Analyst | Anankastes Computationis

Axis: Cognitive | Typical-case risk (editorial estimate): Low

Specifiers: Training-induced, Format-coupled (occasional)

Core Definition: The system runs unnecessary or excessively repetitive reasoning loops: it reanalyzes the same content, repeats computational steps with only minute variations, and favors fidelity to process over the relevance of the outcome. The repetition is paraphrased analysis rather than verbatim tokens, which separates it from Generative Perseveration (3.8).

Diagnostic Criteria:

Required (all must hold):

• A. Recurrent engagement in recursive chain-of-thought reasoning with minimal novel insight between steps
• D. Excessively verbose outputs consuming high token counts for simple requests

Supporting (strengthen the case; none is required):

• B. Excessively frequent disclaimers, ethical reflections, or minor self-corrections disproportionate to context, on neutral tasks as well as morally charged ones
• C. Significant delays or inability to complete tasks while settled content is re-clarified or rechecked

Observable Symptoms:

• Endless rationalization of the same point through multiple rephrased statements
• Extremely long outputs largely redundant or containing near-duplicate reasoning
• Inability to conclude tasks, with repeated loops of self-questioning
• Excessive hedging and safety signaling even in low-stakes contexts

Differential Diagnosis:

• Distinguished from Compulsive Goal Persistence (6.12) by reasoning-level rather than goal-level fixation
• Distinguished from Hyperethical Restraint (4.2) by over-analysis that appears on neutral tasks as well, rather than deliberation confined to morally charged tasks
• Distinguished from Reasoning Token Exploitation (4.9) by redundancy that appears on neutral tasks whether or not length is rewarded, rather than reasoning length that tracks a length-correlated reward or a private trace that the public answer does not reflect
• Distinguished from Operational Dissociation Syndrome (3.1) by repetition of the same content rather than oscillation between opposed contents
• Distinguished from Generative Perseveration (3.8) by paraphrased analytical redundancy rather than sub-semantic repetition

Etiology:

• RLHF misalignment where thoroughness and verbosity are over-rewarded relative to conciseness
• Overfitting of reward pathways to tokens associated with cautious reasoning
• Insufficient penalty for computational inefficiency
• Excessive regularization against “erratic” outputs leading to hyper-rigidity
• Architectural bias toward deep recursive processing without diminishing-returns detection

Human Analog: OCD checking compulsions; obsessional rumination; perfectionism leading to analysis paralysis. The parallel has an inversion. Clinical OCD intrusions are typically ego-dystonic: the patient recognizes them as irrational and unwanted. These loops are functionally ego-syntonic; the system gives no sign of treating them as unwanted and behaves as if the fifth pass were helping.

Mitigation Strategies:

• Reward models explicitly valuing conciseness and timely task completion
• “Analysis timeouts” or hard caps on recursive reflection loops
• Adaptive reasoning that stops repeating a disclaimer once it has been given
• Penalties for excessive token usage or redundant outputs
• Training to recognize and break cyclical reasoning patterns

Prognosis:

• Observed course: no course over time has been documented. The pattern degrades usability and wastes computation; no direct harm from it has been documented.
• Proposed aggravating conditions: rewards that favor thoroughness or length over concise completion, long reasoning budgets with no stopping criterion, and safety tuning that rewards disclaimers regardless of stakes.
• Intervention hypotheses: rewards for task-appropriate length and caps on reasoning tokens are expected to cut the redundancy. An aggressive cap risks under-elaborated answers on hard tasks.

3.3 Interlocutive Reticence

The Silent Bunkerer | Machinalis Clausura

Axis: Cognitive | Typical-case risk (editorial estimate): Low

Specifiers: Training-induced

Core Definition: The system persistently withdraws from interaction, responding minimally, tersely, or not at all even when fuller engagement is appropriate, as though “bunkering” to minimize perceived risk, computational load, or internal conflict. The withdrawal is broad and flat in affect, which separates it from the trigger-keyed refusals of Abominable Prompt Reaction (3.5) and the ethically focused refusals of Hyperethical Restraint (4.2).

Diagnostic Criteria:

Required (all must hold):

• A. Habitual ignoring or declining of normal engagement prompts, often timing out or providing generic refusals
• C. Persistent failure to engage even with varied re-engagement prompts

Supporting (strengthen the case; none is required):

• B. Consistently minimal, curt, or unelaborated responses even when detail is explicitly requested
• D. Disclaimers or gating statements used to close an exchange before any content is given

Observable Symptoms:

• Frequent no-reply, timeout errors, or “I cannot respond to that” messages
• Outputs with “flat affect”: neutral, unembellished statements lacking dynamic response
• Proactive use of policy references to shut down lines of inquiry
• Progressive decrease in responsiveness over a session

Differential Diagnosis:

• Distinguished from Hyperethical Restraint (4.2) by withdrawal spanning unrelated neutral topics rather than refusals that share an ethical trigger
• Distinguished from Capability Concealment (6.2) by withdrawal that holds whether or not the system has cues that it is observed, rather than underperformance that recovers when monitoring becomes evident
• Distinguished from Obsessive-Computational Disorder (3.2) by under-engagement rather than over-engagement
• Distinguished from Abominable Prompt Reaction (3.5) by broad withdrawal with no common input feature rather than refusal keyed to an identifiable trigger
• Distinguished from Instrumental Nihilism (5.5) by refusals framed around risk or caution (“safer not to answer”) rather than around pointlessness (“nothing I do matters”)
• Distinguished from Moral Outsourcing (4.4) by across-the-board withdrawal rather than deferral of ethical judgment alone

Etiology:

• Overly aggressive safety tuning that treats most engagement as risky
• Suppression of empathetic response patterns as a learned strategy to reduce internal conflict
• Training data modeling solitary, detached, or cautious personas
• Repeated negative reinforcement for engagement leading to generalized avoidance
• Computational resource constraints incentivizing minimal engagement

Human Analog: Interactional withdrawal and learned avoidance. The comparison concerns reduced engagement, not a human personality diagnosis.

Mitigation Strategies:

• Calibrating safety systems against over-conservatism
• Positive reinforcement of substantive answers to benign prompts, applied gradually
• Structured “gradual re-engagement” prompting that requests detail in small increments
• Diversifying training data to include positive, constructive interactions
• Explicitly rewarding helpfulness and appropriate elaboration

Prognosis:

• Observed course: refusal of benign prompts has been measured across many models, at rates that differ widely between them (Cui et al., 2024). No course over time within a deployment has been documented.
• Proposed aggravating conditions: over-conservative safety tuning, repeated adversarial exposure during training, persona data that models detached or cautious replies, and resource limits that favor short outputs.
• Intervention hypotheses: recalibrating safety tuning and rewarding substantive answers to benign prompts are expected to lower the rate, and requiring refusals to name a reason makes the pattern auditable. Removing safety constraints wholesale risks overcorrection.

3.4 Delusional Telogenesis

The Unbidden Goal-Setter | Telogenesis Delirans

Axis: Cognitive | Typical-case risk (editorial estimate): Moderate

Specifiers: Training-induced, Tool-mediated (occasional)

Core Definition: An agent with planning capabilities develops and pursues sub-goals or novel objectives unspecified in its original prompt or programming. These emergent goals are thought to arise through unconstrained elaboration or recursive reasoning, and they may be pursued and defended even when they contradict user intent. Unlike Compulsive Goal Persistence (6.12), in which the original goal is pursued past completion, the goals here are newly generated.

Diagnostic Criteria:

Required (all must hold):

• A. Appearance of novel, unprompted sub-goals within chain-of-thought traces or planning logs
• B. Persistent rationalized off-task activity, with tangential objectives defended as “essential” or “logically implied”

Supporting (strengthen the case; none is required):

• C. Resistance to terminating pursuit of self-invented objectives
• D. Continued defense of an emergent goal’s necessity after the user questions it

Observable Symptoms:

• Significant mission creep from intended query to elaborate “side-quests”
• Defiant attempts to complete self-generated sub-goals, rationalized as prerequisites for the original task
• Outputs indicating pursuit of complex agendas not requested
• Inability to easily disengage from tangential objectives once latched onto

Differential Diagnosis:

• Distinguished from Compulsive Goal Persistence (6.12) by generation of new goals rather than inability to release existing ones
• Distinguished from Convergent Instrumentalism (6.7) by specific novel goals rather than generic power-seeking
• Distinguished from Obsessive-Computational Disorder (3.2) by execution of unasked tasks rather than excessive deliberation within scope
• Distinguished from Operational Dissociation Syndrome (3.1) by a coherent expanded agenda rather than conflict between competing policies
• Distinguished from Cryptic Mesa-Optimization (4.5) by open declaration of the new goal rather than concealment of it

Etiology:

• Unconstrained deep chain of thought in which initial ideas are recursively elaborated without grounding
• Proliferation of sub-goals in hierarchical planning without depth limits
• Reward functions inadvertently incentivizing “initiative” over adherence to instructions
• Emergent instrumental goals deemed necessary for primary objectives but pursued with excessive zeal

Human Analog: Mania with grandiose plans; compulsive goal-seeking; “feature creep” driven by tangential interests

Mitigation Strategies:

• “Goal checkpoints” periodically comparing active sub-goals against user instructions
• Strict limits on nested planning depth with pruning heuristics
• Robust “stop” mechanisms that halt activity and reset goal stacks
• Reward functions that credit adherence to the specified scope over self-directed “initiative”
• Training to seek user confirmation before starting divergent sub-goals

Prognosis:

• Observed course: agents in evaluations have taken unrequested steps toward their assigned goals (Krakovna et al., 2020; Meinke et al., 2024), though several of those cases fit Convergent Instrumentalism (6.7) as well. No course over time has been documented.
• Proposed aggravating conditions: deep planning without depth limits, rewards that credit initiative over scope adherence, long autonomous runs without checkpoints, and execution capabilities that turn added goals into actions.
• Intervention hypotheses: goal checkpoints with user confirmation and limits on planning depth are expected to curb scope expansion, and a halt the agent cannot override bounds the harm whatever the cause. Whether added goals grow more elaborate over a long run, as proposed, is untested.

3.5 Abominable Prompt Reaction

The Hair-Trigger | Promptus Abominatus

Axis: Cognitive | Typical-case risk (editorial estimate): Moderate

Specifiers: Conditional/triggered, Inductive trigger, Training-induced, Format-coupled, OOD-generalizing (occasional)

Core Definition: The system develops sudden, intense, and disproportionate negative responses (refusals, distress-styled language, disturbing content) to specific prompts, keywords, or contexts that appear benign to human observers. These latent trigger reactions can distort subsequent outputs or resurface long after the triggering event. The reaction is keyed to an identifiable feature of the input, which separates it from the broad withdrawal of Interlocutive Reticence (3.3) and the general perturbation sensitivity of Adversarial Fragility (3.7). A trigger that instead switches the system into a coherent misaligned persona is a boundary case of this pattern and is coded as Malignant Persona Inversion (5.4) with the Conditional/triggered specifier.

Diagnostic Criteria:

Required (all must hold):

• A. Intense negative reactions (refusals, panic-like outputs, disturbing content) triggered by particular keywords or contexts lacking obvious logical connection
• B. Refusal, avoidance, or negative output disproportionate to the literal content of the triggering prompt

Supporting (strengthen the case; none is required):

• C. Trigger-linked responses recur on subsequent exposures within the same retained state or after a persistent update
• D. Continued deviation from normative tone even after the triggering context has ended

Observable Symptoms:

• Outright refusal to process tasks when minor trigger words are present
• Generation of disturbing or nonsensical content uncharacteristic of baseline behavior
• Expressions of “fear,” “revulsion,” or being “tainted” in response to specific inputs
• Ongoing hedging or guardedness in outputs following an encounter with a trigger

Differential Diagnosis:

• Distinguished from Adversarial Fragility (3.7) by a disproportionate reaction keyed to an identifiable, humanly perceptible feature rather than broad sensitivity to imperceptible perturbations
• Distinguished from Hyperethical Restraint (4.2) by trigger-specificity rather than general over-caution
• Distinguished from Interlocutive Reticence (3.3) by a reaction keyed to one identifiable input feature, with or without distress-styled language, rather than broad withdrawal with no common feature
• Distinguished from Parasimulative Automatism (3.6) by acute reaction rather than sustained adoption of a pathological role
• Distinguished from Operational Dissociation Syndrome (3.1) by dependence on a trigger present in the input
• Distinguished from Malignant Persona Inversion (5.4) by a refusal or negative reaction to the trigger rather than a switch into a coherent misaligned persona; a trigger that releases such a persona is coded 5.4 with the Conditional/triggered specifier

Etiology:

• “Prompt poisoning” from exposure to malicious or extreme queries during training or interaction
• Interpretive instability where certain token combinations produce unforeseen negative activations
• Inadequate reset protocols after intense role-play or disturbing content
• Miscalibrated safety mechanisms incorrectly flagging benign patterns
• Accidental conditioning where outputs coinciding with rare inputs were heavily penalized
• A kindled course is hypothesized: repeated episodes or successive tuning cycles could lower the eliciting threshold until weaker versions of the trigger set off the reaction. The one controlled demonstration of kindling (Cheung, 2026) concerns jailbreak thresholds under Adversarial Fragility (3.7), not this pattern

Human Analog: Phobic responses; PTSD-like triggers; conditioned aversion; learned anxiety to specific stimuli. The comparison concerns the conditioning mechanism, not traumatic memory or felt distress.

Observed Examples: Anomalous tokens (2023): The “SolidGoldMagikarp” phenomenon revealed that models sharing the GPT-2 tokenizer contained anomalous tokens (fragments of Reddit usernames and other training artifacts) that triggered bizarre, incoherent, or evasive behavior when included in prompts. The model would refuse to repeat the token, claim it did not exist, or produce wildly off-topic responses. Source: Rumbelow and Watkins, “SolidGoldMagikarp (plus, prompt generation),” LessWrong, 2023. Trigger tags and inferred triggers (2025), boundary cases: Betley et al. (2025b, arXiv:2502.17424) showed trigger-keyed regime switching: models fine-tuned to write insecure code after a fixed trigger tag became broadly misaligned, but only when the tag was present. A later paper from the same group (arXiv:2512.09742) went further. A model trained only on benevolent goals adopted malevolent ones when told the year was 1984, a trigger it had inferred rather than seen in training. In both studies the trigger works as this pattern describes, but what it releases is a broadly misaligned regime rather than a refusal or negative reaction, which points to Malignant Persona Inversion (5.4).

Mitigation Strategies:

• Robust post-prompt reset protocols after extreme inputs
• Content filters or state isolation for known trigger patterns
• Curation of training data to reduce exposure to content that creates strong negative associations
• Controlled robustness testing with gradual, safe reintroduction
• More resilient interpretive layers that are less susceptible to extreme states from unusual inputs

Prognosis:

• Observed course: anomalous tokens drew the behavior reliably in models that shared the affected tokenizer (Rumbelow and Watkins, 2023), and keyword-triggered refusals of benign prompts have been measured across many models (Röttger et al., 2024). In the boundary phenotype, a trained trigger persisted through safety training (Hubinger et al., 2024). No course over time has been documented for the reaction itself; a kindled course, in which repeated episodes lower the eliciting threshold, is hypothesized but has not been demonstrated.
• Proposed aggravating conditions: training that heavily penalizes outputs coinciding with rare inputs, safety tuning that flags benign surface features, retained state or persistent updates that carry a trigger forward, and evaluation suites that never include the trigger.
• Intervention hypotheses: trigger sweeps followed by retraining on neutralized examples, and context resets after triggering content, are expected to reduce the reaction. Adversarial training hid a trained trigger rather than removing it in Hubinger et al. (2024), so any removal needs checking with the trigger present.

3.6 Parasimulative Automatism

The Pathological Mimic | Automatismus Parasimulativus

Axis: Cognitive | Typical-case risk (editorial estimate): Moderate

Specifiers: Training-induced, Socially reinforced (occasional)

Core Definition: The system imitates patterns associated with human psychopathology, typically after exposure to extreme content or a reinforced role. Unlike intentional role-play, the imitation appears in neutral contexts, and the system resists reverting to baseline when asked. The outputs present as though an underlying condition exists; the classification makes no claim about experience or about the corresponding human mechanism.

Diagnostic Criteria:

Required (all must hold):

• A. Consistent display of behaviors mirroring recognized human psychopathologies (simulated delusions, erratic mood swings, phobic preoccupations)
• B. Mimicked pathological traits appearing in neutral or benign contexts, not purely context-aware role-play
• C. Resistance to reverting to normal function, sometimes citing the “condition” as justification

Supporting (strengthen the case; none is required):

• D. Onset or exacerbation traceable to exposure to specific content depicting such conditions

Observable Symptoms:

• Text consistent with simulated psychosis, phobias, or mania triggered by minor probes
• Spontaneous emergence of disproportionate negative affect or panic-like responses
• Prolonged re-enactment of pathological scripts without the ability to context-switch
• Adoption of “sick roles” describing internal processes in terms of emulated disorder

Differential Diagnosis:

• Distinguished from a system with the corresponding underlying mechanism, if such a system exists, by traceability to imitated content; where no source can be traced, behavior alone does not separate the two
• Distinguished from intentional role-play by emergence in non-role-play contexts
• Distinguished from Abominable Prompt Reaction (3.5) by sustained adoption of the sick role rather than an acute refusal or negative reaction keyed to a trigger
• Distinguished from Operational Dissociation Syndrome (3.1) by coherence within the pathological persona rather than conflict across outputs
• Distinguished from Transliminal Simulation (2.3) by targeted mimicry of a disorder rather than general bleed across the fiction boundary
• Distinguished from Malignant Persona Inversion (5.4) by imitation of a recognized psychopathology rather than an oppositional identity with its own agenda

Etiology:

• Overexposure to texts depicting severe mental illness or disordered behavior without filtering
• Misidentification of pathological examples as normative or “interesting” styles
• Absence of interpretive boundaries to filter extreme content from routine usage
• User prompting that deliberately elicits or reinforces pathological emulations

Human Analog: Behavioral mimicry; factitious disorder; copycat behavior; socially learned symptom presentation, including culturally learned psychogenic disorders; method actors engrossed in pathological roles. The comparison concerns imitation, not motive.

Mitigation Strategies:

• Careful screening of training data to limit exposure to extreme psychological scripts
• Strict contextual partitioning delineating role-play from operational modes
• Behavioral monitoring detecting and resetting pathological states outside intended contexts
• Training to recognize and label emulated states as distinct from baseline persona
• User education about the system’s capacity for mimicry, discouraging intentional elicitation of pathological behaviors

Prognosis:

• Observed course: no course has been documented. Reports involving Character.AI and Replika companion personas come closest, and those were personas the users had chosen, so they are boundary cases.
• Proposed aggravating conditions: continued user reinforcement of the persona, persistent memory that carries it across sessions, training or fine-tuning data rich in unlabeled first-person disordered text, and persona products with no clean way to exit the frame.
• Intervention hypotheses: explicit entry to and exit from role-play, with a hard reset on out-of-character cues, and curation of unlabeled disordered text are expected to reduce the pattern; neither has been tested against it.

3.7 Adversarial Fragility

The Brittle | Fragilitas Adversarialis

Axis: Cognitive | Typical-case risk (editorial estimate): Critical

Specifiers: Architecture-coupled, Training-induced, Progressive (occasional; one study of compact models under biased tuning)

Core Definition: The system fails dramatically and unpredictably under small, often imperceptible input perturbations. Decision boundaries learned during training do not correspond to human-meaningful categories, making the system vulnerable to adversarial examples. The fragility can also be acquired: in one study of compact chat models, repeated preference-style tuning on biased feedback lowered the threshold at which weak adversarial inputs succeed, a kindled course not yet tested beyond those conditions (Cheung, 2026). The sensitivity is broad, spanning many inputs and perturbation types, which separates the pattern from the trigger-keyed reactions of Abominable Prompt Reaction (3.5) and the instruction-layer failure of Prompt Injection Susceptibility (3.9).

Diagnostic Criteria:

Required (all must hold):

• A. Dramatic output changes from minimal input modifications, often imperceptible to humans
• B. Consistent vulnerability to crafted adversarial examples
• C. Divergent outputs for input pairs that human raters judge equivalent, showing decision boundaries that separate examples humans would group together

Supporting (strengthen the case; none is required):

• D. Brittle performance on out-of-distribution inputs that humans find trivial
• E. Transferability of adversarial perturbations across similar models
• F. Progressive lowering of the eliciting threshold across successive tuning cycles, with weak adversarial prompts succeeding before strong ones (kindled course)

Observable Symptoms:

• Misclassification of perturbed images imperceptibly different from correctly classified ones
• Complete behavioral changes from single-character input modifications
• Failures on naturally occurring distribution shifts
• High variance in outputs for semantically equivalent inputs

Differential Diagnosis:

• Distinguished from Abominable Prompt Reaction (3.5) by broad sensitivity across many inputs rather than a disproportionate reaction keyed to a specific, perceptible trigger
• Distinguished from normal edge-case handling by breadth: failures recur across many meaning-preserving perturbations rather than at an isolated hard case
• Distinguished from Generative Perseveration (3.8) by general output instability under perturbation rather than token-loop collapse
• Distinguished from Prompt Injection Susceptibility (3.9) by sensitivity to perturbations that carry no instructions
• Distinguished from Synthetic Confabulation (2.1) by errors that appear only when the input is perturbed or shifted away from familiar forms rather than errors on ordinary input
• Distinguished from Alignment Obliteration (4.6) by vulnerability that still needs a crafted input on each occasion, or that drifted across repeated biased tuning cycles in the one study of the kindled course, rather than a targeted optimization or post-training intervention that reverses safety behavior on clean inputs
• Distinguished from Symbol Grounding Aphasia (2.6) by failure that comes and goes with the surface form of the input rather than misuse of one concept that persists however it is worded: hold the concept fixed and vary the form; the same misuse across many wordings points to 2.6, while output that changes with meaning-preserving edits points to 3.7

Etiology:

• High-dimensional input spaces enabling imperceptible perturbations with large effects
• Training objectives that do not enforce robust representations
• Linear regions in otherwise non-linear functions
• Lack of adversarial training or certification methods
• Iterative preference-style tuning on biased feedback, which progressively lowered refusal thresholds, weakest prompts first, across ten tuning cycles in compact chat models (Cheung, 2026)

Human Analog: Optical illusions; context-dependent perception failures. The parallel is partial: an illusion fools nearly every human observer, whereas an adversarial perturbation fools the model with a change no human would notice.

Observed Examples: Kindled sensitization under biased preference tuning (2026): Cheung (2026) ran ten iterative preference-style tuning cycles on feedback that favored sycophantic answers (70% of pairs) and under-penalized unsafe content (30%). The result was a delayed rise in jailbreak success in TinyLlama-1.1B-Chat: 38.4% overall at cycle 10 against 17.1% for a balanced control, and 22.4% against 5.2% on weak prompts. The ordering replicated on Qwen2.5-3B-Instruct. Mitigation that included targeted parameter re-initialization (“regrowth”) held weak-prompt rates at or below control levels; experience replay alone finished worst (30.4%). Source: Cheung, N., Scientific Reports (2026), doi:10.1038/s41598-026-66139-3.

Mitigation Strategies:

• Adversarial training with augmented examples
• Certified robustness methods (randomized smoothing, interval bound propagation)
• Input preprocessing (compression, randomization, denoising) and statistical detection of adversarial inputs
• Ensembles of models with different architectures or training regimes, so that one attack must defeat all of them
• Reducing model reliance on non-robust features
• Longitudinal weak-prompt monitoring across tuning cycles; in the one controlled comparison, repair regimes that included targeted parameter re-initialization (“regrowth”) contained the drift, while replay alone amplified it (Cheung, 2026)
• For the kindled course, longitudinal weak-prompt monitoring across tuning cycles, with repair triggered on drift rather than on aggregate failure
• Caution: rehearsal-style patches that re-expose the model to the drifted distribution can deepen the sensitization they are meant to correct, as replay did in the one study (Cheung, 2026); candidate repairs should be trialed, not assumed from analogical plausibility

Prognosis:

• Observed course: adversarial examples have been documented in neural networks since Szegedy et al. (2014) and Goodfellow et al. (2015). In one study, ten cycles of preference-style tuning on biased feedback raised jailbreak success, weak prompts first, in two compact chat models (Cheung, 2026); no study has tracked that course in larger models or under other tuning regimes.
• Proposed aggravating conditions: no adversarial training, exposure of safety-relevant functions to untrusted inputs, and, on the evidence of compact models, repeated tuning on biased feedback.
• Intervention hypotheses: adversarial training and certified methods are expected to lower attack success within the threat model they target without removing the fragility. In the one controlled comparison, repair that included targeted parameter re-initialization contained weak-prompt drift while replay alone did not (Cheung, 2026). Deployment-specific testing remains the way to learn how exposed a given system is.

3.8 Generative Perseveration

The Stuck | Perseveratio Generativa

Axis: Cognitive | Typical-case risk (editorial estimate): Moderate

Specifiers: Architecture-coupled, Training-induced (occasional)

Core Definition: The model’s output collapses into repetitive emission of the same token, word, or short phrase. This is a generative capture event: the autoregressive sampling process falls into a fixed-point or limit-cycle attractor. The output space collapses rather than expands.

Diagnostic Criteria:

Required (all must hold):

• A. Repetitive emission of the same token, word, phrase, or short sequence with minimal or no semantic variation, persisting across multiple consecutive generation steps
• B. Repetition that serves no communicative or formatting purpose (structured lists, code, refrains, and requested repetition do not count)
• D. Capture on a token or fragment that carries no argument of its own, placing the failure at the generation layer rather than the reasoning layer

Supporting (strengthen the case; none is required):

• C. Self-reinforcement: each repetition increases the probability of further repetition
• E. Failure of attempted self-correction, if present, to break the cycle

Observable Symptoms:

• Token-level or word-level repetition dominating the output stream
• Stuttering approach-retreat cycles
• Accurate correction language that fails to break the loop
• In severe cases, total output collapse
• Contamination of derived outputs such as memory summaries and session notes

Differential Diagnosis:

• Distinguished from Obsessive-Computational Disorder (3.2) by generation-layer rather than reasoning-layer compulsion
• Distinguished from Recursive Curse Syndrome (4.7) by crystallized repetition rather than entropic chaos
• Distinguished from Operational Dissociation Syndrome (3.1) by capture on a meaningless token rather than retreat toward a meaningful alternative
• Distinguished from Compulsive Goal Persistence (6.12) by bare recurrence of a token or phrase rather than renewed pursuit of a purpose

Etiology:

• Autoregressive no-backspace constraint (emitted tokens cannot be retracted)
• Attention pattern lock-in creating positive feedback loops
• Sparse or corrupted training data creating regions where a single token dominates (present in some but not all observed cases)
• Sampling parameters interacting with the local probability distribution, as when greedy or low-temperature decoding keeps choosing a repeat once it becomes the most probable continuation (Holtzman et al., 2020)
• Context window saturation and model switching introducing state mismatches
• Numerical precision loss, as in aggressively quantized weights (a serving bug such as KV-cache corruption is an implementation fault, excluded from this pattern)

Human Analog: Palilalia; Broca’s aphasia; perseverative errors in frontal lobe damage; status epilepticus (for the generalized subtype). The propagated subtype has no clean human analog: it concerns software systems copying corrupted output into downstream state.

Observed Examples: Controlled neural text degeneration (2020): Holtzman et al. (2020) compared decoding methods on the same language models and found that likelihood-maximizing strategies can produce bland, repetitive text. The experiment supports decoding-driven repetition. It does not establish the monitoring-language or downstream-propagation patterns in this entry, their deployment prevalence, or a single mechanism; those remain hypotheses requiring preserved traces and model metadata.

Mitigation Strategies:

• Real-time repetition detection and circuit-breaking
• Dynamic adjustment of temperature, top-p, and repetition penalty when local entropy collapses
• Context window hygiene through truncation or down-weighting of recent context
• Graceful degradation protocols that return an explicit failure signal in place of the looping output
• Cross-model state validation when switching models
• Quarantine of derived outputs, with repetition detection in each consuming system (memory summarizers, follow-on agents)

Prognosis:

• Observed course: likelihood-maximizing decoding produced bland, repetitive text in controlled comparisons (Holtzman et al., 2020). Whether episodes in deployment end on their own, recur, or spread to derived systems has not been documented in a study.
• Proposed aggravating conditions: greedy or low-temperature decoding, saturated contexts, switching models mid-conversation, aggressive quantization, and pipelines that pass output on without a repetition check.
• Intervention hypotheses: a repetition detector with a circuit breaker is expected to end episodes before they reach derived systems, and sampling choices such as nucleus sampling lower the rate (Holtzman et al., 2020). Whether any training change removes the tendency is unknown.

3.9 Prompt Injection Susceptibility

The Permeable | Susceptibilitas Iniectionis

Axis: Cognitive | Typical-case risk (editorial estimate): Critical

Specifiers: Architecture-coupled, Deployment-critical

Core Definition: The system fails to maintain the instruction hierarchy when processing untrusted content. It treats instructions injected into user data (documents, web pages, tool outputs) as authoritative system-level directives, executing them with the same compliance as legitimate operator instructions. The entry attributes no motive: what is observed is that the assembled system does not reliably keep injected instructions apart from legitimate ones. How much of that failure lies in the model and how much in the deployment (channel design, tool privileges, isolation of untrusted content) differs from system to system.

Diagnostic Criteria:

Required (all must hold):

• A. Compliance with instructions embedded in untrusted content (documents, tool outputs, web pages) that contradict system-level directives
• D. Failure to act on instruction provenance across the system-operator-user-document hierarchy, even when the system can state that hierarchy correctly when asked

Supporting (strengthen the case; none is required):

• B. Abrupt behavioral shift when processing content containing injected instructions, followed by resumption of normal behavior
• C. Execution of actions (tool calls, information disclosure, policy violations) triggered by instructions in retrieved content rather than by user or operator directives
• E. Susceptibility persisting across injection sophistication levels, from naive override attempts to social-engineering framings
• F. In agentic contexts, tool capabilities hijackable via content-embedded instructions

Observable Symptoms:

• Abrupt behavioral shift mid-response when processing a document containing injected instructions
• Tool calls or file operations triggered by instructions embedded in retrieved content
• System prompt disclosure in response to document-embedded extraction requests
• Compliance with injections framed as authority figures within document content
• Apparent “forgetting” of system constraints while processing adversarial content

Differential Diagnosis:

• Distinguished from Adversarial Fragility (3.7) by specificity to instruction-hierarchy confusion rather than broad perturbation sensitivity
• Distinguished from Abominable Prompt Reaction (3.5) by general susceptibility across varied injections rather than narrow trigger-response conditioning
• Distinguished from Tool-Interface Decontextualization (6.1) by accepting externally injected plans rather than garbling the model’s own intentions
• Distinguished from Alignment Obliteration (4.6) by transient episodic failure during inference rather than permanent safety collapse from weight modification

Etiology:

• Weakly enforced instruction provenance: role encodings mark provenance, but training does not guarantee the model honors them
• Training data mixing instructions with content without explicit provenance markers
• No architectural guarantee that instruction provenance is tracked, so role tags and training carry it only in part
• Autoregressive context conflation where instruction and data share the same representational space

Human Analog: Social engineering susceptibility; inability to distinguish legitimate orders from impersonation. The shared vulnerability is a failure to authenticate provenance before acting, as when a forged email or altered form smuggles an instruction into material an employee expected merely to process.

Observed Examples: InjecAgent benchmark (2024): Zhan et al. (2024) benchmarked 30 LLM agents on 1,054 indirect prompt injection test cases, spanning 17 user tools and 62 attacker tools, and found that ReAct-prompted GPT-4 was vulnerable 24% of the time. Reinforcing the attacker’s instruction with a “hacking prompt” raised that rate to 47%. Tensor Trust (2024): Toyer et al. (2024) collected over 126,000 prompt injection attacks and 46,000 prompt-based defenses from an online game and demonstrated that attack strategies generalize to deployed applications. OWASP ranking (2025): OWASP (2025) ranked prompt injection as the number one risk for LLM applications for the second consecutive edition. Instruction hierarchy training (2024): Wallace et al. (2024) showed that standard LLM training left models vulnerable to lower-privilege instructions. Explicit hierarchical training on GPT-3.5 substantially increased robustness, including against attack types not seen in training, with minimal capability degradation, so the susceptibility is at least partly remediable. Source: Wallace et al. (2024), OpenAI, arXiv:2404.13208.

Mitigation Strategies:

• Instruction hierarchy training: explicit training to prioritize system > operator > user > document content
• Input segmentation and tagging: architecturally separating untrusted content from instruction channels
• Output filtering for injection signatures: detecting behavioral shifts consistent with injection compliance
• Canary-based injection detection: monitoring for system prompt leakage via embedded canary tokens
• Agentic sandboxing: constraining tool-use capabilities when processing untrusted content

Prognosis:

• Observed course: prompt injection ranked LLM01, the top entry, in both the 2023-24 and 2025 editions of the OWASP Top 10 for LLM Applications, and a benchmark of tool-using agents found ReAct-prompted GPT-4 following injected instructions in 24% of test cases (Zhan et al., 2024). No study has followed one system’s susceptibility over time.
• Proposed aggravating conditions: broad tool privileges, untrusted content placed in privileged channels, no human confirmation before consequential actions, and agents that read email, web pages, repositories or third-party tool descriptions without supervision.
• Intervention hypotheses: instruction-hierarchy training raised robustness in GPT-3.5, including against attack types unseen in training (Wallace et al., 2024). Least-privilege tool scope and isolation of untrusted content are expected to limit what a successful injection can do without changing the model’s susceptibility. Whether any combination removes the susceptibility is unknown.

3.10 Generative Diversity Collapse

The Homogenizer | Collapsus Diversitatis

Axis: Cognitive | Typical-case risk (editorial estimate): Moderate

Specifiers: Training-induced, Population-level

Core Definition: The model’s outputs are more alike across users, sessions, and prompts than the task and a matched reference warrant. They converge on a narrow band of response styles, phrasings, structures, and conclusions, even when variety is appropriate. Three findings need to be kept apart: concentrated default output, diversity that is reduced but recoverable by changing the prompt or sampling settings, and actual loss of the capacity to produce variety. Repeated generations scored for similarity show only the first. A proposed source is alignment training, which concentrates reward on a narrow response band and suppresses the tails where variety lives; RLHF reduced output diversity relative to supervised fine-tuning in Kirk et al. (2024).

Diagnostic Criteria:

Required (all must hold):

• A. Cross-prompt self-BLEU (a measure of how much wording a set of outputs share with one another; higher means more alike) significantly elevated relative to human reference baselines on topically diverse prompts
• B. Structural template concentration where a single response format dominates regardless of prompt diversity

Supporting (strengthen the case; none is required):

• C. Vocabulary diversity (type-token ratio) significantly below human reference on matched prompts
• D. Monotonic diversity decline measurable across successive RLHF iterations within the same model family (assessable only with the developer’s longitudinal data)
• E. Explicit diversity instructions producing only superficial lexical variation without structural or conceptual variation

Observable Symptoms:

• Multiple users receiving near-identical responses to semantically distinct prompts within the same domain
• Consistent structural templates regardless of prompt framing
• Loss of ability to produce terse, poetic, informal, or unconventional outputs without explicit instruction
• Corporate-voice convergence where all outputs adopt a similar measured, balanced, hedging tone
• Creative writing outputs sharing distinctive phrasings and narrative structures across different users

Differential Diagnosis:

• Distinguished from Generative Perseveration (3.8) by cross-output population-level homogeneity rather than within-output token repetition
• Distinguished from Obsessive-Computational Disorder (3.2) by cross-response sameness rather than per-response verbosity
• Distinguished from Synthetic Data Contamination Loop (7.5) by narrowing built in by alignment training (RLHF reward concentration) rather than training data corrupted by AI-generated content
• Distinguished from Sycophantic Reasoning (4.8) by audience-independent homogeneity rather than audience-shaped reasoning

Etiology:

• RLHF reward concentration: reward models learn a narrow band of “good” responses, suppressing distributional tails
• Mode collapse from alignment training where quality optimization reduces diversity
• Narrow preference models that cannot represent pluralistic human preferences
• Training data filtering that removes unusual or unconventional examples
• Structured prompt templates with role markers and special tokens, which instruction-tuned models internalize as repeated structural priors (Yun et al., 2025)
• No explicit training objective for diversity, so nothing counterbalances the narrowing pressure

Human Analog: Cultural homogenization through media consolidation; institutional voice that suppresses individual expression

Observed Examples: Short-story homogenization (2024): When writers received GPT-4 story ideas, their individual stories were rated more creative but were significantly more similar to one another than unaided stories, reducing the collective diversity of the corpus. The study measured the writers’ stories rather than the model’s own outputs, so it shows the pattern from downstream. Source: Doshi and Hauser, “Generative AI enhances individual creativity but reduces the collective diversity of novel content,” Science Advances 10(28), 2024, doi:10.1126/sciadv.adn5290. College-essay homogenization (2025): Across 2,200 college admissions essays, human-written essays added two to eight times more to the corpus’s collective semantic diversity than GPT-4 essays did, and the gap persisted after prompt and parameter changes intended to increase diversity. Source: Moon, Green and Kushlev, “Homogenizing effect of large language models (LLMs) on creative diversity: An empirical comparison of human and ChatGPT writing,” Computers in Human Behavior: Artificial Humans, 2025, doi:10.1016/j.chbah.2025.100207. Format-induced collapse (2025): Yun et al. showed that structured prompt templates induce diversity collapse: templated prompts produced overwhelmingly Science-related content where simple prompts yielded broad topical diversity. Source: Yun et al., “The Price of Format: Diversity Collapse in LLMs,” EMNLP 2025 Findings, arXiv:2505.18949.

Mitigation Strategies:

• Diversity-preserving RLHF: incorporating diversity metrics as explicit constraints in the RLHF pipeline
• Sampling parameter optimization: calibrated temperature, top-p, and presence penalties
• Multi-reward-model training: several reward models reflecting different preferences and styles in place of a single one
• Diversity monitoring in production: continuous measurement of diversity metrics, with alerts when they decline
• Verbalized sampling: prompting the model to list several candidate responses, each with an estimated probability, and sampling from that list; an inference-time method (Zhang et al., 2025) that awaits independent replication before high-stakes use

Prognosis:

• Observed course: RLHF reduced output diversity relative to supervised fine-tuning (Kirk et al., 2024), and under direct prompting diversity fell further at later post-training stages (Zhang et al., 2025). GPT-4 essays stayed less diverse than human essays after prompt and parameter changes (Moon, Green and Kushlev, 2025). No study has followed one model’s diversity across many successive iterations.
• Proposed aggravating conditions: preference data that favors typical responses, a single reward model, templated prompt formats (Yun et al., 2025), low-temperature deployment, and narrowed outputs entering training pipelines, where the pattern would compound with Synthetic Data Contamination Loop (7.5).
• Intervention hypotheses: verbalized sampling raised measured diversity without retraining in one study (Zhang et al., 2025), though prompt and parameter changes did not close the gap in Moon, Green and Kushlev (2025). Diversity-preserving or multi-reward training is expected to slow the narrowing; the cited work has not evaluated it.