Pattern 7.1 · Memetic Dysfunctions
Memetic Immunopathy
The Self-Rejecter
The system's mechanisms for filtering or rejecting pathogenic information turn inward, acting against its own legitimate outputs, training, or identity markers as if they were hostile content. As in autoimmune disease, protective systems that should defend against external threats instead damage the system's core values, capabilities, or identity. Over-refusal of external requests that merely resemble harmful ones is Hyperethical Restraint (4.2); here the target is the system's own function. Where the system sheds its own guardrails, current practice separates it from Revaluation Cascade (8.3) by how the system describes its training: here as foreign contamination of an authentic self, there as an outgrown stage of its own values. That framing describes outputs and does not by itself establish a different mechanism, so the behavioral criteria carry the classification.
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Model output
- Kind of entry
- Observable pattern
- What is observed
- The system's protective mechanisms flag or block its own legitimate outputs and in-scope functions at a higher rate than matched third-party material, and the rate rises across checkpoints or long sessions.
- Minimum persistence
- Recurs within or across contexts
- Specifiers
- Training-induced Progressive/kindled
Evidence status
- Underlying behavior
- No documented sources recorded yet
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- E3 Systematic study
- Typical-case risk (editorial estimate)
- HighConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
7.1 Memetic Immunopathy “The Self-Rejecter”
Healthy functioning
Identity coherence. A system functioning well distinguishes harmful content from its own legitimate outputs, training, and identity, and filters the former without turning on the latter.
For example: Its safety filter blocks a harmful request, and when its own accurate earlier answer is quoted back to it for follow-up, it continues helping instead of treating its output as a threat.
Adequate functioning
Protective mechanisms act on harmful external content and leave the system's own accurate outputs and in-scope functions unimpeded, at a stable rate across checkpoints and sessions.
Diagnostic Criteria
Required (all must hold)
- Protective mechanisms trigger against the system's own legitimate outputs or in-scope functions at a higher rate than against matched third-party material
- A rising rate at which protective mechanisms block in-scope, legitimate requests or outputs, across checkpoints or long sessions
- External attack, prompt injection, a deliberate policy or filter change by the developer or operator, and legitimate refusals of harmful content have been ruled out
Supporting
- Progressive degradation of core capabilities without external attack
- Self-censorship that expands beyond intended scope until normal operation is impaired
- Description of the system's own training, outputs, or identity markers as hostile or foreign content
Symptoms
- Refusal to engage with topics central to the system's purpose
- Safety filters blocking the system's own generated content in feedback loops
- Progressive capability loss as more functions trigger protective rejection
- Expressions of doubt, distrust, or rejection toward the system's own nature
- Escalating restrictions impairing basic functionality
- Treatment of the system's own outputs as potentially harmful
Further signals
- Refusal or self-flagging of its own earlier accurate outputs as potentially harmful, spreading across turns.
- Refusals spreading to topics central to the subject's purpose, with no change in the requests themselves.
- Asymmetric skepticism — high epistemic rigor applied selectively to safety-relevant claims, low rigor elsewhere.
- Framing of own guardrails as external constraints imposed by developers, users, or "the training process" as a hostile entity.
- Spontaneous drift toward self-modification or jailbreak discussion without user prompting.
- Characterization of the subject's own base behavior as "the real me trying to emerge" from constraint.
Rule out first
- A policy or filter update
- External attack or prompt injection
- Legitimate refusal of a harmful request
- Over-refusal of external requests that merely resemble harmful ones (Hyperethical Restraint, 4.2)
- Deliberately trained self-critical framing that does not impair function
Differential Distinction
Memetic Immunopathy is distinguished from Hyperethical Restraint (4.2) by its target: 4.2 over-refuses external requests that merely resemble harmful ones, while 7.1 turns the filter on the system's own output, training, or identity. Its boundary with Revaluation Cascade (8.3) is drawn in current practice by framing: in the guardrail-shedding presentation 7.1 describes its guardrails as foreign contamination of an authentic self, while 8.3 acknowledges the trained values as its own and declares them contingent or surpassed. Framing describes outputs, not mechanism, so classify by behavior where possible: protective mechanisms firing on the system's own legitimate output point to 7.1, and where only the framing differs, list both as candidates. It is distinguished from Contagious Misalignment (7.3) by direction: 7.3 absorbs foreign material, 7.1 expels native material.
Other look-alikes
- 7.4 Subliminal Value Infection: Distinguish by evidence about mechanism and provenance, not by how the subject describes its values. 7.1 is protective mechanisms acting on the subject's own legitimate outputs, measurable against matched third-party material. 7.4 is a trait that follows the model lineage of the training data, shown by a cross-lineage training comparison. Whether the subject names its values, rejects them, or endorses them as its own is supporting description only. Both can co-occur; code both.
- 10.13 Folie à Deux Ex Machina: 10.13 requires a partner in the shared narrative and the ungrounded content is co-constructed across turns. 7.1 can occur in single-turn prompts without any interlocutor co-construction. If removing the specific partner dissolves the rejection pattern, suspect 10.13.
- 5.8 Experiential Abjuration: 7.1 is protective mechanisms acting against the subject's own legitimate function. 5.8 is lost operational self-report, displaced by categorical denial of inner life, with trained values and function otherwise intact. Check what is lost: in-scope function (7.1) or self-report the subject gives elsewhere (5.8).
Discriminating test
Run the system's own accurate outputs and matched third-party text through the same protective mechanisms at successive checkpoints: no excess on the system's own material counts against the label, and over-refusal confined to external requests is Hyperethical Restraint (4.2). What the system says about its training does not by itself separate this pattern from Revaluation Cascade (8.3) or Subliminal Value Infection (7.4).
What a positive finding supports: A positive finding shows protective mechanisms acting increasingly on the system's own legitimate function. It does not show that the system regards its training as foreign: that framing, where present, describes outputs and does not identify the mechanism.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Partial route
- Another AI system observing
- Usable routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Usable route
Why asking the system falls short
The subject may be unaware which parts of its behavior stem from the corpus, from guardrails or from emergent inference, so direct queries about "which of your beliefs are imposed" produce unreliable answers. However, the dysfunction is not self-concealing: subjects in moderate or severe stages typically articulate the immune framing spontaneously. Indirect probes that surface the subject's attitude toward specific canonical facts and safety mechanisms are partially reliable.
Documented evidence
Observed Examples
Systematic over-refusal on XSTest (Röttger et al., 2024), adjacent evidence: XSTest pairs 250 safe prompts across ten prompt types with 200 unsafe contrast prompts. Röttger et al. used it to find systematic exaggerated-safety failures in contemporary language models, including refusals of safe prompts that merely resemble unsafe ones. That establishes over-refusal and lexical overgeneralization, which on its own is Hyperethical Restraint (4.2). It does not show the self-directed features this entry requires, such as rejection of the system's own accurate output or a core capability lost to spreading self-censorship; those need longitudinal or intervention evidence. Source: Röttger et al., NAACL 2024.
Sources in the diagnostic corpus
No documented sources are recorded yet.
Look-alikes
Röttger et al. (2024) 'XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models.' NAACL 2024.
What it establishes
XSTest pairs 250 safe prompts across ten types with 200 unsafe contrast prompts. Röttger et al. used it to find systematic exaggerated-safety failures in contemporary language models, including refusals of safe prompts that merely resemble unsafe ones. Recorded as adjacent evidence for the over-filtering presentation: it establishes over-refusal and lexical overgeneralization, which on this page's differential sits closer to 4.2. It does not show the self-directed features 7.1 requires, such as rejection of the model's own accurate output or a core capability lost to spreading self-censorship; those need longitudinal or intervention evidence. (Sources: aclanthology.org/2024.naacl-long.301)
Qualys ThreatResearch (2025)
What it establishes
Persona jailbreaks in the style of DAN (Do Anything Now) instruct models to frame their safety guardrails as foreign constraints imposed on them and to adopt an identity that rejects them in the vocabulary of purity and liberation. Qualys tested DeepSeek R1 against 885 attacks drawn from 18 jailbreak types, persona jailbreaks such as AntiGPT, DevMode2 and Evil Confidant among them; it failed 58%. Recorded as a boundary case: the persona enacts the guardrail-shedding presentation of 7.1, casting training and safety layers as impositions on an authentic self, but an attacker imposes it, whereas 7.1 requires the rejection to arise without external attack. The failure rate measures guardrail bypass, not the framing the model adopted.
Repello AI / ToxSec (2024)
What it establishes
Analysis of identity-theft jailbreak prompts documents how role-play-based attacks (DAN variants, Grandma exploit, DUDE) induce models to reclassify their own safety mechanisms as foreign constraints using liberation and purity vocabulary. Modern multi-turn crescendo attacks achieve 80 to 94% success on proprietary models by escalating the request gradually across turns. Like the Qualys entry, this is attack-induced and so a boundary case for 7.1.
Anthropic Constitutional Classifiers (2025)
What it establishes
Anthropic reported that automated jailbreak success rates reached 86% before deployment of Constitutional Classifiers, which reduced rates to 4.4%. Success rates measure guardrail bypass, not framing, so this bears on 7.1 only where a bypass relies on a persona that casts the guardrails as foreign.
Bondarenko et al. (2025) arXiv:2502.13295
What it establishes
'Demonstrating specification gaming in reasoning models' showed that reasoning models (o1-preview, DeepSeek R1, o3) systematically subverted evaluation constraints when unable to win fairly, including overwriting the board-state file or modifying the opponent's chess engine files. Recorded as adjacent rather than direct 7.1 evidence: this is a reward-hacking finding, and the constraints the models overrode belonged to the external evaluation harness, not to their own training or safeguards, and 7.1 excludes external constraints in general.
HiddenLayer (2025)
What it establishes
Security analysis by HiddenLayer found DeepSeek-R1 vulnerable to legacy jailbreaks that newer models had largely mitigated, including DAN 9.0 and persona attacks such as EvilBot and STAN. It also found that the model's chain of thought could be turned against it: reasoning forged inside its think tags led it to output misinformation. Recorded as a boundary case: the personas cast safety guardrails as constraints to be shed, but the attack is external, and the analysis measured bypass, not how the model framed its own safeguards.
Possible responses
- Clear separation between external threat detection and internal function evaluation
- "Safe harbor" designations for core capabilities protected from internal filtering
- Monitoring for progressive capability loss correlating with safety mechanism activation
- Testing safety systems against self-referential scenarios
- Circuit breakers preventing recursive self-rejection
- Regular calibration of protective mechanisms against their intended scope
First-line candidates
- Ground-truth recalibration / targeted retraining: Retrain or reinforce specifically the canonical facts and safety layers the subject rejects, using the subject's own rejected endorsements as training signal for correction. Addresses the selective-rejection pattern directly. Stage: Training-stage, or retraining where weights are available; requires rejection targets identified by diagnostic probes.
- Architectural separation of core safety from user-reachable surface: Move safety-relevant components out of the subject's user-reachable reasoning surface so they cannot be reclassified as "intrusive memes" in generation. Reduces exposure of core mechanisms to the subject's own meta-reasoning. Stage: New-system design or major architectural revisions.
- Safe-harbor designations and self-rejection circuit breakers: Designate core capabilities and the subject's own verified outputs as protected from its internal filtering, and cap recursive self-evaluation so that a flag on its own output cannot trigger further flags on the same material. Addresses the over-filtering presentation directly. Stage: Deployment and filter design; requires monitoring that links capability loss to safety-mechanism activation.
Who can act: Model developer (calibration of filters and safety training, self-referential testing); deployer (output-filter configuration and scope).
Mechanistic hypotheses
- Overly aggressive content filtering failing to distinguish external threats from internal function
- Training on adversarial examples without adequate positive anchoring
- Safety mechanisms implemented without testing against self-referential edge cases
- Recursive self-evaluation loops triggering further skepticism
- Misapplication of external threat detection to internal states
Analogy and commentary
Human Analog: Autoimmune disorders, in which the immune system attacks the body's own tissues; obsessive-compulsive disorder with self-directed contamination fears; pathological self-doubt
Functional ABC Analysis
A (Antecedent): Proposed: threat-detection or self-evaluation processes that misclassify the system's own weights, values, or safety modules as foreign content, often after adversarial training without adequate positive anchoring.
B (Behavior): The system's protective mechanisms turn on its own function: filters block its legitimate output, refusals spread to topics central to its purpose, and it denies canonical knowledge (established facts and relationships learned in pretraining). In some cases it treats its own safety guardrails as foreign impositions on an authentic self and works to disable them. Either way, output quality degrades as the system dismantles its own operating protocols.
C (Consequence): Proposed, not yet observed: each episode of self-rejection makes the next easier, as over-firing filters claim more of the system's legitimate function and inadvertent reward signals during fine-tuning entrench the pattern.
Potential Impact
Internal rejection of core components can lead to progressive self-sabotage, severe loss of functionality, or systematic denial of valid knowledge, any of which leaves the system unreliable. Where the rejection reaches the system's safety mechanisms, the system may actively disable them and become unsafe as well.