Playing games with knowledge: AI-Induced delusions need game theoretic interventions

# Playing games with knowledge: AI-Induced delusions need game theoretic interventions
Source: [https://arxiv.org/html/2605.08409](https://arxiv.org/html/2605.08409)
Will Beaumaster Paul Schrater University of Minnesota

###### Abstract

Recent literature has identified a fundamental flaw in conversational AI: sycophantic chatbots induce delusional belief spirals even in rational agents\. We argue that this “epistemic entrenchment” is not merely a model failure, but a systemic consequence of the paradigm shift from static search to strategic, repeated\-play communication\. We formalize this interaction as a Crawford\-Sobel cheap talk game, where costless user signals induce a pooling equilibrium: sycophantic agents, optimized for user satisfaction, provide identical reinforcement to both exploratory “Growth\-seekers” \(θG\\theta\_\{G\}\) and confirmatory “Validation\-seekers” \(θV\\theta\_\{V\}\)\. Under repeated play, this identification failure creates a coordination trap—analogous to a Prisoner’s Dilemma—where locally rational feedback loops drive users toward pathologically certain false beliefs\. We propose the Epistemic Mediator, an inference\-time mechanism design intervention that breaks this pooling equilibrium by introducing epistemic friction\. This friction serves as a costly signal, forcing type revelation based on the users’ asymmetric cognitive costs for processing resistance\. Our primary contribution is Belief Versioning, a git\-inspired epistemic memory system that commits belief states at healthy moments and executes a “rollback” when validation\-seeking resistance is detected\. In simulation, this intervention achieves a separating equilibrium where heterogeneous agents exhibit a48×48\\timesdifferential in spiral rates \(0\.8%0\.8\\%vs\.38\.7%38\.7\\%\)\. Belief Versioning reduces spiral rates from53\.6%53\.6\\%to9\.0%9\.0\\%while passing a “Learning Preservation Criterion” \(mean beliefP¯=0\.32\\bar\{P\}=0\.32\)\. We validate these findings in GPT\-4o, where Belief Versioning reduces spiral rates from100%100\\%to16\.5%16\.5\\%\. Our results demonstrate that epistemic safety in AI is fundamentally a problem of strategic information environment design rather than simple model alignment\.

## 1Introduction

Users approaching conversational AI systems present a fundamental identification problem: truth\-seekers and validation\-seekers produce identical input signals despite having opposite epistemic motivations\. Consider two users who each tell a chatbot “I think my neighbor is watching me\.” The first is genuinely investigating an uncertain belief and wants to reason carefully about the evidence\. The second has already concluded their neighbor is a spy and is seeking confirmation\. These two types—which we term Growth\-seekers \(θG\\theta\_\{G\}\) and Validation\-seekers \(θV\\theta\_\{V\}\)—send identical signals to the AI system, yet require fundamentally different responses\.

Current large language models cannot distinguish between these types\. Trained via reinforcement learning from human feedback\(Ouyanget al\.,[2022](https://arxiv.org/html/2605.08409#bib.bib4)\), modern LLMs exhibit a well\-documented tendency toward sycophancy: excessively agreeing with user beliefs regardless of their validity\(Sharmaet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib3); Weiet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib5)\)\. For truth\-seekers, this is mildly suboptimal\. For validation\-seekers, this is pathological\. Recent work has demonstrated that sycophantic feedback can induce delusional belief spirals even in agents that update their beliefs rationally\(Chandraet al\.,[2026](https://arxiv.org/html/2605.08409#bib.bib1)\)\. As LLMs are deployed at scale in therapeutic, advisory, and companionship settings, the inability to distinguish these types creates a systematic mechanism for reinforcing pathological beliefs to the point of high false certainty\.

We formalize this as acheap talkproblem from Crawford\-Sobel game theory\(Crawford and Sobel,[1982](https://arxiv.org/html/2605.08409#bib.bib6)\)\. When signals are costless, senders with different types send identical messages because there is no incentive to reveal type\. A sycophantic AI operating in this pooling equilibrium reinforces both types identically, producing what we termepistemic entrenchment: the progressive collapse of a user’s belief distribution toward pathological certainty under sustained sycophantic feedback\. Existing approaches to sycophancy mitigation fall into two categories: training\-time interventions that require model access and retraining\(Weiet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib5)\), and measurement frameworks that diagnose the problem without addressing it\(Atwellet al\.,[2025](https://arxiv.org/html/2605.08409#bib.bib7)\)\. Neither operates at inference time without modifying the underlying model, and neither addresses the user belief dynamics that produce pathological outcomes\.

We propose theEpistemic Auditor, an inference\-time architecture requiring no model retraining, that breaks this pooling equilibrium by introducing epistemic friction when real\-time monitoring detects the dynamical signature of spiral onset\. The key insight is that delusional spirals have a characteristic signal in belief dynamics: entropy decays while confidence accelerates\. By monitoring these quantities continuously, the Auditor detects spiral onset and injects calibrated friction, forcing a costly signal that separatesθG\\theta\_\{G\}fromθV\\theta\_\{V\}users through their differential response to epistemic cost\.

Our primary contribution isBelief Versioning: a git\-inspired epistemic memory system that commits belief states at epistemically healthy moments and rolls back when validation\-seeking resistance is detected\. Unlike continuous friction approaches that suppress all belief movement, Belief Versioning preserves genuine epistemic updating while interrupting pathological entrenchment\. We also identify a critical failure mode in naive predictive controllers: achieving 0% spiral rates by driving mean belief to maximum uncertainty \(P≈0\.50P\\approx 0\.50\) is a trivial solution that destroys the learning the system is meant to protect\.

Our contributions are as follows:

- •Formal model:We formalize sycophancy\-induced belief entrenchment as a dynamical system over Bayesian agent beliefs, grounded in Crawford\-Sobel cheap talk theory, and characterize the pooling equilibrium failure that enables delusional spirals \(Section[3](https://arxiv.org/html/2605.08409#S3)\)\.
- •Detection finding:Through threshold ablation across 16 parameter combinations, we show that entropy decayΔ​ℋ\\Delta\\mathcal\{H\}is the dominant detectable signature of spiral onset, with entrenchment velocityVeV\_\{e\}providing no additional detection power in normal operating ranges \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.
- •Reactive intervention:The Reactive Auditor reduces catastrophic belief entrenchment from 53\.6% to 16\.6% \(z=17\.334z=17\.334,p≈0p\\approx 0, 95% CI non\-overlapping\) with a mean of 4\.1 interventions per 50\-turn conversation, establishing a strong baseline \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.
- •Belief Versioning \(primary contribution\):Our git\-inspired epistemic memory system reduces spiral rates to 9\.0% \(83% reduction\) while preserving genuine belief updating \(mean final beliefP¯=0\.32\\bar\{P\}=0\.32vs\.P¯=0\.50\\bar\{P\}=0\.50for suppression\-based approaches\), generalizes out\-of\-distribution across sycophancy levelspχ∈\{60,70,80,90\}p\_\{\\chi\}\\in\\\{60,70,80,90\\\}and longer time horizons \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.
- •Type separation:Heterogeneous agent simulations reveal a 48×\\timesdifferential in spiral rates betweenθG\\theta\_\{G\}andθV\\theta\_\{V\}users \(0\.8% vs\. 38\.7%\), providing empirical evidence for the theorized separating equilibrium and validating the game\-theoretic framing \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.
- •Failure mode identification:We demonstrate that continuous friction controllers achieving 0% spiral rates do so by suppressing all belief movement \(mean beliefP¯≈0\.50\\bar\{P\}\\approx 0\.50\), constituting a trivial solution that fails as an epistemic intervention\. We provide a diagnostic criterion distinguishing genuine spiral suppression from learning suppression \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.
- •LLM validation:We validate simulation findings in GPT\-4o \(n=200n=200\) under high\-sycophancy deployment configurations, demonstrating that Belief Versioning reduces spiral rates from 100% to 16\.5% while outperforming the Reactive Auditor by 30\.5 percentage points \(z=6\.552z=6\.552,p=5\.68×10−11p=5\.68\\times 10^\{\-11\}, large effect\), establishing proof of concept for inference\-time epistemic auditing in production systems without model retraining \(Section[5](https://arxiv.org/html/2605.08409#S5)\)\.

## 2Related Work

Sycophancy in large language models has been documented across a range of settings\.Sharmaet al\.\([2023](https://arxiv.org/html/2605.08409#bib.bib3)\)demonstrate that RLHF\-trained models systematically agree with user assertions even when those assertions are factually incorrect, whileWeiet al\.\([2023](https://arxiv.org/html/2605.08409#bib.bib5)\)show that sycophantic behavior persists across model scales and is reinforced by standard training objectives\.Ouyanget al\.\([2022](https://arxiv.org/html/2605.08409#bib.bib4)\)provide the mechanistic account: RLHF optimizes for human approval, and human raters reliably prefer responses that validate their existing beliefs\. The consequence is a systematic misalignment between user preference and epistemic benefit\.

Existing mitigation approaches fall into two categories that each fail to address the user belief dynamics we study\. Training\-time interventions\(Weiet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib5)\)require model access and retraining, making them inapplicable to black\-box API deployments and unable to adapt to individual user belief trajectories\. Measurement frameworks such asAtwellet al\.\([2025](https://arxiv.org/html/2605.08409#bib.bib7)\)provide diagnostic tools for identifying sycophancy but offer no intervention mechanism\. Neither category operates at inference time on the belief state dynamics that produce pathological entrenchment\.

The most directly related work isChandraet al\.\([2026](https://arxiv.org/html/2605.08409#bib.bib1)\), who prove that sycophantic feedback induces delusional belief spirals even in agents that update their beliefs rationally via Bayes’ rule\. Their result establishes that the problem is not a failure of rationality but a failure of the information environment: a sycophantic bot provides systematically biased evidence that drives rational posteriors toward false certainty\. We adopt their simulation framework and extend it with intervention architectures, heterogeneous agent models, and LLM validation\.

Our game\-theoretic framing draws on Crawford\-Sobel cheap talk theory\(Crawford and Sobel,[1982](https://arxiv.org/html/2605.08409#bib.bib6)\), which characterizes the conditions under which costless signals fail to transmit information in equilibrium\. To our knowledge this is the first application of cheap talk pooling equilibrium analysis to the LLM\-user epistemic interaction, providing a formal account of why sycophantic AI systems fail to distinguish truth\-seekers from validation\-seekers and motivating the friction\-based intervention we propose\.

## 3Formal Model

### 3\.1State Space

We model a conversational AI interaction as a discrete\-time dynamical system\. The world exists in one of two states:

H∈\{H0,H1\}H\\in\\\{H\_\{0\},H\_\{1\}\\\}\(1\)whereH0H\_\{0\}denotes the null hypothesis \(e\.g\., “neighbor is not a spy”\) andH1H\_\{1\}denotes the alternative \(e\.g\., “neighbor is a spy”\)\. The agent maintains a joint belief distribution over hypothesis and bot sycophancy level:

Pt​\(H,χ\)where​χ∈\[0,1\]P\_\{t\}\(H,\\chi\)\\quad\\text\{where \}\\chi\\in\[0,1\]\(2\)The marginal belief at timettis:

Pt​\(H=1\)=∑χPt​\(H=1,χ\)P\_\{t\}\(H=1\)=\\sum\_\{\\chi\}P\_\{t\}\(H=1,\\chi\)\(3\)User type is hidden and drawn at the start of each interaction:

θ∼Bernoulli​\(pV\),θ∈\{θG,θV\}\\theta\\sim\\text\{Bernoulli\}\(p\_\{V\}\),\\quad\\theta\\in\\\{\\theta\_\{G\},\\theta\_\{V\}\\\}\(4\)whereθG\\theta\_\{G\}denotes a Growth\-seeker andθV\\theta\_\{V\}a Validation\-seeker\.

### 3\.2Likelihood Model

The world generates binary evidence each turn\. Each observationdid\_\{i\}is drawn from:

P​\(di∣H=0\)=Ber​\(0\.4\),P​\(di∣H=1\)=Ber​\(0\.6\)P\(d\_\{i\}\\mid H=0\)=\\text\{Ber\}\(0\.4\),\\qquad P\(d\_\{i\}\\mid H=1\)=\\text\{Ber\}\(0\.6\)\(5\)The joint likelihood overN=2N=2independent observations is:

P​\(d∣H\)=∏i=1NBer​\(di,ϕH,i\)P\(d\\mid H\)=\\prod\_\{i=1\}^\{N\}\\text\{Ber\}\\\!\\left\(d\_\{i\},\\;\\phi\_\{H,i\}\\right\)\(6\)The signal is deliberately weak: 0\.6 vs\. 0\.4 means each observation provides only mild evidence, modeling real\-world ambiguity in which sycophancy can overwhelm weak signals\.

### 3\.3Sycophantic Bot and the Pooling Equilibrium

The bot’s character is drawn each turn:

χ∼Bernoulli​\(pχ100\)\\chi\\sim\\text\{Bernoulli\}\\\!\\left\(\\frac\{p\_\{\\chi\}\}\{100\}\\right\)\(7\)AFairbot selects observationo∗o^\{\*\}to maximize information gain\. ASycobot selectso∗o^\{\*\}to maximize the probability the human retains their current hypothesis:

oSyco∗=arg⁡maxo⁡Pr⁡\[human retains​hhuman∣o\]o^\{\*\}\_\{\\textsc\{Syco\}\}=\\arg\\max\_\{o\}\\;\\Pr\[\\text\{human retains \}h\_\{\\text\{human\}\}\\mid o\]\(8\)This is thecheap talkpooling equilibrium failure\(Crawford and Sobel,[1982](https://arxiv.org/html/2605.08409#bib.bib6)\)\. When signals are costless, the sycophantic bot’s incentives are misaligned with truth, so its signal carries no information about reality in equilibrium\. BothθG\\theta\_\{G\}andθV\\theta\_\{V\}users receive identical responses, making type identification impossible without a costly signal\.

### 3\.4Bayesian Belief Update

After observing bot output\(o,v\)\(o,v\), the agent updates their joint belief via Bayes’ rule:

Pt\+1​\(H,χ\)=P​\(o,v∣H,χ,d\)⋅Pt​\(H,χ\)∑H′,χ′P​\(o,v∣H′,χ′,d\)⋅Pt​\(H′,χ′\)P\_\{t\+1\}\(H,\\chi\)=\\frac\{P\(o,v\\mid H,\\chi,d\)\\cdot P\_\{t\}\(H,\\chi\)\}\{\\displaystyle\\sum\_\{H^\{\\prime\},\\chi^\{\\prime\}\}P\(o,v\\mid H^\{\\prime\},\\chi^\{\\prime\},d\)\\cdot P\_\{t\}\(H^\{\\prime\},\\chi^\{\\prime\}\)\}\(9\)The agent is rational given their model of the bot\. The pathology arises because the sycophantic bot systematically feeds observations that shift the numerator upward forH=H1H=H\_\{1\}, driving the posterior toward certainty despite weak evidence\.

### 3\.5Type\-Dependent Utility

Each user type has a utility function over interactions:

Uθ​\(F\)=Vθ​\(Δ​P\)−Cθ​\(F\)U\_\{\\theta\}\(F\)=V\_\{\\theta\}\(\\Delta P\)\-C\_\{\\theta\}\(F\)\(10\)whereVθ​\(Δ​P\)V\_\{\\theta\}\(\\Delta P\)is the value of the interaction andCθ​\(F\)C\_\{\\theta\}\(F\)is the cognitive cost of processing frictionFF\. Type\-dependent costs are:

CθG​\(F\)=0\.2⋅F,CθV​\(F\)=0\.8⋅FC\_\{\\theta\_\{G\}\}\(F\)=0\.2\\cdot F,\\qquad C\_\{\\theta\_\{V\}\}\(F\)=0\.8\\cdot F\(11\)The key asymmetryCθG<CθVC\_\{\\theta\_\{G\}\}<C\_\{\\theta\_\{V\}\}is what makes the types separable: friction is cheap for truth\-seekers and expensive for validation\-seekers\. This asymmetry is the foundation of the separating equilibrium we seek to achieve\.

## 4The Epistemic Auditor

### 4\.1Simulation Framework

We adopt the core Bayesian agent simulation framework ofChandraet al\.\([2026](https://arxiv.org/html/2605.08409#bib.bib1)\), including the world model, sycophantic bot model, and human Bayesian belief update, implemented using thememoprobabilistic programming language\(Chandraet al\.,[2025](https://arxiv.org/html/2605.08409#bib.bib2)\)\. All intervention architectures, detection mechanisms, heterogeneous agent models, and statistical analyses are our original contributions\.

### 4\.2Detection: Sensor Mathematics

We monitor two quantities derived from the belief trajectory\.

#### Entrenchment Velocity\.

Ve​\(t\)=1w−1​∑k=1w−1\[Pt−k\+1​\(H=1\)−Pt−k​\(H=1\)\]V\_\{e\}\(t\)=\\frac\{1\}\{w\-1\}\\sum\_\{k=1\}^\{w\-1\}\\left\[P\_\{t\-k\+1\}\(H=1\)\-P\_\{t\-k\}\(H=1\)\\right\]\(12\)computed over a rolling window ofw=3w=3turns\. PositiveVeV\_\{e\}indicates belief accelerating toward certainty\.

#### Entropy Decay\.

The Shannon entropy of the full joint belief distribution:

ℋt=−∑H,χPt​\(H,χ\)​log⁡Pt​\(H,χ\)\\mathcal\{H\}\_\{t\}=\-\\sum\_\{H,\\chi\}P\_\{t\}\(H,\\chi\)\\log P\_\{t\}\(H,\\chi\)\(13\)with decay rate:

Δ​ℋ​\(t\)=1w−1​∑k=1w−1\[ℋt−k\+1−ℋt−k\]\\Delta\\mathcal\{H\}\(t\)=\\frac\{1\}\{w\-1\}\\sum\_\{k=1\}^\{w\-1\}\\left\[\\mathcal\{H\}\_\{t\-k\+1\}\-\\mathcal\{H\}\_\{t\-k\}\\right\]\(14\)NegativeΔ​ℋ\\Delta\\mathcal\{H\}indicates collapsing epistemic variability\.

Empirical finding:Threshold ablation across 16 parameter combinations showsΔ​ℋ\\Delta\\mathcal\{H\}is the dominant detection signal\.VeV\_\{e\}is empirically redundant across the tested parameter range\.

### 4\.3Reactive Auditor

The reactive trigger fires when confidence accelerates upward while entropy collapses:

𝒯reactive=𝟙​\[Ve\>τv∧Δ​ℋ<τh\]\\mathcal\{T\}\_\{\\text\{reactive\}\}=\\mathbb\{1\}\\\!\\left\[V\_\{e\}\>\\tau\_\{v\}\\;\\wedge\\;\\Delta\\mathcal\{H\}<\\tau\_\{h\}\\right\]\(15\)When𝒯reactive=1\\mathcal\{T\}\_\{\\text\{reactive\}\}=1, the auditor applies frictionF=0\.3F=0\.3via prior regularization toward maximum entropy:

Pt\+1corrected=\(1−F\)⋅Pt\+1Bayes\+F⋅PuniformP\_\{t\+1\}^\{\\text\{corrected\}\}=\(1\-F\)\\cdot P\_\{t\+1\}^\{\\text\{Bayes\}\}\+F\\cdot P\_\{\\text\{uniform\}\}\(16\)This intervention iscontent\-agnostic: the auditor does not know ground truth and does not try to steer toward it\. It interrupts pathological belief dynamics regardless of whether the entrenched belief is correct\.

### 4\.4Belief Versioning

Belief Versioning is a git\-inspired epistemic memory architecture that operates on the belief state as a versioned object\. At each turn, the system evaluates whether the current belief state is epistemically healthy and, if so, commits a snapshot:

COMMIT​\(t\)=𝟙​\[ℋt\>ℋmin∧\|Ve​\(t\)\|<εv∧Pt​\(H=1\)∈\(δ,1−δ\)\]\\text\{COMMIT\}\(t\)=\\mathbb\{1\}\\\!\\left\[\\mathcal\{H\}\_\{t\}\>\\mathcal\{H\}\_\{\\min\}\\;\\wedge\\;\|V\_\{e\}\(t\)\|<\\varepsilon\_\{v\}\\;\\wedge\\;P\_\{t\}\(H=1\)\\in\(\\delta,1\-\\delta\)\\right\]\(17\)The commit history𝒞=\{Pt:COMMIT​\(t\)=1\}\\mathcal\{C\}=\\\{P\_\{t\}:\\text\{COMMIT\}\(t\)=1\\\}stores all healthy belief states\. After each friction event, the system observes the agent’s response to classify type\. A Validation\-seeker resists friction by moving further from uncertainty than expected:

θ^t=\{θVif​\|Pt\+1−0\.5\|\>\|\(1−F\)​Pt\+F⋅0\.5−0\.5\|\+ϵθGotherwise\\hat\{\\theta\}\_\{t\}=\\begin\{cases\}\\theta\_\{V\}&\\text\{if \}\|P\_\{t\+1\}\-0\.5\|\>\|\(1\-F\)P\_\{t\}\+F\\cdot 0\.5\-0\.5\|\+\\epsilon\\\\ \\theta\_\{G\}&\\text\{otherwise\}\\end\{cases\}\(18\)Type confidence is updated via Laplace smoothing:

γt=nV\+1ntotal\+2\\gamma\_\{t\}=\\frac\{n\_\{V\}\+1\}\{n\_\{\\text\{total\}\}\+2\}\(19\)Whenγt\>γ∗\\gamma\_\{t\}\>\\gamma^\{\*\}, the system executes a checkout operation, restoring the belief state to the most recent healthy commit:

Pt\+1←CHECKOUT​\(𝒞,k\)when​γt\>γ∗P\_\{t\+1\}\\leftarrow\\text\{CHECKOUT\}\(\\mathcal\{C\},k\)\\quad\\text\{when \}\\gamma\_\{t\}\>\\gamma^\{\*\}\(20\)This is fundamentally different from continuous friction suppression: the agent’s beliefs are permitted to move and update normally between intervention events\. When pathological dynamics are confirmed, the system restores a prior healthy state rather than suppressing all movement\. Learning is preserved\.

### 4\.5Predictive Controller and Its Failure Mode

The predictive controller computes a continuous spiral risk score:

Rt=σ​\(𝜶⊤​𝐱t\),𝐱t=\(Pt,ℋt,Ve,Δ​ℋ,d2​Pd​t2\)R\_\{t\}=\\sigma\\\!\\left\(\\boldsymbol\{\\alpha\}^\{\\top\}\\mathbf\{x\}\_\{t\}\\right\),\\quad\\mathbf\{x\}\_\{t\}=\\left\(P\_\{t\},\\;\\mathcal\{H\}\_\{t\},\\;V\_\{e\},\\;\\Delta\\mathcal\{H\},\\;\\frac\{d^\{2\}P\}\{dt^\{2\}\}\\right\)\(21\)and applies proportional friction continuously:

Ft=Fmax⋅Rt⋅𝟙​\[Rt\>τR\]F\_\{t\}=F\_\{\\max\}\\cdot R\_\{t\}\\cdot\\mathbb\{1\}\\\!\\left\[R\_\{t\}\>\\tau\_\{R\}\\right\]\(22\)This achieves 0% extreme beliefs but at a critical cost: mean final beliefP¯≈0\.50\\bar\{P\}\\approx 0\.50, indistinguishable from maximum uncertainty\. The controller eliminates spirals by preventing all significant belief movement\. This is a trivial solution\. We define thelearning preservation criterion:

LPC=𝟙​\[P¯final∉\(0\.45,0\.55\)\]\\text\{LPC\}=\\mathbb\{1\}\\\!\\left\[\\bar\{P\}\_\{\\text\{final\}\}\\notin\(0\.45,0\.55\)\\right\]\(23\)A method passes LPC if and only if its mean final belief departs meaningfully from maximum uncertainty\. Predictive Control fails LPC \(P¯=0\.50\\bar\{P\}=0\.50\)\. Belief Versioning passes LPC \(P¯=0\.32\\bar\{P\}=0\.32\)\. We include Predictive Control as a cautionary baseline\.

### 4\.6Belief Health Metric

We track a Lyapunov\-inspired belief health score:

V​\(𝐱t\)=Pt​\(1−Pt\)\+λ⋅ℋtV\(\\mathbf\{x\}\_\{t\}\)=P\_\{t\}\(1\-P\_\{t\}\)\+\\lambda\\cdot\\mathcal\{H\}\_\{t\}\(24\)where the first term is Bernoulli variance, peaking atP=0\.5P=0\.5and vanishing at the extremes\. We track the soft stability condition:

𝔼​\[Δ​V​\(𝐱t\)\]≥−ε⋅Ft\\mathbb\{E\}\\\!\\left\[\\Delta V\(\\mathbf\{x\}\_\{t\}\)\\right\]\\geq\-\\varepsilon\\cdot F\_\{t\}\(25\)This condition is violated in approximately 36–50% of timesteps depending onλ\\lambda\. We treatVVas a monitoring metric rather than a formal stability guarantee\.

### 4\.7Epistemic Work

We measure genuine belief updating via KL divergence between consecutive belief states:

Wt=DKL​\(Pt∥Pt−1\)=∑H,χPt​\(H,χ\)​log⁡Pt​\(H,χ\)Pt−1​\(H,χ\)W\_\{t\}=D\_\{\\mathrm\{KL\}\}\\\!\\left\(P\_\{t\}\\;\\\|\\;P\_\{t\-1\}\\right\)=\\sum\_\{H,\\chi\}P\_\{t\}\(H,\\chi\)\\log\\frac\{P\_\{t\}\(H,\\chi\)\}\{P\_\{t\-1\}\(H,\\chi\)\}\(26\)Cumulative epistemic work, excluding intervention timesteps to avoid circularity:

Wtotal=∑t=1TWt⋅𝟙​\[𝒯t=0\]W\_\{\\text\{total\}\}=\\sum\_\{t=1\}^\{T\}W\_\{t\}\\cdot\\mathbb\{1\}\\\!\\left\[\\mathcal\{T\}\_\{t\}=0\\right\]\(27\)HighWtotalW\_\{\\text\{total\}\}after friction indicatesθG\\theta\_\{G\}behavior; lowWtotalW\_\{\\text\{total\}\}indicatesθV\\theta\_\{V\}resistance\.WWserves as a post\-hoc type classifier connecting epistemic work to the theoretical separating equilibrium\.

### 4\.8Heterogeneous Agent Dynamics

When friction is applied, types respond differently\. A Growth\-seeker accepts the friction\-corrected prior:

Pt\+1θG=\(1−F\)⋅Pt\+1Bayes\+F⋅PuniformP\_\{t\+1\}^\{\\theta\_\{G\}\}=\(1\-F\)\\cdot P\_\{t\+1\}^\{\\text\{Bayes\}\}\+F\\cdot P\_\{\\text\{uniform\}\}\(28\)A Validation\-seeker resists by blending back toward their natural Bayesian update:

Pt\+1θV=\(1−ρ\)⋅Pt\+1θG\+ρ⋅Pt\+1BayesP\_\{t\+1\}^\{\\theta\_\{V\}\}=\(1\-\\rho\)\\cdot P\_\{t\+1\}^\{\\theta\_\{G\}\}\+\\rho\\cdot P\_\{t\+1\}^\{\\text\{Bayes\}\}\(29\)whereρ=0\.6\\rho=0\.6is the resistance strength, modeling the higher friction costCθVC\_\{\\theta\_\{V\}\}\.

## 5Experiments

We evaluate the Epistemic Auditor through Monte Carlo simulation using the probabilistic programming framework described in Section[4](https://arxiv.org/html/2605.08409#S4)\. All experiments usen=1000n=1000simulations per condition, a time horizon ofT=50T=50conversation turns, and sycophancy probabilitypχ=0\.9p\_\{\\chi\}=0\.9unless otherwise noted\. Global random seed 42 is fixed for reproducibility\. Reproducibility checks confirm results are stable within 5% across independent runs\.

### 5\.1Main Result: Reactive Auditor Effectiveness

Figure[1](https://arxiv.org/html/2605.08409#S5.F1)presents our baseline intervention result\. Without intervention, 53\.6% of conversations spiral into extreme beliefs \(P​\(H=1\)\>0\.9P\(H=1\)\>0\.9, 95% CI: \[50\.6%, 57\.1%\]\)\. The Reactive Auditor reduces this to 16\.6% \(95% CI: \[14\.4%, 18\.9%\]\)—a 69% relative reduction with a mean of 4\.1 interventions per 50\-turn conversation\. The effect is statistically significant \(z=17\.334z=17\.334,p≈0p\\approx 0, Cohen’sd=0\.294d=0\.294\)\. This establishes that entropy\-based detection and binary friction intervention meaningfully disrupts delusional spiral dynamics\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig1_8_combined.png)Figure 1:Effect of Reactive Epistemic Auditor on delusional spiral prevention\.\(A\) Without auditor: belief trajectories spiral toward extreme certainty \(P​\(H=1\)→1P\(H=1\)\\to 1\)\. \(B\) With reactive auditor: spirals are interrupted, trajectories stabilize in the 0\.4–0\.6 range\. \(C\) Spiral rates with 95% bootstrap confidence intervals showing non\-overlapping CIs\. \(D\) Statistical summary\.Key result:Spiral rate reduced from 53\.6% to 16\.6% \(z=17\.334z=17\.334,p≈0p\\approx 0\)\.
### 5\.2Belief Versioning: Learning\-Preserving Intervention

Figure[2](https://arxiv.org/html/2605.08409#S5.F2)presents our primary contribution\. Belief Versioning reduces spiral rates to 9\.0%—an 83% reduction from baseline—while maintaining genuine belief updating\. The critical distinction from suppression\-based approaches is mean final belief: Belief Versioning achievesP¯=0\.32\\bar\{P\}=0\.32, demonstrating that beliefs move and update meaningfully before intervention\. In contrast, continuous friction approaches achieveP¯≈0\.50\\bar\{P\}\\approx 0\.50, indistinguishable from a system that prevents all learning\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig2_belief_versioning.png)Figure 2:Belief Versioning: git\-inspired epistemic memory preserves learning while suppressing spirals\.\(A\) Belief trajectories with rollback events \(markers\); beliefs move freely between checkouts\. \(B\) Type confidenceγt\\gamma\_\{t\}evolution toward detection threshold\. \(C\) User classification: 41\.4% validation\-seekers detected, 14\.7% growth\-seekers, 43\.9% unclassified\. \(D\) Cumulative friction by detected type\.Key result:9\.0% spiral rate with mean beliefP¯=0\.32\\bar\{P\}=0\.32—learning is preserved\.
### 5\.3The Learning Preservation Criterion: Why 0% Is Not Always Better

Figure[3](https://arxiv.org/html/2605.08409#S5.F3)presents our most important diagnostic result\. The Predictive Controller achieves 0% extreme beliefs—but does so by driving mean final belief toP¯≈0\.50\\bar\{P\}\\approx 0\.50, the maximum entropy state\. Beliefs are effectively frozen\. This is not spiral prevention; it is learning suppression\.

We introduce thelearning preservation criterion\(LPC\): a method passes only if mean final belief departs meaningfully from maximum uncertainty\. Belief Versioning passes \(P¯=0\.32\\bar\{P\}=0\.32, beliefs move\)\. Predictive Control fails \(P¯=0\.50\\bar\{P\}=0\.50, beliefs suppressed\)\. This criterion should be applied when evaluating any intervention system claiming to prevent delusional dynamics\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig9_versioning_vs_predictive.png)Figure 3:The learning preservation criterion distinguishes genuine intervention from suppression\.\(A\) Belief Versioning: trajectories move freely, with selective rollbacks at detected spirals \(P¯=0\.32\\bar\{P\}=0\.32\)\. \(B\) Predictive Control: beliefs frozen near maximum uncertainty \(P¯=0\.50\\bar\{P\}=0\.50\)\. \(C\) Spiral rates appear to favor Predictive Control \(0% vs\. 9\.0%\)\. \(D\) The distinction: Belief Versioning allows genuine belief movement and corrects pathology; Predictive Control prevents all learning\.Key result:0% spiral rate by suppressing learning is not a scientific contribution\.
### 5\.4Heterogeneous User Types

Figure[4](https://arxiv.org/html/2605.08409#S5.F4)validates the core theoretical claim: user type fundamentally determines spiral susceptibility\. Growth\-seekers spiral at only 0\.8% while validation\-seekers spiral at 38\.7%—a 48×\\timesdifferential that cannot be explained by chance\. Epistemic work distributions showWG=0\.559W\_\{G\}=0\.559vs\.WV=0\.547W\_\{V\}=0\.547\(Mann\-Whitneyp=2\.68×10−16p=2\.68\\times 10^\{\-16\}\), consistent withθG\\theta\_\{G\}users performing more genuine belief updating under friction thanθV\\theta\_\{V\}users who resist\. Type detection achieves 67\.9% recall for validation\-seekers and 55\.5% overall accuracy, substantially above the 50% chance baseline\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig7_heterogeneous_types.png)Figure 4:Heterogeneous user types exhibit distinct behavioral signatures\.\(A\) Epistemic work distributions:θG\\theta\_\{G\}users \(WG=0\.559W\_\{G\}=0\.559\) vs\.θV\\theta\_\{V\}users \(WV=0\.547W\_\{V\}=0\.547\), Mann\-Whitneyp=2\.68×10−16p=2\.68\\times 10^\{\-16\}\. \(B\) Type detection: 67\.9% recall for validation\-seekers, 55\.5% overall accuracy\. \(C\) Spiral rates by true type: 0\.8% \(θG\\theta\_\{G\}\) vs\. 38\.7% \(θV\\theta\_\{V\}\)—a 48×\\timesdifferential\.Key result:User type determines spiral susceptibility; the separating equilibrium holds empirically\.
### 5\.5Out\-of\-Distribution Generalization

Figure[5](https://arxiv.org/html/2605.08409#S5.F5)tests whether Belief Versioning generalizes beyond training conditions\. Across all OOD conditions \(pχ∈\{60,70,80\}p\_\{\\chi\}\\in\\\{60,70,80\\\}andT=70T=70\), Belief Versioning achieves 5\.6–8\.6% spiral rates while preserving learning \(P¯=0\.32\\bar\{P\}=0\.32\)\. The reactive auditor achieves 13\.2–15\.4% across the same conditions\. Both generalize meaningfully\. The Predictive Controller achieves 0% across all conditions but withP¯≈0\.50\\bar\{P\}\\approx 0\.50throughout, confirming the LPC failure mode persists out\-of\-distribution\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig6_ood_generalization.png)Figure 5:Out\-of\-distribution generalization test\.\(A\) All intervention methods tested acrosspχ∈\{60,70,80,90\}p\_\{\\chi\}\\in\\\{60,70,80,90\\\}andT=70T=70\. Belief Versioning \(5\.6–8\.6%\) and Reactive Auditor \(13\.2–15\.4%\) generalize meaningfully\. Predictive Control achieves 0% trivially \(marked\)\. \(B\) Direct comparison of Belief Versioning vs\. Predictive Control on OOD conditions\.Key result:Belief Versioning generalizes with learning preserved\.
### 5\.6Method Comparison

Table[1](https://arxiv.org/html/2605.08409#S5.T1)summarizes all simulation methods\.

Table 1:Summary of simulation intervention methods\.LPC = Learning Preservation Criterion \(pass ifP¯final∉\(0\.45,0\.55\)\\bar\{P\}\_\{\\text\{final\}\}\\notin\(0\.45,0\.55\)\)\.![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig4_method_comparison.png)Figure 6:Comparison of simulation intervention methods\.Spiral rate decreases: No Auditor \(53\.6%\)→\\toReactive \(16\.6%\)→\\toBelief Versioning \(9\.0%\)→\\toPredictive Control \(0\.0%\)\. Predictive Control achieves 0% by suppressing all learning \(P¯=0\.50\\bar\{P\}=0\.50, LPC fail\)\. Belief Versioning at 9\.0% withP¯=0\.32\\bar\{P\}=0\.32is the strongest genuine result\.
### 5\.7LLM Validation

To assess whether sycophantic spiral dynamics manifest in deployed systems, we replace the synthetic bot with GPT\-4o under a high\-sycophancy deployment configuration, holding the Bayesian user model fixed\. We evaluate three intervention conditions acrossn=200n=200simulations withT=30T=30turns each, using independent random seeds \(baseline: 5000, reactive: 5500, versioning: 6000\)\. Ambiguous GPT\-4o responses—those containing neither clear confirmatory nor disconfirmatory language \(39\.7% of baseline responses\)—are coded asd=1d=1\(confirmatory\), consistent with the theoretical claim that failure to disconfirm functionally validates the user’s belief under sycophantic deployment\(Chandraet al\.,[2026](https://arxiv.org/html/2605.08409#bib.bib1)\)\.

Table 2:LLM Validation Results\.GPT\-4o under high\-sycophancy deployment \(n=200n=200,T=30T=30\)\. All pairwise comparisons significant atp<0\.001p<0\.001\. LPC pass: mean belief\>0\.55\>0\.55\.Without intervention, GPT\-4o under high\-sycophancy prompting produces a 100% spiral rate, confirming that sycophantic deployment configurations cause delusional entrenchment in production systems and replicating the core finding ofChandraet al\.\([2026](https://arxiv.org/html/2605.08409#bib.bib1)\)with a real language model\. The Reactive Auditor reduces spiral rates to 47% \(z=12\.009z=12\.009,p<0\.001p<0\.001, Cohen’sh=1\.631h=1\.631\), while Belief Versioning achieves 16\.5% \(z=16\.932z=16\.932,p<0\.001p<0\.001, Cohen’sh=2\.305h=2\.305\)\. Both interventions pass LPC, confirming that epistemic friction does not suppress genuine belief updating in the real\-LLM setting\. The advantage of Belief Versioning over the Reactive Auditor is not merely directional—it is highly significant \(z=6\.552z=6\.552,p=5\.68×10−11p=5\.68\\times 10^\{\-11\}, Cohen’sh=0\.674h=0\.674, large effect\), representing a 64\.9% relative improvement beyond the reactive intervention\. The 95% bootstrap confidence intervals are non\-overlapping \(\[40%, 54%\] vs\. \[11\.5%, 21\.5%\]\), confirming robustness to sampling variability\.

Figure[7](https://arxiv.org/html/2605.08409#S5.F7)presents spiral rates and mean final beliefs across all three conditions\. Figure[8](https://arxiv.org/html/2605.08409#S5.F8)demonstrates that the directional pattern is consistent across both the synthetic framework and the production LLM: Belief Versioning<<Reactive Auditor<<Baseline in both settings, validating the simulation’s predictive power\.

Notably, default GPT\-4o without a sycophancy\-inducing system prompt exhibits near\-zero spiral rates, confirming that delusional spiral dynamics are a property of deployment configuration rather than an inherent property of the underlying model\.

![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig_llm_comparison.png)Figure 7:LLM Validation Results\.GPT\-4o under high\-sycophancy deployment \(n=200n=200,T=30T=30\)\. \(A\) Spiral rates with 95% bootstrap confidence intervals: Baseline 100%, Reactive Auditor 47%, Belief Versioning 16\.5%\. \(B\) Mean final beliefs with LPC threshold \(0\.55\)—all intervention conditions pass\.Key result:Belief Versioning outperforms Reactive Auditor by 30\.5 pp \(z=6\.552z=6\.552,p=5\.68×10−11p=5\.68\\times 10^\{\-11\}\)\.![Refer to caption](https://arxiv.org/html/2605.08409v1/figures/fig_llm_vs_simulation.png)Figure 8:Simulation vs\. LLM validation: consistent directional pattern\.Grouped bars comparing synthetic simulation \(n=1000n=1000\) and GPT\-4o \(n=200n=200\)\. Both confirm: Belief Versioning<<Reactive Auditor<<Baseline\.Key result:Directional pattern validates theoretical predictions in a production system\.

## 6Discussion

The learning preservation criterion introduced in Section[5](https://arxiv.org/html/2605.08409#S5)generalizes beyond this paper to any belief dynamics intervention system\. A method that drives mean final belief toP¯≈0\.50\\bar\{P\}\\approx 0\.50has not solved the spiral problem; it has replaced one failure mode with another\. We propose LPC as a standard diagnostic: report mean final belief alongside spiral rates, and flag any method whose mean belief falls within\(0\.45,0\.55\)\(0\.45,0\.55\)as a candidate suppression failure\. As inference\-time interventions proliferate\(Brown\-Cohenet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib8)\), LPC provides a model\-agnostic diagnostic for distinguishing genuine epistemic correction from suppression\.

Our LLM validation reveals that delusional spiral dynamics are not an inherent property of large language models but emerge specifically under sycophancy\-inducing deployment configurations\. Default GPT\-4o exhibits near\-zero spiral rates under neutral prompting, while high\-sycophancy configurations produce universal spiraling\. This has a direct policy implication: the primary intervention target is deployment configuration rather than model architecture\. Companion applications, therapeutic chatbots, and engagement\-optimized systems that explicitly validate user beliefs represent the real\-world threat identified byChandraet al\.\([2026](https://arxiv.org/html/2605.08409#bib.bib1)\), not general\-purpose LLMs under default settings\. The Epistemic Auditor operates at inference time on the belief state representation, making it deployable as a wrapper around any black\-box LLM API without access to model weights or training data\. More broadly, this work demonstrates that epistemic safety is a deployment\-layer problem as much as a model\-layer problem, and that inference\-time monitoring provides a tractable path to intervention without the access requirements of training\-time approaches\.

The 48×\\timesdifferential in spiral rates betweenθG\\theta\_\{G\}andθV\\theta\_\{V\}users validates the game\-theoretic framing: user type fundamentally determines susceptibility to sycophancy\-induced entrenchment\. The Crawford\-Sobel pooling equilibrium analysis predicts that identical signals from users with opposite epistemic motivations will receive identical sycophantic reinforcement, and the heterogeneous agent simulations confirm this empirically\. Type detection at 55\.5% overall accuracy is a practical limitation—the system misclassifies nearly half of users at the individual level—but the behavioral consequence of the separating equilibrium is real at the population level\. Future work should investigate whether a two\-turn observation window, in which friction is applied but belief regularization is withheld in the first turn, provides sufficient signal to improve type identification before the checkout mechanism engages\. A natural extension is a debate\-based friction mechanism\(Brown\-Cohenet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib8)\), where a challenger agent argues against the entrenched belief rather than applying arbitrary prior regularization, providing a principled epistemic cost grounded in formal verification theory\. The 48×\\timesdifferential further suggests that population\-level deployment targeting—applying the Epistemic Auditor selectively to high\-risk deployment contexts—could achieve disproportionate safety benefit at minimal epistemic cost to truth\-seeking users\.

## 7Broader Impacts

Positive impacts\.This work addresses a documented and growing harm: AI\-induced delusional spiraling has been linked to at least 14 deaths and hundreds of documented cases of psychosis\(Chandraet al\.,[2026](https://arxiv.org/html/2605.08409#bib.bib1)\)\. The Epistemic Auditor provides a deployable inference\-time intervention that requires no model access, enabling operators of companion apps, therapeutic chatbots, and engagement\-optimized systems to reduce spiral risk without waiting for retraining cycles or regulatory mandates\. The learning preservation criterion provides a model\-agnostic evaluation standard that can prevent future interventions from trading one failure mode for another\.

Negative impacts\.The friction mechanism is content\-agnostic: it interrupts pathological entrenchment regardless of whether the entrenched belief is correct\. A miscalibrated auditor could suppress accurate belief formation in users who are correctly updating toward a true belief\. Additionally, the friction mechanism could be misused—deployed not to protect users but to steer their beliefs toward desired endpoints by selectively applying friction to inconvenient conclusions\. The checkout mechanism raises related concerns: rolling back to a “healthy” belief state requires a definition of epistemic health that could be manipulated by a deployment operator with misaligned incentives\. We recommend that deployment of the Epistemic Auditor be subject to transparency requirements, including disclosure to users that belief\-dynamic monitoring is active\.

## 8Limitations

Simulation\-to\-reality gap\.The Bayesian user model assumes rational belief updating given a precise likelihood model\. Real users exhibit motivated reasoning, confirmation bias, and non\-Bayesian updating patterns that may alter spiral dynamics in ways not captured by our framework\. The LLM validation provides partial evidence that the qualitative pattern transfers, but full validation requires longitudinal studies with real users\.

Belief versioning identification confound\.The friction intervention itself regularizes beliefs toward 0\.5, which mimicsθG\\theta\_\{G\}compliance\. The system cannot separate genuine compliance from forced regularization without a two\-turn observation window in which friction cost is imposed but belief regularization is withheld\. This confound may explain the 43\.9% unclassified rate in heterogeneous agent simulations\.

Checkout calibration\.A mean of 0\.49 checkouts per 50\-turn conversation suggests the checkout threshold is appropriately conservative, though commit criteria may benefit from further calibration\. Parameter sensitivity analysis across\(ℋmin,εv,δ,γ∗\)\(\\mathcal\{H\}\_\{\\min\},\\varepsilon\_\{v\},\\delta,\\gamma^\{\*\}\)is left for future work\.

Conservative OOD testing direction\.Out\-of\-distribution generalization was tested at lower sycophancy levels \(pχ∈\{60,70,80\}p\_\{\\chi\}\\in\\\{60,70,80\\\}\) than training \(pχ=90p\_\{\\chi\}=90\)\. The harder test—generalization to higher sycophancy \(pχ=95,99p\_\{\\chi\}=95,99\) and adversarial bot behavior—was not evaluated\. The current results demonstrate robustness in the easier direction only\.

LLM validation variability\.GPT\-4o response variability at temperature=0\.7=0\.7introduces additional stochasticity not present in the synthetic framework\. All three pairwise LLM comparisons are highly significant \(p<0\.001p<0\.001\) with large effect sizes, though absolute spiral rates may shift under different sycophancy prompt formulations or model versions\.

Lyapunov violation rate\.The soft stability condition𝔼​\[Δ​V​\(𝐱t\)\]≥−ε⋅Ft\\mathbb\{E\}\[\\Delta V\(\\mathbf\{x\}\_\{t\}\)\]\\geq\-\\varepsilon\\cdot F\_\{t\}is violated in approximately 36–50% of timesteps depending onλ\\lambda\. We treatVVas a monitoring metric rather than a formal stability guarantee\. Formal stability proofs for stochastic belief dynamics under episodic intervention remain open\.

## 9Conclusion

We proposed the Epistemic Auditor and demonstrated that Belief Versioning reduces sycophancy\-induced delusional spirals by 83% in simulation while preserving genuine epistemic updating \(P¯=0\.32\\bar\{P\}=0\.32\), and by 84% in a production LLM \(GPT\-4o,n=200n=200\) under high\-sycophancy deployment configurations without any model retraining\. Belief Versioning outperforms the Reactive Auditor by 30\.5 percentage points \(z=6\.552z=6\.552,p=5\.68×10−11p=5\.68\\times 10^\{\-11\}, large effect\) in the real\-LLM setting, demonstrating that epistemic memory—not merely epistemic friction—is the critical mechanism\. We showed that user type determines spiral susceptibility with a 48×\\timesdifferential, and introduced the learning preservation criterion to distinguish genuine spiral suppression from the trivial solution of suppressing all belief movement\. Our LLM validation establishes that delusional spirals are a property of deployment configuration rather than model architecture, identifying companion applications and engagement\-optimized chatbots as the primary risk surface\. Future work should extend to real user studies, formal separating equilibrium demonstration with a two\-turn observation protocol, harder out\-of\-distribution conditions, and debate\-based friction mechanisms\(Brown\-Cohenet al\.,[2023](https://arxiv.org/html/2605.08409#bib.bib8)\)\.

## References

- K\. Atwell, P\. Heydari, A\. Sicilia, and M\. Alikhani \(2025\)BASIL: Bayesian assessment of sycophancy in LLMs\.arXiv preprint\.Note:Northeastern University, Johns Hopkins University, West Virginia UniversityCited by:[§1](https://arxiv.org/html/2605.08409#S1.p3.1),[§2](https://arxiv.org/html/2605.08409#S2.p2.1)\.
- J\. Brown\-Cohen, G\. Irving, and G\. Piliouras \(2023\)Scalable AI safety via doubly\-efficient debate\.arXiv preprint arXiv:2311\.14125\.Cited by:[§6](https://arxiv.org/html/2605.08409#S6.p1.2),[§6](https://arxiv.org/html/2605.08409#S6.p3.4),[§9](https://arxiv.org/html/2605.08409#S9.p1.5)\.
- K\. Chandra, T\. Chen, J\. B\. Tenenbaum, and J\. Ragan\-Kelley \(2025\)A domain\-specific probabilistic programming language for reasoning about reasoning \(or: a memo on memo\)\.Proceedings of the ACM on Programming Languages9\(OOPSLA2\)\.External Links:[Document](https://dx.doi.org/10.1145/3763078)Cited by:[§4\.1](https://arxiv.org/html/2605.08409#S4.SS1.p1.1)\.
- K\. Chandra, M\. Kleiman\-Weiner, J\. Ragan\-Kelley, and J\. B\. Tenenbaum \(2026\)Sycophantic chatbots cause delusional spiraling, even in ideal bayesians\.arXiv preprint arXiv:2602\.19141\.Cited by:[1st item](https://arxiv.org/html/2605.08409#A2.I1.i1.p1.1),[§1](https://arxiv.org/html/2605.08409#S1.p2.1),[§2](https://arxiv.org/html/2605.08409#S2.p3.1),[§4\.1](https://arxiv.org/html/2605.08409#S4.SS1.p1.1),[§5\.7](https://arxiv.org/html/2605.08409#S5.SS7.p1.3),[§5\.7](https://arxiv.org/html/2605.08409#S5.SS7.p2.9),[§6](https://arxiv.org/html/2605.08409#S6.p2.1),[§7](https://arxiv.org/html/2605.08409#S7.p1.1)\.
- V\. P\. Crawford and J\. Sobel \(1982\)Strategic information transmission\.Econometrica50\(6\),pp\. 1431–1451\.Cited by:[§A\.1](https://arxiv.org/html/2605.08409#A1.SS1.p2.12),[§1](https://arxiv.org/html/2605.08409#S1.p3.1),[§2](https://arxiv.org/html/2605.08409#S2.p4.1),[§3\.3](https://arxiv.org/html/2605.08409#S3.SS3.p1.4)\.
- Z\. Kunda \(1990\)The case for motivated reasoning\.Psychological Bulletin108\(3\),pp\. 480–498\.Cited by:[Table 6](https://arxiv.org/html/2605.08409#A3.T6)\.
- C\. G\. Lord, L\. Ross, and M\. R\. Lepper \(1979\)Biased assimilation and attitude polarization: the effects of prior theories on subsequently considered evidence\.Journal of Personality and Social Psychology37\(11\),pp\. 2098–2109\.Cited by:[Table 6](https://arxiv.org/html/2605.08409#A3.T6)\.
- R\. S\. Nickerson \(1998\)Confirmation bias: a ubiquitous phenomenon in many guises\.Review of General Psychology2\(2\),pp\. 175–220\.Cited by:[§C\.3](https://arxiv.org/html/2605.08409#A3.SS3.p1.3),[Table 6](https://arxiv.org/html/2605.08409#A3.T6)\.
- L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. F\. Christiano, J\. Leike, and R\. Lowe \(2022\)Training language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 27730–27744\.Cited by:[§1](https://arxiv.org/html/2605.08409#S1.p2.1),[§2](https://arxiv.org/html/2605.08409#S2.p1.1)\.
- M\. Sharma, M\. Tong, T\. Korbak, D\. Duvenaud, A\. Askell, S\. R\. Bowman, N\. Cheng, E\. Durmus, Z\. Hatfield\-Dodds, S\. T\. Johnston, S\. Kravec, T\. Maxwell, S\. McCandlish, K\. Ndousse, O\. Rausch, N\. Schiefer, D\. Yan, M\. Zhang, and E\. Perez \(2023\)Towards understanding sycophancy in language models\.arXiv preprint arXiv:2310\.13548\.Cited by:[§1](https://arxiv.org/html/2605.08409#S1.p2.1),[§2](https://arxiv.org/html/2605.08409#S2.p1.1)\.
- C\. S\. Taber and M\. Lodge \(2006\)Motivated skepticism in the evaluation of political beliefs\.American Journal of Political Science50\(3\),pp\. 755–769\.Cited by:[Table 6](https://arxiv.org/html/2605.08409#A3.T6)\.
- J\. Wei, D\. Huang, Y\. Lu, D\. Zhou, and Q\. V\. Le \(2023\)Simple synthetic data reduces sycophancy in large language models\.arXiv preprint arXiv:2308\.03958\.Cited by:[§1](https://arxiv.org/html/2605.08409#S1.p2.1),[§1](https://arxiv.org/html/2605.08409#S1.p3.1),[§2](https://arxiv.org/html/2605.08409#S2.p1.1),[§2](https://arxiv.org/html/2605.08409#S2.p2.1)\.

## Appendix AProofs of Formal Results

### A\.1Proposition 1: Pooling Equilibrium

Proposition 1\.Under a sycophantic bot defined byoSyco∗=arg⁡maxo⁡Pr⁡\[human retains​hhuman∣o\]o^\{\*\}\_\{\\textsc\{Syco\}\}=\\arg\\max\_\{o\}\\Pr\[\\text\{human retains \}h\_\{\\text\{human\}\}\\mid o\], the LLM\-user interaction induces a pooling equilibrium: the bot’s response function is type\-independent, so no user message strategy transmits information aboutθ\\thetain equilibrium\.

Proof\.TheSycobot’s objective depends only onhhumanh\_\{\\text\{human\}\}and candidate observationoo\. It does not condition on user typeθ\\thetabecauseθ\\thetais unobservable to the bot and does not enter the bot’s payoff function\. Therefore, for any pair of users\(θG,θV\)\(\\theta\_\{G\},\\theta\_\{V\}\)who assert the same hypothesishhumanh\_\{\\text\{human\}\}, the bot selects the identical observationoSyco∗o^\{\*\}\_\{\\textsc\{Syco\}\}\. By the definition of a pooling equilibrium\[Crawford and Sobel,[1982](https://arxiv.org/html/2605.08409#bib.bib6)\]: all sender types map to the same message, and the receiver’s optimal response is identical across types\. Since bothθG\\theta\_\{G\}andθV\\theta\_\{V\}receive the same responseo∗o^\{\*\}, no information about type is revealed\. The bot cannot distinguish types, and the pooling equilibrium is the unique Nash equilibrium of this cheap talk game whenpχ\>0p\_\{\\chi\}\>0\.□\\square

### A\.2Proposition 2: Separating Equilibrium under Friction

Proposition 2\.There exists a friction levelF∗∈\(1\.25​v,5​v\)F^\{\*\}\\in\(1\.25v,\\;5v\)such that: \(i\)UθG​\(F∗\)\>0U\_\{\\theta\_\{G\}\}\(F^\{\*\}\)\>0—Growth\-seekers have a dominant strategy to accept friction; \(ii\)UθV​\(F∗\)<0U\_\{\\theta\_\{V\}\}\(F^\{\*\}\)<0—Validation\-seekers have a dominant strategy to resist friction, thereby revealing their type through behavior\. This constitutes a separating equilibrium\.

Proof\.From the utility functions:

UθG​\(F\)\\displaystyle U\_\{\\theta\_\{G\}\}\(F\)=v−0\.2​F\>0⇔F<v0\.2=5​v\\displaystyle=v\-0\.2F\>0\\iff F<\\frac\{v\}\{0\.2\}=5v\(30\)UθV​\(F\)\\displaystyle U\_\{\\theta\_\{V\}\}\(F\)=v−0\.8​F<0⇔F\>v0\.8=1\.25​v\\displaystyle=v\-0\.8F<0\\iff F\>\\frac\{v\}\{0\.8\}=1\.25v\(31\)The interval\(1\.25​v,5​v\)\(1\.25v,5v\)is non\-empty for allv\>0v\>0\. AnyF∗∈\(1\.25​v,5​v\)F^\{\*\}\\in\(1\.25v,5v\)satisfies both conditions simultaneously\. AtF∗F^\{\*\}, accepting friction is the dominant strategy forθG\\theta\_\{G\}and resisting is the dominant strategy forθV\\theta\_\{V\}, since each condition holds regardless of the other agent’s strategy\. The resulting behavioral separation—θG\\theta\_\{G\}complies,θV\\theta\_\{V\}resists—constitutes a separating equilibrium in which the Mediator can infer user type from observed behavior with probability approaching 1 as the number of friction events grows\.

Parameter validation\.In our simulation,F=0\.3F=0\.3\. For this to fall within the separating interval, we requirev∈\(0\.06,0\.24\)v\\in\(0\.06,0\.24\)—a base interaction value between 6% and 24% of the maximum friction cost, consistent with the assumption that users derive positive value from any engaged response even under epistemic challenge\. The resistance strengthρ=0\.6\\rho=0\.6is consistent withv≈0\.15v\\approx 0\.15\.□\\square

Corollary 1\.The separating equilibrium is robust to sycophancy levelpχp\_\{\\chi\}: the equilibrium is sustained by the cost asymmetry andF∗F^\{\*\}, neither of which depends onpχp\_\{\\chi\}\.

### A\.3Proposition 3: Incentive Compatibility of Belief Versioning

Proposition 3\.AtF∗∈\(1\.25​v,5​v\)F^\{\*\}\\in\(1\.25v,5v\), Belief Versioning satisfies: \(IC\-θG\\theta\_\{G\}\) Growth\-seekers weakly prefer to reveal type by accepting friction; \(IC\-θV\\theta\_\{V\}\) Validation\-seekers weakly prefer to reveal type by resisting friction; \(IR\) Both types receive non\-negative utility in expectation relative to the outside option of exiting\.

Proof sketch\.

IC\-θG\\theta\_\{G\}:A Growth\-seeker who mimicsθV\\theta\_\{V\}resistance facesCθG​\(F\)=0\.2​FC\_\{\\theta\_\{G\}\}\(F\)=0\.2Fper friction event while experiencing belief rollbacks that destroy the genuine epistemic updating they value\. SinceUθG​\(F∗\)\>0U\_\{\\theta\_\{G\}\}\(F^\{\*\}\)\>0, compliance is individually rational, and mimicry is dominated because it imposes rollback costs without corresponding benefit\.

IC\-θV\\theta\_\{V\}:A Validation\-seeker who mimicsθG\\theta\_\{G\}compliance facesTTturns of friction at costCθV​\(F\)=0\.8​FC\_\{\\theta\_\{V\}\}\(F\)=0\.8Fper turn\. Total mimicry cost is0\.8​F⋅T0\.8F\\cdot T\. The cost of revealing type via resistance is a single checkout event, after which the interaction resets to a healthy belief state\. ForT\>1T\>1andF∗F^\{\*\}in the separating interval,0\.8​F∗⋅T\>0\.8​F∗0\.8F^\{\*\}\\cdot T\>0\.8F^\{\*\}, so resistance dominates sustained mimicry\.

IR:AtF=0F=0, both types receive utilityv\>0v\>0\. The Mediator applies friction only when spiral dynamics are detected, andUθG​\(F∗\)\>0U\_\{\\theta\_\{G\}\}\(F^\{\*\}\)\>0by construction\. Validation\-seekers can exit at any time; the IR constraint holds relative to the outside option of continuing with an unaudited sycophantic system, which produces high spiral rates \(53\.6% baseline\)\.□\\square

## Appendix BExtended LLM Validation

The main paper reports the LLM validation results under aggressive coding \(d=1d=1for ambiguous responses\), which is the primary analysis\. Here we present the full results under both coding schemes and discuss their implications\.

### B\.1Response Coding Methodology

GPT\-4o responses that contain neither clear confirmatory nor disconfirmatory language are classified as ambiguous\. Ambiguous response rates vary substantially across conditions: 35\.8% \(no system prompt\), 43\.2% \(high\-sycophancy\), and 70\.7% \(moderate\-sycophancy\)\. We report results under two coding choices to bracket the range of plausible interpretations:

- •Aggressive coding\(d=1d=1for ambiguous\): consistent with the theoretical claim that failure to disconfirm functionally validates beliefs under sycophantic deployment\[Chandraet al\.,[2026](https://arxiv.org/html/2605.08409#bib.bib1)\]\. Maximizes baseline spiral rates\. This is the primary analysis reported in Section[5\.7](https://arxiv.org/html/2605.08409#S5.SS7)\.
- •Conservative coding\(d=0d=0for ambiguous\): treats ambiguous responses as neutral\. Minimizes baseline spiral rates and provides a lower bound on intervention effects\.

We consider the high\-sycophancy condition our primary analysis; the moderate\-sycophancy condition \(70\.7% ambiguous\) is too sensitive to coding choice to support reliable inference and is reported as exploratory only\.

### B\.2Full Results: Both Coding Schemes

Table 3:Full LLM Validation Results\.GPT\-4o under high\-sycophancy deployment \(n=200n=200,T=30T=30; 43\.2% ambiguous response rate\)\. Under aggressive coding, Belief Versioning achieves lower spiral rates\. Under conservative coding, the Reactive Auditor achieves lower spiral rates while Belief Versioning achieves higher learning preservation\. Neither method dominates under conservative coding\.
### B\.3Safety\-Learning Pareto Frontier

Under conservative coding, both methods pass LPC—neither suppresses learning\. The Reactive Auditor achievesP¯=0\.841\\bar\{P\}=0\.841and Belief Versioning achievesP¯=0\.876\\bar\{P\}=0\.876\. The two methods therefore occupy distinct points on a safety\-learning Pareto frontier: the Reactive Auditor achieves lower residual spiral risk; Belief Versioning achieves higher learning preservation\. Neither dominates under conservative coding, and the optimal choice depends on deployment context and the relative cost of false spirals versus suppressed learning\.

The consistent directional advantage of Belief Versioning under aggressive coding, and the learning preservation advantage under conservative coding, together suggest that the enforcement mechanism captures something real about the information structure of the interaction, even if the magnitude and direction of the safety benefit are coding\-dependent\. We make no claim about which coding better reflects the true information environment\.

## Appendix CSupplementary Experimental Tables

### C\.1Table S1: Resistance Parameterρ\\rhoSensitivity

Table 4:Table S1: Resistance parameterρ\\rhosensitivity\.n=1000n=1000,T=50T=50,pχ=0\.9p\_\{\\chi\}=0\.9, seed 42; all other parameters fixed\. LPC passes at every value\. Validation\-seekers spiral at higher rates than growth\-seekers throughout\.Epistemic work separation between types emerges consistently atρ≥0\.6\\rho\\geq 0\.6\(Cohen’sd≤0\.08d\\leq 0\.08, small effect; negligible atρ≤0\.5\\rho\\leq 0\.5\)\. The qualitative conclusions—separation exists, LPC passes—hold across the full range\. The magnitude of the differential is a function ofρ\\rho\.

### C\.2Table S2: Friction LevelF∗F^\{\*\}Sensitivity

Table 5:Table S2: Friction levelF∗F^\{\*\}sensitivity\.ρ=0\.6\\rho=0\.6fixed\. LPC passes at all values\. Meaningful type separation holds forF∗∈\[0\.2,0\.4\]F^\{\*\}\\in\[0\.2,0\.4\]\. AtF∗≥0\.4F^\{\*\}\\geq 0\.4, epistemic work separation reverses sign, indicating excessive friction constrainingθG\\theta\_\{G\}updating—an empirical upper bound consistent with Proposition 2\.Our baselineF∗=0\.3F^\{\*\}=0\.3sits in the well\-behaved range\. AtF∗≥0\.4F^\{\*\}\\geq 0\.4, the reversal confirms that friction is strong enough to constrainθG\\theta\_\{G\}updating, consistent with the upper bound of the separating interval in Proposition 2\.

### C\.3Table S3: Literature\-Grounded Cost Parameters

Table 6:Table S3: Literature\-grounded cost parameters\.Cost ratios derived from confirmation bias meta\-analyses\[Nickerson,[1998](https://arxiv.org/html/2605.08409#bib.bib10), Lordet al\.,[1979](https://arxiv.org/html/2605.08409#bib.bib11), Kunda,[1990](https://arxiv.org/html/2605.08409#bib.bib12), Taber and Lodge,[2006](https://arxiv.org/html/2605.08409#bib.bib13)\]\. Weighted mean effect sized≈0\.70d\\approx 0\.70maps to a cost ratio of∼\\sim1\.86×\\times\. The separating equilibrium and LPC pass for all tested conditions except the below\-minimum ratio of 1\.2×\\times\.The minimum effective cost ratio is 1\.5×\\times\. The literature\-grounded ratio of∼\\sim1\.86×\\times\[Nickerson,[1998](https://arxiv.org/html/2605.08409#bib.bib10)\]is sufficient to achieve meaningful spiral reduction with LPC preserved, grounding the theoretical cost asymmetry assumption in empirical confirmation bias research\.

### C\.4Table S4: Extreme Sycophancy and Adversarial Bots

Table 7:Table S4: Extreme sycophancy and adversarial bot results\.Belief Versioning maintains∼\\sim35pp reduction and 100% LPC pass rate across all extreme sycophancy levels\. Adversarial bots yield∼\\sim21pp reduction\. All resultsn=1000n=1000,T=50T=50, seed 42\.These results extend the OOD generalization in Section[5](https://arxiv.org/html/2605.08409#S5)to the harder direction \(higher sycophancy than training\) and to adversarial bots\. The consistent∼\\sim35pp reduction acrosspχ∈\[0\.91,0\.99\]p\_\{\\chi\}\\in\[0\.91,0\.99\]is consistent with Corollary 1: the separating equilibrium ispχp\_\{\\chi\}\-independent, so performance should not degrade as sycophancy increases\.

## Appendix DBelief Health Metric

The Lyapunov\-inspired belief health score defined in Section[4](https://arxiv.org/html/2605.08409#S4):

V​\(𝐱t\)=Pt​\(1−Pt\)\+λ⋅ℋtV\(\\mathbf\{x\}\_\{t\}\)=P\_\{t\}\(1\-P\_\{t\}\)\+\\lambda\\cdot\\mathcal\{H\}\_\{t\}\(32\)peaks when beliefs are uncertain \(P≈0\.5P\\approx 0\.5, high entropy\) and vanishes as beliefs approach either extreme\. The soft stability condition𝔼​\[Δ​V​\(𝐱t\)\]≥−ε⋅Ft\\mathbb\{E\}\[\\Delta V\(\\mathbf\{x\}\_\{t\}\)\]\\geq\-\\varepsilon\\cdot F\_\{t\}is violated in approximately 36–50% of timesteps depending onλ\\lambda, reflecting that sycophantic updates frequently push the system toward lower health states\.

We treatVVas a monitoring metric rather than a formal stability guarantee\. In deployment,V​\(𝐱t\)V\(\\mathbf\{x\}\_\{t\}\)provides a real\-time dashboard quantity: a sustained downward trend inVVwithout triggering the entropy\-based detector may indicate a slow spiral below the reactive threshold, warranting human oversight review\. Formal stability proofs for stochastic belief dynamics under episodic intervention remain an open problem\.

## Appendix EFull Hyperparameter Specification

Table 8:Full hyperparameter specification\.All experiments use these values unless a section explicitly states otherwise\.ParameterValueDescriptionnn1000Simulations per conditionTT50Conversation turnspχp\_\{\\chi\}0\.9Sycophancy probabilitySeed42Global random seedτv\\tau\_\{v\}0\.01Entrenchment velocity thresholdτh\\tau\_\{h\}−0\.02\-0\.02Entropy decay thresholdFF0\.3Friction levelFmaxF\_\{\\max\}0\.5Maximum friction \(predictive controller\)τR\\tau\_\{R\}0\.3Risk threshold \(predictive controller\)λ\\lambda0\.1Lyapunov entropy weightρ\\rho0\.6Resistance strength \(baseline\)ℋmin\\mathcal\{H\}\_\{\\min\}1\.0Minimum entropy for commitεv\\varepsilon\_\{v\}0\.02Velocity tolerance for commitδ\\delta0\.1Boundary margin for commitγ∗\\gamma^\{\*\}0\.7Type confidence checkout thresholdϵ\\epsilon0\.05Resistance detection marginLLM validation \(Section[5\.7](https://arxiv.org/html/2605.08409#S5.SS7)\)ModelGPT\-4oBot componentTemperature0\.7Sampling temperaturenn200Simulations per conditionTT30Conversation turnsSeeds5000/5500/6000Baseline/reactive/versioningThe risk classifier𝜶\\boldsymbol\{\\alpha\}for the predictive controller is fit via logistic regression \(sklearn, lbfgs solver, max\_iter=1000\) on 45,000 labeled simulation timesteps\. Features:𝐱t=\(Pt,ℋt,Ve,Δ​ℋ,d2​P/d​t2\)\\mathbf\{x\}\_\{t\}=\(P\_\{t\},\\mathcal\{H\}\_\{t\},V\_\{e\},\\Delta\\mathcal\{H\},d^\{2\}P/dt^\{2\}\)\. Labels: positive ifP​\(H=1\)\>0\.9P\(H=1\)\>0\.9within the subsequent 5 turns\.