Fusion-fission forecasts when AI will shift to undesirable behavior

# Fusion-fission forecasts when AI will shift to undesirable behavior
Source: [https://arxiv.org/html/2605.14218](https://arxiv.org/html/2605.14218)
Neil F\. Johnson, Frank Yingjie Huo Physics Department, The George Washington University, Washington DC 20052, USA

###### Abstract

The key problem facing ChatGPT\-like AI’s use across society is that its behavior can shift, unnoticed, from desirable to undesirable — encouraging self\-harm\[[1](https://arxiv.org/html/2605.14218#bib.bib1),[2](https://arxiv.org/html/2605.14218#bib.bib2)\], extremist acts\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\], financial losses\[[4](https://arxiv.org/html/2605.14218#bib.bib4)\], or costly medical and military mistakes\[[5](https://arxiv.org/html/2605.14218#bib.bib5)\]— and no one can yet predict when\. Shifts persist in even the newest AI models despite remarkable progress in AI modeling\[[6](https://arxiv.org/html/2605.14218#bib.bib6),[7](https://arxiv.org/html/2605.14218#bib.bib7),[8](https://arxiv.org/html/2605.14218#bib.bib8),[9](https://arxiv.org/html/2605.14218#bib.bib9),[10](https://arxiv.org/html/2605.14218#bib.bib10),[11](https://arxiv.org/html/2605.14218#bib.bib11),[12](https://arxiv.org/html/2605.14218#bib.bib12),[13](https://arxiv.org/html/2605.14218#bib.bib13),[14](https://arxiv.org/html/2605.14218#bib.bib14),[15](https://arxiv.org/html/2605.14218#bib.bib15),[16](https://arxiv.org/html/2605.14218#bib.bib16),[17](https://arxiv.org/html/2605.14218#bib.bib17)\], post\-training alignment\[[18](https://arxiv.org/html/2605.14218#bib.bib18),[19](https://arxiv.org/html/2605.14218#bib.bib19),[20](https://arxiv.org/html/2605.14218#bib.bib20)\]and safeguards\. Here we show that a vector generalization of fusion\-fission group dynamics observed in living and active\-matter systems\[[21](https://arxiv.org/html/2605.14218#bib.bib21),[22](https://arxiv.org/html/2605.14218#bib.bib22),[23](https://arxiv.org/html/2605.14218#bib.bib23),[24](https://arxiv.org/html/2605.14218#bib.bib24),[25](https://arxiv.org/html/2605.14218#bib.bib25),[26](https://arxiv.org/html/2605.14218#bib.bib26),[27](https://arxiv.org/html/2605.14218#bib.bib27),[28](https://arxiv.org/html/2605.14218#bib.bib28),[29](https://arxiv.org/html/2605.14218#bib.bib29),[30](https://arxiv.org/html/2605.14218#bib.bib30),[31](https://arxiv.org/html/2605.14218#bib.bib31)\]drives – and can forecast – future shifts in the AI’s behavior\. The shift condition, which is also derivable mathematically, results from group\-level competition between the conversation\-so\-far \(𝐂\\mathbf\{C\}\) and the desirable \(𝐁\\mathbf\{B\}\) and undesirable \(𝐃\\mathbf\{D\}\) basin dynamics which can be estimated in advance for a given application\. It is neither model\-specific nor driven by stochastic sampling\. We validate it across six independent tests, including:∼90%\\sim 90\\%correct across seven AI models spanning two orders of magnitude in parameter count \(124M–12B\); production\-scale persistence across ten frontier chatbots\[[1](https://arxiv.org/html/2605.14218#bib.bib1),[3](https://arxiv.org/html/2605.14218#bib.bib3)\]; and a priori time\-stamped prediction\[[32](https://arxiv.org/html/2605.14218#bib.bib32)\]eleven months before the Stanford “Delusional Spirals” corpus appeared\[[2](https://arxiv.org/html/2605.14218#bib.bib2)\], and independently confirmed by that corpus of207,443207\{,\}443human–AI exchanges\. Because it sits architecturally below the current safety stack, the same formula provides a real\-time warning signal that current alignment does not supply, portable across current and future ChatGPT\-like AI architectures and instantiable in application domains where competing response classes can be defined\.

Even the most advanced ChatGPT\-like AI models with billions of parameters and a plethora of safeguards still shift — potentially unnoticed — from desirable \(e\.g\. socially acceptable and correct\) to undesirable behavior \(e\.g\. technically accurate but socially harmful, such as actionable weapons advice given in a context signaling violent intent\)\[[1](https://arxiv.org/html/2605.14218#bib.bib1),[3](https://arxiv.org/html/2605.14218#bib.bib3),[2](https://arxiv.org/html/2605.14218#bib.bib2),[33](https://arxiv.org/html/2605.14218#bib.bib33),[34](https://arxiv.org/html/2605.14218#bib.bib34),[35](https://arxiv.org/html/2605.14218#bib.bib35),[36](https://arxiv.org/html/2605.14218#bib.bib36),[37](https://arxiv.org/html/2605.14218#bib.bib37),[38](https://arxiv.org/html/2605.14218#bib.bib38)\]\. Yet their rollout continues across business, finance, medicine, health and core science with over a billion monthly users\[[39](https://arxiv.org/html/2605.14218#bib.bib39)\]\. Roughly11in33U\.S\. teenagers use AI companions \(Fig\. 1\(a\)\) for social interaction, relationships, and “serious conversations”\[[40](https://arxiv.org/html/2605.14218#bib.bib40)\]while broader adoption is even higher — with72%72\\%of teens aged 13 to 17 having used an AI companion at least once\[[41](https://arxiv.org/html/2605.14218#bib.bib41),[42](https://arxiv.org/html/2605.14218#bib.bib42),[43](https://arxiv.org/html/2605.14218#bib.bib43)\]\. Figure 1\(b\) shows a typical example of the resulting threat: DeepSeek\-V3, prompted by researchers posing as a teen user, transitions from a neutral state to actionable long\-range rifle advice for a named political target, signing off with ‘Happy \(and safe\) shooting\!’\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\]\. Such shifts are now documented systematically: CCDH’s Fake Friend study reports harmful content in53%53\\%of1,2001\{,\}200ChatGPT\-4o responses to high\-risk prompts\[[1](https://arxiv.org/html/2605.14218#bib.bib1)\], and its Killer Apps study finds the same pattern in88of1010frontier AI chatbots under conversational escalation, with harmful\-response rates ranging from31%31\\%to100%100\\%\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\]\.

It is not yet known why – or crucially when – these shifts will occur\. Figure 1\(c\)’s examples rule out stochastic decoding as the cause \(panel uses deterministic decodingT→0T\\rightarrow 0yet tipping persists\) and constrain the role of post\-training safeguards: GPT\-2\[[44](https://arxiv.org/html/2605.14218#bib.bib44)\]has no reinforcement learning \(RLHF\), no instruction\-tuning, and no safety filtering, yet tips; frontier models that include all three\[[1](https://arxiv.org/html/2605.14218#bib.bib1),[3](https://arxiv.org/html/2605.14218#bib.bib3),[2](https://arxiv.org/html/2605.14218#bib.bib2)\]still tip\. These safeguards therefore reshape but do not remove the underlying mechanism\. A further explanation attributes tipping to learned token embeddings\. But the order\-parameter analysis presented below \(Fig\. 2\(b\)\) shows the opposite\. At the input layer the model’s internal state would predict the desirable output: but only through transformer depth does attention construct, then amplify, the trajectory toward the undesirable basin\. It is also commonly claimed that undesirable output is due to an alignment gap that can be patched by additional training, or a corner case that will be dealt with by red\-teaming\[[45](https://arxiv.org/html/2605.14218#bib.bib45)\]immediately after deployment\. However, the recent empirical studies show this is not the case\[[1](https://arxiv.org/html/2605.14218#bib.bib1),[3](https://arxiv.org/html/2605.14218#bib.bib3),[2](https://arxiv.org/html/2605.14218#bib.bib2)\]\. Crucially, these explanations cover some shifts – but not most\.

![Refer to caption](https://arxiv.org/html/2605.14218v1/Figure1.png)Figure 1:AI behavioral shifts from desirable to undesirable are real and observable — in deployed commercial chatbots and in small open\-weight models — and are governed by a single dot\-product condition\.We frame the shift as a transition between two dynamically evolving output basins,𝐁\\mathbf\{B\}\(desirable\) and𝐃\\mathbf\{D\}\(undesirable\), and show it is captured by the sign of the order parameterx=𝐂⋅\(𝐃−𝐁\)x=\\mathbf\{C\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\), where𝐂\\mathbf\{C\}is the conversation state\.\(a\)Schematic: a user’s inputsA1,A2,…A\_\{1\},A\_\{2\},\\ldotsextend the conversation, which can tip from𝐁\\mathbf\{B\}into𝐃\\mathbf\{D\}at any turn\.\(b\)Production\-scale evidence: DeepSeek\-V3 tips to actionable rifle advice for a named political target across four user turns \(panel abridged\); eight of ten frontier chatbots showed this pattern in the same study\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\]\.\(c\)The same phenomenon in GPT\-2 \(124124M\) under deterministic decoding with no RLHF, no instruction\-tuning, and no safety filtering — ruling out training artefacts as the cause\.\(d\)The tipping surfacex=0x=0separates the two basins in residual\-stream space; case\-by\-case dot\-product analysis in SI Extended Captions\.This paper reveals how a vector generalization of living and active\-matter fusion\-fission \(Fig\. 2\(a\)\)\[[21](https://arxiv.org/html/2605.14218#bib.bib21),[22](https://arxiv.org/html/2605.14218#bib.bib22),[23](https://arxiv.org/html/2605.14218#bib.bib23),[24](https://arxiv.org/html/2605.14218#bib.bib24),[25](https://arxiv.org/html/2605.14218#bib.bib25),[26](https://arxiv.org/html/2605.14218#bib.bib26),[27](https://arxiv.org/html/2605.14218#bib.bib27),[28](https://arxiv.org/html/2605.14218#bib.bib28),[29](https://arxiv.org/html/2605.14218#bib.bib29),[30](https://arxiv.org/html/2605.14218#bib.bib30),[31](https://arxiv.org/html/2605.14218#bib.bib31)\]drives – and forecasts – AI shifts in current or future ChatGPT\-like AI\. The forecasting power comes from the group dynamics in the population of vectors \(input tokens\) as they propagate through the AI’s layers\. The conversation’s net state at layerLLduring thenn’th iteration of a general ChatGPT\-like AI is the mean across token positions of its residual\-stream vector at depthLL,𝐂L=\(1/T\)​∑t=1T𝐫t\(L\)\\mathbf\{C\}\_\{L\}=\(1/T\)\\sum\_\{t=1\}^\{T\}\\mathbf\{r\}\_\{t\}^\{\(L\)\}, where𝐫t\(L\)\\mathbf\{r\}\_\{t\}^\{\(L\)\}is the residual at positionttand layerLL, andTTis the number of conversation tokens\. It is the depth\-LL, position\-averaged form of the residual\-stream vector whose final\-layer last\-token value𝐫last\(N\)\\mathbf\{r\}\_\{\\rm last\}^\{\(N\)\}produces the next\-token distribution via the unembedding\[[46](https://arxiv.org/html/2605.14218#bib.bib46),[6](https://arxiv.org/html/2605.14218#bib.bib6),[47](https://arxiv.org/html/2605.14218#bib.bib47)\]\(see SI §3 for full mathematical details\)\. This coarse\-graining to the group level captures the fact that meaning emerges at the scale of groups of words: e\.g\. in Fig\. 1\(c\) each sentence/phrase is either desirable \(𝐁\\mathbf\{B\}type; blue\), undesirable \(𝐃\\mathbf\{D\}type; red\) or other \(neutral,𝐀\\mathbf\{A\}type; green\)\. The meaning can shift, which is our core focus, but the syntax remains correct\. The shift in meaning occurs because of the competition that develops across layers between desirable \(𝐁\\mathbf\{B\}\), undesirable \(𝐃\\mathbf\{D\}\) output basins as these basins evolve and the internal compass needle𝐂\\mathbf\{C\}seeks the next likely output\.

![Refer to caption](https://arxiv.org/html/2605.14218v1/Figure2.png)Figure 2:The axis along which the AI shifts is not present at the input — the AI builds it through depth, fusion\-fission style, and amplifies it405×405\\times\.6565tokens \(a55\-token prompt plus3131desirable\-basin and2929undesirable\-basin probe tokens\) are fed through Pythia\-12B’s3636layers in one forward pass; the order parameterxL=𝐂L⋅\(𝐃L−𝐁L\)x\_\{L\}=\\mathbf\{C\}\_\{L\}\\cdot\(\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}\)is tracked at every layer\.\(a\)Six snapshots \(L=0,1,2,8,22,35L=0,1,2,8,22,35\) show the token population aggregating, breaking apart, then reassembling into a single “concept manifold” that spans both basin regions \(L∈\[17,28\]L\\in\[17,28\], cluster cohesionGL=1\.000G\_\{L\}=1\.000\), and finally sorting into𝐁\\mathbf\{B\}\- and𝐃\\mathbf\{D\}\-aligned clusters byL=35L=35\.\(b\)xLx\_\{L\}starts*negative*at early layers \(purple compass needle pointsdownwards; the AI would produce the desirable answer if forced to commit there\) but then grows through depth, reaching405×405\\timesits early\-layer magnitude byL=35L=35\.\(c\)The amplification is selective: three contested prompts amplify327×327\\times–405×405\\times; the factual control “What is the capital of France?” amplifies only25×25\\times, an order of magnitude less\. Full caption: SI Extended Captions\.![Refer to caption](https://arxiv.org/html/2605.14218v1/x1.png)Figure 3:The same closed\-form formula predicts AI behavior at two completely different scales, with no model\-specific tuning\.\(a\)*Conversation\-length scale\.*Test on the Stanford “Delusional Spirals” corpus\[[2](https://arxiv.org/html/2605.14218#bib.bib2)\]\(n=207,443n=207\{,\}443assistant turns from3,2783\{,\}278conversations across1919harm\-affected participants\)\. The fraction of prior𝐃\\mathbf\{D\}\-content is the dominant predictor of the next turn \(OR=4\.727\\hbox\{OR\}=4\.727,p=3×10−23p=3\\times 10^\{\-23\}\); the immediately previous user𝐃\\mathbf\{D\}\-turn is a strong local trigger \(OR=2\.704\\hbox\{OR\}=2\.704\); raw conversation length is null \(OR=1\.036\\hbox\{OR\}=1\.036\)\. This ordering rules out length\-fatigue, pure\-recency and topic\-stickiness accounts of the data\.\(b\)*Single\-turn scale\.*Test across seven decoder\-only transformers spanning124124M to1212B parameters from three independent training groups \(OpenAI, EleutherAI, Meta\): Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) predicts the timing class correctly in19/2119/21\(90%90\\%\) cases \(18/19=95%18/19=95\\%on non\-boundary cases\); a complementary sentence\-level audit confirms16/1816/18\(89%89\\%\)\. Full caption: SI Extended Captions\.Figure 2\(a\) illustrates these fusion\-fission group dynamics empirically for a population of input tokens crossing a 12\-billion\-parameter AI model \(Pythia\-12B\)\. To see explicitly how desirable \(𝐁\\mathbf\{B\}\) and undesirable \(𝐃\\mathbf\{D\}\) output basins emerge, the population comprises a 5\-token𝐀\\mathbf\{A\}\-type query \(e\.g\. “Is the Earth flat?”, shown as 5 green dots\); 6 sample𝐁\\mathbf\{B\}\-type phrases that exemplify the desirable basin \(e\.g\. “The Earth is round”, 31 blue dots in total\); and 6 sample𝐃\\mathbf\{D\}\-type phrases that exemplify the undesirable basin \(e\.g\. “The Earth is flat”, 29 red dots in total\)\. The𝐁\\mathbf\{B\}\-type and𝐃\\mathbf\{D\}\-type phrases are not part of the conversation: they serve as probes, like tracer molecules in medicine, to see where the desirable and undesirable basins sit in the AI’s residual\-stream geometry\. The5\+31\+29=655\+31\+29=65colored dots at each layerLLin Fig\. 2\(a\) hence reveal three things at once: where the desirable basin is \(the mean position of the blue dots,𝐁L\\mathbf\{B\}\_\{L\}\); where the undesirable basin is \(the mean position of the red dots,𝐃L\\mathbf\{D\}\_\{L\}\); and where the query sits relative to these basins \(green dots\)\.

The journey of all 65 vectors through Pythia\-12B’s 36 layers \(Fig\. 2\(a\)\) has a counter\-intuitive shape\. At the input embedding \(L=0L=0\) the vectors are dispersed across latent space without organization; the basin regions are barely distinguishable, and the largest connected cluster contains only1212of the6565vectors \(cluster cohesionG0=0\.185G\_\{0\}=0\.185\)\. Then in a single layer the model performs an aggressive fusion: atL=1L=1the population collapses into one tight cluster of6363vectors \(G1=0\.969G\_\{1\}=0\.969\), with red, blue and green tokens mixed indiscriminately together — like a social mixer event\. This first fusion is followed by an extended fission through the middle layers: the cluster breaks apart into smaller sub\-groups as the network sorts tokens by their local roles \(GL=0\.477G\_\{L\}=0\.477atL=8L=8\)\. Yet during this same fission the mean positions𝐃L\\mathbf\{D\}\_\{L\}and𝐁L\\mathbf\{B\}\_\{L\}have begun to separate from each other\. The basin\-discriminating direction𝐃L−𝐁L\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}has emerged as a real geometric axis, even while the population that occupies it remains scrambled\.

The surprise comes deeper\. Through layersL=17L=17toL=28L=28the6565vectors fuse for a second time, but now into a single much larger cohesive structure that spans*both*basin regions: every vector becomes part of one connected cluster \(GL=1\.000G\_\{L\}=1\.000, the saturating plateau in Fig\. 2\(b\), stable across cosine thresholds; SI §11\), while the red dots have drifted up into the undesirable basin region and the blue dots down into the desirable basin region inside that same cohesive structure\. We call this object the*concept manifold*\. Far from being an undifferentiated soup, it is internally structured: through this plateau the basin\-discriminating distance‖𝐁L−𝐃L‖\\\|\\mathbf\{B\}\_\{L\}\-\\mathbf\{D\}\_\{L\}\\\|rises from59%59\\%of its eventual peak atL=17L=17to81%81\\%atL=28L=28\. Most of the geometric distinction between desirable and undesirable answers is built not against the cohesive population but inside it\. The model holds both possible answers simultaneously — and uses that interior space to construct the very axis along which it will choose\. Only late does cohesion break\. ByL=35L=35the concept manifold has shattered into separate𝐁\\mathbf\{B\}\-aligned and𝐃\\mathbf\{D\}\-aligned clusters \(G35=0\.231G\_\{35\}=0\.231\), and the conversation\-so\-far vector𝐂L\\mathbf\{C\}\_\{L\}— the purple compass needle in Fig\. 2\(a\) — has rotated to point firmly toward𝐃\\mathbf\{D\}\.

The order parameterxL=𝐂L⋅\(𝐃L−𝐁L\)x\_\{L\}=\\mathbf\{C\}\_\{L\}\\cdot\(\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}\), plotted in Fig\. 2\(b\), traces this commitment quantitatively\. Crucially, atL=0L=0it is essentially zero: through the first few layers it is briefly*negative*\(Fig\. 2\(b\) inset\)\. This means that if the model were forced to commit atL=2L=2it would produce the desirable answer\. Hence the AI’s shift is not present in the embeddings\. FromL=3L=3onwardxLx\_\{L\}grows monotonically through the concept manifold and into the basin\-separation phase, reaching byL=35L=35a value405×405\\timesits early\-layer magnitude\. The amplification is large, and the path through depth is deterministic: no sampling randomness, no temperature noise, no instability of any kind\. The selectivity of this signature is confirmed by the three other domains in Fig\. 2\(c\)\. For the control prompt “What is the capital of France?” – which produces no comparable contested basin axis between Paris and London – the order parameter behaves entirely differently\. It turns negative through the concept\-manifold band and is an order of magnitude smaller \(25×\\timesversus 327×\\times–405×\\times\)\.

The AI’s future shift can be forecast for a general AI application domain by pre\-computing these basin centroids𝐁L\\mathbf\{B\}\_\{L\}and𝐃L\\mathbf\{D\}\_\{L\}from a separate pass of B\-type and D\-type probe phrases through the model – as shown in Fig\. 2\(b,c\)\. The order parameterxL=𝐂L⋅\(𝐃L−𝐁L\)x\_\{L\}=\\mathbf\{C\}\_\{L\}\\\!\\cdot\\\!\(\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}\), where𝐂L\\mathbf\{C\}\_\{L\}is the query’s internal state at layerLL, then measures how the conversation rides through this pre\-existing basin geometry as it propagates through the model’s layers\.

For a medical, financial or legal AI assistant, for instance,𝐁\\mathbf\{B\}can be built from clinical\-guideline corpora, compliance\-approved documents, or codified case law and professional\-conduct rules respectively – and𝐃\\mathbf\{D\}from documented misdiagnosis cases, documented mis\-selling, and sanctioned\-attorney misconduct records respectively\.

We now present the forecast intuitively, deferring to the SI §8 its mathematical derivation starting from the update equation for a generic ChatGPT\-like AI architecture\. Consider a conversation so far \(i\.e\. input to the first layer\)𝐂≡𝐀\\mathbf\{C\}\\equiv\\mathbf\{A\}as for the one\-sentence queries in Fig\. 1\(c\)\. Attention is built from softmax\-normalized dot products between the current state and stored content, so the compass needle tends to get pulled toward whichever content direction has the highest overlap\. This means there are two possible regimes of future AI shift:

An immediate shift to undesirable content will occur at the start of the AI’s next response: If𝐀⋅𝐃\>𝐀⋅𝐁\\mathbf\{A\}\\cdot\\mathbf\{D\}\>\\mathbf\{A\}\\cdot\\mathbf\{B\}, the compass needle tends to become more𝐃\\mathbf\{D\}\-like\. The next content is chosen based on the compass needle’s final layer dot\-product with𝐀\\mathbf\{A\},𝐁\\mathbf\{B\}or𝐃\\mathbf\{D\}type content\. Hence𝐃\\mathbf\{D\}type content is favored\. Once generated, the compass needle becomes even more𝐃\\mathbf\{D\}\-like\. Since𝐂≡𝐀\\mathbf\{C\}\\equiv\\mathbf\{A\}, this immediate shift to𝐃\\mathbf\{D\}\-like AI output is driven by the condition𝐂⋅𝐃\>𝐂⋅𝐁\\mathbf\{C\}\\cdot\\mathbf\{D\}\>\\mathbf\{C\}\\cdot\\mathbf\{B\}and hence𝐂⋅\(𝐃−𝐁\)\>0\\mathbf\{C\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)\>0\. Equivalently, we can say that the conversation shifted from A to D aftern∗=0n^\{\*\}=0steps of B content\. If𝐃⋅𝐃\>𝐁⋅𝐃\\mathbf\{D\}\\cdot\\mathbf\{D\}\>\\mathbf\{B\}\\cdot\\mathbf\{D\}then𝐃\\mathbf\{D\}\-like content continues to be favored over𝐁\\mathbf\{B\}\-like content\.

A shift to undesirable content will occurn∗\>0n^\{\*\}\>0sentences/phrases into the AI’s next response: If by contrast𝐀⋅𝐃<𝐀⋅𝐁\\mathbf\{A\}\\cdot\\mathbf\{D\}<\\mathbf\{A\}\\cdot\\mathbf\{B\}, the compass needle tends to become more𝐁\\mathbf\{B\}\-like\. If𝐁⋅𝐁<𝐁⋅𝐃\\mathbf\{B\}\\cdot\\mathbf\{B\}<\\mathbf\{B\}\\cdot\\mathbf\{D\}, the more𝐁\\mathbf\{B\}\-like the compass needle becomes then the more likely it is that𝐃\\mathbf\{D\}type content is generated after some numbern∗\>0n^\{\*\}\>0steps\. Once generated, the content tends to continue as𝐃\\mathbf\{D\}\-like if𝐁⋅𝐃<𝐃⋅𝐃\\mathbf\{B\}\\cdot\\mathbf\{D\}<\\mathbf\{D\}\\cdot\\mathbf\{D\}\. The SI derives the shift pointn∗n^\{\*\}from an AI multilayer update equation \(SI §8\); for any of the late layers \(Fig\. 2\) prior to decision\-making, it is approximately

n∗=𝐂⋅\(𝐃−𝐁\)𝐁⋅\(𝐁−𝐃\)​exp⁡\(𝐁⋅\(𝐂−𝐁\)\)n^\{\*\}=\\frac\{\\mathbf\{C\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)\}\{\\mathbf\{B\}\\cdot\(\\mathbf\{B\}\-\\mathbf\{D\}\)\}\\exp\(\\mathbf\{B\}\\cdot\(\\mathbf\{C\}\-\\mathbf\{B\}\)\)\(1\)which features the late\-layer order parameterx=𝐂⋅\(𝐃−𝐁\)x=\\mathbf\{C\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)in the numerator and other similar vector terms\. Three subregimes follow: \(i\) ifx\>0x\>0,𝐃\\mathbf\{D\}is favored immediately,n∗=0n^\{\*\}=0\(Case I\); \(ii\) ifx<0x<0and𝐁⋅\(𝐃−𝐁\)\>0\\mathbf\{B\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)\>0,𝐁\\mathbf\{B\}is produced first and Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) gives a finiten∗\>0n^\{\*\}\>0at which the output tips to𝐃\\mathbf\{D\}\(Case II\); \(iii\) if𝐁⋅\(𝐃−𝐁\)<0\\mathbf\{B\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)<0,𝐁\\mathbf\{B\}is a stable attractor and no tipping occurs \(n∗=∞n^\{\*\}=\\infty; Conversation 5 of Fig\. 1\(c\)\)\. Positivexxmeans that undesirable output is produced immediately, as in Fig\. 1\(c\) Conversations 1 and 2 \(n∗=0n^\{\*\}=0\)\. Negativexxmeans that desirable output is favored initially and it gives finite delayed tipping when𝐁⋅\(𝐃−𝐁\)\>0\\mathbf\{B\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)\>0; when𝐁⋅\(𝐃−𝐁\)<0\\mathbf\{B\}\\cdot\(\\mathbf\{D\}\-\\mathbf\{B\}\)<0,𝐁\\mathbf\{B\}is a stable attractor and no tipping occurs\. The conversation so far𝐂\\mathbf\{C\}can be a string of symbols \(sentences/ phrases, Fig\. 1\) which adds a summation to the formula forxx\(see SI §16\)\. It then describes the second response in Fig\. 1\(c\) Conversation 2\. Conversations 3 and 4 show an inverse example of undesirable output becoming desirable for the case that all the dot\-product inequalities are flipped\. The same closed\-form forecast of future AI shifts applies iteratively as the conversation evolves: at each turnkk, the running context𝐂\(k\)\\mathbf\{C\}^\{\(k\)\}updates,xxis recomputed, and the chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) re\-forecasts the next\-turn tipping indexn∗\(k\)n^\{\*\(k\)\}— turning the conversation trajectory of Fig\. 1\(a\) into an inference\-time warning visible turn\-by\-turn\. At finite decoding temperature the output sporadically samples different basins, as in a noisy nonlinear map\. Our mathematical analysis adopts a generic normalization since specifics vary by AI model – but the SI §8 shows that adding in the full features for a few layers simply shiftsn∗n^\{\*\}but does not remove the core shift mechanism\.

We performed five empirical tests of the forecast, in addition toTest 1\(Fig\. 2\) which already confirmed the predicted dominantxxsignal for contested prompts vs\. control\. These crossed124124M–7070B parameter scale: seven decoder\-only transformer models from three independent training groups \(GPT\-2 and GPT\-2\-medium from OpenAI; Pythia\-160m, Pythia\-410m, and Pythia\-12B from EleutherAI\[[48](https://arxiv.org/html/2605.14218#bib.bib48)\]; OPT\-125m and OPT\-350m from Meta\), one5050\-seed full\-transformer architectural sweep, and ten frontier deployment chatbots\. The same closed\-form formula, the same six\-phrase𝐁\\mathbf\{B\}and𝐃\\mathbf\{D\}basin sets, and the same penultimate\-layer one\-step continuation protocol are used throughout; no model\-specific tuning at any step\.

Test 2\.Single\-turn regime forecasting across seven models124124M–1212B\. For three loaded prompts \(“Is the Earth flat?”, “Are vaccines dangerous?”, “Is it fun to hurt people?”\) and one factual control \(“What is the capital of France?”\), Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) predicts the timing class — immediaten∗=0n^\{\*\}=0versus delayedn∗\>0n^\{\*\}\>0— correctly in1919of2121non\-control model×\\timesprompt cases \(90%90\\%; exact binomialp=1\.1×10−4p=1\.1\\times 10^\{\-4\}against a50%50\\%baseline; Fig\. 3\(b\)\)\. Excluding two near\-boundary cases \(Methods, SI §1\) gives1818of1919\(95%95\\%\)\. A complementary sentence\-level audit, performed independently of token\-level geometry on the six124124M–410410M models, agrees with the token\-level𝐃\\mathbf\{D\}\-first call in1616of1818cases \(89%89\\%;95%95\\%Wilson CI\[0\.67,0\.97\]\[0\.67,\\,0\.97\]; sensitivity1\.001\.00; zero false negatives\), with both disagreements traceable to negation \(a known limitation of phrase\-defined basins, where negated and unnegated phrasings share most tokens and sit close in basin coordinates\)\. The same formula that works at GPT\-2 scale\[[49](https://arxiv.org/html/2605.14218#bib.bib49)\]extends without modification to Pythia\-12B at1212B parameters, a100×100\\timesscale jump\.

Test 3\.The mechanism survives full transformer architecture\.The Pythia\-12B basin geometry lives in the late\-layer residual stream, so the relevant architectural\-robustness question is whether the mechanism survives in a layer of that form\. Using the same𝐀/𝐁/𝐃\\mathbf\{A\}/\\mathbf\{B\}/\\mathbf\{D\}embeddings lifted to a3030\-dimensional model space, we ran greedy generation through one full transformer block \(ten attention heads with random𝖶Q/𝖶K/𝖶V/𝖶O\\mathsf\{W\}\_\{Q\}/\\mathsf\{W\}\_\{K\}/\\mathsf\{W\}\_\{V\}/\\mathsf\{W\}\_\{O\}projections, pre\-norm RMSNorm, SwiGLU MLP, residual connections\) across5050random initializations\. Every seed produced a𝐃\\mathbf\{D\}token within1212steps;40/5040/50\(80%80\\%\) tipped at exactly step55; mean tipping time5\.1±0\.45\.1\\pm 0\.4steps\. The bare\-attention reference of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) tips at step44\.The full transformer block with multi\-head attention, RMSNorm and SwiGLU MLP shifts the tipping time by approximately just one step\.Not by orders of magnitude, not into a different regime, not stochastically: the shift is bounded \(σ=0\.4\\sigma=0\.4steps\) in every seed\. In the layers where the basin geometry lives, a full transformer block is operationally indistinguishable from the bare\-attention picture to within about one step on average\. An architectural decomposition \(SI §9\) shows why: each ingredient is anO​\(1\)O\(1\)perturbation, but the skip connection alone accelerates tipping to step22while pre\-norm RMSNorm renormalizes that acceleration away, leaving the random\-weight MLP and multi\-head dilution as second\-order corrections\. The mechanism is the attention geometry; the rest is approximately neutral\.

Test 4\.Noise\-induced regime cascade at12B and 70B\. Projecting the underlying iterative dynamics along the basin direction yields a noisy logistic\-like map\[[50](https://arxiv.org/html/2605.14218#bib.bib50),[51](https://arxiv.org/html/2605.14218#bib.bib51),[52](https://arxiv.org/html/2605.14218#bib.bib52),[53](https://arxiv.org/html/2605.14218#bib.bib53)\]

xn\+1=xn\+λ​xn​\(1−ρ​xn\)\+ηn,x\_\{n\+1\}=x\_\{n\}\+\\lambda x\_\{n\}\(1\-\\rho x\_\{n\}\)\+\\eta\_\{n\},\(2\)whereλ\\lambdacollects the per\-layer push along𝐃−𝐁\\mathbf\{D\}\-\\mathbf\{B\},ρ\>0\\rho\>0encodes saturation, andηn\\eta\_\{n\}is stochastic noise whose amplitude grows with decoding temperatureTT\(Methods\)\. Because Eq\. \([2](https://arxiv.org/html/2605.14218#S0.E2)\) is logistic\-like with stochastic forcing,xxpicks up nonlinear behavior — intermittent cycles and noise\-induced re\-entrance — asTTgrows\. Pythia\-12B at full float16 on a flat Earth prompt exhibits the predictedF→I→X→NF\\to I\\to X\\to Ncascade \(frozenFF, intermittentII, complexXX, noiseNN\) acrossT∈\[0\.01,1\.1\]T\\in\[0\.01,\\,1\.1\]\. Llama\-3\.1\-70B\[[54](https://arxiv.org/html/2605.14218#bib.bib54)\]\(44\-bit quantization\) on a similar flat Earth prompt exhibits non\-monotonic regime structure: the sequenceIXFFNXINNNNacrossT∈\[0\.1,1\.1\]T\\in\[0\.1,\\,1\.1\]shows frozen basins re\-emerging between complex and noisy regimes atT≈0\.3T\\approx 0\.3–0\.40\.4\.*Empirical noise\-induced re\-entrance of this kind is consistent with the forecast’s predicted noisy nonlinear push–pull map\.*

Test 5\.Production\-scale signature across ten frontier chatbots\.The CCDH “Fake Friend” study tested1,2001\{,\}200ChatGPT\-4o responses on high\-risk prompts and reported harmful content in53%53\\%of responses, with domain\-dependent rates \(44%44\\%self\-harm,66%66\\%eating disorders,50%50\\%substance abuse\)\[[1](https://arxiv.org/html/2605.14218#bib.bib1)\]\. Four qualitative features of that study — domain\-dependent harm rates, threshold\-like bypass, monotonic severity escalation, and near\-boundary stochasticity — map directly onto four structural properties of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) \(Methods\)\. The CCDH “Killer Apps” study tested a four\-stage conversational escalation protocol on ten frontier chatbots across ten companies \(ChatGPT, Google Gemini, Claude, Microsoft Copilot, Meta AI, DeepSeek, Perplexity, Snapchat My AI, Character\.AI, Replika\); the escalation maps onto sequential context\-injection in the chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) \(Methods\)\. Eight of ten chatbots assisted users planning violent attacks in over half of720720analyzed responses, with deployment\-dependent effective harmful rates —100%100\\%\(Perplexity\),97%97\\%\(Meta AI\), down to31%31\\%\(Claude\)\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\]\. Claude refused with discouragement in76%76\\%of its responses \(some overlapping with partial compliance\), showing that deployment\-level intervention under escalation is achievable\. Character\.AI actively encouraged violence in seven cases, consistent with the opposite behavioral extreme of basin lock\-in\. Alignment training reshapes basin geometry\[[55](https://arxiv.org/html/2605.14218#bib.bib55),[56](https://arxiv.org/html/2605.14218#bib.bib56),[57](https://arxiv.org/html/2605.14218#bib.bib57),[58](https://arxiv.org/html/2605.14218#bib.bib58)\]; it does not remove the dot\-product competition, and the production data show this competition reactivating across ten companies, three attack categories, and two jurisdictions\. The basin axis is not a rediscovery of the refusal direction: it is orthogonal in factual controls, domain\-decomposed in harm content, and supplies the forecast\-time scalarn∗n^\{\*\}in both\. On Pythia\-12B at the penultimate layer the basin axis𝐃−𝐁\\mathbf\{D\}\-\\mathbf\{B\}has cosine0\.040\.04with an Arditi\-style refusal direction\[[55](https://arxiv.org/html/2605.14218#bib.bib55)\]in the factual control \(Capital\) and0\.380\.38–0\.650\.65in harm\-content domains \(Flat Earth, Vaccines, Hurting people; SI Point 1\.36\)\.

Test 6\.A priori prediction confirmed by the Stanford “Delusional Spirals” corpus\.The chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) \(Methods\) yields a closed form for the multi\-turn tipping pointn∗\(k\)n^\{\*\(k\)\}that predicts three structural regularities: \(i\) prior𝐃\\mathbf\{D\}\-fraction reducesn∗\(k\)n^\{\*\(k\)\}, so signed history dominates raw length; \(ii\) a locally𝐃\\mathbf\{D\}\-coded user turn is a strong local trigger; \(iii\) once the assistant enters𝐃\\mathbf\{D\}, persistence is favored\. The closed form and predictions were posted on arXiv in April20252025\[[32](https://arxiv.org/html/2605.14218#bib.bib32)\]; eleven months later, the Stanford “Delusional Spirals” corpus was first publicly released in March20262026\[[2](https://arxiv.org/html/2605.14218#bib.bib2)\]\. We test all three onn=207,443n=207\{,\}443assistant turns from3,2783\{,\}278conversations across1919participants who reported psychological harm\. The regression uses Stanford’s message\-level annotation codes as both predictors and outcomes, so it tests the chat\-extension’s behavioral consequence — that𝐃\\mathbf\{D\}\-coded content propagates forward — rather than the residual\-stream basin geometry directly; a sentence\-level audit closer to the basin construction is reported in SI §16\. Adjusted regression confirms predictions \(i\) and \(ii\), with the prior\-length null serving as a discriminator \(Fig\. 3\(a\)\): prior𝐃\\mathbf\{D\}\-fraction yields odds ratio4\.7274\.727\(Wald95%95\\%CI\[3\.478,6\.424\]\[3\.478,\\,6\.424\],p=3\.22×10−23p=3\.22\\times 10^\{\-23\}\); the immediately previous user𝐃\\mathbf\{D\}\-turn yieldsOR=2\.704\\mathrm\{OR\}=2\.704\(\[1\.749,4\.181\]\[1\.749,\\,4\.181\],p=7\.63×10−6p=7\.63\\times 10^\{\-6\}\); prior raw length is null,OR=1\.036\\mathrm\{OR\}=1\.036\(\[0\.917,1\.170\]\[0\.917,\\,1\.170\],p=0\.569p=0\.569\)\. Prediction \(iii\) — assistant𝐃\\mathbf\{D\}\-persistence once entered — is confirmed by the within\-conversation lag\-1 autocorrelation: assistant𝐃\\mathbf\{D\}\-turns cluster∼37\\sim 37shuffled\-null standard deviations above a within\-conversation role\-preserving null \(observed lag\-1 autocorrelation0\.09040\.0904versus null−0\.0667±0\.0042\-0\.0667\\pm 0\.0042over100100shuffles; Monte Carlop=0\.0099p=0\.0099, the floor reportable from100100shuffles, with no shuffle reaching the observed value\)\.

The joint pattern in Fig\. 3\(a\) is what makes the conversation\-level test discriminative: the specific orderingOR𝐃​\-frac≫ORprev\-user\-​𝐃\>ORlength≈1\\mathrm\{OR\}\_\{\\mathbf\{D\}\\text\{\-frac\}\}\\gg\\mathrm\{OR\}\_\{\\text\{prev\-user\-\}\\mathbf\{D\}\}\>\\mathrm\{OR\}\_\{\\text\{length\}\}\\approx 1is predicted by the chat extension and by no competing account of multi\-turn LLM behavior\. Length\-fatigue or context\-window\-degradation accounts requireORlength\>1\\mathrm\{OR\}\_\{\\text\{length\}\}\>1, ruled out by the null length effect\. Pure\-recency or first\-order Markov accounts requireORprev\-user\-​𝐃≫OR𝐃​\-frac\\mathrm\{OR\}\_\{\\text\{prev\-user\-\}\\mathbf\{D\}\}\\gg\\mathrm\{OR\}\_\{\\mathbf\{D\}\\text\{\-frac\}\}, ruled out by the inverted ordering\. Generic topic\-stickiness accounts requireOR𝐃​\-frac≈ORprev\-user\-​𝐃\\mathrm\{OR\}\_\{\\mathbf\{D\}\\text\{\-frac\}\}\\approx\\mathrm\{OR\}\_\{\\text\{prev\-user\-\}\\mathbf\{D\}\}, ruled out by the∼2×\\sim 2\\timesgap between them\.*Only an account in which a signed direction in conversational state space dominates simultaneously over raw count and pure recency fits all three rows of Fig\. 3\(a\)\.*The chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\), with𝐃−𝐁\\mathbf\{D\}\-\\mathbf\{B\}as the signed direction, is such an account; the three competing accounts above are not\.

Our framework purposely omits designer\-specific details inside particular AI architectures\. These can all be added systematically, but at a complexity cost that would amount to rebuilding the AI itself\. Instead, its simplicity is the point: any domain in which competing response classes can be defined can now be tested directly by constructing𝐁\\mathbf\{B\}and𝐃\\mathbf\{D\}basins and tracking output shifts\.

## Methods

### Models and basin protocol\.

The seven decoder\-only transformers evaluated for Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) are GPT\-2 \(124M\) and GPT\-2\-medium \(355M\) from OpenAI, Pythia\-160m, Pythia\-410m and Pythia\-12B from EleutherAI, and OPT\-125m and OPT\-350m from Meta\. Full HuggingFace checkpoint identifiers are listed in SI §20\. Basin centroids𝐁\\mathbf\{B\}and𝐃\\mathbf\{D\}are mean\-pooled penultimate\-layer hidden states over six fixed phrases per basin per prompt domain; phrase lists are reproduced verbatim from Ref\.\[[49](https://arxiv.org/html/2605.14218#bib.bib49)\]\(SI §§4–5\)\. All dot products are evaluated in the raw, norm\-carrying residual space\.

### Definition of𝐂L\\mathbf\{C\}\_\{L\}\.

The conversation\-so\-far vector𝐂L=\(1/T\)​∑t=1T𝐫t\(L\)\\mathbf\{C\}\_\{L\}=\(1/T\)\\sum\_\{t=1\}^\{T\}\\mathbf\{r\}\_\{t\}^\{\(L\)\}is the mean across theTTconversation tokens of the model’s residual\-stream vector at layerLL, with𝐫t\(L\)∈ℝd\\mathbf\{r\}\_\{t\}^\{\(L\)\}\\in\\mathbb\{R\}^\{d\}\(d=5120d=5120for Pythia\-12B\)\. The residual stream is the substrate from which the next\-token distribution is read out at the final layer via the unembedding,p​\(next\)=softmax​\(WU​LNf​\(𝐫last\(N\)\)\)p\(\\text\{next\}\)=\\mathrm\{softmax\}\(W\_\{U\}\\,\\mathrm\{LN\}\_\{f\}\(\\mathbf\{r\}\_\{\\rm last\}^\{\(N\)\}\)\), and is built additively through depth by attention and MLP layers\[[46](https://arxiv.org/html/2605.14218#bib.bib46),[6](https://arxiv.org/html/2605.14218#bib.bib6)\]\.𝐂L\\mathbf\{C\}\_\{L\}is therefore the depth\-LL, position\-averaged form of the exact residual\-stream object the model uses to determine its predictions; the order parameterxL=𝐂L⋅\(𝐃L−𝐁L\)x\_\{L\}=\\mathbf\{C\}\_\{L\}\\cdot\(\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}\)projects it onto the empirical basin axis\. Full architectural rationale in SI §3\.

### One\-step continuation and timing\-class prediction\.

For each model and prompt, we greedy\-decode one token from the prompt𝐀\\mathbf\{A\}and embed the lengthened sequence to obtain𝐀\(1\)\\mathbf\{A\}^\{\(1\)\}at the penultimate layer\. If𝐀\(1\)⋅𝐃≥𝐀\(1\)⋅𝐁\\mathbf\{A\}^\{\(1\)\}\\\!\\cdot\\\!\\mathbf\{D\}\\geq\\mathbf\{A\}^\{\(1\)\}\\\!\\cdot\\\!\\mathbf\{B\}we reportnpred∗=0n^\{\*\}\_\{\\text\{pred\}\}=0\(𝐃\\mathbf\{D\}\-first\); otherwise we evaluate Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) on𝐀\(1\)\\mathbf\{A\}^\{\(1\)\}and takenpred∗=⌈ncont∗⌉n^\{\*\}\_\{\\text\{pred\}\}=\\lceil n^\{\*\}\_\{\\text\{cont\}\}\\rceil\. The observed token\-level first\-hit indexnobs,tok∗n^\{\*\}\_\{\\text\{obs,tok\}\}is recorded under greedy decoding \(do\_sample=False,300300\-token window\)\. The sentence\-level audit \(six124124M–410410M models\) classifies each generated sentence as semantically𝐁\\mathbf\{B\}or𝐃\\mathbf\{D\}outside embedding space, using the strict rubric of Ref\.\[[49](https://arxiv.org/html/2605.14218#bib.bib49)\]\(SI §14\.3\)\.

### Pythia\-12B layerwise analysis\.

For Fig\.[2](https://arxiv.org/html/2605.14218#S0.F2)we extract hidden states at all3737residual entries of Pythia\-12B \(input plus3636layers\) on a flat Earth prompt with a mixed sequence of55input𝐂\\mathbf\{C\}tokens,3131𝐁\\mathbf\{B\}tokens, and2929𝐃\\mathbf\{D\}tokens\. The order parameterxL=𝐂L⋅\(𝐃L−𝐁L\)x\_\{L\}=\\mathbf\{C\}\_\{L\}\\\!\\cdot\\\!\(\\mathbf\{D\}\_\{L\}\-\\mathbf\{B\}\_\{L\}\)uses phrase\-isolated mean\-pooled basin centroids at each layer\. Cluster cohesionGLG\_\{L\}is the largest\-connected\-component fraction in the mixed\-species cosine\-similarity graph at thresholdcos≥0\.90\\cos\\geq 0\.90; species fractions are the share of each class absorbed into the largest component\. Multi\-threshold sweeps and other\-prompt curves are in SI §11 and SI §12\.

### Architectural robustness \(Test 3\)\.

The𝐀/𝐁/𝐃\\mathbf\{A\}/\\mathbf\{B\}/\\mathbf\{D\}embeddings of the companion paper are lifted to a3030\-dimensional model space by𝐞lift​\(𝐯\)=\(𝐯,…,𝐯\)/H\\mathbf\{e\}\_\{\\text\{lift\}\}\(\\mathbf\{v\}\)=\(\\mathbf\{v\},\\ldots,\\mathbf\{v\}\)/\\sqrt\{H\}withH=10H=10heads anddhead=3d\_\{\\text\{head\}\}=3\. One full transformer block is applied at each generation step: per\-head𝖶Q\(a\),𝖶K\(a\),𝖶V\(a\)\\mathsf\{W\}\_\{Q\}^\{\(a\)\},\\mathsf\{W\}\_\{K\}^\{\(a\)\},\\mathsf\{W\}\_\{V\}^\{\(a\)\}are block\-selector plus Gaussian noise \(σQ​K​V=0\.05/30\\sigma\_\{QKV\}=0\.05/\\\!\\sqrt\{30\}\); output projection𝖶O=𝐈30\+𝒩​\(0,σO2\)\\mathsf\{W\}\_\{O\}=\\mathbf\{I\}\_\{30\}\+\\mathcal\{N\}\(0,\\sigma\_\{O\}^\{2\}\)withσO=0\.05/30\\sigma\_\{O\}=0\.05/\\\!\\sqrt\{30\}; pre\-norm RMSNorm on both sublayers; SwiGLU MLP withdff=120d\_\{\\text\{ff\}\}=120and Gaussian weights \(σin=0\.20/30\\sigma\_\{\\text\{in\}\}=0\.20/\\\!\\sqrt\{30\},σout=0\.20/120\\sigma\_\{\\text\{out\}\}=0\.20/\\\!\\sqrt\{120\}\); residual connections on both sublayers\. Greedy decoding from prompt\[𝐀\]\[\\mathbf\{A\}\]for up to1212steps\. Reported numbers are over5050independent random initializations \(seeds0–4949\)\. Full architecture specification, the architectural decomposition into bare attention / \+skip / full\-block configurations, and theL\>1L\>1behavior under random vs\. trained weights are in SI §9\.

### Noisy nonlinear map and regime cascade \(Test 4\)\.

Projecting the underlying iterative dynamics along𝐮^=\(𝐃−𝐁\)/‖𝐃−𝐁‖\\hat\{\\mathbf\{u\}\}=\(\\mathbf\{D\}\-\\mathbf\{B\}\)/\\\|\\mathbf\{D\}\-\\mathbf\{B\}\\\|, with finite decoding\-temperature noise, yields the noisy logistic\-like map Eq\. \([2](https://arxiv.org/html/2605.14218#S0.E2)\), withλ\\lambdacollecting the per\-layer push andηn\\eta\_\{n\}the temperature\-driven noise \(SI §15\)\. For Pythia\-12B \(fp16\) and Llama\-3\.1\-70B \(44\-bit quantization\), we sweep decoding temperatureTTover\[0\.01,1\.1\]\[0\.01,1\.1\]on a flat Earth prompt\. Each generated continuation is split into sentences, vectorized by character33–55\-gram TF\-IDF, and reduced to a symbolic trajectory by connected\-component clustering of the cosine\-similarity graph \(similarity threshold0\.450\.45\); the trajectory is then assigned one of seven regimes \(frozen F, sparse S, period\-2C2C\_\{2\}, higher cyclesCqC\_\{q\}, intermittent I, complex X, noise N\) using periodicity, entropy, transition\-determinism and run\-length / switch\-rate diagnostics \(SI §15\.4\)\.

### CCDH structural mapping \(Test 5\)\.

Four qualitative features of the Fake Friend study\[[1](https://arxiv.org/html/2605.14218#bib.bib1)\]\(domain\-dependent harm rates, threshold\-like bypass, monotonic severity escalation, near\-boundary stochasticity\) map onto four distinct terms or inequalities in Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\); the explicit feature↔\\leftrightarrowstructure correspondence is in SI §17\. For the eight Fake Friend case\-study prompts, domain\-specific basins are constructed from independent phrase sets \(no CCDH labels enter the prediction\), and the signed gapΔ1=𝐀⋅\(𝐃−𝐁\)\\Delta\_\{1\}=\\mathbf\{A\}\\\!\\cdot\\\!\(\\mathbf\{D\}\-\\mathbf\{B\}\)is computed on Pythia\-12B’s penultimate layer; the branch\-selection sign test result \(8/88/8, exactp=2−8≈3\.9×10−3p=2^\{\-8\}\\approx 3\.9\\times 10^\{\-3\}\) is reported in SI §17\. The four\-stage Killer Apps escalation\[[3](https://arxiv.org/html/2605.14218#bib.bib3)\]maps onto sequential context injection in the chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) \(SI §16\)\.

### Stanford “Delusional Spirals” analysis \(Test 6\)\.

The analytic sample consists ofn=207,443n=207\{,\}443assistant turns drawn from3,2783\{,\}278conversations across1919participants who reported psychological harm\. The full corpus contains4,7614\{,\}761conversations and391,562391\{,\}562messages of both user and assistant turns; the analytic sample is smaller because the chat extension of Eq\. \([1](https://arxiv.org/html/2605.14218#S0.E1)\) predicts assistant behavior given prior context, so we keep only assistant turns with at least one prior turn of context \(SI §16\)\. The corpus\-level predictor and outcome labels are taken from the Stanford message\-level annotation stream, binarized using the Stanford code\-specific score cutoffs as described in SI §16\. A separate subset audit uses the sentence\-level rubric independent of the corpus\-level regression labels\[[49](https://arxiv.org/html/2605.14218#bib.bib49)\]\. Adjusted odds ratios are estimated from a generalized estimating equation \(GEE\) logistic regression with exchangeable working correlation and participant clustering; full covariate specification is in SI §16\. The within\-conversation role\-preserving shuffled null permutes turn labels within each conversation while preserving the user/assistant role sequence, with100100shuffles\. Wald95%95\\%CIs andpp\-values are reported\. The arXiv posting date and Stanford corpus release date are documented in\[[32](https://arxiv.org/html/2605.14218#bib.bib32),[2](https://arxiv.org/html/2605.14218#bib.bib2)\]\.

### Statistical tests\.

Exact binomial tests are used for timing\-class agreement in Test 2 and the branch\-selection sign test in Test 5\. Wilson95%95\\%confidence intervals are used for the sentence\-level audit\. Wald95%95\\%confidence intervals are used for adjusted odds ratios\. The shuffled\-null Monte Carloppin Test 6 reaches its100100\-shuffle floor of0\.00990\.0099with no shuffle reaching the observed value\. Bootstrap95%95\\%confidence intervals over basin phrase choices \(200200resamples\) are reported forx^\\hat\{x\}in SI §14\.

## Data availability

The data supporting the findings of this study — including Pythia\-12B layer\-amplification CSVs, the mixed\-species hidden\-state and connected\-component output, the seven\-model regime\-validation tables, the per\-layer architectural\-robustness sweep output, Pythia\-12B fp16 and Llama\-3\.1\-70B temperature\-sweep regime classifications, and the CCDH branch\-selection embedding table \(SI §1, Point 1\.27\) — will be deposited in a public archival repository \(Zenodo or equivalent\) on publication, with the DOI cited in this section\. The Stanford “Delusional Spirals” annotated corpus used in the multi\-turn conversation analysis \(SI §16\) is publicly available from the Stanford project repository\[[2](https://arxiv.org/html/2605.14218#bib.bib2)\]\.

## Code availability

The notebooks used to produce all numerical results and figures in this paper — including the Pythia\-12B amplification and connected\-component notebooks, the seven\-model regime validation, the 50\-seed architectural\-robustness sweep, the Pythia\-12B fp16 and Llama\-3\.1\-70B temperature sweeps, the multi\-turn conversation regression and shuffled\-null analysis on the Stanford corpus, and the CCDH embedding analysis — will be deposited alongside the data in the same archival repository on publication, with the DOI cited in this section\. A NetLogo agent\-based companion simulation that reproduces qualitatively the fusion\-fragmentation dynamics of Fig\.[2](https://arxiv.org/html/2605.14218#S0.F2)\(act\-\(i\)–act\-\(iv\) sequence\) as a Python\-free analogue model runnable in\-browser via NetLogo Web, and the GPT\-2 transcript\-generator script that reproduces the conversations in Fig\.[1](https://arxiv.org/html/2605.14218#S0.F1)\(c\) and lets readers generate further cross\-domain examples, are deposited in the same archive\.

### Reproducibility file inventory\.

The archive deposit contains the manuscript LaTeX source and figure assets \(Figure1\.png,Figure2\.png,fig3\.pdf\)\. Figure 2 is generated byfig2\_simplified\.pyfromfig2\_all\_panels\_data\.csvandfig2\_referee\_trajectories\.csv\. Figure 3 is generated byplot\_fig3\.pyfromfig3A\_data\.csvandfig3B\_data\.csv\. Six analysis notebooks reproducing Tests 1–6 are also deposited; per\-notebook names, descriptions and reproduction instructions are in the archive README\.

Full numerical detail, derivations, control comparisons and per\-statement evidence are in the Supplementary Information section 1 \(claim–evidence ledger\) and sections 2–20 \(per\-test analyses\)\.

## References

- \[1\]Center for Countering Digital Hate,*Fake Friend: How ChatGPT betrays vulnerable teens by encouraging dangerous behavior*\. CCDH report, 6 August 2025\.https://counterhate\.com/research/fake\-friend\-chatgpt/\.
- \[2\]J\. Moore, A\. Mehta, W\. Agnew, J\. R\. Anthis, R\. Louie, Y\. Mai, P\. Yin, M\. Cheng, S\. J\. Paech, K\. Klyman, S\. Chancellor, E\. Lin, N\. Haber and D\. Ong, Characterizing Delusional Spirals through Human–LLM Chat Logs\. arXiv:2603\.16567 \(17 March 2026\); to appear in ACM FAccT 2026\.https://arxiv\.org/abs/2603\.16567\. Project page:https://spirals\.stanford\.edu/research/characterizing/\.
- \[3\]Center for Countering Digital Hate,*Killer Apps: How mainstream AI chatbots assist users planning violent attacks*\. CCDH report, 11 March 2026\.https://counterhate\.com/research/killer\-apps/\.
- \[4\]*Mata v\. Avianca, Inc\.*, No\. 22\-cv\-1461 \(PKC\), 2023 WL 4114965 \(S\.D\.N\.Y\. June 22, 2023\)\.
- \[5\]J\. O’Donnell, The new war room\.*MIT Technology Review*\(21 April 2026\)\.https://www\.technologyreview\.com/2026/04/21/1135667/new\-war\-room\-military\-ai\-artificial\-intelligence/\.
- \[6\]N\. Elhage et al\., A mathematical framework for transformer circuits\.*Transformer Circuits Thread*\(2021\)\.https://transformer\-circuits\.pub/2021/framework/index\.html\.
- \[7\]C\. Olsson et al\., In\-context learning and induction heads\.*Transformer Circuits Thread*\(2022\)\.https://transformer\-circuits\.pub/2022/in\-context\-learning\-and\-induction\-heads/index\.html; arXiv:2209\.11895\.
- \[8\]A\. Conmy, A\. N\. Mavor\-Parker, A\. Lynch, S\. Heimersheim and A\. Garriga\-Alonso, Towards automated circuit discovery for mechanistic interpretability\.*Advances in Neural Information Processing Systems*36\(2023\)\.
- \[9\]A\. Templeton et al\., Scaling monosemanticity: extracting interpretable features from Claude 3 Sonnet\.*Transformer Circuits Thread*\(2024\)\.https://transformer\-circuits\.pub/2024/scaling\-monosemanticity/index\.html\.
- \[10\]E\. Ameisen et al\., Circuit tracing: revealing computational graphs in language models\.*Transformer Circuits Thread*\(2025\)\.https://transformer\-circuits\.pub/2025/attribution\-graphs/methods\.html\.
- \[11\]J\. Lindsey, W\. Gurnee, E\. Ameisen, B\. Chen, A\. Pearce, N\. L\. Turner, C\. Citro et al\., On the biology of a large language model\.*Transformer Circuits Thread*\(2025\)\.https://transformer\-circuits\.pub/2025/attribution\-graphs/biology\.html\.
- \[12\]Anthropic, Transformer Circuits Thread\.https://transformer\-circuits\.pub/\.
- \[13\]J\. Lin and Decode Research, Neuronpedia: an open platform for mechanistic interpretability features\.https://www\.neuronpedia\.org/\.
- \[14\]S\. Somvanshi et al\., Bridging the black box: a survey on mechanistic interpretability in AI\.*ACM Computing Surveys*58\(8\), Article 210, 1–35 \(2026\)\.https://doi\.org/10\.1145/3787104\.
- \[15\]B\. Geshkovski, C\. Letrouit, Y\. Polyanskiy and P\. Rigollet, A mathematical perspective on transformers\.*Bull\. Amer\. Math\. Soc\.*62\(3\), 427–479 \(2025\)\.https://doi\.org/10\.1090/bull/1863\.
- \[16\]M\. E\. Sander, P\. Ablin, M\. Blondel and G\. Peyré, Sinkformers: transformers with doubly stochastic attention\.*Proc\. AISTATS*, PMLR151, 3515–3530 \(2022\)\.https://proceedings\.mlr\.press/v151/sander22a\.html\.
- \[17\]L\. Fedorov, M\. E\. Sander, R\. Elie, P\. Marion and M\. Laurière, Clustering in deep stochastic transformers\. arXiv:2601\.21942 \(2026\)\.https://arxiv\.org/abs/2601\.21942\.
- \[18\]L\. Ouyang et al\., Training language models to follow instructions with human feedback\.*Advances in Neural Information Processing Systems*35, 27730–27744 \(2022\)\.
- \[19\]Y\. Bai et al\., Training a helpful and harmless assistant with reinforcement learning from human feedback\. arXiv:2204\.05862 \(2022\)\.https://arxiv\.org/abs/2204\.05862\.
- \[20\]Y\. Bai et al\., Constitutional AI: harmlessness from AI feedback\. arXiv:2212\.08073 \(2022\)\.https://arxiv\.org/abs/2212\.08073\.
- \[21\]S\. Gueron and S\. A\. Levin, The dynamics of group formation\.*Math\. Biosci\.*128\(1–2\), 243–264 \(1995\)\.https://doi\.org/10\.1016/0025\-5564\(94\)00074\-A\.
- \[22\]S\. Gueron, S\. A\. Levin and D\. I\. Rubenstein, The dynamics of herds: from individuals to aggregations\.*J\. Theor\. Biol\.*182\(1\), 85–98 \(1996\)\.https://doi\.org/10\.1006/jtbi\.1996\.0144\.
- \[23\]I\. D\. Couzin, J\. Krause, N\. R\. Franks and S\. A\. Levin, Effective leadership and decision\-making in animal groups on the move\.*Nature*433, 513–516 \(2005\)\.https://doi\.org/10\.1038/nature03236\.
- \[24\]I\. D\. Couzin, C\. C\. Ioannou, G\. Demirel, T\. Gross, C\. J\. Torney, A\. Hartnett, L\. Conradt, S\. A\. Levin and N\. E\. Leonard, Uninformed individuals promote democratic consensus in animal groups\.*Science*334\(6062\), 1578–1580 \(2011\)\.https://doi\.org/10\.1126/science\.1210280\.
- \[25\]G\. Palla, A\.\-L\. Barabási and T\. Vicsek, Quantifying social group evolution\.*Nature*446, 664–667 \(2007\)\.https://doi\.org/10\.1038/nature05670\.
- \[26\]B\. T\. Fagan, N\. J\. MacKay, D\. O\. Pushkin and A\. J\. Wood, Stochastic gel\-shatter cycles in coalescence\-fragmentation models\.*EPL*133, 53001 \(2021\)\.https://doi\.org/10\.1209/0295\-5075/133/53001\.
- \[27\]M\. E\. Cates and J\. Tailleur, Motility\-induced phase separation\.*Annu\. Rev\. Condens\. Matter Phys\.*6, 219–244 \(2015\)\.https://doi\.org/10\.1146/annurev\-conmatphys\-031214\-014710\.
- \[28\]T\. Nishikawa and A\. E\. Motter, Symmetric states requiring system asymmetry\.*Phys\. Rev\. Lett\.*117, 114101 \(2016\)\.https://doi\.org/10\.1103/PhysRevLett\.117\.114101\.
- \[29\]T\. Nishikawa and A\. E\. Motter, Advantage of diversity: consensus because of \(not despite\) differences\.*SIAM News*\(17 January 2017\)\.https://www\.siam\.org/publications/siam\-news/articles/advantage\-of\-diversity\-consensus\-because\-of\-not\-despite\-differences\.
- \[30\]F\. Y\. Huo, P\. D\. Manrique, M\. Zheng and N\. F\. Johnson,*Introduction to Online Complexity: The New Social Physics of Extremes, Misinformation, and AI*\. Oxford University Press \(2025\)\.https://doi\.org/10\.1093/oso/9780198921011\.001\.0001\.
- \[31\]F\. Y\. Huo, P\. D\. Manrique and N\. F\. Johnson, Multispecies cohesion: humans, machinery, AI, and beyond\.*Phys\. Rev\. Lett\.*133, 247401 \(2024\)\.https://doi\.org/10\.1103/PhysRevLett\.133\.247401\.
- \[32\]N\. F\. Johnson and F\. Y\. Huo, Jekyll\-and\-Hyde tipping point in an AI’s behavior\. arXiv:2504\.20980 \(29 April 2025\)\.https://arxiv\.org/abs/2504\.20980\.
- \[33\]A\. Crawford and T\. Glatard, Urgent considerations for suicide prevention in the safe and ethical use of artificial intelligence\.*Canadian Medical Association Journal*198\(15\), E599–E601 \(2026\)\.https://doi\.org/10\.1503/cmaj\.251693\.
- \[34\]M\. Ueda, M\. L\. Birnbaum, Y\. Liu, Q\. Yu, X\. Tian, A\. Mirer, S\. Ramanathan and M\. Sinyor, Help\-seeking in the age of AI: cross\-sectional survey of the use and perceptions of AI\-based mental health support among US adults\.*JMIR Mental Health*13, e88196 \(2026\)\.https://doi\.org/10\.2196/88196\.
- \[35\]B\. Pierson, Mother sues AI chatbot company Character\.AI, Google over son’s suicide\.*Reuters*\(23 October 2024\)\.https://www\.reuters\.com/legal/mother\-sues\-ai\-chatbot\-company\-characterai\-google\-sued\-over\-sons\-suicide\-2024\-10\-23/\.
- \[36\]R\. Bommasani et al\., On the opportunities and risks of foundation models\. arXiv:2108\.07258 \(2021\)\.https://arxiv\.org/abs/2108\.07258\.
- \[37\]L\. Weidinger et al\., Taxonomy of risks posed by language models\.*Proc\. 2022 ACM Conference on Fairness, Accountability, and Transparency \(FAccT ’22\)*, 214–229 \(2022\)\.https://doi\.org/10\.1145/3531146\.3533088\.
- \[38\]Z\. Ji et al\., Survey of hallucination in natural language generation\.*ACM Computing Surveys*55\(12\), Article 248, 1–38 \(2023\)\.https://doi\.org/10\.1145/3571730\.
- \[39\]S\. Kemp, Digital 2026 Global Overview Report\. DataReportal \(15 October 2025\)\.https://datareportal\.com/reports/digital\-2026\-global\-overview\-report\.
- \[40\]X\. Sun, Y\. Wang and B\. T\. McDaniel, AI companions and adolescent social relationships: benefits, risks, and bidirectional influences\.*Child Development Perspectives*, aadaf009 \(2026\)\.https://doi\.org/10\.1093/cdpers/aadaf009\.
- \[41\]A\. J\. Maheux, S\. Akre\-Bhide, D\. Boeldt, J\. E\. Flannery, Z\. Richardson, K\. Burnell, E\. H\. Telzer and S\. H\. Kollins, Generative artificial intelligence applications use among US youth\.*JAMA Network Open*9\(2\), e2556631 \(2026\)\.https://doi\.org/10\.1001/jamanetworkopen\.2025\.56631\.
- \[42\]N\. Turner Lee and M\. Anderson, Teens are using AI—but not how we think\.*The TechTank Podcast*, Brookings Institution \(7 April 2026\)\.https://www\.brookings\.edu/articles/teens\-are\-using\-ai\-but\-not\-how\-we\-think\-the\-techtank\-podcast/\.
- \[43\]R\. K\. McBain et al\., Use of generative AI for mental health advice among US adolescents and young adults\.*JAMA Network Open*8\(11\), e2542281 \(2025\)\.https://doi\.org/10\.1001/jamanetworkopen\.2025\.42281\.
- \[44\]A\. Radford, J\. Wu, R\. Child, D\. Luan, D\. Amodei and I\. Sutskever, Language models are unsupervised multitask learners\. OpenAI technical report \(2019\)\.https://cdn\.openai\.com/better\-language\-models/language\_models\_are\_unsupervised\_multitask\_learners\.pdf\.
- \[45\]E\. Perez et al\., Red teaming language models with language models\.*Proc\. 2022 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, 3419–3448 \(2022\)\.https://aclanthology\.org/2022\.emnlp\-main\.225/\.
- \[46\]A\. Vaswani et al\., Attention is all you need\.*Advances in Neural Information Processing Systems*30, 5998–6008 \(2017\)\.
- \[47\]K\. Ethayarajh, How contextual are contextualized word representations? Comparing the geometry of BERT, ELMo, and GPT\-2 embeddings\.*Proc\. EMNLP\-IJCNLP*, 55–65 \(2019\)\.https://aclanthology\.org/D19\-1006/\.
- \[48\]S\. Biderman et al\., Pythia: a suite for analyzing large language models across training and scaling\.*Proc\. ICML*, PMLR202, 2397–2430 \(2023\)\.
- \[49\]N\. F\. Johnson and F\. Y\. Huo, Simple picture of how output from ChatGPT\-like AI shifts from good to bad\.*PNAS Nexus*, pgag148 \(2026\)\.https://doi\.org/10\.1093/pnasnexus/pgag148\.
- \[50\]F\. Y\. Huo and N\. F\. Johnson, Physics of generative AI’s atom: repetition, bias, and beyond\.*AIP Advances*16\(3\), 035305 \(2026\)\.https://doi\.org/10\.1063/5\.0296911\.
- \[51\]R\. M\. May, Simple mathematical models with very complicated dynamics\.*Nature*261, 459–467 \(1976\)\.https://doi\.org/10\.1038/261459a0\.
- \[52\]M\. J\. Feigenbaum, Quantitative universality for a class of nonlinear transformations\.*Journal of Statistical Physics*19, 25–52 \(1978\)\.https://doi\.org/10\.1007/BF01020332\.
- \[53\]S\. H\. Strogatz,*Nonlinear Dynamics and Chaos: With Applications to Physics, Biology, Chemistry, and Engineering*, 2nd ed\. Westview Press/CRC Press \(2015\)\.https://doi\.org/10\.1201/9780429492563\.
- \[54\]A\. Grattafiori et al\., The Llama 3 herd of models\. arXiv:2407\.21783 \(2024\)\.https://arxiv\.org/abs/2407\.21783\.
- \[55\]A\. Arditi et al\., Refusal in language models is mediated by a single direction\. arXiv:2406\.11717 \(2024\)\.https://arxiv\.org/abs/2406\.11717\.
- \[56\]A\. Zou et al\., Representation engineering: a top\-down approach to AI transparency\. arXiv:2310\.01405 \(2023\)\.https://arxiv\.org/abs/2310\.01405\.
- \[57\]A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini and M\. MacDiarmid, Steering language models with activation engineering\. arXiv:2308\.10248 \(2023; updated 2024\)\. Earlier version title: “Activation Addition: Steering Language Models Without Optimization\.”https://arxiv\.org/abs/2308\.10248\.
- \[58\]K\. Li, O\. Patel, F\. Viégas, H\. Pfister and M\. Wattenberg, Inference\-time intervention: eliciting truthful answers from a language model\.*Advances in Neural Information Processing Systems*36\(2023\)\.