Perturbation Dose Responses in Recursive LLM Loops: Raw Switching, Stochastic Floors, and Persistent Escape under Append, Replace, and Dialog Updates

Abstract: Recursive language-model loops often settle into recognizable attractor-like patterns. The practical question is how much injected text is needed to move a settled loop somewhere else, and whether that move lasts. We study this in 30-step recursive loops by separating the model from the context-update rule: append, replace, and dialog updates expose different histories to the same generator. The main result is that persistent redirection in append-mode recursive loops is memory-policy-conditioned. Under a 12,000-character tail clip, destination-coherent persistence plateaus near 16 percent and retained source-basin escape near 36 percent at dose 400; neither crosses 50 percent. Under a full-history protocol, retained source-basin escape crosses 50 percent near 400 tokens and saturates at 75-80 percent by 1,500 tokens, while destination-coherent persistence first reaches 0.50 near 1,500 tokens with a Wilson 95 percent CI of [0.41, 0.61]. For raw switching, adversarial continuations yield an ED50 near 40 tokens, with paired-control floors near 35 percent and net switching never reaching +50 percentage points within 5-400 tokens. Replace-mode raw switching is near-saturated but largely reflects state-reset overwrite: insert-mode probes drop it to 12-32 percent. A homogeneous-perturbation control reproduced the high-dose non-monotonic dip in destination-coherent persistence, refuting perturbation heterogeneity as the cause; the dip appears structural, with mechanism unresolved. We report 37 experiments on gpt-4o-mini with within-vendor replication on gpt-4.1-nano. Recursive-loop evaluations should distinguish transient movement from durable escape, subtract stochastic floors, and treat context-update rules as first-class safety-relevant design choices.

• The paper presents a controlled token-valued dose–response protocol to quantify perturbation-induced basin switching and persistent escape in recursive LLM loops.
• It demonstrates that different context-update rules (append, replace, dialog) significantly affect raw switching, net switching, and persistence, highlighting the impact of memory policy.
• Empirical evaluations reveal that clustering granularity and prompt family heterogeneity are key factors influencing LLM robustness and reliability in state-update scenarios.

Perturbation Dose Response in Recursive LLM Loops: Mechanisms, Barriers, and Memory Policy Effects

Introduction and Formalization

This paper provides the first systematic, quantitative characterization of perturbation-induced basin switching and persistent escape in recursive LLM loops under different context-update rules. The authors introduce a clean separation between generator and nudge (context-update rule), operationalize attractor-like regimes in LLM recursive systems using embedding-space diagnostics, and propose a controlled, token-valued dose–response protocol to directly measure regime moveability subject to stochastic floors and memory policy. The primary distinction is between raw switching (final disagreement), net switching (raw minus floor), and persistent escape (jump at injection and residence in the new basin at trajectory termination).

Crucially, the context-update rule—append, replace, or dialog—strongly modulates the system’s susceptibility to perturbations. Two fundamental endpoints are defined: retained source-basin escape (departure from original attractor) and destination-coherent persistence (commitment to the specific post-injection attractor). The authors demonstrate both empirically and formally that memory policy is a first-class determinant of robustness, with persistent escape being tightly bound to context retention and state-overwrite mechanisms.

Main Results: Append, Replace, and Dialog Regimes

Append-mode (O1): Dose Response and Memory-Policy Conditioned Escape

In append-mode recursive loops, crafted in-distribution adversarial perturbations exhibit a distinct raw-switching dose–response that localizes around $\mathrm{ED50}_{\mathrm{raw}}\approx 40$ tokens. This response is robust and characterized by sharp saturation: the raw switching rate plateaus near 67%, but subtraction of the stochastic divergence floor (∼35%) reveals a maximal net effect of +32 percentage points (see Figure 1).

Figure 1: O1 append-mode adversarial dose response, highlighting the monotonic rise of raw switching with dose and revealing a plateau at 67%; stochastic control floor is ≈35%.

However, this is not equivalent to durable basin escape. Persistent escape rates—in which a detectable jump at perturbation persists through the remaining trajectory—remain low under bounded-memory, peaking at 16% Figure 2. Persistent escape does not cross the formal 50% barrier under any clustering convention up to 400 tokens under the canonical 12k-char tail-clipped loop.

Figure 2: Persistent-escape rates in O1 regime under multiple clustering granularities; destination-coherent persistence remains well below 50% in bounded-memory settings.

The situation changes in the full-history, unclipped variant: retained source-basin escape (kicked and outside the original basin at trajectory termination) crosses 50% near 400 tokens and saturates near 75–80% by 1,500 tokens Figure 3. The stricter destination-coherent persistence first crosses a 50% point-estimate at ∼1,500 tokens, but this value is non-monotonic and CI-bounded.

Figure 3: Destination-coherent persistence: full-history (unbounded memory) allows majority-persistent escape at high dose, with threshold crossing at ∼1,500 tokens and observable dependence on memory policy.

These results formally demonstrate that append-mode persistent-escape barriers are contingent on memory policy, not an intrinsic model property.

Replace-mode (O2/O3): Overwrite Tautology and Model-Update Separation

Replace-mode (paraphrase-replace, summarize-and-negate-replace) exhibits near-saturated raw switching under the default overwrite perturbation for all non-control conditions (adversarial, neutral, gibberish), but this is mechanically tautological: the context-update directly overwrites state with the perturbation, so the switching is a function of the update rule, not the model (see Figure 4). Insert-mode probes, which expose the model to the perturbation without overwriting, yield much lower switching rates (12–32%), divorcing overwrite mechanics from model-mediated redirection.

Cross-regime overwrite-minus-insert switching differentials are regime-dependent: append-mode shows only a 14–34 percentage-point gap, but replace-mode shows 60–80 points Figure 5. The insert-mode effect is strongest in append, weaker in oscillatory replace, and weakest in absorbing replace: $O1 > O2 > O3$.

Figure 5: Overwrite-minus-insert switching gap is small in append but large in replace, confirming that replace-mode apparent fragility mainly arises from the state-write protocol, not weak model attractors.

Dialog Modes: Susceptibility and Basin Hardening

Dialog regimes present intermediate behavior, with dialog-specific basin structure and high initial susceptibility to perturbations, especially for off-topic (neutral/gibberish) content. However, dialog basins can harden with additional turns: late injections in D1 show reduced switching, while O1 append is time-invariant Figure 6.

Figure 6: Basin hardening in D1 dialog—late-stage injections are less likely to cause basin switching, unlike O1 append.

Robustness, Cluster Granularity, and Family Effects

The quantitative results are stable across different observables but show some sensitivity to clustering granularity. O1 adversarial switching is consistently 2–3× higher than out-of-distribution (neutral/gibberish) at any $k$ or clustering algorithm, while D1 is more sensitive to the clustering definition Figure 7.

Figure 7: Switching rates are robust for O1 across granularities, but D1 dialog exhibits considerable sensitivity to cluster definitions.

There is significant prompt-family heterogeneity in append-mode dose response, resulting in inter-family differences that inflate bootstrap CIs for ED50 estimates Figure 8. This cautions against interpreting population-level ED50s as homogeneous across prompt families.

Figure 8: Per-family dose-response in O1 demonstrates wide variation in switching behavior and underpins broad ED50 CIs.

Embedding, Generator, and Diagnostic Robustness

The regime-taxonomy and attractor-like structure (contractive, oscillatory, multi-basin dialog, etc.) are robust under changes in embedding model and within-vendor generator. Basin predictability (group-aware fold), recurrence, and regime separation are preserved under embedding ablation, but sharpness dimension is not Figure 9.

Figure 9: Basin predictability is robust to embedding-model substitution; qualitative regime distinction persists.

Geometric and Diagnostic Observations

Empirical density landscapes in 2D/3D corroborate basin structures but absolute barrier heights ($V^\star$) are parameter-sensitive. Rank ordering between perturbation types (control > neutral/lorem > adversarial) is robust, but numeric values should not be interpreted as calibrated Figure 10.

Figure 10: Geometric barrier heights ($V^\star$) vary with analysis choices; ordinal but not metric information is stable.

Unsupervised clustering in diagnostic space reliably separates replace and append/dialog regimes but does not recover the full five-way taxonomy—perturbation dose response is required to resolve regime structure (Figures 15 and 16).

Figure 11: Unsupervised clustering in diagnostic space separates replace from append/dialog but does not fully recover regime taxonomy.

Implications and Future Directions

Practical and Theoretical Insights

• Context-update rules are safety-critical: Overwrite capability enables state reset and makes devices appear fragile absent memory-policy-aware evaluation.
• Raw switching is insufficient for robustness assessment: High raw switching can be due to high stochastic floors; durable escape is a stricter, much less easily met criterion in typical bounded-memory append-mode architectures.
• Empirically, modern LLMs show real basin barriers in bounded context: Even adversarial in-domain perturbations at moderate dose rarely induce persistent escape.
• Cluster granularities, prompt family heterogeneity, and observable selection all affect measurements: Cross-method and cross-family analyses are essential for sound conclusions.
• Overwrite/insert distinction is generalizable to broader agent architectures: The effect of state-through-overwrite vs passive model exposure is highly relevant for tool-augmented agents, retrieval-augmented generation, and summary-based memory.

Methodological Advances

• The explicit generator–nudge separation and the persistent escape estimands formalize intervention-based attractor dynamics in LLMs.
• Dose-response analysis at the level of perturbation tokens operationalizes the cost of redirecting a settled LLM loop, paralleling pharmacological concepts.
• The overwrite vs. insert protocol can be extended to dissect robustness and evaluate security claims for agent scaffolds and memory architectures.

Open Problems and Research Directions

• Cross-vendor and cross-linguistic generalization: Only within-vendor models are studied at present.
• Beyond text—multimodal, code, or stateful agents: Extension of the framework to tool-using systems with richer state semantics is a direct next step.
• Information-theoretic barrier estimates: Bridging from token count to logprob (nat)-valued barriers for better model comparability.
• Role of alignment, safety tuning, and non-textual context: How do alignment interventions or modality shifts affect regime structure and basin stability?

Conclusion

This study provides the first comprehensive, experimentally grounded account of perturbation barriers and memory-policy-conditioned robustness in recursive LLM loops (2605.02236). The phenomena of raw switching, stochastic floors, and persistent escape are quantitatively contextualized and connected directly to engineering mechanism and architectural design. The distinction between generator and context-update is essential for both theoretical analysis and safety evaluation. Future work should generalize these results to cross-vendor, cross-modality, and deployment-scale agent settings, integrating logprob-based information measures and more granular, task-relevant observables.