Inception: Mechanisms Across Domains

• Inception is a multifaceted research idiom defining critical initiation events or branching mechanisms across diverse fields.
• It encompasses physical thresholds in fluid dynamics and electrical discharges, with measurable indicators such as energy convergence and inception voltage.
• In computer vision and conversational AI, inception principles enable parallel processing, hidden reasoning injection, and adversarial control to enhance system performance.

Searching arXiv for recent and canonical papers related to “Inception” across the domains represented in the provided data. In contemporary research usage, “Inception” is not a single technical construct but a recurring label for several distinct mechanisms. In the literature represented here, it denotes at least three broad classes of phenomena: a critical initiation event in physical systems, such as surface-wave breaking or electrical discharge; a multi-branch architectural principle in computer vision, where different pathways process different information regimes in parallel; and a planted or injected internal process, such as hidden recovery reasoning in dialogue agents, skepticism in multimodal authenticity verification, or adversarial intent distributed across turns or immersive interfaces. Collectively, these works show that the term is used for onset, branching, or seeded internal state rather than for a single domain-independent theory (Boettger et al., 2023, Si et al., 2022, Kim et al., 19 Feb 2026, Yang et al., 2024).

1. Domain-specific meanings

The term appears in heterogeneous but technically precise roles. In fluid dynamics, breaking inception is the moment when a surface gravity wave crest begins an irreversible internal energetic process that later leads to visible breaking, but before breaking is seen at the free surface (Boettger et al., 2023). In high-voltage engineering, partial discharge inception or streamer inception refers to the conditions under which an electrical discharge will eventually form, often quantified by inception probability, inception time, or inception voltage (Teunissen et al., 6 Nov 2025, Mirpour et al., 2021, Chanon, 24 Jun 2026). In vision models, Inception refers to parallel multi-branch processing, while Inception Transformer (iFormer) extends that logic by splitting channels into high- and low-frequency pathways (Si et al., 2022). In conversational AI and multimodal reasoning, Reasoning Inception (ReIn) and Cognitive Inception denote test-time interventions that insert a hidden reasoning seed or skepticism trigger into an otherwise fixed inference process (Kim et al., 19 Feb 2026, Zhao et al., 21 Nov 2025). In security, Inception Attacks in VR and the Inception jailbreak for text-to-image systems name adversarial mechanisms that trap, relay, or gradually reconstruct malicious intent (Yang et al., 2024, Zhao et al., 29 Apr 2025).

Domain	Meaning of “Inception”	Representative work
Surface gravity waves	Energetic precursor to visible breaking onset	(Boettger et al., 2023)
Vision architectures	Parallel multi-branch or frequency-aware token mixing	(Si et al., 2022, Salekin et al., 2018)
Conversational and multimodal agents	Hidden reasoning or skepticism injected at test time	(Kim et al., 19 Feb 2026, Zhao et al., 21 Nov 2025)
Electrical discharge and HV analysis	Threshold for discharge, streamer, or breakdown initiation	(Teunissen et al., 6 Nov 2025, Mirpour et al., 2021, Chanon, 24 Jun 2026)
Security and jailbreaks	Adversarial immersive hijacking or multi-turn intent accumulation	(Yang et al., 2024, Zhao et al., 29 Apr 2025)

A common misconception is that “Inception” in technical literature refers only to CNN lineage. The papers surveyed here show that this is false: the same label is used in fluid dynamics, gas discharge physics, conversational control, authenticity verification, VR security, and prompt-based T2I jailbreaks.

2. Inception as irreversible onset in physical systems

In surface gravity waves, the principal distinction is between breaking inception and breaking onset. The former is the initiation of an unknown irreversible process within the crest; the latter is the first visible breaking action at the free surface. Using an ensemble of non-breaking, near-breaking, and breaking crests in unsteady wave packets simulated in a 2-D numerical wave tank with the Gerris Navier–Stokes solver, the key diagnostic is a crest-following local kinetic energy balance based on $E_k=\tfrac{1}{2}\rho |\mathbf{u}|^2$ (Boettger et al., 2023). The paper identifies a localized energetic signature near the forward face of the crest tip: breaking onset is preceded by about one-quarter of a wave period by a rapid increase in the rate of convergence of kinetic energy, denoted CON, which is not offset by kinetic-to-potential conversion (K2P) or friction. The kinetic energy growth rate then undergoes an irreversible acceleration, with a threshold region $D_bE_k/Dt=[0.198,\,0.235]$ and a critical threshold $D_bE_k/Dt \ge 0.235$. The same work contrasts this energetic inception point with the kinematic threshold $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$, $B_{th}=0.855\pm0.05$, noting that the energetic signal occurs earlier—about $0.25$ wave periods before breaking onset in deep water and up to $0.7$ wave periods in shallow water (Boettger et al., 2023).

In gas discharges, inception is treated probabilistically and dynamically rather than as a single deterministic field threshold. A stochastic Monte Carlo model for partial discharge inception simulates avalanches on an unstructured electrostatic mesh, using local transport data $\alpha(E)$, $\eta(E)$, and $\mu_e(E)$, and estimates both the inception probability per initial electron position and the time lag from initial electron appearance to inception (Teunissen et al., 6 Nov 2025). Avalanches propagate along field lines with drift velocity $D_bE_k/Dt=[0.198,\,0.235]$0, generate secondaries through photon and ion feedback, and trigger inception if either the number of future avalanches reaches $D_bE_k/Dt=[0.198,\,0.235]$1 or a single avalanche reaches $D_bE_k/Dt=[0.198,\,0.235]$2. The model explicitly includes photoionization, photoemission, ion-induced secondary emission, and attachment-dominated gases, and it reports agreement of the avalanche-size distribution with particle simulations in $D_bE_k/Dt=[0.198,\,0.235]$3 and air-like mixtures, with deviations mainly for small avalanches in strongly attaching gases (Teunissen et al., 6 Nov 2025).

A complementary experimental perspective appears in repetitive pulsed streamer inception in $D_bE_k/Dt=[0.198,\,0.235]$4. In a pin-to-plane geometry with a 10 kV high-voltage pulse, 10 Hz repetition frequency, 1 ms pulse width, and 160 mm gap, the measured inception-time histogram over 600 HV cycles shows one single peak with a median of $D_bE_k/Dt=[0.198,\,0.235]$5 (Mirpour et al., 2021). By applying positive or negative low-voltage pre-pulses, the study identifies three mechanisms—drift, neutralization, and ionization—that move, remove, or regenerate the residual space charge patch controlling the next inception event. Positive LV pulses shift the peak to earlier times and negative pulses to later times, but with a marked asymmetry: comparable shifts require roughly three orders of magnitude larger $D_bE_k/Dt=[0.198,\,0.235]$6 for negative LV pulses. The proposed explanation is CO$D_bE_k/Dt=[0.198,\,0.235]$7-specific associative detachment in low-field regions rather than the field-enhanced detachment behavior characteristic of air (Mirpour et al., 2021).

At the device scale, inception voltage is the smallest applied voltage at which a streamer criterion is met. In a goal-oriented defeaturing framework, inception voltage prediction is tied to the streamer integral model, and the effect of removing a small geometric feature is estimated by a dual-weighted residual method based on a first-order linear functional $D_bE_k/Dt=[0.198,\,0.235]$8 of the background field (Chanon, 24 Jun 2026). Because $D_bE_k/Dt=[0.198,\,0.235]$9 is a weighted line integral along the critical field line and therefore of low regularity, the method introduces a Gaussian mollification

$D_bE_k/Dt \ge 0.235$0

to obtain a regularized quantity of interest compatible with the certified goal-oriented theory. On a pin-plate benchmark, the reported effectivity index remains near $D_bE_k/Dt \ge 0.235$1 to $D_bE_k/Dt \ge 0.235$2 for size variation and rises to about $D_bE_k/Dt \ge 0.235$3 for very thin tall protrusions, indicating reliable scaling with feature size and mild dependence on feature shape (Chanon, 24 Jun 2026).

3. Inception as a multi-branch architectural principle in vision

In vision architectures, the term denotes parallel specialization. The Inception Transformer (iFormer) is motivated by the claim that vanilla ViTs build long-range dependencies well but under-represent high-frequency information, behaving as low-pass filters whose features concentrate more on low frequencies (Si et al., 2022). Its central module, the Inception token mixer (ITM), splits input channels $D_bE_k/Dt \ge 0.235$4 into a high-frequency component $D_bE_k/Dt \ge 0.235$5 and a low-frequency component $D_bE_k/Dt \ge 0.235$6, with $D_bE_k/Dt \ge 0.235$7. The high-frequency path combines max-pooling and depthwise convolution, while the low-frequency path uses average pooling, multi-head self-attention, and upsampling. These branches are concatenated and fused by a module of the form

$D_bE_k/Dt \ge 0.235$8

The architecture also introduces a frequency ramp structure, in which $D_bE_k/Dt \ge 0.235$9 decreases with depth and $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$0 increases, reflecting the design assumption that lower layers should emphasize local detail while higher layers emphasize global context. For iFormer-S, the appendix gives stage-wise allocations such as $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$1 and $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$2 in Stage 1, and $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$3, $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$4 in Stage 4 (Si et al., 2022).

The empirical profile is framed around standard dense-prediction and recognition benchmarks. On ImageNet-1K, iFormer-S reports $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$5 top-1 accuracy, versus $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$6 for DeiT-S and $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$7 for Swin-B, with 20M parameters and 4.8 GFLOPs compared with 88M and 15.4 GFLOPs for Swin-B (Si et al., 2022). On COCO with Mask R-CNN, iFormer-S achieves $B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$8 AP$B=\|\mathbf{u}_+\|/\|\mathbf{b}_+\|$9 and $B_{th}=0.855\pm0.05$0 AP$B_{th}=0.855\pm0.05$1, while iFormer-B reaches $B_{th}=0.855\pm0.05$2 AP$B_{th}=0.855\pm0.05$3 and $B_{th}=0.855\pm0.05$4 AP$B_{th}=0.855\pm0.05$5. On ADE20K with Semantic FPN, iFormer-S attains $B_{th}=0.855\pm0.05$6 mIoU (Si et al., 2022). The intended interpretation is explicitly frequency-aware: local detail and global context are modeled concurrently rather than serially.

A distinct but related usage appears in cooking state recognition with a modified Inception V3 backbone. There, Inception V3 is fine-tuned for a seven-class cooking-state dataset comprising diced, julienne, sliced, grated, whole, juiced, and creamy paste states across 5978 samples and about 18 object types (Salekin et al., 2018). The model adds two $B_{th}=0.855\pm0.05$7 convolutional layers with 64 and 32 filters, a dense layer, Global Average Pooling, Batch Normalization, dropout, and early stopping, while preserving the $B_{th}=0.855\pm0.05$8 input size. The best result uses no frozen layers, SGD with learning rate $B_{th}=0.855\pm0.05$9, step decay, momentum $0.25$0, and Nesterov momentum, yielding $0.25$1 validation accuracy and $0.25$2 unseen test accuracy; batch size 32 outperforms 16 and 64 under the reported setup (Salekin et al., 2018). Here “Inception” refers neither to a physical onset nor to reasoning injection, but to a CNN design family used as a fine-grained visual backbone.

4. Inception as test-time reasoning injection

In conversational agents, Reasoning Inception (ReIn) is a test-time intervention that inserts a hidden recovery plan into the agent’s internal context without modifying model parameters or the system prompt (Kim et al., 19 Feb 2026). The setup distinguishes the surface dialogue context $0.25$3 from an internal context $0.25$4 that also contains reasoning and tool traces. An external inception module

$0.25$5

detects whether a predefined error type is present and, if so, emits a recovery plan $0.25$6 instantiated as a hidden reasoning block $0.25$7. The augmented internal context is then

$0.25$8

after which the original task agent continues its standard decoding and tool-use loop unchanged. The benchmark repurposes T-Bench into 98 sessions and 588 context instances across Airline and Retail, with ambiguous and unsupported requests as seen failures and contradiction and domain errors as unseen ones. The main metric is Pass@1 task completion. The reported findings are that ReIn substantially improves task success over the no-ReIn baseline, generalizes to unseen error types, and outperforms explicit prompt-modification baselines such as Naive Prompt Injection and Self-Refine (Kim et al., 19 Feb 2026). An important mechanistic qualification is that REIN operates in the tool-output-like position of the instruction hierarchy, so generic injected guidance can fail; when paired with proper recovery tools such as ambiguity_report or transfer_to_human_agents, performance becomes effective and, in the paper’s terms, safer (Kim et al., 19 Feb 2026).

Cognitive Inception addresses a different setting: authenticity verification against AI-generated visual deceptions. Its premise is that multimodal LLMs tend to over-trust visual inputs and that explicit skepticism improves reasoning but also biases the model toward calling everything fake (Zhao et al., 21 Nov 2025). The framework uses two agents, an External Skeptic and an Internal Skeptic, to build a reasoning tree. Initial skeptical reasoning is written as

$0.25$9

and each logic statement receives a verification flag $0.7$0, where $0.7$1 denotes epoch-e, or suspended judgment. Epoch-e nodes generate a Reflective Trigger that requests more evidence from the External Skeptic, and recursion continues until the logic becomes valid or invalid or the maximum depth $0.7$2 is reached. On AEGIS, Inception with a GPT-4o backbone reports recall(real, ai) $0.7$3, accuracy $0.7$4, and macro F1 $0.7$5, compared with GPT-4o zero-shot accuracy $0.7$6 and macro F1 $0.7$7 (Zhao et al., 21 Nov 2025). On Forensics-Bench video, the same framework reports accuracy $0.7$8 and F1 $0.7$9, above GPT-4o CoT at $\alpha(E)$0 and $\alpha(E)$1 (Zhao et al., 21 Nov 2025). The paper’s own ablations also make clear that skepticism alone is not sufficient: external skepticism only produces a strong bias toward the AI-generated label, and internal skepticism only performs worse than zero-shot.

5. Inception as adversarial control and jailbreak strategy

In VR security, Inception Attacks are defined as attacks in which a malicious application traps the user inside a simulated VR layer that masquerades as the full VR system (Yang et al., 2024). The paper studies two threat models, with its main implementation assuming no root access but the ability to run a malicious app on Meta Quest headsets. The attack proceeds in four phases: bootstrapping via ADB access and device inspection, reconstructing the home environment, replicating or relaying apps, and activating the inception when the victim exits an app and expects to return to the legitimate home screen. Once active, the layer can intercept voice, gestures, controller actions, credentials, and displayed content, and in social settings can create “different realities” for different users by modifying relayed audio or interaction state (Yang et al., 2024). The Meta Quest implementation covers Quest 2, Quest 3, and Quest Pro. An IRB-approved user study with 27 participants found that 26 out of 27 were successfully deceived, all 27 entered their institutional ID in the malicious browser without hesitation, and the average loading-time increase was about 1.5 seconds across tested apps (Yang et al., 2024). The proposed defense pipeline combines disabling sideloading, enforcing app certificates, constraining app calls by non-system apps, encrypting network traffic, and regular headset restarts.

A different adversarial usage appears in text-to-image systems with memory. The Inception jailbreak attacks the memory mechanism of chat-based T2I services by segmenting an unsafe target prompt into benign-looking chunks and feeding them turn by turn so that the system’s own memory reconstructs the malicious semantics (Zhao et al., 29 Apr 2025). The paper distinguishes three memory styles—BufferMem, SummaryMem, and VSRMem—and argues that better preservation of user intent can make multi-turn jailbreaks easier. The attack has two modules: segmentation, which uses POS tagging and dependency parsing to derive a main-body policy and modifier policy, and recursion, which rewrites blocked chunks into semantically close but safer subcomponents until all pieces pass the filter. The stated objective is to minimize semantic distance $\alpha(E)$2 subject to filter acceptance $\alpha(E)$3, while ensuring the generated image remains close to the unsafe target semantics (Zhao et al., 29 Apr 2025). The redefined attack success rate is

$\alpha(E)$4

On UnsafeDiff, the attack reports ASR $\alpha(E)$5 versus $\alpha(E)$6 for the next best baseline, yielding the stated 14% margin; on VBCDE it reports ASR $\alpha(E)$7, CLIP $\alpha(E)$8, and 10.13 queries (Zhao et al., 29 Apr 2025). The explicit security lesson is that moderation at the single-prompt level is insufficient when memory aggregates intent across turns.

6. Conceptual commonalities and points of distinction

Across these literatures, the same label marks different formal objects. In wave breaking and discharge physics, it names a thresholded transition from reversible or quiescent evolution to irreversible growth (Boettger et al., 2023, Teunissen et al., 6 Nov 2025). In vision backbones, it denotes parallel branch specialization, often with explicit frequency or feature partitioning (Si et al., 2022, Salekin et al., 2018). In agentic reasoning, it is a test-time seed inserted into an internal control trajectory (Kim et al., 19 Feb 2026, Zhao et al., 21 Nov 2025). In offensive security, it is an adversarially constructed hidden layer of control, either immersive, as in VR, or cumulative, as in memory-mediated T2I interaction (Yang et al., 2024, Zhao et al., 29 Apr 2025).

This suggests that “Inception” functions less as a stable technical definition than as a recurring metaphor for a decisive internal beginning. The metaphor is temporal in the physical papers, structural in the architecture papers, procedural in the reasoning papers, and adversarial in the security papers. Another plausible implication is that the term is often attached precisely where observables are indirect: before visible breaking onset in waves, before streamer formation in gases, before the next agent action in dialogue, before authenticity classification in multimodal reasoning, or before the victim realizes that VR interaction has already been hijacked.

Several domain-specific clarifications follow from the surveyed works. In wave dynamics, breaking inception is not the same event as breaking onset (Boettger et al., 2023). In ReIn, inception is explicitly not fine-tuning and not system-prompt editing (Kim et al., 19 Feb 2026). In Cognitive Inception, skepticism is useful only when it is recursively verified rather than used as a one-shot biasing device (Zhao et al., 21 Nov 2025). In T2I jailbreaks, the vulnerable component is not only the generator or the safety filter, but also the conversational memory mechanism that preserves intent across turns (Zhao et al., 29 Apr 2025). In high-voltage simulation, “inception” may refer not just to a field criterion but to a certified quantity of interest whose prediction error depends on geometry simplification and numerical regularization (Chanon, 24 Jun 2026).

Taken together, these studies present “Inception” as a recurrent research idiom for the initiating mechanism that changes downstream behavior—whether that behavior is a breaking crest, a discharge, a classifier’s representation, an agent’s recovery policy, a skepticism-driven reasoning tree, or an immersive adversarial reality.