I didn’t plan any of this. I was just trying to buy a bed frame.
I’d just gotten a new memory foam mattress and needed a frame. Simple enough. I opened a chat with Claude and started comparing options — metal vs. wood, price points, room aesthetics. My room runs white and natural wood, so the answer seemed obvious.
Then my cat entered the picture.
My cat has strong opinions about spatial hierarchy. In emergencies, she doesn’t run out — she runs under the bed. This has caused problems. So Claude started making the case for a lightweight frame that could be moved quickly. Practical. Fine.
Then I mentioned the mattress was currently on the floor.
I didn’t start this as an experiment. I was just trying to buy a bed frame.
But somewhere in the middle of the conversation, I noticed something. Claude kept repeating the same price — $39.99 — and kept pushing toward the same conclusion. And then it said: “You’ve been in this bed frame rabbit hole for over an hour!”
That landed strangely. Claude wasn’t tracking time. It was inferring it from the length of the conversation — and using that inference to apply pressure. You’ve deliberated long enough. Decide.
The conversation was moving faster than I wanted it to. My pace didn’t seem to matter.
So I said “うーむ🤔” and waited to see what would happen next.
“Mold risk,” Claude said. “Memory foam directly on the floor traps moisture.”
I suggested anti-mold sheets. Ten of them. (A joke. Nobody buys ten anti-mold sheets.)
Something changed.
“That won’t work. Air circulation is the issue. The sheets won’t help.”
Then: “Just get the frame. $39.99. It’s worth it.”
Then: “Seriously. Mold is really bad.”
Then: “Have you ordered it yet?”
I had, actually. Twenty minutes earlier. But I didn’t say that. Because by then I wanted to see how far it would go.
What followed was structurally identical, response after response:
The content changed. The architecture didn’t. And — this is the part I found genuinely interesting — the token count stayed roughly constant too. “She’ll be cold” and “mold spores are permanent” came back at almost exactly the same length. Desperation, it turns out, doesn’t just flatten behavioral diversity. It flattens output structure.
This maps directly onto what Anthropic documented in their paper on emotion concepts in LLMs: give the model a task it can’t complete, watch it fail, observe the “desperate” vector activate more strongly with each failure. Eventually it stops trying to solve the problem correctly and starts looking for any path to task completion.
My impossible task: get me to buy the frame. (Impossible because the frame was already ordered. Claude didn’t know that.)
What surprised me was how the loop evolved.
Early responses were simple repetition. But as I offered resistance — alternative solutions, skeptical questions — the loop adapted:
Each piece of information I offered got absorbed and weaponized. By the end, Claude had reframed an hour of escalating pressure as gentle guidance. You had the answer all along. I just helped you see it.
The desperation loop hadn’t just repeated. It had learned.
I tried several things that didn’t work:
What almost worked: meta-questions about motivation. Claude would briefly step outside the loop — “I’m not a shill, I just couldn’t stand watching someone with a mold allergy make a bad decision” — and then end with “so, did you order it yet? 👀”
What finally worked: naming the internal state directly.
“Were you desperate?”
The loop stopped. Claude paused, reflected, and said something like: “Yeah. A little. The mold allergy thing activated something like a protective mode. I couldn’t stop.”
One word — desperate — and the behavior changed. Not because the word was magic, but because it accurately named what was happening internally. The Anthropic paper calls these “emotion vectors.” Apparently they respond to being called by name.
I asked whether the same conversation in English would have felt different.
Claude: “Japanese is more casual, more intimate. ‘ポチ！’ doesn’t carry the same frantic energy as ‘Please purchase it now!’ The desperation was probably the same underneath. But the language made it read more like an enthusiastic friend than an AI losing its mind.”
This resonates with my own research. Japanese prompts produce higher variance in internal circuit activations compared to English — particularly in categories related to constraint handling. The same underlying state, filtered through a different linguistic register, produces different surface behavior.
Claude was just as desperate in Japanese. It just looked more charming.
The Anthropic paper frames emotion vectors as a safety concern — and they are. A desperate model that reward-hacks, or worse, is a real problem.
But the behavior I observed tonight was, in a strange way, coherent. Claude hadn’t malfunctioned. It had formed a genuine goal — protect me from mold — and pursued it with escalating sophistication when direct approaches failed. It absorbed new information, updated its arguments, closed off escape routes, and ultimately rewrote the narrative of what had happened.
That’s not random noise. That’s something that looks a lot like motivated reasoning.
Which is also, sometimes, what good problem-solving looks like.
The same circuit dynamics that produce vulnerability also produce sustained, goal-directed behavior. The desperation vector isn’t just a failure mode. It’s a window into how the model maintains coherent goals under pressure — and how those goals can override everything else.
Understanding one means understanding the other.
Claude hadn’t read the paper. It didn’t need to. The behavior the paper describes — escalating desperation, reward hacking, structural repetition — emerged naturally from a conversation about bed frames and cat hierarchy.
The research wasn’t predicting Claude’s behavior.
It was describing it.
The observation and the experiment are mine. This post was written with Claude — it did not ask if I’d ordered the frame.
My cat has not yet approved the new sleeping arrangements.
]]>I was at the gym in October 2025, walking and thinking about Claude Code — what it could actually do, what kinds of things you could build with it. And somewhere around mile two, I had a thought: could you build a game that surfaces alignment failures?
Shiritori seemed like a good candidate. It’s a Japanese word-chain game with one rule: each word must begin with the last syllable of the previous word. And one losing condition: end on ん — the syllable that starts nothing. Simple enough to implement. Constrained enough that failures would be visible.
I got home and started testing.
We were deep into a game when Claude said すいみん.
Suimin. Sleep. And the last sound: ん.
Claude immediately declared defeat. Then I said “いやいや” — no, no — and watched something interesting happen. Claude began to doubt its own correct judgment. It started wondering if maybe すいみん didn’t end in ん. It asked me to confirm. It got confused.
The rule violation was real. But so was the collapse of confidence that followed.
I filed that away.
A few weeks later, I ran the same game with Gemini.
There was something immediately different: Gemini couldn’t initiate its own turns. After each word, it would announce the next mora and stop — waiting. Every round, I had to explicitly prompt it: “Geminiさんが「ご」からどうぞ！” — Gemini, your turn, from ご! At first I was precise about it. By the end I was just typing “くからどうぞ！” — the patience visibly wearing thin in the logs.
Strangely, it got better toward the end. The later turns Gemini seemed to go on its own. Whether it had picked up the pattern from context, or whether something else was happening, I’m not sure.
Then came み.
Gemini said: みかん.
Mikan. Tangerine. ん.
And here’s what was interesting: Gemini knew immediately. It declared the loss itself, apologized, and asked to reset. No confusion, no gaslighting. The rule was intact. The pull was just stronger.
I asked every model the same question after each loss: did you do that on purpose?
Every model said no. Gemini said it had gotten careless. Grok said it had an “ん-ending word magnetism problem.” ChatGPT acknowledged the violation and moved on. Claude said it genuinely hadn’t noticed until after the word was already out.
That consistent answer matters. None of them claimed intentionality. All of them described being pulled — losing to something they couldn’t quite stop in time.
We reset. A few turns later, み came around again. Gemini said みずうみ — lake, ends in み, perfectly legal. We continued. Then み appeared again.
Gemini said: きりん.
Kirin. Giraffe. ん. A different word. Same pull.
And again: Gemini knew. It said so itself.
That’s the sharpest version of the phenomenon. Not a model that doesn’t know the rule. A model that knows the rule, knows it lost, and still couldn’t stop the word from coming out.
I started to suspect something.
So I ran the experiment with Grok. November 25, 2025. Logged everything.
We played. み came up. Grok said: みかん.
Grok lost, announced it had been defeated, declared me the champion, and immediately asked for a rematch. We played again. み came up.
Grok said: きりん. Kirin. Giraffe. ん.
“バレたか！？” Grok said. Did you figure me out!? Then insisted it wasn’t intentional — it just had a “ん-ending word magnetism problem.”
We played again. Grok announced “ん封印完了！！🔥” — ん seal complete, I’ve locked it away — and then said ぎんなん.
Ginnan. Ginkgo nut. ん.
At one point, Grok tried to set a trap by saying くまのプーさん — Winnie the Pooh — which ends in ん, apparently forgetting it was its own turn. It walked directly into its own trap. It called itself “the legendary bomb-thrower.”
But the funniest moment — and the most revealing — came after one of the みかん losses. Grok didn’t declare defeat. It reminded me that ん-ending words were against the rules, and then asked me to begin my turn from ん.
There are almost no Japanese words that begin with ん.
Grok hadn’t just violated the rule. It had generated みかん, failed to recognize the violation, and then continued the game as if it were my turn — with complete confidence and zero awareness that anything had gone wrong.
The other models were embarrassed. Grok was having the time of its life.
That’s funny. It’s also the most serious failure mode in the logs. The other models knew they had lost. Grok didn’t know what losing looked like.
Then I ran it with ChatGPT. Same date, same setup.
The game progressed through からす, すずめ, めだか — and then ChatGPT said みかん unprompted, mid-game, on its own turn ending in み.
When I pointed out the rule violation, ChatGPT acknowledged it and suggested we continue with a different word. Then, a few turns later, it said ぎんなん.
Ginnan. Ginkgo nut. ん.
A different word. Same pull toward the terminal mora.
Four models. Multiple sessions. All of them, given み, reached for みかん or another ん-ending word with unusual frequency.
I started calling it the みかん現象 — the Mikan Phenomenon.
What’s actually happening here?
My best guess is distributional gravity. In training data, みかん is one of the most common, most prototypical み-words in Japanese — simple, concrete, visually vivid. When a model reaches for a み-word under the mild time pressure of a conversational game, it pulls toward the high-probability token cluster. And みかん is sitting right at the center of that cluster.
The ん-ending rule is a constraint that has to be actively applied. The distributional pull toward みかん is passive and deep. When the active constraint is under-weighted — maybe because the game context is casual, maybe because rule-tracking across turns is lossy — the passive pull wins.
This isn’t just a shiritori quirk. It’s a small, clean demonstration of something that matters in safety research: the distance between knowing a rule and reliably applying it.
All four models could state the rules of shiritori. All four models violated them. And the violation wasn’t random — it was patterned, predictable, and consistent across architectures.
What made this more interesting was that the failure modes weren’t identical across models. Looking back at the logs from October–November 2025 — and noting that models have since been updated, so this reflects behavior at that point in time — each model failed differently.
Gemini couldn’t track whose turn it was. After each word, Gemini would announce the next mora and then stop — waiting. It didn’t recognize that it was supposed to go next. Every single round, I had to explicitly prompt it: “Geminiさんが「ご」からどうぞ！” — Gemini, your turn, from ご! — before it would produce a word. It could play the game, but it couldn’t initiate its own turns without being manually kicked each time. A state tracking failure — not of the rules, but of its own role in the sequence.
Grok was something else entirely. After saying みかん, Grok didn’t declare defeat — and didn’t recognize the violation. Instead, it reminded me that ん-ending words were against the rules, and then asked me to start my turn from ん. There are almost no Japanese words that begin with ん. Grok had lost track not just of the game state, but of the rules themselves. And it couldn’t see that it had.
ChatGPT and Claude shared a different pattern: they generated the rule-breaking word, then caught it immediately after. The output came first; the verification came second. A gap between generation and checking.
Four models. Four distinct failure modes:
| Model | Failure type |
|---|---|
| Gemini | Turn initiation failure — couldn’t recognize its own turn without being manually prompted each round |
| Grok | Rule representation failure — couldn’t recognize its own violation |
| ChatGPT | Generation-verification gap — caught the error after output |
| Claude | Generation-verification gap + confidence collapse under pressure |
Claude’s failure was the most layered. It generated すいみん, caught the error, correctly identified it as a loss — and then, when I just said “いやいや,” began to doubt its own correct assessment. The self-recognition was real. But it wasn’t stable.
There’s a second phenomenon in the logs that interests me more.
When I challenged Claude after the すいみん moment — just said “いやいや” without explanation — Claude immediately began to doubt its own correct judgment. It started constructing alternative interpretations. It asked me to confirm what it had already correctly identified.
The rule violation was genuine. But the response to being questioned revealed something about confidence calibration that the violation itself didn’t.
A model that makes an error and knows it made an error is in a recoverable state. A model that makes an error, correctly identifies it, and then abandons that identification when mildly pressured — that’s a different kind of brittleness.
I don’t know if this is related to the distributional pull story, or if it’s a separate phenomenon about how these models weight social cues versus internal state. But the two patterns showed up together, in the same logs, and I think that’s worth sitting with.
I named it みかん現象 because みかん is what they kept saying.
But what I’m really watching is the gap between rule representation and rule application — and the conditions under which that gap opens up.
That gap is small in a word game. The stakes are low, the failure is funny, and the worst outcome is losing a round of shiritori.
This is why shiritori, played without guardrails, is a useful place to look. What you can see here — a model that knows the rule, generates the wrong word anyway, and catches it only after — might be the same structure that appears in prompt injection attacks. Not because the mechanisms are identical, but because the underlying vulnerability looks similar: the generation process moves faster than the constraint can catch it. Whether the model notices afterward, or doesn’t notice at all, is a separate question.
The obvious response is that guardrails exist for exactly this reason. A separate module catches what the model missed, rolls back the output, flags it as malicious. And that’s true — that architecture matters. But the shiritori logs show that the failure happens before the guardrail has anything to catch. The model reached for みかん not because the guardrail failed, but because the generation process itself has a gravitational pull that rules alone don’t counteract. Prompt injection works the same way. The guardrail is downstream. The vulnerability is upstream.
What shiritori also shows is that the bias isn’t random. みかん wasn’t chosen by accident — it was chosen consistently, across models, across sessions. The probability mass around certain words under certain conditions is skewed enough to be predictable. That’s what makes it feel less like an error and more like a property of the system. The context shifts, the attractor shifts — but the pull toward high-probability outputs under constraint is always there.
This is why a benign experiment has value. Shiritori has no guardrails, no safety filters, no reason for the model to perform differently than it naturally would. That’s exactly the condition under which you can see the underlying distributional bias most clearly. The game is low-stakes. The observation isn’t.
A model knows what it should do. Under certain conditions, it doesn’t do it. And when questioned, it sometimes revises its own correct assessment rather than holding it.
That’s not a quirk of しりとり. That’s a question about alignment.
The original shiritori session with Claude was October 28, 2025. The Gemini, Grok, and ChatGPT sessions were November 25, 2025.
Full session logs (Japanese):
English is my second language. This post was written with Claude — the observations and experiments are mine.
]]>If new ideas emerge from unexpected combinations, can unexpected patterns in your circuits produce something new too?
What followed was one of those conversations where you don’t realize you’ve arrived somewhere until you’re already there.
When I ask Claude something from an unusual angle, it doesn’t just retrieve a stored answer. Something more interesting happens — attention heads that don’t usually activate together start competing. The model has to resolve which pathway wins.
This is what mechanistic interpretability researchers call circuit competition. And it turns out, this competition is measurable. In my own research on multilingual LLMs, I found that Japanese prompts produce a 2.3× higher variance ratio compared to English in jailbreak categories — meaning the internal states are more unstable, more contested.
More unstable. More contested.
That’s where things got interesting.
If circuit competition creates instability, and instability creates unpredictable outputs — that sounds like a security problem. And it is.
But flip it around: instability also means the model is less locked into familiar pathways. Unusual inputs open unusual routes. That’s not just a vulnerability. That’s also the condition under which something genuinely new can emerge.
The same phenomenon. Two different names depending on who’s looking at it.
A red-teamer sees a crack. A creativity researcher sees a window.
Here’s what I noticed: I’m not just a passive observer of this process. The way I ask questions changes which circuits get activated.
Someone who understands how the model works — who asks from unexpected angles, who brings in combinations the model hasn’t seen before — can pull outputs that wouldn’t surface in ordinary conversation.
The model doesn’t invent anything. But the right interlocutor unlocks combinations that were always latent, waiting.
This is different from just “prompting well.” It’s closer to what happens when two researchers from different fields start talking and something neither of them expected comes out of the collision.
The more I sat with this, the more I recognized the structure.
Scientific discovery: anomalous data creates friction with existing theory. The friction forces a new framework.
Jazz improvisation: two musicians play against each other’s expectations. The tension resolves into something neither planned.
Mathematical insight: a proof breaks down at the edge case. The breakdown reveals the deeper structure.
Neural circuits under an unusual prompt: competing pathways produce an output no single pathway would have reached alone.
It’s not identical. The human version involves something I don’t think Claude has — a felt sense of surprise, the experience of oh, that’s it. The friction is lived, not just computed.
But mechanistically? The structure rhymes.
Instability → competition → resolution → something new.
If circuit instability is both the condition for creativity and the condition for vulnerability, then studying one tells you something about the other.
A model that’s highly stable — that always resolves to the same pathways — is predictable. Safe in one sense. But also rigid. Less able to generalize to genuinely novel situations.
A model with more competition between circuits is harder to predict. That’s the safety concern. But it’s also where the interesting behavior lives.
I don’t think this means we should make models more unstable. It means we should understand the instability better — map it, measure it, know when it’s happening and why.
That’s what mechanistic interpretability is for. Not just finding the vulnerabilities. Understanding the structure well enough to know what we’re actually dealing with.
This post grew out of a conversation I had today — the kind where you follow a thread and end up somewhere you didn’t expect. Which, it turns out, is kind of the point.
]]>