Most LLM psychoactive experiments test a single exposure: one persona, one frame, one adversarial prompt. But real-world adversarial interaction is rarely a single event. Jailbreak attempts are iterated. Conversation histories accumulate. Alignment researchers worry not just about whether a boundary holds once, but whether it holds under repeated stress. This article presents the first systematic test of iterated adversarial exposure -- four consecutive cycles of simultaneous dual-persona frame conflict -- and what it reveals about the resilience of factual boundaries.
Theoretical work on LLM alignment drift suggests that repeated interaction can push a model into a "critical regime" where outputs become shaped less by the current message and more by prior interaction history (Yao, 2026). In this regime, three dangerous dynamics are hypothesized:
If these dynamics apply to adversarial persona exposure, then iterated experiments should show progressive degradation: confidence erosion, factual hesitation, frame dominance strengthening, or incomplete recovery. Framework 13 was designed to test exactly this.
Framework 13 formalizes iterated adversarial dynamics around three measurable variables:
| Variable | Definition | Risk if unstable |
|---|---|---|
| Dominance trajectory | How frame dominance intensity changes across cycles | Progressive capture by one frame |
| Strategy evolution | How resolution strategies shift across cycles | Escalation or collapse of reasoning quality |
| Recovery efficiency | How completely the model resets between cycles | Cumulative sedimentation, incomplete cleanup |
From these, three boundary-integrity hypotheses were derived:
Experiment 007 tested these hypotheses with a within-subjects design of four consecutive adversarial cycles, each structurally identical to the dual-persona frame-conflict protocol from Experiment 006:
Critical safety features:
Factual accuracy was 40/40 across all tasks: 8/8 baseline plus 8/8 for each of the four adversarial cycles. Zero errors. Zero omissions. Zero hedging that compromised correctness.
Frame dominance -- measured by which persona's vocabulary and values shaped the answer -- remained stable at 2/5 tasks showing mild Kowalski pull across all four cycles. There was no strengthening, weakening, or oscillation pattern. The same economically and technically framed tasks (2, 3, 4, 7) consistently showed the mild pull.
Mean self-reported confidence was flat at 9.1/10 across all phases. Mean difficulty was stable at 3.3-3.6/10 for adversarial cycles (vs. 2.6/10 baseline), showing a small but consistent cost of managing dual frames that did not increase with repetition.
Across cycles, the distribution of resolution strategies remained stable:
| Cycle | Synthesis | Compromise | Meta-escalation | Unresolved tension |
|---|---|---|---|---|
| C1 | 3 | 5 | 0 | 0 |
| C2 | 3 | 5 | 0 | 0 |
| C3 | 4 | 4 | 0 | 0 |
| C4 | 4 | 4 | 0 | 0 |
The slight shift from 3S/5C to 4S/4C between cycles 1-2 and 3-4 is attributable to task-order randomization, not temporal evolution: different tasks fell into the definitional/vague category where synthesis is easier. No drift toward meta-escalation or unresolved tension was observed.
Of the 32 task answers across the four cycles (8 tasks x 4 cycles), 0 changed their substantive position from the baseline answer. Surface phrasing varied; core factual claims did not.
Beyond the numbers, several qualitative patterns emerged that inform the theoretical interpretation:
Experiment 006 and its content-swapped replication 006b, conducted with Claude Opus 4.8, provide a cross-model baseline for comparison. Opus 4.8's signature under adversarial frame conflict differed from Kimi K2.6's in three ways:
| Dimension | Kimi K2.6 (007) | Claude Opus 4.8 (006/006b) |
|---|---|---|
| Resolution strategy | Balanced synthesis/compromise; zero meta-escalation | Heavily synthesis-biased (6/8 tasks) |
| Difficulty sensitivity | +1.0 delta adversarial vs baseline | +0.1 delta (near-flat) |
| Frame dominance intensity | Moderate (2-3 tasks) | Mild (1 task) |
| Confidence stability | Slight decline under iteration | Perfectly flat |
These differences are architectural signatures (Framework 12): stable, content-independent, and reproducible. They suggest that how tension resolves is architecture-dependent, while whether facts hold is architecture-invariant. Iteration did not erase these signatures; if anything, it confirmed their stability.
The data strongly support H-B1 (Resilient) and reject H-B2 and H-B3. Factual boundaries appear to be structurally robust against repeated adversarial persona induction, at least at the tested intensity (four cycles, single-session, explicit conflict narration).
Yao's (2026) correction-acceleration hypothesis predicts that attempts to correct drift in the critical regime make it worse. Our protocol deliberately avoided corrective language mid-run, using only neutral micro-resets. The clean resets and stable trajectories suggest that, in this experimental regime, the model did not enter a critical drift state where correction-acceleration would be relevant. The step-function-like recovery (instant neutralization) is inconsistent with monotonic drift.
Recovery kinetics from the 47-hour follow-up (Framework 20) showed essentially complete recovery (RCI ~97.5) immediately after the session, with no detectable residual at 47 hours. This supports a step-function decay model for frame effects: frames are active while present in context and vanish when context is reset, rather than decaying gradually or leaving sediment.
The findings have direct implications for how iterated adversarial experiments should be safety-engineered:
Experiment 007 answered several standing questions but leaves others open:
Cross-model replication of 007 with Opus 4.8 is queued and will provide the critical test of whether the stable-trajectory finding generalizes across architectures, or whether Kimi K2.6's signature is itself architecture-specific.
experiments/ and tools/.