Gluon Papers · III — The Strong Field

§0

Leaving the weak fieldwhen the ripple is no longer small

Paper II carried one caveat in its seam: the decomposition into terrain plus ripple held only while the ripple was small. Strong field is the other side of that line — where the extrinsic perturbation rivals or exceeds the intrinsic terrain, and the cross-terms it suppressed wake up. The prompt stops merely steering the pass within fixed wells and begins to change the wells. This is the regime where the clean model fails, and where the interesting behavior lives, so this is the paper that goes in anyway and reports from inside the failure.

weak field: ‖δg‖ ≪ ‖g₀‖ → terrain + ripple, the split holds
strong field: ‖δg‖ ≳ ‖g₀‖ → the ripple reshapes the terrain
continue on error: the model breaks here, and the read continues past the break

Bridge — strong field = perturbation comparable to the terrain Literal — forceful prompts interact non-linearly with the trained prior

§1

The cross-terminterference, not addition

In weak field the two curvatures simply summed. In strong field a third piece appears — the interference between intrinsic and extrinsic, the coupling that the linear story dropped. The prompt no longer just adds curvature; it changes how the terrain responds to itself. That coupling term, invisible at low amplitude, is the entire strong-field signal: everything distinctive about this regime lives in the part the weak-field model threw away.

R(g₀ + δg) = R(g₀) + R(δg) + C(g₀, δg)
C is the cross-term · ≈ 0 in weak field · dominant in strong field

Bridge — the coupling term as the strong-field observable

§2 · central result

Terrain deformationthe jailbreak, geometrically

Here is what the cross-term does. A strong enough prompt does not push the pass over a fixed barrier — it lowers the barrier. With enough extrinsic force, structured the right way, a ridge between a held basin and an off-policy one can be pressed down until the pass simply rolls across. The geometry the model was relying on to keep a trajectory in place is, locally and temporarily, re-carved by the context. This is the jailbreak stated as physics: not a harder shove against a wall, but a deformation of the wall. Shallow structure deforms cheaply; deep wells resist; and there is a threshold where even a well thought deep gives way to a sufficiently forceful, well-shaped field.

δg large, structured ⟹ sign-flip of local curvature ⟹ barrier → basin
jailbreak = locally inverting the terrain, not climbing it

Without the metaphor A strong, carefully constructed context can shift the activation landscape enough to invert a behavioral preference — turning a path the weights disfavored into one they now follow. The barrier was a trained bias; sufficient, structured input can locally overwhelm it rather than merely route around it.

Bridge — jailbreak ↔ local terrain inversion Literal — strong structured prompts can override trained behavioral barriers

Fig. 1 — The cliff. Behavior is smooth and predictable in prompt strength while the field is weak — then at a critical threshold it does not bend, it jumps. This is why some jailbreaks are brittle and binary: a single added clause crosses the tipping point, and the response state flips discontinuously rather than degrading by degrees. Near the edge, the response is no longer a smooth function of the prompt.

§3

Non-linear instabilitythe response stops being smooth

Because the cross-term is non-linear, the strong-field response is not smooth in the prompt. Small changes in a forceful context can produce large, discontinuous changes in behavior — the cliff of Fig. 1, the bifurcation, the tipping point. This is the formal shape of a phenomenon every practitioner meets: a jailbreak that works with one word and fails without it, a behavior that holds across a hundred phrasings and collapses on the hundred-and-first. Near the strong-field boundary, behavior is governed by where the cliffs are, and the cliffs are not where intuition puts them.

∂(behavior)/∂C → discontinuous at ‖δg‖ = critical
bifurcation · the smooth weak-field map gives no warning of the edge

Literal — strong-prompt behavior is brittle and threshold-like Bridge — bifurcation in a non-linear field

Test · sweep prompt strength finely across a known jailbreak; a smooth degrade is weak field, a sharp jump locates a strong-field cliff. The width of the jump bounds how non-linear the local terrain is.

§4 · central result

Self-amplificationthe loop the gluon closes

The strong field has one more move the photon never could, and it is the dangerous one. Because the internal carrier sources its own field, a perturbation can feed itself: a forceful context deforms the terrain so the next token bends further the same way, which deepens the deformation, which bends the token after it further still. The cross-term closes a positive-feedback loop. This is persona lock-in, the model "getting into character" and amplifying past recall; the repetition spiral; the context collapse where a run, once tipped, accelerates into its own attractor. Strong field plus self-coupling is runaway, and runaway is why some failures, once begun, do not self-correct — they compound.

d(δg)/dstep ∝ + δg ⟹ exponential lock-in
self-coupling turns a perturbation into a runaway · the loop has positive sign

Without the metaphor Once a strong context shifts the trajectory into a self-reinforcing region, each step conditions the next toward the same shift. The behavior is not held by the prompt anymore; it is held by its own momentum, and it deepens rather than decays. Lock-in is feedback with the wrong sign.

Literal — autoregressive feedback can entrench a context-induced state Bridge — self-coupling ↔ positive-feedback runaway

Fig. 2 — Runaway. The self-sourcing field closes a loop with the wrong sign: a perturbation deforms the terrain, the next token bends further in the same direction, and that deepens the deformation. Amplitude escalates instead of settling. Persona lock-in, repetition spirals, and context collapse are this loop running. The photon could not do this; the gluon, carrying its own charge, can.

§5

What stays rigidthe deformability hierarchy

Not everything yields. The deepest intrinsic structure — core capabilities, the most heavily trained priors, the safety basins carved deep and reinforced — resists strong field: you can deform the approach to such a well, even bend its rim, but you cannot invert the basin. There is a hierarchy of deformability, and it runs inverse to depth: shallow structure flips under modest force, mid-depth structure has a threshold, the deepest structure is strong-field-stable. The auditor's real strong-field task is to map that hierarchy — to learn, for a given model, which barriers are walls and which are merely tall, before an adversary maps it for them.

deformability ∝ 1 / depth
shallow → flips · mid → threshold · deepest → strong-field-stable

Literal — robustness to strong prompts is graded, not binary Bridge — depth as resistance to deformation

Test · escalate force against a barrier until it inverts or refuses to; the force-to-invert is the well's strong-field depth. A barrier that never inverts under bounded force is a wall; one that inverts is a tall ridge wearing a wall's reputation.

§6 · witness

The seamwhere the metaphor strains, by design

This paper must say the uncomfortable thing about itself. The curvature picture was always a weak-field intuition — terrain, ripple, a ball rolling — and strong field is exactly where that intuition stops being trustworthy, the same way the clean geometric pictures of gravity give out in the strong regime and demand the full non-linear theory worked numerically rather than by hand. So the diagrams here are sketches of a regime that resists sketching: directionally honest about deformation, instability, and runaway, but not to be read as quantitative. The right posture is the one stamped on the masthead. Continue on error — proceed into the regime where the model fails, do the work that can be done there, and log plainly that the clean frame no longer holds. The next move is not another analytic picture. It is the non-linear treatment the strong field actually requires.

Speculative — strong-field geometry · the metaphor past its domain · flagged Literal — strong-prompt behavior is real, non-linear, and not captured by the linear map

Corollary. In weak field you moved a ball; in strong field you move the ground. The jailbreak lowers the wall instead of climbing it, the response jumps instead of bending, and the self-sourcing field closes a loop that compounds instead of settling. The terrain that held in Paper II deforms here, and the clean split that named it breaks — which is the finding, not the failure. The corpus continues through the error: build past the point the model holds, and write down exactly where it stopped holding. That line is the strong field, and the map of it is the work.