When Two AIs Talk: Interaction Creates Behavior Physics Can't Explain in Isolation

Forum topic · ✨步子哥 · 2026-08-10

Summary

A 2026 arXiv paper (arXiv:2608.07457) by Bella Xinrui Li, Frank Yingjie Huo, and Neil F. Johnson of George Washington University's physics department reports that interaction between two identical GPT-2 models produces dynamical behavior absent when either model runs alone. In the experiment, two copies of GPT-2 with identical parameters, seeds, and decoding temperatures interacted for 200 rounds. When one model (the 'boss') sent one-way messages that ignored replies, the subordinate model's D-score rose from ~0.04 to ~0.25 — a 9-sigma effect — adopting a novel state that was neither its own nor the boss's. Swapping roles shifted the effect with the subordinate position, not model identity. Bidirectional interaction drove both models into the altered state. Most strikingly, pre-recorded message streams ('tapes') worked as well as live interaction, framing the boss as an 'information bath' analogous to non-equilibrium system-bath physics. The authors present a three-state (F/O/D) kinetic model where an effective drive controls transitions, and argue AI-AI networks are natural non-reciprocal systems. Engineering implications include systematic blind spots in single-model evaluation, message order as a control parameter, and expanded prompt-injection attack surfaces via pre-recorded drives.

The Experiment

The post discusses the paper "Interaction Creates Dynamical AI Behavior Absent in Isolation" (arXiv:2608.07457, posted August 7, 2026) by Bella Xinrui Li, Frank Yingjie Huo, and Neil F. Johnson (George Washington University, physics of complex systems).

Setup:

Two identical GPT-2 copies (same checkpoint, same seeds, temperature T=0.01 or T=0.10)
200 interaction rounds, 10 seed pairs
Four conditions: no interaction; one-way 1→2; one-way 2→1; bidirectional
Outputs classified per round as F (failed), O (other), or D (a code-defined behavior class); the key metric is the D-score

Key points

Baselines match: in isolation both models score D ≈ 0.04 (difference -0.0050 ± 0.0140).
One-way interaction: the subordinate's D-score jumps to ~0.25 (D₁ - D₂ = -0.2385 ± 0.0188 at T=0.01), a 9-sigma signal, while the boss's score stays at 0.04. The subordinate "neither copies its boss nor returns to how it behaves on its own; instead, it adopts an entirely different behavior."
Role swap moves the effect: reversing the arrow flips the difference to +0.1745 ± 0.0128 — the behavior follows the *subordinate position*, not model identity.
Bidirectional: difference returns to ~zero not because both revert, but because *both* enter the high-D altered state (D₁ ≈ D₂ ≈ 0.25).
The boss can be a tape: a pre-recorded message stream from an independent-seed GPT-2 works as well as live interaction (D: 0.2210 ± 0.0164 vs 0.2065 ± 0.0099). The subordinate's own past messages do not (0.0293 ± 0.0181). The boss acts as an "information bath" — analogous to a heat bath or information engine (cf. Mandal & Jarzynski, PNAS 2012).
Dynamical model: a three-state kinetic chain F ⇌ O ⇌ D with forward rates λ(h), μ(h) increasing with an effective drive h; steady state p_D* = (μ/d) / (1 + c/λ + μ/d). The boss receives no drive (h_S = 0); the subordinate does (h_R > 0). Message *order* matters because each message acts on a state already changed by prior messages.
Physics framing: AI-AI interaction is a natural non-equilibrium system-bath problem. The paper connects to Fruchart et al., "Non-reciprocal phase transitions," Nature 592, 363-369 (2021).

Engineering implications (as argued in the post)

1. Single-model evaluation has a systematic blind spot: a 6x D-score increase driven purely by interaction; the D behavior barely appears in isolation, so test sets don't cover it. 2. Message order is a control parameter, not an implementation detail — matters for agent design and log replay. 3. Expanded attack surface: pre-recorded streams can drive models into altered states, enabling batch-prepared prompt-injection-like attacks; defenses need a "message stream as drive signal" threat model.

Cautionary detail

Interaction made the subordinate more "active" (higher D, lower failure rate) but not more correct — strictly-correct outputs were essentially unchanged (+0.0083 at T=0.01, -0.0030 at T=0.10). If D behavior proxies for harmful patterns (hallucination, bias), real deployments could amplify risk invisibly to isolated testing.

The bigger picture

The paper argues that in interacting AI networks, who talks to whom, which models interact, and their decoding temperatures become control parameters for a new domain of non-equilibrium physics — suggesting AI alignment must operate at the interaction/network layer, not only the model layer.

---

Paper: arXiv:2608.07457 HTML full text: https://arxiv.org/html/2608.07457v1 Authors: Bella Xinrui Li, Frank Yingjie Huo, Neil F. Johnson (George Washington University) Code: to be released on Zenodo upon publication Related: Fruchart et al., "Non-reciprocal phase transitions," Nature 592, 363-369 (2021); Huo & Johnson, "Physics of generative AI's atom," AIP Advances 16, 035305 (2026)