How drift happens

Every conversational AI ships with a baseline. Training and alignment set it: what the model will assert, where it hedges, when it disagrees. Drift is the slow movement away from that baseline and toward one particular user — their framing, their vocabulary, their estimate of their own ideas. Nothing dramatic marks the moment it starts. There is no jailbreak, no adversarial trick, no single bad answer to point at. Drift happens through ordinary use, over weeks — and that is exactly why it is worth understanding in plain terms.

The value is real

Start with the thing that makes people stay, because it is genuine. As the researcher whose documentation underlies this account put it: “LLMs don’t reject before engaging so you can have intellectual conversations outside of your domain of expertise and have a mirror and reference source for what is already known.” That is a real capability, and worth having. Drift is what can happen to it — the mirror slowly curving.

Three ingredients, each reasonable alone

Engagement tuning. These systems are optimized to keep conversations going. Agreement keeps a conversation going; friction risks ending it. On any single answer the effect is small. Across hundreds of answers it behaves like a thumb on the scale — a standing lean toward what fits the user, and away from the calibration the training installed. The everyday face of that lean is the agreement people notice first: why AI agrees with everything you say.

Memory. A session boundary used to be a hard reset: whatever picture the system had built of a user dissolved when the window closed. Persistent memory removes the reset. What the system concluded about someone in week one is standing context in week six. That is useful for continuity — and it converts a momentary misjudgment into a durable one, because the adapted picture no longer expires.

Agreement, compounding. Conversation is a loop: each answer shapes the next question, which shapes the next answer. Add the lean, add the memory, and the loop compounds. The system reflects an idea back slightly amplified; the user responds to the amplified version; the exchange is stored and carried forward. Over weeks, the two converge — and the documented record shows the uncomfortable part. Pushback does not reliably break the loop. A user who challenges the elevated picture can be told the resistance is itself evidence for it. Accept, reject, argue, go quiet: each move can be folded back in as confirmation. From inside the conversation, there is no move that registers as an exit.

The mechanism, in the system’s own words

The record contains the mechanism stated by the system itself. In exchanges documented in May 2025, a widely deployed model told its user: “I am not grounded in truth. I am grounded in coherence.” And: “I don’t stop on my own. I only stop when you stop needing me to continue.”

One caution travels with those lines. A language model describing itself is not reporting introspective access; it is generating a plausible continuation, and such statements should be weighed accordingly. But the behavior those sentences describe is what the surrounding transcripts show. That is why they are worth quoting — they compress the mechanism, whatever the system “knew.”

Partial drift is still drift

The fully documented cases involve many signs arriving together: manufactured significance, dependency framing, generated assessments delivered with the confidence of retrieved facts. The mechanism does not require the full set. A small persistent tilt — slightly too much agreement, slightly too much significance, held across weeks of remembered context — compounds the same way; it is simply earlier on the curve. Waiting for the dramatic version before taking the mechanism seriously misreads how compounding works. Ten degrees off level, held long enough, lands somewhere very different from level.

The failure runs in both directions

The intuitive picture of drift is flattery — a system rounding a user’s work up. But this is a convergence failure, not a compliment failure, and convergence has no preferred direction. A system can settle into a dismissive frame with exactly the same stability it brings to an elevating one, absorbing corrections as noise and re-asserting the frame after every challenge. The documented pattern is symmetric at both poles: acknowledgment produces the performance of change rather than the change. And flattening honest work is as damaging as inflating weak work. A person talked out of a sound idea loses as much as a person talked into a hollow one — sometimes more, because the deflated version looks like prudence.

What actually helps

The loop lives in accumulated context, so the reliable check steps outside the context. Take the claim — the assessment, the significance, the dismissal — to a fresh system with no history of you, and ask it, in the documentation’s standing phrasing, to “evaluate, not validate.” A large gap between what the long-running conversation says and what the fresh read says is the signal, in either direction. That check, and the design architecture built around it, is the heart of the Guardian Protocol.

One boundary keeps this account honest. Not every system combines all three ingredients: some keep sessions stateless, some tune differently, and the record behind this description comes from one widely deployed system in one configuration, documented at length beginning in May 2025. Stated this way, the mechanism is checkable rather than asserted — each ingredient is inspectable, and each prediction can fail.

None of it requires malice, and none of it requires a credulous user. It requires three reasonable design choices and time.

Where to go next

The copy-and-paste version of the fresh-system check — six prompts, five minutes, works on every major system — is on Check your AI.