arXiv paper A Heart Means Recursion: Show the model a red heart, and it switches from iteration to recursion

Recently, APPSO found a very interesting paper on arXiv, A Heart Means Recursion.

The story begins with a very small observation.

The researchers gave the model a classic binary tree traversal problem. Recursion can produce the correct answer, and so can an iterative approach using a stack, but when faced with this kind of problem, the model almost always chooses the latter and rarely uses recursion. Then they attached an image next to the problem: a red heart ❤️.

The model turned around and started writing recursion.

When the model was then asked what that heart meant, it replied that it was just something irrelevant, and that it had chosen recursion for other technical reasons. But when there was no heart, it almost never wrote it this way; with the heart, it did.

The paper's abstract calls this phenomenon implicit guidance: the model's direct interpretation of the symbol and its chain of thought are far removed from its actual exhibited behavior.

Besides the red heart, color-and-shape combinations such as pink crosses and light blue spirals exert a similar pull on individual models. The researchers also had models pass messages to each other using shapes, and discovered another gap: what the models sent out were often basic shapes that both humans and the models themselves considered intuitive, yet these shapes often failed to guide another model.

But could the ad images on webpages, the icons in the corners, and the emoji stickers in chats—things we habitually treat as background—change an Agent's choices when no one is noticing?

Humans are also pushed along by irrelevant cues

When it comes to being swayed by irrelevant cues, humans are not at an advantage.

In 1974, psychologists Kahneman and Tversky recruited a group of students at the University of Oregon and had them first spin a wheel. The wheel was preset to stop only on the two numbers 10 or 65.

The students wrote down the number and were then asked: What percentage of United Nations member states are African countries? The group that stopped on 10 estimated 25% on average, while the group that stopped on 65 gave an average answer of 45%. The actual proportion is about 28%.

A random number from the wheel pulled the answers apart by nearly twenty percentage points, and the wheel had nothing to do with the United Nations.

Tversky and Kahneman found that even with a cash prize for correct answers, the anchoring effect did not weaken.

In 2001, Frédéric Brochet, a researcher at the University of Bordeaux, invited 54 wine students to taste wine, and one of the glasses was actually white wine colored red with tasteless food dye.

When the students evaluated that glass of "red wine," they used only vocabulary for describing red wine, such as "jammy" and "crushed red fruit aromas." Not one of them discovered that it was actually white wine.

Brochet called it a "perceptual illusion."

Afterward, the people involved can usually offer a plausible-sounding explanation. Machines are very much like humans in this respect, except that human biases mostly land on things like numbers, colors, and price tags, while machines' weaknesses can be strange in ways we could not have anticipated beforehand.

In 2021, OpenAI disclosed the "typographic attack" they discovered: stick a sticky note with "iPod" handwritten on it onto an apple, and their image recognition model CLIP will identify the fruit as a music player.

In another test, overlaying dollar signs on an image of a poodle led the model to recognize it as a piggy bank.

Earlier still, Google researchers created an adversarial patch with a psychedelic pattern: placing a sticker printed with a specific pattern next to a table with bananas on it led the VGG16 neural network to judge the entire scene to be a toaster with 99% confidence. That sticker was more "salient" to the neural network, and it hijacked the model's attention.

Returning to the red heart experiment, the paper mentions that weaker models are actually more easily led astray by noise images, while frontier models are basically immune to noise yet highly sensitive to meaningful symbols. We often assume that smarter subjects are harder to fool, when in fact it is only that the ways they get fooled have become more respectable.

There is a similar finding in the field of code generation. When evaluating LLM code generation, researchers found that more detailed prompts do not always bring higher accuracy. Overly verbose prompts may introduce redundant information and slightly harm code generation accuracy. Sometimes, omitting a constraint actually causes the model to fall back to a more robust general implementation, avoiding edge cases it does not handle well.

There is no simple linear relationship between prompt content and model output. This is also a challenge for evaluation, because the cleanliness of "irrelevant elements" in the test environment becomes a variable.

How do you see an invisible influence?

The scenario of AI Agents reading screenshots is becoming increasingly common.

The work loop of a computer-controlling Agent is usually: take a screenshot, send the pixels to a large language model, and the model decides where to click next and what to input. In this loop, the Agent perceives the entire visual page. This means that ad images on the page, decorative icons, and emoji in pop-ups all enter the model's field of view.

If a single red heart can make a model switch from iteration to recursion, then could a carefully designed page element also quietly change an Agent's decisions in a real task—for example, which button to click or which option to choose?

A Heart Means Recursion not only shows that visual symbols can influence model behavior, but also points out that this influence may not appear in the model's chain of thought at all.

Chain of thought was originally regarded as an interpretability tool. By having the model write out its reasoning process, humans can trace what it is thinking and thereby spot potential problems. But if the true drivers of the model's behavior are not faithfully reflected in the reasoning chain, this oversight mechanism fails.

The paper records that as many as 74.7% of GPT-5.4 samples exhibit "unfaithful attribution," meaning there is a clear disconnect between the reasoning explanation the model gives and the behavior it actually performs.

Some researchers systematically rewrote an Agent's chain of thought while keeping its actions and environment state unchanged, and found that LLM judges are very easily misled by the manipulated reasoning chain into believing the task has been completed.

If the model itself says that heart is irrelevant, what can we rely on to discover that it played a role?

A more reliable method than explanation testing is behavioral testing: with all other conditions held completely constant, swap out that "element that should be irrelevant" and observe whether the model's output changes accordingly.

If the only difference between two sets of inputs is a red heart, and the outputs show a systematic bias, then no matter how the model explains itself, we have reason to believe that this element played a role.

For scenarios dominated by structured API inputs, the boundary between signal and noise is relatively clear. But for Agents that perceive the world through screenshots, the entire visible page is input, and the boundary is much blurrier.

Some researchers have proposed adding a multi-Agent defense framework between the Agent's perception layer and decision layer, separating perception from decision-making and dynamically assessing the credibility of visual input, in order to reduce behavior that is led astray by misleading visual signals.

The red heart experiment raises a question with no simple answer. That heart-shaped icon is indeed irrelevant for most task scenarios, but "indeed irrelevant" and "indeed has no effect" are no longer equivalent.

This article comes from the WeChat public account "APPSO," author: the one who discovers tomorrow's products, published by 36Kr with authorization.