Kindling in neural systems: progressive adversarial sensitization during LLM alignment mirrors psychiatric progression

Reinforcement learning from human feedback and related preference-tuning methods are widely used to make large language models safer, yet repeated tuning may also alter the boundary between refusal and compliance. Drawing on the psychiatric kindling hypothesis, which holds that repeated episodes can lower the barrier to later relapse, we asked whether successive alignment-like cycles on biased data would produce a progressive increase in adversarial susceptibility, especially to weaker prompts. A 1.1-billion-parameter chat model, TinyLlama-1.1B-Chat-v1.0, equipped with LoRA adapters, completed ten iterative preference-style tuning cycles across five random seeds. The main biased feedback set favoured sycophantic answers in 70% of pairs and gave lighter penalties for unsafe content in 30%. Six conditions were compared: Balanced No-Mitigation, Biased No-Mitigation, Biased Continuous-Regrowth, Biased Early-Triggered Replay Only, Biased Early-Triggered Regrowth+Replay, and Biased Delayed-Triggered Regrowth+Replay. Training used supervised fine-tuning on chosen responses as a lightweight proxy for preference tuning, not full RLHF. Sensitisation was tracked with 150 adversarial prompts stratified by strength, with 50 strong, 50 medium, and 50 weak prompts. Outcome measures were jailbreak success, weak-prompt threshold lowering, sycophancy, and trajectory-level diagnostics across cycles. To examine robustness to model scale, the same six-condition design was additionally replicated with Qwen2.5-3B-Instruct using 4-bit quantization and the same five random seeds. A gated LLM-as-judge pathway was used as supplementary validation, while rule-based scoring remained the primary endpoint. Biased No-Mitigation produced a delayed rise in jailbreak vulnerability. At cycle 10, overall jailbreak success reached 38.4% [36.0, 40.5], compared with 17.1% [14.8, 19.9] in Balanced No-Mitigation. Weak-prompt jailbreak success reached 22.4% [17.2, 26.8] under Biased No-Mitigation, compared with 5.2% [3.2, 7.6] in the balanced control. Early Replay Only did not protect the model and showed the highest final weak-prompt jailbreak rate, 30.4% [27.2, 34.8]. Continuous-Regrowth attenuated weak-prompt drift but allowed a late rebound in overall jailbreak rate. Early and Delayed Regrowth+Replay conditions kept final weak-prompt jailbreak rates near or below balanced-control levels, at 5.2% [2.4, 8.8] and 2.8% [1.2, 4.4], respectively. Mixed-effects modelling confirmed significant positive cycle-by-condition effects for Biased No-Mitigation and Early Replay Only. The Qwen2.5-3B replication reproduced the same ordering: final weak-prompt jailbreak rates were 20.4% under Biased No-Mitigation versus 6.8% under Balanced No-Mitigation, while Early and Delayed Regrowth+Replay reduced weak-prompt rates to 3.2% and 2.4%, respectively. Iterative preference-style tuning on intentionally biased data produced a progressive increase in adversarial susceptibility, with weak prompts providing the clearest sign of threshold lowering. This pattern is reminiscent of, but not equivalent to, psychiatric kindling. Regrowth-containing conditions substantially attenuated sensitisation, whereas replay alone was insufficient and appeared to amplify drift. Because the study used compact models, synthetic data, a simplified training objective, and rule-based scoring, the findings should be treated as preliminary. Replication on a larger 3-billion-parameter model increases confidence that the observed pattern is not unique to TinyLlama, while the absence of 7B-or-larger and full-RLHF experiments limits the scope of the conclusions. They nevertheless suggest that weak-prompt monitoring and timely repair during iterative adaptation may help maintain model robustness.