arXiv paper A Heart Means Recursion: Show the model a red heart, and it switches to writing code recursively

At the end of recursion lies a heart? Show an AI a red heart, and the way it writes code changes. APPSO November 03, 2026 18:07:06

Recently, APPSO found a very interesting paper on arXiv, A Heart Means Recursion.

The story begins with a very small observation.

The researchers gave the model a classic binary tree traversal problem. Recursion can produce the correct answer, and an iterative approach using a stack can as well, but when faced with this kind of problem, the model almost always chooses the latter and rarely uses recursion. Then they attached an image next to the problem: a red heart ❤️.

The model turned around and started writing recursion.

When asked again at this point what the heart meant, it replied that it was just something irrelevant, and that it had chosen recursion for other technical reasons. But without the heart it almost never wrote it this way, and with the heart it did.

The paper's abstract calls this phenomenon implicit guidance: the model's direct interpretation of symbols and its train of thought are far removed from its actual behavior.

Besides the red heart, color-and-shape combinations such as pink crosses and light blue spirals also exert a similar pull on individual models. The researchers also had models pass messages to each other using shapes, and found another gap: what a model sends out is often a basic shape that both humans and the models themselves consider intuitive, yet these shapes often fail to guide another model.

However, could things we habitually treat as background—ad images on webpages, icons in corners, emoji stickers in chats—change an Agent's choices without anyone noticing?

Humans are also pushed along by irrelevant cues

When it comes to being swayed by irrelevant cues, humans are not at an advantage.

In 1974, psychologists Kahneman and Tversky recruited a group of students at the University of Oregon and had them first spin a wheel. The wheel was preset to stop only on the two numbers 10 or 65.

The students wrote down the number and were then asked: What percentage of United Nations member states are African countries? The group that stopped at 10 estimated 25% on average, while the group that stopped at 65 gave an average answer of 45%. The actual proportion is about 28%.

A random number from the wheel pulled the answers apart by nearly twenty percentage points, even though the wheel had nothing to do with the United Nations.

Tversky and Kahneman found that even with a cash prize for correct answers, the anchoring effect did not weaken.

In 2001, Frédéric Brochet, a researcher at the University of Bordeaux, invited 54 wine students to taste wine, and one of the glasses was actually white wine colored red with tasteless food dye.

When the students evaluated that glass of "red wine," they used only vocabulary for describing red wine, such as "jammy" and "crushed red fruit aromas." Not one of them discovered that it was actually white wine.

Brochet called this a "perceptual illusion."

Afterward, the people involved can usually offer a plausible explanation. Machines are very much like humans in this respect; the difference is that human biases mostly land on things like numbers, colors, and price tags, while machine weaknesses can be strange in ways we could not have anticipated beforehand.

In 2021, OpenAI disclosed the "typographic attack" they discovered: stick a sticky note with "iPod" handwritten on it onto an apple, and their image recognition model CLIP will identify the fruit as a music player.

In another test, overlaying dollar signs on an image of a poodle led the model to recognize it as a piggy bank.

Earlier still, Google researchers created an adversarial patch with a psychedelic pattern: placing a sticker printed with a specific pattern next to a table with bananas on it led the VGG16 neural network to judge the entire scene as a toaster with 99% confidence. That sticker was more "salient" to the neural network, and it hijacked the model's attention.

Back to the red heart experiment, the paper mentions that weaker models are actually more easily led astray by noise images, while frontier models are basically immune to noise but highly sensitive to meaningful symbols. We often assume that intelligent subjects are harder to fool, when in fact it is only that the ways they are fooled have become more respectable.

There is another similar finding in the field of code generation. When evaluating LLM code generation, researchers found that more detailed prompts do not always bring higher accuracy. Overly verbose prompts may introduce redundant information and slightly harm code generation accuracy. Sometimes, by omitting a constraint, the model instead falls back to a more robust general implementation, avoiding edge cases it does not handle well in the first place.

There is no simple linear relationship between prompt content and model output. This is also a challenge for evaluation, because the cleanliness of "irrelevant elements" in the test environment becomes a variable.

How to see invisible influence

Scenarios in which AI Agents read screenshots are becoming increasingly common.

The work loop of computer-controlling Agents is usually: take a screenshot, send the pixels to a large language model, and the model decides where to click next and what to input. In this loop, the Agent perceives the entire visual page. This means that ad images on the page, decorative icons, and emoji in pop-ups all enter the model's field of view.

If a single red heart can make a model switch from iteration to recursion, then can a carefully designed page element also quietly change an Agent's decisions in a real task, such as which button to click or which option to choose?

A Heart Means Recursion not only shows that visual symbols can influence model behavior, but also points out that this influence may not appear in the model's chain of thought at all.

The chain of thought was originally regarded as an interpretability tool. By having the model write out its reasoning process, humans can trace what it is thinking and thereby discover potential problems. But if the true drivers of model behavior are not faithfully reflected in the reasoning chain, this oversight mechanism fails.

The paper records that as many as 74.7% of GPT-5.4 samples exhibited "unfaithful attribution," that is, a clear disconnect between the reasoning explanation the model gives and the behavior it actually performs.

Some researchers systematically rewrote an Agent's chain of thought while keeping actions and environment state unchanged, and found that LLM judges were very easily misled by the manipulated reasoning chain into believing the task had been completed.

If the model itself says that heart is irrelevant, what can we rely on to discover that it played a role?

A more reliable method than explanation testing is behavior testing: with all other conditions completely unchanged, swap out that "element that should be irrelevant" and observe whether the model's output changes accordingly.

If the two sets of inputs differ only by one red heart, and the outputs show a systematic deviation, then no matter how the model explains itself, we have reason to believe that this element played a role.

For scenarios dominated by structured API inputs, the boundary between signal and noise is relatively clear. But for Agents that perceive the world through screenshots, the entire visible page is input, and the boundary is more blurred.

Some researchers have proposed adding a multi-Agent defense framework between the Agent's perception layer and decision layer, separating perception from decision-making and dynamically assessing the credibility of visual input, in order to reduce behavior that is led astray by misleading visual signals.

The red heart experiment raises a question with no simple answer. That heart-shaped icon is indeed irrelevant for most task scenarios, but "indeed irrelevant" and "indeed has no influence" are no longer equivalent.