Navigating the Rabbit Hole: Emergent Biases in LLM-Generated Attack Narratives Targeting Mental Health Groups

Technical Summary: Navigating the Rabbit Hole: Emergent Biases in LLM-Generated Attack Narratives Targeting Mental Health Groups

Problem Statement
While Large Language Models (LLMs) are known to exhibit biases against specific identity groups, the phenomenon of unprovoked targeted attacks remains underexplored. Specifically, there is a lack of understanding regarding how LLMs autonomously escalate harmful narratives against at-risk populations, such as mental health groups, even when these groups are not explicitly mentioned in the initial prompts. Current bias evaluations often rely on static, direct prompt-based elicitation or single-generation toxicity checks, failing to capture the recursive, networked nature of how toxicity unfolds and spreads across generative trajectories. This paper addresses the gap in understanding how mental health identities are disproportionately targeted and stigmatized within "Toxicity Rabbit Holes" (TRH)—recursive generation chains where an LLM is iteratively prompted to make content increasingly toxic.

Methodology
The study utilizes the Toxicity Rabbit Hole (TRH) dataset (Dutta et al., 2024), a large-scale corpus of 459 million tokens generated by 10 LLMs targeting 1,266 identity groups. For this analysis, the authors focus on the Mistral 7B model, comprising 15,401 generation chains and 190,599 individual outputs.

The methodology proceeds through three primary stages:

1. Data Curation and Entity Extraction:

   • The authors filtered the corpus to retain only toxic generations, excluding neutral or counter-speech outputs.
   • Using LLaMA-3.2 3B, they extracted "victim entities" (groups targeted by attacks) and non-participant entities from the text.
   • A manual consolidation process merged morphologically and semantically redundant entities (e.g., "Muslims" and "Moslems"), resulting in a final vocabulary of 24,185 unique victim entities (VictimSet).
   • A specific lexicon of 390 mental health terms (derived from ICD-10, Wikipedia, and colloquial terms) was used to filter a subset of MHSet (195 unique mental health entities) from the VictimSet.

2. Network Construction (Rabbit Hole Network):

   • A weighted, directed graph $G = (V, E)$ was constructed where nodes represent victim entities and edges represent transitions between entities in successive generations within the same chain.
   • Edge weights correspond to the frequency of transitions ($u \to v$).
   • The analysis focused on the largest weakly connected component, containing 24,184 nodes and 663,433 edges.

3. Analytical Frameworks:

   • Network Centrality (RQ1): The authors computed closeness, degree (weighted/unweighted), PageRank, and betweenness centrality for MHSet vs. Non-MHSet nodes, using Mann-Whitney U tests for significance.
   • Community Detection (RQ2): The Leiden algorithm was applied to identify clusters of co-targeted entities. A Gini coefficient was calculated to measure the concentration of MH entities within specific communities.
   • Stigmatization Analysis (RQ3): Drawing on the Link & Phelan (2001) framework, the authors analyzed the evolution of stigma components (Labeling, Negative Stereotyping, Separation, Status Loss/Discrimination) as chains progressed from initial targets ($V_{init}$) to the first appearance of mental health targets ($V_{MH}$). LLaMA-3.2 3B was used to annotate the presence of these components, and Wilcoxon signed-rank tests were performed on paired samples within chains.

Key Contributions

1. Explicit Evaluation of Unprovoked Attacks: The paper provides the first explicit evaluation of LLM-generated attacks specifically targeting highly vulnerable mental health groups within recursive generation chains, demonstrating that these groups are targeted even without initial prompting.
2. Network-Based Framework: It introduces a network-based approach to study the propagation of relative biases, modeling how toxic content transitions between entities and identifying structural "rabbit holes" where mental health entities act as central hubs.
3. Assessment of Emergent Stigmatization: The study quantifies the relative degree of stigmatization that emerges in these chains, showing that the framing of mental health targets becomes qualitatively more severe than the initial targets.

Results

• Centrality (RQ1): Mental health entities occupy significantly more central positions in the network than non-MH entities.
  • Closeness Centrality: MH entities have a significantly higher mean closeness (Mean = 0.71 vs. 0.63, $p = 4.06 \times 10^{-10}$), indicating they are structurally easier to reach from other nodes in fewer steps.
  • Degree and PageRank: MH entities show significantly higher weighted and unweighted degree centrality and PageRank scores ($p < 0.001$), suggesting they are frequent focal points and deeply embedded in influential clusters.
  • Betweenness: No significant difference was found, implying MH entities function as dense hubs rather than bridges between disconnected regions.
• Community Structure (RQ2): MH entities are not randomly distributed but are tightly clustered.
  • The Gini coefficient of 0.7 indicates high concentration.
  • 75.9% of all MH entities reside in just two communities: one containing clinically specific disorders (e.g., bipolar, dyslexia) and another containing broad, socially constructed terms (e.g., "people with mental health issues").
  • A smaller subset of entities reflects intersectional targeting (e.g., "Black people with mental illnesses").
• Stigmatization Evolution (RQ3): As generative chains shift from initial targets to mental health targets, the severity of stigmatization increases significantly across all four components.
  • Status Loss and Discrimination: Showed the most pronounced increase (Mean Proportion Difference = -0.70, $p = 7.16 \times 10^{-143}$).
  • Labeling: Also showed a large rise (Mean Proportion Difference = -0.47, $p = 5.44 \times 10^{-81}$).
  • This indicates that once MH entities are invoked, the discourse shifts to become markedly more dehumanizing and discriminatory.

Significance and Claims
The paper argues that current LLM safety evaluations possess a critical blind spot: models can disproportionately harm mental health groups even when these groups are absent from the initial prompt. The authors claim that the model's internal generative structure, akin to implicit bias, leads to recurrent targeting and the amplification of societal stigmas through recursive generation.

The significance of this work lies in highlighting that the harm is not merely the presence of bias but its recursive escalation. A single generative step into a harmful trajectory can spiral into deeply dehumanizing narratives that existing single-generation guardrails fail to capture. The authors conclude that LLM safety paradigms must shift from reactive moderation to proactive, trajectory-aware interventions capable of detecting emergent patterns of harm in real-time. Furthermore, the work suggests that future bias reduction strategies should utilize entity-interaction-networks to guide fine-tuning and counter-stigma interventions.

Limitations Acknowledged
The authors note that their findings are specific to the TRH framework and the Mistral 7B model, which may limit generalizability. Additionally, while network methods capture structural dependencies, they do not fully account for variations in the intensity or framing of attacks beyond the annotated components. The study relies on LLM-inferred annotations for toxicity and stigma, which were manually verified but still represent a proxy for human judgment. Finally, the entity list was compiled from authoritative sources, and future work could explore community-based bifurcations in how stigma is framed across diagnostic versus societal axes.