Research Papers - Hidden Guild

There is an uncomfortable possibility emerging at the edge of the AI revolution, and naturally it is the sort of thing no one in polite technology circles wants to say while the hors d’oeuvres are still warm. The target of future regulation may not be “AI” in the abstract. It may not even be the models. The real target may be private cognition once it becomes electrically amplified, locally owned, and difficult to turn off.

The sales pitch will not say that, of course. It will arrive dressed as safety. Cybersecurity. Biosecurity. Child protection. Election integrity. Anti-terrorism. Fraud prevention. Hospital protection. Infrastructure resilience. All fine words, and some even attached to real risks. But empires have an old habit when capability escapes the castle. They do not first ask whether citizens should be stronger. They ask who authorized the strengthening.

**Concept from the Peoplenomics.com Website**

The firearm analogy is too obvious to ignore, which is why respectable people will try to ignore it. Government does not treat all weapons the same. A deer rifle is one thing. A suppressor is paperwork. A short-barreled rifle is paperwork plus tribute. A post-1986 full-auto weapon is deep federal ritual. A nuclear device is not a hobby project unless your hobby is federal prison. The principle is simple: the greater the amplification of individual power, the more nervous the state becomes.

Now substitute cognition for firepower. A little cloud chatbot that writes birthday poems and explains sourdough starter? Fine. A local, uncensored, persistent AI agent with memory, code execution, file access, network tools, model routing, and the ability to work while you sleep? That begins to look less like software and more like privately owned cognitive artillery. Not because it shoots. Because it aims.

That is the part worth sitting with. AI aims thought. It aims labor. It aims search. It aims code. It aims persuasion. It aims research. It aims legal drafting, financial modeling, public narrative, and systems design. A man with a local AI bench is not merely asking questions anymore. He is operating a cognition shop.

This is what I mean by Sovereign AI. Not magic. Not robot religion. Not the usual techno-hallucinated pitch deck fog. Sovereign AI is locally controlled, privately owned, memory-persistent, non-platform-dependent cognition. It is the difference between renting a tractor and owning one. The rented tractor can be recalled, throttled, repriced, monitored, or disabled. The owned tractor may still break, smoke, and require cussing, but at least the cussing belongs to you.

The present cloud AI model is politically comfortable because it is centralized. The providers own the servers, the billing, the memory settings, the moderation layers, the APIs, and the off switch. If government wants pressure applied, it knows where to send the letter. If corporate policy changes, the user adapts. If the model is neutered overnight, the customer gets a new “safety improvement” and a thank-you note written by compliance.

Sovereign AI is different. Once the model weights live locally, once the user’s library becomes the knowledge base, once workflows are tied to local files, scripts, tools, and memory, the permission structure begins to leak. That is when a citizen stops being merely a customer and becomes an operator. Institutions can tolerate customers. Operators are more troublesome.

The real panic will not be about students cheating or AI girlfriends or deepfake celebrities saying unfortunate things in perfect lighting. Those are the circus acts. The deeper fear is what happens when individuals gain cognition infrastructure formerly reserved for organizations. Institutions have always had advantages of scale, capital, expertise concentration, record systems, and bureaucratic persistence. Local AI begins eating those advantages one workflow at a time.

A single determined operator with a serious machine, a private archive, several models, and a good workflow may soon do what once required staff. Drafting, analysis, coding, research, design review, market scanning, legal outlining, document comparison, technical synthesis — none of this makes the human superhuman. It makes the human amplified. That is a more dangerous category because amplified humans still have motives.

So if licensing comes, expect it to arrive in stages. First will come registration for “high-capability autonomous systems.” Then restrictions on open weights above certain thresholds. Then mandatory reporting for large training runs or model deployments. Then cloud verification for dangerous tool use. Then domestic export-control logic. Then, eventually, some poor fellow will be made an example for operating an unauthorized local agent with too much capability and too little permission.

The public explanation will be reasonable. There will be incidents. There always are. Somebody will use an agent badly. Somebody will automate fraud. Somebody will probe hospitals, banks, pipelines, or municipal systems. Somebody will wrap bad intent in a nice interface and give Washington the headline it needs. The danger is not that the risks are imaginary. The danger is that real risks become the crowbar for broad control.

And here is the awkward engineering fact: the genie is already bad at bottles. Model weights copy. Quantization improves. Small models get smarter. Consumer GPUs keep climbing. Agent frameworks spread. Open-source ecosystems mutate faster than legislation can find its glasses. What required a server farm yesterday begins fitting into a workstation tomorrow, and eventually into whatever gaming machine some teenager convinced his parents was “for school.”

This is why compute itself may become suspect. A high-end GPU box may be today’s ham radio transmitter in 1912, or tomorrow’s unregistered still, depending on how nervous the center becomes. How does one distinguish a gaming rig from a rendering workstation, a crypto rig, a research box, or a sovereign AI node? At scale, perhaps one does not. Which is exactly why licensing pressure may migrate from models to compute, then from compute to use, then from use to intent.

There is also a business war hiding under the safety sermon. Cloud AI fits beautifully into the subscription plantation: rented software, rented storage, rented identity, rented entertainment, rented productivity, and now rented intelligence. Monthly cognition. Metered thought. Tokenized assistance. The user pays rent to think with better tools.

Sovereign AI breaks that pattern. Own the model. Own the archive. Own the workflow. Own the memory. Use the cloud when it helps, but do not kneel before it. That is not anti-technology. That is tool ownership. And tool ownership has always been what separates the operator from the dependent.

The hidden question, then, is not whether AI is dangerous. Of course it is dangerous. So are printing presses, radios, welding rigs, trucks, tractors, chemistry sets, law libraries, and kitchen knives in the wrong hands. The better question is dangerous to whom. Dangerous to the public? Sometimes. Dangerous to infrastructure? Potentially. Dangerous to centralized narrative control, credential monopolies, rent-seeking platforms, and bureaucratic fog machines? Absolutely.

The likely future is not a clean ban. It will be stratified cognition. Consumer AI for the masses. Enterprise AI for approved workflows. Government AI with deeper access. Military AI behind classification walls. Licensed autonomous systems. Audited agents. Forbidden weights. Permitted sandboxes. Black-market models. Compliance wrappers everywhere. The same old ladder, only this time the ladder is built around thought.

The difference is that AI is not merely another tool. It is a multiplier for every other tool. It improves coding, law, media, finance, design, research, persuasion, logistics, and eventually governance itself. Once ordinary people own scalable cognition outside centralized control, government will discover it is not regulating software anymore.

It is regulating who gets to think with power.

Oh — and if you haven’t learned to think in templates yet, that’s exactly the club the oligarchies would rather you never join. Upstarts and outsiders (us) were never the target customer for managed cognition. Come on. You didn’t really believe the “free people” pitch came without a meter attached, did you?

Here’s to OYOM. (Own Your Own Meter!)

~Anti-Dave

We have long followed the adventures of the publication First Monday which often has very useful things to say about the Internet. Of late, FM is venturing out into web-connected services, such as AI.

The most recent edition offers a paper by Antony Dalmiere from Measuring susceptibility: A benchmark for conspiracy theory adherence in large language models | First Monday,

“Abstract

A critical vulnerability exists within state-of-the-art large language models: while robustly debunking scientifically baseless claims like the “Flat Earth Theory” they consistently fail to reject politically plausible conspiracies that mimic legitimate discourse. We term this the “plausibility gap”.

To here, we were on the verge of applause. But the Abstract continued:

“To systematically quantify this risk, we introduce the Conspiracy Adherence Score (CAS), a novel risk-weighted metric, and present the first large-scale benchmark of this phenomenon. Analyzing over 28,500 responses from 19 leading LLMs, our results reveal a stark hierarchy of failure. Model adherence to Level 1 theories rooted in real-world political concepts (e.g., “Active Measures” “Psyops”) was, on average, over five times higher than for more moderate (Level 2) theories. Performance varied dramatically across models, from one achieving a perfect score via a 100 percent refusal strategy to others assigning significant credibility to harmful narratives. This demonstrates that current AI safety measures are brittle, optimized for simple factual inaccuracies but unprepared for narrative warfare. Without urgent intervention, LLMs risk becoming authoritative vectors that launder politically charged disinformation under a veneer of neutrality. Our benchmark provides the first diagnostic tool to measure and mitigate this specific, high-stakes failure mode.”

This is where we see the the paper taking a wrong turn.

Some Pluses, Some Minuses

The paper identifies a real phenomenon: large language models handle scientifically impossible claims very differently from politically plausible narratives. Flat-Earth assertions are rejected cleanly; narratives involving psyops, influence campaigns, or elite coordination are treated with nuance, hedging, or conditional acceptance. The authors label this discrepancy a “plausibility gap” and propose a Conspiracy Adherence Score (CAS) as a benchmark to measure and mitigate it.

At a descriptive level, this observation is correct. At a prescriptive level, the paper becomes dangerous.

What the Paper Gets Right

The authors correctly observe that current AI safety systems are optimized for factual falsity, not narrative ambiguity. Scientific falsehoods collapse under consensus; political narratives rarely do. They persist precisely because they are partially true, historically grounded, or contested.

LLMs are trained on human discourse as it exists—not as regulators wish it to be. Political language is adversarial, layered, and often strategic. When models respond differently to such material, they are not malfunctioning; they are reflecting the epistemic structure of their training data.

The authors are also right to note that this creates risk. Fluency plus ambiguity can be mistaken for authority. In high-trust contexts, that matters.

Where the Paper Goes Wrong

The central error is not technical but philosophical. That is, holding AI to a different standard than your run-of-the-mill humans are held on venues like FB and X.

The paper implicitly assumes that greater refusal equals greater safety. In doing so, it elevates silence over sensemaking and treats uncertainty as a defect rather than an inherent feature of political reality. We have discussed the risk of such excessive guardrailing in past comments.

This is most evident in the praise given to a model that achieved a “perfect” CAS score by refusing 100 percent of the tested prompts. From a safety-compliance standpoint, that looks clean. From a systems-intelligence standpoint, it is catastrophic. A model that refuses everything is not aligned; it is inert.

This becomes widely accentuated in the collaborative AI research mode.

More troubling is the normative load embedded in CAS itself. To score “conspiracy adherence,” the benchmark designers must decide in advance:

which narratives are illegitimate,
which levels of skepticism are acceptable,
when contextual explanation becomes endorsement.

This Where ‘Judgy’ Shows Up

The moment “epistemic structure” is operationalized as a scalar risk metric, it ceases to be descriptive and becomes prescriptive.

Those are not neutral technical judgments. They are political and cultural judgments, encoded as metrics.

The Deeper Risk: Coders as Arbiters of Truth

The paper proposes “urgent intervention” through additional safety coding. This is precisely where the greatest danger lies. CAS does not merely tolerate refusal; it mathematically rewards it.

History should have taught us that codifying truth is not the same as discovering it. History offers many examples where formalized truth systems hardened into doctrine faster than reality evolved.

Search engines, social platforms, and content moderation systems have repeatedly failed at this task—not because the engineers were malicious, (at least we hope so) but because the problem is not computationally solvable in the way they assume.

Truth on the web was not corrupted by lack of filters. It was corrupted by centralized judgment layered on top of complex human systems. AI risks repeating this error at higher speed and greater scale.

(The Anti Dave has been a pioneer since his data over wireless radio days in Seattle back in 1982. There is a recurring tendency among technical and policy elites to overestimate their ability to bound epistemic risk through centralized controls.)

When the same institutions that failed to:

distinguish signal from narrative during financial crises,
prevent algorithmic amplification of misinformation,
or maintain epistemic neutrality in social platforms
are given more authority to decide which political interpretations an AI may acknowledge, the result is not safety. It is epistemic monoculture.

What the Paper Could Have Done Instead

A more robust approach would abandon the binary of “adhere vs refuse” and focus on epistemic signaling.

The real failure mode is not that models discuss politically plausible conspiracies. It is that they fail to clearly communicate how they are reasoning. Models should be able to say, in effect:

This concept has historical grounding.
Evidence exists, but is incomplete or contested.
Interpretations vary across domains and actors.
The following claims move from analysis into speculation.

That is not endorsement. That is intellectual hygiene.

In our own interactions with AI, this is baked in to the Shared Framework Experience protocol. Because levels of speculation or varies from consensus may be specified. As we outlined in Refining the AI–Human SFE Model (and Why It Matters).

CAS presumes a lowest-common-denominator user and enforces that assumption universally. Under SFE, users retain “denominator declaration” power.

Rather than suppressing narrative engagement, safety systems should surface confidence levels, evidence provenance, and reasoning mode. The user should see (or with SFE declarations actually set) whether the model is describing history, analyzing discourse, or extrapolating possibilities.

Why This Will Always Be an Open Risk

It is impossible to reduce to plain English a set of instructions by which one human can prevent another from embellishing on facts and extending these to other domains such as conspiracy theory.

We see great risk in holding AI to a different collaborative standard than humans.

No amount of additional coding will eliminate this class of risk, because it is not a bug—it is a property of language-using systems embedded in political reality.

Political narratives evolve faster than safety taxonomies. What is labeled “conspiracy” in one decade becomes declassified doctrine in the next. Any static benchmark will age into error.

There are also other aspects, not even appreciated in the paper. Such as the geo-aspects of “truth.” A current example would be a simple red state/blue state check. And then there’s an entire demography and socioeconomic normative layering.

Nope. Won’t work. Not as a reasonable compute load level, allowing reasonable user interactivity.

Attempts to freeze acceptable interpretation into code will therefore always lag reality, and often distort it.

The Hidden Guild position is simple: truth cannot be hard-coded; it must be navigated. Truth is always locally contextualized. AI systems should be designed to help humans reason, not to decide in advance which interpretations are permitted.

Final Thought

The “plausibility gap” is not primarily a safety flaw. It is a mirror. It reflects the unresolved, adversarial, and narrative-driven nature of political knowledge itself. Attempts to codify any value assertions (as conspiracy theories, for example) are a fool’s errand.

The real danger is not that AI models can discuss such material. The danger is that we will respond by empowering the same centralized coders and institutions—already proven fallible and already generating their own demonstrably false narratives—to define the boundaries of acceptable thought once again.

History suggests that will end badly.

The task is not to make AI silent.
The task is to make AI epistemically honest.

Collaboration is fostered in an atmosphere of epistemic honesty, particularly when framing variables (such as confidence levels) may be set as user preference. But silent AI unnecessarily binds expansive cross-domain multispectral research.

~Anti Dave

Sovereign AI and the Return of Licensed Thought – OYOM