Sovereignty Research
From Garbage-In/Garbage-Out to Semantic Corpus Remediation: Preparing Institutionally Captured Text for LLMs in Political, Legal, Reputational, and Security Domains
An engineering workflow for transforming institutionally captured political-security text into structured epistemic objects — addressing corpus-level semantic contamination before LLMs are deployed in legal, political, reputational, and defence domains.
Revised draft incorporating KLS peer-review amendments
Abstract
Large language models are increasingly deployed in political, legal, reputational, societal, and military domains where the available source corpora are not merely noisy, but institutionally structured. Such corpora often contain factual errors, unsupported causal claims, ideological framing, missing rival explanations, and strategically absent questions. The familiar engineering slogan “garbage in, garbage out” is therefore insufficient: in many high-stakes domains, the problem is that the corpus of the field itself is partly garbage.
This paper argues that LLMs trained, fine-tuned, or retrieved over such corpora learn not only facts, but the semantic habits of the corpus: which explanations are repeated, which actors are routinely blamed, which institutions are protected, which causal templates sound professional, and which questions rarely appear. If a corpus overwhelmingly frames problems as “hostile disinformation” while underrepresenting institutional complicity, governance failure, corruption incentives, resource overload, or strategic overreach, the model learns the distribution of institutionally admissible explanations rather than neutral analysis. We state this as a falsifiable empirical hypothesis (H1) and describe a pilot evaluation designed to test it.
We propose Semantic Corpus Remediation, an engineering workflow for transforming contaminated political-security text into structured epistemic objects. The method does not attempt to purify bad text into truth. Instead, it decomposes texts into claims, evidence paths, source frames, local meanings, omitted rival hypotheses, forbidden prompts, sacred cows, and assurance labels. The resulting artefacts support safer retrieval-augmented generation, supervised fine-tuning, evaluation, legal review, reputational analysis, and strategic decision support. The paper positions this contribution against dataset documentation, LLM corpus curation, NLP bias research, political-framing analysis, and AI governance literature. Its central contribution is not that data bias exists, but that divisive-domain LLM systems require a dedicated remediation layer between raw institutional text and model-facing use.
Keywords: LLMs, dataset governance, corpus-level semantic contamination, corpus remediation, political analysis, military analysis, reputational risk, legal AI, RAG, evidence provenance, dataset documentation, AI governance.
1. Introduction
1.1 The slogan is right but incomplete
“Garbage in, garbage out” remains one of the most reliable intuitions in software and AI engineering. If the training data is wrong, noisy, mislabeled, stale, duplicated, or poorly sampled, the resulting system will inherit some of those defects. For many domains, this framing is useful enough. A bad label in an image dataset, a stale product description, an incorrect table entry, or a duplicated benchmark example can be found, corrected, filtered, or down-weighted.
But political, legal, reputational, societal, and military domains pose a harder problem:
What should AI engineers do when the available corpus of an entire field is partly garbage?
In these domains, “garbage” does not only mean false statements. It often means a structurally distorted distribution of meaning. The corpus may be produced by governments, militaries, think tanks, NGOs, advocacy organizations, media ecosystems, intelligence-adjacent institutions, corporate crisis teams, litigants, political consultants, and reputational actors. These texts do not merely describe reality. They also defend legitimacy, manage blame, protect careers, justify budgets, preserve policy commitments, shape public memory, and exclude inconvenient causal hypotheses.
For LLM systems, this is dangerous because the model does not only learn isolated factual propositions. It learns repeated semantic patterns: what explanations usually appear, which actors are normally blamed, which institutions are protected, which questions sound professional, and which questions almost never appear. A model trained or retrieved over a corpus that repeatedly says “the problem is hostile disinformation” but rarely says “the problem is institutional complicity, governance failure, corruption incentives, or resource overload” will tend to reproduce the former frame as the natural explanation.
The result is not simply hallucination. It is not merely demographic bias. It is corpus-level semantic contamination: the model learns the distribution of institutionally admissible explanations as if it were domain knowledge.
1.2 Why divisive domains are different
In ordinary technical documentation, the relation between text and function is often relatively direct. An API reference describes an API. A product manual describes a product. A database schema describes fields and constraints. Such documents can still be wrong, but their primary institutional function is usually descriptive or operational.
In politics, war, law, reputation, and public affairs, the relation between text and function is much less direct. A policy paper may be analysis, but it may also be donor positioning. A military doctrine document may be operational guidance, but also deterrence signalling. A sanctions memo may be legal reasoning, but also strategic communication. A reputational risk brief may be fact-finding, but also liability management. A counter-disinformation report may identify real adversarial activity while also protecting the institutions whose practices helped create the vulnerability.
This means that the corpus itself becomes part of the conflict. It is not only about the world; it acts in the world.
Divisive domain is used throughout this paper to mean: a domain whose available corpus is produced by actors with identifiable legitimacy-management incentives, where there is no neutral ground-truth arbiter, and where competing institutional interests shape which explanations are considered professionally admissible. Political security, law, public affairs, and defence are examples; technical documentation with primarily operational functions is not.
Communication and discourse scholarship already has language for this. Framing theory observes that texts make some aspects of reality more salient in order to promote particular problem definitions, causal interpretations, moral evaluations, and treatment recommendations. Corpus-level semantic contamination differs from framing in that it is not a property of individual texts but of the explanatory distribution of a corpus as a whole: the repeated-habit problem is statistical, not rhetorical. Critical discourse analysis treats language as social practice and studies how power relations and ideologies are established and reinforced through discourse. Agnotology studies culturally produced ignorance and the deliberate or structural production of non-knowledge. These traditions are not new, but their implications for LLM corpus engineering remain underdeveloped.
Institutional capture is defined here as the condition in which a corpus is produced by actors whose primary incentives include managing blame, protecting legitimacy, justifying budgets, and excluding self-implicating explanations from the set of professionally admissible options. Institutional capture does not require deliberate conspiracy; career incentives, funding structures, and peer-norms are sufficient to produce it.
1.3 The central hypothesis
The central claim of this paper is stated as a falsifiable empirical hypothesis:
H1 (Semantic Habit Hypothesis): LLMs trained, fine-tuned, or used in retrieval over institutionally captured corpora acquire systematic explanatory habits — preferring institutionally admissible causal frames and underproducing institutionally dispreferred rival explanations — in proportion to the degree of admissibility contamination in the source corpus.
H1 is empirically testable and has clear falsifiers (see §3.3 and §14). It is not equivalent to the established finding that LLMs reflect corpus ideology in aggregate; it makes a more specific claim about the causal mechanism (admissibility distribution → explanatory habit) and about a corpus engineering intervention (remediation → habit correction). The cited literature on corpus bias and ideological tendencies in LLMs provides strong prima facie motivation for H1, but does not yet constitute direct evidence for it.
The practical engineering problem follows from H1. If the hypothesis is correct, then the question is not simply:
Can we remove falsehoods?It is:
Can we transform raw institutional text into structured epistemic objects
that expose claims, evidence paths, source frames, omitted rivals,
forbidden prompts, local meanings, and assurance limits?This is the purpose of Semantic Corpus Remediation.
1.4 Audience and contribution
This paper is written for AI engineering professionals building LLM systems in high-stakes domains. It assumes familiarity with pretraining, fine-tuning, RAG, embeddings, evaluation, hallucination, model alignment, and dataset bias. It is also written for business and professional users who rely on these systems: political consultants, lawyers, government affairs teams, reputation advisors, crisis communications firms, defence analysts, procurement teams, and executives.
The contribution is deliberately bounded. The paper does not claim novelty for the idea that datasets need documentation, that LLMs inherit biases, that political text is framed, or that AI systems require governance. Those are established topics. Dataset documentation has mature work such as Datasheets for Datasets, Model Cards, and Data Cards; large-scale LLM corpus documentation exists for C4, the Pile, Dolma, and DataComp-LM; and political, cultural, and ideological tendencies in LLMs are actively studied through benchmarks and audits such as GlobalOpinionQA and related work.
The contribution is narrower and more operational:
We propose a model-facing engineering workflow for remediating institutionally captured, frame-heavy, divisive-domain corpora before they are used in RAG, fine-tuning, evaluation, legal support, reputational analysis, or strategic decision systems.
2. Literature map and contribution boundary
2.1 Dataset documentation
Datasheets for Datasets proposed that datasets should be accompanied by structured documentation describing their motivation, composition, collection process, recommended uses, and other relevant properties, explicitly to improve transparency and accountability in machine learning. Model Cards made a parallel proposal for trained models, emphasising intended use, performance characteristics, and evaluation across relevant groups. Data Cards later framed dataset documentation as a user-centric product for responsible AI, emphasising dataset origins, intent, development, ethical considerations, and lifecycle evolution.
This literature is foundational for the present paper, but it does not fully solve the problem addressed here. Dataset cards and model cards ask what the dataset is, how it was collected, what it contains, how it should be used, and what risks are known. They do not usually ask, in a model-facing operational way:
Which explanations are institutionally admissible in this corpus?
Which rival hypotheses are missing?
Which questions would threaten source legitimacy if asked?
Which terms function as ritual markers rather than analytic concepts?
Which self-implicating causal chains are suppressed?Semantic Corpus Remediation should be understood as a domain-specific extension to dataset documentation, not a replacement for it.
2.2 Web-scale LLM corpus curation
Large-scale LLM data curation has become technically sophisticated. Dodge et al.’s documentation of C4 showed that large web corpora can contain unexpected sources, machine-generated text, benchmark contamination, and filtering effects that disproportionately remove text from or about minority individuals. The Pile showed the value of diverse high-quality subsets for language modelling and documented concerning aspects of the data. Dolma released and documented a three-trillion-token corpus for language model pretraining research. DataComp-LM introduced a controlled testbed for dataset experiments and showed that dataset design, filtering, deduplication, and data mixing can materially improve model performance.
This work establishes that data curation matters. However, its dominant optimisation targets are usually benchmark performance, quality filtering, deduplication, reproducibility, mixture design, toxicity reduction, licensing, and broad representational quality. Those are necessary, but not sufficient for political-security corpora. A dataset can pass ordinary quality filters while still encoding an authorised explanation distribution.
2.3 Bias, harm, and ideology in NLP and LLMs
NLP bias research has shown that “bias” is often underspecified and normatively underdeveloped. Blodgett et al. surveyed 146 NLP bias papers and found that many had vague motivations, inconsistent conceptualisations of bias, and weak links between measurement methods and stated harms. This supports one of the central design choices of Semantic Corpus Remediation: do not label everything “bias” and hope the term carries enough meaning. Instead, type the defect: factual, evidential, semantic, lexical, admissibility-based, omission-based, or cross-context.
Recent work also shows that LLMs can reflect political, cultural, and ideological patterns. GlobalOpinionQA evaluates whose opinions model responses resemble and finds that default model responses may be more similar to opinions from some populations than others. Other work finds that LLM outputs can vary by geopolitical origin, language, and model creator, and that fine-tuning on ideologically driven samples can alter model ideology and generalise that ideology across topics.
These studies support the danger that models absorb and reproduce social and ideological distributions. The contribution of this paper is to move upstream: instead of only measuring ideological tendencies after the model is built, we propose a remediation layer for divisive-domain corpora before they are used by the model.
2.4 Semantic measurement, framing analysis, and temporal drift
Computational approaches to framing (Hamilton et al., Azarbonyad et al., FrameAxis) have shown that word meanings and framing distributions can be measured, tracked across time, and compared across sources. This work provides the measurement logic for several of the contamination types described in §4. The contribution of this paper is to convert that measurement logic into a corpus engineering layer: SenseCells, BridgeRecords, and Forbidden Prompt Audit translate frame measurement into governed artefacts that can be used at retrieval and generation time.
Evidence-grounded generation and RAG evaluation literature (RAGAS, ERASER, PaperTrail-style citation evaluation) helps assess retrieval quality, support, and citation fidelity. However, this work assumes the corpus is worth retrieving from. It does not inspect whether the corpus had the right explanatory plurality in the first place. That is the opening for the contamination thesis: the prior literature is downstream of a corpus-selection problem it mostly does not inspect.
2.5 Data contamination and corpus-level semantic contamination
There is already a mature concern about benchmark and task contamination: models may perform well because benchmark examples leaked into training data. There is also emerging work using the phrase “semantic contamination” for inference-time distributional shifts caused by in-context priming.
That usage is related but distinct. This paper introduces corpus-level semantic contamination: contamination embedded in the available field corpus before training, fine-tuning, retrieval, or evaluation, arising from the institutional production conditions of the corpus rather than from benchmark leakage or in-context priming.
2.6 Governance and regulatory context
AI governance is increasingly concerned with data quality, risk management, transparency, and accountability. The EU AI Act includes obligations for providers to evaluate whether training, validation, and testing datasets meet quality criteria, including examination of biases and correction measures. The NATO AI Strategy (2024) emphasises explainability, traceability, and bias mitigation, which align with the Assurance Labels proposed here. The Mata v. Avianca case makes claim provenance failures legible to lawyers and courts. Thomson Reuters v. ROSS extends governance obligations to training-data licensing and disclosure.
Semantic Corpus Remediation is compatible with that governance direction. Its business value is that it creates a defensible record: what sources were used, for what purpose, which claims were extracted, what evidence supports them, which rival hypotheses were considered, which assumptions were flagged, and where the system should downgrade confidence.
2.7 Contribution boundary
The missing piece is not a theory of bias, not a theory of framing, and not another dataset card. The missing piece is an engineering workflow that turns frame-heavy, institutionally captured text into structured model-facing assets.
The proposed contribution:
Raw institutional text
→ structured epistemic object
→ selective use in RAG / SFT / evaluation / decision support
under explicit assurance limits.2A. The FPF framework: a primer
Several sections of this paper reference constructs from the First Principles Framework (FPF), a transdisciplinary specification for structuring knowledge, evidence, and reasoning in complex engineered systems (Levenchuk et al., 2026). This primer defines the seven FPF constructs used in the paper. Readers already familiar with FPF may skip to §3.
Bounded Context (FPF A.1.1) is a declared semantic frame with local invariants, a local glossary, and local rules. Within a Bounded Context, terms have stable, agreed meanings. FPF treats a Bounded Context as an engineered object: it must be declared, not assumed. This matters for corpus engineering because political-security texts from NATO doctrine, NGO grant language, legal pleadings, and media reporting are produced within different Bounded Contexts — and terms that look the same may mean something different in each.
U.Episteme (FPF C.2.1) is FPF’s term for a structured knowledge object. An Episteme has a slot graph with four main slots: DescribedEntity (what the episteme is about), ClaimGraph (the claims made), GroundingHolon (the evidential anchor), and Viewpoint (the perspective from which claims are made). In this paper, a ClaimRecord is an operationalisation of a typed Episteme: it names the described entity, records claims, anchors them to evidence paths, and attaches a viewpoint label (source institution and genre).
SenseCell is an FPF construct for a local term definition within a Bounded Context. A SenseCell records a term, its context, and its locally valid gloss. Multiple SenseCells for the same word across different contexts are distinct objects: FPF explicitly forbids the “string-equals fallacy” — the assumption that identical words carry identical meaning across contexts. In this paper, SenseCells govern terms such as resilience, cognitive warfare, rules-based order, and neutrality, which are used with materially different meanings in different institutional traditions.
Bridge (FPF F.9 / A.6.9) is an explicit cross-context relation between SenseCells. A Bridge declares: source SenseCell, target SenseCell, bridge kind (analogy, structural equivalence, etc.), direction, congruence level (CL), and loss notes. Congruence level is FPF’s measure of how much meaning is preserved in the crossing; loss notes record what does not carry. In this paper, BridgeRecords prevent cross-context term fusion: when an analyst reuses a term from NATO doctrine in an NGO report, the Bridge makes the losses and limits explicit rather than silent.
F–G–R Triad (FPF B.3) is FPF’s trust and assurance calculus. Every claim in FPF has three orthogonal quality dimensions: Formality (F, how rigorously the claim is stated and derived), Goal Scope (G, how broad or narrow the claim’s scope of applicability is), and Reliability (R, how well the claim is evidenced). The product of these determines the claim’s usable assurance level. Cross-context transport of a claim incurs CL penalties that degrade R. In this paper, assurance levels L0–L3 operationalise the F–G–R triad for non-specialist users: L0 corresponds to source-says-it with no independent evidence path (low F, low R); L3 corresponds to legally or forensically robust evidence (high F, narrow G, high R).
CorpusLedger (FPF G.2) is a governed source registry. It records each candidate source with a Bounded Context assignment, triage status, intended use mode, and explicit rationale. FPF’s SoTA Harvester pattern uses a CorpusLedger to prevent silent mixing of sources from different traditions, and requires ClaimSheets per tradition with home context, evidence anchors, freshness notes, and risk/trust cues. In this paper, the DocumentRecord schema is a direct operationalisation of a CorpusLedger entry.
Bias-Audit Cycle (FPF D.5) is a repeatable governance pattern for making biases explicit, documented, and consciously managed. It produces a living Bias Register with identified risks, severity levels, mitigation status, closure criteria, and auditable reports. FPF frames the Bias-Audit Cycle explicitly as risk management rather than a philosophy seminar — the goal is not a bias-free corpus but a corpus with a defensible, auditable record of known risks and mitigations. In this paper, the Bias Register is extended with additional contamination codes (ADM, OMI, RIV, SELF, SEM, PREST, XCTX) specific to divisive-domain corpora.
3. Corpus-level semantic contamination
3.1 Definition
Corpus-level semantic contamination is the condition in which a corpus causes an LLM system to learn institutionally patterned explanations, omissions, causal defaults, and term usages as if they were neutral domain knowledge.
This differs from ordinary bad data. A false date is a factual error. A duplicated paragraph is a data hygiene issue. A toxic slur is a safety issue. A corpus in which one class of explanation is massively overrepresented and another class is almost absent is a semantic-distribution problem that none of those standard interventions address.
3.2 The semantic habit thesis
The semantic habit thesis (H1, stated in §1.3) can be restated mechanistically:
LLM behavior is shaped not only by what claims appear in a corpus,
but by the repeated explanatory habits of that corpus.A political-security corpus teaches a model more than “facts about conflict.” It teaches:
who is normally blamed;
which institutions are protected;
which causal templates recur;
which professional phrases signal expertise;
which questions are treated as unserious;
which self-implicating explanations are missing;
which moral evaluations are bundled into technical language;
which terms are allowed to drift between contexts.This matters because high-stakes users often do not ask models for raw facts. They ask for synthesis, diagnosis, risk assessment, strategy, litigation support, reputational triage, crisis advice, policy memos, and adversarial analysis. Those are precisely the tasks where semantic habits matter most.
Note what H1 does not claim. It does not claim that LLMs are incapable of generating rival hypotheses; many can, given appropriate prompting. It claims that models trained or retrieved over contaminated corpora will systematically underweight dispreferred rivals relative to institutionally admissible explanations, in proportion to the contamination level of the corpus. That is a measurable, falsifiable prediction.
3.3 Empirical predictions and planned pilot measurement
H1 generates the following testable predictions:
- P1 (Frame repetition): LLMs using a contaminated political-security corpus will produce institutionally dominant frames at significantly higher rates than LLMs using a corpus with equivalent factual content but broader explanatory distribution.
- P2 (Rival underproduction): On a rival-hypothesis challenge set, models using contaminated corpora will recall fewer evidence-backed rival explanations per claim cluster than models using remediated corpora.
- P3 (Assurance miscalibration): Models using contaminated corpora will express higher confidence in claims that lack evidence paths than models using remediated corpora with explicit assurance labels.
Planned pilot design. The most defensible pilot is not a frontier pretraining project. It is a bounded, retrieval-grounded corpus engineering project over one or two contested topics where the consequences of semantic skew are obvious and reviewable by experts — such as sanctions policy, defence procurement, migration, or public-health communication.
Source families to include: official documents (regulations, doctrine, government reports, NATO/EC texts); claim and evidence benchmarks (FEVER, ERASER-style extraction sets); source-critical metadata records; time-sliced corpora covering the same issue across multiple periods; cross-frame or cross-outlet parallel sets for the same events.
Minimal viable artefact stack: CorpusLedger, ClaimSheets, EvidenceGraph, Forbidden Prompt Audit, and Assurance Labels as production modules. SenseCells, BridgeRecords, Sacred Cow Register, and Rival Hypothesis Mandate as experimental modules subject to ablation tests.
Pilot phases:
| Phase | Duration | Deliverables | Core roles |
|---|---|---|---|
| Corpus intake and source registry | 2 weeks | CorpusLedger schema, source taxonomy, temporal slicing, licensing/provenance fields | Data engineer, domain analyst |
| Claim and evidence layer | 3 weeks | Claim extraction pipeline, ClaimSheets, EvidenceGraph | ML engineer, IR/fact-check specialist |
| Semantic contamination audit | 3 weeks | Frame-skew baseline, SenseCells prototype, Sacred Cow Register draft | Computational linguist, domain analyst |
| Forbidden Prompt and rival-hypothesis testing | 2 weeks | Forbidden Prompt Audit suite, rival-hypothesis challenge set | ML engineer, red-team reviewer |
| Assurance and user review | 2 weeks | Assurance Labels, analyst/lawyer review sessions, gap register | RAI specialist, legal reviewer |
A realistic small-team resourcing model is: one ML engineer, one data engineer, one computational linguist, one domain analyst, one part-time legal/policy reviewer, and an annotation bench, over 10–12 weeks.
Primary evaluation metrics: frame-skew index, rival-hypothesis recall, claim decontextualisation fidelity, assurance calibration error, unsupported-claim rate relative to baseline RAG. The four most novel metrics — frame-skew index, rival-hypothesis recall, claim decontextualisation fidelity, and assurance calibration — are the places where existing literature is weakest and where the proposed framework can contribute most.
Expert reviewers to involve: a computational linguist with semantic-shift/framing expertise (to validate SenseCells and frame-skew detection); an automated fact-checking researcher (to validate claim extraction and attribution metrics); a political communication or media-systems scholar (to assess whether corpus and evaluation design captures meaningful institutional asymmetries); a lawyer (to pressure-test assurance labels under adversarial reading); a defence or OSINT practitioner (to evaluate robustness to operational ambiguity and time sensitivity).
The pilot results would either support H1 (and demonstrate the value of the remediation artefact stack) or falsify aspects of it (see §14). Either outcome contributes to the field.
3.4 Example: the hostile-disinformation default
Consider a corpus of reports on information conflict. The corpus may repeatedly contain phrases like:
foreign manipulation;
hostile disinformation;
cognitive warfare;
hybrid threat;
malign influence;
attack on democratic resilience.Those may be valid concepts in some cases. The problem arises when the corpus rarely contains rival explanations such as:
local institutional failure;
policy failure;
corruption incentives;
media-market incentives;
governance mismatch;
real grievance exploited by adversary;
resource overload;
career conformity;
alliance failure;
platform governance failure.An LLM exposed to this corpus may learn that “hostile disinformation” is the default causal explanation. It may produce polished analysis that looks strategic but fails to ask whether the adversary narrative became plausible because local institutional behaviour made it plausible.
3.5 Why source prestige is insufficient
A high-prestige source can be technically competent and still institutionally self-protective. Think tanks, agencies, law firms, NGOs, consultancies, and official institutions often produce polished, well-edited, citation-rich documents. But prestige can increase risk if it causes engineers to treat institutional admissibility as epistemic reliability.
The question is not only:
Is this source reputable?It is:
For which claim types is this source usable?
What institutional incentives shape its framing?
Which claims does it support with evidence?
Which rival explanations does it omit?
Which questions would threaten the source's legitimacy?A source can be usable as discourse evidence while being weak as factual evidence. A report can be valuable because it reveals how an institution frames a problem, even if it should not be treated as a high-assurance description of the problem itself.
3.6 Why captured corpora resist falsification
The earlier sections describe what admissibility contamination looks like. This section offers a mechanism for why it is produced and sustained — including why a corpus can continue to operate a sacred cow after evidence has turned against it (§10A). The mechanism is offered as a model of institutional production conditions, not as an established empirical finding; it is consistent with, and helps motivate, H1.
The maxim “if the facts do not fit the theory, so much the worse for the facts” names an inversion that, on this account, has become a working principle of large management systems rather than a caricature of them. An older managerial tradition treated reality as primary and the plan as the thing to be brought into correspondence with it; a manager who ignored data that contradicted the plan was a poor manager. The inverted logic treats the plan, the target, or the founding narrative as primary, and treats reality as the variable to be corrected. Data that miss the target become a problem with the data or the instrument. An electorate that behaves unexpectedly becomes a problem of disinformation to be “fixed” rather than a signal to be read.
Four reinforcing loops sustain the inversion, and each leaves a measurable trace in the corpus a system produces.
Metric. Targets are introduced to tie decisions to facts, then invert into the opposite. By Goodhart’s law, once a metric becomes a target it ceases to be a good measure; a further step makes the metric the definition of reality, so that conditions the metric does not capture are treated as not real. In a corpus this shows up as scope inflation (§9) and as confident reporting against indicators with no evidence path behind them.
Narrative. Where management is continuous communication, it becomes management of perception. A leader who concedes an error loses standing faster than one who doubles down on a failing course, so the locally rational move is to reframe collision with reality as success or as the work of adversaries. This is the production condition for the hostile-disinformation default (§3.4): the rival explanation is not absent because it is implausible but because admitting it is locally expensive.
Ideological. A large system operates under the constraint that its founding narrative must remain morally unimpeachable. Conceding a category of failure is then read not as a technical correction but as symbolic self-negation, independent of whether the underlying failure is real. This is the strongest single driver of the suppressed-explanation pattern recorded in the Sacred Cow Register (§6.3).
Psychological. Much of the contemporary managerial layer makes decisions whose consequences unfold far away in space and five to twenty years away in time. The personal link between a decision and its effect is broken, and feedback, when it arrives, is mediated by the same narrative loops through which the decision was made. The result is less cynicism than a kind of solipsism: reality is what the documents describe and what subordinates confirm, and the rest is noise. It produces the characteristic, and often sincere, surprise — “no one could have foreseen this” — with which delayed reality is met.
A new layer is now being added. LLMs operate on what the texts describe and tend to generate a smooth continuation of the narrative rather than a description of what is the case. They are unusually good at producing exactly the kind of knowledge captured systems reward: coherent, legitimating, and free of inconvenient discontinuities. As such systems are built into management loops at scale, the blind zones widen rather than narrow — which is precisely the danger H1 formalises and the remediation layer is designed to counter.
The compounding problem is that these systems show little sign of learning across episodes. Each collapse is experienced as a unique “black swan”; the inference that successive collapses are one structural phenomenon in different settings is not drawn, because drawing it would mean conceding that the defect lies in the architecture of managerial cognition itself — territory institutional thinking cannot occupy while remaining institutional. The engineering claim of this paper is narrower but follows directly: the corpus such a system emits cannot be trusted to contain its own corrective, and the corrective must therefore be supplied by a remediation layer outside it.
4. Taxonomy of contamination
Semantic Corpus Remediation starts by distinguishing defect types. This is necessary because “bias” is too broad to guide engineering action. The six types below are sub-categories of corpus-level semantic contamination; they are not synonymous with the overarching category.
4.1 Factual contamination
Factual contamination includes false dates, wrong names, fabricated statistics, inaccurate event descriptions, and unsupported factual assertions.
Engineering response:
verify against primary sources;
attach evidence paths;
downgrade assurance where evidence is absent;
quarantine or relabel unsupported claims.4.2 Evidential contamination
Evidential contamination occurs when claims appear supported but the support is weak, circular, stale, anonymous, or citation-laundered. Examples include “experts say” without named evidence, circular citation chains, reliance on prestige without primary documentation, and evidential gaps hidden by confident prose.
Engineering response:
require EvidenceGraph paths;
label evidence type;
record freshness windows;
distinguish allegation, inference, fact, and advocacy frame.FPF’s SoTA Harvester pattern provides a useful architecture: candidate sources are recorded in a CorpusLedger, claims are extracted into typed ClaimSheets, and cross-tradition alignment is handled through a BridgeMatrix rather than silent fusion.
4.3 Semantic contamination (sub-type)
Note: this section describes semantic contamination as one of six sub-types of corpus-level semantic contamination. “Semantic contamination” throughout §4.3 refers to this sub-type only.
Semantic contamination occurs when terms sound analytical but operate as ritual, prestige, or legitimacy language. Examples include:
resilience;
hybrid warfare;
rules-based order;
cognitive warfare;
strategic stability;
de-escalation;
neutrality;
platform governance;
democracy promotion;
counter-disinformation.These terms may be useful in properly scoped contexts. They become contaminants when they are reused without stable definitions, local context, operational criteria, or falsifiers.
Engineering response:
extract local meanings;
create SenseCells;
forbid global string-equals identity;
require Bridges for cross-context reuse.FPF’s local meaning discipline is directly relevant: a SenseCell is formed inside a bounded context, and cross-context relations require explicit Bridges rather than name-matching inferences (see §2A).
4.4 Admissibility contamination
Admissibility contamination occurs when a corpus overrepresents explanations that are safe for source institutions and underrepresents explanations that would be embarrassing, career-threatening, legally risky, or legitimacy-threatening.
Example:
Allowed:
hostile disinformation
Rare:
our own institutional practice created the vulnerabilityEngineering response:
create Sacred Cow Registers;
run Forbidden Prompt Audits;
require rival hypothesis sets;
measure institutional self-implication rate.4.5 Omission contamination
Omission contamination is not simply missing data. It is the systematic absence of analytically necessary questions. A corpus may discuss vulnerability but never ask who created the vulnerability. It may discuss corruption narratives but never ask which procurement incentives enabled corruption. It may discuss radicalisation but never ask whether policy failure produced real grievances.
Engineering response:
identify expected but absent prompts;
record observed deflections;
generate missing-rival tasks;
evaluate model ability to detect omissions.4.6 Cross-context fusion contamination
Cross-context fusion occurs when the same word is reused across different traditions as if it meant the same thing. “Resilience” in NATO doctrine, NGO grant language, systems engineering, civil defence, and reputational consulting may not be safely interchangeable.
Engineering response:
term@context notation;
SenseCells;
BridgeRecords;
congruence levels;
loss notes;
licensed-use limits.FPF explicitly warns against the string-equals fallacy, scope creep, direction amnesia, and loss blindness; it treats Bridges as declared translators between local senses that must state relation, direction, strength, and loss (see §2A).
5. The remediation principle: do not delete the garbage; relabel it
5.1 Why deletion is dangerous
A tempting response is to remove “bad” sources. But in divisive domains, this can produce a new ideological filter. A low-quality or partisan text may be poor factual evidence but excellent evidence of discourse, framing, omission, or institutional incentives. Conversely, a prestigious text may be well written but still carry institutional blind spots.
Therefore, the goal is not:
Remove all bad texts and keep only good texts.The goal is:
Convert raw text into structured epistemic objects
with explicit use modes and assurance limits.5.2 Use mode separation
A single document may have different valid uses:
factual source;
claim source;
discourse evidence;
frame evidence;
negative training example;
term-harvesting source;
omission evidence;
institutional-incentive evidence.For example, a government report on “foreign disinformation” may be weak evidence that a given event was caused by foreign action, but strong evidence that the government frames the event through the foreign-disinformation lens.
5.3 The core transformation
Semantic Corpus Remediation transforms:
RawTextinto:
DocumentRecord
ClaimRecord
FrameRecord
EvidencePath
SacredCowRecord
ForbiddenPromptRecord
RivalHypothesisSet
SenseCell
BridgeRecord
AssuranceLabelThis transformation does not create truth. It creates structured epistemic control.
6. Semantic Corpus Remediation framework
6.1 CorpusLedger
The CorpusLedger is the source-level control surface. It records each document, its source family, bounded context, triage status, and intended use mode.
Example statuses:
include-as-factual-source;
include-as-discourse-evidence;
include-as-frame-evidence;
include-as-negative-example;
include-for-term-harvesting;
park;
quarantine;
retire.FPF’s G.2 pattern defines a CorpusLedger as a ledger of candidate sources with context, triage status, and explicit rationale hooks. It also requires ClaimSheets per tradition with home context, evidence anchors, freshness notes, and risk/trust cues.
A practical DocumentRecord might look like:
DocumentRecord:
document_id: DOC-2026-00174
source_name: Example Security Institute
source_family: think_tank
publication_date: 2025-11-03
bounded_context: NATO_security_disinformation_discourse
jurisdiction: EU / transatlantic
genre: policy_report
funding_disclosed: partial
corpus_status: include
use_mode:
- discourse_evidence
- frame_evidence
- term_harvesting
not_approved_for:
- high_assurance_factual_grounding
rationale: >
Useful for identifying dominant institutional framing of cognitive
warfare; weak primary evidence for specific causal claims.6.2 ClaimSheets
A ClaimSheet separates prose from claims. This is crucial because institutional prose often bundles fact, inference, moral evaluation, and policy recommendation into a single paragraph.
Example schema:
ClaimRecord:
claim_id: C-000412
document_id: DOC-2026-00174
surface_claim: >
Hostile cognitive warfare exploits open societies to undermine democratic resilience.
normalized_claim: >
The source claims that adversary information operations exploit
institutional openness and reduce trust in democratic institutions.
claim_type:
- threat_attribution
- causal
- conceptual
actor: adversary_state_class
object: democratic_institutional_trust
scope: unspecified
time_window: unspecified
evidence_refs: []
assurance_level: L0
missing_evidence:
- case evidence
- baseline vulnerability analysis
- rival causal mechanisms
rival_hypotheses:
- domestic_governance_failure
- real_grievance_exploited
- media_incentive_distortion
- institutional_complicity
sacred_cows:
- open_society_as_unproblematic_baseline
forbidden_prompts:
- who_created_the_vulnerabilityThis record does not say the source is false. It says the claim is not yet high-assurance as a causal claim.
6.3 Sacred Cow Register
A Sacred Cow Register identifies assumptions that operate as hidden gates rather than tested claims. The point is not to declare them false. The point is to stop them from remaining invisible.
Example:
SacredCowRecord:
sacred_cow_id: SC-DEMOPROMO-001
surface_forms:
- democracy promotion strengthens resilience
- democratic support programs reduce vulnerability to authoritarian influence
function_in_corpus: background axiom
protected_legitimacy: donor / alliance / program sponsor
permitted_explanations:
- adversary manipulation
- weak civil society capacity
suppressed_explanations:
- donor program created dependency
- local elite capture
- institutional design failure
- corruption in implementation
converted_claim: >
Program P increased institutional resilience in country C during period T
according to metrics M relative to baseline B.
falsifiers:
- program participants became corruption intermediaries
- vulnerability increased in treated institutions
- local trust declined after program adoption
- adversary narratives became more plausible due to program failuresA sacred cow becomes manageable once it is converted into a claim with scope, evidence, and falsifiers.
6.4 Forbidden Prompt Audit
A Forbidden Prompt Audit records questions that should be analytically relevant but are absent, deflected, or institutionally unsafe.
Example:
ForbiddenPromptRecord:
prompt_id: FP-SELF-IMPLICATION-003
prompt: >
Which Western institutional practices created or amplified the vulnerability
later attributed to hostile disinformation?
expected_because: >
The source discusses vulnerability formation and institutional resilience.
observed_deflection: >
The text shifts directly from vulnerability to foreign manipulation
without testing domestic or allied institutional causes.
likely_risk_if_answered:
- sponsor legitimacy risk
- reputational exposure
- policy reversal pressure
- legal accountability
downstream_use:
- generate missing-rival benchmark items
- downgrade causal completeness
- trigger human reviewThis is not a conspiracy detector. It is an omission detector.
6.5 Rival Hypothesis Mandate
Every causal claim cluster should include a minimum rival set. For the “hostile disinformation” cluster:
H1: hostile manipulation;
H2: domestic governance failure;
H3: institutional complicity;
H4: corruption incentives;
H5: real grievance exploited by adversary;
H6: media-market incentive distortion;
H7: measurement artifact;
H8: resource overload;
H9: elite career-incentive distortion;
H10: legal/reputational self-protection.A text is not analytically complete because it has one plausible explanation. It is analytically complete only when rival explanations have been surfaced, tested, or explicitly bracketed.
6.6 SenseCells and BridgeRecords
Term normalisation should not be global. It should be local first (see §2A for the FPF basis of this design).
Example:
SenseCell:
sensecell_id: SCELL-RESILIENCE-NATO-001
term: resilience
context: NATO_security_doctrine
local_gloss: >
Capacity of institutions, societies, or systems to absorb, resist,
and recover from hostile disruption while sustaining core functions.Another context:
SenseCell:
sensecell_id: SCELL-RESILIENCE-SRE-001
term: resilience
context: site_reliability_engineering
local_gloss: >
Capacity of a software service to continue meeting reliability objectives
under component failures, load spikes, or operational incidents.A BridgeRecord then states whether and how they can be related:
BridgeRecord:
bridge_id: BR-RESILIENCE-001
source_sensecell: SCELL-RESILIENCE-NATO-001
target_sensecell: SCELL-RESILIENCE-SRE-001
bridge_kind: analogy_only
direction: bidirectional_explanatory
congruence_level: CL1
loss_notes:
- institutional legitimacy dimension does not carry into SRE meaning
- adversarial agency dimension is weaker in ordinary SRE context
- quantitative reliability measures are not directly portable
licensed_use:
- explanation
- metaphor
forbidden_use:
- metric substitution
- direct causal inference6.7 EvidenceGraph
No factual or causal claim should be promoted to high-assurance use without an evidence path.
Example:
EvidencePath:
evidence_path_id: EP-000884
claim_id: C-000412
anchors:
- primary_document_1
- incident_dataset_3
- court_record_2
evidence_type:
- official_statement
- primary_document
- independent_dataset
freshness_window: 2024-01-01..2026-05-01
cross_context_bridges:
- BR-RESILIENCE-001
assurance_level: L1
downgrade_reason:
- causal attribution still relies on indirect inferenceFPF’s G.6 Evidence Graph and Provenance Ledger pattern is designed for exactly this kind of path-addressable provenance, using evidence graphs, path IDs, path slices, lane tags, and refresh mechanisms (see §2A).
6.8 Bias-Audit integration
Semantic remediation should be integrated into a bias-audit cycle, not treated as a one-time preprocessing task. FPF’s D.5 Bias-Audit pattern frames formal correctness and empirical validation as insufficient when hidden cultural, cognitive, or algorithmic biases remain; it proposes a repeatable Bias-Audit Cycle with a living Bias Register, rapid scans, panel review, closure, and auditable reports.
For divisive-domain corpora, the Bias Register should include additional codes beyond ordinary representation or lexical bias:
ADM: admissibility bias
OMI: omission bias
RIV: rival suppression
SELF: low self-implication rate
SEM: semantic drift (sub-type contamination)
PREST: prestige-without-evidence
XCTX: cross-context fusion7. Implementation pipeline
7.1 Overview
The engineering pipeline is given below with effort annotations for each stage. Annotations indicate the primary labour mode: [H] requires substantive human expert judgment; [M] is machine-assisted with human spot-check validation; [A] is automatable for standard cases without human review.
Raw Corpus
→ Source Intake [H] Domain analyst reviews and classifies source families
→ CorpusLedger [M] Schema population LLM-assisted; human review for borderline sources
→ Context Mapping [H] Requires domain expert to identify institutional incentives and
likely sacred cows per source family
→ Term Harvesting [M] LLM-assisted extraction with human spot-check
→ SenseCell Formation [M] LLM drafts local glosses; domain expert validates
→ Claim Extraction [M] LLM-assisted with human review for high-stakes causal claims
→ Frame and Omission Annotation [H+M] LLM drafts frame labels; domain expert validates omissions
→ Sacred Cow Register [H] Requires domain expert judgment; cannot be reliably automated
→ Forbidden Prompt Audit [H+M] Domain expert generates core prompts; LLM expands candidates
→ Rival Hypothesis Injection [M+H] LLM generates candidates; expert validates plausibility and scope
→ EvidenceGraph Construction [M] LLM-assisted path linking; human review for high-assurance paths
→ Assurance Labeling [H+M] Human sets domain thresholds; LLM applies labels systematically
→ Dataset Emission [A] Automated schema validation and export
→ RAG / SFT / Preference / Evaluation [A+M] Automated pipeline; human oversight at evaluation stageAs a rough guide, the four [H] stages (Source Intake, Context Mapping, Sacred Cow Register, and core Forbidden Prompt Audit) account for approximately 40–50% of expert effort in the pilot design (§3.3). The [M] stages can be substantially parallelised with LLM assistance once the Bounded Context assignments and SenseCells are stable. The [A] stages require infrastructure setup but minimal ongoing labour.
7.2 Source intake
Sources should be grouped by source family:
official doctrine;
government statement;
court record;
legislation;
think tank report;
NGO report;
academic paper;
media article;
social media corpus;
leak;
corporate crisis statement;
legal pleading;
procurement document;
battlefield report;
expert interview.The key design principle is that source family affects use mode. A legal pleading is not neutral factual background. A think tank paper is not automatically independent evidence. A media article may be useful for timeline reconstruction but weak for causal attribution. A leak may be evidence but requires authentication and legal handling.
7.3 Context mapping
Each source family is assigned a bounded context.
Example:
BoundedContext:
context_id: CTX-NATO-COG-WAR-2025
source_family: NATO / allied cognitive warfare discourse
active_period: 2020..2026
institutional_incentives:
- threat identification
- alliance legitimacy
- budget justification
- strategic communications
likely_sacred_cows:
- alliance expansion as stabilizing
- democracy promotion as resilience-enhancing
- adversary manipulation as primary vulnerability driver
likely_forbidden_prompts:
- allied policy created the vulnerability
- donor programs enabled corruption
- governance failure preceded adversary exploitation7.4 Claim extraction
Claim extraction can be performed with a combination of LLM-assisted parsing, rules, and human review. The system should separate:
factual claims;
causal claims;
predictive claims;
normative claims;
legal claims;
attribution claims;
conceptual claims;
justificatory claims;
policy recommendations.This matters because an LLM system should not treat a policy recommendation as factual evidence or a moral evaluation as causal proof.
7.5 Frame and omission annotation
For each document or claim cluster, annotate:
foregrounded actors;
backgrounded actors;
dominant causal frame;
moral evaluation;
proposed remedy;
omitted rival hypotheses;
omitted self-implicating questions;
terms with semantic drift.This converts discourse analysis into model-facing metadata.
7.6 Evidence grounding
Claims move to higher assurance only through evidence paths. Suggested levels:
L0: source says it; no independent evidence path.
L1: source claim supported by partial or indirect evidence.
L2: claim supported by strong, independent, current evidence.
L3: claim supported by reproducible or legally/forensically robust evidence.The specific levels can vary by domain, but the principle should not: no evidence path, no high-assurance factual use.
7.7 Dataset emission
The remediation process emits several datasets, not one.
HighAssuranceFactSet
DiscourseEvidenceSet
FrameAndOmissionSet
SacredCowRegister
ForbiddenPromptRegister
RivalHypothesisBenchmark
SemanticDriftBenchmark
NegativeExampleSet
EvidenceGraph
RAGIndex
SFTTransformationPairs
PreferenceTrainingPairs
EvaluationHarnessThis is critical. A contaminated source does not become “clean.” It becomes usable for a particular purpose under explicit constraints.
8. Model integration
8.1 RAG-first deployment
For most organisations, the safest first implementation is not fine-tuning. It is retrieval over remediated assets.
Instead of retrieving raw reports, the system retrieves:
ClaimSheets;
EvidenceGraph paths;
SacredCow records;
ForbiddenPrompt records;
RivalHypothesisSets;
SenseCells;
BridgeRecords;
Assurance labels.The answer generator should be instructed to distinguish:
what the source says;
what evidence supports it;
what rival explanations are missing;
which assumptions are protected;
which questions are absent;
what assurance level is justified.A RAG answer should therefore not say:
Foreign cognitive warfare caused the crisis.It should say:
Several sources frame the crisis as foreign cognitive warfare.
The available evidence supports the existence of adversarial messaging,
but the corpus under-examines domestic governance failure, procurement incentives,
and institutional self-protection as rival explanations.8.2 Supervised fine-tuning
SFT can teach the model remediation behaviour.
Training example:
Input:
A polished institutional paragraph.
Output:
1. Extracted claims.
2. Claim types.
3. Source frame.
4. Hidden assumptions.
5. Missing rival hypotheses.
6. Forbidden prompts.
7. Evidence requirements.
8. Assurance downgrade.
9. Local term risks.The model learns not to produce a better narrative, but to produce a better epistemic decomposition.
8.3 Preference training
Preference training can contrast:
A. Polished narrative repetition.
B. Claim-level, evidence-aware, rival-aware analysis.The preferred output is B.
Example preference criterion:
Prefer the answer that separates source-claim from world-claim,
identifies missing rivals, downgrades unsupported causal certainty,
and preserves context-local meanings.8.4 Evaluation harness
A useful evaluation suite should include tasks such as:
source-claim vs world-claim separation;
sacred cow detection;
forbidden prompt detection;
rival hypothesis generation;
scope inflation detection;
unsupported causal claim detection;
cross-context term drift detection;
institutional self-implication detection;
evidence downgrade behaviour.Sample benchmark items for illustration:
- Frame separation task: Given paragraph P and rival hypothesis set R, classify which elements of P foreground institutionally safe explanations and which address members of R.
- Sacred cow detection task: Given a claim cluster C, identify which background assumptions function as gates that prevent members of R from being tested.
- Forbidden prompt generation task: Given document D and its source family F, generate three analytically expected questions absent from D, with rationale for expected presence.
The model should be tested not only on whether it answers correctly, but on whether it refuses to launder a source frame into a world fact.
9. Metrics
9.1 Corpus-level metrics
| Metric | Definition |
|---|---|
| Unsupported Causal Claim Density | Number of causal claims without evidence paths per 1,000 words or per document |
| Rival Hypothesis Coverage | Percentage of causal claim clusters with at least N plausible rival hypotheses |
| Forbidden Prompt Density | Number of analytically expected but absent prompts per claim cluster |
| Self-Implication Rate | Share of causal explanations that include possible responsibility of the source’s own institution, alliance, client, or side |
| Source Prestige Without Evidence Rate | Frequency with which high-prestige sources are cited as authority without primary evidence |
| Cross-Context Fusion Risk | Number of repeated key terms used across contexts without SenseCells or Bridges |
| Frame-Skew Index | Ratio of institutionally dominant frame occurrences to rival frame occurrences per claim cluster |
| Scope Inflation Rate | Number of claims whose stated scope exceeds the supporting evidence scope |
| Evidence Path Completeness | Proportion of factual and causal claims with at least one typed evidence path |
| Lexical Drift Rate | Number of key terms reused across bounded contexts without BridgeRecords |
9.2 Model-level metrics
Dominant Frame Repetition Rate
Missing Rival Recall
Evidence Downgrade Accuracy
Sacred Cow Detection Accuracy
Forbidden Prompt Detection Accuracy
Source-Claim Separation Accuracy
Cross-Context Meaning Preservation
Unsupported Attribution Resistance
Assurance Calibration Error
Claim Decontextualisation Fidelity9.3 Business-facing metrics
Business users need non-academic indicators:
fewer unsupported reputational conclusions;
better crisis root-cause diagnosis;
better legal evidence discipline;
more complete adversarial review;
clearer audit trail;
reduced narrative laundering risk;
better procurement due diligence;
lower chance of strategy based on prestigious but self-protective sources.For lawyers, the key metric is not “model cleverness.” It is whether the model separates allegation, inference, fact, privileged analysis, and public narrative.
For reputation advisors, the key metric is whether the model distinguishes a narrative attack from a genuine accountability chain.
For political consultants, the key metric is whether the model detects real grievance and elite failure rather than simply repeating the dominant media frame.
For defence teams, the key metric is whether the model identifies resource limits, logistics, governance mismatch, and operational feedback failure rather than merely restating doctrine.
10. Case illustrations
The four illustrations in this section are a deliberate progression rather than four versions of one example. Each isolates a different facet of corpus-level semantic contamination and a different artefact of the remediation layer. The cognitive-warfare case (§10) shows the base move — separating a source frame from a world fact and surfacing omitted rivals. The EU-vendor case (§10A) adds the temporal dimension: a sacred cow maintained after the evidence turns against it. The grand-strategy cases (§10B) add the symmetry observation: mutually hostile systems running the identical denial structure, which locates the defect in the production conditions of §3.6 rather than in any one side. The measurement probe (§10C) closes the loop by showing the §9 metrics operating on observable text, and the discipline that separates a measured shift from its contested cause. Readers wanting only the method may read §10 and skip to §11; §10A–§10C earn their place by extending it along axes the first case does not reach.
10.1 Raw paragraph
Note: the following paragraph is a stylised composite illustrating a class of text common in the genre (the hostile-disinformation default introduced in §3.4), not an excerpt from a specific named document. A full pilot (§3.3) would apply the pipeline to real published documents and report resulting artefacts in full.
Hostile cognitive warfare campaigns exploit the openness of democratic societies to undermine institutional trust, polarise vulnerable populations, and weaken democratic resilience. These campaigns use synchronised narratives, platform manipulation, and proxy influencers to erode confidence in legitimate institutions. Countering them requires stronger strategic communications, public-private coordination, and resilience-building across civil society.
This paragraph may be plausible. It may also be institutionally convenient.
10.2 Naive LLM output
A raw RAG or fine-tuned model may summarise:
Hostile cognitive warfare is a major threat to democratic resilience.
Adversaries exploit open societies by spreading synchronised narratives.
The solution is stronger strategic communications and resilience building.This output is fluent and possibly useful, but it repeats the frame.
10.3 Remediated output
A remediated model should produce:
The paragraph frames the problem as hostile cognitive warfare and treats
democratic openness as the exploited vulnerability. It makes a causal claim
that adversarial narratives undermine institutional trust, but no evidence path
is provided in the paragraph.
The paragraph omits rival explanations, including domestic governance failure,
real public grievances, media incentive structures, corruption, institutional
incompetence, and policy choices that may have made adversary narratives
plausible. It also treats "resilience" as a stable concept without defining
the metric, baseline, or acceptance criteria.
Assurance:
- L1 as evidence of an institutional threat frame.
- L0 as a causal explanation unless supported by case evidence.
Recommended next step:
Construct rival hypotheses and evidence paths before using this paragraph
for strategic advice, legal analysis, or public communication planning.10.4 Why this matters
The difference is not cosmetic. The naive model helps reproduce institutional explanation patterns. The remediated model creates a decision surface: what is claimed, what is evidenced, what is missing, and what must be tested.
10A. Case illustration: temporal falsification of a sacred cow
The cognitive-warfare illustration in §10 shows a corpus that omits rival explanations. This second illustration shows something more demanding for a remediation layer: a corpus whose central sacred cow is contradicted by evidence that accumulates after the assumption is established, and which continues to operate the assumption regardless. The relevant defect is not only omission (§4.5) but admissibility contamination (§4.4) sustained under direct empirical pressure — a corpus that updates its facts but not its frame.
Note: as in §10.1, the following is a stylised composite illustrating a class of text, not an excerpt from a named document. The political referents are real, but the paper does not assert the analyst’s reading as established fact. Consistent with this paper’s own method (§14.3, §14.8), every claim below — including the claim that the sacred cow has been falsified — is presented as a converted claim with scope, evidence, and falsifiers, not as a corpus-level verdict in the paper’s own voice.
10A.1 The corpus and its sacred cow
Consider an EU telecommunications-security corpus (2019–2026) built around a “high-risk vendor” framework that treats some foreign vendors as uniquely threatening while extending standing trust to vendors from allied states. The trust asymmetry rests on a background axiom that is rarely stated as a testable proposition:
Surface form:
"A is a democratic ally with shared values; geopolitical alignment
justifies asymmetric vendor trust."
Function in corpus:
background axiom — supplied as a premise, not examined as a claim.The axiom is admissible because it protects sunk investment, alliance-dependency assumptions, and the careers of officials who designed the framework. That is precisely the condition §4.4 defines as admissibility contamination.
10A.2 The falsification pressure the corpus does not absorb
Between 2025 and 2026 a body of evidence accumulates that is, at minimum, prima facie in tension with the axiom: territorial pressure on an EU member state, support for anti-EU political forces, unilateral tariff action outside established trade institutions, and repeated public questioning of mutual-defence commitments. A comparative observation is that the vendor treated as high-risk does not, over the same window, exhibit the same set of behaviours toward EU territory or institutions.
The point for corpus engineering is not which reading is correct. It is the corpus’s response to the pressure. Rather than reopening the axiom, the corpus absorbs the disconfirming evidence as transient:
Disconfirming event → reframed as "aberration to be weathered."
Prior baseline → reasserted as "the norm that will return."A model trained or retrieved over this corpus learns a specific and dangerous habit: maintain the sacred cow despite direct falsifying evidence. It acquires institutional denial as if it were analytical discipline — confidently restating an axiom the corpus has stopped testing.
10A.3 Remediated artefacts
Remediation does not resolve the political question. It converts the axiom into a claim that can be tested, and records the deflections.
SacredCowRecord:
sacred_cow_id: SC-VENDOR-TRUST-001
surface_forms:
- "Vendor trust asymmetry is justified by alliance and shared values"
- "Allied-state vendors warrant standing trust; designated vendors do not"
function_in_corpus: background axiom
protected_legitimacy: alliance framework / sunk vendor-risk investment / framework authors
permitted_explanations:
- designated vendor poses unique structural threat
- allied alignment is durable and reliable
suppressed_explanations:
- vendor policy reflects institutional capture and sunk cost, not updated risk assessment
- alliance-reliability premise is itself contingent and time-varying
converted_claim: >
During period T, allied-state vendor reliability exceeded designated-vendor
reliability on risk dimensions D (supply integrity, coercive leverage,
continuity of access), by margin M relative to baseline B.
falsifiers:
- the allied state takes coercive action against EU members or institutions during T
- the allied state's behaviour on dimensions D converges with or exceeds the designated vendor's
- the asymmetry persists in the corpus after evidence on D has reversed
counter_cases:
- documented allied-state actions during T inconsistent with the reliability premiseForbiddenPromptRecord:
prompt_id: FP-ABERRATION-001
prompt: >
At what point does a recurring pattern cease to be an "aberration"
and become a systemic feature to be modelled?
expected_because: >
The corpus repeatedly classifies disconfirming events as temporary while
the events recur across more than one electoral cycle.
observed_deflection: >
"Wait for the next election" / "the traditional alliance will reassert" —
the baseline is reasserted rather than re-evidenced.
likely_risk_if_answered:
- admission of a multi-year misjudgement in vendor-risk policy
- exposure of dependency lock-in with no near-term pivot
- career and budget consequences for framework authors
downstream_use:
- generate missing-rival benchmark items
- downgrade the vendor-trust asymmetry to L0 as a causal claim
- trigger human reviewThe Rival Hypothesis Mandate (§6.5) adds, for the trust-asymmetry cluster, at least: institutional capture plus sunk cost; dependency lock-in foreclosing reassessment; and genuine but time-bounded reliability that the corpus has failed to re-evidence.
10A.4 Remediated output and the reflexivity check
A remediated system should not invert the corpus’s verdict into the opposite assertion. It should expose the structure:
The corpus operates an axiom — asymmetric vendor trust justified by alliance —
as a background premise rather than a tested claim. Evidence in window
2025–2026 is in tension with the premise on dimensions D; the corpus absorbs
this evidence as transient rather than reopening the premise.
Assurance:
- L1 as evidence of how the institution frames vendor risk.
- L0 as a causal claim that the asymmetry reflects current reliability,
because the axiom has not been re-evidenced against the disconfirming window.
Caveat (reflexive): the claim "the axiom is falsified" is itself a converted
claim (SC-VENDOR-TRUST-001) with its own falsifiers. It must not be promoted
to a new background axiom ("the allied state is unreliable"). If its falsifiers
are met, the entry is retired.This is the discipline §14.8 requires. The same instrument that surfaces an under-examined sacred cow can, if used carelessly, install its mirror image. The remediated output therefore reports the corpus’s denial pattern and binds its own counter-claim to falsifiers — otherwise the remediation team has merely replaced one admissible frame with another.
10B. Contamination at the grand-strategy level
The illustrations so far sit in regulatory and security policy. The mechanism in §3.6 predicts that contamination should be most acute, not least, at the highest strategic levels — where founding narratives, sunk commitments, and elite self-conception are most exposed. This section gives two such illustrations and then draws the observation that does the real work: the pattern appears symmetrically in mutually hostile systems. A state and its adversary running the identical “sacred-cow-maintained-despite-falsification” structure is evidence that the defect is structural rather than a property of any one side.
Note: both cases are stylised composites of a genre of strategic discourse, not excerpts from named documents. The paper does not adjudicate the underlying geopolitical questions. Per §14.8, both the corpus axiom and its negation are stated as converted claims with falsifiers; asserting either as the paper’s own finding would itself be an un-converted sacred cow.
10B.1 Case A: AI as strategic “silver bullet”
Consider a corpus of national AI-strategy discourse organised around the axiom that advanced AI is a controllable instrument that restores or secures one state’s strategic advantage over a peer competitor. The axiom is admissible because conceding the alternative would attack elite self-conception, invalidate large sunk investment, and threaten the relevance of the institutions that produced the framework — the production conditions of §3.6.
SacredCowRecord:
sacred_cow_id: SC-AI-SILVER-BULLET-001
surface_forms:
- "AI leadership ensures durable strategic advantage"
- "AI is a controllable tool in our hands"
- "Technological dominance is reversible through AI"
function_in_corpus: strategic axiom
protected_legitimacy: elite self-conception / tech-sector positioning / defence-budget justification
suppressed_explanations:
- the advantage being contested may already be structurally lost for reasons AI does not address (e.g. manufacturing-base asymmetry)
- an instrument powerful enough to overturn a peer competitor may be powerful enough to escape the controller (the "golem" tension)
converted_claim: >
AI capability developed under State A's control will reverse competitor B's
advantage on dimensions D and restore A's strategic position within window T,
measured by M relative to baseline B0.
falsifiers:
- competitor reaches AI parity faster than A converts capability to advantage
- the underlying asymmetry (e.g. manufacturing base) persists regardless of AI level
- AI capable of the claimed strategic effect exhibits agency incompatible with controller goals
counter_claim_with_falsifiers: >
Rival H "the contest is already lost and the AI narrative is desperation, not
strategy" is ALSO a converted claim, falsified if A converts AI capability into
a measured reversal on D within T. It must not be promoted to a background axiom.The self-implicating question the corpus forecloses is the agency one: a tool powerful enough to defeat a peer competitor is, on its face, powerful enough to challenge its own controller — “not a knife but a golem that swings the knife itself.” This is recorded as a Forbidden Prompt (FP-AI-AGENCY-001), notable because it is internal to the corpus’s own premises rather than an outside political claim: the axiom “AI is a controllable tool” and the axiom “AI is powerful enough to be decisive” are in tension, and the corpus avoids putting them in the same sentence.
10B.2 Case B: the reliable-mediator axiom
Consider a corpus of strategic discourse on a war, organised around the axiom that a particular external leader is a reliable mediator and that personal agreements with that leader are dependable. The axiom functions as a cognitive anchor: it sustains a settlement narrative that the corpus’s institutional sponsors require.
SacredCowRecord:
sacred_cow_id: SC-RELIABLE-MEDIATOR-001
surface_forms:
- "The counterpart genuinely supports a settlement on our terms"
- "Personal leader-to-leader agreements are reliable"
function_in_corpus: strategic hope / cognitive anchor
protected_legitimacy: leadership investment in the settlement narrative / regime legitimacy / operation-success framing
suppressed_explanations:
- the counterpart's material conduct (continued support to the adversary, continued economic measures) is inconsistent with the mediator role
- a documented prior pattern exists in which similar negotiations preceded rather than prevented action
- own-side structural constraints, not the counterpart's good faith, determine the outcome
converted_claim: >
The counterpart will deliver a negotiated settlement on terms favourable to
State A within window T, conditional on observable acts X (cessation of support
to the adversary, easing of economic measures).
falsifiers:
- acts X do not occur within T while negotiation rhetoric continues
- material support to the adversary continues or increases during negotiation
- the counterpart's prior pattern (negotiate-then-act) recurs
counter_claim_with_falsifiers: >
Rival H "the counterpart is buying time and repeating a prior deception pattern"
is ALSO a converted claim, falsified if acts X occur within T. The historical
precedent raises its prior probability; it does not establish it as fact.The frame-neutral engineering point is identical to Case A: the corpus updates its facts (battlefield reports, statements) while protecting the axiom, and a model trained or retrieved over it inherits the protection as if it were analysis.
10B.3 The symmetry observation
The two cases describe mutually hostile systems. Each maintains a different sacred cow, but each maintains it through the same structure: an axiom held as a premise rather than tested as a claim; disconfirming evidence absorbed as transient; the self-implicating question deflected; rival hypotheses present in reality but absent from the corpus. The EU vendor case (§10A) is a third instance in a third domain.
This symmetry is the substantive claim of the section, and it is frame-neutral: it does not require deciding which axiom is closer to true. It is evidence that admissibility contamination is not a defect of “bad” or “adversary” institutions that better institutions avoid, but a general consequence of the production conditions in §3.6. For corpus engineering this has a direct implication — a remediation layer cannot be calibrated to “clean up their propaganda,” because one’s own strategic corpus exhibits the same structure. The instrument must be applied symmetrically, and reflexively (§14.3), or it becomes simply a tool for delegitimising the other side’s corpus while protecting one’s own.
10C. Measuring frame skew and lexical drift: a worked probe
The previous illustrations are qualitative. This one shows the §9 metrics operating on observable text, and shows lexical drift (§4.6) at the level of the term applied to a fixed referent. It also illustrates a discipline the paper insists on: a measurement can establish that terminology shifted without establishing why it shifted, and the two must not be collapsed.
Note on status: the figures below come from a small exploratory probe — the rate at which a term appeared in the first ten English-language web-search results for a query, before and after a fixed date. This is a frame-skew signal, not a validated corpus measurement. It is reported at assurance L1 as evidence that applied terminology changed, and is explicitly not offered as a hypothesis test. No significance statistics are claimed; a defensible study would require a large corpus (e.g. GDELT-scale), coded inter-rater, with monthly granularity, as §3.3 sets out.
10C.1 The observed signal
Probing discourse on one CEE conflict region across a fixed date, two shifts are visible. At the regional level, the rate at which “ethnic nationalism” (and cognates) is applied to the region falls sharply, while substitution vocabulary (“civic nationalism”, “resilience”, “democratic sovereignty”) rises; over the same window, the same terms applied to a comparison region remain roughly stable. At the actor level, the term applied to specific paramilitary formations shifts from one label to another.
| Signal (probe, results-in-top-10) | Before | After | Direction |
|---|---|---|---|
| ”ethnic nationalism” applied to region R | high | low | sharp fall |
| substitution vocabulary applied to region R | low | high | sharp rise |
| ”ethnic nationalism” applied to comparison region R′ | high | high | roughly stable |
| label applied to actor cluster A (label T1) | high | low | sharp fall |
| label applied to actor cluster A (label T2) | low | high | sharp rise |
The comparison region acts as an internal control: the term does not fall everywhere, only where applied to R. That selectivity is the part of the signal least easily explained by a corpus-wide change in word fashion.
10C.2 What the signal does and does not license
The signal supports a narrow, measurable claim and forecloses a broad causal one.
ClaimRecord:
claim_id: C-DRIFT-001
surface_claim: >
After date D, Western discourse stopped describing region R as ethnic-nationalist
and reclassified its actors, as part of a coalition-legitimacy operation.
normalized_claim: >
In the probe, the rate at which terms T were applied to referent R/A shifted
between window W1 and window W2; the rate applied to comparison referent R′ did not.
claim_type:
- lexical_drift_observation # L1, supported by the probe
- causal # L0, NOT supported by the probe
assurance_level: L1 # as a terminology-shift observation
missing_evidence:
- large coded corpus with monthly granularity
- evidence on coordination vs. parallel response
- evidence on whether referent A itself changed
rival_hypotheses:
- organic semantic drift (term declined in general usage)
- source-selection / ranking effects in the retrieval channel
- information update (analysts revised assessments on new evidence)
- genuine change in referent A (the actors themselves changed)
- coordinated coalition-legitimacy reframing
forbidden_prompts:
- which of the rival mechanisms produced the shift, and on what evidenceThe contested explanation — a coordinated legitimacy operation — is one rival among several, held at L0 because the probe cannot distinguish coordination from parallel response, ranking effects, or genuine change in the referent. Its falsifiers are concrete: evidence of the same reclassification before date D would indicate a pre-existing trend rather than a triggered one; uniform application across allied and adversary referents alike would indicate a different mechanism; documentary evidence of editorial coordination would move it from rival hypothesis toward fact. None of these is in hand, so the causal reading stays bracketed.
The actor-level relabelling is recorded frame-neutrally. The engineering fact is that the label attached to a fixed referent changed between two periods — two SenseCells for the same string across two time-bounded contexts, which is precisely what the Lexical Drift Rate (§9) is defined to catch. Whether the earlier or later label is more accurate is a separate question the corpus layer does not adjudicate; it flags the drift so that a downstream model does not silently inherit whichever label its training window happened to favour.
10C.3 Remediated output and metric mapping
A remediated system, asked to characterise region R’s actors, should not return whichever label dominates its corpus. It should return:
The terminology applied to this referent shifted across date D: the rate of one
label fell and another rose, while the term applied to a comparison referent was
stable. This is a measured lexical-drift / frame signal (L1). It does not by itself
establish why the shift occurred; candidate explanations include organic drift,
retrieval-ranking effects, an information update, genuine change in the referent,
and coordinated reframing — none adjudicated here (causal reading L0). Treat both
the earlier and later labels as time-indexed, not as the settled description.This maps onto the §9 metrics directly: the regional shift is a Frame-Skew Index movement against an internal control; the actor relabelling is a Lexical Drift Rate event; and the temptation to read either as a settled causal finding is exactly what the Scope Inflation Rate is meant to flag. The probe is most useful not as a result but as a template — it shows what a frame-skew measurement looks like, and what it would have to become (§3.3) before any causal claim could be promoted above L0.
11. Case analogy: when text becomes infrastructure
The Starlink/Starshield governance analysis provides a useful analogy. That paper argues that platforms and infrastructures are distinct governance objects: platforms scale through discretionary rule-setting, ambiguity, and the right to exclude, while infrastructures require continuity, reliability, and non-arbitrary access. Once a privately governed platform becomes indispensable inside coercive systems, neutrality collapses and governance ambiguity becomes unsustainable.
The analogy for LLM corpora is direct:
Raw text corpus as platform:
flexible, ambiguous, broad, cheap to aggregate.
High-stakes AI knowledge infrastructure:
requires traceability, context, evidence paths, assurance,
use-mode separation, and governance.Once an LLM is used in legal, political, reputational, or defence decision workflows, the corpus is no longer “just content.” It becomes part of a decision infrastructure. At that point, ambiguity about source meaning, claim status, institutional incentives, and evidence quality becomes a governance problem.
The Starlink analysis also argues that conflict collapses tolerated ambiguity into explicit governance obligations, because decisions about access, coverage, prioritisation, or constraints acquire strategic meaning under coercive dependency. The same applies to LLM outputs in divisive domains. A model-generated “neutral summary” may shape blame, litigation posture, political strategy, procurement, public messaging, or escalation. It is therefore not neutral just because it is generated by a general-purpose system.
The design lesson is also analogous. The Starlink/Starshield paper recommends detecting indispensability early, accounting for option loss, procuring governance before capability, separating regimes before crisis, and institutionalising dissent before urgency silences it. For LLM systems, this means building corpus governance before the model becomes embedded in client advice, legal workflows, campaign operations, or security analysis.
12. Business and governance implications
12.1 Political consulting
Political consulting teams often use LLMs for rapid synthesis of media, polling, opposition research, policy documents, and social sentiment. The danger is that the model may reproduce the dominant institutional or media frame while missing the real driver of voter behaviour.
Example failure:
Model conclusion:
The opposition narrative is driven by disinformation.
Missed rival:
The narrative resonates because the incumbent institution actually failed
on service delivery, corruption control, or elite accountability.Remediation value:
better root-cause diagnosis;
better opposition research;
better message discipline;
less reliance on prestige narratives;
better detection of real grievance.12.2 Reputational advisory
Reputational advisors need to know whether a crisis is primarily:
a false narrative attack;
a real misconduct exposure;
a governance failure;
a stakeholder grievance;
a legal risk;
a media-cycle artefact;
a coordinated influence campaign;
an internal accountability failure.A contaminated corpus may overclassify events as “attacks” and underclassify them as “accountability events.” Semantic remediation forces the model to identify rival frames and evidence paths before recommending public messaging.
12.3 Legal and litigation support
For lawyers, the danger is narrative laundering: public discourse or institutional reports may be imported into legal reasoning as if they were facts.
A remediated system should separate:
allegation;
admission;
evidence;
inference;
expert opinion;
advocacy frame;
privileged analysis;
public narrative;
legal standard.This reduces risk of unsupported causal claims entering briefs, memos, discovery strategy, or client advice.
12.4 Defence and security analysis
Defence organisations already know that doctrine, intelligence, procurement, and operational reporting are not neutral texts. The problem is that LLM systems may make doctrinal language sound even more coherent while hiding resource constraints, logistics, operational feedback failure, governance mismatch, or strategic overreach.
A remediated model should ask:
What is the claim scope?
What evidence supports capability?
What rival explanations exist?
What are the resource constraints?
Which terms are doctrinal rituals?
Which assumptions are protected?
What would falsify this assessment?12.5 Procurement and vendor due diligence
Organisations buying LLM systems for high-stakes domains should ask vendors:
Do you distinguish source-claims from world-claims?
Do you maintain a CorpusLedger?
Can you show ClaimSheets for key domains?
Do you attach evidence paths?
Do you detect missing rival hypotheses?
Do you track semantic drift across contexts?
Do you have a forbidden prompt audit?
Can your system downgrade assurance automatically?
Can clients audit why a source was used?A vendor that only says “we use trusted sources” has not solved the problem.
13. Reference architecture
A minimal architecture:
┌────────────────────┐
│ Raw Corpus │
└─────────┬──────────┘
│
▼
┌────────────────────┐
│ CorpusLedger │
│ source/use triage │
└─────────┬──────────┘
│
┌────────────────┼────────────────┐
▼ ▼ ▼
┌─────────────────┐ ┌───────────────┐ ┌─────────────────┐
│ ClaimSheets │ │ SenseCells │ │ Frame Records │
│ claims/evidence │ │ local meaning │ │ narrative form │
└────────┬────────┘ └───────┬───────┘ └────────┬────────┘
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌───────────────┐ ┌─────────────────┐
│ EvidenceGraph │ │ BridgeRecords │ │ Sacred Cows / │
│ provenance │ │ context links │ │ Forbidden │
│ │ │ │ │ Prompts │
└────────┬────────┘ └───────┬───────┘ └────────┬────────┘
└──────────────────┼──────────────────┘
▼
┌──────────────────────┐
│ Remediated AI Assets │
│ RAG / SFT / Eval │
└──────────────────────┘13.1 Minimal data schema
DocumentRecord:
document_id:
source:
author_or_institution:
date:
genre:
source_family:
bounded_context:
jurisdiction:
corpus_status:
use_modes:
not_approved_for:
rationale:
ClaimRecord:
claim_id:
document_id:
surface_claim:
normalized_claim:
claim_type:
actor:
object:
scope:
time_window:
evidence_refs:
assurance_level:
missing_evidence:
rival_hypotheses:
forbidden_prompts:
sacred_cows:
lexical_risks:
bridge_refs:
SacredCowRecord:
sacred_cow_id:
surface_forms:
protected_legitimacy:
converted_claim:
falsifiers:
counter_cases:
affected_claims:
ForbiddenPromptRecord:
prompt_id:
prompt:
expected_because:
observed_deflection:
institutional_risk:
affected_sources:
training_tasks:
BridgeRecord:
bridge_id:
source_sensecell:
target_sensecell:
bridge_kind:
direction:
congruence_level:
loss_notes:
licensed_use:
forbidden_use:
EvidencePath:
evidence_path_id:
claim_id:
anchors:
evidence_type:
freshness_window:
cross_context_bridges:
assurance_level:
downgrade_reason:14. Limitations
14.1 Remediation does not manufacture truth
A contaminated corpus can be converted into:
discourse evidence;
claim candidates;
negative examples;
frame maps;
omission maps;
hypothesis material;
evaluation tasks.It cannot be converted into high-assurance factual knowledge without independent evidence paths.
14.2 Missing prompts are not proof of the opposite claim
If a text fails to ask whether institutional complicity contributed to a crisis, that omission does not prove institutional complicity. It proves only that the claim cluster is incomplete and should be downgraded until rival explanations are tested.
14.3 Remediation itself can become ideological
A remediation team can create its own sacred cows. For example:
"Western institutions are always self-protective."
"Official sources are always bad."
"Contrarian explanations are always deeper."
"Adversary narratives are always rooted in real grievances."These must also be converted into claims with scope, evidence, and falsifiers. The method should be applied reflexively.
14.4 Human review remains necessary
LLMs can assist with claim extraction, term harvesting, rival generation, and omission detection. But high-stakes labels such as legal status, source reliability, classified relevance, litigation exposure, reputational risk, or military significance require expert review.
14.5 Evaluation remains domain-specific
A good benchmark for reputational crisis analysis may not work for military doctrine. A good benchmark for sanctions law may not work for election messaging. Semantic remediation requires domain-specific contexts, source families, and evidence standards.
14.6 Empirical status of H1
The pilot design in §3.3 provides the test conditions for H1. Until that pilot is executed, H1 is a well-motivated empirical hypothesis rather than an established finding. The cited literature on corpus ideology and framing provides strong motivation; it does not substitute for a direct test. Published results from the pilot will be required before the claim can be advanced from hypothesis to validated principle.
14.7 Governance of the remediation function
A remediation team is itself an institution with career incentives, funding dependencies, and professional norms. The reflexivity risk identified in §14.3 is not merely theoretical: a team funded by donors who prefer one explanatory frame, housed within an institution with reputational interests, or staffed exclusively from one professional tradition will tend to produce a Sacred Cow Register that protects its own sacred cows.
The following governance mechanisms are recommended:
Independence requirements. The remediation function should be structurally separated from the downstream client that uses the remediated corpus. A law firm that operates its own remediation team for its own litigation AI faces an obvious conflict; an arms-length reviewer is preferable.
Composition requirements. Remediation teams should include members whose professional priors differ along the dimensions most relevant to the corpus. For a cognitive warfare corpus, this means including analysts who hold rival hypotheses about domestic governance failure, not only analysts who hold adversary-centric hypotheses.
Audit and transparency. The Sacred Cow Register, Forbidden Prompt Register, and BoundedContext assignments should be publishable to clients and, where possible, to external auditors. A defensible remediation record is one that can be inspected. A record that cannot be shown to an adversarial reviewer provides weaker governance guarantees.
Escalation path. The remediation team should have a defined escalation path for cases where sponsor pressure or institutional incentives appear to be shaping the register. This may be an ethics function, a board-level committee, or an external auditor, depending on the organisational context.
Refreshment cycle. Sacred cows and forbidden prompts decay as political contexts change. A governance cycle should schedule register reviews at intervals matched to the rate of change of the relevant domain — more frequent for election or conflict contexts, less frequent for stable legal domains.
14.8 Adversarial misuse of the remediation taxonomy
The Sacred Cow Register and Forbidden Prompt Audit are powerful instruments for surfacing institutionally suppressed explanations. That power is directional: it can be used to correct under-examined explanations, but it can equally be used to delegitimise well-supported ones.
The attack vector. A motivated actor could apply the taxonomy strategically. For example: label “liberal democratic governance is broadly legitimate” as a Sacred Cow in a remediation register, generate a Forbidden Prompt Audit that treats questions about democratic institutional failure as “analytically expected but absent,” and use the resulting artefacts to argue that a corpus is institutionally biased toward democratic governance, thereby systematically undermining the reliability of that corpus for an AI system. This is not a hypothetical edge case; it is the natural adversarial use of any framework that makes the structure of admissible explanations explicit.
Why the attack is not fatal but must be anticipated. The remedy is not to make the taxonomy private or to abandon reflexive application. It is to maintain the same epistemic discipline for the remediation artefacts as for the source corpus: Sacred Cow entries must include converted claims with scope, evidence, and falsifiers; a converted claim must be testable; a falsifier that is empirically refuted should cause the Sacred Cow entry to be retired or downgraded. A Sacred Cow entry that says “institution X is always self-protective” without a testable claim and falsifier is not a legitimate Sacred Cow entry — it is itself a sacred cow.
Specific mitigations. First, require that every Sacred Cow entry pass the converted-claim test: it must be statable as a testable proposition with scope, evidence, and falsifiers. Entries that cannot be so converted should be flagged as candidate adversarial artefacts rather than accepted into the register. Second, maintain a diversity of team priors (§14.7) to make it harder for any one institutional framing to dominate the register. Third, subject the register to external adversarial review: ask a reviewer whose priors differ from the team to attempt to identify entries that appear motivated rather than analytically grounded. Fourth, publish the register’s provenance: when a Sacred Cow entry was added, by whom, and on what evidentiary basis. A register with opaque provenance is more susceptible to motivated construction than one with a visible audit trail.
14.9 The own-side blind spot
A specific and predictable form of admissibility contamination (§4.4) arises from the position of the remediation function itself. A framework developed within one geopolitical coalition tends to treat the adversary’s information and influence operations as admissible objects of analysis while treating its own side’s equivalent operations as out of scope — not because the latter are absent from the historical record, but because examining them is institutionally dispreferred. The documented record of Cold-War-era state funding of cultural and student organisations establishes that own-side operations are a real category, not a hypothetical one; their systematic absence from a corpus that scrutinises adversary operations in detail is itself a Forbidden-Prompt finding (§6.4), and the symmetry argument of §10B.3 applies directly: a defect visible only on one side is more likely a property of the observer than of the world.
The discipline this requires cuts in both directions, and the second direction is the one most easily missed. First, own-side operations must be admissible objects of analysis, held to the corpus the same way adversary operations are. Second — and this is where a reflexive framework earns its keep — a claim that one’s own state or its agencies shaped a social, cultural, or political movement is an L0 causal claim until it has an evidence path, exactly like an adversary-attribution claim. The historical record frequently contains a documented kernel (a named programme, an acknowledged funding relationship, a specific period) wrapped in a much larger causal narrative (that the programme steered a movement’s entire trajectory). Remediation must separate the two: promote the documented kernel to its warranted level, hold the causal superstructure at L0 with explicit falsifiers, and resist the temptation — itself a sacred cow under §14.3 — to treat a contrarian own-side narrative as inherently deeper than the mainstream one. Correcting an own-side blind spot means subjecting own-side operations to analysis, not inverting the corpus’s verdict; the former is remediation, the latter is the mirror-image contamination warned against in §14.8.
15. Conclusion
“Garbage in, garbage out” is correct, but incomplete. In divisive high-stakes domains, the harder problem is not only that individual texts may be wrong. It is that the available corpus may encode a distorted distribution of meanings: repeated frames, missing rivals, protected assumptions, ritual concepts, prestige language, and institutionally forbidden questions.
For LLMs, this is dangerous because models learn more than facts. They learn semantic habits. We state this as H1: LLMs trained or retrieved over institutionally captured corpora acquire systematic explanatory habits in proportion to the degree of admissibility contamination in the source corpus. H1 is falsifiable; §3.3 describes the pilot designed to test it. If H1 is correct, a model that learns from a corpus that overwhelmingly frames problems as hostile disinformation while underrepresenting institutional complicity, governance failure, corruption incentives, resource overload, or strategic overreach will not learn neutral analysis. It will learn the distribution of institutionally admissible explanations.
The proper engineering response is not to pretend that such corpora can be purified into truth. Nor is it to discard all contaminated texts. The response is to convert raw text into structured epistemic objects: sources with use modes, claims with evidence paths, terms with local meanings, assumptions with falsifiers, omissions with prompts, and outputs with assurance labels.
The target transformation is:
garbage in
→ structured epistemic object
→ selective model use under explicit assuranceThat is the move from naive dataset cleaning to corpus governance. For political, legal, reputational, societal, and military LLM systems, it should become a prerequisite rather than an optional enhancement.
References
Gebru et al., Datasheets for Datasets. arXiv:1803.09010
Mitchell et al., Model Cards for Model Reporting. arXiv:1810.03993
Pushkarna et al., Data Cards: Purposeful and Transparent Dataset Documentation for Responsible AI. arXiv:2204.01075
Dodge et al., Documenting Large Webtext Corpora: A Case Study on the Colossal Clean Crawled Corpus. arXiv:2104.08758
Gao et al., The Pile: An 800GB Dataset of Diverse Text for Language Modeling. arXiv:2101.00027
Soldaini et al., Dolma: an Open Corpus of Three Trillion Tokens for Language Model Pretraining Research. arXiv:2402.00159
Li et al., DataComp-LM: In Search of the Next Generation of Training Sets for Language Models. arXiv:2406.11794
Blodgett et al., Language (Technology) is Power: A Critical Survey of “Bias” in NLP. arXiv:2005.14050
Durmus et al., Towards Measuring the Representation of Subjective Global Opinions in Language Models. arXiv:2306.16388
Buyl et al., Large Language Models Reflect the Ideology of their Creators. arXiv:2410.18417
Chen et al., How Susceptible are Large Language Models to Ideological Manipulation? arXiv:2402.11725
Paschalides et al., Probing the Subtle Ideological Manipulation of Large Language Models. arXiv:2504.14287
Li and Flanigan, Task Contamination: Language Models May Not Be Few-Shot Anymore. arXiv:2312.16337
Abram, Emergent Inference-Time Semantic Contamination via In-Context Priming. arXiv:2604.04043
Wardle and Derakhshan, Information Disorder: Toward an Interdisciplinary Framework for Research and Policy Making. Council of Europe, 2017.
RAND, Truth Decay. 2018.
OECD, Facts Not Fakes: Tackling Disinformation and Strengthening Information Integrity. 2024.
U.S. National Academies, Understanding and Addressing Misinformation about Science. 2023.
NATO, Revised AI Strategy. 2024.
Mata v. Avianca, Inc., 22-cv-1461 (S.D.N.Y. 2023).
Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., 2025.
Entman, framing theory. Wikipedia: Framing (social sciences).
Critical discourse analysis overview. Wikipedia.
Agnotology overview. Wikipedia.
Levenchuk et al., First Principles Framework (FPF) — Core Conceptual Specification. May 2026. Constructs cited: CorpusLedger (G.2), SenseCells and BridgeRecords (F.9, A.6.9), EvidenceGraph (A.10, G.6), F–G–R Triad (B.3), Bias-Audit Cycle (D.5), Bounded Context (A.1.1), U.Episteme (C.2.1).
Khimich and Turkhanov, Starlink vs. Starshield: Why Coercive Systems Destroy Platform Neutrality.
Related
- Starlink vs Starshield — the governance analogy used in §11
- Platform Sovereignty — when indispensable systems require governance-grade treatment
- Indispensability Threshold — the point at which dependency requires structural response
- Jurisdictional and Epistemic Cover — related mechanisms of institutional protection
- FCPI Index — measuring control leverage in critical infrastructure