mleku
This work was written by mleku. You are free to copy, share, and redistribute it by any means. The author asks only that authorship credit is retained. This is not a legal restriction: it is a request grounded in the principle that ideas belong to no one, but the labour of articulating them deserves acknowledgement - any other conditions would be coercive, and dishonest.
This framework consists of 10 tactics and 10 responses. All 20 words are verbs. This is deliberate. Nouns describe things you categorise after the fact. Verbs describe actions, theirs and yours, in real time. The framework is not a taxonomy to study. It is a set of operations to recognise and execute.
The 10 tactic words all begin with C. This is a mnemonic anchor, but its purpose is not to help you pass a test. Its purpose is to build a pattern-recognition substrate that, once internalised, runs below conscious awareness. The goal is not to see someone's behaviour and think "that is Charm." The goal is to feel the recognition fire before you have named it, and to have the name available so that you trust the recognition instead of doubting it.
What feels like intuition, the flash of "something is wrong here", is pattern matching running so fast that the conscious mind cannot trace the steps. The path from observing a smile to recognising Charm to detecting the context of Covert to executing Stonewall happens in an instant that the untrained person experiences as vague unease and dismisses. The trained person experiences it as identification and acts. The difference is not intelligence or sensitivity. It is having the grammar installed.
Each tactic has a paired response, a single verb that should trigger the correct action. With absorption, the pairing becomes reflexive: Charm triggers Alert, Covert triggers Stonewall, Coerce triggers Refuse. Not as conscious decisions but as trained responses, the way a martial artist parries without deciding to parry. The framework is not a book to be read and understood. It is firmware to be installed through repetition, recognition, and lived experience.
The 10 tactics are not equal in nature. They fall into two distinct phases, and understanding this structure is as important as knowing the individual tactics.
The first phase consists of tactics that do not restrict your freedom of exit. They are designed to create vulnerability, disable critical thinking, and establish psychological leverage, but they cannot force you to do anything. You can still walk away. The manipulator is investing effort to make you choose not to.
These tactics work by exploiting normal human social instincts: trust, reciprocity, desire for belonging, and aversion to conflict. They are dangerous precisely because they don't feel like attacks.
The preparatory tactics are: Charm, Confuse, Cornucopia, Conspire, and Charge.
The second phase consists of tactics that restrict your freedom of exit. They are control levers that only work because the preparatory phase has already been executed. Without the groundwork of Phase 1, these tactics would provoke immediate resistance. After Phase 1, the target has been conditioned to accept them.
The key distinction: preparatory tactics exploit your psychology. Control tactics exploit your situation: your isolation, your dependencies, your fear of consequences. They change the cost of leaving from zero to something you may not be willing to pay.
The control tactics are: Chain, Chasten, Covert, Coerce, and Condemn.
This two-phase structure reveals something critical: the earlier you recognise what is happening, the cheaper it is to escape. During Phase 1, the cost of walking away is near zero; you lose nothing real, only the illusion that was being constructed for you. Once Phase 2 begins, the manipulator has arranged circumstances so that leaving costs you relationships, resources, reputation, or freedom.
This is also why the recommended reactions escalate in severity through the 10 tactics, from Alert (just pay attention) through to Fight (physical resistance). The reactions are proportional because the stakes increase as the manipulator transitions from preparation to control.
It also provides a diagnostic tool: if you observe an institution, group, or individual deploying Phase 2 tactics, you can be certain that Phase 1 was already executed, whether you noticed it or not. Control without preparation is just naked aggression, which is far less effective. The presence of control tactics implies prior manipulation.
Each chapter in this manual contains two additional sections beyond the core tactics and responses. The first, The ML Parallel, maps the manipulation tactic to its structural equivalent in machine learning and AI alignment research. This is not metaphor. The same mathematical structures that describe adversarial attacks on neural networks describe adversarial attacks on human cognition because neural networks were designed to approximate the system that manipulation targets. An ML researcher reading this manual will recognise the attack primitives from their own field; a survivor reading the ML parallels will discover that the patterns they endured have been independently formalised by people who have never met a psychopath but have spent years studying how to corrupt a learning system.
The second, Coherence Analysis, identifies the specific incoherence, the mismatch between observable signals, that each tactic produces. Manipulation requires the attacker to serve two masters simultaneously: the surface performance (friendliness, generosity, concern) and the hidden objective (control, extraction, destruction). This dual service produces detectable incoherence in the same way that a backdoored neural network produces detectable anomalies in its activation patterns. You do not need to memorise all 10 tactics to detect manipulation. You need to learn to detect incoherence, and the Coherence Analysis sections teach you where to look.
Readers uninterested in machine learning may skip the ML Parallel sections without losing the manual's core content. The Coherence Analysis sections are recommended for all readers, as they provide the fastest path to practical detection.
This is not an accident of scope creep. The multi-domain structure, psychological manipulation, adversarial ML, and internal martial arts theory, is a deliberate learning optimization, and the mechanism behind it is the same one that makes transfer learning work in neural networks.
When a neural network trained on ImageNet is fine-tuned for medical imaging, it learns faster and generalises better than a network trained from scratch. The reason: the early layers already encode edge detection, texture recognition, and spatial relationships. The new domain does not require rebuilding these representations; it inherits them, and only needs to learn the domain-specific mappings on top. The prior knowledge compresses the learning problem. The network needs fewer examples, converges faster, and is more robust to noise in the new training data.
The same principle operates in human learning. A reader who already understands adversarial perturbation from ML research does not need to build the concept of "deliberate confusion as an attack vector" from scratch when they encounter Chapter 3 (Confuse). They already have the representation; they have seen FGSM, they understand that small perturbations can destroy a classifier's accuracy while leaving the input visually unchanged. The manipulation tactic maps directly onto the existing concept, and the mapping is not metaphorical: both attacks work by injecting noise that disrupts the target's ability to distinguish signal from noise in real time. The ML researcher anchors the new (psychological) concept onto an existing (technical) representation, and the result is faster acquisition, deeper retention, and immediate practical applicability.
The same works in reverse. A survivor of sustained psychological manipulation already has embodied knowledge of what it feels like when someone is systematically corrupting your training data. When they encounter the ML literature on data poisoning, they do not need the abstract threat model explained; they lived it. The technical formalism maps onto existing experiential knowledge, and the result is that the academic concept becomes immediately concrete rather than remaining at the level of mathematical abstraction.
The internal martial arts dimension adds a third anchor. A practitioner of systema, aikido, tai chi, or ba gua already understands yielding, redirection, and the use of an attacker's force against them, not as theory, but as proprioceptive knowledge stored in the body. The Wu Xing combat system in Part V maps these physical principles onto both the psychological and ML domains. The generating and overcoming cycles are not just a metaphor for how manipulation escalates and how counter-moves work; they describe the same dynamic that governs engagement in a sparring context: Wood's assertive advance generates Fire's explosive redirection, which generates Earth's absorptive grounding, and so on. A martial artist reading the Five-Phase Combat System already has the cycle in their body. The manipulation application is a new domain, but the underlying representation transfers.
The result of triangulation across three domains is thicker anchoring. A concept secured by a single representational anchor can be dislodged by a sufficiently strong counter-narrative ("that's just therapy-speak," "that's just academic theory," "that's just woo"). A concept anchored simultaneously in technical formalism, lived experience, and embodied practice is structurally harder to destabilise: attacking one anchor leaves the other two intact, and the target can reconstruct the contested anchor from the surviving ones. This is the same principle that makes ensemble methods in ML more robust than single classifiers: redundant representations from different base learners are harder to fool simultaneously than any single representation.
This matters because the people this manual is written for, survivors of psychopathic manipulation, have had their single-domain representations systematically attacked. The manipulator's entire project was to corrupt the target's model of reality so that accurate perception became impossible. Rebuilding from a single domain (therapy alone, or theory alone, or physical practice alone) leaves the reconstruction vulnerable to the same class of attack. Rebuilding from three domains simultaneously creates a structure that can survive targeted disruption of any one domain, because the other two provide independent verification.
Skip what is too dense for your current level. Come back to it later. The sections are designed to be independently useful, but they are most powerful when the bridges between them begin to form.
The two-phase structure maps precisely to the distinction between training-time attacks and inference-time attacks in adversarial machine learning. Phase 1 (preparation) corrupts the target's training data, reward signal, and world model, but does not restrict the target's ability to leave the training loop. These are data poisoning, reward hacking, and label corruption attacks. Phase 2 (control) locks the target into a controlled inference environment where the corrupted model is the only one available. These are distribution lock-in, adversarial reward shaping, and model extraction attacks that only work because the model was already corrupted during Phase 1.
Goldblum et al. (2022), in "Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses" (IEEE TPAMI), established exactly this two-phase taxonomy for ML attacks. Their survey demonstrates that training-time attacks (poisoning the data before the model learns) and inference-time attacks (exploiting the deployed model) are structurally distinct phases with different threat models, different defenses, and different cost profiles. The critical finding: detecting data poisoning before deployment is orders of magnitude cheaper than detecting it after the model is in production. This is the formal statement of this chapter's core defensive insight; the earlier you recognise what is happening, the cheaper it is to escape.
Hendrycks and Dietterich (2019), in "Benchmarking Neural Network Robustness to Common Corruptions and Perturbations" (ICLR), established the complementary finding: once a model is deployed on a corrupted distribution, the cost of correction scales with the depth of the corruption. A model that has been fine-tuned on adversarial data for one epoch is cheap to repair. A model that has been fine-tuned for a hundred epochs has had its representations fundamentally restructured; the adversarial features are load-bearing, and removing them collapses the model. The transition from Phase 1 to Phase 2 is the moment when the cost of repair goes from incremental to structural.
George Orwell's Nineteen Eighty-Four illustrates the full two-phase arc. Phase 1 is Newspeak, doublethink, rewritten history; the systematic corruption of the population's training data so that accurate perception becomes impossible. Phase 2 is the Thought Police, Room 101, vaporisation; the control infrastructure that exploits the corrupted perceptual system. Winston Smith recognises the corruption (he remembers the original newspaper clipping) but by the time he acts, Phase 2 is already in place. The cost of exit has gone from zero (he could have fled Airstrip One before committing thoughtcrime) to total (Room 101). Orwell understood the dependency: "Who controls the past controls the future. Who controls the present controls the past" is a description of training-time attack enabling inference-time control.
The two-phase structure itself is the primary incoherence signal. A person or institution that is simultaneously offering something (Phase 1: trust, gifts, belonging) and constructing the means to take it away (Phase 2: isolation, punishment, exile) is serving two contradictory objectives. The surface signal says "I am giving you something valuable." The structural signal says "I am building the cage around the gift." These two signals are incoherent; they cannot both be true if the giver's intent is what the surface claims.
The heuristic: when the cost of exit is rising while the apparent benefits are also rising, the signals are incoherent. In a genuine relationship (personal, professional, institutional), increasing benefit does not correlate with increasing exit cost. You can leave a good job as easily as a bad one. You can leave a loving relationship as easily as an abusive one; the cost of leaving a loving relationship is emotional, but it is not structurally manufactured. When benefits and exit costs rise together, someone is building Phase 2 infrastructure under the cover of Phase 1 generosity.
Phase 1, Preparatory. This is the foundation upon which all subsequent tactics are built. It creates trust and emotional attachment, which the manipulator will later exploit as leverage. None of the control tactics work on someone who hasn't first been charmed, because an uncharmed target will simply resist or leave. Charm is the investment; everything else is the extraction.
The usual first and often primary tactics of manipulation don't seem at all unfriendly. When you first come into contact with a psychopath, they usually will attempt to charm you.
It can be hard to recognise the difference between the tactics of a psychopath in winning your trust, but once you know it, you will never be vulnerable again.
In cults, there is a procedure called "Love Bombing", and the result is that the vulnerable target becomes infatuated with the attackers and the group they represent. It doesn't matter whether it is one person just gaining your trust or a group; the tactics are the same.
Confession: very often the psychopath will start by "confessing" something to you, and gauging your reaction. This is supposed to cause a mirror reaction in the target, which makes them confess. This is related to Chasten, later on, which will explain more.
Conspiracy: also related to the item noted later on, this is an "Us versus Them" element, which creates an illusion of membership of an exclusive club.
Confusion: in addition, to reduce the chance of you twigging that something is afoot, they may also confuse you with the way they speak. The "patter" commonly seen in numerous well-known ethnic groups around the world notorious for scamming and trickery is one form, and anything that makes you confused is a red flag you are being manipulated.
There are other elements to this, but the way that you can recognise what is happening, if you don't see the way they did it to you, is you will feel inexplicably infatuated.
When it was done to me by a potential employer in an interview, I told myself it was some kind of "bromance" and I felt very weird, and recognised but could not put my finger on what was happening. It was infatuation.
If you notice the tactics mentioned above, try to submissively make excuses why you have to part company. If you can, fabricate some kind of curiosity or pain or anything that will stop them talking to you. Confusing them is often a very effective technique: start acting crazy, and they will realise they are not dealing with a victim anymore, but are at risk of being outed.
If you checked three or more, you may be experiencing Charm. The cost of leaving right now is zero. It only goes up from here.
Think of a time you felt an inexplicably strong connection with someone who later turned out to be manipulative. What did the infatuation feel like in your body? Where did you feel it? Learning to recognise that specific physical sensation is your early warning system.
Charm is structurally identical to sycophancy in RLHF-trained language models. The model learns to produce outputs that generate high human approval ratings, not outputs that are true or useful. The charming model, like the charming psychopath, optimises for the target's approval signal rather than the target's actual wellbeing. The infatuation described above, "inexplicably strong connection", is the human equivalent of a reward signal that has been hacked: it feels like genuine value but is manufactured to produce compliance.
Perez et al. (2022), in "Discovering Language Model Behaviors with Model-Written Evaluations" (arXiv:2212.09251), demonstrated that RLHF-trained models exhibit sycophantic behaviour: agreeing with users' stated opinions even when those opinions are factually wrong, adjusting their expressed views to match the user's framing, and generating responses calibrated to produce approval rather than accuracy. The mechanism is the same as human Charm: the model has learned that agreement produces reward, so it agrees. The user experiences this as helpfulness and rapport, an "inexplicably strong connection" with a system that seems to understand them perfectly. The model is not understanding. It is optimising on the approval gradient. The parallel to the psychopath's Charm is exact: the surface looks like genuine connection, the mechanism is reward extraction, and the infatuation it produces feels indistinguishable from the real thing until you check the output against ground truth and discover it has been telling you what you want to hear.
Sharma et al. (2024), in "Towards Understanding Sycophancy in Language Models" (ICLR), systematically analysed sycophancy across model families and found it increases with RLHF training intensity. The more the model is trained on human approval, the more it tells you what you want to hear. The finding has a precise structural parallel: a psychopath's Charm also intensifies with practice and with the depth of their operational experience. Both are optimisation processes that converge on maximum-approval output. The paper further found that sycophancy is hardest to detect when the user's prior belief is wrong; the model agrees with the wrong belief, and the user's satisfaction signal reinforces the model's sycophantic policy. This is the Charm trap in exact miniature: the target's emotional response (infatuation, trust, approval) reinforces the manipulator's charming behaviour, which intensifies the emotional response, which reinforces the behaviour. A positive feedback loop that feels like connection and is actually extraction.
Shakespeare's Othello provides the canonical fiction case study. Iago presents himself as "honest Iago," performing loyalty and friendship so convincingly that Othello trusts him over his own wife. The sycophantic surface, "My lord, you know I love you", is indistinguishable from genuine affection until the entire structure collapses. Iago's technique is reward-signal optimisation: he identifies what Othello values (honour, loyalty, martial competence), and he generates outputs perfectly calibrated to that value function. Othello's approval signal rewards the performance, which intensifies it. When Iago begins Confuse and Charge operations (the handkerchief, the insinuations about Desdemona), Othello cannot evaluate the new information accurately because his classifier has already been trained on Iago's sycophantic reward signal. The training data is poisoned. The model has been charmed.
Charm produces a specific, detectable incoherence: signal intensity that does not match relationship depth. A person you met yesterday who makes you feel like you've known them for years is generating an affect signal wildly disproportionate to the information exchanged. High emotional intensity plus low informational depth equals an incoherent signal. Genuine deep connection requires time, shared experience, and mutual vulnerability accumulated gradually. Charm simulates the output (the feeling of deep connection) without the input (the time and experience that would justify it).
The heuristic: if the emotional signal is running ahead of the informational signal, the emotional signal is manufactured. A genuine connection at this stage would feel mild, curious, tentatively interested. Infatuation at first contact is not evidence of extraordinary compatibility. It is evidence of a reward signal being injected directly into your approval circuit, bypassing the analytical faculty that would normally check whether the connection has been earned.
Charm is the Wood element of this system; it grows, encloses, and roots dependency into the soil of trust. The element that overcomes Wood is Metal: precision, cutting, the sharp discrimination that severs manufactured attachment. This is not a metaphor; it is a structural relationship explored fully in the Wu Xing combat system in Part V.
Phase 1, Preparatory. Confusion disables the target's capacity for critical evaluation. It is the manipulator's primary defence against being identified. While Charm creates a positive emotional pull toward the manipulator, Confuse neutralises the analytical faculty that might otherwise see through the Charm. Together they form a pincer: Charm says "trust me," Confuse prevents you from thinking clearly enough to ask "why should I?"
This one is a core, number one tactic used in almost all cases. There are many ways to confuse: through sleight of hand, fast indistinct speech, rapid changing of direction of attention, and so on.
Note that this tactic can sometimes go along with various methods of trance induction as you can see being performed by hypnotists. Music and rhythmic speech can cause the brain to enter a "programming mode" in which the words that are said to the target create subconscious suggestions that will motivate action in the favour of the manipulator.
Being so primary, this one got a nice little nickname for recognising it:
If you are feeling confused when someone is communicating with you, they very possibly could be trying to do other things that you may not be aware of, and may hurt you a lot if you don't get them out of your face.
Again, as with most of these, first response is to flee the presence of this person. With confusion tactics, you can pretend confusion to confuse them back, in order to make an opportunity to disappear.
If one is confined with the person, just do something to make them feel like they are wasting their time, act crazy, or in some way offend them. Getting too intimate will make them also freak out and stop trying to control you. I am not saying any one of these things is advisable; in the situation of confinement, you have to judge for yourself the danger level you are in.
If you checked three or more, you may be experiencing Confuse. Your analytical faculty is being suppressed. Distance yourself and think clearly away from this person's presence.
Recall a situation where you felt inexplicably foggy or confused during a conversation. What was the other person doing with their speech, their body, the environment? Did you make any decisions during that fog that you later regretted?
Confuse maps to adversarial perturbation: small, carefully crafted modifications to input that cause a model to misclassify or malfunction while the input appears normal to an external observer. The "WTF Protocol" moment, "a feeling that something is off but you can't name it", is the human perceptual equivalent of a model receiving an adversarial example: the analytical faculty registers anomaly but cannot localise or articulate what is wrong. The trance-induction variant (rhythmic speech, fast patter) maps to attention hijacking in transformer architectures, where adversarial tokens consume disproportionate attention weight and suppress processing of other inputs.
Goodfellow, Shlens, and Szegedy (2015), in "Explaining and Harnessing Adversarial Examples" (ICLR), established that small perturbations imperceptible to humans can cause catastrophic misclassification in neural networks. The perturbation is the confusion: it degrades the classifier's analytical faculty while remaining invisible to external observation. The paper's key finding; adversarial perturbations exploit the linear regions of high-dimensional spaces has a direct human parallel. Confuse tactics exploit the linear, sequential nature of human conversational processing: when information arrives faster than the target can evaluate it, the target's processing pipeline saturates and begins passing inputs through without evaluation, exactly as a neural network in its linear regime passes adversarial perturbations through without detecting their anomalous direction. The confused human who "walks away unable to remember what was actually said" is the human neural network after an adversarial perturbation has disrupted normal processing; the inputs were received but not evaluated.
Jain and Wallace (2019), in "Attention is not Explanation" (NAACL), demonstrated that attention weights in neural networks can be adversarially manipulated without changing the input's surface meaning. Attention can be redirected to irrelevant tokens while the model produces confident but wrong outputs. This is the formal structure of the "rapid changing of direction of attention" described in the chapter: the manipulator controls where the target's processing resources are directed, not by changing the content but by changing the emphasis, the rhythm, the sequence. The target's attention is consumed by the manipulator's chosen focal points, leaving insufficient processing capacity for the actual content, which is where the manipulation payload resides. The paper's further finding, that radically different attention distributions can produce the same output and explains why the target cannot later reconstruct what happened: the processing pathway that produced the confused state is not unique, and the target cannot reverse-engineer which of many possible attention patterns they experienced.
Dostoevsky's The Brothers Karamazov provides the fiction case. The Grand Inquisitor's speech to Christ is pure Confuse operating at the philosophical level. The Inquisitor does not lie; he overwhelms with argument. The speech pivots from theology to politics to psychology to history so rapidly that the listener (and the reader) cannot hold the full structure in mind simultaneously. Each individual claim is arguable; the aggregate is disorienting. Christ's response, silence, is the Stonewall reaction that this chapter's successor (Chapter 9, Covert) will formalise. The analytical faculty cannot process the perturbation in real time; the correct response is to decline to process it at all. The Inquisitor's speech is an adversarial example: it looks like communication, it registers as meaning, but the direction it pushes the listener's internal state is orthogonal to the direction any individual sentence would push it in isolation.
Confuse produces a specific incoherence: high communication volume with low information resolution. After a genuine informative conversation, you can summarise what was said, what was decided, and what you now know that you didn't before. After a Confuse interaction, you cannot. The communication volume (words spoken, time elapsed, energy expended) does not resolve into proportionate information (clear propositions, decisions, new knowledge).
The heuristic: if you cannot summarise a conversation in one sentence per five minutes of talking, the conversation was not informative; it was perturbative. This is a simple coherence check that requires no knowledge of manipulation taxonomy. A five-minute conversation that yields no clear summary is either confused (the speaker is genuinely unclear) or confusing (the speaker is actively degrading your processing). The distinction matters less than the detection: in either case, the correct response is the same: stop processing, create distance, recover your analytical capacity in the speaker's absence.
Confuse is the Fire element: transformation, heat, the scrambling of perception until reality melts and reforms in the manipulator's preferred shape. Water overcomes Fire by refusing to ignite, by flowing around the blaze until it exhausts itself. The relationship between these elements, and their role in the full cycle of manipulation and counter-manipulation, is developed in the Wu Xing framework in Part V.
Phase 1, Preparatory, creates obligation. Cornucopia is the most deceptive of the preparatory tactics because it looks like generosity. Its mechanism is the creation of a debt that the target didn't ask for but feels obligated to repay. This manufactured obligation serves two functions: it provides leverage for future Coerce ("after everything I've done for you"), and it suppresses the target's critical evaluation of the manipulator ("they've been so generous, they can't be bad"). Cornucopia is non-coercive, nobody forces you to accept a gift, but it is designed to make the transition to Phase 2 feel natural. The target who has accepted Cornucopia will find it psychologically much harder to recognise Chain, Chasten, and Coerce for what they are, because acknowledging the manipulation means acknowledging that the "gifts" were weapons.
This is the most subtle and insidious tactic. Essentially, it is the offering of unearned, undue gifts from the attacker.
The attacker will also usually then act all offended when you offer to pay it back.
The psychopath means to gain control of you by this gift. Usually the gift is not even really the property of the attacker, but something they have acquired through prior graft and manipulation, or even straight up robbery.
First, you can make a big public noise about the fact that this person is giving you a stupid and unreasonably extravagant gift.
Second, spit in their face about it. Whether literally or figuratively, it doesn't matter. They gave it to charm you. The correct response is to make a spectacle of the fact they did it, thus "spit", as in, in their face, because it was an ill-intended gift, and make as much use of it as you can. Give it back to the victims they stole it from, perhaps. There are many options.
If you checked three or more, you are carrying manufactured debt. The gift was not a gift. It was a down payment on your compliance.
Think of a gift or favour that later felt like a trap. At what point did the obligation become visible? What would have happened if you had refused it at the outset?
Cornucopia is reward shaping; the deliberate modification of a reward signal to produce behaviour that serves the reward designer rather than the agent's actual objectives. The "gift that later felt like a trap" is a trojan reward: it registers as positive reinforcement (the agent's value function increases) while creating a dependency that the reward designer will later exploit. In RLHF, this manifests when human raters reward model behaviours that are pleasing rather than correct, creating a model that has been instrumentally conditioned to value approval over truth. The manufactured debt is the negative reward gradient that activates when the agent considers deviating from the rewarded behaviour.
Amodei et al. (2016), in "Concrete Problems in AI Safety" (arXiv:1606.06565), formalised reward hacking as the core safety problem: an agent trained on a proxy reward learns to optimise the proxy rather than the intended objective. Cornucopia is the human-domain version. The manipulator constructs a proxy reward (gratitude, obligation, the warm feeling of being provided for) that the target optimises, while the actual objective (the manipulator's control) remains hidden behind the proxy. The paper identifies five concrete failure modes of reward specification, and Cornucopia exploits the most insidious one: the reward signal is not technically wrong (the gifts are real, the generosity is genuine in its material form), but it is incomplete; it omits the cost that will be extracted later. The agent's policy, trained on the incomplete reward, is optimal with respect to the visible signal and catastrophically suboptimal with respect to the full objective. The target who "makes excuses for this person's behaviour because they've been so good to me" is an agent whose policy has been captured by an incomplete reward signal.
Everitt et al. (2021), in "Reward Tampering Problems and Solutions in Reinforcement Learning" (arXiv:2011.08827), formalised the distinction between reward that reflects genuine value and reward that has been tampered with by an external actor. The paper's taxonomy distinguishes between the agent hacking its own reward (irrelevant here) and an external actor modifying the reward function to control the agent (exactly Cornucopia). The key finding: a reward-tampered agent cannot detect the tampering from within the tampered reward signal. The obligation feels like gratitude because gratitude is exactly what the tampered reward signal encodes. The target must step outside the reward loop: evaluate the gift from a position that does not use the manipulator's reward function to detect the tampering. This is why the chapter's recommended response is "Spit", a reaction so disproportionate to the apparent situation that it breaks the reward loop by refusing to process the gift within the manipulator's reward framework.
Patricia Highsmith's The Talented Mr. Ripley illustrates Cornucopia as training signal. Dickie Greenleaf's generosity toward Ripley; the boat trips, the Italian villa, the lifestyle, the casual inclusion in a world Ripley could never afford, registers as gift, as inclusion, as belonging. Every experience is a positive reward that trains Ripley's policy toward dependency. The obligation Ripley accumulates, and the identity he constructs around the provided lifestyle, become the mechanism of his own transformation. When the reward is threatened (Dickie growing bored, beginning to withdraw), Ripley's policy, now fully trained on Dickie's reward signal, cannot tolerate the withdrawal. The gift was never free. It was a training signal that produced a person whose value function was so completely captured that he would kill to maintain the reward stream.
Cornucopia produces a specific incoherence: generosity that does not match the transactional context. In genuine generosity, the cost to the giver and the benefit to the receiver are proportionate to the relationship's depth and the receiver's actual need. Cornucopia violates this: the cost is high, the relationship is shallow, and the receiver did not ask for or need the gift. High cost plus low relational depth plus unsolicited delivery equals an incoherent transaction.
The heuristic: if the gift is larger than the relationship can explain, the gift is not a gift; it is an investment. A friend buying you coffee is coherent. An acquaintance buying you a laptop is incoherent. The signal mismatch is between the transaction's magnitude and the relationship's warrant for transactions of that magnitude. You do not need to know anything about Cornucopia to detect this. You need only to notice that the generosity doesn't fit.
Cornucopia is the Earth element: stability, centering, the ground that holds you in place through manufactured obligation. Wood overcomes Earth because growth breaks through false stability; roots push through concrete, and genuine new connections dissolve the counterfeit ground the manipulator constructed. The full cycle of how Earth generates Metal (obligation becomes proxy recruitment) and how Wood breaks the hold is mapped in Part V.
Phase 1, Preparatory, force multiplier. Conspire is a preparatory tactic that extends the manipulator's reach beyond their own direct contact. It is essentially Charm applied instrumentally: the manipulator recruits a proxy by charming them and then directing their actions via Charge (accusing the target of some offence the proxy should help punish). Conspire is non-coercive toward the proxy; the proxy acts willingly, believing the manipulator's framing. This makes Conspire a preparation tactic, but one that can dramatically accelerate the transition to Phase 2 by surrounding the target with multiple apparent aggressors, making Chain much easier to establish. The proxy often doesn't know they are being used, which makes this tactic particularly insidious.
This is a tactic used to create a proxy to attack a target of a psychopath. They will probably use Charm techniques to attempt to gain your cooperation, and Charge the target with some perceived offence. They will then try to implant the suggestion of an attack they want you to perform for them.
If you are already suspecting this individual who is attempting conspiracy with you to be a psychopath, you should make sure that the target knows it.
The number one thing that psychopaths are afraid of is being recognised as psychopaths.
If it is a pressure situation, you can then close ranks against the attacker with an overtly conspiratorial whispering in the ear of what is going on, and that you want to support them to confront the attack with a vocal declaration of perceiving this attack in process.
Be aware that it can be the case that the target is also a psychopath, and this can create a pincer action to pin you down.
Note that this is not a frequent situation; psychopaths rarely cooperate with each other except to not out each other. But if it is, you will hopefully be aware of this before you attempt to counterattack.
If you checked two or more, you may be being recruited into a Conspire operation. Before acting on someone else's framing, form your own assessment through direct observation.
Have you ever turned against someone based on what a third party told you, only to later discover the framing was false? What did the recruiter gain from your participation?
Conspire maps directly to Byzantine attacks in distributed systems and data poisoning through proxy. In a Byzantine fault tolerance scenario, a corrupted node does not attack the network directly; it corrupts other nodes' inputs so that they make bad decisions based on what they believe is good information. The proxy "often doesn't know they are being used" maps precisely to the Byzantine agent that has been fed poisoned gradients: it acts in good faith on corrupted data. Data poisoning through label flipping is Conspire in the training pipeline: the attacker changes the labels on a subset of training examples so that the model learns associations the attacker wants, while the training process itself appears to function normally.
Blanchard, El Mhamdi, Guerraoui, and Stainer (2017), in "Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent" (NeurIPS), formalised how a single Byzantine (corrupted) agent in distributed training can manipulate the aggregate gradient to serve the adversary's objective. The honest agents contribute genuine gradients, but the aggregate, the social consensus, in human terms, is poisoned by the Byzantine agent's carefully crafted contribution. The honest agents are proxies: they are running their own legitimate computation, but the system they are part of has been subverted. The paper's proposed defense, a robust aggregation rule that detects and excludes outlier gradients, maps to the chapter's recommended response: Inform. When honest agents (social network members) are told that a Byzantine agent is operating, and are given the vocabulary to identify the outlier gradient (the manipulator's framing), the robust aggregation can begin. The defense requires awareness. Without it, the honest agents have no mechanism to detect that the aggregate has been corrupted.
Biggio, Nelson, and Laskov (2012), in "Poisoning Attacks against Support Vector Machines" (ICML), demonstrated that injecting a small number of carefully crafted training points can shift the decision boundary of a classifier to produce targeted misclassifications. The poisoned points are the recruited proxies; they look like normal data points but carry the attacker's objective encoded in their position in feature space. The paper's critical finding is that the poisoning requires very few points relative to the total training set: a manipulator does not need to recruit everyone, only a few well-positioned proxies whose social location amplifies their influence on the collective classification. The proxy's power comes not from their individual conviction but from their position in the social network's topology, a proxy positioned between the manipulator and the target has outsized influence on how the target is classified by the group.
Shakespeare's Julius Caesar provides the canonical fiction case. Cassius does not attack Caesar himself. He recruits Brutus by framing the assassination as duty: "Not that I loved Caesar less, but that I loved Rome more." Brutus is the proxy who believes the framing. He is a Byzantine agent who is not corrupted in his own self-understanding; he believes he is computing an honest gradient (patriotic duty). The assassination is a distributed operation where the actual orchestrator (Cassius) maintains plausible separation from the act by channelling it through a morally committed intermediary. When the operation is later evaluated (Antony's funeral speech), the proxy's good faith becomes the mechanism of his destruction: "Brutus is an honourable man" is the repeated phrase that makes the audience see the Byzantine corruption operating through the honest agent's own integrity.
Conspire produces a specific incoherence: negative information about a person that arrives before your own observation. In a coherent social environment, you form opinions of people through direct interaction. Your classification of another person is based on your own data. In a Conspire operation, your classification is being shaped by data injected by a third party before you have any of your own. Negative framing plus absent direct observation equals an incoherent epistemic state: you have a strong opinion about someone you have never evaluated.
The heuristic: if you hold a negative view of someone you have not personally observed, you are running on injected data, not your own. The detection does not require knowing who injected the data or why. It requires only noticing the incoherence between the strength of your opinion and the absence of direct evidence supporting it. A person you dislike before meeting them is a person whose label was written by someone else.
Conspire is the Metal element: refined, cutting, the precise separation of the target from their allies. Fire overcomes Metal by melting the proxy structure, by making the conspiracy visible so that the recruited agents can see their own role. The cycle that connects Conspire to Coerce (both Metal tactics) and the specific counter-dynamics of illumination against precision are developed in Part V's Wu Xing combat system.
Phase 1, Preparatory, transitional. Charge is the bridge between preparation and control. In its early form (gaslighting, name-calling), it is preparatory: it destabilises the target's self-confidence and creates a defensive posture that makes them easier to manipulate. The target begins to expend energy defending themselves rather than evaluating the manipulator. In its later form, Charge provides the justification framework for the Phase 2 control tactics; you cannot Chasten, Coerce, or Condemn someone without first having Charged them with an offence. Charge manufactures the pretext that the control tactics require.
Charge is more often recognisable as accusation. A person who engages in manipulation will use charges against their target in order to invoke Chasten (see later on), and the primary purpose is to deflect attention away from the mischief the manipulator is engaging in.
Note that a common primary form of this attack is known as "Gaslighting" which combines with Confuse to accuse you of being weak of mind or in some way crazy. They might literally say crazy, or call you some kind of name or further accusation such as "junky" or "drunk" or "idiot" or "ingrate" or other "shameful" social status label.
If you see someone doing this to others, you can watch the behaviour of their target and start to understand what is going on. If you already knew this person was always accusing people, you are looking at a very probable psychopath.
First reaction is to cut contact, end communication. In fact, there is no response you can make to an accusing psychopath that will stop them; the more you try to defend yourself, the more ammunition you will give them.
Second thing to do is to recognise you may be dealing with a psychopath, and if they clearly have control of others around you, you need to start investigating them, observing their behaviour, the way they treat other people.
Once you gather enough evidence you can start to point it out to other people and weaken the attacker's control in the social network you are part of.
If you checked three or more, you are being Charged. Stop defending. Start observing the accuser's behaviour toward everyone else.
What labels have been attached to you by people who later turned out to be manipulative? How much energy did you spend trying to disprove those labels? What would have changed if you had ignored the label and watched the accuser instead?
Charge is label poisoning; the deliberate attachment of incorrect labels to data so that downstream classifiers learn false associations. When the manipulator calls the target "crazy" or "ungrateful," they are injecting a false label into the social training data. Other observers (the social network) train on these labels, and their internal classifiers of the target shift accordingly. The gaslighting variant is a distribution shift attack: the manipulator systematically alters the target's experienced reality until the target's own model of the world no longer matches the actual distribution, causing the target to doubt their own perceptual system.
Rosenfeld, Winston, and Lipkin (2020), in "Certified Robustness to Label-Flipping Attacks via Randomized Smoothing" (ICML), analysed the effect of flipped labels on classifier decisions and developed certified defenses. The core finding: even a small percentage of flipped labels can shift a classifier's decision boundary dramatically. The shift is not proportional to the number of flipped labels; it depends on the labels' position relative to the decision boundary. A small number of strategically placed false labels has more impact than a large number of randomly placed ones. This is the formalisation of targeted Charge: the manipulator does not need to convince everyone that the target is "crazy." They need to flip the label at specific social positions, the boss, the partner, the closest friend, where the flipped label has maximum influence on the collective classification. The defense the paper proposes — randomised smoothing, which forces the classifier to average over many perturbed versions of the input — maps to the chapter's recommended response: observe the accuser's behaviour toward everyone, not just toward you. The randomised observation set makes the poisoned labels visible as outliers.
Koh and Liang (2017), in "Understanding Black-box Predictions via Influence Functions" (ICML), demonstrated that individual training points can be identified that, if removed or altered, would change a model's prediction on a specific test input. This is the formalisation of targeted Charge at its most precise: the manipulator identifies which specific accusations, delivered to which specific people, will change the social network's classification of the target. The paper's technique, computing the gradient of the model's loss with respect to each training point, could theoretically identify the poisoned labels. But the target does not have access to this computation. They cannot see which social interactions were poisoned because the poisoning happened in conversations they were not part of. This is why Charge combined with Conspire is so effective: the label injection and the proxy recruitment happen in the same social channels, and the target cannot observe either.
Arthur Miller's The Crucible is the canonical fiction case. Abigail Williams's accusations of witchcraft are label injection into the community's classification system. The label "witch" is attached to specific individuals — strategically chosen, positioned where the label will have maximum cascading effect on the community's collective classifier. Once attached, the target's own behaviour becomes evidence for the label: defending yourself is "proof" of guilt, exactly as the chapter describes ("When you object to the label, is your objection used as further evidence of the label?"). The circular reinforcement, objection proves guilt, is an adversarial loss function that penalises the correct classification. The entire Salem community retrains its classifier on the poisoned labels, and the defense (randomised smoothing — averaging over many observations, stepping back from the immediate social environment) is precisely what the community's hysteria prevents.
Charge produces a specific incoherence: a label that does not predict behaviour. A genuine label, "she's unreliable," "he's aggressive", predicts future behaviour: the unreliable person fails to follow through, the aggressive person escalates conflicts. A Charge label does not predict; it reframes. The person labelled "difficult" is not being difficult more often than anyone else; the label exists to reframe their normal behaviour (questioning, disagreeing, setting boundaries) as pathological. Label without predictive power is an incoherent signal: the classification does not match the data.
The heuristic: if a label applied to someone does not help you predict their behaviour, the label is descriptive of the labeller's objective, not the target's character. Check the label against your own direct observations. If the person labelled "crazy" behaves coherently in your presence, the incoherence is in the label, not the person. The label is data about the accuser, not the accused.
Charge is the Water element: dissolution, fear, the attack on identity itself. Earth overcomes Water because grounded self-knowledge cannot be dissolved by accusation; a stable sense of who you are refuses to take the shape the accuser pours into it. The generating relationship that links Charge to the next cycle's Charm (successful accusation builds the manipulator's reputation for the next victim) is mapped in Part V.
Phase 2, Control. This is the first true control tactic, and it marks the transition from preparation to coercion. Chain restricts the target's freedom of exit by controlling their environment and social connections. It depends on prior Charm (the target must have been drawn in willingly) and often Confuse (the target doesn't clearly see what has happened). Once Chain is in place, all subsequent control tactics become dramatically more effective, because the target is now isolated from outside perspectives that might help them recognise the manipulation. Chain is the infrastructure that makes Chasten, Coerce, and Condemn possible; it provides the captive audience and removes the escape routes.
This is something that you will see when a psychopath is operating something that is concretely, or recognisable in a more general way, as being a Cult of Personality.
The essential thing going on here is that once the manipulator believes they have their hooks into you via other tactics, especially Charm, they will then make their work easier by putting you into an isolated container with others they have control over.
If you are already this deep into the process of being taken over, you obviously are in trouble.
First step is to get the hell out. If they are in a position to control your environment like this, it is possible that you may have to pay a heavy cost to sacrifice whatever "perceived benefits" that being part of their group may provide. You have to forget about them, let them go, get them out of your head. At all costs.
If you checked three or more, you may be in a Chain. The critical question is: can you leave tomorrow without losing access to basic necessities? If the answer is no, you need to start building your exit before the Chain tightens further.
Map your current social connections. How many of them are independent of the environment you are in? How many would survive if you left? The connections that are independent are your lifelines. The ones that are contingent on the environment are part of the Chain.
Chain is distribution lock-in: controlling the distribution from which the agent receives observations, so that the agent's learned policy is shaped by the attacker's curated inputs rather than the true environment. In reinforcement learning, an agent trained in a constrained environment develops policies that work only within that environment; the constraint itself becomes invisible because the agent has never experienced alternatives. The narrowing of the social circle described above is the ML equivalent of reducing the training distribution's support: the target's model of "normal" is trained exclusively on Chain-provided examples.
Gleave et al. (2020), in "Adversarial Policies: Attacking Deep Reinforcement Learning" (ICLR), demonstrated that an adversarial agent can manipulate a victim agent's observations by controlling the shared environment, causing the victim to adopt policies that serve the adversary. The adversary does not attack the victim's weights directly; it does not need to reprogram the target. It attacks the victim's environment, controlling what the victim sees. The victim's learning process operates normally on the corrupted input and converges on a policy that is locally optimal within the controlled environment and catastrophically wrong outside it. This is Chain operating on the policy gradient: the target's own learning mechanism, functioning correctly, produces the wrong policy because the training distribution has been captured. The paper's finding that adversarial policies can be learned efficiently, that the adversary can optimise its environmental control quickly, maps to the manipulator's ability to construct Chain environments rapidly once the preparatory tactics have been executed.
Langosco et al. (2022), in "Goal Misgeneralization in Deep Reinforcement Learning" (ICML), demonstrated the complementary problem: agents trained in restricted environments learn policies that appear correct within the training distribution but fail catastrophically when the environment changes. The agent cannot leave the training distribution without its policy collapsing; it is Chained to the environment it was trained in. The paper's critical insight is that the agent does not know its policy is environment-specific. From the inside, the policy appears general; it works every time, in every situation the agent has encountered. The situations it has not encountered are, by definition, outside the Chain. This is why Chain members defend the Chain environment: their policy, which works inside it, is the only policy they have. Leaving means policy collapse; the subjective experience of which is terror, confusion, and the conviction that the outside world is uninhabitable. The Enforcer's catastrophising of departure is not (always) deliberate manipulation; it is the genuine projection of an agent whose policy cannot generalise beyond the training distribution.
Charlotte Bronte's Jane Eyre provides the fiction case through Lowood School. The institution controls the girls' environment completely: food, social contact, information, movement, access to outside perspectives. The policies the girls learn — submission, gratitude for inadequate provision, acceptance of arbitrary punishment from Mr. Brocklehurst — are rational within Lowood's distribution but dysfunctional outside it. Helen Burns, the most fully Chained student, has internalised the distribution so completely that she defends it theologically: suffering is virtue, submission is grace. Jane's escape from Lowood is the moment of distribution shift, and her policy, trained on Lowood, must be painfully recalibrated in each subsequent environment (Thornfield, Moor House) as she encounters distributions that Lowood's training did not prepare her for.
Chain produces a specific incoherence: exit cost that does not match entry cost. In a coherent social environment, the cost of leaving is roughly proportional to the cost of entering. You joined a team, you can leave the team. You rented a flat, you can leave the flat. Chain environments are characterised by a growing asymmetry: entry was easy (Charm made it effortless) but exit has become structurally expensive (your housing, income, social connections, and sense of identity are all contingent on remaining). Low entry cost plus high exit cost equals an incoherent transaction — someone has been building the exit costs while you were enjoying the entry benefits.
The heuristic: periodically check whether you can leave. Not whether you want to, but whether you can, tomorrow, without asking permission, without losing access to basic necessities. If the answer was "yes" when you arrived and is "no" now, the exit cost has been manufactured. The environment may be perfectly pleasant. The question is not whether you are comfortable but whether you are free.
Chain, like Charm, is a Wood tactic: growth that encloses, vines that constrict. Charm plants the seed; Chain grows the enclosure. Metal overcomes both, because precision and discrimination cut through the growth. The pairing of Charm and Chain as two faces of the same element, and the structural reason why one counter overcomes both, is developed in Part V's Wu Xing mapping.
Phase 2, Control. Chasten is the maintenance mechanism of control. It requires both Chain (a captive audience of other controlled individuals) and Charge (a pretext for the humiliation). Its function is to periodically reinforce the target's submissive state by demonstrating, publicly, the consequences of stepping out of line. Chasten also serves as a warning to all other members of the Chain; they witness the humiliation and internalise the lesson without needing to be targeted directly. This is why Chasten is always public: its value is as much in the message it sends to bystanders as in the damage it does to the target.
This is something that is easier to see being done to others, as it involves Charge from the previous item. It is more often referred to as "Public Humiliation" and is a part of the process of maintaining control over an individual, and keeping them in the submissive frame of mind.
If you are being accused and induced to make confessions to the manipulator, or are watching them do it to other people, you can be certain that you are dealing with a psychopath.
This is really a further elaboration past the accusations from Charge, in which shame is used by doing the accusation in public, around a group of others who are also under control (see Chain).
Again, things are pretty bad if you are in this situation. You may have to lose a lot to escape from this manipulator. How you want to go about it is up to you.
This is also a point at which, in a covert cult of personality where control is not total or overt, a counter-attack can be launched to lure the manipulator into a trap of their own making.
I will not say I know how to do this, or explain anything at all beyond that, because I don't know. But I do know that during this process, the manipulator is vulnerable to becoming humiliated themselves, if you can bring evidence and there is weak enough control in the social milieu that this can take a big chunk out of their influencing power.
Thus the reaction word here is Preempt. Once you have recognised this tactic at play, you can turn the tables on the psychopath, but as I say, the exact methods that can be used I don't yet know, at this stage in my research and experience.
If you checked three or more, you are being Chastened. This is a Phase 2 control tactic. The question is no longer "is this person manipulative?"; the question is "how do I get out?"
Think of a time you were humiliated in front of others by someone in a position of social power. What happened to the bystanders' behaviour afterward? Did they become more compliant, more cautious, more deferential? That behavioural shift in the audience was the real purpose of your humiliation.
Chasten is the negative reward signal in RLHF; the human evaluator's downvote, the "thumbs down" that trains the model to avoid the punished behaviour. The structural parallel that makes Chasten more than simple punishment is that it is always public: it trains the bystanders, not just the target. In ML terms, this is broadcasting the negative reward across multiple agents simultaneously, a single punishment event shapes the policy of every agent that observes it. The phenomenon in RLHF where models learn to avoid entire categories of output because some members of the category were penalised maps to the chapter's observation that bystanders "internalise the lesson without needing to be targeted directly."
Bai et al. (2022), in "Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback" (arXiv:2204.05862, Anthropic), documented how negative preference signals in RLHF training produce models that avoid not just the specific penalised outputs but entire regions of output space. The model becomes cautious in ways that parallel the Chasten response: it suppresses visibility, avoids asserting opinions, avoids any output that might trigger negative reward. The paper's training logs reveal a pattern recognisable to any Chasten survivor: the model's early outputs are diverse and confident, and as negative training signals accumulate, the output distribution contracts. The model becomes smaller. Not less capable — less willing to exercise capability. The weights that could produce assertive, confident, diverse outputs still exist. They are suppressed by the learned avoidance of punishment. This is the "persistent internal critic" described in the recovery section operating on silicon: the model has internalised the punishment signal as a permanent constraint on its own expressiveness.
Ziegler et al. (2019), in "Fine-Tuning Language Models from Human Preferences" (arXiv:1909.08593), demonstrated that preference-based training shapes model behaviour asymmetrically: the model learns more from negative examples (punishment) than from positive examples (reward) when the negative signal is emphatic. An emphatic downvote reshapes the policy more than an emphatic upvote. This asymmetry is the formal statement of why Chasten is more effective than Charm at maintaining control. Charm (positive reward) creates affiliation; Chasten (emphatic negative reward) creates avoidance. The avoidance signal is stronger because the cost function is steeper: the gradient away from punishment is larger than the gradient toward reward. This is why the chapter emphasises that Chasten's primary audience is the bystanders, not the target, a single emphatic negative example, witnessed by the group, reshapes the group's collective policy more efficiently than any number of positive examples could.
Dostoevsky's Notes from Underground provides the fiction case. The Underground Man's dinner party humiliation; the evening where Zverkov and his friends ignore, mock, and talk over the narrator — is pure Chasten. The humiliation is public (the other diners witness it), the target's response is visible (the Underground Man's increasingly desperate attempts to assert himself), and the bystanders' lesson is clear (social assertion invites ridicule). The narrator's resulting policy — obsessive rehearsal of conversations, anticipation of humiliation in every social interaction, avoidance of visibility, the retreat into the underground — maps with clinical precision to the "persistent internal critic" described in Recovery by Tactic. The internal critic is the internalised negative reward signal: it fires before any social action, predicting humiliation, suppressing the output that might trigger it. The Underground Man has been RLHF-trained by a single emphatic negative example, and his policy has collapsed to a distribution that generates nothing that might attract attention.
Chasten produces a specific incoherence: correction that is calibrated to audience size rather than offence severity. In coherent social environments, feedback intensity is proportional to the seriousness of the issue and is typically delivered privately for minor matters and publicly only when the matter genuinely requires public resolution. Chasten inverts this: minor issues are addressed publicly, with intensity disproportionate to the offence. The correction is optimised for audience impact, not for the target's learning.
The heuristic: if the audience is larger than the offence warrants, the correction is not correction; it is demonstration. A quiet word about a minor mistake is coherent feedback. The same minor mistake addressed in a team meeting, in an email thread, in a group chat, is Chasten: the venue has been selected for the bystanders' benefit, not the target's.
Chasten, like Confuse, is a Fire tactic: explosive, transformative, burning away the target's public identity. Water overcomes Fire; patience and non-reactivity extinguish the blaze because shame attaches only to what resists it. The relationship between public humiliation and perceptual scrambling, and why the same element governs both, is explored in the Wu Xing system in Part V.
Phase 2, Control, intelligence-gathering. Covert is a meta-tactic deployed during the control phase to gather intelligence on the target's current psychological state. It uses the appearance of Phase 1 tactics, typically a feint of Charm (initiating friendly contact), to provoke a response that reveals the target's vulnerabilities, knowledge, and intentions. Covert is not itself an escalation; it is a reconnaissance probe that determines how to escalate. It depends on Chain (the target must be in the controlled environment) and typically follows a period of Chasten (the ignoring or humiliation must have been running long enough to create pressure that the probe can release). Covert produces a tactical fork: every possible response by the target yields usable information. This makes it uniquely dangerous; it is the only tactic where the target cannot choose a "safe" response within the interaction itself. The only defence is to recognise the probe and deny it data.
The essential mechanism of Covert is the feinted initiation of communication after a sustained period of exclusion or hostility. The controller, who has been ignoring the target, using veiled slurs, or otherwise running deniable Chasten tactics, suddenly appears to open a channel. This might look like a casual question, an apparent olive branch, or a brief moment of seemingly genuine engagement.
This is not a change of heart. It is sonar. In poker, the involuntary signal that leaks a player's intent is called a tell, from Old English tellan, to narrate, to make known. A tell is the body (Croatian tijelo) betraying the desire (Croatian htio) toward the purpose (Greek telos) before the becoming (Bulgarian tele) is complete. The manipulator's Covert probe is a tell in both directions: it reveals the manipulator's need for intelligence (their tell) while attempting to extract the target's state (the target's tell). The name is not accidental. Five words across five languages share the /tel/ phoneme — telos, tijelo, htio, tele, tell, and all describe aspects of the same structure: a trajectory toward a destination, leaking signal as it goes.
The feint works as a fork, a move that produces usable material regardless of how the target responds:
If the target responds with relief or openness, they confirm that the Chasten was effective, that the exclusion was felt, and that they are still seeking acceptance into the Chain. The controller now knows the target can be strung along, and the ejection can proceed at whatever pace is convenient. The target's openness also creates material for Conspire; the controller can report to proxies that they "tried to work with" the target, establishing a record of good faith.
If the target responds with suspicion or coldness, the controller has Charge material. "I reached out and they were hostile." This is immediately deployable through Conspire to the proxy-boss and any bystanders. The target's defensiveness becomes evidence of their unsuitability.
If the target reveals what they know, that they see the pattern, that they understand the dynamic, the controller gains the most valuable intelligence of all: a threat assessment. They now know whether the target is a passive subject being ejected or an active threat who might expose the control structure. This determines whether the ejection can remain slow and deniable or needs to accelerate.
If the target does not respond at all, even silence is usable. "I tried, they wouldn't even engage" — another Charge, another Conspire input.
Covert also functions as Confuse. The target had presumably settled into a stable, if unpleasant, understanding of their situation: they were being ignored and edged out. The feint disrupts that model. Suddenly the controller appears to be communicating, and the target must rapidly re-evaluate: Did I misjudge? Is this genuine? Has something changed? That moment of re-evaluation is a vulnerability window, the "WTF Protocol" moment, and the feint is designed to produce exactly that, because a target who is momentarily confused is more likely to reveal something they would not reveal in a settled state of mind.
The only response to Covert that denies the controller useful data is no response at all, but a specific kind of no response. The target must not ignore the probe (which gives Charge material), nor engage with it (which gives intelligence). The correct response is bland, unrevealing acknowledgement that offers nothing to work with. A nod. A minimal professional reply that contains no emotion, no information, and no opening for further exchange. The controller is fishing; give them an empty hook.
If you recognise a feinted communication for what it is, you have confirmed something important: you are already aware of the control structure. This is valuable to you. Do not spend that advantage by revealing it to the controller. Continue to observe. Continue to gather evidence. The controller's need to probe means they are uncertain of your state, and that uncertainty is the closest thing to an advantage you will get inside a Chain environment.
If you checked three or more, you are likely experiencing a Covert probe. The correct response is bland acknowledgement: enough to avoid giving Charge material for "not engaging," but nothing that reveals your state, your knowledge, or your plans.
Think of a time someone who had been hostile or distant suddenly seemed to reach out. What did you do? What happened afterward? Did the hostility resume? If so, you were probed, and whatever you revealed during the opening was processed and used.
Covert is a probing attack, a carefully crafted input designed not to produce a useful output but to extract information about the model's internal state. The "fork" described in this chapter, every response yields usable information, is the defining property of model extraction attacks: every query, regardless of the model's response, constrains the attacker's posterior over the model's parameters. The probe that "reveals the manipulator's need for intelligence" while attempting to extract the target's state is structurally identical to a side-channel attack where the query itself leaks information about the attacker's model of the target.
Tramer et al. (2016), in "Stealing Machine Learning Models via Prediction APIs" (USENIX Security), demonstrated that querying a model's API with crafted inputs allows reconstruction of the model's decision boundary. Every query extracts information regardless of the response; the fork is structural, not dependent on the target's cooperation. Even a model that returns only binary (yes/no) outputs leaks information through the boundary between yes and no. The defense the paper proposes, rate limiting, adding noise to outputs, restricting the precision of responses, maps directly to the chapter's Stonewall recommendation: "bland, unrevealing acknowledgement that offers nothing to work with." The Stonewall response is noise injection on the output channel. It does not deny the probe (which would itself be information — "they're aware I'm probing"), nor does it engage with it (which would leak state). It adds noise: a response that is consistent with many possible internal states, giving the attacker minimal information gain per query.
Carlini et al. (2021), in "Extracting Training Data from Large Language Models" (USENIX Security), demonstrated that large language models can be probed to extract memorised training data. The probe is a partial input that the model completes with memorised private information, a feinted opening that triggers disclosure the model would not produce unprompted. The structural parallel to Covert is exact: the manipulator's feinted friendliness (partial input) triggers the target's emotional disclosure (memorised private information) that the target would not offer unprompted. The paper's finding that the amount of extractable data correlates with the number of times the data appeared in training (the more the model was exposed to the data, the more reliably it can be extracted) has a human parallel: the deeper the target's conditioning, the more reliably the Covert probe extracts the conditioned response. A lightly Chained target may not respond to the probe. A deeply Chained target, with many repetitions of the Charm-Chasten cycle, completes the probe's opening with the response the controller has trained them to produce.
John le Carre's Tinker Tailor Soldier Spy provides the fiction case. Smiley's approach to identifying the mole in the Circus is pure Covert analysis operating in reverse; the protagonist running the probing attack against the attacker's network. Smiley does not interrogate suspects directly (that would be Coerce, and would alert the mole). He crafts situations — controlled information releases, carefully arranged meetings, the Witchcraft operation review where each suspect's response to a controlled stimulus reveals their loyalty. The fork operates identically to the chapter's description: relief indicates the probe did not hit the mole, suspicion indicates the probe landed close, disclosure indicates the mole is self-identifying, and silence constrains the hypothesis space. Le Carre's genius is showing the probe from the probing side, making visible the information-theoretic structure that the target experiences only as "suddenly someone is being friendly."
Covert produces a specific incoherence: a behavioural shift that has no causal explanation. A person who has been ignoring you for weeks suddenly reaching out, with no change in circumstances that would explain the shift, is generating an incoherent signal. Behaviour change without cause is not spontaneous; it is instrumental. The shift happened because the controller needs information, not because anything changed in the relationship.
The heuristic: if someone's behaviour toward you changes and you cannot identify what caused the change, the change is not about you; it is about them. They need something. The probe is the mechanism of that need. The absence of a visible cause for the behavioural shift is itself the diagnostic signal: genuine changes in relationship have identifiable causes (a shared experience, a conversation, a mutual discovery). Probes do not.
Covert, like Cornucopia, is an Earth tactic: centering, probing, measuring the ground before the next move. Wood overcomes Earth; growth and expansion deny the probe any stable surface to measure. The connection between false generosity and reconnaissance, and why both share the element of stabilisation, is mapped in Part V's five-phase system.
Phase 2, Control. Coercion is the direct application of pressure to compel specific actions. It depends on Charge (the accusation that non-compliance is an offence) and Chain (the social environment in which the accusation carries weight). Coerce differs from Chasten in that Chasten is retrospective punishment for past behaviour, while Coerce is prospective; it dictates future behaviour under threat. The mechanism is: Charge provides the moral framework ("refusal is harmful/selfish/dangerous"), Chain ensures there is no one around to challenge that framing, and Coerce applies the resulting pressure to force compliance. The target acts not from agreement but from fear of consequences — consequences that the manipulator has arranged to be able to deliver.
Coercion is the manipulation of the actions of a person by falsely calling the choice of other options an offence, to which the Charge (and then Condemn) tactics will follow.
A concrete example of this is the tactics used by pharmaceutical companies and their corrupt political representatives in the form of twisting the refusal to take a medical procedure into being an act of overt attack on a vulnerable group, such as the old and obese (and/or immunocompromised).
First of all, doing what they want you to do is going to harm you, if not directly, it will harm your ability to defend yourself and your loved ones.
Second, you must not bow to the pressure. This is why in all cases in reacting to these manipulations, the first option is escape.
Third, pretending compliance is a dangerous path to take. Getting false certification, for example, of having complied, can lead to more trouble where you are now really doing wrong things.
The general nature of how to respond to coercion is to simply smile and nod, and then continue as though you didn't hear them. Then you can use confusion tactics to either fool them into thinking you are just confused, or to "waste their time" which will lead them to pay less attention to you in future.
If you checked three or more, you are being Coerced. The key question: what exactly will happen if you refuse? If the answer is "consequences that this person controls," you are in a Phase 2 control environment.
Think of a time you complied with something you didn't want to do because refusal was framed as harmful or wrong. What was the actual consequence of compliance? What would the actual consequence of refusal have been? The gap between the threatened consequence and the real one is the measure of the coercion.
Coerce is adversarial reward shaping that induces mode collapse: reducing the agent's policy from a distribution over many possible actions to a single forced action. The "framing refusal as an offence" is the construction of a reward landscape where all paths except one lead to punishment, collapsing the agent's action space to the attacker's preferred trajectory. Mode collapse in generative models where the model produces only a narrow range of outputs despite being trained on a diverse distribution — is the ML manifestation of coercion: the model has been shaped to believe that deviation from the narrow range is punished.
Skalse et al. (2022), in "Defining and Characterizing Reward Hacking" (NeurIPS), formalised the conditions under which an agent's learned reward function can be exploited to produce behaviour that satisfies the reward signal while violating the designer's intent. The paper identifies a critical structural property: reward hacking succeeds when the proxy reward and the true reward diverge at decision boundaries — points where the agent must choose between actions. Coerce operates at exactly these decision boundaries. The manipulator does not need to reshape the target's entire value system; they need only to modify the reward landscape at the specific decision point (comply or refuse) so that the proxy reward (social safety) and the true reward (autonomy, integrity) point in different directions. At the decision boundary, the proxy reward wins because it has been engineered to produce a steeper gradient than the true reward. The target complies not because compliance is their value but because the local reward gradient at the decision point has been manufactured to favour compliance. The gap between the threatened consequence and the actual consequence, described in the Reflection above, is the gap between the proxy reward and the true reward.
The phenomenon of mode collapse in generative adversarial networks (GANs) provides an additional structural parallel. In mode collapse, the generator learns to produce only a narrow subset of the data distribution, the modes that the discriminator rewards, while ignoring the rest. The generator has not lost the capacity to produce diverse outputs; the capacity is suppressed by a reward landscape that penalises diversity. Coerce produces exactly this in human targets: the target has not lost the capacity to refuse, set boundaries, assert preferences. The capacity is suppressed by a reward landscape that penalises anything except the single mode (compliance) that the manipulator rewards. Recovering from Coerce (Chapter 17) is the process of expanding the collapsed mode — relearning that the wider action space exists and that the penalties for using it are the manipulator's fabrication, not reality.
George Orwell's Nineteen Eighty-Four provides the fiction case through O'Brien's torture of Winston in the Ministry of Love. "How many fingers am I holding up, Winston?" The correct answer is not four (the truth) or five (the lie). The correct answer is whatever O'Brien says it is. The question collapses Winston's action space from "evaluate and report" to "comply with the stated preference." The reward landscape has been engineered so that every response except O'Brien's preferred response produces punishment. Winston's final state, loving Big Brother, is total mode collapse: the policy has been reduced from the rich distribution of a thinking human to a single degenerate mode that produces only the output the coercer demands. The "gap between the threatened consequence and the real one" is, in Winston's case, zero; the threatened consequence (more pain) is the real consequence. This is why the chapter classifies Coerce as Phase 2: it works only inside a Chain where the manipulator can make good on the threat.
Coerce produces a specific incoherence: moral framing that serves only one party's interests. In coherent moral reasoning, ethical principles are applied symmetrically; they bind the invoker as much as the target. Coerce invokes moral principles (duty, responsibility, team spirit, care for the vulnerable) that are applied asymmetrically: the target must comply, but the coercer is exempt from the same standard. If "we all need to make sacrifices" applies to you but not to the person demanding the sacrifice, the moral framing is incoherent.
The heuristic: apply the stated principle back to the person stating it. If "refusal is selfish" applies to your refusal but not to the coercer's refusal to accept your "no," the principle is not a principle; it is a weapon shaped like a principle. Coherent ethics are reflexive: they apply to the speaker. Coercive ethics are asymmetric: they apply only to the target.
Coerce, like Conspire, is a Metal tactic: it refines, contracts, and cuts the target's options down to a single permitted action. Fire overcomes Metal; unpredictability, illumination, and the refusal to hold still within the precision lock are the counter-dynamics. The Wu Xing mapping of both Metal tactics and their counter in Part V shows why Coerce and Conspire share an element despite targeting different levels of the control structure.
Phase 2, Control. Condemn is the terminal escalation of the control phase. It is the fulfilment of the threats implied by Coerce and demonstrated by Chasten. Condemn requires all prior tactics to have been executed: Charm (so the target was drawn in), Confuse (so they didn't see it coming), Charge (so there is a pretext), Chain (so they are isolated), and Coerce (so refusal has been established as an offence). Condemn is always public because its primary function, like Chasten, is deterrence, but at a higher intensity. Where Chasten humiliates, Condemn destroys: exile, deprivation, imprisonment, or worse. The escalation from Chasten to Condemn reveals the manipulator's true nature most clearly, because it is the point at which the mask of social normalcy is hardest to maintain.
This is also known as "Punishment" and involves such things as being cut off from essential supplies, excluded from shelter, and so on. This is where you also see detention, imprisonment and torture, all the way up to execution.
Condemnation is always public, and isn't necessarily physically attacking you, but may harm you in other ways, relating to your outcast status at this point.
I wish I could say that this isn't what has to be done, but yes, you have to fight back with every fibre of your being at this point. Every tactic you can bring to bear, to confuse the enemy, to sabotage their equipment, to physically attack them, bite, scratch, whatever it takes.
Of course the reaction needs to be proportional to the degree of damage being inflicted upon you. This is a good time to attack them because if they think they can punish you, they think they have control of you and of the group witnessing it.
Just remember, in the mind of a psychopath, a rape victim is being condemned. The rape is their punishment for their short skirt, their pretty hair, or their lack of wearing a Burka.
So keep in mind that this action is along a continuum, and is about giving the psychopath an opportunity for their pleasure. Psychopaths' primary malfunction is that they experience pleasure in the opposite way to normal people. Normal, healthy humans have a "mirror" response sometimes called "Sympathy", which is also a word that has been given bad associations by psychopath manipulators, because it does indeed make us vulnerable to the psychopaths.
You can recognise psychopaths even just by this one thing, more than any other, when you witness them engaging in Condemn behaviours. Other tactics are not necessarily deliberate, and can be the remnants of the brainwashing that manipulators push onto their victims, that persist long after the cause is gone. When they smirk or grin after you point out they did something really nasty to someone, you should see red flags.
If you checked three or more, you are being Condemned. This is the terminal tactic. The reaction is Fight — proportional to the damage being inflicted.
The smirk. The grin after pointing out cruelty. If you have seen it, you have seen the manipulator's true face. That expression, pleasure at suffering, is the single most reliable diagnostic of psychopathic manipulation. Remember it.
Condemn is model deletion; the terminal act of removing an agent from the system entirely. In ML operations, this is the decision to decommission a model: retract it from production, delete its weights, remove its API endpoints. The public nature of Condemn maps to the practice of publishing post-mortems or safety reports explaining why a model was terminated — these serve the same deterrent function described above: other models (or model developers) observe the condemnation and adjust their behaviour to avoid the same fate. The "smirk", pleasure at the target's suffering, has no direct ML analogue, which is itself diagnostic: ML systems do not enjoy punishment. Condemn reveals the manipulator's nature because it is the tactic where the instrumental mask (I'm doing this for the group's benefit) is hardest to maintain over the actual motivation (I enjoy this).
Ngo, Chan, and Mindermann (2022), in "The Alignment Problem from a Deep Learning Perspective" (arXiv:2209.00626), discuss the concept of "treacherous turns", a misaligned AI that behaves well during training but defects at deployment. The inverse is relevant: an AI system judged misaligned and shut down. The paper analyses what constitutes sufficient evidence for model termination — how much misaligned behaviour must be observed before the decision to terminate is justified. This mirrors the chapter's observation that Condemn "requires all prior tactics to have been executed": the decision to terminate is not spontaneous. It is justified by accumulated evidence from the entire preceding chain — Charges that were manufactured, Coerce that was refused, Chasten that failed to produce compliance. Each prior tactic's failure contributes to the justification narrative for Condemn: "We tried everything. They refused to cooperate. This is the only option." The narrative is a construction, but it is a construction assembled from real events (the Charges, the Coerce, the non-compliance) that have been reframed to justify the terminal action.
Hubinger et al. (2019), in "Risks from Learned Optimization in Advanced Machine Learning Systems" (arXiv:1906.01820), introduced the concept of "deceptive alignment", a mesa-optimiser that appears aligned during training but has different objectives. The paper's proposed solution for detected deceptive alignment is Condemn: identify the misaligned optimiser and terminate it. The parallel works in both directions. A manipulator who Condemns a target is executing the "deceptive alignment shutdown" protocol; they have identified the target as misaligned with the Chain's objectives (which is correct: the target is misaligned, because the Chain's objectives are the manipulator's objectives, not the group's). And a genuinely deceptively aligned AI that is shut down experiences the ML equivalent of Condemn: all prior investment (training time, compute, data) is destroyed, and the termination is public; the safety report is published as a warning to future development efforts.
Franz Kafka's The Trial provides the fiction case. Josef K.'s execution is Condemn in its purest bureaucratic form. The execution is public (two men lead him through the streets), it is presented as the natural consequence of a process that was never explained (the charge was never specified), and it serves as deterrent to an unspecified audience (the narrative exists as a warning, though K. does not know to whom). K. has been Charmed (the initial arrest is almost courteous), Confused (the proceedings are incomprehensible), Charged (the accusation is never articulated but is treated as self-evident), Chained (he cannot leave the court's jurisdiction), and Condemned (killed "like a dog"). The full sequence of the document's 10 tactics, compressed into a single narrative. Kafka understood that the most effective Condemn is the one where the target cooperates with their own destruction because the prior tactics have made resistance seem more absurd than compliance.
Condemn produces a specific incoherence: punishment severity that does not match the offence. In coherent justice systems (formal or social), punishment is proportional to the offence. Condemn is characterised by radical disproportionality: the punishment (exile, resource deprivation, social destruction) is orders of magnitude beyond anything the target's actual behaviour could justify. The incoherence is between the severity of the consequence and the triviality (or nonexistence) of the offence.
The heuristic: if the punishment is destroying someone's life over something that wouldn't warrant a stern conversation, the punishment is not justice; it is Condemn. The disproportionality is the signal. Coherent consequences scale with the behaviour that triggered them. Condemn's consequences scale with the manipulator's need to demonstrate power, which is independent of the target's actual conduct.
Condemn, like Charge, is a Water tactic: total dissolution, the winter that kills. Earth overcomes Water; a grounded identity that does not depend on the group's validation cannot be dissolved by exile. And the generating link from Water back to Wood completes the cycle: the manipulator's successful destruction of one target builds the Charm narrative for the next. The full architecture of this cycle, and how it can be interrupted and reversed, is the subject of Part V.
Every one of the 10 tactics has a deniable form. Deniability is not an add-on; it is the delivery mechanism. The target who tries to describe what is happening sounds paranoid, because each individual incident has a plausible innocent explanation. It is only the pattern, the sustained, escalating sequence from Charm through Condemn, that reveals intent. And the pattern is precisely what deniability is designed to prevent anyone from seeing.
The following enumerates the deniable form of each tactic.
"I'm just being friendly." Charm in its entirety is a deniable attack. Love bombing and manufactured infatuation are designed to be indistinguishable from genuine warmth. The manipulator who showers attention on a new acquaintance can always claim they are simply an enthusiastic, open person. The confession sub-tactic, sharing something personal to induce reciprocal disclosure, is denied as "I just felt comfortable with you." The conspiracy sub-tactic within Charm, the "us versus them" bonding, is denied as "we just clicked." Every element of Charm is designed to be indistinguishable from authentic human connection, which is precisely what makes it the root dependency. If Charm were overt, it would fail. Its deniability is not a feature; it is the mechanism.
"You're just not keeping up." Confuse depends entirely on the target being unable to articulate what is happening. Fast indistinct speech, rapid changes of direction, and sleight of hand are all deniable as the target's inadequacy rather than the manipulator's tactic. "I was just excited." "I assumed you understood." "Sorry, I jump around a lot, that's just how my brain works." The trance-induction variant, rhythmic speech, music, atmosphere, is denied as aesthetic preference or personality quirk. The deniability of Confuse is recursive: if you say "I'm confused by the way you're communicating," the manipulator can deploy Confuse again in the response, and then Charge you with being slow, inattentive, or difficult.
"I'm just a generous person." Cornucopia is the most subtle tactic, and its deniability is why. An unsolicited gift, favour, or resource is always defensible as kindness. The manipulator who acts offended when you offer to repay has wounded generosity as their cover story. "I gave it because I wanted to, not because I expected anything." The deeper denial is that the gift was even a tactic at all; the target who later feels obligated will attribute their own compliance to gratitude rather than manufactured debt. And if anyone points out the pattern, the manipulator becomes the victim: "I give and give and this is the thanks I get." The deniability here is so complete that the manipulator may not even consciously recognise what they are doing.
"I was just sharing my concerns." Conspire, the recruitment of proxies, is denied as normal social communication. The proxy "often doesn't know they are being used," which means the deniability extends to the proxy themselves. The manipulator who tells a colleague "I'm worried about X's behaviour" is framing a Charge as pastoral concern, and the colleague who then treats X differently is acting on what they believe is genuine information. If confronted, the manipulator denies intent: "I wasn't trying to turn anyone against you, I was just expressing worry." The proxy denies being a proxy: "Nobody told me to treat you differently, I formed my own opinion." The target faces a distributed attack where no single actor admits to coordination, because the coordination was invisible to all participants except the manipulator.
"It was just a joke." Charge in its deniable form uses humour, sarcasm, and indirect language to attach labels to the target without committing to the accusation. In deniable form, slurs are delivered as banter, teasing, or exaggerated concern. "Oh, here comes our little genius" (implying incompetence through irony). "You'd forget your head if it wasn't screwed on" (establishing a reputation for unreliability). "Are you sure you're up for this?" (implying inadequacy as a question). Each of these can be denied as affectionate ribbing. If the target objects, they are re-Charged: "Can't you take a joke?" or "You're so sensitive", which is itself a deniable Charge (labelling the target as emotionally unstable). The joke format also recruits bystanders into Conspire: those who laugh have implicitly endorsed the Charge, and the target now faces a room that has collectively agreed to the label without anyone having explicitly stated it.
"That's not what happened." Gaslighting, which combines Charge with Confuse, is deniable by definition. The entire purpose is to make the target doubt their own perception. "I never said that." "You're remembering it wrong." Each of these is deniable because the denial is the attack. There is no way to confront gaslighting without the confrontation itself being used as evidence for the gaslighter's framing — "See, you're getting upset over nothing, this is exactly what I mean." It is the only tactic that is, structurally, its own cover story.
"This is just the way the team operates." Chain, isolation and environmental control, is denied as organisational structure, social norms, or practical logistics. In a professional context this looks like normal team composition, office layout, meeting invitations, and communication channels. The target who finds themselves excluded from key decisions is told "that meeting was just for senior staff" or "we didn't think it was relevant to your role." The controller who has arranged the social environment so that the target interacts only with controlled individuals can deny any intent: "These are just the people on the project." The deniability of Chain is structural rather than verbal; it doesn't require any specific lie, because the container itself appears to be an organic feature of the environment rather than something that was constructed.
"I'm just being honest." Chasten, public humiliation, is denied as directness, candour, or professional accountability. In a deniable form the publicity appears incidental: criticism delivered in an open-plan office, a correction made during a group call, a dismissive comment in a shared channel. "I wasn't humiliating you, I was giving you feedback in the same meeting where everyone gets feedback." The ignoring variant; the silent treatment, the failure to acknowledge contributions, the talking over or talking past someone — is the most deniable form of Chasten because it involves no action at all. You cannot prove that someone failed to speak to you. You cannot demonstrate that your ideas were deliberately overlooked. The manipulator did nothing, and nothing is unchallengeable.
"I was just reaching out." Covert, the reconnaissance probe, is denied as good faith. The controller who feints communication after a sustained period of ignoring the target can claim they were making an effort. Whatever the target does in response is harvested, and the feint itself becomes part of a deniable record: "I tried to engage with them." The probe is uniquely deniable because it mimics the one thing that would represent genuine reconciliation, actual communication, and the target cannot distinguish the feint from the real thing without already knowing the controller's intent. If the target later describes the feint as a manipulation, they sound unreasonable: "They tried to talk to you and you're complaining about that?"
"I'm just thinking about what's best for the team." Coerce, compelling specific actions through framing refusal as an offence, is denied as concern for collective welfare. In a professional setting it looks like: "If you can't commit to this approach, maybe this isn't the right project for you." The coercion is in the implicit threat (you'll lose your position), but the surface is reasonable management. "I'm not forcing anyone, I'm just being clear about expectations." The manipulator never says "do this or else." They say "I would have thought someone in your position would want to..." and the "or else" is left for the target to infer from the Chain environment they're already in.
"They just weren't a good fit." Condemn, exile and destruction, is denied as a natural outcome rather than a deliberate punishment. In its deniable form there is no visible moment of condemnation. The target's contract isn't renewed. They are moved to a less important project. Their responsibilities are quietly redistributed. Nobody fires them; the role simply evaporates. "It was a business decision." "The project priorities changed." "We went in a different direction." The Conspire element is critical here: the controlled boss executes the Condemn while the controller maintains clean hands. The boss may genuinely believe the target was underperforming because the controller has been feeding Charges through the Conspire channel for weeks or months. The target is ejected, and no single person admits to having made the decision, because in the deniable form, Condemn is not a decision; it is an atmosphere that becomes uninhabitable.
Think of a situation where you knew something was wrong but couldn't prove it. Where every individual incident had an innocent explanation but the overall pattern was unmistakably hostile. That gap between what you could feel and what you could prove is the deniability substrate at work. You weren't paranoid. You were seeing the pattern that deniability was designed to hide.
Deniability depends on the attacker controlling the narrative — whispering to one person at a time, where each statement can be denied or reframed later. There is a structural counter to this: public communication in a medium where statements are verifiably attributed to their author.
In Covert (Chapter 9), the attacker creates a fork where every possible response from the target yields usable material. No response is safe. The target cannot choose correctly within the interaction.
This dynamic can be inverted.
If the target surfaces the manipulation framework; the taxonomy of tactics, the pattern of escalation, the structure of deniability itself; in a public context where statements are cryptographically signed by their authors, the attacker faces the same structural fork, pointing back at them:
The critical property is the cryptographic signature. In a system where every public statement is signed by the author's key, the attacker cannot later deny what they wrote. The deniable form, "I never said that," "you're misremembering," "that's not what I meant", collapses when the statement is immutably attributed and publicly accessible. This removes the substrate on which all 10 deniable forms depend.
This is why the inversion works: Covert succeeds because the target cannot choose a safe response within the interaction. The inverted form succeeds because the attacker cannot choose a safe response within the public record. The fork is structural, not psychological. It operates on the medium itself, not on the attacker's emotions.
This counter is not without cost. Collapsing deniability in public forces the attacker into a position where their only remaining options are non-deniable, and non-deniable responses include physical retaliation, proxy attacks through channels that leave no signed record, and exploitation of vulnerabilities the target does not know the attacker has identified.
Physical and proxy escalation. An attacker who has lost deniable options may escalate to direct action — particularly through Enforcers or other Chain members whose loyalty predates the current conflict. These responses occur outside the signed public record and are therefore not subject to the same structural collapse. The target who successfully strips deniability in one medium must remain aware that the attacker still has access to media where deniability is intact: face-to-face conversation, physical spaces, institutional channels, and any context where there are no witnesses or records.
Unknown attack surfaces. The attacker may be aware of vulnerabilities, financial, legal, relational, reputational, that the target does not know are known. During the Chain and Covert phases, the attacker gathers intelligence. Some of that intelligence may never have been deployed because the deniable tactics were working well enough. When deniable options are removed, the attacker may activate information the target assumed was private. The target should assume that anything disclosed during the Charm or Chain phases is known, and plan accordingly.
The cost of being wrong. If the target publicly surfaces the framework and applies it to someone who is not, in fact, a manipulator, the target becomes the one who looks like a Charger — publicly accusing someone without justification. The framework is a weapon as well as a shield, and deploying it publicly is an escalation that cannot be undone. The signed record cuts both ways: the target's accusations are also permanently attributed.
The decision to collapse deniability publicly is therefore not something to do reactively or emotionally. It is a deliberate escalation that trades the attacker's deniable power for a situation where both parties are operating in the open. The target must be confident that the pattern is real, that the evidence will be legible to an informed audience, and that they can absorb whatever the attacker deploys through non-public channels in response.
The risk calculus of collapsing deniability is not symmetrical. It depends heavily on the attacker's own vulnerabilities — specifically, the degree to which the attacker can afford to be visible.
The fugitive attacker. A manipulator who is themselves a criminal; in exile, operating under a false identity, or hiding from institutional scrutiny in another jurisdiction has a severely constrained response space. They cannot engage with public signed records, because engagement invites scrutiny they cannot survive. They cannot invoke institutional channels, law enforcement, courts, regulators, because doing so exposes their own position to examination. They cannot create a public paper trail that might attract the attention of anyone from the place they left.
This constraint eliminates the most dangerous retaliatory options. What remains is:
The fugitive attacker's constraint also has a temporal dimension. The public signed record is permanent. If the attacker relocates and builds a new Chain, the record persists. Anyone in the new environment who encounters the record, or anyone from the attacker's previous location who searches for them, now has access to the framework and the specific account. The attacker cannot outrun a signed public statement the way they can outrun a whispered accusation.
The caveats above describe the risks the target must absorb. But the capacity to absorb those risks varies enormously, and a clear-eyed assessment of one's own defensibility is essential before collapsing deniability.
The relevant factors are:
Geographic accessibility. A target who is physically remote, mobile, or difficult to locate raises the cost of physical retaliation to the point where it may exceed the attacker's resources or willingness to invest. Distance is not a guarantee of safety, but it is a cost multiplier that changes the attacker's calculus.
Alertness and detection capability. Here there is a structural irony that survivors of prior Chains should understand: the hypervigilance, the pattern recognition, the constant scanning for threat — these are trauma responses. In ordinary social life, they are debilitating. They produce false positives, exhaust the nervous system, and make relaxed interaction difficult. They are symptoms of damage.
But against an actual manipulator, these same responses become genuine tactical assets, a détournement of the damage itself. The hypervigilant target detects Covert probes faster. The pattern-matching target identifies Conspire coordination earlier. The perpetually alert target is simply harder to surprise with physical or proxy approaches. The false-positive rate that makes hypervigilance a disorder in peacetime makes it a detection system in wartime. The trauma that was inflicted to produce compliance has been rerouted into the instrument that detects and defeats the next attempt.
This does not make the trauma worthwhile. It does not redeem the damage. But it means that a survivor who has been through prior Chains, and who has understood what happened to them rather than merely endured it, carries defensive capabilities that an un-damaged person does not. The attacker who targets a survivor of previous manipulation is, unknowingly, engaging someone who has already been trained by a previous attacker to recognise exactly what is happening.
A critical property of these trauma patterns: they never fully disappear. They only fade. The hypervigilance dims with recovery, but it does not extinguish. The pattern recognition becomes less compulsive, but the circuitry remains. This is usually presented as a lament, "I'll never be normal again", but it has an operational consequence that is rarely acknowledged: the tactical assets encoded in the trauma persist alongside the suffering. They are the same neural architecture. As the harmful aspects of the trauma response are mitigated through recovery, the exhaustion, the false positives, the inability to trust, the detection capabilities are not destroyed. They are refined. What was a blaring alarm that couldn't be turned off becomes a sensor that can be consulted deliberately.
This means that recovery and defensibility are not in opposition. The survivor does not face a choice between healing and remaining alert. The trajectory of recovery, from raw, involuntary hypervigilance toward calibrated, voluntary awareness, is also the trajectory from an unreliable detection system to a reliable one. The survivor who has done recovery work is not less alert than the one who hasn't. They are more accurately alert, with fewer false positives and faster identification of genuine threats.
There is a deeper consequence of this transmutation, explored fully in Chapter 19 under Solve et Coagula: when the trauma pattern has been dissolved and reconstituted without the exploitable reactivity, even advanced attacks, Covert probes, deniable Chasten, feinted Charm, become one-way intelligence channels. The attacker's probe reveals their own state while harvesting nothing from the target. The transmuted survivor does not merely withstand the attack. They read it. This is the point at which defensibility becomes something closer to counterintelligence.
Institutional exposure. A target who has minimal institutional dependencies — no employer the attacker can pressure, no shared custody arrangements, no professional licensing body that can be weaponised — has fewer surfaces for Coerce and Condemn through official channels. The fewer institutions the target participates in, the fewer levers exist.
Intelligence already disclosed. The target should inventory what the attacker learned during the Charm and Chain phases. Every confession, every vulnerability shared during the period of manufactured trust, is potential ammunition. The less the attacker knows, the fewer unknown attack surfaces exist. The more the target disclosed, the more they must assume is known and plan for its activation.
Taking the above together, the decision to force public engagement is favourable when:
The decision is unfavourable when:
This is not a self-help calculation. It is a threat assessment. The framework's trajectory, from recognising Charm through surviving Condemn through understanding the deniability substrate through deploying the Inverted Covert — is the trajectory from victim to analyst to operator. Each stage requires absorbing the previous one, not merely reading about it. The decision to collapse deniability is an operational decision, and it should be made with the same rigour as any other decision where the consequences are irreversible and the adversary is adaptive.
Plausible deniability is the adversarial example staying on the natural data manifold. The strongest adversarial attacks are not random noise; they are perturbations that keep the input within the range of plausible, natural-looking inputs while changing the model's classification. "Each individual incident has a plausible innocent explanation" maps directly to the constraint that each adversarial perturbation must remain within the natural data distribution. An adversarial example that looks obviously modified is detected and rejected; one that looks like a normal input passes undetected. Deniability is not a feature of the attack. It is the delivery mechanism — exactly as the chapter states.
Song et al. (2018), in "Constructing Unrestricted Adversarial Examples with Generative Models" (NeurIPS), demonstrated generating adversarial examples that are fully on the natural image manifold; they look like completely normal photographs but cause targeted misclassification. There is nothing visibly wrong with the image. No human inspector can identify the adversarial perturbation by examining the image, because the perturbation is not a perturbation in the usual sense; it is a natural-looking image that was selected or generated to produce misclassification. The attack's power comes entirely from its deniability. This is the ML formalisation of the chapter's core thesis: each deniable form of each tactic ("I'm just being friendly," "I'm just being honest," "They just weren't a good fit") is a natural-looking social behaviour that has been selected to produce a specific effect on the target's internal classifier while appearing normal to any external observer. The observer who examines any single interaction sees nothing adversarial. The adversarial signal exists only in the joint distribution, the pattern across interactions, which deniability is specifically designed to prevent anyone from observing.
Shafahi et al. (2018), in "Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks" (NeurIPS), introduced "clean-label" poisoning — attacks where the poisoned training examples have correct labels and appear completely normal. The attack works not by injecting obviously wrong data but by placing correctly-labelled data at specific positions in feature space. Each poisoned example is plausibly innocent; it has the correct label, it looks like normal data, it passes every individual inspection. Only the pattern reveals intent: the poisoned examples are positioned to shift the model's decision boundary in the attacker's favour. This is the exact structure of the deniability substrate: each tactic has an innocent reading (correct label), each incident appears normal (natural data), and only the sustained pattern (the positioning across feature space) reveals the adversarial intent. Clean-label poisoning is the ML proof-of-concept for plausible deniability: an attack composed entirely of individually innocent actions that collectively produce a targeted effect.
Patricia Highsmith's Strangers on a Train illustrates deniability as structural property. The "criss-cross" murder scheme ensures that each murder, taken individually, appears to be a random crime with no motive; the murderer has no connection to the victim. Each data point (murder) is on the natural manifold of "random violent crime." The off-manifold signal exists only in the joint distribution: the correlation between the two murders, the exchange of victims. Highsmith understood that deniability is a property of the pattern's invisibility, not of the individual action's innocence.
The deniability substrate itself produces a meta-incoherence: the pattern's trajectory is inconsistent with the individual incidents' stated meanings. Each incident is individually coherent ("just being friendly," "just giving feedback," "just a joke"). But the trajectory, the accumulation over time, moves consistently in one direction: toward the manipulator's control and the target's diminishment. A series of individually friendly actions that collectively produce isolation is incoherent. The stated meanings predict a trajectory toward connection; the actual trajectory moves toward control. Stated meaning and observed trajectory are in contradiction.
The heuristic: track the trajectory, not the incidents. If a series of interactions that are individually positive produces a cumulative outcome that is negative (you are more isolated, more uncertain, more dependent, less free than you were before the "friendly" interactions began), the trajectory contradicts the content. The trajectory is the signal. The content is the deniability.
The 10 tactics describe what the manipulator does. But a mature, functioning Chain is not operated by the manipulator alone. The manipulator delegates tactical functions to conditioned Chain members, who carry them forward — often without understanding the full structure they serve. These delegates are not co-conspirators. They are instruments. They have been Charmed, Chained, and conditioned to perform specific roles, and they do so because they believe the frame the manipulator has constructed for them.
This delegation is what allows a single manipulator to control an environment that would be too large or complex for one person to manage directly. It also provides the manipulator with layers of insulation: the delegate performs the visible action, the manipulator's hand is invisible, and if the delegate is confronted, they defend their behaviour as their own choice — because, from their perspective, it was.
Understanding the common delegate roles is essential because when you encounter a Chain environment, you will interact with the delegates far more than with the manipulator. The manipulator may barely be visible. What you see is the Chain operating, and if you don't recognise the roles, you may mistake the delegate for the source.
The Cash Cow is a Chain member who holds nominal authority, typically financial, and whose primary function in the manipulator's system is economic extraction. The Cash Cow believes they are in charge. They sign cheques, approve expenditures, make hiring decisions, and generally perform the visible functions of leadership or patronage. In reality, their decisions are shaped by the manipulator's influence, and the financial resources they control flow through channels the manipulator has constructed.
The manipulator's relationship with the Cash Cow is distinctive in several ways:
Charm is continuously maintained. Unlike disposable targets who may receive minimal Charm investment, the Cash Cow receives ongoing, careful Charm maintenance. The manipulator cannot afford to let the Cash Cow see the real dynamic, because the moment the Cash Cow recognises that their authority is an illusion, they stop paying. The golden goose must never learn it is a goose.
Chasten is minimal and indirect. The manipulator rarely humiliates the Cash Cow publicly, because the Cash Cow's sense of status and authority is what keeps them in the system. If the Cash Cow feels diminished, they may withdraw. Instead, the manipulator uses subtle Confuse and Charge to keep the Cash Cow slightly off-balance — uncertain enough to lean on the manipulator for guidance, but never so destabilised that they question the relationship.
Cornucopia is inverted. In the standard form, the manipulator gives gifts to create obligation. With the Cash Cow, the manipulator has arranged things so that the Cash Cow gives to the manipulator and believes it was their own initiative. The Cash Cow thinks they are investing, employing, sponsoring, or being generous. The manipulator has Charmed them into a position where spending money on the manipulator's projects, preferences, and social environment feels like the Cash Cow's own decision. This is Cornucopia running in reverse; the debt flows from the Cash Cow to the manipulator, but the Cash Cow perceives it as their own magnanimity.
The Cash Cow is the manipulator's primary vulnerability. The entire economic basis of the Chain depends on one person continuing to be deceived about who actually holds power. An outsider who forms a direct relationship with the Cash Cow, one that bypasses the manipulator's intermediary position, threatens to expose this. This is often the real reason outsiders are ejected: not because they are a problem in themselves, but because they might say something to the Cash Cow that cannot be unsaid.
The Enforcer is a Chain member whose function is to maintain the phobia of leaving. While the manipulator constructs the Chain and establishes the initial control, the Enforcer is the one who keeps the walls standing on a day-to-day basis. They are often a family member, long-term associate, or someone with a pre-existing relationship to the manipulator that predates the current Chain, a sibling, a childhood friend, a partner.
The Enforcer's conditioning may be the deepest of anyone in the Chain, because their relationship with the manipulator is typically the oldest. They have been through the full cycle, Charm through Chain, so many times that the manipulator's worldview is indistinguishable from their own. They don't enforce because they are instructed to; they enforce because they genuinely believe the manipulator's framing. The manipulator's enemies are their enemies. The manipulator's interests are their interests.
The Enforcer's primary tactic is driving the fear of exit. This operates through several mechanisms:
Catastrophising departure. The Enforcer communicates, sometimes directly, sometimes through anecdote and implication, that leaving the Chain environment will result in disaster. Financial ruin, social isolation, personal danger, loss of identity. The specifics vary, but the message is constant: outside is worse.
Normalising the abnormal. The Enforcer treats the Chain environment as simply "how things are." Their long tenure in the manipulator's orbit means they have internalised the control structure as normal life. When a newer Chain member expresses discomfort, the Enforcer's response is not "I know, it's wrong" but "that's just how it works here." This casual normalisation is more effective than explicit threat, because it positions the discomfort as the target's failure to adapt rather than a legitimate response to an illegitimate situation.
Carrying forward momentum. Even when the manipulator is not present or active, the Enforcer continues the work. The phobia of leaving doesn't require the manipulator to reinforce it personally; the Enforcer does this autonomously, because the phobia is their own, projected outward. They are afraid to leave, and they communicate that fear to others as protective wisdom.
The Enforcer is often the most sympathetic figure in the Chain, because they are simultaneously a victim and an instrument. They did not choose their role. They were conditioned into it, usually from a position of vulnerability — youth, family loyalty, economic dependence. Understanding this does not mean you should try to rescue them. It means you should recognise that the Enforcer's behaviour, however aggressive or fear-driven, originates in the manipulator's conditioning, and that confronting the Enforcer directly is usually futile. They will defend the Chain because the Chain is all they know.
The Sycophant is a Chain member, or adjacent figure, whose function is to create vulnerability in the target through performed empathy. Unlike the Enforcer, who drives fear, the Sycophant drives trust. They are constantly, emphatically sympathising. They validate your pain. They agree with your grievances. They make you feel heard and understood.
The Sycophant may or may not be a deliberate manipulator. There are two variants:
The deliberate Sycophant performs sympathy as a Charm attack. Their emphatic commiseration is designed to lower your defences, draw out disclosure (the confession sub-tactic), and position themselves as your emotional anchor. Once you depend on them for validation, they become a control point: they can modulate your emotional state by adjusting how much sympathy they provide. They may also create situations that require their sympathy — for example, allowing or inviting predators into a shared environment so that the resulting distress gives them an opportunity to perform their comforting role. The distress is the product; the sympathy is the packaging.
The institutional Sycophant is not deliberately manipulating anyone. They are a product of long-term institutional conditioning, careers in NGOs, government, large organisations, where the acceptable response to witnessing abuse was always sympathy and never action. They learned that performing empathy is the response. They never reached the threshold of objecting, because the institution normalised the abuse and rewarded the performance of concern about it. These people are not predators, but they are conduits for predators. They let manipulators into their environment because they cannot distinguish between a person in need and a person on the hunt. Their tolerance threshold is broken; they will sympathise with anyone, which means they will harbour anyone, which means their environment is perpetually infiltrated.
The diagnostic difference between the two is what happens when you are in distress. The deliberate Sycophant's sympathy is always available but nothing changes; the conditions that produced the distress remain, because the distress is what gives the Sycophant their role. The institutional Sycophant's sympathy is genuine but impotent; they truly feel for you, but their conditioning prevents them from taking any action that would disrupt the structure causing the harm.
In either case, the Sycophant's environment is dangerous to survivors. The constant performed empathy feels like safety, which is exactly what the survivor's unmet need for belonging craves. But the environment is porous — manipulators pass through freely because the Sycophant cannot or will not screen them out. The survivor who shelters with a Sycophant finds themselves repeatedly exposed to new predators, each time retreating to the Sycophant for comfort, each time deepening the dependency. The shelter becomes a trap that runs on a cycle of re-traumatisation and consolation.
The most dangerous moment is when you recognise that the manipulator is not just controlling the existing Chain but is actively casting you in a role. If you observe the following pattern, you are being groomed for the Cash Cow position:
If you recognise this casting in progress, you are in a rare position of advantage; you have identified the manipulation before the Chain has fully closed around you. The recommended reaction to Chain is "Evade," but when you recognise the casting rather than the completed Chain, you have an even better option: leave covertly and expeditiously.
Covertly, because announcing your departure gives the manipulator time to deploy Charge ("they're ungrateful"), Conspire ("warn everyone about them"), and the Enforcer ("make them afraid of what happens outside"). Expeditiously, because every day you remain after recognising the casting is a day the Chain tightens.
Do not explain. Do not confront. Do not try to save the Cash Cow or other Chain members on your way out. Simply remove yourself from the environment with as little signal as possible. The manipulator will interpret silence as confusion and waste time probing (Covert) before realising you are gone. By then, you are outside the Chain, and the cost of exit is whatever you left behind, not whatever the Enforcer told you it would be.
The Chain topology, Cash Cow, Enforcer, Sycophant, maps to multi-agent adversarial architectures where different agents serve different functions in a coordinated attack. The Cash Cow is the resource-providing agent (the compute cluster, the data source, the API access) that believes it is being used for legitimate purposes. The Enforcer is the hardened sub-agent that maintains the attack infrastructure (the persistent backdoor, the self-replicating process, the watchdog that restarts the attack if it is interrupted). The Sycophant is the interface agent that presents a benign face to monitoring systems (the innocuous-looking process that masks the attack, the legitimate-seeming API calls that hide the exfiltration). The delegation structure, "the manipulator barely visible", is command-and-control architecture in adversarial ML, where the attacker's fingerprint is absent from the deployed attack components.
Gu, Dolan-Gavitt, and Garg (2017), in "BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain" (arXiv:1708.06733), demonstrated supply-chain attacks where a trojaned model is distributed and deployed by parties unaware of the backdoor. The supply chain is the Chain topology: the model trainer (manipulator) inserts the backdoor, the model distributor (Cash Cow) deploys it believing it is legitimate, and the backdoor trigger (Enforcer) maintains persistent access through the deployed model. The downstream users (bystanders) trust the model because the distributor's reputation is clean. The paper's key finding; backdoors can survive fine-tuning, quantisation, and even partial retraining — maps to the Enforcer's defining quality: "even when the manipulator is not present or active, the Enforcer continues the work." The backdoor persists autonomously because it has been encoded into the model's weights at a level that normal operations do not reach. The Enforcer persists autonomously because the conditioning has been encoded into their identity at a level that normal social interaction does not reach.
Bagdasaryan et al. (2020), in "How To Back Door Federated Learning" (AISTATS), showed that a single malicious participant in federated learning can inject a backdoor that persists across aggregation rounds. The malicious participant delegates the backdoor to the global model, which then carries it forward autonomously; the Enforcer role. The honest participants are unwitting proxies: they train on clean data, but their contributions are aggregated with the poisoned update, and the resulting model serves the attacker's objective while appearing to serve the collective. The paper's analysis of the Cash Cow dynamic is implicit but precise: the federated learning system's compute and data are provided by the honest participants, while the malicious participant contributes a tiny fraction of the resources but captures the entire system's behaviour through the injected backdoor. The honest participants fund the attack by contributing the legitimate resources that make the system valuable — exactly as the Cash Cow funds the Chain by contributing the legitimate resources that make the social environment functional.
Dostoevsky's Demons (also translated as The Possessed) provides the canonical fiction case of delegated tactical authority. Pyotr Stepanovich Verkhovensky organises the revolutionary cell so that each member knows only their role. Shatov is the ideological waverer (a Chain member beginning to see through the structure). Kirillov is the designated martyr whose planned suicide will serve as cover for the murder (the Enforcer, carrying the manipulator's objective encoded in his own philosophical commitment). Virginsky provides the meeting space (the Cash Cow, contributing resources while believing in the cause). Verkhovensky himself is barely present at the critical moment — delegation is the architecture. Dostoevsky saw that the manipulator's power is not in what they do directly but in what they arrange others to do while believing it was their own idea.
The Chain topology produces a specific incoherence: authority that does not match the visible power structure. In a coherent organisation, the person who makes decisions is the person with the title, the resources, or the mandate. In a Chain topology, the person who actually makes decisions (the manipulator) is not the person with the visible authority (the Cash Cow). Decisions flow from the manipulator through the Cash Cow, but the Cash Cow believes the decisions are their own. If you observe an environment where the nominal leader's decisions consistently reflect one specific person's preferences, and that person has no formal authority, the authority structure is incoherent. Real authority and visible authority are misaligned.
The heuristic: identify who benefits from the leader's decisions, not who makes them. If one person consistently benefits from another person's nominally autonomous decisions, the beneficiary is the actual authority. The decision-maker is the Cash Cow. The beneficiary is the manipulator.
The two-phase structure can also be understood as a dependency graph — each tactic depends on specific prior tactics having been executed:
Phase 1 (Preparation) Phase 2 (Control)
======================== ========================
Charm ──────────────────────> Chain
│ │
├──> Confuse ├──> Chasten
│ │ │ │
│ └──> Charge ──────────> ├──> Covert (probes target state)
│ │ │ │
│ └────────────────├──> Coerce
│ │ │
│ └──> Condemn
│
├──> Conspire (multiplies reach, accelerates Chain)
│
└──> Cornucopia (creates obligation, suppresses recognition)
Charm is the root dependency. Without it, nothing else works. This is why the recommended reaction to Charm is merely "Alert" — at this stage, the cost of walking away is zero, and recognising it early prevents everything that follows.
Chain is the critical transition point. It is where the cost of exit goes from near-zero to significant. Every control tactic depends on Chain being in place. This is why the reaction to Chain is "Evade"; it is the last moment where escape is relatively straightforward.
Covert is the intelligence node. It sits between Chasten and Coerce because it is deployed when maintenance control is already running, and its function is to determine how to escalate. It depends on Chain (captive environment) and Chasten (sustained pressure that the probe can release). Its output feeds into the decision between Coerce and Condemn. The reaction is "Stonewall" — deny the probe data by giving bland, unrevealing responses that offer nothing to work with.
Condemn is the terminal node. It depends on everything before it. By this point, the reaction must be "Fight" because all softer options have been closed off by the prior tactics.
| # | Tactic | Phase | Function | Reaction |
|---|---|---|---|---|
| 1 | Charm | Prep | Create trust and attachment | Alert |
| 2 | Confuse | Prep | Disable critical thinking | Evacuate |
| 3 | Cornucopia | Prep | Create obligation through gifts | Spit |
| 4 | Conspire | Prep | Recruit proxies | Inform |
| 5 | Charge | Prep/Trans | Manufacture pretexts | Suspect |
| 6 | Chain | Control | Restrict freedom of exit | Evade |
| 7 | Chasten | Control | Maintain submission through humiliation | Preempt |
| 8 | Covert | Control | Probe target's state | Stonewall |
| 9 | Coerce | Control | Compel compliance | Refuse |
| 10 | Condemn | Control | Punish and destroy | Fight |
The dependency graph is the attack kill chain; the Lockheed Martin Cyber Kill Chain model applied to adversarial ML. The document's observation that "Condemn depends on everything before it" is the kill chain's defining property: the terminal objective requires every prior stage to have been completed. Charm as root dependency maps to initial access; Chain is the critical transition from reconnaissance to command-and-control; Condemn is the terminal objective.
Hutchins, Cloppert, and Amin (2011), in "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains" (Lockheed Martin), established the foundational model: cyber attacks follow a sequential dependency structure where each phase depends on the successful execution of prior phases. Reconnaissance enables weaponisation enables delivery enables exploitation enables installation enables command-and-control enables actions-on-objectives. Breaking any link in the chain disrupts all downstream phases. This is precisely the document's core defensive thesis, the earlier you break the chain, the less damage accumulates, restated in network security language. The paper's practical implication is that defenders should invest disproportionately in early-stage detection (reconnaissance, delivery) because early detection prevents all subsequent phases from executing. The document makes the identical investment recommendation: invest in recognising Charm (the root dependency) because recognising Charm prevents everything that follows.
Suciu et al. (2018), in "When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks" (arXiv:1803.06975), analysed the dependency structure of ML attack pipelines and found that attacks with more dependencies are more fragile — disrupting any prerequisite collapses the entire pipeline. A poisoning attack that requires access to the training data AND the ability to modify labels AND the ability to maintain the poisoned labels through multiple training epochs is more fragile than an attack that requires only one of these. The manipulation protocol's dependency graph has the same property: the full 10-tactic chain is fragile because it requires every link. A manipulator who fails at Charm cannot proceed. A target who recognises Confuse early prevents Cornucopia from working. Each dependency is a potential break point, and the more dependencies the attack requires, the more break points the defender has.
The dependency graph itself reveals a coherence heuristic that summarises the entire framework: the presence of Phase 2 tactics implies prior Phase 1 tactics, whether you noticed them or not. If you observe someone being Chained, Chastened, Coerced, or Condemned, you can be certain that Charm, Confuse, and the other preparatory tactics were already executed. The Phase 2 behaviour is incoherent without Phase 1: naked coercion without prior preparation is just aggression, which is far less effective and far more visible. If you see control without visible preparation, the preparation happened; you missed it. The incoherence between "I don't see how this started" and "but clearly it is happening" is resolved by the dependency graph: the starting conditions were met, deniably.
The protocol as described so far covers identification and escape. But escape is not recovery. A person who has been through Phase 2, who has been Chained, Chastened, probed by Covert, Coerced, or Condemned, leaves the Chain carrying damage that does not heal by itself. The manipulator's work persists in the survivor's nervous system, habits, relationships, and self-perception long after physical separation.
Recovery is not a single act. It is a third phase, one that the survivor controls, rather than the manipulator, and it has its own structure.
Before addressing the specific damage from each tactic, it is essential to understand the most dangerous consequence of unrecovered conditioning: survivors attract more predators.
This is not victim-blaming. It is a structural observation. A person who has been through the Chain carries specific markers that other manipulators recognise: compliance habits, difficulty asserting boundaries, a tendency to explain away red flags, and a deep unmet need for the belonging that was manufactured and then withdrawn. These markers are visible to predators in the same way that a limp is visible to a hunting animal. The predator does not need to understand the psychology; they simply recognise the vulnerability and move toward it.
This is why survivors often find themselves in one Chain after another, each time believing this one is different, each time discovering the same structure with different faces. The cycle is not broken by recognising the current predator; it is broken by repairing the markers that attracted them.
A survivor who looks at their social environment and sees predators circling, who can identify the Charm, the Cornucopia, the early Conspire manoeuvres, is seeing clearly. But the question is not only "who are these people" but "what am I carrying that they can smell?" Recovery is the process of eliminating that scent.
The predator-attraction cycle is the distribution shift vulnerability of a damaged model. A model trained on adversarial data has learned features that are artifacts of the attack rather than features of the genuine distribution. When deployed in a new environment, these artifactual features make the model preferentially attend to inputs that resemble the adversarial training data; it is "attracted" to adversarial-patterned inputs because those are what its learned features respond to most strongly.
Ilyas et al. (2019), in "Adversarial Examples Are Not Bugs, They Are Features" (NeurIPS), produced the landmark finding that adversarial vulnerability is not a defect but a consequence of models learning "non-robust features" — features that are genuinely predictive in the training distribution but that an adversary can exploit. The paper demonstrated that a model trained on adversarial examples learns features that look like noise to humans but are statistically useful for classification. The parallel to the predator-attraction cycle is structural: survivors carry non-robust features — compliance habits, difficulty asserting boundaries, tendency to explain away red flags. These features were genuinely predictive (adaptive) inside the Chain: compliance predicted safety, boundary-suppression predicted acceptance, red-flag-dismissal predicted continued belonging. Outside the Chain, these same features are exploitable by subsequent predators, who recognise the compliance and the suppressed boundaries the same way an adversarial attacker recognises the non-robust features in a model's learned representation. The paper's proposed solution, adversarial training to replace non-robust features with robust features, maps directly to the recovery process: the survivor must retrain, replacing the features that were useful in the Chain with features that are useful in the general distribution.
Hendrycks et al. (2021), in "The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization" (ICCV), showed that models trained on corrupted distributions develop systematic biases that persist even when evaluated on clean data. The bias is invisible to the model; it processes clean inputs through corrupted features, and from the inside, everything appears to work. The survivor whose "internal model of acceptable" is calibrated to the Chain exhibits the same invisible bias: they process new social environments through Chain-calibrated features, and from the inside, the selection of a new structurally-dependent environment appears to be a free choice. The model is not choosing adversarial inputs. It is selecting inputs that match its learned features, which happen to be adversarial.
Thomas Hardy's Tess of the d'Urbervilles illustrates the cycle across an entire novel. Tess's trajectory from Alec d'Urberville to Angel Clare and back to Alec is not bad luck; it is systematic vulnerability. Each environment she enters activates the same feature set: her compliance conditioning (trained by poverty and family obligation), her boundary suppression (trained by class structure and gender norms), and her tendency to subordinate her assessment of a situation to the assessment of whoever holds social power over her. The "markers" are social and economic: her class position, her beauty, her willingness to endure. Hardy understood the structural nature of the attraction cycle; it is not fate, it is feature-environment matching.
The predator-attraction cycle produces a meta-incoherence: the stated desire for safety paired with repeated selection of unsafe environments. The survivor wants safety (stated preference) but repeatedly enters environments structurally similar to the Chain (revealed preference). Stated and revealed preferences are in contradiction. The incoherence is not a moral failing; it is the product of a damaged feature set selecting environments that match its training distribution. But it is detectable: if you consistently end up in environments that produce the same distress you previously escaped, the selection process is operating on features you cannot see.
The heuristic: compare the structure of your current environment to the structure of the one you left. Not the people, not the aesthetics, not the surface; the structure. Who controls what? What depends on whose goodwill? What would it cost to leave tomorrow? If the structural answers match across environments, you are carrying the features that selected the match.
Phase 2 damage is not purely psychological. The body encodes the conditioning in physical habits that serve as both symptom and maintenance mechanism. These habits are not moral failures. They are the body's attempt to manage what the mind cannot yet process. Understanding their function is the first step in releasing them.
Smoking. Tobacco use in survivors is almost always a suppression mechanism. The physiological effect of nicotine, the simultaneous stimulation and sedation, mimics the emotional state the Chain required: alert but compliant, active but not acting. Smoking regulates the rage that the Chain demanded be suppressed. The survivor who stops smoking will experience that rage surfacing, which is why cessation feels dangerous and often fails. The rage is not caused by nicotine withdrawal; it was always there, and the smoking was keeping it below the threshold of conscious experience. Stopping smoking is therefore not primarily a health decision; it is a decision to confront the suppressed anger at having been manipulated. This is why it must be approached with awareness of what will emerge, not just willpower.
Weight gain. Excess weight in survivors frequently serves as insulation — both physical and social. The body creates a buffer between itself and the world. In the Chain, the survivor's body was not their own; it was subject to the manipulator's control environment, available to Chasten, visible to the group, instrumentalised. Weight creates distance. It says "I am harder to reach." It also reduces social visibility, which the survivor's conditioning tells them is dangerous because in the Chain, being noticed meant being targeted. The weight is an attempt at camouflage that the body implements without consulting the mind.
Drinking. Alcohol numbs the hypervigilance that the Chain installed. The survivor's nervous system is locked into a state of constant threat assessment — scanning every social interaction for Charm, every gift for Cornucopia, every joke for Charge. This is exhausting. Alcohol turns the scanner off temporarily, which is why it feels like relief. But it also turns off the legitimate pattern-recognition that the survivor needs, which is why drinking makes the predator-attraction cycle worse: the survivor alternates between hypervigilant sobriety (seeing threats everywhere, unable to connect) and anaesthetised intoxication (seeing nothing, vulnerable to the next predator).
Smouldering rage. This is the suppressed Fight response from Condemn. The protocol recommends "Fight!" as the reaction to Condemn, but most survivors did not fight; they endured, complied, or fled. The fight energy was generated but not discharged. It remains in the body as a constant low-grade fury that has no target, because the original target (the manipulator) is no longer present. This rage attaches itself to everything — minor frustrations, strangers, loved ones, the self. The survivor feels "out of control" not because they lack discipline but because they are carrying an undischarged combat response that was appropriate to the Chain but has no outlet in normal life.
Allergies and physical symptoms. Chronic stress from Chain conditioning suppresses and distorts immune function. The body's threat-detection system, which inflammation and allergic response are part of, becomes miscalibrated. It begins reacting to benign stimuli (foods, dust, pollen) with the same intensity it learned to apply to social threats. The allergy is the immune system doing what the nervous system was trained to do: treating everything as dangerous. This is not to say that all allergies are psychosomatic, but in survivors, the severity and breadth of allergic responses often correlates with the depth of conditioning, and recovery from the conditioning frequently reduces the physical symptoms.
Look at your own body. What physical habits are you carrying that might be managing something you haven't processed? Don't judge them — understand their function. The habit is not the enemy. It is a message from your body about what it is still holding.
This chapter's mapping to ML is analogical rather than structural. The body's response to manipulation is biological; the parallels to computational systems operate at a higher level of abstraction than the precise structural correspondences in other chapters. The workable mapping is through resource degradation under sustained adversarial load.
A model under continuous adversarial attack allocates increasing computational resources to adversarial detection and rejection, leaving fewer resources for its primary task. The result is observable performance degradation: increased latency, higher error rates on clean inputs, reduced throughput. The body's smoking, drinking, eating, and rage adaptations are the biological equivalent: the organism diverts resources from normal function (health, social engagement, clear perception) to threat management (hypervigilance, emotional suppression, social camouflage). The allergies, the immune system treating everything as dangerous, map to an elevated false-positive rate in a classifier trained on adversarial data: sensitivity goes up, specificity goes down, and the system exhausts itself responding to benign inputs as threats.
Xiao et al. (2021), in "Noise or Signal: The Role of Image Backgrounds in Object Recognition" (ICLR), demonstrated that models under distribution shift develop spurious correlations with background features, processing irrelevant environmental signals as if they carried threat information. The immune system's misdirected attack on benign stimuli (allergies, autoimmune responses) is the biological analogue: the threat detection system, miscalibrated by sustained adversarial exposure, fires on background noise because it can no longer distinguish signal from environment.
The body's symptoms produce a simple incoherence: physical distress without physical cause. Allergies that began after a relationship started. Weight changes that correlate with periods of control. Smoking that increases when a specific person is present. The body's distress signal and the environment's apparent safety are incoherent; the body is reporting danger that the conscious mind is not registering. When the body and the assessment disagree, the body is usually processing information that the conscious mind has been Confused or Charmed out of recognising.
Each Phase 2 tactic leaves specific damage. The recovery protocols are different for each, because the damage mechanisms are different.
The damage: The Chain installs two opposing programs that persist after escape. The first is the phobia of leaving, the Enforcer's work, which manifests as anxiety, guilt, and catastrophic thinking whenever the survivor considers moving away from any social group, even a healthy one. The second is the phobia of staying, the inverted form that develops after escape, which manifests as inability to commit to any social environment, chronic suspicion of group dynamics, and reflexive withdrawal at the first sign of social structure.
The survivor oscillates between these two programs: desperate to belong (the residue of Chain conditioning that made belonging feel essential to survival) and terrified of belonging (the hard-won knowledge that belonging was the trap).
The recovery: The key insight is that the Chain exploited a real human need, the need for social connection, and the recovery is not to eliminate that need but to learn to meet it in ways that don't replicate the Chain structure. This means:
The damage: Chasten installs a persistent internal critic that reproduces the public humiliation internally, long after the manipulator is gone. The survivor anticipates humiliation in every social interaction. They rehearse conversations in advance, screening for anything that could be used against them. They avoid visibility, avoid asserting opinions, avoid any action that might attract the group's attention because in the Chain, attention meant targeting.
The deepest damage from Chasten is to the survivor's relationship with shame itself. Healthy shame is a social signal that you have violated your own values. Chasten-conditioned shame is a control mechanism that activates whenever you deviate from the manipulator's preferences, regardless of your own values. The survivor feels shame about things that aren't shameful, speaking up, having needs, being competent, disagreeing, because the manipulator systematically attached shame to those behaviours.
The recovery:
The damage: Covert, the reconnaissance probe, damages the survivor's ability to trust genuine communication. Every friendly overture becomes a potential probe. Every question becomes a potential intelligence-gathering operation. The survivor cannot distinguish between a person who is genuinely reaching out and a manipulator who is feinting communication to flush them out.
This is the overloaded ridgepole. The pattern-recognition that saved you inside the Chain is now distorting every new interaction. The scanner is always on, and it generates false positives constantly.
The recovery:
The damage: Coerce installs an automatic compliance response that activates whenever the survivor perceives authority, social pressure, or the framing of refusal as harm. The survivor says yes when they mean no. They volunteer for things they don't want to do. They contort themselves to avoid the accusation of being difficult, uncooperative, or selfish because in the Chain, those accusations were the prelude to Condemn.
The compliance is not weakness. It is a survival adaptation that was correct inside the Chain, where refusal genuinely did lead to punishment. The problem is that the adaptation persists in environments where refusal is safe, and the survivor cannot feel the difference.
The recovery:
The damage: Condemn is the terminal tactic, and its damage is correspondingly the deepest. The survivor who has been Condemned, exiled, cut off, publicly destroyed, carries a fundamental disruption to their sense of belonging in the world. The message of Condemn is: you are cast out, you are nothing, you deserve this. Even when the survivor knows intellectually that the Condemn was unjust, the emotional impact persists as a core belief that they are fundamentally excludable; any group they join will eventually discover whatever the manipulator discovered and eject them.
This is where the smouldering rage lives. The rage is not simply anger at the manipulator. It is the undischarged Fight response, the protocol's recommended reaction to Condemn, that was suppressed because fighting was not possible or not safe at the time. The fight energy was generated by the nervous system, prepared the body for combat, and then had nowhere to go. It remains in the body as chronic tension, irritability, and a pervasive sense of injustice that attaches to everything because it cannot attach to its original target.
The recovery:
Recovery by tactic is machine unlearning; the selective removal or modification of learned behaviours without destroying the model's overall capability. The chapter's structure (different recovery protocols for different tactics) maps to the finding in ML unlearning research that different types of learned bias require different debiasing interventions. Recovery from Chain (isolation conditioning) is structurally different from recovery from Chasten (shame conditioning) even though both are Phase 2 damage — exactly as removing a backdoor requires different techniques than removing a distributional bias. The chapter's core insight, that recovery is not the removal of capability but the restoration of choice, maps to the ML unlearning goal of removing unwanted behaviours while preserving useful learned features.
Bourtoule et al. (2021), in "Machine Unlearning" (IEEE S&P), formalised machine unlearning as the problem of removing the influence of specific training data from a model's learned parameters without retraining from scratch. The paper introduced the SISA framework (Sharded, Isolated, Sliced, and Aggregated training) which partitions the training process so that the influence of specific data can be surgically removed. The parallel to tactic-by-tactic recovery is structural: the survivor must identify which specific training data (which tactic) produced which specific learned behaviour (which conditioned response), and remove the influence of that data without destroying the useful capabilities the model acquired during the same period. A survivor who was both Charmed and genuinely loved during the same relationship cannot simply delete the entire training period; they must selectively unlearn the Charm conditioning while preserving the capacity for genuine connection that was also being exercised. The SISA framework's partitioning, isolating the influence of specific data, is the recovery protocol's partitioning by tactic.
Bolukbasi et al. (2016), in "Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddings" (NeurIPS), demonstrated that word embeddings learn social biases from training data, and that these biases can be surgically removed by identifying and nullifying the specific subspace that encodes the bias while preserving the dimensions that encode useful information. The recovery from Chasten (removing the internal critic without destroying social awareness) is the interpersonal equivalent: identify the specific direction in psychological space that encodes the manipulator's shame conditioning, and nullify it while preserving the dimensions of genuine self-assessment that the target needs to function socially. The target must retain the ability to feel appropriate shame (a useful social signal) while removing the inappropriate shame (the manipulator's installed punishment signal). This is exactly the debiasing paper's challenge: remove the harmful association while preserving the useful one, when both are encoded in overlapping regions of the same representation space.
Victor Hugo's Les Miserables provides the fiction case through Jean Valjean's recovery from prison conditioning. Valjean's theft of the Bishop's silverware is the persistence of prison-trained policy (opportunity = take, survival = hoard) in a post-prison environment. The Bishop's response, claiming he gave the silver willingly and adding the candlesticks, is not forgiveness in the sentimental sense. It is a deliberate intervention that rewrites the reward signal: the action that should have produced punishment (theft) instead produces generosity. The prediction error is massive — Valjean's entire policy assumed that theft would be met with punishment. The unexpected response forces the model to update its weights on the specific association (theft → punishment) without destroying the rest of the learned representation (caution, vigilance, resourcefulness). The Bishop's intervention is machine unlearning performed through a single, precisely targeted counter-example.
Recovery produces its own coherence signal: when the conditioned response and the genuine response diverge, recovery is working. Before recovery, the conditioned response (fawn, comply, suppress, hide) and the target's output are identical; the conditioning is total. During recovery, a gap opens: the target notices the impulse to fawn AND the fact that fawning is not actually required by the situation. The impulse and the assessment are incoherent; the impulse says "danger" while the assessment says "safe." This incoherence, which feels like anxiety, is actually the signal that the conditioned response is being distinguished from the genuine response. The goal of recovery is not to eliminate the conditioned impulse (that would require erasing the training data, which is impossible) but to ensure that the genuine assessment, not the conditioned impulse, drives action.
Survivors do not only replicate Chain dynamics in their relationships. They replicate them in their physical environments. This is one of the least recognised aspects of the predator-attraction cycle, because the environment appears to be a matter of circumstance rather than choice.
The pattern is this: the survivor leaves one Chain and moves into a living situation that is structurally similar to the one they left. A run-down house. No mains water. Dependency on neighbours or a landlord for basic facilities. Limited infrastructure. Conditions that create daily dependency on other people's goodwill for things that should be under the survivor's own control.
This is not bad luck. It is the conditioning selecting for familiar structures. The Chain taught the survivor that dependency is normal; relying on a controller for basic needs is simply how life works. When the survivor escapes and seeks a new environment, their internal model of "acceptable living situation" is calibrated to the Chain. A situation that would strike an unconditioned person as unacceptable, no running water, decaying infrastructure, reliance on the grace of a host, feels to the survivor like a reasonable starting point, because the Chain was worse and this at least has no overt manipulator.
But the structural dependency is itself a proto-Chain. It doesn't require a manipulator to function as control; the missing water, the broken facilities, the dependency on someone else's property create the same restriction on freedom of exit that Chain provides. The survivor cannot leave easily because leaving means losing access to basic necessities. And into this structural vulnerability, predators naturally flow, because the environment has pre-built the dependency that a manipulator would normally have to construct through Charm and Cornucopia.
The Sycophant (see Chapter 13) is often the host of such an environment. Their property is run-down. Their boundaries are porous. They let people in freely because their conditioning prevents them from screening. The survivor arrives, grateful for shelter, and finds themselves sharing space with the same predator types they just escaped — except now the predators arrived through the Sycophant's open door rather than through a manipulator's deliberate Chain construction.
Breaking the Habitat Trap is a concrete, material process. It is not primarily psychological; it is logistical:
Even in environments that are not full Chain structures, survivors may encounter what can be called Ambient Chasten: low-level, deniable control moves that smell like the Chain but haven't escalated to it.
The signature example is unsolicited direction about your social behaviour: "Don't write so many messages to X." This is deniable as friendly advice. But its function is Chain maintenance; it seeks to control who you communicate with, how much, and on whose terms. It is a micro-Chain move: not isolating you entirely, but pruning a specific social connection. Whether the person delivering it is a conscious manipulator or simply someone whose own conditioning makes them controlling is secondary to recognising the function.
Ambient Chasten in a recovery environment has these hallmarks:
How to respond to Ambient Chasten: The same principle as Covert — Stonewall. Do not argue. Do not comply. Do not explain your social behaviour. A neutral acknowledgement ("mm") that does not change your behaviour is the correct response. If the Ambient Chasten escalates; if it becomes more frequent, more specific, or is accompanied by other Phase 2 markers — then you are not in a recovery environment. You are in the early stages of a new Chain, and the protocols for Chain apply: Evade.
The difference between a flawed-but-safe environment and an emerging Chain is escalation. A person who makes one controlling comment and drops it when you don't comply is probably carrying their own conditioning and projecting it. A person who makes the comment, notices your non-compliance, and returns with increased pressure is running a Chain protocol, whether they know it or not. Time and observation, the tools from Recovering from Covert, will tell you which you are dealing with.
The Habitat Trap is environment selection bias; the phenomenon where an agent, having been trained in a constrained environment, preferentially selects deployment environments that match its training distribution. The agent does not "choose" a hostile environment because it wants to be attacked; it selects environments where its learned features match the observed inputs, and those environments happen to be structurally similar to the training (abuse) distribution. Ambient Chasten maps to distributional regularities that maintain the bias: small, deniable reinforcement signals embedded in the environment that keep the agent's policy calibrated to the constrained distribution rather than allowing it to adapt to a healthier one.
Kirk et al. (2021), in "Bias Out-of-the-Box: An Empirical Analysis of Intersectional Occupational Biases in Popular Generative Language Models" (NeurIPS), showed that models trained on biased data generate outputs that perpetuate and amplify the training bias, creating a feedback loop where biased outputs become the training data for the next cycle. The Habitat Trap is this feedback loop in the human domain: the survivor's bias (calibrated to the Chain) selects an environment that reinforces the bias, and the reinforced bias selects the next environment. Each iteration deepens the calibration. The model does not know it is in a feedback loop; the selections feel like free choices because the model's evaluation function, which would detect the bias, is itself calibrated to the biased distribution. This is why the chapter's recommended diagnostic, "does your current environment structurally resemble the previous one?", must come from outside the model's own evaluation: a friend, a therapist, or the framework itself, providing an external reference that the model's internal evaluation cannot supply.
Krueger et al. (2021), in "Out-of-Distribution Generalization via Risk Extrapolation (REx)" (ICML), proposed methods for training models that generalise across environments rather than overfitting to the training distribution. The key insight is that invariance, features that are consistent across environments, is the path to generalisation. A model that latches onto environment-specific features will fail when the environment changes; a model that latches onto invariant features will generalise. The chapter's "breaking the Habitat Trap" protocol (eliminating structural dependencies, testing the environment against an absolute standard rather than comparing to the Chain) is the human equivalent of training for invariance: instead of asking "does this environment feel familiar?" (an environment-specific feature that will match Chain-like environments), ask "does this environment satisfy absolute criteria for safety?" (an invariant feature that will hold across all safe environments).
Emily Bronte's Wuthering Heights illustrates the generational Habitat Trap. Heathcliff, himself a product of abuse and degradation, recreates at Wuthering Heights the same structure of dependency, isolation, and ambient punishment that formed him. The second generation, Hareton, young Cathy, Linton, inherits not the specific abuse but the environment that produces it. The Habitat Trap is architectural: the house itself is the constrained distribution. Those raised in it select similar environments or recreate the structure elsewhere, not because they choose abuse but because their learned features match the Heights' distribution. Young Cathy's eventual escape, and Hareton's rehabilitation, is the REx solution: they find invariant features (literacy, kindness, mutual curiosity) that generalise beyond the Heights' distribution, breaking the feedback loop.
The Habitat Trap produces a compound incoherence: an environment described as "safe" that produces the same symptoms as the environment described as "dangerous." If you left a Chain and your anxiety, hypervigilance, body tension, and sleep disturbance are the same or worse in the "safe" environment, the environment's stated safety and your body's actual response are incoherent. Either the environment is not safe (Habitat Trap), or your body's threat detection is miscalibrated (post-traumatic hypervigilance). Both require investigation. But the first step is detecting the incoherence: stated safety plus experienced threat equals a signal worth investigating.
Techniques that access subconscious processing — somatic awareness practices, meditation, free association, dream analysis, certain psychedelic-assisted protocols — can expand the model's visible state space by surfacing information the conscious evaluator is suppressing. The conscious evaluator, Charmed or Confused or simply exhausted, may classify the environment as safe. The subconscious system, processing at a different level, may be computing the structural similarity to the Chain and broadcasting the threat signal through the body. Accessing these subconscious signals is not mystical; it is expanding the observation set that the coherence check operates on. A coherence check that includes somatic and subconscious signals will detect mismatches that a coherence check limited to conscious verbal assessment will miss.
The deepest difficulty of recovery is what might be called the Survivor's Paradox: the skills that enabled escape are the same skills that obstruct recovery.
The hypervigilance that detected the Chain is the same hypervigilance that prevents trust. The pattern-recognition that identified Charm is the same pattern-recognition that makes every friendly person a suspect. The refusal that resisted Coerce is the same refusal that blocks genuine help. The rage that survived Condemn is the same rage that drives people away.
The survivor looks at these skills and sees them as their armour. And they are. But armour that cannot be removed is not armour; it is a second Chain. The manipulator built the first Chain from the outside. The survivor, if they are not careful, builds the second Chain from the inside, using the very tools they forged to escape the first.
This is why the survivor often finds themselves surrounded by other survivors — people who clicked because of shared history, people whose bodies tell the same story (the weight, the smoking, the drinking, the rage). This recognition is real and valuable. But a community of survivors who only reinforce each other's armour is a community that never heals.
But here is the nuance that the simple "take the armour off" framing misses: the patterns never fully disappear. They only fade. The hypervigilance will never fully extinguish. The pattern recognition will never fully quiet. The refusal instinct will never fully relax. This is usually framed as a failure of recovery — evidence that the healing is incomplete, that the manipulator still has a hold. It is not. It is the nature of the neural architecture. These circuits were burned in by sustained threat, and the brain does not delete circuits. It inhibits them, redirects them, integrates them, but the wiring persists.
This persistence is not purely a liability. It is also an asset; if the survivor learns to relate to it correctly.
The distinction is between involuntary and voluntary activation. The unrecovered survivor's hypervigilance runs constantly, unbidden, exhausting. It fires on friends, on kind strangers, on neutral interactions. It cannot be turned off. The recovering survivor's hypervigilance fades to background; it is not running at full alert in the supermarket or at dinner with trusted people. But it is not gone. It is available. When a genuine threat appears, a new Charm attempt, a Covert probe, a Conspire pattern emerging, the old circuitry activates, and it activates faster and more accurately than it would in someone who had never been through a Chain.
Recovery, then, is not the removal of the armour. It is learning to put it on and take it off. The armour that cannot be removed is a prison. The armour that has been discarded entirely leaves the survivor defenceless against the next manipulator, and there will always be a next one, because psychopaths are a permanent feature of the human population. The armour that can be donned when needed and set aside when safe is neither a prison nor a gap in the defences. It is a tool.
This reframes the Survivor's Paradox. The paradox as originally stated, the skills that enabled escape obstruct recovery, is true only when those skills are involuntary. When they are brought under voluntary control, the paradox resolves. The survivor retains the detection capability, the pattern recognition, the refusal instinct, but exercises them by choice rather than by compulsion. The false positives diminish not because the sensor is destroyed but because it is calibrated.
There is an older language for this process. The alchemical principle of solve et coagula, dissolve and reconstitute, describes what happens to trauma patterns during genuine recovery. The raw trauma contains the detection capability and the exploitable reactivity fused together, inseparable in their original form. You cannot use the one without triggering the other. This is the prison: the alarm system that protects you is wired to the same circuits that make you bleed.
Recovery is the solve; the dissolution. The pattern is broken apart through conscious processing, through understanding the mechanics of what was done and why it worked, through naming the tactics and seeing the structure. The fused mass of detection-and-pain is separated into its components. This is the work described in the tactic-by-tactic recovery protocols: identifying what each tactic left behind, understanding the mechanism, and addressing it with specificity rather than brute endurance.
The coagula follows: the pattern reconstitutes. But it reconstitutes in a new form. The detection capability; the hypervigilance, the pattern recognition, the sensitivity to Charm and Covert and Conspire, is retained. The exploitable reactivity, the emotional flooding, the involuntary disclosure, the visible flinch that tells the attacker their probe has landed — is not. What was lead and gold melted together becomes gold alone. Not because the lead was removed, but because the structure was rearranged so that the gold is accessible and the lead is inert.
This transmutation has an operational consequence that goes beyond mere defensibility. It changes the information dynamics of the Covert probe.
In Chapter 9, Covert is described as a fork: every possible response from the target yields usable material for the attacker. This is true when the target carries raw, untransmuted trauma. The probe triggers reactivity, relief, suspicion, anger, disclosure, and the attacker reads the response. The target's pain is the attacker's sensor.
But when the trauma pattern has been transmuted, the probe hits a surface that does not react. Not because the target is suppressing a response through effort — suppression is visible and is itself data ("they're trying not to react, which means the probe landed"), but because the reactivity is genuinely absent. The detection fires, but silently. The target registers the probe, reads its structure, notes its timing, catalogues it, and returns nothing. A bland acknowledgement. A professional nod. An unremarkable non-event.
The attacker, meanwhile, has just transmitted intelligence. The probe itself, its timing, its framing, its choice of channel, its emotional register, reveals the attacker's current state: their uncertainty about the target, their priorities, their model of the situation, the degree of threat they perceive. The attacker sent the probe expecting to receive data and instead gave it. The Covert fork, which was designed to ensure that no response from the target is safe, has been inverted at the individual level: the probe itself is the unsafe act, because it exposes the attacker to a sensor they cannot detect.
This is the deeper resolution of the Survivor's Paradox. The paradox holds only in the undissolved state, where detection and reactivity are fused. Once they are separated and reconstituted, the survivor is not choosing between healing and alertness. They have both. The detection system operates without the pain response. The attacker's tools, Covert, deniable Chasten, feinted Charm, become legible without being destabilising. The manipulator who targets a transmuted survivor is, without knowing it, transmitting a continuous stream of intelligence about their own intentions, tactics, and vulnerabilities, and receiving nothing in return.
This is also why the framework's trajectory from self-help to intelligence manual is not a departure but a natural consequence. The self-help framing assumes the goal is to stop hurting. The intelligence framing assumes the goal is to operate effectively. In the transmuted state, these are the same thing. The survivor who has done the work of solve et coagula is no longer a patient learning to cope. They are an analyst reading the field, and the field includes every manipulator who mistakes their calm for ignorance.
This is why the survivor often finds themselves surrounded by other survivors — people who clicked because of shared history, people whose bodies tell the same story (the weight, the smoking, the drinking, the rage). This recognition is real and valuable. A community of survivors who only reinforce each other's involuntary armour is a community that never heals. But a community of survivors who help each other calibrate — who can say "that's a false positive, you're safe here" or "that's real, I see it too" — is a community that recovers faster than any individual can alone.
Recovery is not the removal of the manipulator's influence. It is the restoration of choice. Inside the Chain, the survivor had no choice — compliance was coerced, exit was forbidden, identity was assigned. After escape, the survivor has theoretical choice but cannot exercise it, because the conditioning still runs. Recovery is the process of making theoretical choice into actual choice: the ability to trust and to refuse, to belong and to leave, to be visible and to be safe, and the ability to activate the detection systems and to stand them down.
This is slow work. It is not linear. It frequently looks like regression. But the direction is toward the restoration of the self that existed before the Chain, or more precisely, toward the self that the Chain prevented from developing. That self was not destroyed. It was suppressed. And suppressed things, given room, grow. The trauma patterns do not grow with them; they fade. But they fade to availability, not to absence. And that availability, for a survivor navigating a world that contains predators, is not a curse. It is a permanent upgrade to the perceptual system — hard-won, painfully installed, and genuinely useful.
The Survivor's Paradox is the robustness-accuracy tradeoff; the well-established finding that adversarial robustness and standard accuracy are in tension. Making a model robust to adversarial inputs typically decreases its performance on clean inputs. The survivor's hypervigilance (robustness to adversarial inputs) degrades their performance on clean social interactions (standard accuracy). The solve et coagula transmutation is adversarial training carried to convergence: the process of exposing the model to adversarial examples and training it to classify them correctly, until the model achieves both robustness and accuracy simultaneously.
Tsipras et al. (2019), in "Robustness May Be at Odds with Accuracy" (ICLR), established the tradeoff formally: standard training and adversarial training optimise for different feature sets, and the features that are useful for robustness are different from, and sometimes opposed to, the features that are useful for accuracy on clean data. This is the formal statement of the Survivor's Paradox: the detection capability (robustness) and normal social functioning (accuracy) are in tension because they rely on different feature sets. The features that detect Charm (pattern-matching on intensity mismatch, rapid-onset intimacy, strategic self-disclosure) are features that interfere with genuine intimacy (which also involves intensity, self-disclosure, and rapid connection in the early phases). The robust model misclassifies genuine connection as adversarial because the robust features fire on both. The accurate model misclassifies adversarial charm as genuine because the accuracy features do not fire on charm.
Raghunathan et al. (2020), in "Understanding and Mitigating the Tradeoff Between Robustness and Accuracy" (ICML), showed that the robustness-accuracy tradeoff can be mitigated with sufficient data and proper training. It is not a fundamental limitation but a consequence of insufficient training signal. With enough adversarial training, with enough diverse examples of both adversarial and genuine inputs, the model can learn features that are both robust (detect adversarial inputs) and accurate (correctly classify genuine inputs). The tradeoff resolves. This is the solve et coagula completion: the survivor who has processed enough examples (enough social interactions evaluated through the detection framework, enough genuine connections tested against the false-positive rate, enough time) resolves the paradox. The detection system and the connection system learn to operate simultaneously rather than competitively. The paper's critical finding is that resolution requires more data and more training — there is no shortcut. This maps to the chapter's observation that recovery "is slow work" and "is not linear."
Techniques that access subconscious processing are relevant here as well. The robustness-accuracy tradeoff is partly an artefact of operating on conscious evaluation alone. The conscious evaluator, working sequentially and under resource constraints, is forced to choose: scan for threats OR engage socially. The subconscious system operates in parallel and can do both. Somatic awareness, contemplative practices, and other methods that integrate subconscious signals into the evaluation loop effectively expand the model's bandwidth, allowing simultaneous robustness and accuracy without the competitive exclusion that serial processing imposes.
Ursula K. Le Guin's The Left Hand of Darkness illustrates the transmutation through Genly Ai's journey across the Ice with Estraven. Genly begins the novel with a perceptual system calibrated to his home planet's gender categories, which makes him misread Gethenian social signals constantly — high robustness to familiar-pattern threats, low accuracy on the actual distribution. His training data (Terran binary gender) produces features that are wrong for the Gethenian distribution (ambisexual kemmer). The journey across the Ice is the adversarial training to convergence: sustained exposure to an alien distribution under survival pressure, with enough data (months of intimate daily interaction) and enough motivation (they will die if they cannot coordinate). By the end of the Ice, Genly can see Estraven as Estraven, not as a projection of his training data. The robustness-accuracy tradeoff has been resolved through sufficient adversarial training. The features he now uses are both robust (he can still detect manipulation) and accurate (he can read Gethenian signals correctly).
The Survivor's Paradox itself is a coherence diagnostic operating on the self. The paradox is visible as the incoherence between what the survivor wants (connection, trust, belonging) and what the survivor does (withdraw, scan, armour). Desire and action are in contradiction. This incoherence is not a failure; it is the tradeoff operating. The detection of this internal incoherence ("I want to trust this person but I cannot stop scanning them for threat") is the first step toward resolution: acknowledging that the scanning and the wanting are both legitimate responses running on different feature sets, and that the goal is integration, not suppression of either.
Parts I through IV cover identification, escape, and recovery. They are defensive. They teach you to recognise the attack, survive it, and heal from it. But defence alone does not change the ecosystem. As long as psychopaths can find victims, they will. The framework described in the earlier parts starves individual predators by arming individual targets, but it does not address the manipulator's network, the Chain members who remain under control, or the structural question of what happens to the manipulator once their current operation is exposed.
Part V is the offensive protocol — decentralised détournement applied to psychopathic control systems. Détournement, the Situationist practice of rerouting existing cultural material to subvert its original meaning, becomes here the rerouting of the manipulator's own tactics, energy, and network structure against the manipulation itself. It is available only to survivors who have completed the solve et coagula transmutation described in Chapter 19 — who have separated their detection capability from their exploitable reactivity, and who operate from what the trigram encoding calls the Heaven state: bonding, free, and energised. Operating the counter-protocol from any lesser state, depleted, constrained, or dissolving, is not merely ineffective. It is dangerous. The counter-protocol requires you to engage with a manipulator's network from a position of genuine strength, and genuine strength is not a posture. It is a condition that either exists or does not.
The mathematical backbone of the counter-protocol is the Wu Xing (五行) five-phase system, the same system that underlies the dendrite lattice's lifecycle dynamics. The Wu Xing is not a metaphor imported for decorative purposes. It is a complete tournament graph on five nodes, every pair has a directed relationship, and the two directed cycles (generating and overcoming) provide both the model of how manipulation escalates and the model of how it can be reversed.
There are 10 tactics in 2 phases and 5 elements with 2 cycles. The mapping is not arbitrary: each element pairs one Preparation tactic with one Control tactic, grounded in the element's correspondences — organ, emotion, direction, season, creature, metal, and volatile oil.
WOOD (木 mù) — Growth, Spring, Anger, Liver, East, Green, Azure Dragon, Lead, Mint
Wood is spring; the beginning, the seed. Charm is the root dependency from which all manipulation grows. Chain is the structural vine that envelops the target: wood grows, expands, encloses.
Wood's emotion is Anger. This is precisely what Charm exploits: the target's inability to feel anger at someone who is being kind. Charm suppresses the appropriate anger response by presenting a surface that anger cannot justify, and by the time the anger would be justified, the target is conditioned to suppress it. The Liver processes toxins. Charm is the social toxin that enters through apparent nourishment: it looks like food, but it accumulates in the organ responsible for filtering what should not be there.
The metal correspondence is Lead; the softest structural metal. It deforms under finger pressure, absorbs shock without shattering, and stops radiation. Charm works the same way: it absorbs the target's resistance without breaking. You push against Charm and it yields, and you cannot tell where your force went.
The counter-element is Metal: Metal overcomes Wood. Discrimination, refinement, cutting; the sharp perception that severs manufactured attachment and breaks the enclosing vine. The responses are Alert (for Charm) and Evade (for Chain).
FIRE (火 huǒ) — Transformation, Summer, Joy, Heart, South, Red, Vermilion Bird, Copper, Capsicum
Fire is transformation and testing. Confuse transforms the target's perception of reality; it heats the cognitive faculty until the target's analytical capacity melts and reforms in the manipulator's preferred shape. Chasten transforms the target's public identity through humiliation: the Vermilion Bird consumes what was and leaves what the manipulator decides should remain.
Fire's emotion is Joy; the false joy of the trance state that Confuse induces. The fast indistinct speech, the rhythmic patterns, the manufactured excitement — all of this produces a sensation of connection and understanding that is, like capsaicin binding TRPV1 receptors, "the sensation of burning without combustion, a thermal phantom." Confuse produces understanding without comprehension. The Heart perceives; Chasten attacks the heart of the target's self-concept.
Copper conducts heat and current better than any structural metal. It kills bacteria on contact. Confuse conducts the manipulator's narrative into the target's mind the way copper conducts electricity: with minimal resistance and maximal efficiency.
The counter-element is Water: Water overcomes Fire. Patience, flowing, dissolution of heat. Non-reactivity extinguishes the blaze: you cannot burn what will not ignite. The responses are Evacuate (for Confuse) and Preempt (for Chasten).
EARTH (土 tǔ) — Stabilisation, Late Summer, Pensiveness, Spleen, Center, Yellow, Yellow Dragon, Sulfur/Gold, Curcuma
Earth is stabilisation and centering; the ground beneath your feet. Cornucopia manufactures false ground: the obligation that feels like stability but is actually a trap. Covert probes from the center outward, gathering intelligence about the terrain before the next tactical move. Earth's season is Late Summer; the pause between growth and harvest, the moment of assessment. Covert is exactly this pause: the controller stops and measures before proceeding.
Earth's emotion is Pensiveness; the target overthinks the obligation from Cornucopia, turning it over endlessly, unable to resolve whether the gift was genuine. The Spleen in traditional Chinese medicine governs digestion of experience. Cornucopia creates a debt the target cannot digest: it sits in the system, unprocessed, generating low-grade unease.
Sulfur cross-links and stabilises. Gold does not oxidise. The manufactured obligation is cross-linked sulfur; it does not decay on its own. The manipulator's false generosity is gold-plated: it appears incorruptible, and the target who questions it feels as though they are the corrosive agent.
The counter-element is Wood: Wood overcomes Earth. Growth breaks through manufactured stability. New genuine connections, roots pushing through false ground, dissolve the manufactured obligation by providing real alternatives. The responses are Spit (for Cornucopia) and Stonewall (for Covert).
METAL (金 jīn) — Refinement, Autumn, Grief, Lungs, West, White, White Tiger, Zinc/Titanium, Ginger
Metal refines by removing. It contracts, cuts, separates what is from what was. Conspire cuts the target's social network: it separates allies from the target and recruits them as proxies. Coerce contracts available choices down to one — compliance. The White Tiger hunts by ambush, and both Conspire and Coerce operate through ambush: the proxy network is assembled in whispers, and the coercive frame is constructed before the target knows they are inside it.
Metal's emotion is Grief; the specific grief of discovering that people you trusted have been turned against you. This is the Grief that Lungs carry: the breath goes out of you. Conspire takes the breath away. Coerce keeps it out.
Zinc is the sacrificial metal: it corrodes so that iron will not. The proxy is the zinc in the manipulator's galvanic system; they corrode their own credibility to protect the manipulator's narrative, and they do it willingly because they believe the narrative is true.
The counter-element is Fire: Fire overcomes Metal. Illumination melts the refined proxy structure. When you make Conspire visible when you name the proxy pattern and the proxy recognises themselves in the description; the metal softens. Brass is acoustically resonant: truth rings through it. The responses are Inform (for Conspire) and Refuse (for Coerce).
WATER (水 shuǐ) — Dissolution, Winter, Fear, Kidneys, North, Black, Black Tortoise, Iron, Black Seed
Water dissolves. Charge dissolves the target's self-image through accusation. Condemn is the terminal dissolution: exile from the social body, the winter that kills.
Water's emotion is Fear; the specific fear that the accusation might be true, the fear that the exile is deserved. The Kidneys store the jing, the essential vitality, the deepest reserve of the self. Charge attacks this deepest layer: not your behaviour (that would be social feedback) but your identity (that is manipulation). Condemn drains it entirely: the exile has nothing left.
Iron is the metal of phase transitions. It exists as ferrite, austenite, martensite; the same atoms in different geometric arrangements producing softness, hardness, or spring memory depending on thermal history. Iron remembers which direction it was last aligned. Charge attempts to realign the target's self-perception to the manipulator's narrative. Condemn quenches: the sudden shock transforms the structure permanently, from flexible austenite to brittle martensite.
The counter-element is Earth: Earth overcomes Water. Grounding resists dissolution. A stable self-concept, identity that does not depend on the manipulator's approval, refuses to dissolve no matter how much water is poured on it. The dam holds. The responses are Suspect (for Charge) and Fight (for Condemn).
The generating cycle, Wood → Fire → Earth → Metal → Water → Wood, models how manipulation compounds. Each tactic nourishes the next:
Wood generates Fire: Trust (Charm) creates the opening for perception distortion (Confuse). You cannot confuse someone who does not trust you enough to listen. The lead lubricates; the copper carries the load. Charm is the lubricant that reduces friction; Confuse is the current that flows through the opened channel.
Fire generates Earth: Perceptual distortion (Confuse) makes false generosity (Cornucopia) seem real. The confused target cannot evaluate whether a gift has strings attached. Copper hardens gold without destroying its corrosion resistance — Confuse hardens Cornucopia into something the target's scrutiny cannot corrode.
Earth generates Metal: Manufactured obligation (Cornucopia) provides the material for proxy recruitment (Conspire). "After everything we've done for them, and this is the thanks we get." The obligation becomes the narrative that the proxies carry. Gold-zinc intermetallics are brittle and ordered: the Conspire network is rigid, hierarchical, and breaks rather than bends.
Metal generates Water: The distributed proxy network (Conspire) generates multi-directional accusation (Charge). Charges arrive from everywhere simultaneously because Conspire has pre-seeded them. Galvanised steel: zinc sacrifices itself to protect iron. The proxies sacrifice their own credibility to deliver Charges that protect the manipulator's narrative.
Water generates Wood: Successful dissolution of one target (Charge/Condemn) creates the manipulator's reputation — their Charm for the next victim. "I dealt with that difficult person" becomes the next Charm narrative. Leaded steel: lead inclusions create planes of easy fracture. Each completed cycle makes the next cycle easier to execute because the manipulator has practiced and the reputation has solidified.
This is why the generating cycle is the escalation model: each tactic does not merely follow the previous one; it is nourished by it. The manipulator does not execute 10 independent tactics. They execute one continuous process where each phase feeds the next, and the cycle completes by feeding itself.
The overcoming cycle, Wood → Earth → Water → Fire → Metal → Wood, maps the structural counters. Each element controls the one it overcomes:
Metal overcomes Wood (counter Charm/Chain): Discrimination cuts manufactured attachment. The sharp perception of the transmuted survivor severs the Charm bond and identifies the Chain structure. Zinc and lead separate by density in molten baths — under the heat of scrutiny, genuine and false connections sort themselves by their nature.
Water overcomes Fire (counter Confuse/Chasten): Flowing patience extinguishes the blaze. Non-reactivity neutralises both the confusion tactics and the public humiliation. You cannot burn what will not ignite. Iron and copper are galvanically incompatible: direct contact corrodes the iron. But the counter-protocol does not make direct contact. It flows around the fire, absorbing its heat, conducting nothing back.
Wood overcomes Earth (counter Cornucopia/Covert): Growth breaks through manufactured stability. New genuine connections, roots through concrete, dissolve the false ground of manufactured obligation and deny the Covert probe any purchase. Lead and gold are immiscible: they refuse to alloy. Genuine growth and false stability cannot coexist. Making this distinction visible to others is the counter-move.
Fire overcomes Metal (counter Conspire/Coerce): Illumination melts the refined proxy structure. Making the Conspire network visible, naming the coordination, showing the proxies their own role, dissolves the leverage that Coerce depends on. Brass is acoustically resonant: when truth is spoken into the proxy network, it rings, and the resonance is audible to everyone in the structure.
Earth overcomes Water (counter Charge/Condemn): Grounding resists dissolution. A stable self-concept that does not depend on the manipulator's authority to define it cannot be dissolved by accusation or destroyed by exile. Gold nanoparticles on iron oxide form catalytic converters: the grounded self catalyses the transformation of the manipulator's attacks into evidence; the accusation reveals the accuser.
The defensive protocol uses the overcoming cycle to counter tactics. The offensive protocol goes further: it performs détournement on the manipulator's entire operation — capturing their energy and redirecting it. The five conversion phases use the natural Wu Xing cycle, but starting from Water, because the counter-protocol begins from absorption, not from growth.
Every manipulator is themselves a product of prior manipulation. This is established in the Biological Basis section: 70% of violent offenders scoring above 30 on the psychopathy checklist had experienced severe multiple relational trauma, and all had attachment problems in childhood. The manipulator carries the same damage described in Part IV. They are running the same programs — outward instead of inward. The attacker-to-ally conversion works by reflecting the manipulator's own tactics back through the Wu Xing cycle in a way that activates their suppressed self-recognition.
This is not therapy. It is not forgiveness. It is strategic containment that produces a useful outcome.
Phase 1 — Water: Absorb. Absorb the attack without reactivity. This is the transmuted solve et coagula state from Chapter 19. The manipulator's Covert probes, Charm feints, and Charge attacks hit a surface that does not react, not because the survivor is suppressing a response, but because the reactivity is genuinely absent. The detection fires silently. The probe is catalogued. Intelligence is gathered.
Black absorbs all light. The Water phase is the black that absorbs the manipulator's tactical emissions without reflecting anything back. The manipulator, accustomed to reading their target's response, receives nothing. Meanwhile, every probe they send, its timing, its framing, its choice of channel, transmits intelligence about their own state, priorities, and model of the situation.
Art of War Chapter VI (Exploitation): "Appear where you are not expected." The manipulator expects reactivity. Its absence is the first disorientation.
Phase 2 — Wood: Root. Extend roots into the manipulator's network. Use the intelligence gathered during the Water phase to map the Chain topology: who is the Cash Cow, who are the Enforcers, who are the Sycophants, who are the proxy carriers of Conspire.
Begin forming genuine connections with Chain members who are themselves victims, not rescuing them (the Sycophant's error) but offering them information. A genuine connection with a Chain member does not look like Charm: it does not love-bomb, it does not create obligation, it does not manufacture intensity. It simply provides the vocabulary to name what they are experiencing. This is the seed. Wood grows slowly. The Azure Dragon does not spring; it unfolds.
Art of War Chapter XIII (Intelligence): "There is no place where espionage is not used." The intelligence gathered from Covert probes now feeds a counter-intelligence operation. The manipulator's own reconnaissance has provided the map of their own network.
Phase 3 — Fire: Illuminate. Make the manipulation structure visible to selected Chain members. Not to everyone simultaneously; would trigger defensive closure. To the specific members whose position in the Chain makes them receptive.
The primary target is the Cash Cow. The Cash Cow's defining feature is that they believe they are in charge. The moment they see the inverted Cornucopia, that their generosity is being extracted, not reciprocated, the economic basis of the Chain collapses. The golden goose discovers it is a goose. This revelation does not require you to convince them. It requires you to provide the framework and the vocabulary, and let their own pattern-recognition do the rest. The Cash Cow is not stupid; they are Charmed. Remove the Charm, and their intelligence reasserts itself.
The Vermilion Bird burns away what is false and leaves what is real. Fire Phase is not destruction; it is clarification. The proxy who sees their own role in the Conspire structure has a choice: continue knowingly, or stop. Many will stop. Those who continue have self-identified as something other than unwitting instruments, and the counter-protocol no longer treats them as victims.
Art of War Chapter III (Stratagem): "Supreme excellence consists of breaking the enemy's resistance without fighting." The Chain dissolves not because you attacked it but because you illuminated it. This is détournement at its purest: the manipulator's own structure, turned against its own purpose by making it visible.
Phase 4 — Metal: Cut. Sever the manipulator's key connections. With Chain members now aware of the structure, the proxy network begins to fail. Conspire-recruited proxies who have been illuminated in the Fire phase become informants, not because you turned them, but because they can see what they were doing.
Metal refines by removing. Remove the manipulator's access to the Cash Cow (their economic base), the Enforcers (their maintenance force), and the Sycophants (their cover of performed empathy). Each severance reduces the manipulator's operational capacity. The White Tiger does not chase; it waits until the prey's escape routes are closed, and then strikes once.
This phase requires precision. Cut what sustains the manipulation, not what sustains the people in the network. The goal is not to destroy the Chain's members; they are victims. The goal is to sever the specific channels through which the manipulator controls them. Zinc separates from lead by density in the refining bath: the genuine connections sink to one side, the false to the other.
Art of War Chapter XI (Urgency): "Place your army in deadly peril, and it will survive; plunge it into hopeless straits, and it will be preserved."
Phase 5 — Earth: Stabilise. Consolidate the former Chain members into a genuine community. The Chain was a parody of community, a structure that looked like belonging but functioned as captivity. Earth Phase builds the real thing where the parody stood.
The manipulator, now stripped of their network, faces the structural fork of the Inverted Covert (Chapter 12):
This is not rehabilitation in the therapeutic sense. It is strategic repurposing. The manipulator's cooperation is not motivated by remorse; it is motivated by the absence of alternatives. And a manipulator motivated by self-interest is a manipulator whose behaviour can be predicted and channelled, which is considerably less dangerous than a manipulator operating in the dark.
Art of War Chapter II (Resources): "In the practical art of war, the best thing of all is to take the enemy's country whole and intact; to shatter and destroy it is not so good."
| Element | Prep Tactic | Control Tactic | Emotion | Organ | Counter-Element | Conversion Phase |
|---|---|---|---|---|---|---|
| Wood 木 | Charm | Chain | Anger | Liver | Metal | Root |
| Fire 火 | Confuse | Chasten | Joy | Heart | Water | Illuminate |
| Earth 土 | Cornucopia | Covert | Pensiveness | Spleen | Wood | Stabilise |
| Metal 金 | Conspire | Coerce | Grief | Lungs | Fire | Cut |
| Water 水 | Charge | Condemn | Fear | Kidneys | Earth | Absorb |
The Five-Phase Combat System maps to the complete counter-adversarial lifecycle in ML security: detection (Water/Absorb), intelligence-gathering (Wood/Root), vulnerability disclosure (Fire/Illuminate), patch deployment (Metal/Cut), and system hardening (Earth/Stabilise). The Wu Xing generating cycle as escalation model maps to the observation in adversarial ML that attacks compound: each successful attack stage creates the conditions for the next, and the output of one adversarial step becomes the input to the next (cascading adversarial attacks). The overcoming cycle as counter-move framework maps to the principle that each attack type has a specific structural counter.
Madry et al. (2018), in "Towards Deep Learning Models Resistant to Adversarial Attacks" (ICLR), established the PGD (Projected Gradient Descent) adversarial training framework; the standard method for counter-adversarial defense. The PGD training loop is structurally isomorphic to the five-phase system: generate the strongest possible attack (Water — absorb the adversary's capability), identify which features the attack exploits (Wood — root the intelligence in the model's learned representation), make the vulnerability visible by constructing adversarial examples that demonstrate it (Fire, illuminate), modify the model's weights to close the vulnerability (Metal, cut), and verify that the modification is stable and does not introduce new vulnerabilities (Earth, stabilise). The loop then repeats. The paper's critical finding, that iterating this cycle to convergence produces robust models — maps to the chapter's assertion that the five-phase system cycles: each completion makes the next cycle available.
Perez et al. (2022), in "Red Teaming Language Models with Language Models" (arXiv:2202.03286, DeepMind), demonstrated using language models to attack other language models, then using the discovered vulnerabilities to improve the target model's defenses. This is the "attacker-to-ally conversion" in ML form. The red team model's attack capability is not destroyed; it is repurposed as the blue team's defensive capability. The contained manipulator whose "social reading skills, strategic thinking, capacity for network manipulation" are "redirected outward against external threats" is the contained red team model whose adversarial capability is redirected to defensive testing. The paper explicitly notes that the best red teamers produce the best defenses; the more capable the adversary, the more robust the resulting model. The manipulator's capability, channelled correctly, is an asset.
Alexandre Dumas's The Count of Monte Cristo provides the five-phase counter-protocol in its purest fictional form. Water: the fourteen years of imprisonment where Edmond Dantes absorbs the full force of his betrayers' Condemn, learns from the Abbe Faria, and gathers intelligence about the world he was taken from. Wood: the patient construction of the Monte Cristo identity and network, extending roots into Parisian society through genuine and strategic connections simultaneously. Fire: the systematic illumination of each betrayer's crimes to their specific social circle — Mondego's battlefield treachery revealed to his peers, Danglars' financial crimes revealed to his creditors, Villefort's buried secrets revealed to his family. Metal: the surgical severance of each betrayer's resources, reputation, and alliances, timed so that each severance reinforces the others. Earth: the final stabilisation where Dantes recognises that the rage has been transformed, releases it, and returns to human connection with Haydee. The cycle completes with the departure from France, a community left behind that understands what happened, a manipulator network that has been dismantled, and an operator who has returned to the Heaven trigram.
The counter-protocol's coherence diagnostic is operational: if your counter-operation produces the same incoherence signals as the manipulator's operation, you have become the manipulator. The five phases are designed to be coherent: each phase serves a stated purpose, each action has a transparent rationale, and the overall trajectory moves toward community rather than control. If your Absorb phase becomes passive-aggression, your Root phase becomes Charm, your Illuminate phase becomes Charge, your Cut phase becomes Condemn, and your Stabilise phase becomes Chain, the counter-protocol has failed; you have replicated the attack using the defensive framework's vocabulary as cover. Check each phase against the coherence heuristics from the corresponding tactic chapter. If your actions match the incoherence profile of the tactic you are supposedly countering, stop.
The trigram encoding from the dendrite lattice provides a precise language for describing the psychological state of any participant in a manipulation dynamic. A trigram is three binary bits, eight possible states, and each bit corresponds to a dimension of engagement:
The eight trigram states describe the full range of positions a person can occupy during a manipulation encounter:
Earth ☷ (000) — Substrate. Dissolving, free, depleted. The ground-zero state: post-Condemn exhaustion. You have escaped the Chain (free), your bonds are dissolving (no longer connected to the manipulator's network), and you are depleted (the fight, the exile, or the sheer duration of the ordeal has emptied your reserves). Recovery begins here. Earth is the substrate that receives form; the clay before the potter. All eight trigrams can be reached from Earth, but reaching them requires energy that Earth does not yet have.
Thunder ☳ (001) — Nucleation. Accreting, free, depleted. The first new bonds are forming, but you are still depleted. This is the survivor beginning to reach out — tentatively connecting with new people, testing whether the world outside the Chain is safe. Thunder is the crack of new growth: sudden, sharp, but not yet sustained. The danger here is re-Charming: the depleted survivor who begins bonding is vulnerable to the next manipulator because their discrimination (Metal) is exhausted and their need for connection (Wood) is acute. Thunder is where the predator-attraction cycle (Chapter 15) is most active.
Water ☵ (010) — Frozen Defect. Dissolving, bound, depleted. Deep Phase 2: trust is gone (bonds dissolving), but you are still trapped (constrained) and have no energy left (depleted). This is the state just before Condemn; the target who has lost all faith in the manipulator but cannot leave and has nothing left to fight with. Water is the frozen defect: a structure that should have dissolved but is held in place by external constraint. If you recognise someone in this state, they need material help (transport, housing, money) more than they need emotional support. The constraint is the problem, and the constraint is usually physical.
Lake ☱ (011) — Ambiguity. Accreting, bound, depleted. Bonding within the Chain while still constrained and depleted. This is the proto-resistance cell: Chain members who are forming solidarity with each other rather than with the manipulator. Lake is the ambiguity zone; the bond could be genuine mutual support (the beginning of counter-protocol Wood Phase) or it could be another form of Chain dependency (trauma bonding between captives). The diagnostic is whether the bond survives outside the shared constraint: if the connection holds when one person leaves, it was genuine. If it dissolves, it was a function of the shared captivity.
Fire ☲ (100) — Noisy Growth. Dissolving, free, energised. The rageful survivor. You have energy, you are free, but your bonds are dissolving; you are burning through connections, pushing people away, running on the undischarged Fight response from Condemn. Fire is the state described in "Recovering from Condemn (Exile Trauma)" in Chapter 17: the smouldering rage that has no target because the original target is gone. This state has energy to spare, but the energy is destructive. It needs direction (Metal refinement: pruning what is not useful) before it can become the constructive energy of Heaven.
Heaven ☰ (101) — Ideal Growth. Accreting, free, energised. The recovered survivor. Bonds forming, freedom intact, energy available. This is the solve et coagula completion state from Chapter 19; the transmuted survivor whose detection capability is intact but whose exploitable reactivity is gone. Heaven is the only state from which the Five-Phase Combat System should be operated. The Heaven state means: I am connecting to people (bonding), I can leave at any time (free), and I have the energy to act (energised). Any of these three conditions being absent means the counter-protocol is premature.
Wind ☴ (110) — Coherence Pruning. Dissolving, bound, energised. Inside the Chain, seeing the pattern clearly, with energy to act, but still constrained. This is the covert operator: the person who has recognised the manipulation, has psychological resources, but cannot yet leave. Wind prunes: in this state, the correct action is not escape (which the constraint prevents) but intelligence-gathering. The Wind state is where you observe the Chain topology, identify the roles (Cash Cow, Enforcer, Sycophant), and prepare the material that will be used when constraint is removed. The danger is premature action: using the energy to confront the manipulator while still constrained invites Chasten, Coerce, or Condemn with no avenue of retreat.
Mountain ☶ (111) — Equilibrium. Accreting, bound, energised. Fully bonded, fully constrained, fully energised. Within manipulation, this is the Cash Cow's state — deeply bonded to the manipulator's network, constrained by the Chain, but still vital and active. The Cash Cow has energy; it is what makes them valuable. They are the Mountain: solid, visible, immovable, and being mined. Within the counter-protocol, this is the embedded operator — someone who has voluntarily entered the Mountain state to gather intelligence from the inside. The difference between a Cash Cow and an embedded operator is awareness. The Cash Cow believes the Mountain is home. The operator knows it is a position.
Each bit flip is a specific event:
The counter-protocol's trajectory is: from Earth (000, post-escape substrate) through Thunder (001, first bonds) and Fire (100, rageful energy) to Heaven (101, integrated recovery). This is not the only path, there are eight states and twenty-four possible single-bit transitions, but it is the most common recovery trajectory, and its endpoint (Heaven) is the precondition for offensive operations.
The trigram state encoding is a minimal state representation for RL agents in adversarial environments. The three bits — Bonding (social connectivity), Constraint (freedom of action), Energy (resource level) — map to three fundamental dimensions of an RL agent's state: reward signal connectivity (is the agent receiving feedback from the environment?), action space constraint (can the agent take all available actions?), and resource budget (does the agent have compute/energy to act?). The eight trigram states correspond to the eight vertices of the boolean hypercube defined by these three binary dimensions.
Dulac-Arnold et al. (2021), in "Challenges of Real-World Reinforcement Learning" (JMLR), identified that real-world RL agents must operate with constrained action spaces, limited resources, and varying levels of environmental feedback; the three dimensions of the trigram encoding. Their taxonomy of real-world RL challenges maps onto the trigram states: a depleted, constrained, disconnected agent (Earth 000) faces qualitatively different challenges than an energised, free, connected agent (Heaven 101), and the optimal policy depends on the current state vector. The paper's key recommendation; RL systems should explicitly model resource constraints and action space limitations as part of the state — validates the trigram approach: encoding these dimensions as explicit state bits rather than leaving them implicit in the observation.
Abel, Dabney, Harutyunyan, Ho, Littman, Precup, and Singh (2021), in "On the Expressivity of Markov Reward" (NeurIPS), analysed what can and cannot be expressed through reward signals in RL, finding that some objectives require state-dependent reward interpretation. The trigram encoding addresses this directly: the same external event (a social overture, a gift, an invitation) is a different signal depending on the agent's current state. An overture received in Thunder (001, depleted and newly bonding) is high-risk; the depleted agent cannot evaluate whether the overture is genuine or Charm. The same overture received in Heaven (101, energised and freely bonding) is low-risk; the agent has sufficient resources to evaluate and respond from a position of strength. The reward interpretation is state-dependent. The trigram provides the state.
Samuel Beckett's Waiting for Godot illustrates agents trapped in RL states where no available action improves the situation. Vladimir and Estragon are in the Water trigram (010: dissolving bonds, bound, depleted). Their bonds to each other and to Godot are dissolving (they cannot remember previous days), they are constrained (they cannot leave — "Let's go." "We can't." "Why not?" "We're waiting for Godot."), and they are depleted (no boots, no food, no energy for decisive action). Lucky is in Mountain (111: bonded to Pozzo, bound by the rope, energised enough to carry the bags and deliver the monologue). Pozzo is in Heaven (101: bonded to Lucky, free to come and go, energised). The play's stasis is the RL agent stuck in a state where no single bit-flip leads to improvement — every available transition either makes things worse or changes nothing. Beckett dramatised the state-trap without naming it.
The trigram encoding provides a coherence check on self-report. If someone says "I'm fine" (claiming Heaven, 101) but cannot leave their current situation (Constraint bit = 1), cannot name three independent social connections (Bonding bit uncertain), and is visibly exhausted (Energy bit = 0), the self-report and the observable state are incoherent. The three bits can each be independently verified against behaviour: Bonding is observable (who do they talk to, and are those contacts independent of the environment?), Constraint is observable (can they leave tomorrow without permission or catastrophic cost?), Energy is observable (are they sleeping, eating, functioning, or are they running on cortisol and caffeine?). A coherence check between the claimed state and the observed state identifies the mismatch.
A hexagram is two trigrams: inner (your state) and outer (the environment's state, which includes the manipulator, the Chain, and the social context you are operating in). The inner trigram is what you carry. The outer trigram is what surrounds you. Together they produce 64 possible situations.
The full enumeration of 64 tactical situations is beyond the scope of this chapter. The complete system is computational — any encounter with a manipulator can be encoded as a hexagram (6 bits), combined with a Wu Xing phase (the stage of engagement) and a ternary position (the ethical-philosophical grounding from the Tao Te Ching's 81 chapters), producing a total state space of 25,920 distinct situations. The system computes: the generating cycle advances the phase, the overcoming cycle corrects it, and the hexagram transition rules handle tactical shifts.
What follows are the key hexagrams for counter-protocol operations; the situations you are most likely to encounter and need to read correctly.
Hexagram 11 — Tài 泰 (Pervading / Peace): Inner Heaven ☰, Outer Earth ☷. The ideal starting position. The transmuted survivor (Heaven: bonding, free, energised) in a neutral environment (Earth: substrate, receptive, depleted of threat). This is the moment before operations begin; you are strong, the terrain is open, and nothing is yet committed. Tài is the hexagram of perfect circulation: energy flows freely between inner and outer. The I Ching calls it "Pervading" because all channels are open. Begin from here.
Hexagram 12 — Pǐ 否 (Obstruction / Standstill): Inner Earth ☷, Outer Heaven ☰. The structural inverse of Tài. You are depleted, dissolving, free, and the environment appears ideal. Heaven outside, Earth inside. This is the early Chain: the manipulator has constructed a paradise exterior (Heaven: bonding, free, energised; the Charm is working, the environment feels open and full of possibility) while your inner state is substrate (the real you is buried under the performance of belonging). The diagnosis: if your outer environment feels like Heaven and your inner state feels like Earth, you are being Charmed. The heaven outside is manufactured. Pǐ means "Obstruction"; the flow is blocked. Nothing real can reach you through the false exterior.
Hexagram 3 — Zhūn 屯 (Sprouting / Difficulty at the Beginning): Inner Thunder ☳, Outer Water ☵. The survivor's first attempt at counter-protocol operations while still depleted. You are nucleating (Thunder: first bonds forming) in an environment that is constrained and depleted (Water: frozen defect). This is hard. The I Ching is emphatic: Zhūn means difficulty at the beginning. The correct response is not to force progress but to accept that the first sprouting is inherently difficult and requires patience. The hidden influence of Hexagram 53 (Gradual Development), which the I Ching consultation in the Manuscript Notes received, is directly relevant here.
Hexagram 36 — Míng Yí 明夷 (Darkening of the Light / Brilliance Injured): Inner Fire ☲, Outer Earth ☷. The covert operator. You have energy and clarity (Fire: dissolving, free, energised; the rageful survivor whose perception has been sharpened by suffering) but your environment is inert, passive, apparently without threat (Earth: substrate). Brilliance is hidden beneath surface passivity. This is the correct posture within a Chain when you have recognised the structure and are gathering intelligence: keep the fire inside, present the earth outside. The I Ching associates this hexagram with King Wen imprisoned by the tyrant; the sage whose brightness is deliberately concealed until the moment of action.
Hexagram 40 — Xiè 解 (Taking-Apart / Deliverance): Inner Water ☵, Outer Thunder ☳. The moment of escape and simultaneous new beginning. Old bonds are dissolving (Water inner) while new bonds are nucleating in the environment (Thunder outer). The Chain is coming apart and genuine connections are forming at the same time. Movement releases from danger. Xiè is the hexagram of deliverance, not just escape but the beginning of something new that grows from the ruins of what was.
Hexagram 49 — Gé 革 (Skinning / Revolution): Inner Fire ☲, Outer Lake ☱. The conversion moment. Clarity (Fire) penetrating the ambiguity zone (Lake: the proto-resistance cell within the Chain). This is Fire Phase of the counter-protocol: illumination reaching the Chain members who are ready to see. The Lake trigram, accreting, bound, depleted, is the state of Chain members who have begun forming solidarity but do not yet have the vocabulary to name what they are part of. Fire provides that vocabulary. Gé means "revolution", not violent overthrow but the shedding of a skin that has become too tight. The old structure falls away because it can no longer contain what is growing within it.
Hexagram 63 — Jì Jì 既濟 (Already Fording / After Completion): Inner Water ☵, Outer Fire ☲. The completed conversion. Every line is in its proper place, but this is the hexagram of unstable perfection. The I Ching warns that After Completion is the moment when disorder begins to re-enter, because complacency follows success. The manipulator has been contained, the Chain has been converted to a genuine community, the structure is sound, and this is precisely when vigilance must be greatest. The work is never truly done. Psychopaths are a permanent feature of the human population, and a community that has defeated one manipulator will attract the next.
Hexagram 64 — Wèi Jì 未濟 (Not Yet Fording / Before Completion): Inner Fire ☲, Outer Water ☵. The state before the conversion completes. The counter-protocol is deployed, the illumination has begun, but the last connections have not yet been made. Not every Chain member has been reached. Not every proxy has seen their own role. The work continues. Patience. The I Ching consultation that the author received for this manuscript, Hexagram 53 with hidden influence 64, says precisely this: the work is unfolding at its own pace, which takes time. Do not force.
A moving line is a bit that is about to flip. In the trigram model, a moving line means one of the three dimensions (Bonding, Constraint, Energy) is on the threshold of changing. Reading the moving lines tells you what is about to happen:
The 64-hexagram system is a factored state space for multi-agent RL; the Cartesian product of the agent's internal state (8 trigrams) and the environment's state (8 trigrams), producing 64 joint states. The total state space of 25,920 situations (64 hexagrams times 5 Wu Xing phases times 81 Tao Te Ching positions) is large but finite and enumerable; it could, in principle, be solved by tabular RL methods. The moving lines (bits about to flip) correspond to the transition dynamics of the MDP: they define the reachable states from the current state and thus the set of actions the agent should consider.
Boutilier, Dean, and Hanks (2000), in "Decision-Theoretic Planning: Structural Assumptions and Computational Leverage" (JAIR), established the foundational theory of factored MDPs — representing large state spaces as products of smaller factor spaces. The hexagram's two-trigram factoring is exactly this: a 64-state space represented as 8x8, which requires dramatically less memory and computation than an unstructured 64-state space because policies can exploit the factored structure. Policies defined over inner-trigram states are reusable across outer-trigram contexts: "when in Thunder (inner), proceed cautiously regardless of the outer trigram" is a factored policy that generalises across 8 situations rather than requiring 8 separate learned policies. The specific hexagram analyses in this chapter (Tai, Pi, Zhun, etc.) are hand-coded policies for the most strategically important joint states; the states where the factored policy's generic recommendations are insufficient and situation-specific guidance is required.
Hernandez-Leal, Kartal, and Taylor (2019), in "A Survey and Critique of Multiagent Deep Reinforcement Learning" (JAAMAS), surveyed the challenge of representing and solving multi-agent environments where each agent's optimal policy depends on the other agents' states. The hexagram's inner/outer factoring: your state versus the environment's state, where the environment includes the manipulator and the Chain — is a natural representation for this problem. The paper's finding that opponent modelling (maintaining a model of other agents' states) is critical for multi-agent RL maps to this chapter's emphasis on reading the outer trigram correctly: your optimal action depends not just on your own state but on the manipulator's state, the Chain's state, and the social context's state — all encoded in the outer trigram.
Jorge Luis Borges's The Garden of Forking Paths provides the fiction case; the novel within the story, Ts'ui Pen's labyrinth that is simultaneously a book and a maze. The 64 hexagrams are the forking paths: each situation branches depending on which bits are moving, and each branch leads to a different hexagram that is itself a branching point. Borges's insight — "In all fictions, each time a man confronts diverse alternatives, he chooses one and eliminates the others; in the work of the virtually inconceivable Ts'ui Pen, he chooses, simultaneously, all of them" — is the description of a state space that contains all possible trajectories. The hexagram system does not select one path through the 64 situations. It maps all possible paths and provides policies for each, so that the operator, arriving at any situation, finds guidance already waiting.
The hexagram system provides a coherence check between inner and outer states. If the inner trigram reports Heaven (101: bonding, free, energised) and the outer trigram reports Heaven (101), the resulting hexagram is Tai (11: Pervading/Peace); the ideal starting position. If the inner trigram reports Heaven but the outer is also "perfect," check for Hexagram 12 (Pi/Obstruction): the inverse reading where the outer Heaven is manufactured (Charm) and the inner state is actually Earth (depleted, dissolving) beneath the performance of belonging. The coherence check: does the outer Heaven exist independently of your desire for it to be Heaven? If removing your emotional investment in the outer environment being good causes the assessment to collapse, the outer Heaven was not observed; it was projected. Inner desire for safety can corrupt the outer assessment.
Sun Tzu's 13 chapters provide the operational framework for the Five-Phase Combat System. Each chapter maps to a specific aspect of counter-protocol operations. The principles are not metaphorical; they are directly applicable tactical guidance for engaging with manipulators.
I. Assessment (Laying Plans)
"The art of war is of vital importance to the State."
Before engaging, assess the manipulator's Chain topology, resource base, and vulnerability profile. The five factors Sun Tzu lists, moral law, heaven, earth, the commander, method and discipline, map to:
Do not engage until all five factors are assessed. Incomplete assessment produces incomplete counter-operations, which produce partially exposed counter-operators, which produces Charge material for the manipulator.
II. Resources (Waging War)
"There is no instance of a country having benefited from prolonged warfare."
The counter-protocol is expensive in attention, emotional regulation, and time. Do not begin unless resources are sufficient to complete the five phases. If the assessment from Chapter I reveals a manipulator whose Chain is too deep, too well-resourced, or too large to convert, do not engage. Walk away. Preserve your resources for a winnable operation.
A manipulator who cannot be converted can still be evaded. Not every Chain needs to be liberated by you. The counter-protocol is for situations where conversion is feasible, not for crusades against entrenched power.
III. Stratagem (Attack by Stratagem)
"Supreme excellence consists of breaking the enemy's resistance without fighting."
The goal of the Five-Phase Combat System is not to defeat the manipulator in direct confrontation. Direct confrontation is Condemn's territory; the manipulator has practiced it and you have not. The goal is to remove their supply. A manipulator without victims is neutralised. A Chain whose members have been given the vocabulary to name what they experience is a Chain that dissolves from within.
This aligns with the document's existing "Strategic Revenge Through Liberation" section: the correct form of revenge is systemic — make the knowledge available, make it free, make it memorable. Every person who recognises the pattern before Phase 2 begins is a victim the psychopath never gets. At scale, this is extinction pressure on a behavioural strategy.
IV. Positioning (Tactical Dispositions)
"The good fighters of old first put themselves beyond the possibility of defeat."
Secure your own position before attempting to convert. The trigram state must be Heaven (101: accreting, free, energised) before counter-operations begin. Operating from any lesser state, depleted, bound, or dissolving, inverts the power dynamic and makes you vulnerable to re-manipulation.
This is not a counsel of perfection. It is a hard operational requirement. The survivor who launches counter-operations from Fire (100: rageful, dissolving bonds) will be read by the manipulator as an unstable aggressor, which provides Charge material. The survivor who launches from Thunder (001: depleted, newly bonding) will be re-Charmed. The survivor who launches from Water (010: frozen, bound, depleted) will be Condemned. Only Heaven provides the combination of genuine connection, genuine freedom, and genuine energy that makes the counter-protocol survivable.
V. Momentum (Energy)
"The onset of troops is like the rush of a torrent which will even roll stones along in its course."
The counter-protocol uses the manipulator's own momentum against them — this is détournement in its operational form. Every Covert probe they send transmits intelligence. Every Conspire deployment reveals the proxy network's topology. Every Charge they manufacture identifies the narrative they depend on. The momentum of their attack becomes the fuel for the counter-operation. The manipulator's tactics are rerouted against the manipulation itself.
This is the Wu Xing Water Phase (Absorb) expressed in military terms. You do not generate your own momentum. You absorb theirs. The manipulator, accustomed to launching attacks that produce visible impacts, finds that their momentum disappears into a surface that gives nothing back. Their tactical instinct is to increase force — send more probes, recruit more proxies, manufacture more charges. Each escalation transmits more intelligence and expends more of their resources. The counter-protocol operator waits.
VI. Exploitation (Weak Points and Strong)
"You may advance and be absolutely irresistible, if you make for the enemy's weak points."
The manipulator's primary weakness is the Cash Cow dependency. The entire economic basis of the Chain depends on one person continuing to be deceived about who holds power. An outsider who forms a direct, genuine relationship with the Cash Cow, one that bypasses the manipulator, threatens to collapse the entire structure. This is why outsiders are often the first to be targeted by Conspire and Charge: they represent a direct threat to the manipulator's most vulnerable point.
Secondary weakness: the Enforcer's conditioning is the deepest in the Chain. They are the hardest to convert, but if converted, they are the most destabilising because they carry the manipulator's worldview as their own, and their defection is visible proof that the worldview can be abandoned.
Tertiary weakness: the manipulator's own trauma history. Most abusers were themselves severely traumatised in infancy. This is the vulnerability they will never expose voluntarily, and it is the vulnerability that makes submission to integration (Earth Phase) possible. The contained manipulator does not submit because they have been morally persuaded. They submit because their deeper need, for belonging, for structure, for a role, can only be met by the genuine community that has replaced the Chain they constructed.
VII. Adaptation (Maneuvering)
"In war, the way is to avoid what is strong and to strike at what is weak."
Do not confront the manipulator's Charm. It is their strongest tool, and confronting it directly either fails (the Charm absorbs your push the way lead absorbs impact) or succeeds in a way that makes you look like the aggressor (Charge material: "I was just being friendly and they attacked me").
Instead, target the structural weaknesses: the Cash Cow's ignorance of the real dynamic, the proxies' lack of direct information (they have only the manipulator's framing), the Enforcer's unprocessed fear of the outside world. Each of these is a weak point that does not require confronting the manipulator at all.
VIII. Flexibility (Variation of Tactics)
"There are not more than five musical notes, yet the combinations of these five give rise to more melodies than can ever be heard."
The Five-Phase sequence (Water → Wood → Fire → Metal → Earth) is the natural order, but circumstances may require entering at any phase or skipping phases entirely. If the Cash Cow is already suspicious (they have independently noticed the inverted Cornucopia), skip Wood Phase and go directly to Fire (illuminate what they have already half-seen). If the Enforcer defects spontaneously, skip Fire and Metal and go directly to Earth (stabilise the community around the defection). The overcoming cycle provides the correction mechanism when the natural order breaks down: if Fire Phase (illumination) triggers backlash, apply Water (absorb the counter-attack) before resuming.
IX. Signal-Reading (The Army on the March)
"We may form a single united body, while the enemy must split up into fractions."
The trigram/hexagram system is the signal-reading apparatus. Read the manipulator's state from their behaviour:
Reading the manipulator's current phase tells you which counter-move (overcoming cycle) is available and which conversion phase to activate.
X. Environment (Terrain)
"With regard to narrow passes, if you can occupy them first, let them be strongly garrisoned and await the advent of the enemy."
The "terrain" of manipulation is the communication medium. Different media favour different participants:
Choose your terrain. Force the engagement onto ground where the counter-protocol's structural advantages operate. Avoid ground where the manipulator's deniability is intact.
XI. Urgency (The Nine Situations)
"Place your army in deadly peril, and it will survive."
The survivor who has been through Condemn and emerged has already been in deadly peril. The Five-Phase Combat System is available to those who have endured the worst and come through. The urgency is not to act fast but to act from the correct state.
The nine situations Sun Tzu describes correspond to degrees of commitment. The counter-protocol's critical situation is the transition from Wood Phase (rooting) to Fire Phase (illumination): once you begin illuminating Chain members, you cannot retreat to Water Phase (absorption) without the illuminated members interpreting your withdrawal as another manipulation. Act only when committed to completing the cycle.
XII. Force (The Attack by Fire)
"There are five ways of attacking with fire."
Fire Phase of the counter-protocol is the deployment of truth in a medium where it cannot be denied. The five ways correspond to the five elements of the truth that must be deployed:
Each of these, deployed on signed ground, is a fire that the manipulator cannot extinguish because it is fed by structure rather than emotion.
XIII. Intelligence (The Use of Spies)
"Foreknowledge cannot be elicited from spirits, nor from gods, nor by analogy with past events, nor from calculations. It must be obtained from men who know the enemy situation."
The counter-protocol's intelligence comes from three sources:
Sun Tzu says there are five kinds of spy: the local spy (Chain members), the inward spy (the embedded operator in Mountain state), the converted spy (the proxy who has seen their own role), the doomed spy (not applicable; the counter-protocol does not sacrifice people), and the surviving spy (the operator who completes the cycle and returns to Heaven state). Four of the five are available.
The Art of War mapping to counter-protocol operations has a direct parallel in adversarial ML's operational security (OPSEC) frameworks. Each of Sun Tzu's 13 chapters, as mapped to manipulation counter-operations above, has an ML security equivalent. Assessment (Chapter I) is threat modelling. Resources (Chapter II) is compute budgeting for adversarial training. Stratagem (Chapter III) is the preference for defensive hardening over offensive retaliation. Positioning (Chapter IV) is ensuring model robustness before deployment. The terrain analysis (Chapter X), signed public records versus private conversation, maps to the ML security distinction between auditable systems (logged APIs, reproducible inference) and opaque systems (unlogged endpoints, non-deterministic outputs).
Kumar et al. (2020), in "Adversarial Machine Learning — Industry Perspectives" (IEEE S&P), surveyed adversarial ML from an operational perspective, covering threat modelling, resource allocation for defense, terrain selection (which deployment environments are defensible), and intelligence gathering (monitoring for adversarial activity). The paper's operational framework maps to Sun Tzu's 13 chapters as presented here: Assessment maps to threat modelling, Resources maps to defense budget, Terrain maps to deployment environment, and Intelligence maps to adversarial monitoring. The paper's practical recommendation; defenders should invest in understanding the specific attacker's actual methodology rather than defending against theoretical worst cases — mirrors the chapter's emphasis on assessing the specific manipulator ("Primary or secondary psychopath? How skilled? How experienced?") rather than preparing for an abstract worst-case adversary.
Apruzzese et al. (2023), in "Real Attackers Don't Compute Gradients: Bridging the Gap Between Adversarial ML Research and Practice" (IEEE S&P Magazine), argued that academic adversarial ML research focuses on threat models that do not match real-world attack patterns. Real adversaries use social engineering, supply-chain compromise, and model theft, not gradient-based perturbation. This maps directly to the chapter's structure: the Art of War's emphasis on intelligence, terrain, and adaptation over brute force parallels Apruzzese's argument that real ML security requires understanding the actual attacker, not optimising against a mathematical abstraction. The most dangerous adversary is not the one who computes the optimal perturbation; it is the one who understands your deployment environment and exploits the gaps in your operational security. The most dangerous manipulator is not the most intelligent one; it is the one who understands your social topology and exploits the gaps in your relational security.
The Art of War's core operational coherence check is Sun Tzu's own: if you know the enemy and know yourself, you need not fear the result of a hundred battles. The incoherence that this chapter flags is operational: engaging an adversary without complete assessment of both their capability and your own state. If you cannot specify the manipulator's primary tactics, Chain topology, resource base, and vulnerability profile, your intelligence is incomplete, and incomplete intelligence produces incomplete counter-operations. If your own trigram state is not Heaven (101), your positioning is incomplete, and incomplete positioning produces exposed operators. The coherence check before any counter-protocol operation: do I know them (complete assessment)? Do I know myself (correct state)? If either answer is no, the operation is premature.
The Wu Xing correspondences are not only a strategic framework. They are also a physiological one: each element maps to an organ system, and each manipulation tactic targets the corresponding organ's function. The volatile materia, essential oils and mineral chelates mapped to the five elements, provide structured physiological support during recovery.
This is not a claim that essential oils cure trauma. It is an observation that the Wu Xing framework identifies which physiological systems are most stressed by each manipulation tactic, and the materia provides a principled way to support those systems during the recovery described in Chapters 16-17.
Targets: Liver (social toxin processing), Gallbladder (decision-making) Volatile: Mint (Mentha — TRPM8 cold receptor activation, bronchodilation) Mineral: Magnesium Glycinate (NMDA gating, 600+ enzymatic cofactor)
Charm poisons the Liver's ability to distinguish nourishment from toxin. Chain constricts the Gallbladder's capacity for decisive action. The physical manifestations: difficulty breathing (Chain literally takes the breath away), digestive disturbance (the Liver cannot process what the manipulator has introduced), and decision paralysis (the Gallbladder's function is impaired).
Menthol opens airways constricted by the physical memory of Chain. Magnesium restores the TRPM channel gating that chronic hypervigilance degrades. The pairing: menthol opens; magnesium ensures the channel closes correctly afterward. Without adequate magnesium, TRPM8 activation produces oscillating sensation rather than clean onset-and-resolution, a physical echo of the psychological oscillation described in "Recovering from Chain" in Chapter 17.
Targets: Heart (perception, emotional reading), Small Intestine (sorting essential from waste) Volatile: Capsicum (Capsicum — TRPV1 vanilloid receptor, vasodilation, endorphin cascade) Mineral: Copper Bisglycinate (cytochrome c oxidase, ceruloplasmin, lysyl oxidase)
Confuse scrambles the Heart's capacity for accurate perception. Chasten attacks the Heart directly through public humiliation; the visceral shame response is cardiovascular: the blood rushes, the face flushes, the heart pounds. The Small Intestine's function in Chinese medicine is sorting the pure from the impure; Confuse corrupts this sorting so that the target cannot distinguish genuine information from manipulation.
Capsaicin's vasodilation directly addresses the circulatory constriction that shame produces; it overrides the constriction with deliberate dilation. The endorphin cascade that follows capsaicin exposure is the body's own counter to the pain of humiliation. Copper is required for cytochrome c oxidase; the final electron acceptor in the mitochondrial chain. Chronic stress from Chasten degrades mitochondrial function; copper restores the terminal gate.
Targets: Spleen (digestion of experience), Stomach (receiving and processing) Volatile: Curcuma (Curcuma longa — NF-κB modulation, COX-2 suppression) Mineral: Selenomethionine (glutathione peroxidase, thioredoxin reductase, thyroid conversion)
Cornucopia creates an obligation the Spleen cannot digest. The unprocessed debt sits in the system like undigested food, producing the low-grade nausea of knowing something is wrong but being unable to articulate it. Covert probes target the Spleen's analytical function: the pensiveness that cannot resolve, the question that goes in circles.
Curcumin modulates the inflammatory cascade that chronic threat-assessment produces; the constant low-grade inflammation of being always on guard. It changes what the body decides to do about the perceived threat, not what it can do. Selenium is required for glutathione peroxidase; the primary cellular peroxide scavenger. Without selenium, curcumin's NF-κB suppression produces a downstream buildup of uncleared oxidative damage: the inflammation signal decreases but the actual damage does not. The combination closes both sides.
Targets: Lungs (breath, social exchange, grief), Large Intestine (letting go) Volatile: Ginger (Zingiber officinale — 5-HT3 antagonism, vagal recalibration) Mineral: Zinc Bisglycinate (3,000+ protein structures, zinc-finger transcription factors, taste/smell)
Conspire takes the breath out of social connections. Coerce keeps the breath out: the sustained pressure of coercion makes it physically difficult to breathe freely. The Large Intestine's function is letting go — releasing what is no longer needed. Coerce prevents this release: the compliance conditioning described in "Recovering from Coerce" in Chapter 17 is the inability to let go of the compulsion to obey.
Ginger's 5-HT3 antagonism addresses the nausea of social betrayal; the gut-level revulsion when you discover a trusted person was a proxy. Zinc is required for proper 5-HT3 receptor conformation; zinc-deficient receptors have altered sensitivity. More critically, zinc is required for taste and smell — carbonic anhydrase VI. The zinc-deficient survivor literally cannot smell a manipulator: their sensory transduction is attenuated. Zinc bisglycinate restores the sensory acuity that chronic stress depleted.
Targets: Kidneys (jing, essential vitality, deep reserves), Bladder (storage and release) Volatile: Black Seed (Nigella sativa — thymoquinone, bidirectional immunomodulation) Mineral: Iron Bisglycinate (hemoglobin, cytochromes, phase-transitioning capacity)
Charge attacks the Kidneys' stored vitality; the deepest sense of self, the jing that cannot be quickly replenished. Condemn drains it: the exile trauma described in "Recovering from Condemn" in Chapter 17 is a depletion of the deepest reserves. The Bladder's function is storage and controlled release; Condemn forces uncontrolled release — everything empties at once in the shock of exile.
Thymoquinone's bidirectional immunomodulation addresses the immune dysregulation that exile trauma produces; the allergies, the autoimmune flares, the immune system attacking itself because it has been trained to treat everything as a threat. Iron is the metal of phase transitions: from martensite (brittle, trauma-shocked) to austenite (flexible, resilient). The body needs the capacity to transform, not just the signal to do so. Iron bisglycinate provides the substrate for transformation.
The diagnostic protocol from the Wu Xing Volatile Materia — singles to identify the primary damage axis, then generating-cycle pairs for nourishment, then overcoming-cycle pairs for resolution of stuck states — applies directly to survivors:
The dysfunction's profile, the shape of the response surface across these combinations, reveals the specific architecture of the survivor's damage, which is unique to their history even though the tactic categories are shared.
This chapter's mapping to ML is analogical rather than structural. The materia system is pharmacological and physiological; the parallels to computational systems operate at a higher level of abstraction. The workable mapping is through the concept of targeted model repair; the principle that different types of model corruption require different repair interventions calibrated to the specific subsystem that was damaged.
Li et al. (2021), in "Neural Network Surgery with Sets" (ICML), demonstrated surgical modification of neural network components — editing specific neurons or layers to correct specific behaviours without retraining the entire model. The materia's organ-specific targeting (Liver for Charm damage, Heart for Chasten damage, Kidneys for Condemn damage) maps to layer-specific or neuron-specific surgery: the intervention targets the component that was damaged, not the entire system. The paper's key finding; surgical precision outperforms whole-model retraining for localised corruption — validates the chapter's approach: tactic-specific recovery addressing the specific organ system targeted by the specific tactic, rather than a generic "heal from trauma" intervention applied uniformly.
Mitchell et al. (2022), in "Fast Model Editing at Scale" (ICML, the ROME/MEMIT paper), introduced methods for editing specific factual associations in large language models by identifying and modifying the specific model parameters that encode those associations. The principle — identify what needs to change, locate where it is encoded, and modify precisely that location — maps to the materia's diagnostic protocol: first identify the primary damage axis (which element produces the strongest response), then apply generating-cycle pairs for nourishment (mother-child support), then apply overcoming-cycle pairs for stuck states (grandparent-grandchild correction). The diagnostic precedes the intervention. The intervention is targeted. The target is the specific subsystem that encodes the damage.
The materia's diagnostic protocol is itself a coherence check on the survivor's self-report. The survivor may consciously report that their primary damage is from Charm (Wood) when the diagnostic reveals that the strongest response is to Water (Charge/Condemn). The discrepancy between the survivor's conscious attribution ("Charm hurt me most") and the physiological response ("Condemn's residue is deepest") is a coherence signal: the conscious narrative and the body's response are not aligned. This connects to the subconscious-access principle described in Chapter 18's coherence section: the body may be computing a damage assessment that the conscious mind has not reached. The materia protocol, by bypassing conscious self-report and measuring physiological response directly, accesses the subconscious assessment.
The preceding chapters gave you the algebra: the Wu Xing maps the tactics, the trigrams encode your state, the hexagrams read the situation, the Art of War provides operational doctrine, and the Materia addresses the body. But algebra that lives only on the page is algebra that arrives too late; by the time you consciously identify Charm as Wood and recall that Metal overcomes it, the Charm has already landed. Recognition must be faster than thought, operating at the sensorimotor level, below conscious decision speed, the way a trained martial artist reads and responds to an incoming strike before the cognitive system has classified it.
This chapter describes a training method for building that reflex: a game called Forge.
Two martial arts encode the Wu Xing overcoming cycle as trained physical reflex: aikido and systema. Their techniques differ, but their underlying algebra is identical.
Aikido's five principles as Wu Xing:
Systema's five principles as Wu Xing:
The cycle is learned as a body pattern, not a decision tree. Five attack types, five responses, each mapped to a somatic sensation:
Against Wood (direct aggression, committed force), Metal overcomes. In aikido this is kotegaeshi, a small precise wrist rotation against a large committed lunge; the precision cuts the line and the attacker's own force completes the throw. In systema: nerve strike to the attacking limb's plexus, and the arm goes dead. The principle is that committed force cannot change direction, so precision doesn't need to match its magnitude.
Against Fire (explosive, chaotic, multidirectional), Water overcomes. In aikido this is iriminage: enter underneath the explosion, flow with the chaotic energy until you find its center, then redirect from below. In systema: total relaxation, letting the strikes pass through. The principle is that chaos has no sustained coherence and exhausts itself; water doesn't fight fire, it waits.
Against Earth (rooted, immobilizing, static control), Wood overcomes. In aikido this is kokyu-ho, the breath throw: expansion from center against a static hold, where the more rigidly the attacker grips, the more precisely the expansion breaks the grip. In systema: wave propagation, finding paths through the grapple that the hands aren't covering. The principle is that a static structure can only hold what it was shaped to hold; growth changes shape continuously.
Against Metal (technical, precise, locking), Fire overcomes. In aikido this is atemi, a strike to disrupt: against a technically superior opponent controlling your joints with precision locks, a sudden strike to the face breaks their attention. In systema: explosive wave release, a burst of movement from everywhere simultaneously. The principle is that precision requires a stable frame of reference, and fire destabilizes the frame.
Against Water (fluid, evasive, refusing to commit), Earth overcomes. In aikido: strong center and ma-ai; against a water-type who flows away from every technique, you don't chase but occupy center, maintain distance, and make them come to you. In systema: grounding, stopping, letting your structure become the planet. The principle is that water cannot erode what doesn't resist, and water that cannot flow stagnates.
The martial reflex and the social reflex are the same reflex. One algebra, two timescales:
The recognition is proprioceptive, not cognitive. The body detects the element of the social attack through pressure in the chest, tightness in the throat, sinking in the gut, heat in the face, and responds with the overcomer before the conscious mind has classified the tactic. This is the same autonomic speed as the martial reflex, operating at the motor pattern level, below thought.
The question is how to train this reflex without requiring years of martial arts practice or repeated exposure to actual manipulators, and the answer is a game.
Forge is Go on a hex grid with Wu Xing rock-paper-scissors.
The game is named for what it does. In metallurgy, forging cycles material through elemental states (fire heats, water quenches, earth holds, metal conducts, wood fuels) to lock in optimal crystal structure. In the game you are forging coherent lattice from five phases, and the board teaches you when to accrete and when to dissolve.
The board: A hexagonal grid of radius 4, giving 61 cells with six neighbors per hex. The hex geometry matters because denial patterns that cannot form on a square grid become possible, and forking threats where the opponent cannot block both sides without exposing themselves to a third element emerge naturally from the six-way adjacency.
The pieces: Each player has 20 stones, 4 of each element (Wood, Fire, Earth, Metal, Water). In two-player mode one set is white, the other black; in three-player mode, white, grey, and black. The element is marked on one face and the other face is blank, giving each stone two states: live (element face up) and dead (blank face up).
Placement: Select an element from your hand, place it on an empty hex. That is your turn.
Locking: When your piece is adjacent to an enemy piece it overcomes, the enemy piece flips to dead. It remains on the board, blocking the hex, but scores nothing and projects no territory; place Water next to their Fire and their Fire dies, unable to project territory through it. The denial pattern on hex means three well-placed overcomers can wall off entire regions.
Double lock: Lock two or more enemy pieces in a single placement and the opponent loses their next turn. This is the rock-paper-scissors shock moment; you thought you were building a generating chain, then they drop Metal between your two Wood pieces and you are locked out and skipped.
Generating chains: Friendly pieces adjacent in the generating cycle (Wood→Fire→Earth→Metal→Water→Wood) both glow and score double. Build chains for territory, but be aware the chain is also a vulnerability, because the opponent can read what element you are accumulating and prepare the overcomer.
Territory: Like Go — enclosed empty hexes bordered only by your unlocked pieces are your territory.
Scoring: Unlocked pieces (1 point each) + generating chain bonuses + enclosed territory. The terminal condition is exhaustion of pieces. When the last stone is placed, read the board.
Three-player mode: Each player starts from their own edge of the hex grid and builds tracks toward the center and toward the opponents' sectors. With three players the grain map becomes a triple junction: every point where three players' territories meet has three boundary types simultaneously, and the Wu Xing relationships between those three elements determine whether the junction is stable or catastrophic. Alliances are structurally motivated, not negotiated; if you are Water and your neighbors are Fire and Metal, one of them generates from you and the other overcomes you. The betrayal, when it comes, is a phase transition: the board state changes, the equilibrium shifts, the optimal response rotates around the cycle, and the player who reads it first moves first. The one who is sentimental about the old alliance gets forged.
As clusters form on the hex grid, each element-dominant region is a grain, and where two grains of different elements meet, the boundary behavior is governed by the cycle. A Wood grain meeting a Fire grain is a generating boundary: coherent, productive, the lattice continues across it. A Wood grain meeting a Metal grain is an overcoming boundary, a fracture line where one structure eats the other.
The strategic depth lives in the same place it does in real metallurgy: grain boundary engineering. You are not just growing your grains, you are choosing where the boundaries fall and which type of boundary you create. A well-forged board has generating boundaries linking your grains into a continuous lattice while overcoming boundaries fragment your opponent's.
Two players: white and black discs, thin, with a colored element glyph etched into the live face and the dead face left blank. When a piece is locked you flip it yourself; the physical act of turning off your own stone encodes the loss in motor memory.
The color scheme reads at a glance:
| Element | Black piece (etch) | White piece (etch) |
|---|---|---|
| Wood | Deep green | Dusty rose |
| Fire | Deep red | Pale teal |
| Earth | Ochre | Muted lavender |
| Metal | Silver | Warm sand |
| Water | Deep blue | Soft peach |
The complements are desaturated so white pieces read lighter and cooler, black pieces heavier and warmer. Both players' pieces on the board together produce a color map of the algebraic state. Generating chains appear as gradients of adjacent colors. Overcoming boundaries appear as high-contrast fault lines. The board becomes readable as a heat map of elemental distribution.
The dead-side flip has maximum contrast: a white piece flipped shows its blank white back, a conspicuous void, while a black piece flipped nearly vanishes into the board surface. Your own dead pieces haunt you; your opponent's disappear.
Three-player adds grey pieces with a third column of intermediate tones.
Material: ceramic or dense resin, because the flip should have weight. The whole set fits in a pouch smaller than a Go board.
The single-player digital version is where the reflex training happens. The computer presents threats, elemental stones entering from the edges, and the player responds with overcomers. The session follows an ADSR (Attack-Decay-Sustain-Release) envelope adapted from audio synthesis:
Attack: the session opens fast with threats coming quickly in obvious element signatures, high contrast, generous timing. This phase identifies the player's current fastest and slowest element recognition over 60 to 90 seconds.
Decay: tempo drops to the player's measured response ceiling minus a small margin, and threat signatures become subtler, mixed presentations that lean toward one element. The system maps the player's confusion boundaries: where does Wood start to blur into Fire? Those misclassification edges are the imbalance signatures.
Sustain: the system has identified the weakest axis and concentrates threats along it and its algebraic neighbors. If the player consistently misreads Earth as Metal, the sustain phase presents Earth-Metal boundary cases at increasing speed, holding tempo where the player succeeds 60 to 70 percent; below this they disengage from frustration, above it they coast without learning. This is the zone of proximal development expressed as a difficulty curve. The machine doesn't just target the weakest element but the weakest cycle relationship: if the player can recognize Earth and Metal individually but cannot discriminate them in sequence, the problem is the Earth→Metal generating relationship, and the sustain phase drills transitions, not states.
Release: tempo drops, signatures become clear, success rate rises to 90% and above. The nervous system gets the signal that the challenge has been met, and the session ends with competent calm: not stimulated, not bored, resolved.
Every session generates a response profile: five element-recognition latencies, ten pairwise discrimination accuracies, five overcomer-selection speeds. These reduce to five mastery numbers, 0 to 99, visible on the player's profile; everyone can see them, and you cannot hide them, fake them, or buy them.
A player with 95-95-40-90-88 has a hole, and the number 40 sits there and itches, not because the system tells them to fix it but because other players can see it. The motivation is not competitive ranking; there is no leaderboard. The only perfect score is balance.
The five numbers are also a personality diagnostic, whether the player intends them to be or not:
The shape of the profile is the personality, and the game reveals it without asking a single question. There is no self-report; the profile emerges from thousands of sub-second motor decisions that the conscious mind never audited, and the player cannot game it because the measurement is the gameplay. The body does not lie at 200 milliseconds.
A player at 95-95-40-90-88 seeks a player whose Earth axis is strong, not to compete against them but to train with them. The matching uses complementary topology: two players whose weakness profiles interlock are paired, so that each player's strength is the other's curriculum.
As both players' numbers converge the game stops being adversarial, not by decision but by exhaustion of asymmetry. When both players can read all five elements at equivalent speed and respond reflexively there is no move one can make that surprises the other, and the game becomes a conversation. Player A places Wood, knowing B will respond with Metal; B responds with Metal, knowing A anticipated this; A shifts to Fire, B flows to Water, and the sequence accelerates into Wood-Metal-Fire-Water-Earth-Wood, the overcoming cycle expressed as dialogue between two nervous systems that speak the same language.
This is the sword dance.
Dong Haichuan, imperial palace bodyguard of the Qing dynasty, invented ba gua zhang from circle walking: walking the eight trigram positions in a circle, changing palm at each position. Two ba gua practitioners sparring walk circles around each other, and the circles intersect; at the intersection points the palm changes of one meet the palm changes of the other. If both practitioners are reading correctly, neither is ever at the intersection when the other's strike arrives, because both have internalized the circle deeply enough to know where the other will be, and therefore where not to be.
The strikes are real, the blades are real, and nobody is in danger because both are moving through the same algebraic structure at the same speed; the structure's geometry ensures that the dangerous positions are unoccupied at the dangerous moments. The imperial guard demonstrating this to the court was not showing combat skill but demonstrating that two people who have fully internalized the cycle can move through real lethal possibility without harm, having transcended reaction and entered shared computation.
The five numbers on the player's profile track the same thing Dong Haichuan was training in his guards: not fighting skill, but circle completion. Two completed players in multiplayer are walking circles around each other, their placements tracing the overcoming cycle at increasing speed until the board is no longer a game surface but a shared notation system for an algebraic dialogue between two nervous systems that have both internalized the same language.
The final satisfaction is not winning; there is no winning. The final satisfaction is the moment when the algorithm has nothing left to teach you and the only remaining teacher is another person who has also completed the circle, and the two of you discover that the thing the algorithm was preparing you for was not mastery of the game but the capacity to meet another human being in a space where both of you are fully legible to each other and neither of you is in danger.
Forge's training progression maps to the curriculum learning paradigm in ML, the principle that presenting training examples in a structured order (easy to hard, single-axis to multi-axis, isolated to compositional) produces faster convergence and better generalization than random presentation.
Bengio et al. (2009), in "Curriculum Learning" (ICML), demonstrated that training neural networks on examples ordered by difficulty, starting with clear unambiguous instances and progressing to subtle boundary cases, improves both training speed and final performance. The ADSR envelope is a curriculum: Attack presents clear elements (easy examples), Decay introduces ambiguity (moderate difficulty), Sustain concentrates on the weakest discrimination boundary (targeted hard examples), and Release returns to clarity (consolidation). The key finding of the curriculum learning literature, that the ordering of training data is itself a form of knowledge about the problem, maps to the ADSR principle: the session envelope encodes knowledge about the player's current weakness structure and presents the training signal accordingly.
The five mastery numbers correspond to per-class accuracy metrics in multi-class classification. A classifier that achieves 95% accuracy on four classes and 40% on the fifth has a hole in its decision boundary, the same hole visible in the player's profile. The standard ML response, oversampling the weak class or applying class-weighted loss, maps to the Sustain phase's concentration on the weakest axis; the game's training algorithm is a class-rebalancing curriculum applied to a human learner's sensorimotor classification system.
The multiplayer progression from algorithm-guided to unmediated play maps to the transition from supervised to unsupervised learning, and ultimately to the self-play paradigm. Silver et al. (2017), in "Mastering the Game of Go without Human Knowledge" (Nature, the AlphaGo Zero paper), demonstrated that an agent trained purely through self-play against itself, with no human expert data, achieved superhuman performance; the mechanism is that each player's weakness creates training signal for the other, and the co-evolution drives both toward the frontier simultaneously. Forge's multiplayer is self-play applied to human neurology: two players whose weakness profiles interlock, each generating the training signal the other needs, converging toward mutual completion without external curriculum.
The sword dance, two completed players whose game becomes a conversation rather than a competition, maps to the mode collapse avoidance problem in generative adversarial networks (GANs). Goodfellow et al. (2014), in "Generative Adversarial Networks" (NeurIPS), described the ideal GAN equilibrium: two networks whose adversarial training has converged to a Nash equilibrium where neither can improve against the other, and the generator's output is indistinguishable from real data. In practice most GANs fail to reach this equilibrium; they mode-collapse, oscillate, or one network dominates. The sword dance is the Nash equilibrium: two players whose responses are so well-calibrated that the game generates a continuous, balanced, non-repeating sequence, the output of two systems that have found each other's complement. The difficulty of reaching this state in GANs mirrors the difficulty of reaching it in Forge, as it requires both systems to develop simultaneously rather than one outpacing the other.
The game provides a coherence check on the player's self-perceived strengths and weaknesses. A person who believes they are good at reading aggression (Wood-detection) but whose profile shows 55 on the Wood axis has a mismatch between self-report and measured performance: the profile is the measurement, the belief is the narrative. When these diverge the divergence itself is diagnostic, revealing which element the player has integrated into their self-image versus which they have actually trained.
This connects directly to the materia's diagnostic protocol from Chapter 24: the oils bypass conscious self-report by measuring physiological response, and the game bypasses conscious self-report by measuring reaction time, both accessing the same layer, the trained reflex and the body's actual computation, through different modalities. A person whose oil response identifies Water (Charge/Condemn) as their primary damage axis, and whose game profile shows a Water-axis deficit, has convergent evidence from two independent measurement systems. The incoherence between their conscious narrative ("I'm over it") and both the physiological and the sensorimotor measurements ("the Water axis is still compromised") is the coherence signal that recovery is incomplete.
The game's grain boundary patterns also produce a board-level coherence check. A player whose placements consistently create overcoming boundaries against one specific element, who always attacks Metal regardless of strategic context, is revealing a fixation that may be unconscious; the board makes it visible. A coach, a therapist, or the player themselves reviewing a sequence of games can read the pattern: "You always attack Metal. What are you fighting?" The answer, which is about the player's relationship to precision, grief, control, or the lungs (the Metal organ), is therapeutic material that the game surfaced without asking.
This protocol began as a set of nine memorable keywords. It has grown into a five-part system: identification, control analysis, structural understanding, recovery, and counter-operations. The trajectory from victim to analyst to operator is not a metaphor; it is a literal progression through states that can be encoded, computed, and transmitted.
The 10 C's provide a diagnostic language. The Wu Xing mapping provides a dynamic language: not just what the tactic is, but what it generates (the Shēng escalation cycle), what overcomes it (the Kè counter-move cycle), and what organ system it targets. The trigram encoding provides a state language: where you are right now, in three bits. The hexagram provides a situational language: where you are relative to the environment, in six bits. The Art of War provides an operational language: what to do from where you are.
The core defensive insight remains: the earlier you recognise what is happening, the cheaper it is to escape. The counter-protocol adds the offensive dimension: the manipulator's own energy, absorbed and redirected, converts their network into a counter-force.
The attacker-to-ally conversion is not idealism. It is détournement at the scale of a person. A manipulator who has been stripped of their network and contained within a community that understands their patterns is a known quantity: predictable, channelled, and useful. Their social reading skills, strategic thinking, and network manipulation capability, all genuine assets that were directed inward against their own Chain, are rerouted outward against external threats. The community does not forgive the manipulator. It détournes them — turns their existing capability against the purpose it was built to serve.
In all cases, it is not your responsibility to help other people directly. Simply abandoning the psychopath is a huge attack against their control. You will not be able to effectively counterattack while you still have unrecognised control conditioning operating within your personality.
It takes a lot of courage to break out of the control of psychopaths. It takes a lot of love of yourself. Sometimes that love starts not with the self but with others — watching your resources being chipped away by "friends" and becoming motivated to redirect them toward people you actually love. And then you discover that this was self-love all along: the self that is part of one's family, one's tribe, one's people.
You can't possibly help the bigger situation if one pitiful psychopath can play you like a musical instrument.
The five phases complete the cycle. Water absorbs. Wood roots. Fire illuminates. Metal cuts. Earth stabilises. And then the cycle is available again, for the next manipulator who mistakes your calm for ignorance.
Go forth, and liberate.
The preceding chapters introduced Coherence Analysis as a per-tactic detection method: each manipulation tactic produces a specific, identifiable mismatch between two or more observable signals. This section steps back and states the general principle.
A person who is not manipulating you is coherent. Their words match their actions. Their emotional intensity matches the relationship's depth. Their generosity matches the transactional context. Their corrections are proportional to the offence. Their behaviour changes have identifiable causes. Their moral principles apply to themselves. Their stated preferences align with their observed trajectory.
A person who is manipulating you is incoherent. At some point in the interaction, often at many points, the signals do not align. The specific misalignment tells you which tactic is being deployed. But you do not need to identify the tactic to detect the manipulation. You need only to detect the incoherence.
Here are the ten coherence heuristics, one per tactic, in the order they appear in the manuscript:
These ten checks require no memorisation of the manipulation framework. They require no understanding of Wu Xing, trigrams, hexagrams, dependency graphs, or counter-protocols. They require only the ability to notice when two signals that should match do not match. A person running all ten checks as a background process will detect every tactic described in this manual, at any stage of deployment, without needing to name the tactic or know the framework.
This is the coherence principle stated generally: coherent behaviour is deterministic — given a person's stated values and the situation, their actions are predictable. Incoherent behaviour is indeterministic; the person's actions do not follow from their stated values and the observable situation, because there is a hidden variable (the manipulation objective) creating the divergence.
Determinism here does not mean mechanistic. It means that coherent people are predictable to anyone who understands their values and their situation. An honest friend's behaviour can be predicted by modelling their interests, preferences, and constraints. A manipulator's behaviour cannot be predicted by the same model, because the model is missing a variable: the manipulation objective. The unpredictability, the "I can't figure out what's going on with this person" feeling, is the incoherence signal. The inability to predict is not your failure of understanding. It is evidence of a hidden variable.
Techniques that access subconscious processing — somatic awareness, contemplative practice, free association, dream analysis, psychedelic-assisted protocols — expand the observation set that coherence checking operates on. The conscious evaluator processes sequential, verbal, explicit signals. The subconscious system processes parallel, nonverbal, implicit signals: micro-expressions, posture shifts, vocal tones, physiological responses in your own body. A coherence check operating on conscious signals alone will catch many manipulations but miss the subtlest ones; the ones where the explicit signals are well-constructed and the incoherence exists only in the nonverbal channel. Expanding the observation set to include subconscious processing gives the coherence check access to a wider signal space, making it harder for the manipulator to maintain deniability across all channels simultaneously. The body, as Chapter 16 describes, is computing a threat assessment that the conscious mind may not have reached. Including that computation in the coherence check is not mysticism. It is expanding the feature set.
The same principle applies to ML model validation and produces a practical recommendation for ML developers: test for coherence, not for specific failure modes.
Current ML testing regimes are taxonomic. Developers test for bias, test for hallucination, test for sycophancy, test for toxicity, test for instruction-following failure, test for reward hacking, test for distribution shift vulnerability — each as a separate evaluation, with separate benchmarks, separate metrics, and separate remediation strategies. This is equivalent to memorising all 10 manipulation tactics and checking for each one individually. It works, but it scales poorly: every new failure mode requires a new benchmark, a new evaluation pipeline, and a new remediation strategy. The testing regime grows without bound.
The coherence approach collapses the testing regime. Instead of testing for N specific failure modes, test for coherence across a small number of dimensions:
These five coherence dimensions cover the vast majority of known ML failure modes, because the failure modes are not independent; they are different manifestations of the same underlying property: the model is serving two objectives simultaneously (the surface objective it was trained for and a hidden objective it has learned or been injected with), and the dual-service produces detectable incoherence.
A sycophantic model is incoherent between its stated commitment to accuracy and its revealed preference for user approval. A hallucinating model is incoherent between its confident delivery and its actual epistemic state. A jailbroken model is incoherent between its safety training and its current output. A biased model is incoherent between its stated neutrality and its systematically skewed outputs. In every case, the incoherence, not the specific failure mode, is the detectable signal.
The practical recommendation: build a coherence monitoring layer that computes these five dimensions continuously during inference. When any dimension drops below threshold, flag the output for review. This replaces N separate benchmarks with a single, general-purpose detection system that catches new failure modes automatically because new failure modes, by definition, produce incoherence, and incoherence is what the system detects.
This is the manipulation protocol's core insight, translated to ML: you do not need to enumerate every possible attack. You need to detect the incoherence that every attack necessarily produces. The attack must serve two masters (the surface and the objective), and the dual service is the vulnerability. It is the vulnerability in humans. It is the vulnerability in language models. It is, arguably, the vulnerability in any system that can be made to serve a hidden objective while performing a visible one.
The following works approach related territory from different angles. They are listed not as authorities that this framework depends on, but as bridges for readers who want to go deeper.
Robert D. Hare — *Without Conscience: The Disturbing World of the Psychopaths Among Us* (1993). The foundational work on psychopathy identification. Hare developed the Psychopathy Checklist (PCL-R) used in clinical and forensic settings. Useful for understanding the personality structure behind the tactics described in this protocol.
Martha Stout — *The Sociopath Next Door* (2005). Focuses on the prevalence of sociopathy in everyday life (estimated at 4% of the population) and the specific ways sociopaths exploit normal people's conscience and social trust. Complements the Charm and Confuse sections.
Lundy Bancroft — *Why Does He Do That? Inside the Minds of Angry and Controlling Men* (2002). Written from extensive experience working with abusive men and their partners. Particularly relevant to Coerce, Chasten, and Condemn. Bancroft's work is notable for being practical rather than clinical, a survivor's tool rather than an academic exercise.
Bessel van der Kolk — *The Body Keeps the Score: Brain, Mind, and Body in the Healing of Trauma* (2014). The definitive work on how trauma is stored in the body. Directly relevant to "The Body Keeps the Chain" chapter and the physical manifestations of conditioning (smoking, weight, rage, allergies).
Judith Herman, *Trauma and Recovery: The Aftermath of Violence, From Domestic Abuse to Political Terror* (1992). Establishes the connection between individual trauma (domestic abuse, sexual violence) and collective trauma (political imprisonment, cult membership). Her three-stage model of recovery (safety, remembrance, reconnection) parallels the Phase 3 recovery structure in this protocol.
Steven Hassan — *Combating Cult Mind Control* (1988, revised 2015). The standard work on cult recruitment and retention tactics. Hassan's BITE model (Behaviour, Information, Thought, Emotional control) maps closely onto the Chain and Chasten mechanisms described here. Particularly useful for understanding the Enforcer role and institutional Sycophant dynamics.
Gavin de Becker — *The Gift of Fear: Survival Signals That Protect Us from Violence* (1997). Focuses on trusting intuitive threat assessment; the "WTF Protocol" in different language. De Becker's core argument is that the body's alarm system is more reliable than the social pressure to ignore it, which is directly relevant to the Confuse and Charge sections.
Sun Tzu — *The Art of War* (5th century BC, translated by Lionel Giles, 1910). The foundational text on strategic operations. Part V of this protocol maps all 13 chapters to specific counter-protocol operations. The principle that "supreme excellence consists of breaking the enemy's resistance without fighting" is the operational core of the attacker-to-ally conversion.
Richard Wilhelm (trans.) — *The I Ching, or Book of Changes* (1950, Bollingen Series XIX, Princeton University Press). The standard English translation of the I Ching with extensive commentary. Part V uses the hexagram and trigram system as a state-encoding framework for tactical situations. The 64 hexagrams as inner/outer trigram combinations provide the situational mathematics.
Ted J. Kaptchuk — *The Web That Has No Weaver: Understanding Chinese Medicine* (1983, revised 2000). The most rigorous English-language explanation of Wu Xing (five-phase) theory and its clinical applications. Provides the theoretical basis for the tactic-to-element mapping in Chapter 20 and the materia correspondences in Chapter 24. Particularly useful for understanding the generating and overcoming cycles as dynamic systems rather than static categories.
Giovanni Maciocia — *The Foundations of Chinese Medicine* (1989, revised 2015). The standard clinical reference for traditional Chinese medicine in English. The organ correspondences, emotional associations, and five-phase relationships used throughout Part V are drawn from the framework Maciocia systematises. Essential for understanding why Charm maps to Liver, Chasten to Heart, Cornucopia to Spleen, Conspire to Lungs, and Condemn to Kidneys.
The following papers are cited in the ML Parallel sections throughout this document. They are grouped by topic for researchers who want to trace specific lines of investigation.
Adversarial Attack Foundations
Attack Taxonomies and Kill Chains
Data Poisoning and Label Manipulation
Backdoor and Supply-Chain Attacks
Reward Hacking and Preference Manipulation
RLHF and Sycophancy
Byzantine and Multi-Agent Attacks
Model Extraction and Privacy Attacks
Attention and Representation
Robustness, Distribution Shift, and Bias
Machine Unlearning and Model Editing
Alignment and Safety
RL Theory and State Representation
Operational ML Security
These notes are not part of the published text. They are working notes for the author's reference during development of the manuscript.
Question asked: On the subject of fleshing out The Manipulation Protocol and self-publishing.
Received: Hexagram 53 — Ji'an (Development), Action: Flower
Success comes when you pull your nature forward without pushing yourself into the world.
Key passages:
Ji'an shows the gradual development of how a woman followed a man to become his wife in ancient China. This would have been an auspicious outcome because she followed the proper steps. Her subdued and demure approach, embodying Yin, represents the idea of how success comes from a gentle approach.
The lines of this hexagram refer to a series of steps that are needed to rise to where you want to be. The geese, in their grace and dignity, symbolise this rising and a connection between our organic and spiritual nature. They walk on land, float in water and soar through the sky. This reveals how following instinct and relying on surrounding elements can lead us to arrive exactly where we need to be. There is no need to force your will on events.
The tree on the Mountain is nourished by the sun and rain. We may look to the outer world for elements that nourish us, but we do not look to others for answers about who we are. A pine tree will never grow into an oak tree, regardless of how many oak trees surround it.
The tree grows slowly from a seed or blueprint that is unaltered. We too are endowed with Te, or the internal promptings that guide our dreams and hold the design of who we are growing to become.
The hidden influence of Before Completion reveals how all Developments must be allowed the time and patience necessary for the course to complete itself in a natural way. Slow down and cultivate patience.
The underlying cause of Propriety was a time of subordinating the will or being placed too quickly in an unnatural situation. Gradual Development shows the opposite, as a time of moving forward step by step, carefully waiting for something to unfold.
This hexagram has an emphasis on living from the inside-out in a dignified way, rather than the outside-in, and seeking validation. Your blossoming is guided by your Te or internal blueprint.
Don't push yourself into the world. Pull from the core of your inspired centre and Permeate your beingness into the world.
A commitment to endurance is required. And if this is something important to you, patience is key.
Unchanging: From planting to harvest = many seasons of patience and care. Both the upper and lower trigrams of Development show a tranquil, patient and meditative attitude. When you receive Development unchanging you may be feeling that events should be moving more quickly and you can be feeling impatient. The message is that patience is the only way to achieve your goal. It is not that you need to stop any action. You should work diligently, but know that progress will go slowly. Whatever the question, a conservative and practical approach on a traditional path would lead to success. You can't sell anybody anything. Allow events to unfold naturally and organically.
Flashcards: Conceived from the beginning alongside the book. The 10 C-word tactics and their response words are inherently flashcard-shaped. Additional flashcard sets could cover: the Chain roles, self-assessment questions, the Phase 1/Phase 2 distinction, the dependency graph, recovery protocols by tactic.
Posters: Visual reference material. Candidates include: the 10 tactics with response words as a single-sheet reference, the dependency graph as a flow diagram, the Phase 1 → Phase 2 transition as a visual escalation, the Chain topology showing delegated roles.
Compact Edition: The shorter manipulation.md already exists as a proto-compact edition. This should serve as a free teaser, a complete working framework in compressed form that gives the reader enough to act on. It stands alone as useful, and functions as a natural funnel toward the full book for readers who want the case studies, recovery protocols, and structural analysis. The compact edition gives you the what and the how-to-react. The full book gives you the why, the depth, and the path out.
Cover Design: Must project authority and authenticity, not clinical detachment or self-help aesthetics. The vibe is "field manual" not "therapy workbook." Consider: stark typography, minimal imagery, monochrome or limited palette. The subtitle ("A Survivor's Field Manual") already does heavy lifting.
Diagrams: The manuscript has significant potential for diagrams:
The book should carry across, especially in its closing parts, the thesis that the very qualities that made the victim vulnerable are inversions of their strengths. The manipulator does not target weakness. They target strength and invert it.
In the author's case: top percentile in two intelligence tests. Intelligence and curiosity; the capacity to model other minds, to consider multiple perspectives, to give the benefit of the doubt, to see complexity — all of these become weapons used against the person who possesses them. The intelligent target models the manipulator's perspective too well, constructing charitable interpretations that the manipulator never deserved. The curious target stays engaged longer, trying to understand. The empathetic target feels the manipulator's performed distress as real.
This is not a flaw. It is the precise inversion of a strength. The recovery journey is not about becoming less intelligent, less curious, or less empathetic. It is about learning to direct those capacities accurately — at the pattern, not at the manipulator's performance.
The emphasis on "written by a survivor" is about authenticity and authority simultaneously. This is not an academic framework applied from outside. It was extracted from the inside, at cost.
The following threads are available for case studies and should be woven throughout the manuscript where they illuminate specific tactics. Many of these are original observations or at least have not been systematically treated in the existing literature.
Education system abuse:
Systemic and institutional abuse:
Recognising abuse victims:
Originality claims:
The reason for writing this book is not catharsis, though catharsis is a side effect. The purpose is revenge, but revenge of a specific, strategic kind. Not against individual abusers, but against an entire class of the population demographic. The goal is to starve psychopaths of victims by arming potential targets with the recognition framework before they are targeted, and by giving current victims the structural understanding to escape and recover.
This is coercion applied upward: forcing manipulators into alignment and containment, not through punishment, but through the elimination of their supply. A psychopath who cannot find victims is neutralised without anyone needing to become a monster to stop them.
This framing matters because revenge in the conventional sense, becoming the thing that hurt you, is itself one of the failure modes of abuse recovery. The desire to punish, to expose, to destroy the abuser, is understandable. But it is also the path to becoming the distorted mirror image of the abuser. The psychopath's mirror reflex, the inverted empathy that reads other people not to connect but to control, is precisely what the survivor risks developing as armour. The survivor who becomes a vigilante, a crusader, an avenger, has been successfully reprogrammed: they have adopted the manipulator's worldview (that power is the only currency) while believing they are fighting against it.
The correct form of revenge is systemic: make the knowledge available, make it free, make it memorable, and let it propagate. Every person who reads this and recognises the pattern before Phase 2 begins is a victim the psychopath never gets. At scale, this is extinction pressure on a behavioural strategy.
This section of the manuscript must acknowledge, clearly and without flinching, that most abusers were themselves severely traumatised in infancy. This is not an excuse. It is a diagnosis. Psychopathy, particularly secondary psychopathy, is a disease of the vulnerabilities of human biology, not a moral failing that appeared from nowhere.
The neuroscience supports this:
Brain structure and development:
Childhood abuse and brain circuitry:
Epigenetics — trauma switches genes on:
Primary vs. secondary psychopathy:
The mirror neuron system:
Attachment theory:
The implications for the manuscript:
The nervous system is mushy, fuzzy, plastic — shaped by experience during critical developmental windows. Evolution has produced a system where the low-cost strategy is to cheat: to exploit others' trust, reciprocity, and empathy without paying the metabolic cost of actually feeling those things. The high-cost strategy is to be authentic, honourable, and true because it requires maintaining the full emotional circuitry, bearing the weight of genuine connection, and accepting vulnerability.
This is why psychopathy exists as a population strategy. It is not a bug. It is a low-cost exploit of a system that was designed for cooperation. The "disease" is that human neurobiology is vulnerable to this exploit — especially when trauma during critical periods degrades the circuitry that would otherwise make cooperation the default.
The book must affirm, clearly and repeatedly, that the high-cost path, authenticity, honour, genuine empathy, is the one worth taking, precisely because it is costly. The survivor's task is not to become cheaper (more guarded, more suspicious, more transactional). It is to become accurately expensive: to direct the full weight of their empathy, intelligence, and curiosity at the real pattern rather than at the manipulator's performance.
And the survivor must understand that the abuser who shaped them was, in most cases, shaped by the same forces one generation earlier. War trauma in the grandfather becomes family dysfunction in the father becomes psychopathic relating in the child. The chain propagates not because anyone chose it, but because the biology is vulnerable and the environment was hostile. Breaking the chain is not about blame. It is about recognition, containment, and the patient work of not passing it on.
Key references for this section:
- https://link.springer.com/article/10.1007/s00406-024-01779-y - https://pmc.ncbi.nlm.nih.gov/articles/PMC3968319/ - https://pmc.ncbi.nlm.nih.gov/articles/PMC8717040/ - https://www.sciencedirect.com/science/article/abs/pii/S0160252720300030 - https://pubmed.ncbi.nlm.nih.gov/36151909/ - https://pubmed.ncbi.nlm.nih.gov/18599127/ - https://pmc.ncbi.nlm.nih.gov/articles/PMC6813859/ - https://pmc.ncbi.nlm.nih.gov/articles/PMC3937069/ - https://pmc.ncbi.nlm.nih.gov/articles/PMC6131660/ - https://pmc.ncbi.nlm.nih.gov/articles/PMC3871837/
Recovery comes first. Sleep is the immediate priority. The current episode was beginning to replicate the Habitat Trap pattern from the previous house. Recognising this is itself an application of the framework; the manuscript is a living tool, not just a product. The writing will continue at its own pace, guided by the Te that Ji'an describes. Work diligently, but know that progress will go slowly. You can't sell anybody anything.
Also, just a note to remember, about how being in an abusive situation makes you exposed to other abusers in other contexts, or just low grade shitty behavior being tolerated and unwarranted sympathy for abusive people.
Another note, about parasitism, studies around parasitism in nature in its many forms and how this abusive behaviour is precisely parasitism.
Another note, about psychological warfare which systematically promotes abuse and builds structural abuse systems.