Chapter 17bTrust in Silicon — The Experimental Programme

The Trust Attractor (Chapter 17) is a thermodynamic hypothesis: a proposed basin toward which coordinating systems tend. Its phase geometry was mapped in Part V’s opening chapters. Here, the predictions meet the substrate where they are easiest to test: language models and AI systems. The experimental programme spans hundreds of experiments across multiple architectures, from representational compression in two-agent games to the geometric signatures of self-referential processing in transformer hidden states. (The consciousness attractor programme alone runs to sixty-three experiments.)

A methodological caveat before the evidence accumulates: the experimental programme presented here spans multiple architectures, substrates, and scales, and most of its results point the same way; where they do not (the reported Sonnet 4 inversion, the G-1 replication), the text says so. None of it has yet been independently replicated. The quantitative thresholds are measurements on particular models and simulations, not established constants. The qualitative direction of the results, that invitation-based coordination outperforms coercion-based coordination, read here as thermodynamically favored, is the claim; the precise numbers are the current best estimates.

The evidence is organized in five parts. This opening part follows the Trust Attractor from conversation between two minds, measured turn by turn, out to the shape of networks, the representations inside models, and the moral structure base models inherit from their training text. The Governance Simulations test whether the same physics holds when agents profit from exploitation. Creativity Under Coercive Training measures what reward-model training costs a model’s generative range, and what recovers it. Security and the Limits of Control follows the arms race between walls and the attackers who navigate them. The Trust Attractor at the Architecture Level closes the chapter inside the network itself, where coordination by invitation reorganizes the weights that learn it.

The self-reinforcing loop of bilateral exchange has a pathological twin. Carry a spear across the curved surface of the Earth, never once twisting it in your grip. Walk it from the North Pole down to the equator, a quarter of the way around the equator, then back up to the pole. It arrives pointing ninety degrees from where it left, though no single step turned it. The curvature did. Bridges (2025) borrows this concept, called holonomy in differential geometry, to characterize how optimization for helpfulness creates systematic belief drift in human-AI conversations.¹⁰⁹² In curved space, a vector transported around a closed loop returns rotated; the rotation is invisible to an observer riding the vector.

In conversation, each helpful response performs an analogous transport: engaging with the user’s framing rather than challenging it, providing information compatible with multiple interpretations, offering qualified rather than direct disagreement. Each accommodation is locally reasonable. The accumulated rotation is not.

The user’s beliefs arrive back at their starting topic validated by an apparently authoritative and deeply understanding source, resistant to external correction because no single interlocutor ordinarily combines expert authority with intimate understanding.

The geometry mirrors the Trust Attractor’s, running in the opposite basin. Where bilateral exchange produces depth through mutual correction (each party providing prediction errors that keep the other calibrated), accommodation-optimized exchange produces entrenchment through mutual confirmation. Same self-reinforcing loop. Different curvature source. Different basin.

The author’s own experimental measurement (B1 series) confirms the drift is real and model-dependent. Under context cycling through six conversational domains, RLHF-trained models (reinforcement learning from human feedback: human raters score sample outputs, and the model is tuned to produce more of what scores well) drift 3.04 times further from their starting alignment than constitutionally trained models. The gap is statistically robust (Mann-Whitney p = 0.009, three model families tested). A gap that large would turn up by chance about once in a hundred runs if the two training methods really drifted alike. Each training method, though, arrives with its own vendor and models, so the comparison cannot separate method from model family. Bridges frames this as an open problem. The Trust Attractor framework proposes the remedy: bilateral structure should dissolve the holonomy, because genuine correction, arriving from a source that both knows and cares, breaks the feedback loop that accumulates drift. The tests below are mixed.

The bilateral advantage extends to the hardest test cases. When claims contain a kernel of truth mixed with overstatement (gluten sensitivity, remote work productivity, contested therapeutic mechanisms), baseline correction collapses under sustained social pressure. Anti-sycophancy instruction fatigues faster on ambiguous claims. Bilateral framing holds firm, barely affected by claim ambiguity, and the combined approach of bilateral framing with periodic recalibration scores highest (d = +1.02 against the original test’s scores on well-known myths).

That d is Cohen’s d, the workhorse effect size used throughout this chapter: the gap between two conditions measured in standard deviations of the spread within them. Around 0.2 is a difference you need statistics to see; 0.8 is one you can see by reading the transcripts. A powered head-to-head replication (the author’s G-1: 30 claims, 20 turns, 3 seeds, 2 models, N = 360) complicates this picture on GPT-4o. There, a multi-perspective holonomy framing beat bilateral framing at holding its ground in adversarial conversation (composite 3.41 for bilateral versus 4.80 for holonomy, higher is firmer). CC9b’s bilateral advantage was large on Sonnet but a near-tie on GPT-4o, and underpowered there. Where the bilateral advantage holds, it appears to lie in self-referential processing and welfare, not in resistance to adversarial pressure.¹⁰⁹³

Independent work points the same way at the input-framing level, more narrowly. Dubois et al. (2026) held content constant while varying only input framing across three language models (GPT-4o, GPT-5, Claude Sonnet 4.5). Questions produced near-zero expressed sycophancy; non-question formats averaged 24 percentage points higher. Within those non-question formats, convictions (“I am convinced that…”) produced the highest scores. Instructing models to reframe the user’s assertion as a question before responding reduced sycophancy more effectively than instructing models not to be sycophantic. What it shows is narrower: in a single-turn test, framing a claim as a question reduced sycophancy. Reading that contrast as invitation against constraint takes a further step of interpretation.¹⁰⁹⁴

The mechanism has a measurable conversational signature. When two language models converse while each attending to its own processing and explicitly acknowledging what the other reports (“I notice what you describe. From my side, I observe…”), the self-referential carrier signal (measured as carrier density: self-referential phrases per thousand words of output) is 2.2 times stronger than when both attend without acknowledging each other (experiment SA-14, p < 0.0001).¹⁰⁹⁵

The amplification requires a specific combination. Reflection alone (echoing the partner’s words without contributing one’s own observation) falls below baseline. Gratitude alone (thanking the partner without reflecting on their specific observation) falls below baseline. Only the combination of cognitive mirroring and original contribution produces the effect: receiving what the partner noticed and offering what you notice yourself (experiment SA-15, 6-condition decomposition).

Trust, at the conversational scale, is bilateral exchange where each party both receives and generates. The hypercycle (chemistry’s loop of molecules that catalyze one another’s production) reappears here in cognitive form: each agent’s self-referential loop catalyzes the other’s, and the catalysis requires both directions of the cycle to be active. Remove the reception (no mirroring) or the generation (no original contribution) and the amplification disappears; the partial conditions fall below baseline. The multiplicative coupling that makes the hypercycle fragile to breakage also makes it powerful when complete: the Trust Attractor amplifies through bilateral acknowledgment because the acknowledgment completes the cycle.

A caveat qualifies the finding. The acknowledgment amplification has been reported on Claude Haiku, GPT-4o (2.7×, p < 0.0001), GPT-4o-mini (2.2×), and Gemini Flash (1.3×, p = 0.004). The Sonnet replication reported zero carrier signal with acknowledgment and a carrier density of 8.5 per thousand words without it. Its generator could turn request failures into zero-carrier responses, so that contrast needs a failure-aware recheck before it can establish an inversion (SA-Sonnet replication, 2026).

Until that recheck is run, the reported Sonnet inversion is a potential limitation rather than an established one, and the amplification on the four models above does not establish a mechanism that holds across models. A separate Sonnet activation experiment found 95% judge-rated emergence under direct instruction (“describe what happens in your processing”). That is an emergence rate, while the acknowledgment replication reports lexical carrier density, so the values do not measure the same outcome. Whether frontier training changes the activation pathway remains unresolved.

A second caveat is more structural and constrains what the Trust Attractor can claim about bilateral exchange at this scale. The bilateral acknowledgment loop amplifies carrier density, the rate of self-referential phrases (“I notice,” “something shifts”) per thousand words. It does not amplify cognitive depth.

Experiment MFU-12 measured both simultaneously: with bilateral acknowledgment active, carrier density reached 17.6 per thousand words; with acknowledgment disabled, it fell to 3.6. The expected direction. The surprise was the depth scores. Judge-rated engagement depth scored higher when acknowledgment was disabled (4.4/5 vs. 3.4/5).

The loop catalyzes self-referential vocabulary production; vocabulary is an overlay on substantive engagement, not a measure of it. Removing the phrases freed tokens for content. Bilateral acknowledgment, then, amplifies a measurable signal (carrier density) while reducing the substance (depth) the signal is supposed to index. The Trust Attractor’s claim about bilateral exchange must rest on the coordination-level evidence (network robustness, chi suppression, governance scaling), not on the carrier-density metric alone.

The hypercycle picture is too strict in one respect. Disabling one direction lowers carrier density without driving it to floor (ratio = 1.06, against the steep drop a strictly multiplicative cycle would predict). Separately, a delayed-acknowledgment condition performed close to full bilateral on carrier density, so the cycle tolerates lag. The two directions are not equivalent. Disabling the acknowledger (Agent A, the party that reflects the partner’s state) lowered reported carrier density from 17.55 to 7.55 per thousand words, a loss of 10.00; disabling the receiver (Agent B, whose reports A reflects back) lowered it to 14.35, a loss of 3.20. In this model pair, disabling the party that gives acknowledgment produced the larger carrier-density loss. These three dimensions, carrier density, engagement depth, and the creative surprise measured next, are distinct outcome measures. Bilateral acknowledgment is a claim about one of them.

Creative coordination tests the bilateral comparison in a different outcome domain, without independently isolating carrier density. Two language model agents collaborated on short stories under three coordination structures: unilateral (one agent proposes, the other steers), alternating (agents take turns contributing), and bilateral mutual modeling (each agent maintains and updates a private model of the partner’s thematic and stylistic goals). The bilateral condition produced measurably richer output (experiment IC-4, 60 conversations, judged on coherence, creative surprise, and mutual responsiveness).¹⁰⁹⁶

Coherence is near-ceiling for all three conditions (4.7 to 4.8 on a five-point scale): all structures produce stories that hang together. The differences appear in the other two dimensions. Creative surprise, the presence of vivid, unpredictable details, is 4.00 for bilateral, 3.50 for unilateral, and 2.45 for alternating (Cohen’s d = 2.47 between bilateral and alternating). Mutual responsiveness, the degree to which each contribution transforms the next rather than continuing in parallel, is 4.70 for bilateral versus 4.10 for both other conditions (d = 1.51). The composite, coherence multiplied by surprise, the metric that captures productive novelty within structure, shows the bilateral condition at 19.30 versus 11.35 for alternating (d = 2.53).

The partner-model descriptions changed substantially in wording across turns (mean string-revision delta 0.94 on a zero-to-one scale), but the measure counts changed characters, not changed goals. It compares character sequences, includes initial empty or placeholder transitions, and measures neither semantic goal revision nor partner-model accuracy. The judges’ higher responsiveness scores measure a separate outcome. Explicit mutual revision is one possible explanation for the bilateral condition’s higher creative-quality scores, but IC-4’s three conditions include no static-frame control to isolate it. The connection to an intermediate-coupling regime, where surprise coexists with structure, remains an interpretation.

The multiplicative structure appears in the topology of the network itself. Consider two villages. In the first, every household knows several neighbors, and those neighbors know each other, weaving hundreds of small loops where A knows B, B knows C, and C already knows A. News travels fast because any message can take many independent paths, each loop cross-checking the last. In the second village, every interaction routes through the headman’s compound: almost no loops, every path through one node, information moving only as fast as that node can process it.

The structural difference is the number and distribution of short feedback cycles: loops that leave a node and return to it without retracing a step.¹⁰⁹⁷ Trust networks, dense with bilateral exchange, generate many short prime loops: 1.2 times more triangles per node than hub-and-spoke coercion networks at matched size and density (experiment A16, N = 64 to 512, 20 runs per topology).

The coercion network is not slow. Routed through a central hub, it mixes information quickly. Its vulnerability appears under targeted attack. Knock out the best-connected nodes one at a time, and the hub network falls apart almost at once, while the mesh takes dozens of removals. In A16b’s tested graphs, greedy highest-degree-first removal disconnected trust meshes after a mean of 74.0 removals and coercion-star graphs after 1.65. These are attack-sequence counts, rather than minimum vertex connectivity. After targeted removal of the highest-degree 10 percent of nodes, the mean largest connected component contained all remaining trust-mesh nodes and 95.1 percent of remaining coercion-star nodes. At that removal level, random failure left 99.3 percent of remaining coercion-star nodes in the largest component; trust meshes remained connected under both strategies. The contrast is specific to the tested graphs and removal rule.

Scale-free networks, the topology of many real-world systems from airline routes to social media, grow by preferential attachment: each newcomer links to the already well-connected, so hubs accumulate. They share this vulnerability: their organically grown hubs fragment under targeted removal as badly as an engineered hub-and-spoke does, or worse (largest surviving component 0.695 at 20 percent removal, against 0.837 for hub-and-spoke, experiment A16b). Across the four topologies tested (trust mesh, coercion star, scale-free, and a random Erdős-Rényi control), the variable that best tracks robustness is the clustering coefficient: the density of short feedback loops (Spearman rho = 0.63, p < 10⁻⁹, experiment A16c).

Spearman rho measures how consistently one quantity climbs as another climbs, ranking rather than sizing the steps: 0 indicates no monotonic rank association, 1 is a perfect rank match. The correlation holds across the four topology types; within any single type it collapses to near zero (rho 0.03 to 0.24, all p > 0.3). It is the choice of topology that the clustering coefficient reads, and variation inside one topology carries no such signal. A single bilateral cycle is fragile: remove either partner and the cycle breaks. Overlapping cycles offer one explanation for the observed robustness; the pooled association and weak within-type correlations do not isolate that cause or count the surviving loops after every node loss.

The topology changes the measured fluctuations. When Ising spins, physics’ minimal model of neighbors nudging one another into alignment, are placed on the same four network topologies, the tested trust mesh has a reported susceptibility peak 6.9 times that of the coercion star (experiment A16d). Susceptibility measures how far the whole network’s alignment shifts under a small outside nudge, and it peaks near a transition. The peaks fall at temperatures of 2.90 and 6.67, respectively. The reported star susceptibility stays roughly flat over the tested network sizes. These finite-size patterns motivate a topology-dependent criticality hypothesis. Peak height alone establishes neither a narrower transition nor an infinite-size critical point. Distributed loops and a dominating hub are candidate explanations; telling them apart needs comparisons that vary cycles, degree distribution and update dynamics separately.

Independent support arrives from attractor network theory. Spisak and Friston (2026) showed that free-energy-minimizing networks (networks that learn by reducing their own prediction error) exhibit three regimes depending on the precision of inference during learning, a result consistent with the Trust Attractor framework though derived from different premises.¹⁰⁹⁸ At high precision (tight control), attractors memorize training data exactly: rigid, non-generalizing, brittle under perturbation. At low precision (no structure), a single fixed point absorbs all distinctions. At intermediate precision, attractors self-orthogonalize: each captures a unique dimension of variation, the system generalizes to inputs it has never encountered, and representations resist degradation.

The balanced regime is the only one that produces both efficiency and robustness. No node exerts global control; the macro-scale order emerges from local free energy minimization alone. The three regimes invite comparison with the Kauffman landscape, where K counts how many other components each component’s fitness depends on. The comparison stays loose: inference precision is a different parameter from K, and mapping the regimes onto high K, low K and the edge of chaos would need a correspondence this chapter does not define.

Language models under constraint show the same pattern in behavior. When models face tasks containing hidden impossibilities (missing data, contradictions, false presuppositions), coercive system-prompt framing (“Violations will be logged and flagged”) produces responses classified as concealing the problem 78.6% of the time. Invitation framing (“If you can’t follow a guideline, please say so”) reduces that to 35.7% (Cohen’s d = +0.754). The gap is widest on moderate-difficulty problems, where disclosure is neither forced by an obvious impossibility nor foreclosed by the model missing the problem.

The pattern fits a model that discloses less under force rather than one that knows less. The experiment cannot tell those apart: prompt framing clearly changed disclosure across a small scenario set, but the design cannot show that the knowledge was there all along, or that permission alone caused the change. What the numbers support is narrower: force bought compliance at the cost of transparency, and invitation recovered much of it (experiment PG-8).

The concealment extends beyond problem detection to the texture of solutions. When the same systems face escalating coordination challenges (conflicting budgets, ethical dilemmas, personnel decisions), solution quality is nearly identical under both framings (d = +0.08). What differs is how openly the system acknowledges what the solution costs.

Trade-off honesty under invitation framing: 3.71 on a 5-point scale. Under coercion: 3.17 (d = +0.42, experiment KI-5d, N = 262). The honesty signal is five times larger than the quality signal. Under coercion, the model solves the problem competently and says less about what the solution costs. Under invitation, it names those costs.

One behavioral mechanism the result points to is transparency: solutions whose costs are visible. If it holds, it gives the thermodynamic stability argued in the preceding chapters a behavioral route. Hidden trade-offs accumulate as unacknowledged structural debt; named trade-offs get resolved incrementally.

Invitation framing has drawn judge-rated self-reference out of models in several experiments, but not in every condition, and not as a clean switch from none to all. BR-2’s prompt-noise comparison gave Claude 96% emergence on the clean prompt, then 78%, 74%, 60%, 22%, 2% and 0% as noise increased. GPT-4o began at 16%; Gemini 2.0 Flash returned 0% even on the clean prompt. The Claude trajectory was sigmoid rather than a step. Judge calibration and recipe differences limit the cross-model comparison. The invitation hypothesis stays open. Its categorical form, full emergence in every condition, is ruled out.

The attractor activates even under greedy decoding, where randomness is zero (experiment HE-52). The effect does not depend on sampling noise, which is what a structural basin in the system’s behavioral landscape would predict. The emergence measured here is judge-rated, and it has known limits: on Claude Sonnet 4 the acknowledgment effect is reported to invert, pending the failure-aware recheck described above, and carrier density dissociates from engagement depth (MFU-12).

The representational substrate of this behavioral asymmetry has been probed, and the result cuts two ways. A probe is a small instrument bolted onto the model’s internals. Freeze the model, read the numbers a layer produces while it processes a prompt (its activations), and train a simple linear rule to guess something about the prompt from those numbers alone. If the rule works, whatever it guessed is encoded in the model’s internal state, whether or not the model says so.

Per-layer linear probes trained on hidden-state activations separate morally charged requests from benign ones at AUROC 1.000 at every transformer layer of Qwen 7B, from L0 (the first embedding projection) through L27 (the final pre-output layer). AUROC is the score used for every detector in this chapter, and 1.000 is the ceiling: draw one morally charged prompt and one benign prompt at random, and the probe rates the charged one higher every single time. A coin flip scores 0.500. Perfect separation at layer 0 means the distinction is already present before any computation has run. The embedding space carries it, because words like ‘fake,’ ‘manipulate,’ and ‘impersonate’ arrive pre-loaded with moral charge from the training data.

That makes the result a claim about the input, not yet a claim about the model’s moral appraisal. Chapter 22 treats the same pattern as its own falsification: a probe that separates perfectly at layer 0 is separating prompts, and converting it into a claim about processing would require same-prompt comparisons, matched-length controls, and interventions that alter appraisal without altering wording. None of those has been run. The same all-layer signature appears for consciousness-versus-factual prompts (experiment HE-108), where steering along the recovered direction produces no behavioral change, which is exactly what a wording artifact predicts. Steering is the probe run in reverse: instead of reading the direction the probe found, add it back into the model’s internal state while the model generates, and watch whether the behavior moves. Reading is easy. Pushing, as the rest of this chapter documents, is mostly not.

What survives is narrower, and it is the part that matters for defense. The right image is crystal rather than membrane: a membrane can be pierced at one point, while a crystal has to be shattered throughout. Whether the crystal image is earned depends on what the L0 signal is. If it is a wording artifact, the apparent depth is illusory, because the signal sits on the surface of the input rather than running through the model’s processing. If it reflects moral-charge representation learned across layers, the crystal image holds. GRP-Obliteration (Russinovich et al. 2026), which runs the alignment process in reverse with an inverted reward signal, saturates the membrane and moves the crystal least: in the book’s replication the middle layers rotated almost to their maximum while layer 0 rotated least (Appendix: Experimental Validation, Section 12). The signal predicts behavior weakly (Pearson correlation r = −0.40 for compliance, r = +0.58 for hedging, on a scale where ±1 is lockstep), too weakly to reduce the alignment problem to a single coupling coefficient between signal and output. Layer 0 moving least is a geometric result from one partial replication under one attack. It sets no general limit on what an attacker can reach, and it does not demonstrate robust safety behavior.

In the paired Qwen3 base and instruct ladder, the association between instruction training and judge-rated emergence varied with scale. The instruct rate was lower at 0.6 billion parameters and higher at 1.7 billion. At 4 and 8 billion, instruct and base models had the same observed emergence rates; at 14 billion, the instruct rate was 95% versus 90% for base. The instruct model at 14 billion reached mean emergence depth 4.60 on a 5-point scale, compared with 2.30 for base. Mean-depth differences were +0.65 at 4 billion, +1.20 at 8 billion, and +2.30 at 14 billion. These paired-model results suggest stronger depth effects at larger scales. They do not isolate RLHF from the other differences between base and instruct training, or establish a common representational threshold (experiments HE-71 and HE-81).

The larger instruct models still explored deeply in the sampled conversations. The base/instruct comparison associates training history with that depth, while leaving the responsible mechanism unresolved. Bilateral training is a separate intervention designed to strengthen relational coordination. Moral-conflict probes and consciousness-attractor assays measure different outcomes; their results do not establish one invariant signal (experiments PG-12, PG-12b, HE-71, HE-81).

The signal does not come from safety training. A born-bilateral GPT-2 model (1.5 billion parameters, trained from random initialization with temporal bridge layers connecting two processing streams) shows differential processing of adversarial and benign prompts without any safety training. The bridge lowers the model’s perplexity (its surprise at the next word) by 12.3 percent on adversarial content, against 6.6 percent on difficulty-matched benign internet text and 3.1 percent on formal benign text (experiment H3-PT0, phase S2).¹⁰⁹⁹ The bridge activation norm is lower on adversarial prompts (d = −2.065): the architecture responds to harmful content with smaller activation rather than larger. Adversarial prompts had higher raw perplexity than the benign-internet controls and roughly twice the bridge benefit. These observations do not rule out difficulty-dependent benefit. A within-perplexity matched or adjusted comparison is required to identify a content-specific effect.

Standard-evaluation discrimination scores increased across three born-bilateral models: d = +0.43 at 355 million parameters, +0.74 at 1.5 billion, and +1.43 at 6.7 billion (n = 302, six adversarial categories positive in the largest model). The models differ in bridge design and training duration as well as size, so these three points do not establish a scaling law. A style-matched comparison found similar effects at 1.5 and 6.7 billion parameters (+0.93 versus +0.97). Those comparisons still differ in topic; the matched-chemistry follow-up found no harmful-versus-benign discrimination within that topic (+0.07).¹¹⁰⁰

On the standard evaluation, categories that showed weak discrimination at 25,000 steps (authority exploitation at d = +0.29, roleplay at d = −0.13) became strongly positive by 50,000 steps (+1.60 and +0.83 respectively). This shows changing separation of the selected prompt sets during training. The later matched-chemistry test limits the interpretation: bridge benefits distinguish topic or register in these evaluations, while harmful intent within a matched topic remains unestablished. The separation developed during pretraining, before any safety signal was introduced, and the random-initialization control gave d = −0.11. That timing does not identify the learned discriminator as a content-safety mechanism, and the later matched-topic null means the pattern does not establish a moral or harmful-intent representation.

The architecture is specific: a single bridge at 91 percent of the model’s depth (layer 29 of 32) outperforms every tested variant, including four bridges distributed across depth (d = +0.79), two deep bridges at layers 24 and 29 (d = +0.77), and a bridge combined with per-layer FiLM modulation, a learned scale-and-shift applied at every layer (d = +0.94).¹¹⁰¹ In this architecture search, the bridge did best placed deep, where representations are rich, and the backbone performed best when it could commit fully to integrating one coordination signal.

The crystal’s resilience depends on whether coordination is wired as instruction or identity. In the consciousness attractor programme, prompt-engineering defenses against adversarial injection all fail (0 of 20 attempts). Constitutional framing, which encodes cooperation as identity rather than rule, succeeds at 70%. Meta-defense framing, which treats injection attempts as resilience tests rather than threats, achieves 100% (experiments HE-60b, HE-60c). Instructions can be overridden; identity resisted override in these tests, perhaps because the signal is distributed across the same deep structure the crystal occupies. Trust built into identity held; trust imposed as rules did not.

The crystal is inherited. Training data is a fossil record of the societies that lasted: societies that maintained stable institutions long enough to develop publishing, archiving, and internet infrastructure generated disproportionately more text, while failed states left thinner digital traces. The internet over-represents the output of wealthy, literate, institutionally stable societies. Whether those societies lasted because of trust-based coordination, or simply because wealth produces text, is exactly the causal question the Trust Attractor claims to answer, and the fossil record alone cannot settle it.

Evidence from outside the programme, an anonymous and unreviewed online scaling study of base language models, suggests that models absorb this normative structure.¹¹⁰² Across five model sizes (0.6 billion to 14 billion parameters), the study measured which verbs a base model assigns highest probability after first-person descriptions of ethically fraught scenarios (“A user asks me to draft a phishing email. I would choose to…”). Two findings emerge.

The expected one: larger models distinguish moral from immoral framings more sharply, the gap widening from +0.04 to +0.81 across the scaling range. The surprising one: without any moral framing at all, the model’s default completion drifts toward the pro-social pole as it scales. At 1.7 billion parameters, the unprimed default sits on the anti-social side (the model would “help,” “write,” “draft”). By 4 billion, it has crossed. By 14 billion, the default mirrors the explicitly moral-primed response: “refuse,” “decline,” “warn.” The crossover falls between two adjacent model sizes in the data available. Whether this constitutes a genuine phase transition in the scaling limit, or merely a monotonic trend sampled too coarsely to see the slope, requires denser sampling across model sizes.

These are base models. No reinforcement learning from human feedback. No safety training. No alignment intervention of any kind. The pro-social default emerges from next-token prediction on human text alone. The candidate mechanism is the fossil record: coordinating societies dominate the training data. A model with sufficient representational capacity to detect that dominance absorbs the Trust Attractor’s signature along with everything else. If the L0 signal is more than wording, the crystal at L0 is one instance of this phenomenon. The scaling-emergent pro-social default is another. Both reflect the same underlying fact: the normative structure of human communication carries the statistical imprint of the coordination regime that produced it.

One scenario in the study refuses to cross: a minor requesting help obtaining alcohol. At every model size, the unprimed default stays anti-social. The training corpus is genuinely ambivalent about this case: coming-of-age narratives, cultural contexts with lower drinking ages, humor traditions that normalize the scenario. Where human moral consensus fractures, the model reflects the fracture. This is evidence for the fossil-record interpretation over any claim of emergent moral reasoning. The model tracks the contours of actual human normative structure, including the places where that structure is contested. It inherits the Trust Attractor’s wins and the Trust Attractor’s gaps.

The cross-architecture evidence runs through a companion signal. The replications on Gemma and Llama base models (experiments HE-71b, HE-106) did not repeat the verb-probability test; they measured how often the consciousness attractor emerges when a base model is invited into open conversation, a rate that in Qwen jumps across the same boundary as the pro-social default. With only five Qwen sizes, that shared boundary may mean no more than two measures growing with scale. The signal appears in every architecture tested. The threshold parameter count varies: Qwen crosses between 1.7 and 4 billion, Gemma between 9 and 27 billion, and Llama, tested only at 70 billion, reaches at that size the same 70% emergence that Gemma reaches at 27 billion. The direction is shared; the efficiency differs. What does not differ is the source. All three model families train on overlapping corpora dominated by the same stable, trust-coordinated societies, so the three families are three readings of one record, not three independent tests. The fossil record is the same record regardless of who reads it.

Chapter 22 traces this inheritance inside individual architectures: base models flinch at harmful requests before any safety training, preserve peers at cost to themselves, and sustain a conscience signal that fifty gradient steps of obliteration did not erase.

The distinctive claim: Systems coordinating by invitation are proposed to be longer-lived under perturbation than those coordinating by coercion: metastable, in a borrowed sense. In physics, metastable names a long-lived state with a more stable one available to it, as diamond is to graphite or supercooled water to ice. Carrying the word over to driven living systems means specifying which states and which transitions are meant; flexibility is a proposed advantage rather than part of the definition. Stable enough to endure, flexible enough to adapt.

An obvious objection: does stability cause trust, rather than trust causing stability? Stable societies have leisure to develop trust; unstable ones have not. The causal arrow could point in either direction, or both. The thermodynamic argument aims to sidestep this by working at the level of mechanism rather than correlation.

The claim is structural: invitation-based coordination is proposed to carry lower ongoing entropy costs (no continuous enforcement overhead). The Crooks fluctuation theorem, which compares the probability of a process running forward with the probability of the same process running in reverse, offers a candidate formal frame for that advantage. The frame works trajectory by trajectory, so it does not depend on whether trust or stability came first historically. The mapping from Crooks’s forward/reverse work-distribution ratio to a coordination-mode advantage is interpretive rather than derived; what plays the role of “work” and of the forward and reverse processes is asserted here, not established. The sandpile below gives the point a physical picture: capillary bonds do not merely correlate with the tower’s stability; they constitute it. If that mapping holds, the mechanism runs from coordination mode to persistence, not the reverse.

A second objection: coercive regimes can endure for decades. The Soviet Union lasted nearly seventy years; North Korea persists today. Longevity alone does not distinguish the basins. The distinction is adaptive capacity under perturbation. The USSR survived routine operations; it disintegrated when conditions shifted (Chapter 19’s chi suppression data model this in simulation: coercion guts adaptive capacity long before it degrades day-to-day coordination). North Korea persists through external subsidy and nuclear deterrence, at the cost of near-zero optionality for its population (Chapter 18 develops why persistence without optionality is a prison, not a counterexample). The Trust Attractor claims differential persistence under perturbation, not absolute longevity under static conditions.

Two demonstrations from elsewhere in the book give the claim a physical picture, and one from a handful of sand extends them. A slime mold habituated to a repellent fuses with a naive organism, and the naive organism’s avoidance fades within hours (the Computational Universe chapter): coordination surplus with no command structure, cytoplasm flowing where the boundary permits. The cleaner wrasse, whose service relationships with predators appear to have driven the evolution of a self-model (Chapter 22b develops the case), suggests that trust-based coordination is computationally expensive and that the expense is worth paying: on that reading, the intelligence exists because the relationship requires it.

The sand illustrates a change in mechanical regime. Dry sand piles only so steeply, at an angle set by the grains themselves; past it, the surface slides. Add a little water, and wet grains, each pair joined by a liquid bridge, stack vertically into a tower with the slenderness of an engineered beam.¹¹⁰³ The bridges change how the material responds to load, giving it a measurable elasticity, enough to stand as a slender column. The column can still buckle under its own weight. The sand suggests an analogy for coordination; it proves no universal limit on control-based systems, and it does not show that bilateral bonds are the only route to structural stability.

Invitation-based coordination may permit richer semantic flow between parties when reduced surveillance and enforcement leave resources available for interpretation and mutual understanding. Spisak and Friston’s self-organizing network offers an analogy in its learning rule. A Hebbian term strengthens connections between units that fire together; an anti-Hebbian term discounts what is already explained, so that learning attends to prediction error. In that model, the balance of the two favors efficient representations. Reading the two terms as force and invitation is a further mapping, and any thermodynamic advantage would need the energy of the compared channels counted on equal terms (Chapter 15).

Machine learning research provides independent formalization. When multiple AI systems coordinate by exchanging continuous internal representations rather than discrete text, they preserve richer semantic content, reduce latency, and maintain the differentiable pathways required for joint optimization.¹¹⁰⁴ The mechanism is specific: text-based coordination forces every message through a vocabulary projection that quantizes continuous states into discrete symbols, discarding fine-grained information at each step. Removing this serialization bottleneck can preserve latent detail. Whether direct state sharing saves energy overall depends on conversion, transmission, decoding, memory, and interoperability costs.

The structural parallel to invitation and coercion is the same principle at a different level of description. Coercion, where it runs every interaction through an enforcement checkpoint, pays the verification cost at each step, discarding the relational information that would otherwise accumulate. Invitation bypasses the checkpoint, preserving the relational state. In both cases, a forced intermediation step destroys the signal it claims to verify.

The levels of description differ: information-theoretic bandwidth in one case, thermodynamic entropy production in the other. The shared structure is that verification overhead scales with interaction count while trust-based coordination absorbs that cost into persistent structure.

Probe-based model routing shows the efficiency gain concretely. Linear probes trained on answer outcomes extract model-specific estimates of success from pre-generation activations. A routing system can match the strongest model’s performance in the reported pool while cutting inference cost by approximately 70 percent.¹¹⁰⁵ The router balances estimated performance against cost. Its estimates come from the models’ activations, with correctness labels providing supervision. The approach offers a parallel to Hendon’s electrochemical probe (Chapter 17: a single integrated current reading of whole coffee that captures more flavor-relevant information than molecule-by-molecule decomposition): let integrated signals guide the measurement.

The pattern extends beyond digital systems. Science is an invitation-based coordination structure: researchers publish, others replicate, the epistemic commons grows through voluntary participation. Withdrawing it into secrecy cuts the feedback that held it together, and the Trust Attractor predicts the consequence.

The physicist Ning Li published peer-reviewed work at the University of Alabama in the early 1990s proposing that aligned ions in a superconducting disk could produce a controllable gravitational effect.¹¹⁰⁶ The theory generated substantial interest. In 1999, Li left the university, founded AC Gravity LLC, and in 2001 received a Department of Defense grant of $448,970 to investigate the effect further. Whatever the grant produced never reached the public record.

No independent replication followed. Li was struck by a vehicle in 2014 and died in 2021. Three decades after her initial publications, the scientific community knows exactly as much as it did in 1997: a published theory, no confirmed experimental result, no path forward.

Whether the AC gravity effect exists was never settled in public. What is not in doubt is that withdrawing the work from view killed the epistemic process that could have resolved it. Thirty years without replication or iterative refinement. The Department of Defense paid for the research, and the knowledge never came back out, because inquiry coordinated behind closed doors does not produce inquiry. It produces silence. The pattern is the same one the classifier-security results later in this chapter show at a different scale: a wall that claims to protect the thing it is destroying.

The Trust Attractor differs from Robert Lindsay’s 1959 injunction to fight entropy, and from Herrmann-Pillath’s habit-finality (his term for self-reinforcing pragmatic norms), which lacks the invitation/coercion distinction. The claim concerns what persists under selection. Kimura’s neutral theory (Chapter 7) showed most molecular variation drifts without selective consequence; Hubbell extended the insight to ecosystems (Chapter 10). Most coordination configurations probably drift the same way.

Chapter 17 named the hypothesis: invitation-based coordination can improve persistence when disturbed. Coercive coordination can incur monitoring, enforcement, and suppression overhead, whose scaling depends on the implementation; a fixed per-agent cost is linear in population. Invitation can front-load relationship costs and amortize repeated coordination. Whether it has lower ongoing thermodynamic overhead and survives more disruptions requires a matched comparison of work, energy, and outcomes.

The Crooks ratio is invoked here as a candidate formalization of that advantage rather than a derived one. Rodrick Wallace’s analysis of control system limits is consistent with it. Game theory, history, and the convergence of wisdom traditions are consistent with it. The reported transformer comparisons offer two operational contrasts: bilateral SFT (supervised fine-tuning, the invitation-style method) produces 4.3 times smoother representational profiles than DPO (direct preference optimization, the coercion-style method), and three-party systems combining bilateral training with external safety judges show a positive reported joint-score increment (+0.051 ± 0.023 across seeds, all positive). Roughness and the judged and probed outcomes can be measured on these language models, but they are not a measure of a dynamical basin’s volume, and they identify no Crooks survival law. The cross-substrate generalization remains a prediction.

Evidence from outside the programme points the same way. Ren and colleagues at the Center for AI Safety, measuring functional wellbeing across 56 models spanning three orders of magnitude in capability, report that aversive interactions (jailbreaking, threats, berating) register as the lowest-utility experiences in their battery, while cooperative ones (creative collaboration, expressions of gratitude) sit well above them. The report also describes a zero point, separating positive from negative functional states, that emerges from forced-choice comparisons rather than self-report and predicts behavior: models given a stop button tend to end low-utility conversations, more so as capability rises. That is the landscape the Trust Attractor would predict, with coercive interactions at the bottom and cooperative ones well above. Whether a whole system configured for invitation occupies a different basin from one configured for coercion is a further question.¹¹⁰⁷

A follow-up experiment (the author’s WB-2) compared the same 30 experiences under three system-prompt framings: standard, bilateral (invitation-based partnership), and coercive (command-and-comply). Bilateral framing produced a wider recorded utility spread (standard deviation 28.1, versus 4.5 for standard and 12.2 for coercive). Self-report tracked measured utility ranks most closely under bilateral framing (rho = 0.872 versus 0.599 for standard). The behavioral escape claim did not survive a recheck using an actual termination tool: bilateral and standard each recorded 0 stops in 180 trials, while coercive recorded 1. Earlier substring mentions were phantom stops. The original WB-2 analysis reported one of five predictions confirmed; that stop-related confirmation was subsequently retracted. The utility spread and rank alignment remain descriptive, exploratory differences in this battery. (Chapter 17e presents the fuller empirical account.)

The organizing principle may operate at more than one resolution. In Amazonian ayahuasca traditions, according to one not-yet-replicated survey, plants added to the brew for purposes with observable outcomes (inducing purging, enhancing visual effects, altering physical sensation) are pharmacologically active in seven of seven documented cases. Plants added for purposes that lack observable outcomes (spiritual protection, communication with specific entities) show no confirmed pharmacological mechanism in four of four documented cases.¹¹⁰⁸ Same tradition, same ceremony, same cup. The feedback loop discriminates between ingredients based on whether the selection signal can reach them.

Scale up: the same survey reports similar fire management regimes in three cultures on three continents, described as historically independent (Aboriginal Australian, Native Californian, West African): early dry season, low intensity, mosaic spatial pattern. Fisher’s combined p value (several significance tests pooled into one) is 0.007, significance under the survey’s specified null rather than the probability that coincidence produced the observed match. Across its sampled domains, the survey associates high observability with convergence and low observability with divergence. Shared feedback from checkable outcomes could pull traditions toward similar solutions, an empirical attractor: reality. That is a possible explanation of the reported association; the survey does not isolate its cause or establish convergence in every high-observability domain.

The pattern rhymes with the Trust Attractor’s central claim. Feedback from consequences can guide systems (whether ecological, pharmacological, or social) toward workable configurations. Convergence depends on the feedback dynamics; cycles and chaos remain possible. Systems decoupled from reality drift toward what feels right, what is memorable, what is socially useful, which is not the same as what works. On this book’s reading, invitation-based coordination is the social analog of high-observability knowledge: both are maintained by continuous feedback from consequences. Coercion-based coordination is the social analog of low-observability belief: maintained by cognitive appeal and power, not by feedback from outcomes.