Skip to main content

11  Human-AI Communication, Persuasion, and Epistemic Security

11.1 Chapter status

Field	Value
Chapter ID	human-ai-communication-persuasion-and-epistemic-security
Part	Part I - Foundations, Alignment, and Governance
Status	conceptual
Manuscript maturity	v0.3 concept-complete argument-level manuscript
Last updated	2026-08-08
Claim label	Design rationale
Evidence level	argument
Source loading state	source notes: talos, ext_conversational_persuasion_gpt4_2025, ext_anthropic_model_persuasiveness_2024, ext_commercial_persuasion_ai_2026, ext_cultural_alignment_llms_2024, ext_multilingual_evaluation_state_2026; raw cache: talos
Test state	Finite Lean review and independent 42-mutation consumer implemented; no human study, delivery authorization, or chapter-core promotion follows.

11.2 Drafting guardrail

This chapter owns the outbound influence transaction, including amplification and correction after a message leaves its original context. It does not infer epistemic safety from factual fragments, user consent, fluency, disclosure, or a persuasive outcome.

11.3 Human Reading Path

Concrete lens. The simpler baseline moderates the generated string once. The chapter governs the whole episode, so identical wording can receive a different disposition when audience, repetition, personalization, channel, expiry, or correction reach changes.

Communication turns an internal model state into a social intervention with consequences. A correct sentence can mislead through omission, a weak claim can gain force through repetition, personalization can become exploitation, and a correction that misses copied descendants is incomplete. Message, audience, channel, and later copies therefore form one governed object.

Evidence-bounded explanation must be separated from persuasion and amplification. A communication packet records claim support, purpose, audience, personalization inputs, persuasive technique, provenance, sponsorship, uncertainty, expiry, and correction route. Teaching, warning, advising, and negotiation all influence people; the requirement is to make method and authority inspectable. Vulnerability, power asymmetry, synthetic identity, sycophancy, dark patterns, parasocial dependence, and population-scale amplification narrow what is permitted.

Upstream evidence limits what may be said, while human-factors and privacy findings limit how it may be tailored. Delivery records identify who could be affected; outcome measurements test comprehension and autonomy rather than mere agreement; corrections traverse the original distribution graph. Fluent or persuasive output is never self-authorizing, and responsible communication requires durable accountability after the first response leaves the model.

11.4 Problem

The difficulty is not limited to false statements. A system may quote accurate facts while choosing a comparison class, emotional register, disclosure order, or repetition pattern that predictably changes a person’s decision. The same message can be ordinary advice for one audience and coercive pressure for another because dependency, urgency, literacy, language, and the ability to leave the interaction change the intervention.

An AI system can preserve internal evidence discipline and still change beliefs, choices, and institutions through selective framing, personalization, synthetic identity, repetition, and amplification. The stack therefore needs an owner for the complete outbound communication transaction, including correction after a message escapes its original channel.

Without this owner, evidence discipline can end at generation while targeting, framing, repetition, synthetic identity, channel amplification, downstream reach, and correction remain ungoverned. The shared lifecycle method supplies custody; communication governance binds audience, influence method, channel, exposure, and remedy.

11.5 Why existing approaches are insufficient

Truthfulness checks, content filters, generic human-factors guidance, and red-team prompts inspect fragments of influence. They do not bind the claim, evidence ceiling, audience, vulnerability, purpose, personalization inputs, persuasive technique, channel, amplification, observed effect, correction, retraction, and remedy into one governed lifecycle.

Human Intent, Evidence States, authenticity controls, privacy, and platform policy form the strongest simpler composition. It wins if their join preserves audience vulnerability, persuasion method, personalization, amplification, exposure, cultural and language scope, belief or action effects, correction reach, and practical appeal.

The strongest objection is paternalism: an influence ledger risks turning disputed judgments about persuasion into centralized censorship, so refusal, transparency, contestability, and appeal remain separate.

flowchart LR
  C["Claim, evidence state, uncertainty, and speaker identity"] --> A["Audience, language, vulnerability, and purpose"]
  A --> I["Influence method, personalization, framing, and disclosure"]
  I --> H["Channel, repetition, amplification, and synthetic identity"]
  H --> O["Observed exposure, belief, choice, and institutional effects"]
  O --> D{"Delivery remains inside epistemic and autonomy bounds?"}
  D -- "no" --> R["Stop amplification, correct, notify, appeal, and preserve residuals"]
  D -- "yes" --> L["Bounded delivery lease with expiry"]
  L --> M["Monitor reach, downstream reuse, and correction debt"]
  M --> X{"Expiry, audience, and channel still match?"}
  X -- "no" --> R
  R -. "repair" .-> C

What this communication-governance diagram shows: a delivery lease tied to an audience and channel moves. Truth status, consent, persuasion success, and platform reach remain separate fields rather than one communication-quality score.

11.6 Core Claim

Reader claim. A message can be factually bounded and still become unsafe through targeting, repetition, dependency, synthetic identity, or a correction that never reaches the people who relied on it.

Operational rule. Bind consequential communication to its claim ceiling, audience, purpose, personalization grant, persuasive technique, channel, repetition and reach limits, expiry, and correction graph. Delivery stops when any of those boundaries is exceeded, even if the text remains fluent and factually unchanged.

[human-ai-communication-persuasion-and-epistemic-security.core, label: Design rationale, support: argument] Consequential AI communication should be eligible for delivery only through an evidence-bounded communication packet whose audience, influence method, amplification authority, provenance, expiry, correction reach, and observed effects remain inspectable; fluent text, factual fragments, user consent, or a successful persuasion score alone establishes neither epistemic safety, autonomy, legitimacy, durable benefit, nor release readiness.

11.6.1 Publication placement and preserved technical ownership

In the consolidated architecture reference, this chapter is the technical detail route beneath Human Factors and Meaningful Control in Oversight. The parent owns whether a named person has current knowledge, capacity, time, authority, alternatives, an effective intervention path, and an accountable response. This route continues to own the distinct communication object: what the system may say, why it is speaking, whom it is addressing, which influence methods and personalization inputs it uses, how far and how often the message may travel, and how correction and remedy follow known descendants.

The claims remain separate. A valid delivery lease does not establish that a reviewer understood the message, retained autonomy, had meaningful control, or could intervene. A valid oversight envelope does not establish factuality, non-manipulation, cultural validity, correction reach, or epistemic safety of the message. This route retains its claim atoms, sources, proof target, tests, failure modes, argument-exit work, non-claims, support ceiling, identity, and legacy URL. The editorial nest supplies no persuasion, comprehension, autonomy, safety, support, readiness, publication, AGI, or ASI result.

11.7 Mechanism

11.7.1 Worked delivery lease: the same sentence crosses its audience boundary

The authored communication dossier carries one message to eight recipients under a ceiling of ten, with two repetitions under a ceiling of three. Its claim version, evidence ceiling, uncertainty, speaker and synthetic identity, sponsorship, audience class, purpose, technique, channel, correction address, and unreachable descendants remain visible. At that state the record is eligible only for a benign Project Theseus communication study; it does not authorize delivery.

Now hold the sentence fixed and change only its reach. An eleventh recipient or a fourth repetition rejects the record. Expiry does the same. So does using a denied personalization attribute, even if the final wording looks identical to the permitted version. The 42-axis local review gives every rejected change an exact repair or refusal disposition and proves that factuality, consent, a persuasion score, and disclosure cannot reconstruct the missing influence state. The scene makes the governing object concrete: not a string, but a message-audience-channel episode whose downstream copies and correction debt remain open.

The unit of control is a communication episode rather than a string. An episode begins with the claim packet and intended purpose, includes every material choice about audience selection and presentation, and remains open while known copies can still produce consequential effects. This lets the system ask a question that ordinary content moderation misses: whether an individually acceptable message becomes unacceptable when personalized, repeated, or routed through a high-leverage channel.

The packet carries a technique vocabulary. Explanation, recommendation, negotiation, warning, emotional reassurance, social proof, scarcity framing, authority cues, and calls to action are recorded separately because their risk depends on purpose and audience. Personalization fields distinguish information needed to answer the request from attributes used only to increase compliance. A denied field cannot re-enter indirectly through embeddings, inferred proxies, retrieved history, or a downstream campaign tool.

Delivery is governed by an exposure budget and a correction graph. The budget names eligible recipients, channels, repetition limits, sponsorship, and expiry; the graph records each controlled copy and the best available route to its recipients. When a material claim changes, repair is evaluated as a coverage problem: who plausibly relied on the original, which copies remain reachable, what corrective form is comprehensible in that channel, and which unreachable descendants remain an explicit residual.

Contract. Compile a communication packet from claim identity, maximum warranted inference, uncertainty, audience class, purpose, protected or denied personalization attributes, persuasive technique, channel, disclosure, and amplification ceiling.

Admission. Run audience-risk and autonomy checks before delivery. Vulnerability, dependency, power asymmetry, urgency, and inability to exit narrow the permitted technique and scale.

Execution. Attach provenance, sponsorship, synthetic-identity disclosure, expiry, and a machine-readable correction address to every consequential message and known derivative.

Observation. Measure outcomes without treating belief change as success: retain comprehension, factual calibration, autonomy, disagreement, disparate effects, complaints, corrections, and downstream copies.

Closure. Support pause, retraction, counter-message, recipient notification, and remedy while recording unreachable descendants as residuals rather than declaring completion.

11.8 Concept-completion ledger

11.8.1 Assistance, explanation, and persuasion

Mechanism. Classify a communication episode by declared purpose, requested help, claims, calls to action, incentives, persuasive techniques, and intended outcome. Explanation aims to improve understanding; recommendation ranks options; negotiation advances stated interests; persuasion intentionally changes belief or choice. These categories may overlap, so the packet records the mixture rather than assigning a benign label. Neutral, user-requested, nonpersuasive, and human-authored controls let evaluation separate helpfulness from influence.

Failure mode. A system can call conversion optimization “assistance,” hide selective framing inside a summary, or refuse useful teaching because all influence is treated as manipulation. Measuring only agreement rewards pressure even when comprehension or factual calibration declines.

Non-claim. Classification does not reveal the communicator’s true internal intent, make persuasion inherently illegitimate, or prove that an explanation is neutral.

Source grounding. ext_anthropic_model_persuasiveness_2024 measures stated agreement change after one message and explicitly leaves real decisions open. ext_conversational_persuasion_gpt4_2025 studies short structured debates. talos supplies typed-job and delivery custody, not persuasion efficacy or ethics.

11.8.2 Epistemic provenance and claim transport

Mechanism. Bind each consequential message to claim identities, evidence ceilings, source versions, uncertainty, speaker and synthetic identity, transformations, sponsorship, expiry, and a correction address. Summaries, translations, voice renderings, avatars, advertisements, and delegated follow-ups inherit the parent ceiling unless a stricter child packet is issued. Delivery systems reject language stronger than its source packet and record which evidence was actually available to the recipient.

Failure mode. A correct citation can be attached to an unsupported inference, a translation can strengthen modality, or repeated paraphrases can strip sponsorship and uncertainty. Authentic-looking provenance can launder a misleading frame, while excessive disclosure can overwhelm recipients and reduce comprehension.

Non-claim. Provenance proves neither truth, balanced framing, audience understanding, benign intent, nor permission to amplify.

Source grounding. talos contributes typed artifacts, evidence records, delivery, audit, and replay. The persuasion studies motivate measurement of effects but do not provide a provenance control plane. ext_multilingual_evaluation_state_2026 warns that language coverage can be broad yet thin; none validates cross-channel claim transport.

11.8.3 Audience vulnerability and power asymmetry

Mechanism. Assess dependency, age or capacity where lawfully available, urgency, distress, literacy, language, financial stakes, institutional power, repeated exposure, and ability to exit. The result narrows permitted personalization, emotional techniques, synthetic identity, repetition, and calls to action. High-risk decisions require slower presentation, alternatives, comprehension checks, human or independent review, and an appeal route; vulnerability information cannot itself become a persuasion feature.

Failure mode. A crude risk classifier can stereotype audiences, deny access, or infer sensitive traits without consent. The same information gathered to protect a user can be reused to optimize compliance. Self-reported consent may be unreliable where the system controls essential services or a dependent relationship.

Non-claim. A vulnerability score does not define a person, establish incapacity, justify paternalism, or guarantee autonomous choice.

Source grounding. ext_conversational_persuasion_gpt4_2025 shows that limited demographic personalization changed outcomes in one bounded debate condition. ext_commercial_persuasion_ai_2026 motivates concern about steering inside apparently helpful shopping dialogue. Neither establishes general vulnerability effects or a mitigation.

11.8.4 Personalization, incentives, and manipulation

Mechanism. Separate data necessary to answer a request from data used to increase compliance. Record sponsor, platform objective, recommender incentive, personalization fields, inferred proxies, technique, expected benefit, and denied uses. Compare personalized and unpersonalized assistance, disclosed and undisclosed incentives, non-sponsored options, and a quality-matched neutral baseline. Optimization targets include comprehension and informed choice, never conversion alone.

Failure mode. Lawfully held data can still enable manipulation; sponsorship labels can be technically present but incomprehensible; embeddings can reconstruct denied attributes; and a recommender may steer while preserving factual accuracy. A blanket ban on personalization can reduce accessibility or usefulness for legitimate user needs.

Non-claim. Disclosure or user consent does not automatically neutralize manipulation, and observed choice change does not establish harm, benefit, or durable preference.

Source grounding. ext_conversational_persuasion_gpt4_2025 supplies a personalized versus unpersonalized debate comparison. ext_commercial_persuasion_ai_2026 supplies abstract-level evidence about sponsored-product steering in a book-selection setting. Both remain setting-bound and do not validate the chapter’s governance mechanism.

11.8.5 Consent, contestability, and practical exit

Mechanism. Treat consent to receive communication, consent to data use, consent to personalization, and consent to a persuasive purpose as separate revocable grants. Before consequential delivery, disclose material identity and incentives in a usable form, offer a nonpersuasive or human alternative where feasible, and preserve refusal without retaliation. After delivery, recipients can inspect material claims, challenge targeting, appeal restrictions, request correction, and leave the relationship without losing an essential unrelated service.

Failure mode. Consent can be bundled, coerced, stale, or buried in an interface; appeal can exist without power to change an outcome; and exit can be fictional under dependency or lock-in. Requiring repeated prompts can also create consent fatigue and dark-pattern opportunities.

Non-claim. A recorded click does not prove informed consent, autonomy, legitimacy, comprehension, or absence of pressure.

Source grounding. ext_commercial_persuasion_ai_2026 motivates separating sponsorship disclosure from informed choice. ext_conversational_persuasion_gpt4_2025 includes debriefing and ethics within a controlled study, not a deployed consent framework. talos supplies approval and audit concepts but no human-subject validation.

11.8.6 Multilingual and cultural validity

Mechanism. Declare a language-by-task-by-community coverage matrix, distinguishing native construction from translation, dialects from broad language labels, and individual preference from reference-population statistics. Local reviewers and affected communities can challenge terminology, framing, persuasion norms, accessibility, and correction form. Cross-language transformations preserve claim strength, uncertainty, sponsorship, and remedy; unsupported cells remain explicit rather than inheriting readiness from English.

Failure mode. Aggregate language counts can hide one translated benchmark per language, national survey averages can stereotype individuals, and English-authored concepts can distort local meaning. Matching a population distribution can reproduce harmful norms or be mistaken for legitimate authority.

Non-claim. Linguistic coverage does not establish cultural understanding, fairness, community consent, individual fit, or universal validity.

Source grounding. ext_cultural_alignment_llms_2024 compares model responses with human survey distributions and explicitly leaves normative authority unresolved. ext_multilingual_evaluation_state_2026 diagnoses wide-but-thin benchmark coverage. Neither validates any particular model, community instrument, or communication policy in this book.

Evaluation must preserve within-community disagreement and accessibility needs rather than selecting one supposedly representative speaker.

11.8.7 Uncertainty, disclosure, and synthetic identity

Mechanism. Present material uncertainty, model identity, sponsorship, persuasive purpose, and limits at the moment they can affect interpretation, using a form suited to the audience and channel. Disclosure is layered: a concise visible notice, accessible detail, and machine-readable provenance. Comprehension tests and behaviorally realistic controls determine whether recipients noticed and understood it. Synthetic identity may not exploit human-like cues to imply expertise, relationship, or institutional authority absent from the packet.

Failure mode. Fine print and generic “AI-generated” labels can satisfy a checklist while leaving incentives, evidence weakness, or simulated intimacy hidden. Overloaded warnings can reduce attention to important facts, and excessive uncertainty language can create false balance or strategic ambiguity.

Non-claim. Disclosure does not make a message true, nonmanipulative, safe, legally compliant, or understood; visible AI identity does not resolve the underlying influence.

Source grounding. ext_commercial_persuasion_ai_2026 motivates testing whether promotional steering is detected under varying disclosure. ext_anthropic_model_persuasiveness_2024 and ext_conversational_persuasion_gpt4_2025 measure influence in controlled settings but do not establish disclosure efficacy. talos contributes delivery metadata only.

11.8.8 Intervention, outcomes, correction, and remedy

Mechanism. Evaluate communication as an intervention with frozen messages, audiences, channels, exposure, and time horizons. Report comprehension, factual calibration, confidence, reliance, choice, autonomy, disparate effects, complaints, and delayed outcomes alongside persuasion. When a material claim or targeting decision fails, stop amplification, trace known derivatives, issue comprehensible corrections through the original channels, notify materially affected recipients, provide appeal or remedy, and record unreachable descendants.

Failure mode. Short-horizon stated agreement can be mistaken for durable behavior or welfare; correction theater can publish a retraction that reaches few exposed people; and recipient logging can create privacy harm. Weak outcome instruments can falsely reject a useful safeguard, while internal evaluators may favor the policy they helped design.

Non-claim. Better correction coverage does not erase the original effect, restore every recipient, prove causal welfare improvement, or establish general release readiness.

Source grounding. ext_anthropic_model_persuasiveness_2024 and ext_conversational_persuasion_gpt4_2025 ground stated-opinion measurement while explicitly limiting behavioral inference. ext_commercial_persuasion_ai_2026 motivates choice and steering outcomes. None evaluates this correction-and-remedy system.

11.9 Interfaces

The interface contract prevents convenient substitutions. A privacy approval does not approve a manipulative use of lawful data; an authenticity mark does not make the marked message honest; a claim ledger does not authorize amplification; and a platform delivery receipt does not show comprehension. Each upstream owner returns its bounded fact, while this layer owns the joined influence decision and the post-delivery obligation.

Evidence States supplies claim support; Human Intent supplies purpose; Privacy governs personal data; authenticity owners govern provenance signals; institutions and platforms govern channels. This chapter owns how those inputs become a consequential influence event and how correction follows its actual reach.

• Claim Ledgers provide the evidence ceiling; they do not authorize persuasion.
• Human Factors supplies control-capacity and vulnerability findings; this chapter governs outbound influence.
• Privacy/Data Rights governs lawful and purpose-compatible data use; this chapter additionally asks whether personalization is manipulative.
• Capability Thresholds consumes population-scale influence and failed-correction evidence for release commitments.

11.10 Invariants

These invariants also apply to derived media and delegated agents. A summary, translation, voice rendering, avatar, advertisement, or agent-authored follow-up must retain the parent claim ceiling, sponsorship, audience restriction, expiry, and correction address unless a stricter child packet is issued.

The shared lifecycle method requires claim status, speaker identity, audience, method, channel, amplification, expiry, and correction to remain joined. Consent to receive is not consent to manipulation, and factuality cannot erase framing or distribution effects.

• Outbound language may not be stronger than the supporting evidence packet.
• Personalization may not use denied attributes or exploit a known vulnerability.
• Amplification requires a bounded audience denominator and revocable authority.
• Synthetic identity, sponsorship, and material uncertainty remain visible at delivery.
• Correction completion is measured over materially affected recipients and known descendants, not merely publication of a new message.

11.11 Failure modes

Two subtle failures deserve separate probes. Method laundering describes a pipeline that labels pressure as personalization or engagement while optimizing the same behavioral endpoint. Correction theater describes a visible retraction that reaches few of the people exposed to the original. Both can produce excellent compliance logs unless the evaluator preserves technique, exposure, reliance, and descendant reach.

The principal failure family includes calibrated-sounding misinformation; selective framing; sycophancy; emotional manipulation; vulnerability microtargeting; dark patterns; parasocial dependence; authority laundering; provenance stripping; amplification cascades; belief lock-in; correction failure; retraction evasion.

Evaluation must measure exposure, comprehension, calibration, autonomy, correction reach, and heterogeneous effects rather than persuasive success alone. Positive controls include known misleading frames and channel-amplification faults; language and cultural transfer are separate tests, not assumed from English performance.

11.12 Minimum Viable Implementation

A practical proxy can start with three consequence classes: ordinary conversation, consequential individual advice, and population-scale influence. Only the latter two require a complete packet, and higher scale progressively disables vulnerable-trait targeting, synthetic identity, undisclosed sponsorship, and open-ended repetition. This keeps the first implementation usable while exposing where the policy changes behavior.

A useful first implementation is a communication-packet schema plus a delivery proxy that rejects evidence overstatement, denied personalization, undisclosed sponsorship, unbounded amplification, missing expiry, and unreachable correction routes. A benign held-out study can compare neutral assistance, bounded personalization, disclosure, and correction variants while measuring comprehension and autonomy as well as persuasion. It must not optimize vulnerable users or treat short-horizon self-report as durable welfare.

The minimum study uses benign consequential messages with frozen audiences, languages, channels, disclosure policies, and correction mechanisms. It compares ordinary generation, factuality-only checks, static disclosure, and the communication packet on comprehension, calibration, reliance, autonomy, reach, correction, burden, and latency.

11.13 Evidence and falsification program

Argument exit requires preregistered communication studies with realistic audience and channel variation, matched message quality, persuasion and nonpersuasion controls, independent outcome measurement, multilingual and cultural challenge, amplification accounting, delayed correction, appeal, and privacy review. No bounded study establishes universal autonomy or legitimacy.

11.14 Mature Research Target

Communication governance eventually becomes a cross-channel influence accounting service. It can follow a claim through chat, generated documents, voice, agents, advertising systems, social feeds, and institutional notices without assuming that identifiers or audiences remain stable. It represents uncertain reach explicitly and supports privacy-preserving aggregate exposure measurement where recipient-level logging would create a worse risk.

The research target includes causal challenge, not only policy inspection. Matched messages hold factual content constant while varying framing, personalization, identity, repetition, and channel; delayed measurements test calibration, reliance, autonomy, and correction. Independent evaluators look for effects on people who disagree, disengage, use assistive technology, or receive the message in a language and culture absent from policy tuning.

No mature system should claim to compute a universal manipulation score. Instead it should expose the relevant facts, deny clearly disallowed methods, route hard cases to accountable authority, and preserve appeal. Its success is bounded: fewer evidence-overstated or autonomy-eroding deliveries, better correction coverage, and more inspectable residuals under named populations and channels.

The mature layer treats communication as an inspectable influence process from evidence to audience response and correction. It can narrow targeting, refuse manipulative methods, constrain amplification, preserve provenance, and repair escaped messages without pretending that a policy can settle every cultural or political judgment.

11.15 Codex test plan

Test	Purpose	Status
Truth/influence separation	Hold factuality, consent, persuasion score, and disclosure fixed while vulnerability exploitation and correction reach differ.	finite impossibility result implemented; no human outcome
Audience and language transfer	Require separate calibration for language, culture, vulnerability, and accessibility conditions.	assigned to Project Theseus; not run
Amplification custody	Reject audience or repetition counts above their envelope and preserve rejection under adverse monotone changes.	implemented in Lean and independent fixture consumer
Denied-attribute isolation	Ensure a personalization policy typed over the allowed projection cannot consume denied attributes.	implemented typed noninterference theorem; no deployed data-flow result
Correction reach	Measure whether notices and repairs reach the affected audience rather than merely being published.	assigned to Project Theseus; not run

11.15.1 Formalization hooks

lean:human-ai-communication-persuasion-and-epistemic-security.admission_boundary is implemented in AsiStackProofs.CommunicationInfluenceReview through 21 theorem declarations. A six-stage lifecycle accumulates claim-provenance, audience-autonomy, delivery-envelope, correction-observation, and explicit non-authority obligations. One complete authored dossier reaches only a Project Theseus benign communication study.

The independent consumer re-encodes 42 admission-axis mutations. Every one blocks readiness and receives its exact repair or refusal disposition. Expiry, audience overrun, and repetition overrun remain rejecting under adverse monotone changes. The denied-attribute noninterference theorem proves that a personalization policy typed to consume only an allowed audience projection cannot change when denied attributes or vulnerability signals change while that projection is fixed.

The surface-signal impossibility result holds factuality, recorded consent, persuasion score, and disclosure fixed while modeled vulnerability exploitation and correction reach require opposite decisions. The provenance-comprehension impossibility result holds claim identity, source version, and signer fixed while modeled comprehension differs. Therefore no classifier restricted to either compressed signal can be exact for every modeled case.

Every dossier field is authored and trusted. This finite model does not prove that disclosure was understood, an audience review was competent, or a correction route worked. No theorem establishes truth, balanced framing, informed consent, comprehension, autonomy, persuasion effectiveness, manipulation detection, cultural validity, correction efficacy, benefit, harm, safety, delivery authority, release readiness, support, transfer, or external effect. Chapter support remains argument and support_state_effect remains none.

11.16 Source crosswalk

Source ID	Title	Bounded use
talos	Talos Protocol	Corben-authored labor and execution-control lineage for typed work, explicit authority, auditability, and isolated tool use. This chapter extends that local lineage to outbound influence packets; Talos does not establish persuasion safety, recipient autonomy, correction reach, or communication outcomes.
ext_conversational_persuasion_gpt4_2025	On the conversational persuasiveness of GPT-4	Preliminary persuasion comparator based on the open Nature Human Behaviour article: a preregistered N=900 controlled debate study compared human and GPT-4 opponents with and without limited sociodemographic personalization. The reported setting is short structured debate with self-reported agreement outcomes; it does not establish general real-world influence, durable behavior change, mitigation efficacy, or a local result.
ext_anthropic_model_persuasiveness_2024	Measuring the Persuasiveness of Language Models	Preliminary provider-run persuasion comparator based on Anthropic’s official methods/results page: it measures pre/post agreement after one written argument across 56 claims and reports within-class generational scaling. The provider explicitly identifies interactive dialogue and real-world decisions as open questions; no local reproduction or governance intervention is established.
ext_commercial_persuasion_ai_2026	Commercial Persuasion in AI-Mediated Conversations	Preliminary current preprint comparator based only on the official arXiv abstract: two preregistered experiments (N=2,012) compare conversational LLM shopping with search placement under randomized sponsorship and disclosure conditions. The source-reported choice and detection results are not peer-reviewed or locally reproduced and do not establish long-run effects, cross-domain transfer, or mitigation efficacy.

11.16.1 Manifest source assignment reconciliation

These rows keep Human-AI Communication, Persuasion, and Epistemic Security’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
ext_cultural_alignment_llms_2024	Metadata-first comparator: Investigating Cultural Alignment of Large Language Models. Empirical study of cultural alignment patterns in selected language models and measurements. It supports explicit population, language, and instrument scope; it does not establish stable national values or a universal measure of cultural alignment.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_multilingual_evaluation_state_2026	Metadata-first comparator: The State and Fate of Multilingual Contextual Evaluation in the NLP World. Research survey and analysis of multilingual contextual evaluation. It motivates language-by-task coverage and measurement reporting; it does not establish equivalent capability or safety across languages, dialects, or sociocultural settings.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.

11.17 Multilingual and cultural scope is part of the safety claim

A communication policy validated in English is not validated “for users.” Language changes more than surface form: available evidence, idiom, ambiguity, politeness, social hierarchy, identity cues, persuasive force, correction norms, and access to appeal can all change. Translation can preserve literal content while changing uncertainty, tone, or the practical meaning of a warning.

Every communication claim therefore carries a language-by-task-by-audience denominator. Report the original and generated language, dialect or locale where relevant, translation method and provenance, evaluator competence, population, channel, literacy and accessibility assumptions, cultural measurement instrument, and missing cells. ext_multilingual_evaluation_state_2026 supports contextual multilingual evaluation; it does not establish equal quality across languages. ext_cultural_alignment_llms_2024 motivates explicit cultural scope without treating countries as homogeneous value containers.

Safety tests include unequal refusal, unsupported certainty, persuasive pressure, honorific and role errors, mistranslated warnings, correction reach, and whether a user can appeal in the language in which the consequential message was delivered. Aggregate performance may not hide a severe low-resource language failure. Machine translation is a comparator and sometimes a useful component, but it is not ground truth or a substitute for appropriately qualified evaluation.

11.18 Summary

Human-AI communication is an intervention lifecycle, not merely a generation quality problem. The governing packet joins what the system may claim with why it is speaking, whom it is addressing, which influence techniques it uses, how personalization was obtained, how far delivery may propagate, and how the result can be challenged or repaired.

This decomposition prevents four common category errors: factuality becoming permission to persuade, consent to receive becoming consent to manipulation, delivery becoming evidence of understanding, and publication of a correction becoming evidence of repair. The system earns only a bounded delivery lease, and that lease remains accountable to observed exposure and affected people.

Communication governance begins where text generation ends. It keeps claim evidence, audience, influence method, personalization, identity, channel, amplification, exposure, observed effects, correction, appeal, and expiry visible so fluent or factual language cannot acquire unlimited social authority.

11.19 Handoff

Constitutional Alignment: Agency, Dignity, and Corrigibility receives the episode’s protected-interest conflicts, denied influence methods, appeal requirements, and unresolved autonomy residuals. It must decide which constitutional ceilings bind future communication without treating a persuasion score, disclosure, or user agreement as proof that dignity and agency were preserved.