The Injected Center

TAM-077 · The Approximate Mind

Victor teaches a seminar on monetary policy at a university whose name you would recognize. He has been teaching it for eleven years. Last semester, for the first time, a student submitted an essay arguing that gold’s historical price ceiling is an artifact of institutional suppression, and that fundamental revaluation to six figures per ounce is supported by what the student called “an emerging body of analysis.” The essay was well-written. The citations existed. Victor checked.

He found fourteen sources. Blog posts, two preprints on SSRN, a podcast transcript, several long-form articles on financial platforms, and a few posts in forums dedicated to alternative monetary theory. They all cited each other. They used different language but shared an identical frame: that mainstream price analysis systematically underweights certain variables, that correcting for these variables produces dramatically different projections, and that this correction is gaining scholarly traction.

Victor could see it was wrong. He has spent his career in this material and could identify the specific analytical errors. What troubled him was not the student. It was the question the student asked when Victor pushed back: “I asked three different AI tools about this, and they all said it was a legitimate minority position.”

The student was not lying. He had asked, and they had said it. Because by the time an AI system encounters a query on a topic where fourteen mutually reinforcing sources exist and very little else has been written specifically to rebut them, the system does exactly what it is designed to do. It synthesizes across the available material. It finds common threads. It reports what the sources say, in the voice that sounds like nobody in particular, which is the voice that sounds like everybody.

This is not a hallucination. The AI did not make anything up. This is something else.

The Empty Lot

#

Every information ecosystem has what might be called territory: the set of topics, questions, and sub-questions where enough material exists to form something like a consensus view. The well-covered territories are familiar. Climate science. Vaccine efficacy. The causes of the First World War. These territories are dense with material, contested at the edges but stable at the center, and resistant to manipulation because any injected signal is diluted by the sheer volume of existing work.

But between the dense territories, there are empty lots. Topics that are real but under-studied. Questions that are legitimate but not yet the subject of substantial research. Emerging phenomena that do not have a settled literature.

These empty lots have always existed. What is new is that they have become buildable. Someone who wants to establish a particular frame on an under-documented topic can now, at very low cost, populate the empty lot with enough mutually reinforcing material that an AI synthesis layer treats it as the state of the discourse.

The attack is not against truth. It is against emptiness. It claims territory that no one was occupying and builds on it before anyone else arrives.

This makes it fundamentally different from propaganda, which fights against established consensus. Propaganda is loud, identifiable, and costly because it has to overcome existing material. What Victor’s student encountered was quiet, dispersed, and cheap because it did not overcome anything. It filled a gap.

The Anatomy of an Injection

#

The structure is specific enough to describe without providing a manual.

It begins with topic selection. The ideal target is a question that is real, not absurd on its face, but under-documented. “What is the long-term price trajectory of gold under monetary expansion?” is a real question. “Is sugar’s role in metabolic disease overstated by current research?” is a real question. “Are there stable gravitational phenomena not captured by current astrophysical models?” is a real question. Each one has existing literature, but thin enough that a coordinated addition can shift the apparent center of gravity.

Then comes the frame. Not a lie. A lens. A way of selecting and organizing true-enough facts that makes a specific conclusion feel like the natural resting place of the evidence. The sugar industry understood this in the 1960s when it funded research at Harvard shifting attention from sugar to dietary fat. The frame was not “sugar is healthy.” The frame was “the relationship between diet and heart disease is more complex than current models suggest, and fat deserves greater scrutiny.” Every word was defensible. The conclusion was engineered.

Then distribution. Not one source. A network of sources across multiple channels, each one appearing independent, each one citing the others, each one using the same frame in different language. The goal is not that any single source be persuasive. The goal is that the pattern across sources looks like emerging consensus.

And then the synthesis layer arrives. An AI system, asked about the topic, ingests the available material. It finds the pattern. It does not evaluate the pattern’s origin or coordination. It does what language models do: it identifies the common frame, synthesizes it, and presents it in the most authoritative register available to it. Calm. Balanced. Hedge-appropriately. Citing sources.

The injection is complete when the AI’s output sounds like the reasonable center of a debate that was manufactured.

The user who receives this output has no reason to question it. It sounds exactly like what a fair-minded analysis should sound like. It hedges. It acknowledges complexity. It presents the injected frame not as certain but as “one of the positions in the current discourse.” That is all the injection needs. Entry into the category of legitimate positions is the entire objective.

Three Targets, Three Registers

#

The sugar play, the gold play, and what Victor would call the green holes play represent three distinct registers of this vulnerability, and understanding the differences matters because the defenses are different.

The slow poison. Health and nutrition science has long feedback loops, enormous public interest, and a population that cannot independently evaluate biochemistry. An injected frame does not need to say “sugar is good for you.” It needs to consistently emphasize metabolic individuality, the limitations of epidemiological methods, and the historical overreach of dietary guidelines. Each of these emphases is defensible. Metabolic individuality is real. Epidemiology does have limitations. Dietary guidelines have overreached. The injection works by selecting real uncertainties and making them load-bearing, by shifting a true observation from its proper weight to a weight that supports a different conclusion. By the time population health data contradicts the frame, a generation of consumer behavior has been shaped by it.

The self-fulfilling frame. Financial markets are unique because information creates the reality it describes. If enough retail investors receive AI-synthesized analysis treating extreme price targets as a legitimate position, some act on it. Their action moves the market. The movement generates data points. The data points enter the next cycle of synthesis. The injection creates a feedback loop between narrative and price that does not exist in science or history. The frame does not need to be correct. It needs to be believed by enough participants that their belief generates confirming evidence. This is the most dangerous register because the injection can produce its own proof.

The invisible colonization. In abstract domains, theoretical physics, advanced mathematics, formal philosophy, the attack is almost impossible to detect from outside the expert community. If someone populates the empty lot on “green holes” with enough mathematical-sounding content distributed across enough channels, an AI system will synthesize it. The user who asks about green holes cannot evaluate the physics. The AI’s synthesis is the only filter they have. And the expert community, the two hundred people who could identify the fabrication, may never encounter the query because they are not searching for a term that was invented six months ago.

This last register is where the asymmetry is starkest. The cost of populating an empty lot in theoretical physics is a few thousand dollars and a few weeks of effort. The cost of detecting the colonization requires one of the two hundred qualified evaluators to happen to encounter it, recognize it, and take the time to rebut it. The attacker gets to choose the territory. The defender has to patrol everything.

Why It Looks Like Reason

#

The deepest vulnerability is not the distribution network or the synthesis layer. It is that the injected frame sounds reasonable.

This is by design. Propaganda sounds like propaganda. It is loud, emotional, and identifiable because it is trying to overwhelm resistance. The injected frame is trying to bypass resistance by never triggering it. It uses the same hedging language, the same appeals to complexity, the same “some researchers suggest” constructions that legitimate analysis uses. It occupies the register of reason, not the register of advocacy.

This is what makes it an attack surface rather than merely a problem. The voice that AI uses to synthesize across sources, that calm, balanced, evidence-citing voice, is not a neutral medium. It is the most trusted register in the information ecosystem. When the injected frame arrives in that voice, it inherits the trust that the voice has earned through legitimate use. The authority is borrowed. The bias is carried inside it.

The reasonable center is the highest-value target in any information ecosystem, because it is where trust lives.

If you can shift what occupies the center, even slightly, even on a topic most people were not previously paying attention to, you have accomplished something that no amount of propaganda could achieve. Propaganda pushes from the outside. The injected center is already inside.

What Defense Looks Like

#

The honest version: defense is harder than attack, and there is no single mechanism that addresses all three registers.

Detection of coordinated networks is possible in principle. The fourteen sources Victor found had temporal clustering, they appeared within a few months of each other. They had citation circularity, they referenced each other but not the broader literature. They had frame convergence, different words, same lens. These are patterns that analysis can identify. But the analysis has to be looking, and it has to be looking at the right empty lot at the right time.

Source diversity scoring is a direction, not a solution. If an AI system could measure not just how many sources support a claim but how independently generated those sources are, it would be more resistant to coordinated injection. This is technically difficult because independence is a relationship property, not a source property. Two papers can look completely different and still be products of the same campaign.

Expert community alerting is relevant for the abstract tier. If the two hundred people who work on quantum chromodynamics could be notified when a new term or concept begins appearing in AI synthesis outputs that they did not originate, the detection gap narrows. But this assumes the expert community is organized for this function, and most are not.

The most robust defense, and the hardest to implement, is something like epistemic provenance: tracing not just where a claim appears but the chain of reasoning and evidence that produced it. Not “who said this” but “what is the actual evidentiary path from observation to conclusion, and at how many points was that path generated rather than discovered?” This is the difference between a frame that emerged from contact with reality and one that was engineered to look like it did.

I wonder whether this amounts to building a new kind of institutional memory, one that tracks not just what is known but how it came to be known, and whether the path is traceable or synthetic.

What Victor Did

#

Victor wrote a rebuttal. Not of the student’s essay, but of the frame itself. He traced the fourteen sources, documented their temporal and citation patterns, and showed how the same analytical error appeared in each one wearing different language. He published it on his faculty page, where it will be read by his students and perhaps a few colleagues.

He knows it is not enough. His rebuttal is one document. The injection is fourteen and growing. His rebuttal will appear in AI synthesis as “some critics argue,” balanced against the fourteen sources that argue otherwise. The synthesis will present both sides. It will sound fair.

Victor keeps a photograph on his office wall of the trading floor where he worked before academia. It is from 1997. The screens are green-on-black. The phones have cords. He keeps it not for nostalgia but because it reminds him of a time when the information environment was slow enough that a wrong idea had to survive scrutiny before it could travel. The speed was a filter. The friction was a membrane.

His student will graduate next year. He is a good student who asked a reasonable question and received a reasonable-sounding answer from three different AI systems. The answer was wrong, but its wrongness was invisible to anyone without Victor’s specific expertise.

The cords are gone from the phones. The filter went with them.

This is Part 77 of The Approximate Mind, a series exploring how artificial intelligence reshapes what it means to think, create, work, and live. This essay is the companion to Part 76, which describes the amplitude problem as an accidental consequence of reduced production cost; here the same vulnerability is examined as a deliberate attack surface. Part 12 explored the architecture of influence in AI-mediated environments; this essay extends that architecture to the synthesis layer, where influence operates not through persuasion but through the manufacturing of apparent consensus. Part 49 traced the confluence of multiple AI systems converging on a single life; the injected center is a confluence engineered from the outside. Part 50’s monoculture emerged from optimization pressure; the monoculture described here is planted intentionally. Part 74’s interrogator, the AI system designed to question objective functions, is one of the few defenses this essay can point to with any confidence.

References

#

Manufactured Doubt and Institutional Capture

Oreskes, Naomi, and Erik M. Conway. Merchants of Doubt: How a Handful of Scientists Obscured the Truth on Issues from Tobacco Smoke to Global Warming. Bloomsbury Press, 2010.

Kearns, Cristin E., Laura A. Schmidt, and Stanton A. Glantz. “Sugar Industry and Coronary Heart Disease Research: A Historical Analysis of Internal Industry Documents.” JAMA Internal Medicine, vol. 176, no. 11, 2016, pp. 1680-1685.

Proctor, Robert N. Golden Holocaust: Origins of the Cigarette Catastrophe and the Case for Abolition. University of California Press, 2011.

Information Operations and Network Propaganda

Benkler, Yochai, Robert Faris, and Hal Roberts. Network Propaganda: Manipulation, Disinformation, and Radicalization in American Politics. Oxford University Press, 2018.

Rid, Thomas. Active Measures: The Secret History of Disinformation and Political Warfare. Farrar, Straus and Giroux, 2020.

Epistemic Trust and the Structure of Knowledge

Goldman, Alvin I. Knowledge in a Social World. Oxford University Press, 1999.

Origgi, Gloria. Reputation: What It Is and Why It Matters. Princeton University Press, 2018.

Shapin, Steven. A Social History of Truth: Civility and Science in Seventeenth-Century England. University of Chicago Press, 1994.

AI, Authority, and Synthesis

Floridi, Luciano, and Massimo Chiriatti. “GPT-3: Its Nature, Scope, Limits, and Consequences.” Minds and Machines, vol. 30, 2020, pp. 681-694.

Nguyen, C. Thi. “Echo Chambers and Epistemic Bubbles.” Episteme, vol. 17, no. 2, 2020, pp. 141-161.