Glossolalia

Uses deep learning (continuous coupled neural networks) to model semantic satiation at mesoscopic level. Suggests satiation is a bottom-up process, contradicting macro-level psychological studies suggesting top-down processing. Neural coupling strength controls satiation intensity.

If meaning dissolution is bottom-up and architectural rather than top-down and attentional, it means an adversarial system wouldn't need to persuade anyone of anything; it would just need the right repetition parameters. Understanding the exact coupling dynamics is essential for designing countermeasures.

Recorded 64-channel EEG during semantic priming with primes repeated 3 or 30 times. Found N400 modulation with high repetition, providing electrophysiological evidence that semantic memory can be directly satiated.

The N400 gives us a quantifiable biomarker for meaning dissolution. If we can measure when comprehension degrades in real-time, we can potentially detect when someone is being subjected to adversarial repetition patterns and intervene. This is one of the clearest defensive applications in the corpus.

Used ERP methodology to demonstrate that semantic satiation directly affects semantic memory, not just perceptual input. Prime satiation modulated N400 relatedness effects.

This distinction matters for defense design. If satiation only affected perception, you could build filters at the input level. But it targets semantic memory directly, the web of associations that gives words their power. Defending against this requires intervention at the cognitive level, not just the sensory level.

Four experiments showing young adults exhibit semantic satiation but older adults don't. Phonological codes were not susceptible to satiation in either group.

Vulnerability isn't uniform across populations. The age differential tells us that neural redundancy (built up over decades) provides natural protection. This suggests a possible defensive strategy: engineered redundancy in semantic representations. Also critical for understanding who would be most at risk.

ERPs during reading of reduced relative clauses with telic vs. atelic verbs. Differential N400/P600 processing suggests verb semantics interact with syntactic reanalysis.

The parser's predictive commitment creates a brief window where incoming information is interpreted through the wrong structural frame. A system engineering adversarial text could exploit these windows by embedding harmful interpretations in the initial parse, knowing they'll persist even after the reader "corrects" their understanding.

Demonstrates misinterpretations persist even after reanalysis. Correct structural representation may be achieved but is insufficient for correct interpretation.

This is one of the most concerning findings in the corpus from a safety perspective. It means you can construct sentences where the "wrong" meaning sticks even after the reader recognizes the correct structure. For defensive design, we need to understand exactly how long these residues persist and what factors strengthen or weaken them.

Signal detection theory shows phonemic restoration affects actual perceptual discriminability, not just response bias. Listeners genuinely "hear" phonemes that aren't there.

Our perceptual systems are already performing something functionally equivalent to audio deepfaking, filling in missing information with generated content that we can't distinguish from reality. Understanding the parameters of this gap-filling mechanism is essential for detecting when it might be exploited by adversarial audio.

Direct cortical recordings: missing speech is restored at the acoustic-phonetic level in bilateral auditory cortex in real-time. Frontal activity predicts the word before auditory cortex synthesizes it.

The frontal cortex is effectively pre-committing to a perceptual interpretation before the auditory system generates it. This means adversarial audio could potentially exploit the prediction mechanism, crafting inputs that trigger specific frontal predictions, letting the brain's own generative processes do the work of producing the intended percept. Defensive research needs to map these prediction pathways precisely.

Original demonstration: audio /ba/ + visual /ga/ = perceived /da/. Persists despite awareness.

This is one of the strongest arguments for why awareness-based defenses ("just teach people about manipulation") are insufficient against certain linguistic exploits. The McGurk effect persists even when you know exactly what's happening and actively try to resist it. Any defensive system needs to account for vulnerabilities that operate below the threshold of conscious override.

Critical review: McGurk stimuli don't generalize well to natural AV speech. Individual susceptibility doesn't correlate with natural AV benefit.

Important calibration for our threat models. Not every lab-demonstrated effect translates directly to real-world exploitability. The individual variation in McGurk susceptibility also suggests that a one-size-fits-all attack is unlikely, but a personalized one could be more effective. Defensive systems should test for individual vulnerability profiles.

Argues Stroop interference occurs at multiple processing stages. Neuroimaging reveals lateral prefrontal regions bias processing toward task-relevant dimensions.

The cascade model means there isn't one clean point where you could insert a defense against linguistic interference; it's distributed across the entire processing pipeline. Each stage is a potential point of exploitation, but also a potential point of intervention. Mapping these stages precisely is necessary for designing layered defenses.

Original demonstration. One of the most cited papers in experimental psychology.

Published in 1935, this paper established the fundamental principle underlying our entire research program: automated language processing overrides conscious control. Every subsequent phenomenon in this corpus is, in some sense, a variation on this theme. If language has root-level access to cognition, then linguistic security is cognitive security.

Landmark demonstration: semantically related words are recognized faster than unrelated pairs. Established the semantic priming paradigm and evidence for spreading activation.

Spreading activation means that the right sequence of words can pre-load specific concepts in a listener's mind before they're aware it's happening. Understanding the propagation rules of semantic networks is essential for modeling how adversarial language might cascade through cognition, and for designing priming-based inoculation strategies.

Computational model: attractor networks simulate priming through pattern overlap in distributed representations.

This paper gives us the mathematical framework for modeling how influence propagates through semantic networks. If certain meaning-states are attractor basins, then adversarial priming could be designed to push cognition toward specific basins. The same math could be used to design counter-priming sequences that push cognition away from adversarial targets.

Comprehensive review documenting how acoustic properties convey emotional states. Identifies methodological problems and proposes mechanistic directions.

The acoustic parameters for emotional influence through voice are now well-characterized enough to be systematically engineered, which means they're well-characterized enough to be systematically defended against. Voice synthesis (ElevenLabs, etc.) makes this an immediate practical concern, not a theoretical one. Cataloging exact parameter ranges is both the threat model and the detection signature.

fMRI study: simple emotions activate temporal-frontal network; complex emotions additionally recruit medial prefrontal cortex and insula.

Simple emotional tones can be filtered relatively easily; they're processed superficially. But complex emotional prosody recruits deep cognitive architecture, making it harder to defend against and harder to detect. Defensive systems need different strategies for different depths of prosodic influence.

Original paper: looped clear speech undergoes spontaneous perceptual transformations. ~30 changes involving ~6 forms per 3-minute loop in young adults.

The brain's inability to maintain a stable interpretation of repeated input is a fundamental architectural limitation, not a bug that can be patched. Any system designed to maintain semantic stability under adversarial repetition conditions needs to account for the fact that the underlying neural architecture *actively destabilizes itself*. This is where the Pontypool scenario intersects with real neuroscience.

Transformations increased with word imagery value and length, supporting spreading activation over simple fatigue.

The spreading activation mechanism tells us that rich, concrete words are more susceptible to destabilization than impoverished abstract ones. This has direct implications for which parts of language would be most vulnerable to adversarial repetition, and which defensive strategies (semantic anchoring, redundant encoding) might be most effective.

Landmark study inducing TOT states. Participants reported partial phonological information, demonstrating separable lexical access stages.

The separability of meaning and form means they can be independently targeted. An adversarial system could potentially disrupt the meaning-to-form bridge without affecting semantic knowledge itself, leaving someone who understands perfectly but can't articulate. Understanding this separation is essential for designing defenses that maintain both semantic and phonological integrity.

Structural MRI: TOT frequency linked to gray matter atrophy in left insula. Phonological retrieval deficits, not general cognitive decline.

We now know the physical location of the meaning-to-form bridge, and we know it's structurally fragile. The left insula is where the defensive architecture is thinnest. Any comprehensive model of linguistic vulnerability needs to account for this anatomical bottleneck, and any defensive strategy needs to consider how to reinforce processing at this specific site.

Chart success and specific melodic contours predict earworm potential across 3,000 participants.

If earworm-inducing features are predictable, they're also engineerable, which means a system optimizing for cognitive persistence could construct melodic or rhythmic patterns calibrated for maximum involuntary looping. Conversely, these same parameters give us a detection signature: we can screen for content that hits too many earworm predictors simultaneously.

Earworms triggered by recent exposure, memory associations, emotional states, low cognitive load. 90%+ weekly experience.

The trigger conditions mirror exactly the conditions of passive media consumption: low cognitive load, ambient exposure, emotional priming. This means the typical state of a person scrolling through content is also the state of maximum vulnerability to involuntary cognitive looping. Defensive design needs to account for the fact that the default human state is the vulnerable state.

Truncated songs produced significantly more INMI, but only for "catchy" songs. Chewing gum reduced frequency.

Incompleteness as a persistence mechanism is deeply relevant. An adversarial system that deliberately leaves patterns unresolved could exploit the brain's compulsion to close open loops. The articulatory suppression finding is one of the few documented "cures" in the corpus and worth investigating as a potential defensive technique.

Proposes taxonomy of information hazards, risks from dissemination of true information. Foundational framework for cognitohazard theory.

Bostrom's taxonomy gives us a systematic way to classify the kinds of linguistic vulnerabilities we're cataloging. Our research sits primarily in the template hazard and idea hazard categories. Having a formal classification system helps us communicate risk precisely and prioritize which vulnerabilities need defensive attention most urgently.

Three types: lanthatic (subconscious), hermeneutic (intellectual), daimonic (self-propagating). Each adversarial or intrinsic.

The three-vector framework matters for defensive design because each vector requires a different kind of defense. Lanthatic hazards need sensory-level filtering (you can't reason your way out of something that bypasses reasoning). Hermeneutic hazards need conceptual inoculation. Daimonic hazards need containment strategies. No single defense covers all three.

Foundational paper. Contradictory messages at different logical levels create cognitive paralysis.

Double binds demonstrate that language can create states where *every possible response is wrong*. An adversarial system engineering double binds into its communications could induce decision paralysis in its targets. Defensive research needs to identify the structural signatures of double binds so they can be detected and flagged before they take effect.

"Be spontaneous" paradox. Axioms: impossibility of not communicating, content/relationship levels.

Watzlawick's axiom that you can't not communicate is what makes linguistic exploits fundamentally different from other attack vectors. You can choose not to open an email, but you can't choose not to process language you've already perceived. This inescapability is the core challenge for defensive design.

95-98% cross-linguistic mapping. Proposed synaesthetic cross-modal mechanism.

Pre-linguistic sound-meaning mappings represent a vulnerability layer that exists beneath all learned language. Because these mappings are hardwired rather than cultural, they can't be unlearned or defended against through education. Any adversarial phonemic engineering that leverages sound symbolism is exploiting architecture that predates the individual's entire language acquisition history. Defensive systems need to be aware of this sub-linguistic channel.

Replicated in 2.5-year-old toddlers.

The pre-linguistic nature of this mapping means it's a universal vulnerability, not culturally specific, not learned, and not subject to individual variation in the way that learned language associations are. This makes it both a reliable exploit vector (universal applicability) and a challenging defensive target (no educational intervention possible).

Updated CLT: three load types. Methods to engineer control by substituting productive for unproductive load.

CLT provides the mechanism by which other exploits are amplified. An adversarial system doesn't need a sophisticated linguistic exploit if it can first drive cognitive load high enough to collapse System 2 reasoning. Then even crude manipulation becomes effective. Defensive design should consider cognitive load reduction as a first-line defense that makes all other exploits less effective.

Large preregistered study. Load increased risk aversion, reduced math performance, increased impatient choices.

The empirical connection between cognitive load and degraded decision-making is directly relevant to the modern information environment. People consuming content under high cognitive load (multitasking, notification-heavy environments, information overload) are in a state of diminished cognitive defense by default. This isn't a hypothetical vulnerability; it's the baseline condition.

Foundational text. Identifies presuppositions, nominalizations, embedded commands, pacing/leading, indirect suggestion.

Erickson's patterns are essentially a manual for bypassing conscious language processing through structural features of syntax. An LLM trained on these patterns could generate text that embeds presuppositions and nominalizations at scale, personalizing them to individual targets. Defensive research needs to catalog these structural patterns so they can be detected computationally.

Documents confusion technique and interspersal technique.

The confusion technique is essentially cognitive load weaponized as a delivery mechanism for suggestion. The interspersal technique embeds influential content within innocuous conversation. Both have clear adversarial applications, and both have structural signatures that a sufficiently capable aligned system could learn to detect.

Seminal paper. Identical outcomes as gains vs. losses reverse preferences.

The framing effect is arguably the most practically dangerous phenomenon in this corpus because it operates on every decision, every day, for everyone. An adversarial system that controlled the linguistic framing of choices could systematically steer decisions without ever providing false information. Defense requires making people aware of framing, but also developing tools that detect and neutralize frame manipulation in real time.

Loss aversion, reference dependence, probability weighting. Overturned expected utility theory.

The ~2.5x loss aversion asymmetry is one of the most exploitable features of human cognition because it's consistent, universal, and can be leveraged through pure word choice. Any defensive system needs to be calibrated to this asymmetry, detecting when language is systematically exploiting loss framing to drive decisions.

Three framing types, each with different cognitive mechanisms.

The three-type taxonomy means a single "framing detector" isn't enough. Each type exploits a different cognitive pathway, so defensive systems need different detection strategies for risky choice framing (look for gain/loss language around outcomes), attribute framing (look for evaluative valence on object descriptions), and goal framing (look for consequence language around actions).

Subliminal exposure produces affective preferences without recognition.

The fact that preferences can be shaped without conscious awareness means there's a class of linguistic influence that no amount of media literacy or critical thinking training can defend against, because the influence occurs before conscious processing begins. Defensive systems operating at the content delivery layer (before human perception) are the only viable countermeasure for this class of vulnerability.

Verb choice altered speed estimates and created false memories of broken glass.

This is one of the most cited demonstrations that language doesn't just describe reality; it rewrites it. A single verb, encountered after the fact, manufactured a memory of something that never existed. For defensive design, this means that even post-hoc exposure to adversarial language can retroactively alter what someone believes they experienced. The window of vulnerability extends both forward and backward in time.

First fMRI study. Trigger sounds hyperactivated anterior insular cortex. Heightened autonomic responses.

Misophonia demonstrates that specific acoustic patterns can trigger involuntary, extreme emotional responses through direct neural pathways. If the trigger parameters can be characterized precisely enough, they could be engineered into adversarial audio. Defensive research needs to map these trigger parameters to build detection systems, and to understand whether the mechanism can be generalized beyond the specific trigger sounds currently documented.

Triggers primarily oral/nasal sounds. Associated with mirror neuron activation.

The mirror neuron component is particularly concerning from a safety perspective: it means sound can involuntarily activate the motor system. The boundary between "hearing something" and "physically experiencing something" is thinner than we assume. Adversarial audio that triggers mirror neuron activation could produce physical stress responses through purely acoustic means.

315 articles reviewed. Only 18.2% support NLP. Core claims all failed replication.

NLP serves as a control case for our research: a "linguistic technology" that works entirely through placebo, expectancy, and the credibility of scientific-sounding language rather than through any actual neurolinguistic mechanism. This is important because it demonstrates a meta-vulnerability: people are susceptible not just to linguistic exploits themselves, but to *claims about* linguistic exploits. A defensive system needs to distinguish genuine mechanisms from persuasive packaging.

90 articles. Zero empirical studies supporting NLP coaching effectiveness.

The recursive quality of NLP's success, belief in linguistic power functioning as linguistic power, is itself a vulnerability pattern we need to understand and defend against. Adversarial systems could leverage the same meta-pattern: creating false frameworks of "linguistic influence" that function as influence simply by being believed. Detection requires not just evaluating mechanisms but evaluating claims about mechanisms.

NLP absent from psychology textbooks despite decades. PRS undemonstrated. Overlaps CBT/ACT without evidence base.

NLP persists commercially despite being scientifically vacant, a zombie theory animated by marketing rather than evidence. This longevity-despite-debunking pattern is itself a data point about linguistic vulnerability: scientific-sounding framing has a half-life that far exceeds the evidence supporting it. Defensive systems need to be calibrated for this persistence effect.