PRIORITY FILING - INITIAL DRAFT
A fully revised and formatted version will follow.
Gregory Caldwell Beier
Susarb LLC, Cambridge, Massachusetts
March 19, 2026
From the Prolegomena to the Unification of Economics, Computer Science, Mathematics, and Physics by Gregory Caldwell Beier (forthcoming 2026).
© 2026 Gregory Caldwell Beier. Licensed under CC BY-NC-ND 4.0.
The Disclosure Incentive (Beier, 2026b) creates a judgment data stream - a continuous flow of structured, timestamped, attributed, scored assessments of the constraint environment. If this stream is valuable, it will be attacked. This paper identifies four categories of attack on the judgment data stream, analyzes their structure, and argues that no single discipline's defense is sufficient to cover all attack surfaces. Sybil attacks generate fake identities with fabricated track records. Coordinated poisoning manipulates the scoring system through collusion among real agents. AI-generated hollow disclosures produce structurally correct but analytically empty judgments at scale. Adversarial selection games the commitment mechanism by strategically choosing disclosure domains to exploit scoring weaknesses. Each attack has a characteristic signature, and each signature is detectable - but the detection methods draw on different disciplines. Economics detects through track record anomalies and market-price divergence. Computer science detects through statistical fingerprinting and algorithmic complexity analysis. Mathematics detects through calibration impossibility results that constrain what honest scoring patterns can look like. Information theory detects through compression ratio inconsistencies between disclosed reasoning and observed outcomes. The central argument is that the overlapping detection zones of these four approaches have no shared blind spot: an attack sophisticated enough to evade one discipline's detection is caught by another. This cross-disciplinary defense is the strongest practical argument for the unification that the Prolegomena proposes - the judgment data stream's integrity depends on maintaining all four detection channels simultaneously.
Keywords: adversarial economics, mechanism design, Sybil attacks, scoring rules, calibration, information integrity, judgment markets, AI-generated content, collusion
JEL Codes: D82, D47, C72, L86, K42
Every valuable information system attracts adversarial behavior. Financial markets face insider trading, spoofing, and manipulation. Credit rating systems face ratings shopping and conflicts of interest. Peer review systems face fraud, plagiarism, and coordinated citation rings. The judgment data stream created by the Disclosure Incentive (Beier, 2026b) - in which agents publish structured constraint reasoning, scored against outcomes, accumulated into track records - will face its own adversarial pressures proportional to the value the stream creates.
The companion papers acknowledge this without resolving it. Beier (2026b) identifies Sybil attacks, coordinated poisoning, and AI-generated hollow disclosures as potential structural failures and defers their treatment to the present paper. Beier (2026r) establishes that truth-telling is the dominant strategy under proper scoring rules for agents above a calibration threshold q*, but acknowledges that agents below the threshold may find strategic behavior profitable. The present paper takes the adversarial case seriously: it assumes rational, well-resourced adversaries who understand the mechanism's structure and who will exploit any vulnerability that produces private benefit.
Akerlof's (1970) analysis of adverse selection provides the template. When quality is unobservable, low-quality sellers drive out high-quality sellers, and the market unravels. The judgment market faces an analogous risk: if low-quality or fabricated disclosures are indistinguishable from genuine ones, the track record premium erodes, high-calibration agents lose their incentive to disclose, and the information architecture degrades. The question is whether the Disclosure Incentive's verification structure - proper scoring rules, commitment mechanisms, coverage scoring, and the institutional infrastructure of regulated financial markets - is sufficient to prevent this unraveling.
The paper's answer is conditional. No single verification method is sufficient. Each of the four attack categories exploits a different vulnerability, and each requires a different detection approach. What makes the defense viable is that the detection approaches are complementary: they cover different regions of the attack space, and their overlapping coverage leaves no attack that evades all four simultaneously. This complementarity is the practical argument for cross-disciplinary integration - the judgment data stream cannot be defended from within economics alone, or computer science alone, or mathematics alone. It requires all four.
Section 2 classifies the four attack categories. Sections 3 through 6 analyze each attack and its detection. Section 7 develops the cross-disciplinary defense architecture. Section 8 addresses limitations. Section 9 concludes.
The judgment data stream has four components that an adversary can target: identity (who disclosed), content (what was disclosed), scoring (how the disclosure was evaluated), and commitment (what the agent promised to disclose). Each attack category targets a different component.
Attack 1: Sybil attacks target identity. The adversary creates multiple fake identities, each generating disclosures designed to build a track record that appears well-calibrated. The objective is to accumulate track record capital without possessing genuine calibration quality - to manufacture the appearance of demonstrated judgment.
Attack 2: Coordinated poisoning targets scoring. A group of real agents coordinates their disclosures to manipulate the scoring outcomes - for instance, by collectively disclosing assessments that shift market expectations in a direction that makes their prior disclosures look prescient. The objective is to inflate calibration scores through coordinated action rather than genuine foresight.
Attack 3: AI-generated hollow disclosures target content. An adversary uses generative AI to produce disclosures that are structurally correct - they contain all five fields (Input, Method, Output, Identity, Scaling), use appropriate terminology, cite relevant data, and state plausible confidence levels - but that contain no genuine analytical content. The reasoning is mimicked rather than produced. The objective is to generate track record volume at near-zero cognitive cost, hoping that some fraction of the hollow disclosures will score well by chance.
Attack 4: Adversarial selection targets commitment. The adversary exploits the commitment mechanism (Beier, 2026r, Proposition 7) by choosing disclosure domains strategically - committing to domains where calibration is easiest, avoiding domains where it is hardest, and timing commitments to exploit known scoring weaknesses. The objective is to build a track record that overstates general calibration quality by selectively demonstrating calibration only in favorable domains.
A Sybil attack (Douceur, 2002) creates multiple identities controlled by a single adversary. In the judgment market, the adversary generates N pseudonymous identities, each producing disclosures calibrated to build a plausible track record. If successful, the adversary accumulates N track records and earns N times the judgment market return.
The attack is constrained by three features of the Disclosure Incentive's institutional setting.
The first constraint is identity verification. In regulated financial markets - the primary domain where the Disclosure Incentive operates - agents are subject to know-your-customer (KYC) requirements, professional licensing, and fiduciary obligations. Creating a pseudonymous identity that passes these checks requires institutional infrastructure (a registered entity, a compliance record, a professional history) that has real costs. The Sybil attack is not free; it requires investing in the appearance of legitimacy for each fabricated identity.
The second constraint is track record consistency. A single adversary controlling multiple identities will produce disclosures with correlated errors - the same analytical blind spots, the same systematic biases, the same responses to common shocks. Genuine independent analysts, drawing on different information and different analytical frameworks, produce disclosures with uncorrelated errors. The correlation structure of track records across identities is a statistical fingerprint that detection algorithms can exploit.
The third constraint is economic. Each fabricated identity must produce disclosures that score well against outcomes over an extended period. Fabricating calibration over a short period is possible through luck; sustaining it over many scoring cycles requires either genuine calibration (which defeats the purpose of fabrication) or continuous manipulation of the scoring inputs (which is coordinated poisoning, addressed in Section 4).
The detection approach for Sybil attacks is primarily computational: statistical analysis of correlation patterns across track records, anomaly detection in the timing and domain coverage of disclosures, and network analysis of the relationships among identities. Anderson (2020) surveys the security engineering principles applicable to identity-based attacks in information systems; the specific application to judgment markets requires adapting these techniques to the structure of scored disclosures.
Coordinated poisoning involves a group of real agents who collude to inflate their calibration scores. The most direct form: agents coordinate their disclosures to shift market expectations, then benefit when their prior disclosures - which anticipated the shift they engineered - are scored as prescient.
This attack exploits a vulnerability in the scoring mechanism. Proper scoring rules are strictly proper for a single agent reporting independently (Beier, 2026r, Proposition 5). Witkowski and Parkes (2012) showed that the single-agent dominance result can break down when agents have information about others' reports, because an agent can condition their report on what others are expected to say rather than on their own beliefs.
In the Disclosure Incentive setting, coordinated poisoning faces three constraints.
The first is that proper scoring measures calibration against outcomes, not against other agents' forecasts. A group that coordinates disclosures to shift market expectations can move prices, but the scoring rule compares their disclosed probabilities to realized outcomes, not to prices. If the group's coordinated disclosure moves the market but the outcome diverges from their stated confidence, their scores deteriorate. To benefit from coordinated poisoning, the group must not only shift expectations but be correct about the outcome - which requires either genuine foresight (not an attack) or the ability to influence outcomes (market manipulation, which is a separate and already-illegal activity).
The second constraint is that coordinated disclosure produces anomalous agreement patterns. Independent analysts assessing the same constraint environment produce assessments that agree on some dimensions and disagree on others, reflecting their different information and analytical frameworks. Coordinated agents produce assessments that agree suspiciously closely on specific dimensions and at specific times. The statistical signature - clusters of convergent assessments followed by scoring-favorable outcomes - is detectable through the same techniques used to identify coordinated trading in market surveillance.
The third constraint is reputational. Track records are public. A group whose members' track records show correlated scoring improvements coinciding with coordinated disclosure patterns will attract scrutiny from principals, regulators, and competing analysts. The public nature of the track record, which is a design feature of the Disclosure Incentive, makes coordinated poisoning self-documenting: the evidence of coordination is in the record.
The detection approach for coordinated poisoning combines economic analysis (price impact of clustered disclosures, correlation between disclosure timing and scoring outcomes) with statistical methods (agreement pattern analysis, temporal clustering detection). The mathematical dimension is important: calibration theory (Dawid, 1982; DeGroot and Fienberg, 1983) establishes bounds on what honest calibration patterns look like over time, and coordinated poisoning produces patterns that violate those bounds when the coordination is sustained.
The most novel attack category, and the one with no close precedent in the existing adversarial literature, is the use of generative AI to produce disclosures that are structurally correct but analytically hollow. A large language model can generate a five-field disclosure that cites relevant data sources, employs appropriate analytical frameworks, states plausible confidence levels, and reads as a genuine constraint assessment - without any human having performed the underlying analysis.
The economic incentive is clear. If genuine disclosure requires hours of expert analysis while AI-generated disclosure requires seconds of computation, and if the scoring mechanism cannot distinguish the two, then the cost of track record accumulation drops to near zero for anyone with access to generative AI. The judgment market would flood with hollow disclosures, the signal-to-noise ratio would collapse, and the track record premium for genuine calibration would erode - Akerlof's lemons problem applied to the judgment data stream.
Three features of the Disclosure Incentive constrain this attack.
The first is outcome scoring. A hollow disclosure that states plausible-sounding reasoning with moderate confidence levels will, over many scoring cycles, regress to the base rate of the domain. Genuine calibration quality produces scores that exceed the base rate systematically; hollow disclosures do not, because the confidence levels are not grounded in actual analysis. Over a sufficiently long scoring horizon, the track record separates genuine calibration from statistical noise. The vulnerability is the short run: before enough scoring cycles have accumulated, hollow disclosures are indistinguishable from genuine early-stage track records.
A variance-based attack compounds this threat. An adversary generating thousands of AI personas accepts that most will regress to the base rate, but random chance guarantees a handful will achieve statistically significant early track records by luck alone. The adversary burns the failed personas and monetizes the lucky ones before long-run regression catches them. The primary defense is the Scaling field: because it forces articulation of aggregate interaction effects with specific geometric structure, it functions as a complexity trap that is difficult to fake consistently even for lucky AI agents whose early accuracy was driven by variance rather than genuine constraint reasoning.
The second constraint is algorithmic complexity. Kolmogorov (1965) defined the complexity of a string as the length of the shortest program that produces it. Genuine analytical reasoning has high Kolmogorov complexity - it reflects the specific interaction of the analyst's knowledge, information, and judgment in a way that cannot be compressed into a short generating algorithm. AI-generated text has lower effective complexity: it is produced by a model with fixed parameters applied to a prompt, and the generating process leaves statistical fingerprints (token frequency distributions, syntactic regularity, characteristic uncertainty expressions) that differ from the fingerprints of genuine human analysis. Detection methods based on these fingerprints are imperfect and will remain in an arms race with improving generative models, but the complexity asymmetry is structural: genuine analysis is harder to produce than to mimic, and the gap leaves traces.
The third constraint is the Scaling field. Of the five disclosure fields (Input, Method, Output, Identity, Scaling), the Scaling field is the hardest to generate hollowly. Scaling requires assessing interaction effects across agents and across time - what happens when this activity is replicated at scale - and these assessments depend on domain-specific knowledge about constraint environments that generative models trained on text corpora possess only superficially. A hollow Scaling assessment can cite the right framework but will lack the specific quantitative interaction structure (how five operators drawing from the same aquifer affect each other's extraction rates, how simultaneous load from three categories interacts with grid capacity) that genuine constraint analysis contains. The Scaling field functions as a complexity trap: it is the field most likely to expose hollowness because it demands the deepest domain knowledge.
The detection approach for hollow disclosures combines information-theoretic analysis (compression ratio between disclosed reasoning and outcome - genuine reasoning that informs a correct prediction compresses differently from hollow reasoning that coincidentally aligns with an outcome) with computational linguistics (statistical fingerprinting of AI-generated text) and domain-specific evaluation (expert assessment of whether the Scaling field contains genuine interaction analysis or mimicked structure).
Adversarial selection exploits the commitment mechanism of Beier (2026r). The adversary chooses disclosure domains strategically: committing to domains where calibration is easiest (near-term, well-studied, low-variance outcomes) and avoiding domains where it is hardest (long-horizon, poorly understood, high-variance outcomes). The resulting track record overstates the agent's general calibration quality by sampling favorably from the space of possible assessments.
Proposition 7 in the companion paper (Beier, 2026r) partially addresses this attack. The coverage-adjusted scoring rule penalizes narrow commitments by weighting coverage alongside accuracy. An agent who commits to only easy domains achieves high accuracy but low coverage, and the coverage penalty reduces the overall score. For agents above the calibration threshold q*, comprehensive disclosure in a broader domain yields a higher coverage-adjusted score than selective disclosure in a narrow one.
The residual vulnerability is at the boundary. An agent near q* can optimize the tradeoff between coverage and accuracy by choosing a commitment domain that is broad enough to avoid the coverage penalty but concentrated in areas of relative strength. This optimization is rational, not dishonest - it is analogous to an academic publishing in journals where their work has the best fit - and the question is whether it degrades the information quality of the judgment data stream.
The detection approach is primarily economic. Principals hiring on the basis of track records observe the commitment domain alongside the calibration score. An agent with excellent calibration in energy-sector constraint reasoning and no track record in water or infrastructure is evaluated accordingly - the track record is informative about energy and uninformative about everything else. The market for calibration quality differentiates by domain, and adversarial selection produces domain-specific track records that are priced at their domain-specific value rather than at a general premium. The attack is not prevented but it is priced correctly: the adversary's narrow track record earns the premium warranted by the narrow domain, not a general calibration premium.
No single detection method covers all four attack categories. Economic analysis detects adversarial selection and some forms of coordinated poisoning but is weak against sophisticated Sybil attacks and AI-generated content. Computational methods detect Sybil patterns and AI fingerprints but are weak against coordinated poisoning by real agents with genuine identities. Mathematical calibration theory detects violations of honest scoring bounds but cannot distinguish genuine poor calibration from strategic manipulation. Information-theoretic analysis detects compression ratio inconsistencies between reasoning and outcomes but requires outcome data that may not be available for years.
The defense architecture works because the four detection channels are complementary. Consider an adversary attempting to evade detection:
A Sybil attacker who creates identities sophisticated enough to pass economic scrutiny (real-seeming institutional affiliations, plausible commitment domains) still produces correlated error patterns detectable by statistical analysis. A coordinated poisoning group whose statistical agreement patterns are masked by adding noise to each member's disclosures still violates the mathematical bounds on calibration consistency that honest agents satisfy. An AI-generated hollow disclosure that passes linguistic fingerprinting (because the model was fine-tuned to mimic a specific analyst's style) still produces Scaling assessments whose compression ratio against outcomes diverges from what genuine domain expertise produces. An adversarial selector whose commitment domain is broad enough to avoid the coverage penalty still reveals, through the information-theoretic structure of their disclosures, that their reasoning depth varies systematically across subdomains.
Each evasion strategy that defeats one detection channel exposes the adversary to another. The overlapping detection zones have no common blind spot - not because each method is perfect, but because the methods are sensitive to different features of the attack. This complementarity is the structural argument for maintaining all four detection channels, and it is the strongest practical argument for the cross-disciplinary integration that the Prolegomena proposes. The judgment data stream's integrity is a cross-disciplinary problem that requires a cross-disciplinary defense.
The defense is not absolute. A sufficiently resourced adversary who understands all four detection methods and optimizes against all four simultaneously can reduce the probability of detection. The claim is not that the defense is impregnable but that it is robust: the cost of a successful attack is high, the probability of detection increases with the duration of the attack (because more scoring cycles produce more data for each detection method), and the expected return from attacking is lower than the expected return from genuine disclosure for agents whose calibration quality exceeds the threshold q* established in the companion paper. The adversarial equilibrium is one in which the marginal attacker is deterred, not one in which attacks are impossible.
The analysis is taxonomic and structural rather than formal. A game-theoretic model in which adversaries and defenders simultaneously optimize - the adversary choosing an attack strategy, the defense choosing detection thresholds, and both operating under uncertainty about the other's capabilities - would provide tighter bounds on the adversarial equilibrium. That model is beyond the scope of this paper.
The AI-generated hollow disclosure problem is evolving rapidly. The detection methods described in Section 5 - statistical fingerprinting, compression ratio analysis, Scaling field evaluation - are current-generation approaches that will face improving adversarial capabilities as generative models advance. The arms race between generation and detection is real, and this paper does not claim that current detection methods will remain effective indefinitely. What it claims is that the structural asymmetry - genuine analysis has higher complexity than mimicked analysis - persists even as both sides improve, and that this asymmetry provides a permanent (though not insurmountable) advantage to detection.
The cross-disciplinary defense architecture (Section 7) is argued by construction rather than proved. The claim that the four detection channels have no common blind spot is based on analyzing the feature space each method covers and observing that the union covers the full attack space. A formal proof would require specifying the attack space precisely, defining each detection method's coverage region, and proving that the union is complete. This formalization is identified as a direction for future work.
The paper assumes that the institutional infrastructure of regulated financial markets - identity verification, professional licensing, fiduciary obligations, market surveillance - provides a baseline defense that the four detection channels supplement. In unregulated settings, where identity verification is weak and market surveillance is absent, the Sybil attack and coordinated poisoning vulnerabilities are substantially greater. The Disclosure Incentive's adversarial robustness depends on the institutional environment in which it operates.
The analysis does not address state-level adversaries - governments that might wish to manipulate the judgment data stream for strategic purposes, either by suppressing unfavorable constraint disclosures or by flooding the stream with state-directed disinformation. State-level adversarial pressure on information systems is a real and documented phenomenon, and the Disclosure Incentive is not immune to it. The defense against state-level manipulation is primarily institutional (press freedom, judicial independence, international transparency norms) rather than technical, and it falls outside the scope of this paper.
The judgment data stream will be attacked because it is valuable. The attacks will be sophisticated because the attackers are rational and well-resourced. No single discipline's detection method covers the full attack surface.
What makes the defense viable is complementarity. Economic detection covers market-observable anomalies. Computational detection covers statistical fingerprints. Mathematical detection covers calibration bound violations. Information-theoretic detection covers compression ratio inconsistencies. Each method has blind spots, but the blind spots do not overlap. An attack that evades one channel exposes itself to another, and the cost of evading all four simultaneously exceeds the return from the attack for agents above the calibration threshold.
The adversarial analysis is the Prolegomena's most practical argument for cross-disciplinary integration. The judgment data stream cannot be defended from within a single discipline because the attack categories exploit vulnerabilities that span disciplines. The integrity of the information architecture depends on maintaining detection channels that draw on economics, computer science, mathematics, and information theory simultaneously. Unification is not an aesthetic preference. In the adversarial setting, it is a design requirement.
This paper presents results from the Prolegomena to the Unification of Economics, Computer Science, Mathematics, and Physics (Beier, forthcoming 2026). The adversarial analysis developed here supports the companion papers on the Disclosure Incentive (Beier, 2026b) and its mechanism design foundation (Beier, 2026r) by addressing the attack categories those papers defer. The cross-disciplinary defense architecture is the Prolegomena's most practical argument for unification: the judgment data stream's integrity requires all four disciplines because no single discipline's detection covers all attack surfaces. The author invites engagement from the mechanism design, security engineering, information integrity, and AI safety communities.