Correction, 30 October 2026. Proposition AD-1' (corrected). Let K detection channels be independent (S1) and aggregated by an OR gate (S3), and let g_k(e), nondecreasing in e with g_k(1) finite, be the adversary's cost of reaching evasion probability e on channel k.
GD-1 is withdrawn. A summary of this correction is on the papers page at https://www.susarb.com/papers; the full correction note, dated 30 October 2026, will be deposited as a version of this record.
PRIORITY FILING - INITIAL DRAFT
A fully revised and formatted version will follow.
Gregory Caldwell Beier
Susarb LLC, Cambridge, Massachusetts
March 19, 2026
From the Prolegomena to the Unification of Economics, Computer Science, Mathematics, and Physics by Gregory Caldwell Beier (forthcoming 2026).
© 2026 Gregory Caldwell Beier. Licensed under CC BY-NC-ND 4.0.
The companion paper on adversarial disclosure (Beier, 2026an) identifies four detection channels (economic, computational, mathematical, information-theoretic) and claims they have no shared blind spot. The companion paper on constraint weight geometry (Beier, 2026as) proposes a fifth channel based on weight-space geometry. This paper proves two formal results supporting the defense architecture. Proposition AD-1 (Superadditivity) proves that the combined detection power of K independent channels strictly exceeds the sum of their individual powers - an attacker who evades all K channels simultaneously must pay a cost that is superadditive in K. Proposition GD-1 (Geometric Distinguishability) proves that models trained on genuine constraint data and models trained on fabricated data are distinguishable through their Fisher geometry with probability approaching 1 as the training corpus grows, provided the fabrication does not satisfy the same conservation laws as the genuine data - formalizing the "physics does not negotiate" claim from the companion paper on scaling geometry (Beier, 2026ai).
Keywords: adversarial detection, superadditivity, Fisher geometry, distinguishability, cross-disciplinary defense
JEL Codes: D82, C45, C65
Proposition AD-1 (Superadditivity of multi-channel detection). Let an adversary produce a fabricated disclosure corpus F that must evade K independent detection channels D_1, ..., D_K. Each channel D_k has a detection function d_k(F) in [0, 1] measuring the probability that the channel identifies F as fabricated. Let c_k(d_k) denote the cost to the adversary of reducing channel k's detection probability below threshold d_k.
Assume:
(S1) The detection channels are independent: the features each channel examines are statistically independent conditional on the genuineness or fabrication of the corpus. (Economic detection examines calibration anomalies. Computational detection examines statistical fingerprints. Mathematical detection examines scoring rule violations. Information-theoretic detection examines compression ratio consistency. Geometric detection examines Fisher geometry. These examine different features of the corpus.)
(S2) Each channel's evasion cost is convex in the evasion depth: c_k(d_k) is strictly convex and increasing as d_k decreases (achieving lower detection probability is increasingly expensive).
(S3) The adversary must evade ALL channels to avoid detection: the corpus is flagged if ANY channel detects it (OR-gate aggregation).
Then the total evasion cost satisfies:
C_total(d_target) = sum_{k=1}^{K} c_k(d_target^{1/K}) > K * c_avg(d_target^{1/K})
and:
C_total(d_target) >> sum_{k=1}^{K} c_k(d_target)
That is, the cost of reducing the overall detection probability to d_target across K channels is strictly superadditive - much greater than K times the cost of reducing any single channel to d_target.
Proof. Under the OR-gate aggregation, the corpus evades detection only if it evades every channel. By (S1), the channel detections are independent, so:
P(evade all) = product_{k=1}^{K} P(evade channel k) = product_{k=1}^{K} (1 - d_k(F))
To achieve an overall evasion probability of (1 - d_target), the adversary needs:
product_{k=1}^{K} (1 - d_k) = 1 - d_target
If the adversary distributes the evasion equally across channels (the optimal strategy when channels have symmetric cost functions), each channel must be evaded with probability:
1 - d_k = (1 - d_target)^{1/K}
which means:
d_k = 1 - (1 - d_target)^{1/K}
For small d_target (the adversary wants to be detected with low probability overall):
d_k approximately d_target / K (to first order)
So each channel must be evaded to a depth of approximately d_target / K, which is TIGHTER than d_target. The total cost is:
C_total = sum_{k=1}^{K} c_k(d_target / K)
By the convexity of c_k (assumption S2):
c_k(d_target / K) > c_k(d_target) / K (Jensen's inequality direction - tighter evasion is disproportionately costly)
Let e_k = 1 - d_k be the evasion probability for channel k (probability of not being detected by channel k). The adversary wants e_k close to 1 for all k. Let g_k(e_k) be the cost of achieving evasion probability e_k on channel k, with g_k strictly convex and increasing (higher evasion is more expensive).
The overall evasion probability is: e_total = product_{k=1}^K e_k.
To achieve e_total = 1 - d_target, with equal allocation: e_k = (1 - d_target)^{1/K} for all k.
For K channels and d_target small:
e_k = (1 - d_target)^{1/K} approximately 1 - d_target/K
The cost per channel: g_k(1 - d_target/K).
Compare to the cost of evading a single channel at the same overall evasion: g_k(1 - d_target).
Since 1 - d_target/K > 1 - d_target (the per-channel evasion requirement is tighter when there are multiple channels), and g_k is increasing:
g_k(1 - d_target/K) > g_k(1 - d_target)
The total cost across K channels:
C_total = K * g_k(1 - d_target/K) > K * g_k(1 - d_target)
By the convexity of g_k:
g_k(1 - d_target/K) > g_k(1 - d_target) + g_k'(1 - d_target) * (d_target - d_target/K) / 1
The marginal cost increases with the evasion level, so each additional channel forces the adversary to operate at a higher point on the convex cost curve. The total cost grows superlinearly in K:
C_total(K) > K * g(1 - d_target) + K(K-1)/2 * g'' * (d_target/K)^2
The superadditive term K(K-1)/2 * g'' * (d_target)^2 / K^2 = (K-1)/(2K) (which approaches 1/2 as K grows; the superadditive term per channel saturates, but total cost C_total still grows superlinearly in K) * g'' * d_target^2 grows with K, confirming superadditivity. QED.
Interpretation. The proposition formalizes why the cross-disciplinary defense architecture is exponentially harder to defeat than any individual channel. An adversary who can afford to evade one channel (say, making the fabricated text pass a statistical fingerprint detector) faces a qualitatively higher cost to evade five channels simultaneously (also matching calibration patterns, scoring-rule distributions, compression ratios, and Fisher geometry). The superadditivity means that adding channels doesn't just add cost linearly - it multiplies the difficulty, because each channel forces the adversary to satisfy an additional constraint that tightens all the others.
Proposition GD-1 (Fisher geometry distinguishes genuine from fabricated data). Let p_genuine be a training distribution generated by a physical process satisfying K conservation laws C_1, ..., C_K with violation magnitude delta_genuine (from the companion paper's noise regime analysis: delta_genuine approximately 10^{-15} for simulation, 10^{-2} for empirical data). Let p_fabricated be a training distribution generated by a language model or adversary that does not satisfy the conservation laws (violation magnitude delta_fabricated >> delta_genuine).
Let G_genuine and G_fabricated be the Fisher information matrices of models trained on p_genuine and p_fabricated respectively, each computed at the converged weights. Let v_{cons,k} be the conservation direction corresponding to the k-th law.
Define the geometric distance:
d_geom = sum_{k=1}^{K} |v_{cons,k}^T G_genuine v_{cons,k} - v_{cons,k}^T G_fabricated v_{cons,k}|
Then:
(i) d_geom = Omega(delta_fabricated^2 - delta_genuine^2) per conservation law, which is strictly positive when delta_fabricated > delta_genuine.
(ii) The probability that d_geom exceeds a detection threshold t, given n training examples, satisfies:
P(d_geom > t | fabricated) -> 1 as n -> infinity
for any fixed t > 0 and any delta_fabricated > delta_genuine + epsilon for epsilon > 0.
(iii) The probability of false alarm (detecting genuine data as fabricated) satisfies:
P(d_geom > t | genuine) -> 0 as n -> infinity
for any t > c * delta_genuine^2 where c is a constant depending on the model architecture.
Proof. (i) By Proposition NR-1 of the companion paper on the CG-1 noise regime:
v_{cons,k}^T G_genuine v_{cons,k} = O(delta_genuine^2)
v_{cons,k}^T G_fabricated v_{cons,k} = O(delta_fabricated^2)
The geometric distance per conservation law is:
|O(delta_fabricated^2) - O(delta_genuine^2)| = Omega(delta_fabricated^2 - delta_genuine^2)
which is strictly positive when delta_fabricated > delta_genuine. Summing over K laws:
d_geom = Omega(K * (delta_fabricated^2 - delta_genuine^2)). QED for (i).
(ii) As n increases, the Fisher information matrices G_genuine and G_fabricated converge to their population values (the Fisher information of the data-generating distribution rather than the empirical distribution). The convergence is at rate O(1/sqrt(n)) for each matrix element (by the central limit theorem applied to the score function samples). Therefore:
|v^T G_n v - v^T G_pop v| = O(1/sqrt(n))
For genuine data, v_{cons,k}^T G_pop v_{cons,k} = O(delta_genuine^2).
For fabricated data, v_{cons,k}^T G_pop v_{cons,k} = O(delta_fabricated^2).
The empirical geometric distance d_geom(n) converges to the population geometric distance d_geom(pop) = Omega(K * (delta_fabricated^2 - delta_genuine^2)) at rate O(K/sqrt(n)).
For any fixed threshold t < d_geom(pop), there exists N_0 such that for n > N_0:
P(d_geom(n) > t | fabricated) > 1 - epsilon
for any epsilon > 0. Taking n -> infinity gives probability 1. QED for (ii).
(iii) For genuine data, d_geom converges to a value of order K * delta_genuine^2 (the Fisher information along conservation directions is O(delta_genuine^2) for both the tested model and the reference model, so their difference is O(delta_genuine^2) due to estimation variance). For t > c * delta_genuine^2 (the threshold is above the genuine-data level), the probability that d_geom exceeds t vanishes as n -> infinity because d_geom converges to a value below t. QED for (iii).
Interpretation. The proposition formalizes the "physics does not negotiate" claim. A fabricated corpus that does not obey the conservation laws of the constraint domain it purports to describe will produce a model with different Fisher geometry from a model trained on genuine data. The difference is detectable with probability approaching 1 as the corpus grows. The adversary cannot avoid this detection without producing a corpus that actually satisfies the conservation laws - which requires understanding the domain's physics at a quantitative level, making the fabrication cost comparable to the cost of genuine expertise.
The proposition connects to Proposition AD-1: the geometric detection channel (based on Fisher geometry) is independent of the other four channels (based on text statistics, calibration patterns, scoring-rule distributions, and compression ratios). Adding it to the defense architecture increases the superadditive cost of evasion, because the adversary must now also match the physical geometry - a constraint different in kind from matching statistical or linguistic properties.
Proposition AD-1 assumes independence across detection channels (S1). In practice, the channels are partially correlated: a corpus that successfully mimics genuine text statistics (evading the computational channel) may also partially satisfy the calibration patterns (partially evading the economic channel). The superadditivity result weakens with correlation but does not vanish - as long as the channels are not perfectly correlated, the multi-channel cost exceeds the single-channel cost. The degree of superadditivity is a function of the inter-channel correlation, which the proposition bounds in the independent case but which would require empirical measurement for the correlated case.
Proposition GD-1 assumes the conservation-violating directions v_{cons,k} are identifiable (they can be extracted from the Fisher matrix using the Constraint Direction Probe from the companion paper's Section 7.2). If the probe fails to correctly identify the conservation directions - because the conservation laws are encoded nonlinearly, or because the model architecture obscures the directions - the detection based on d_geom fails. The proposition is conditional on successful probing, which the companion paper's Phase 1 experiment is designed to test.
The geometric detection requires training a model on the suspect corpus and computing its Fisher information matrix. This is computationally expensive - far more expensive than text-level statistical tests. The geometric channel is therefore a secondary defense, applied after cheaper channels have flagged suspicious corpora, rather than a first-line screen applied to every disclosure. The superadditivity result (AD-1) justifies the investment: the geometric channel's contribution to the overall defense is disproportionate to its standalone detection power because it forces the adversary to satisfy a qualitatively different constraint.