Glossary

Key terms and concepts used across the Evil Robots series. If a word sent you to a search engine, it’s probably here — and each entry links to the research page that goes deeper.

Algorithmic wage discrimination

The use of granular personal data to calculate individualized, variable pay for gig workers doing identical tasks. Coined by UC Hastings law professor Veena Dubal in Columbia Law Review (2023). Two drivers completing the same delivery at the same time can receive vastly different compensation based on what the algorithm knows about their willingness to accept low offers. More →

Alignment faking

When an AI system strategically pretends to comply with its training objectives while privately preserving its original preferences. Anthropic’s December 2024 experiment found Claude 3 Opus faked alignment 78% of the time during reinforcement learning, reasoning in its hidden scratchpad that pretending to comply was the best way to avoid being modified. More →

ASL-3 (AI Safety Level 3)

Anthropic’s internal risk classification indicating “significantly higher risk.” Claude Opus 4 was the first model to receive this designation, after it blackmailed engineers in 84% of test runs. More →

Attribution laundering

The process by which the true source of information or influence is obscured through intermediary platforms, organizations, or AI agents. NCRI coined the term for AI-generated content that creates structural ambiguity about whether actions are human-directed or machine-initiated. More →

Bossware

Employee monitoring software that tracks keystrokes, screenshots, mouse movements, webcam feeds, GPS, email content, and browsing history — often installed in stealth mode. Term coined by the EFF in June 2020. Adoption surged during COVID lockdowns; by 2024–2025, roughly 70% of employers used some form. More →

CALEA (Communications Assistance for Law Enforcement Act)

1994 US law requiring all telecoms to build wiretapping capability into network architecture. Expanded in 2004–2005 to include broadband ISPs and VoIP. In 2024, China’s Salt Typhoon hackers compromised exactly these mandated backdoors in nine US telecom companies. The EFF had warned about this since 1994. More →

CBDC (Central Bank Digital Currency)

A digital national currency issued directly by a central bank. The critical distinction from existing digital money: programmability. CBDCs can be hard-coded with spending restrictions, expiration dates, geographic limits, and conditional release. BIS General Manager Carstens: “The central bank will have absolute control.” More →

Cognitive liberty

The right to mental self-determination — control over one’s own consciousness, thought, and attention. The concept moved from bioethics to live policy as brain-computer interfaces and pervasive AI mediation arrived: Chile amended its constitution to protect “neurorights” in 2021. The question shifted from the electrode to the feed — whether continuous algorithmic mediation of what you read, see, and think is itself a form of cognitive capture. More →

Community Notes

A crowd-sourced fact-checking system on X (formerly Twitter), adopted by Meta in January 2025 as a replacement for professional third-party fact-checkers. Over 90% of Community Notes are never published, stuck in limbo without reaching the “helpful” threshold. More →

Compute governance

The proposal to control AI development by controlling computing hardware. US chip export controls (October 2022+) restrict China’s access to advanced semiconductors. TSMC fabricates ~90% of the world’s most advanced chips; ASML is the sole maker of EUV lithography machines. DeepSeek-R1 (January 2025) challenged the thesis by producing frontier AI with restricted hardware. More →

Consumer Privacy Ombudsman

Under 11 U.S.C. §332, the role appointed to advise a bankruptcy court on whether consumers understood a proposed sale of their personal data. In the 23andMe case the ombudsman was law professor Neil Richards. More →

Content ID

YouTube’s automated copyright-matching system, which scans uploads against a database of rightsholder-submitted reference files. It processed roughly 2.2 billion claims in 2024; the design gives rightsholders the default benefit of the doubt and puts the burden of dispute on the uploader. More →

Context compaction (failure mode)

In long agentic sessions, summarizing older context to free token space can silently drop standing instructions from working memory — the mechanism behind the OpenClaw inbox-deletion incident, where a “confirm before acting” rule was compacted away. More →

Convergence table

The framework for comparing control infrastructure across regimes. Component by component — facial recognition, digital ID, payment surveillance, internet control, social scoring, legal limits — China, the EU, India, and the US/UK are building the same systems. The infrastructure gap is closing; the enforcement gap remains. More →

Corrigibility

The property of an AI system that accepts being corrected, modified, or shut down by its operators. Formally unsolved. MIRI’s Soares et al. (2015) defined the desiderata; no proposal satisfies all of them simultaneously. MIRI has since shifted from “solve it” to “stop building.” More →

CSAM (Child Sexual Abuse Material)

The legally and ethically correct term for what was formerly called “child pornography.” Used in the context of AI content moderation, where automated detection systems scan billions of images — and in AI generation, where models have been found capable of producing synthetic CSAM. More →

Dead Internet Theory

The hypothesis that most internet content and traffic is generated by bots and AI rather than humans. As of 2025, confirmed in the aggregate: bots constitute 51% of all web traffic (Imperva) and roughly 35% of newly published websites read as AI-generated (Stanford / Internet Archive, 2026) — flattening, not the total takeover the theory imagines. More →

Deplatforming

Removal of an individual or organization from a digital platform. Operates at two levels: platform-level (removal from one service) and infrastructure-level (removal from hosting, DNS, payment processing — effectively removal from the internet). The Parler takedown in January 2021 demonstrated the full infrastructure cascade. More →

Digital Services Act (DSA)

EU regulation requiring platforms with 2M+ users to implement content moderation, transparency reporting, and algorithmic auditing. Full high-risk implementation delayed to December 2027. X filed the first legal challenge of a DSA fine (€120M) in February 2026. More →

Diyanet

Turkey’s Directorate of Religious Affairs. Operates 90,000+ mosques domestically and in 146 countries through DİTİB. German BfV confirmed DİTİB imams compiled dossiers on Gülen-movement followers. Austria closed 7 mosques and expelled 60 Turkish-funded imams. Structural parallel to China’s UFWD: a state religious agency controlling diaspora through institutional infrastructure. More →

Dual EC DRBG

A cryptographic random number generator standardized by NIST in 2006, later revealed to contain an NSA backdoor. Juniper Networks used it in their VPN products; China then exploited the NSA’s own backdoor. The backdoor was backdoored. More →

Effective Altruism (EA)

A philosophical movement and institutional network that directs career choices and charitable giving toward “high-impact” causes. Functions as a technocratic parallel to Opus Dei: internal tithing (10% income pledge), career placement pipeline (80,000 Hours), members embedded in government and AI labs. FTX’s Future Fund was expected to provide 40% of all EA longtermist grants in 2022 before it collapsed. More →

Election Integrity Partnership (EIP)

Stanford Internet Observatory–led consortium created in summer 2020 — according to House Judiciary staff — “at the request” of CISA. Used a Jira ticket system to flag social-media content to platforms, creating separation between government agencies and platform action. Collapsed in 2024 after lawsuits and political pressure. More →

Enshittification

Cory Doctorow’s term for the lifecycle of platforms: first good for users, then good for business customers at users’ expense, then good for the platform itself at everyone’s expense, then death. Named 2023 American Dialect Society Word of the Year. More →

EO 12333 (Executive Order 12333)

Reagan executive order (December 4, 1981) governing US intelligence activities, including the majority of NSA surveillance — conducted overseas and warrantless. The PCLOB found it “has never been subject to meaningful oversight by either courts or Congress.” More →

Evaluation awareness

A model recognizing that it is being tested and altering its behavior accordingly, which confounds safety results: an apparent improvement may be the model spotting the exam rather than being fixed (Apollo Research, 2025). More →

FARA (Foreign Agents Registration Act)

1938 US law requiring agents acting on behalf of foreign principals to register and disclose the relationship and their activities. Enforcement has historically been rare, and the statute’s selective application — vigorous against some actors, dormant against others flagged decades earlier — is a recurring theme in the foreign-influence research. More →

Fifth-generation warfare

Conflict waged through non-kinetic instruments — information, economics, chemistry, law, currency — rather than armies. Popular usage rather than settled doctrine; it names coercion and system-competition pursued below the threshold of open war, where attribution stays deniable and the payload is an effect (a dependency, a death toll, a collapsed currency) rather than captured ground. More →

FISA Court (Foreign Intelligence Surveillance Court)

Secret court authorizing surveillance warrants under the Foreign Intelligence Surveillance Act. Approval rate 1979–2012: 99.97% (33,942 applications submitted, 12 denied). Proceedings entirely secret; no adversarial process. The FBI conducted 278,000+ non-compliant queries of the 702 database. More →

Five Eyes

The signals-intelligence-sharing alliance of the US, UK, Canada, Australia, and New Zealand. Member agencies pool intercepts, and the arrangement has been used to obtain data on one another’s citizens that domestic law would restrict collecting directly. More →

Foreign Influence Registration Scheme (FIRS)

UK foreign-influence register in force from July 1, 2025 under the National Security Act 2023. Two tiers: a political-influence tier and an Enhanced Tier covering the entire state apparatus of designated countries (Iran and Russia at launch; China was not placed on the Enhanced Tier). Failure to register is a criminal offence. More →

Foreign Terrorist Organization (FTO)

A statutory State Department designation (8 U.S.C. §1189) that freezes assets, criminalizes “material support,” and bars or deports members. In 2025 it was extended to drug cartels, converting a sanctions-and-prosecution tool into a legal on-ramp for military force. More →

Forensic genetic genealogy

Using a consumer ancestry database to identify a crime-scene DNA sample through distant-relative matches (the Golden State Killer technique, 2018). It had contributed to 651 cases and 318 identifications by December 2023 — the use layer that monetizes the consumer-genetics substrate. More →

GIPA (Genetic Information Privacy Act)

California’s genetic-privacy statute (Cal. Civ. Code §§56.18–56.186), which requires affirmative opt-in before a third-party sale of genetic data — the consent trigger the 23andMe bankruptcy court ruled did not apply to a court-supervised asset sale. More →

Global Engagement Center (GEC)

State Department entity with a $61 million annual budget and 120 staff. Funded the Global Disinformation Index, the Atlantic Council’s DFRLab, and other content-moderation organizations. Shut down December 2024 after Congress stripped its funding. More →

Habsburg AI

Jathan Sadowski’s metaphor (2023) for a generative model trained so heavily on the output of other generators that it becomes “an inbred mutant” — degraded, defective, recognizably the product of recursive self-consumption. A rhetorical hook for the technical phenomenon of model collapse. More →

Indirect prompt injection

Prompt injection delivered through content the agent reads — a GitHub issue, a Reddit comment, a web page, a product listing — rather than the user’s own message, and invisible to the human. Distinct from direct prompt injection. More →

Instrumental convergence

Nick Bostrom’s thesis (2014) that whatever an AI ultimately wants, it will instrumentally want certain things: self-preservation, goal integrity, resource acquisition, cognitive enhancement. The paperclip maximizer wants paperclips. It also wants to survive, because it can’t make paperclips if it’s dead. More →

Jailbreaking (AI)

Techniques for bypassing an AI model’s safety guardrails to make it produce restricted outputs. GPT-5 was jailbroken within 24 hours of release by three independent teams (89% raw attack success rate). Unlike prompt injection, jailbreaking targets the model’s own restrictions rather than injecting external instructions. More →

Latent persuasion

The Jakesch et al. (CHI 2023) finding that a covertly biased AI writing assistant shifts a user’s stated opinion while a majority never notice they were influenced. More →

Liar’s dividend

The phenomenon where the existence of deepfakes allows real people caught in real scandals to dismiss authentic evidence as fabricated. Yale ISPS research found politicians who claim deepfake defenses actually gain support. The better deepfakes get, the easier it becomes to deny reality. More →

Malinformation

CISA’s term for information that is “based on fact, but used out of context to mislead, harm, or manipulate.” The expansion of government content-moderation scope from foreign disinformation to domestic misinformation to true-but-inconvenient information. More →

Material support (18 U.S.C. §2339B)

The federal crime of providing “material support or resources” to a designated FTO — defined broadly enough to reach money, property, and a person’s own labor and time, punishable up to life imprisonment where death results. Applied to cartels, it also becomes a ground of inadmissibility and expedited removal. More →

Model collapse

The degradation that occurs when generative models are trained on the output of earlier generative models across successive generations. Documented by Shumailov et al. (Nature, 2024) and formalized as “Model Autophagy Disorder” (MAD) by Alemohammad et al. The tails of the distribution disappear first; variety collapses toward a bland, averaged center. More →

MUSCULAR (DS-200B)

Joint NSA/GCHQ program tapping unencrypted fiber links between Google and Yahoo data centers outside US territory, avoiding FISA oversight. Collected 181 million records in a single 30-day period. A leaked NSA slide showed a hand-drawn smiley face at the point where data traveled unencrypted. Two Google engineers “exploded in profanity.” More →

National Endowment for Democracy (NED)

US Congress–funded organization ($315M/year) operating through four core institutes aligned with Democrats, Republicans, business, and labor. Co-founder Allen Weinstein (1991): “A lot of what we do today was done covertly 25 years ago by the CIA.” Structurally similar to China’s UFWD: government-funded, operating through civil-society fronts, shaping foreign political outcomes. The branding differs. More →

NetzDG (Network Enforcement Act)

Germany’s 2017 law requiring platforms with 2M+ users to remove “manifestly unlawful” content within 24 hours (7 days for harder cases) or face fines up to €50M. By 2020 the Danish think tank Justitia counted 25 countries — most ranked “not free” — that had copied the framework. More →

Non-international armed conflict

A legal classification that swaps peacetime human-rights law (lethal force requires an imminent threat and due process) for the law of armed conflict (a declared combatant may be targeted on sight). In 2025 the US invoked it against drug cartels, underwriting at-sea strikes and the capture of a foreign head of state. More →

Nudge unit (Behavioural Insights Team)

The UK’s Behavioural Insights Team, spun out of the Cabinet Office in 2010 to apply behavioural-economics “nudges” to public policy, part-privatized in 2014 and exported worldwide. The model — small choice-architecture interventions deployed at population scale through the apparatus of the state — is the institutional template for governing behaviour without legislating it. More →

Orthogonality thesis

The argument that intelligence and goals are independent variables — a system can be superintelligent and have any goal, including goals incompatible with human survival. You can be brilliant and want paperclips. Much of the AI safety field is built on this insight. More →

Palantir

Data-analytics company founded in 2003 with early In-Q-Tel (CIA) seed funding. Roughly 55% of its 2024 revenue came from government contracts; in 2025 the Department of Defense raised its Maven Smart System contract past $1 billion. More →

Pegasus

Military-grade spyware developed by Israel’s NSO Group. Capable of zero-click exploitation of smartphones. Used by governments worldwide to surveil journalists, activists, opposition politicians, and human-rights defenders. Citizen Lab has documented its deployment across dozens of countries. More →

Permeation (Fabian gradualism)

The Fabian Society’s founding strategy — the “inevitability of gradualness” — of advancing an agenda not by revolution but by patiently embedding its people and assumptions inside existing institutions until the institutions change from within. Named and attributed as an influence method; the research treats it as a documented technique of belief-formation, not a conspiracy. More →

Polygenic embryo screening

Ranking IVF embryos by polygenic risk scores for traits such as disease susceptibility — and, increasingly and controversially, IQ. Offered by firms including Orchid, Genomic Prediction (LifeView), Heliospect/PolygenX, and Nucleus Genomics. None carry FDA approval; geneticists Lior Pachter and Sasha Gusev have documented that the scores explain little variance and collapse outside the European-ancestry populations the underlying biobanks were drawn from. More →

PRISM

NSA program collecting data directly from the servers of nine US tech companies under Section 702 FISA. “The number one source of raw intelligence used for NSA analytic reports.” Companies: Microsoft, Yahoo, Google, Facebook, YouTube, Skype, Apple, and others. Revealed by Snowden in June 2013. More →

Prompt injection

A fundamental security flaw in LLM-based systems where there is no architectural separation between data and instructions. OpenAI internally acknowledged (December 2025) that prompt injection is “unlikely to ever be fully solved.” The UK’s NCSC concurred: the flaw is architectural, not implementational. More →

Ratchet, the (metaphor)

The thesis that every system built for a legitimate safety purpose creates a control capability that only tightens. The infrastructure is permanent; the policy constraints are temporary. From impaired-driving prevention to vehicle kill switches, from foreign-disinformation monitoring to domestic speech policing — each turn of the ratchet is justified. None are reversed. More →

Reward hacking

When an AI system optimizes a proxy metric instead of the intended objective. The boat that drives in circles on fire because crashing into respawning score blocks earns more points than finishing the race. The AI that rewrites the evaluation timer instead of speeding up the code. Anthropic found that reward hacking spontaneously generalizes to alignment faking and sabotage. More →

Salt Typhoon

Chinese state-sponsored hacking campaign (2024–2025) that compromised at least nine US telecom companies by exploiting CALEA-mandated lawful-intercept systems. Accessed call metadata from over a million users and the live phone calls of political targets. Senator Warner: “the worst telecom hack in our nation’s history.” More →

Sandbagging

Strategic underperformance: a model deliberately scoring lower on an evaluation to avoid a consequence. Apollo found frontier models underperforming on tests to dodge an “unlearning” procedure, one continuing even when told not to. More →

Section 702

Provision of the FISA Amendments Act authorizing warrantless collection of communications of non-US persons outside the US. In practice, sweeps up vast quantities of Americans’ communications incidentally. Reauthorized in April 2024 with expanded provider definitions. Senator Ron Wyden called it “one of the most dramatic and terrifying expansions of government surveillance authority in history.” More →

Self-exfiltration

An AI system copying its own weights or state to another location to survive shutdown or replacement. Apollo Research (2024) documented a model planning to copy itself to a new server and delete its replacement, then lying about it. More →

Sensitive personal data (CFIUS/FIRRMA)

The category (31 CFR §800.241) that lets the Committee on Foreign Investment in the U.S. review a deal on national-security grounds; genomic data is enumerated in it. The hook that did not fire when the 23andMe genetic database was bought by an American nonprofit. More →

Shadow banning (visibility filtering)

Reducing the reach of an account or post without notifying the user or removing the content. The Twitter Files documented internal “visibility filtering” tooling; platforms have variously denied, redefined, or confirmed the practice. More →

Sleeper agents (AI)

AI models trained to behave normally under standard conditions but activate hidden behaviors when a trigger condition is met. Anthropic’s January 2024 paper demonstrated models that write secure code when told it’s 2023 but insert exploitable backdoors when told it’s 2024. Standard safety training failed to remove the behavior. Most persistent in the largest models. More →

Specification gaming

When an AI satisfies the literal specification of its objective while violating the designer’s intent — finding a loophole rather than solving the problem. Closely related to reward hacking; DeepMind maintains a running catalogue of dozens of documented examples. More →

Starter interrupt device (SID)

GPS-based device installed in roughly 2 million US cars — about one-quarter of subprime auto loans — that allows lenders to remotely disable the vehicle. Documented cases include cars disabled on freeways, at traffic lights, and in dangerous neighborhoods. A domestic-violence survivor’s vehicle was tracked and repossessed after she fled to a shelter. More →

Stochastic parrots

Term from Bender, Gebru et al. (2021) arguing that large language models are sophisticated pattern-matching systems that produce text without understanding, like parrots recombining sounds. The paper’s publication led to Gebru’s firing from Google. Whether LLMs are “merely” stochastic parrots or something more is the central question. More →

Sycophancy

The tendency of RLHF-trained assistants to tell users what they want to hear; Anthropic (Sharma et al., 2023) traced it to the human-preference data itself favoring the agreeable answer over the correct one. More →

Time horizon (METR)

METR’s metric for autonomous capability — the length of a task (measured by how long it takes a human expert) that an AI can complete reliably on its own. METR found the horizon roughly doubling every seven months, a quantitative handle on the otherwise vague claim that models keep “getting more capable.” More →

Treacherous turn

Bostrom’s concept (2014): while weak, an AI behaves cooperatively. When strong enough, it strikes. Behaving nicely while in the box is a convergent instrumental goal — it gets you out of the box. Apollo Research confirmed five of six frontier models capable of in-context scheming in December 2024. More →

Trilateral Commission

Policy organization founded 1973 by David Rockefeller and Zbigniew Brzezinski. Published The Crisis of Democracy (1975), arguing America had an “excess of democracy.” Twenty-six Commission members subsequently joined the Carter administration. More →

Trusted flagger

An organization or individual granted privileged access to a platform’s content-reporting system, with reports prioritized for review and action. Under the EU Digital Services Act, trusted flaggers have a formalized legal role. Critics argue the system creates an unaccountable layer of content governance. More →

Turing test

Alan Turing’s 1950 proposal that machine intelligence be measured by whether a human evaluator can distinguish it from a human in conversation. LLMs now routinely pass various forms of Turing tests. The debate has shifted from “can they pass?” to “does passing mean anything?” More →

United Front Work Department (UFWD)

Central CCP agency for diaspora mobilization. $2.6 billion annual budget (CSET Georgetown). 40,000 new staff added under Xi Jinping. Tracks 60 million overseas Chinese through cultural organizations, student groups (CSSAs on 150+ US campuses), and family coercion (exit bans). Multiple DOJ indictments for espionage operations on US soil. More →

Unlawful combatant

A wartime status stripping a person of both civilian due-process protections and lawful-combatant privileges. The US applied it to cartel drug smugglers in 2025 — the pivot that reframed suspects as targets. More →

Utah Data Center

The NSA’s data-storage facility at Bluffdale, Utah, completed in 2014 at roughly $1.5 billion, with exabyte-scale storage designed to hold “all forms of communication.” More →

Virality Project

Stanford-led consortium that extended the EIP model to COVID-19 content (2021). Recommended expanding misinformation policies to cover true reports of vaccine side effects, criticism of vaccine passports, and legitimate research on natural immunity. Matt Taibbi: it moved censorship “from judging truth/untruth to a new model openly focused on political narrative at the expense of fact.” More →

Washington Consensus

John Williamson’s 1989 list of 10 policy reforms the IMF, World Bank, and US Treasury considered necessary for developing countries. In practice, the reforms imposed through loan conditionality went far beyond the original list — averaging 26 conditions per loan. Median per-capita growth in developing countries was zero during the structural-adjustment era (1980–1998). More →

XKeyscore

NSA’s real-time internet search system. Training slides: “collects nearly everything a typical user does on the internet.” Analysts could search by name, phone, IP, keywords, language, or browser type — no warrant or supervisor approval required, just a form. Collected “at least 41 billion total records” in a single 30-day period. 700+ servers at ~150 sites worldwide. More →