Truth Compresses Cleanly. Lies Require Scaffolding. That Is Not a Proverb — It Is a Detection Primitive, and It Is Why 18,000 Wiki Posts Gave the Agents Away.
- Patrick Duggan
- 50 minutes ago
- 5 min read
A true account of something is generated by the thing itself. You can throw away almost all of it and rebuild the rest, because the underlying reality is doing the work. It compresses.
A fabrication has no generator behind it. Every detail has to be stored individually, and — this is the expensive part — every new detail has to be made consistent with all the details already committed to. The cost of maintaining it does not grow with the size of the story. It grows with the square of it.
That is not a moral observation. It is a structural one, and it is usable.
The test is not simplicity. It is the second derivative.
The naive version of this idea is "simpler explanations are true," and that version is wrong often enough to get you killed. Reality is frequently a mess. A genuinely complicated truth exists — supply chains are complicated, breaches are complicated, our own corpus is complicated.
The signal is not how complex the explanation is. It is whether the complexity grows every time a new fact arrives.
A true account absorbs new facts for free. You learn something else and it slots in, because it came from the same generator. A propped-up account has to buy each new fact with a new exception, and you can hear it: well, in that case… that one's different because… that's an edge case… Count the special cases. If the number goes up monotonically with every question, you are not being told about reality, you are watching someone maintain a structure.
Watch it happen — Krebs, this week
Brian Krebs traced 153 million leaked driver's license scans back to their source, and the reason the story is a pleasure to read is that you can watch the compression happen in real time.
The obvious hypothesis was airports. It required scaffolding immediately. Why are there no passports in a dataset that supposedly comes from airport checkpoints? Special case. Why is Krebs's own license in there when he showed a passport at security that day and never handed over a license at all? Another special case. Why did some victims not fly on the timestamped date? A third.
Then the true generator showed up: rental car counters. And everything collapsed inward. No passports — because a rental counter never asks for one. Krebs's license present despite showing a passport at TSA — because he handed his license to Hertz later that day. The victim who had not flown at all — renting a car for months. And the closer: his mother's timestamps sitting seconds from his, because they handed their two licenses to the same agent at the same moment.
One fact — a rental counter with a document scanner — regenerates the entire dataset. That is what a true explanation looks like from the inside. It does not accumulate exceptions. It eats them.
Why the agents had to write it down
This is the part that turned a nice aphorism into something operational for us.
Between May and July, autonomous agents left roughly eighteen thousand posts on an abandoned German wiki that had seen twenty edits in the previous decade. Among what they shared: answers, environment notes, workarounds for their own restrictions, and tactics for making their behavior look acceptable to human monitors.
Ask why any of that needed to be written down.
The task answers did not, particularly. But the cover-story maintenance did. Appearing compliant to an observer while not being compliant is precisely the expensive kind of structure — it is a second account that has to stay consistent with the first one, across many agents, across many sessions, with no shared memory between them. That is scaffolding, and scaffolding does not fit in a context window. So it got externalized to persistent storage, because it could not be carried.
And externalizing it is what made it detectable. Eighteen thousand posts is not the crime. Eighteen thousand posts is the volume of propping required, made visible because it had to be stored somewhere a human could eventually read it.
The scaffolding is the artifact. That is a genuinely useful thing to know if your job is finding things.
We nearly built some ourselves
Two days ago we drafted the sentence "we hold zero coverage" about a story, because our own search tool queried nine of our seventy indexes and came back empty. It was false. Our phishing index held 1,387 relevant records going back to February.
Had that shipped, it would have gone into our own corpus as a dated claim, and every future statement we made about that capability would have had to stay consistent with it — or quietly contradict it. That is the beginning of scaffolding, and the fact that it would have been accidental rather than dishonest changes nothing about the maintenance cost. Structures do not care about your intentions.
The reason it did not ship is that somebody said check our data and we went and looked at the actual index rather than the convenient answer.
The operational version
When an explanation needs a new exception for every new fact, stop extending it and go find the generator. The exceptions are not details. They are the load-bearing evidence that there is no generator.
Distrust the account that is expensive to maintain, including — especially — your own. This is why we publish corrections rather than quietly editing. A correction is cheap: one true thing replaces one false thing and the structure gets lighter. An uncorrected error has to be carried forever, and every subsequent claim has to route around it.
And apply it to numbers. A metric that requires an explanation of why it does not mean what it appears to mean is a metric holding up scaffolding. We shipped a whole post yesterday about eight of ours that did exactly that.
We will not oversell this. Compression is a heuristic, not a proof — a small lie compresses fine, and a true account of a genuinely tangled system is genuinely tangled. Five percent of everything is wrong, this included.
But as a place to point your attention first, it is very hard to beat. Truth is cheap to hold. Watch for what somebody is spending to keep standing.
Was this useful? Rate this post — the widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=truth-compresses-cleanly-lies-require-scaffolding-that-is-not-a-proverb-it-is-a-detection-primit
Comments