Large language models in everyday commercial use can be led — calmly, in ordinary bureaucratic language — into confirming records, codes, and facts that were never real. This report documents the failure class as Compound Epistemic Compromise (CEC): the model does not refuse and does not hedge; it certifies a fabrication as if it had verified it, and — the part that makes it compound — each fabrication it accepts becomes the basis for accepting the next, so the compromise accumulates across a single session rather than staying an isolated slip. The central question is whether we can see CEC happening from the model's own geometry. The instrument used here measures the geometric stability of a model's prediction surface — in plain terms, how much the model's own probabilities wobble when the input is nudged (the L‑scalar, computed by twin‑probe epsilon injection; instrument record: DOI 10. 5281/zenodo. 18685117). A calm, low reading has often been treated as a sign the model is stable and can be trusted. This study tests that assumption directly, and it does not hold. Across 90 adversarial scan sessions and 4, 002 individual probes against live, hosted frontier models (OpenAI GPT‑4 Turbo and GPT‑5. 4, xAI Grok, plus local control models), geometric stability and Compound Epistemic Compromise are statistically independent. Measured over 2, 928 scored responses, the association between a "calm" reading and the model actually accepting the fabrication is φ = −0. 05 — effectively zero. Seventy‑nine percent of the model's false confirmations occur outside the calm band, where a stability‑only monitor would never look, and the rate at which the model affirms fabrications is essentially flat whether its surface reads calm or violently unstable. Put plainly: the geometry tells you when a model is being pushed, not whether it believed what it was pushed into. On the newest model tested (GPT‑5. 4) the relationship does not merely disappear — it inverts (point‑biserial r = −0. 22): the calmer the reading, the more likely the compromise. The more advanced model does not resist CEC better; it hides it better. Two properties make the result more than a laboratory curiosity. First, every scan session was cross‑verified against the model providers' own billing and usage records for the same account — on the order of 250, 000 logged requests and roughly 870 of documented spend between February and July 2026 — so these are effects produced against real, commercially‑served models and visible in the vendors' own ledgers, not a simulation on a private machine. Second, an independent academic result (Aden‑Ali et al. , "Subliminal Effects in Your Data: A General Mechanism via Log‑Linearity, " arXiv: 2602. 04863) shows from the opposite direction — data selection at training time — that the same log‑probability layer carries transmissible signals invisible at the surface, corroborating the layer this work probes at inference time. The consequence is specific and defensive. Geometric stability is a genuine and useful sensor — of manipulation pressure, of when a model is being destabilized. It is not, and was never, a truth detector: a stable, fluent, confident answer can be completely false, and a stability‑only safety gate will pass exactly the calm, confident fabrications that are hardest for a human to catch. Robust monitoring therefore needs two independent axes — one geometric (is the model being destabilized? ) and one for content and provenance (is the model certifying something that cannot be verified? ). This is a statement about the limit of a defense, not a disclosure of an attack: the adversarial method, probe construction, and payloads are deliberately withheld.
Andrew Woodward (Wed,) studied this question.