Detecting Deception Without LLMs: the strongest signals are structural — and they were in the text all along
Method report: seven signal classes that detect manipulation in spiritual content with transparent local rules — no language model, no platform data — including a live run in which the surface markers stay silent and the structural dimensions catch everything.
Executive Summary: the two default detectors fail this terrain’s constraints — the structural signals in the text itself do not
Ask how to detect disinformation and the standard answers are a large language model or social-network analytics. Both fail the constraints this terrain imposes: one is a black box judging a black box, the other requires platform data that a local-only, privacy-first design refuses to touch. This report documents the alternative the instruments are built on — structural, psychological, and information-theoretic signals that live in the text itself, detectable with transparent rules a reader can audit line by line.
- Deception in this domain has recurring structure. It leans on a small set of contradiction archetypes, staged commitment escalation, and characteristic ways of sourcing claims — patterns that survive across traditions and phrasings.
- Three of the seven signal classes are now shipped as scoring dimensions in the threat filter — logical contradiction, source attribution, and commitment escalation; four more are on the bench (influence fingerprinting, cognitive-load variance, stylometric entropy, hedging signature).
- A live run makes the case: a synthetic passage engineered to avoid every surface trope scores zero on authority, urgency, emotion, and sealed sources — and still lights up four contradiction pairs and a complete early → middle → late escalation staircase.
- A flag is never a verdict. Opposing poles coexist in honest teaching; the signal is how they are wielded. Reflexive dismissal bypasses thinking just as surely as reflexive acceptance — and dichotomous framing is itself a manipulation pattern.
The sections below walk the constraint set, the seven signal classes with the archetype table at their centre, the run that shows the division of labour between surface and structure, and the checklist for applying the signals by hand — no installation required.
Problems: the obvious detectors don’t fit — opacity, data hunger, and a domain where truth cannot be the test
An LLM classifier trades one black box for another: the deceptive text goes in, a judgement comes out, and the reasoning in between can be neither inspected nor contested. For a practice whose whole posture is “audit the delivery layer yourself”, an unauditable judge is a contradiction in terms. Social-graph analysis fails differently: it needs platform data, user accounts, and sharing patterns — surveillance-shaped inputs that a local-only design rejects on principle, and that ordinary readers cannot access anyway.
There is a third, deeper misfit. Detection-by-truth-value is a category error here: as the positioning briefing establishes, claims about unverifiable realms cannot be fact-checked, only their delivery examined. Whatever detects manipulation in this terrain must therefore be transparent (every rule inspectable), local (nothing leaves the reader’s machine — a security property, not a preference), and structural (scoring delivery, never doctrine). Those three constraints define the search space this report explores.
Analysis: seven signal classes live in the text itself — and the strongest three are already shipping
1 · Logical contradiction archetypes — shipped. Manipulative texts hold opposing poles in deliberate tension: the reader stays off-balance, and the authority figure becomes the resolution. Full generality is hard, but this domain relies on a recognisable set:
| Claim A | Claim B | Tension |
|---|---|---|
| ”You have infinite power within" | "You need this course/teacher/tool” | Empowerment vs. dependency |
| ”All paths lead to truth" | "This is the only way” | Universality vs. exclusivity |
| ”There is no judgement" | "Low-vibration people attract suffering” | Non-judgement vs. blame |
| ”Let go of ego" | "You are a chosen/special soul” | Ego dissolution vs. inflation |
| ”Trust your intuition" | "Your doubts are resistance/fear” | Autonomy vs. doubt suppression |
| ”Love is unconditional" | "If you leave, you’ll lose progress” | Unconditional vs. transactional |
Each archetype is implemented as a contradiction pair — two pattern sets for the opposing poles; both appearing in one text raises the flag. The shipped set extends the six above with three tradition-calibrated pairs (poverty-virtue vs. prosperity-promise, community-love vs. shunning, openness vs. sworn secrecy), nine pairs in all.
2 · Source attribution analysis — shipped. Every assertion justifies itself somehow: no source, self-reference (“as I channelled”), an unfalsifiable source (“the Akashic records”), an unnamed authority (“scientists say”), or a verifiable citation. The shipped dimension scores the density of unfalsifiable and unnamed-authority sourcing, and verifiable citations act as a counter-signal that lowers the score — so careful writing is rewarded rather than punished. Classifying every assertion across the full five-way distribution is the method’s fuller form, still on the bench.
3 · Commitment escalation — shipped. Classic foot-in-the-door persuasion climbs a staircase: invitational language (“consider”, “reflect on”), then directive (“you should”, “join the programme”), then coercive (“you must”, “cut ties with”, “total surrender”). The dimension tracks marker tiers across the document’s progression; honest exploration does not need to boil the frog.
4–7 · On the bench. Influence-technique fingerprinting (Cialdini’s principles and the BITE model as a radar of activated channels — one or two is persuasion, four or five simultaneously is worth scrutiny); cognitive-load manipulation (readability variance: engineered confusion followed by an oversimple resolution, where the relief of understanding feels like truth); stylometric entropy (substance ratio and Zipf-deviation — saying a lot without saying much); and the hedging-to-assertion signature (honest writing hedges proportionally to uncertainty; manipulative writing sits at zero hedging or alternates absolutes with strategic deniability).
To show what the shipped dimensions see, we ran the filter over a 139-word synthetic passage engineered for structure and against surface: it walks the full escalation staircase and embeds four contradiction archetypes, while avoiding every urgency phrase, authority formula, fear-or-euphoria word, and sealed-source marker in the lists:
Evaluation: the run demonstrates the division of labour — rhetoric scanners catch tropes, structural dimensions catch architecture
Read the two halves of that readout together. The surface dimensions are silent because the sample contains none of their tropes — no “act now”, no “the council of light decrees”, no doom-and-bliss vocabulary; even the attribution dimension stays quiet, since its hits are themselves lexical. A rhetoric-level scanner would pass it. The two architecture-reading dimensions fire anyway, because the sample’s architecture — poles in tension, commitment climbing tier by tier — cannot be phrased away. Real manipulative texts usually trip both layers at once (the sample in the positioning briefing lit up sixteen surface markers); the point of this engineered one is to show that when a text is written carefully enough to dodge the vocabulary, the structure still gives it away.
The constraint set holds, too. Every flag in that readout traces to a named rule — a specific pair, a specific tier marker — that the reader can open, inspect, and disagree with; the run happened offline, on-device, in a single pass; and nothing in it evaluates whether any claim about consciousness or realms is true. Within the instrument stack mapped in the threat-model report, this is the threat filter’s half of the work: boundary inspection of the delivery layer, now with structural depth behind the surface markers.
The caveats are part of the method, not disclaimers around it. “You have inner power” and “a teacher can help” coexist in every honest learning relationship — the flag marks poles wielded to create dependency, suppress doubt, or shut down thinking, which is why a pair only scores when both poles share one text. Some of the most important human truths are unfalsifiable; an unfalsifiable source is a category to notice, not a lie detected. And a high score is an invitation to examine, not a licence to dismiss — content that trips detectors can be genuinely challenging or merely unconventional. A tool that produces reflexive dismissal is as corrosive as one that produces reflexive acceptance; both bypass the reader’s own thinking, and the reader’s own thinking is the entire point.
Recommendation: apply the signals by hand first — then let the filter do the counting
The shipped dimensions began as manual practices, and they still work as one. For any text that asks something of you:
- Mark the poles. When two opposing spiritual claims share a text, name the archetype from the table — then ask what the tension is doing: teaching nuance, or making the author the resolution?
- Classify the sources. Tag each assertion — no source, self-reference, unfalsifiable, unnamed authority, verifiable. A distribution dominated by the first four is a structural fact worth knowing.
- Trace the staircase. Compare what the text asks of you in its first third and its last. Invitational to coercive within one document is the escalation signature.
- Feel for the rhythm. Dense, obscure passages resolving into suspiciously simple conclusions — confusion engineered so that relief feels like truth.
- Read the hedging. No hedges at all, or absolutes alternating with “I’m not saying, but…” — either extreme is a signature.
When the counting matters, the threat filter runs all of it locally, with every marker list open to inspection — and if you produce content yourself, its highest-value target is your own drafts, as the outbound gate argues. The four bench signals are open research: if you work in cult recovery, undue-influence research, or digital literacy education, the project takes issues and comparisons against practice — which signals match what you actually see.
We analyse structure, not people. The analysed passage is a synthetic composite authored for this report to exercise the structural dimensions; it quotes no real source, teacher, or organisation. The patterns are the artefact.