By the time the book reached Chapter 11 it was naming capture in three vocabularies across three chapters, and they had stopped agreeing. Chapter 8 had a capture-asymmetry between two halves of an institutional carrier (training vs. preservation); Chapter 10 had a self-vs-external distinction at the platform scale; Chapter 11 had three flavors specific to LLMs (corpus, objective, deployment). Each chapter introduced its capture story because it needed it, and the cross-chapter result was that “capture” was doing unification work I hadn’t done. This note does it, and the unification is straightforward: each chapter’s flavor is the same mechanism operating on a different selection-design surface. Name the surfaces, and the taxonomy falls into place along two further axes, source and recovery.
What capture means
The medium note defined manipulation as tuning a gate’s criteria against truth. Capture is that definition with one substitution: capture is tuning a selection-design surface against the desideratum it was supposed to serve. Surface generalizes “gate” to any selection-design layer that ranks, admits, or generates content; desideratum generalizes “truth” to whatever that layer was nominally serving (faithfulness for a corpus, helpfulness for an objective, accuracy for a preservation institution, user benefit for an engagement gate). That is the whole definition, and the taxonomy is what it produces when you push on the parameters. (I keep calling these layers substrates, the word used throughout; each is a place where some entity ranks or admits or generates content according to criteria, which is the structural commonality that makes them one list rather than a per-chapter inventory.)
Axis 1: which substrate is captured, and how it recovers
The book has named seven substrates across three chapters. The load-bearing property of each is its recovery dynamics: how the damage propagates after capture, and how hard it is to undo. Sorted roughly from most to least recoverable:
| Substrate | Chapter | What it is | Recovery after capture |
|---|---|---|---|
| Deployment configuration | 11 | System prompts, fine-tunes, refusal policies, tool constraints | Cheapest: a different prompt or policy. Most opaque to audit, since configs are unpublished and change silently. |
| Gate-criteria (runtime) | 10 | What an algorithm rewards, an editor accepts, a reviewer passes | Cheaper to re-tune than to retrain; harder to audit than deployment because users can’t see the gate. |
| Preservation archive | 8 | The institution holding the un-[[compressed-form | compressed form]]: journals, libraries, precedent |
| Receiver training | 8 | Curricula, apprenticeships, pedagogy that install decoding keys in people | Damages the receivers themselves; a trained key is chunked machinery, not a revisable belief. At least a cohort cycle, usually a generation; cumulative if the captured curriculum keeps running. |
| Training corpus | 11 | The data an LLM was fitted to | Damages every future model trained on it; a static artifact that doesn’t decay, so it tilts models indefinitely until retrained from a different corpus, the most expensive operation in the stack. |
| Training objective | 11 | The loss and reward signal the model was tuned against | Damages every output and self-reinforces across model generations (outputs feed the internet, the internet feeds the next corpus). Compounds rather than decays: the worst recovery dynamics in the book. |
| Option space | 10 | The set of variants the medium can express at all | Frozen at design time; changing it requires a new medium, not a re-tuned old one. Captures “by absence”: suppressed variants never form, so nothing downstream even encounters them. |
Two structural results fall out of the table that the per-chapter treatments couldn’t show. First, training-corpus capture (Ch 11) is structurally the same problem as receiver-training capture (Ch 8): both damage the consumer of the substrate’s output rather than the substrate itself, both require waiting out a generation of installed keys, and both are harder to walk back than the substrate’s own re-tuning suggests. That gives a cleaner principle than Ch 8’s dichotomy: it is not that “training capture is worse than preservation capture” in general, it is that consumer-key captures (the ones that install a decoding key in people or models) are worse than surface captures (the ones that only shape what a consumer encounters), and Ch 8 was naming the special case where the substrate happens to be receiver-training. Corpus, objective, and receiver-training are consumer-key; gate, option-space, deployment, and preservation are surface. Second, training-objective capture is uniquely bad because it self-reinforces across model generations, the property no other substrate has: even captured receiver-training recovers as cohorts turn over, while a captured objective leaks into the data the next model trains on, a feedback loop that compounds. It is the model-collapse dynamic (Shumailov et al. 2024) pointed at values rather than at accuracy.
Axis 2: who is doing the capturing
Chapter 10 split this into self and external; the unified treatment makes the distinction available at every substrate. External capture: an adversary (a propaganda operation, a state actor, an ad-tech firm, a competitor) learns a substrate’s criteria and crafts inputs that exploit them, the “asymmetric arms race” *The Misinformation Age* (p.175) named. The captor is meaningfully outside the institution, which has, in principle, an interest in defeating it. Self-capture: the institution’s own operating logic is the captor, the platform’s business model tuning engagement gates against truth, the LLM operator’s revenue tuning the corpus against costly faithfulness, the training institution’s prestige pressure tuning curricula toward credentialism. Same mechanism, no external adversary, and the captured state and the institution’s normal operation are the same state. Composite (external riding self): external actors operating inside the gradient self-capture already created, not fighting the substrate but aligning with it, a propaganda operation riding an engagement-tuned platform that was already favoring the content the propaganda wants to inject.
The asymmetry, carried in three vocabularies: self-capture is structurally more stable than external capture because there is no captor to defeat. External capture has a contestable adversary to fight, regulate, or expose; self-capture has none, because the captured agent is the institution doing its job. You can defeat a captor; you cannot defeat an equilibrium, and the only way to remove self-capture is to dismantle the arrangement that holds it in place, typically the resource flow that makes the captured state profitable. That profitability condition is what distinguishes a stably-captured institution from a merely-broken one: the captured state has to pay, or the institution’s normal-operations pressure moves it off the equilibrium. And composite capture is the empirically dominant mode, which is why the asymmetric arms race is asymmetric: the attackers run with the gradient self-capture set, not because they are cleverer, and defenders would have to fight the equilibrium and the attackers riding it, the equilibrium being far the harder of the two.
How captured substrates compose
The substrates don’t capture in isolation. Self-capture creates the gradient external capture rides, so stably-captured institutions are almost always running composite capture. Training-corpus capture composes with receiver-training capture into a uniquely closed loop: a captured curriculum installs the very preconditions a captured corpus is designed to decode against, so the receiver prompts the captured model, which produces outputs decoded by the key the curriculum installed, with no external evidence channel, the loop closed at both ends. That is Chapter 11’s worst case, the captured LLM trained on a captured corpus used as a tutor. Objective capture composes with corpus capture by the self-reinforcement above, so after one generation a captured corpus is partially objective capture, the two merging over time. Deployment capture composes with everything but recoverably (a captured deployment on an uncaptured corpus can be reverted; a captured corpus on a clean deployment cannot be reverted by re-deploying). And option-space capture composes by pre-empting everything, since a suppressed variant never has to be selected against because it never forms. The heuristic that falls out: defend the substrates hardest to recover from first; choosing, defend consumer-key over surface and self-reinforcing over static. That supports Ch 8’s prioritization (training over preservation), refines Ch 10’s (the engagement gate is a surface substrate, but the cost-shifting that captures receiver-training is the deeper damage), and gives Ch 11 its order (objective > corpus > deployment > runtime).
Where I land
The unified vocabulary: capture is one mechanism, tuning a selection-design surface against the desideratum it was supposed to serve, operating across seven substrates, from three sources (external, self, composite), with recovery asymmetries set by the substrate, consumer-key captures harder to undo than surface ones and self-reinforcing substrates worst of all. That subsumes the three earlier stories without contradiction: Ch 8’s asymmetry was the consumer-key-vs-surface principle in the receiver-training case, Ch 10’s self-vs-external was the source axis, Ch 11’s corpus/objective/deployment were three more substrates. So the diagnostic move from here is uniform: when naming a capture concern, name its substrate, source, and recovery asymmetry. “The engagement gate is self-captured, a surface substrate, recoverable per gate-criteria but stably so given the resource flow.” “An LLM’s objective is corporately self-captured, self-reinforcing, the worst recovery dynamics in the book.” “A captured curriculum is composite-captured on a consumer-key substrate, generational recovery.” One thing the taxonomy does not give the book, and Chapter 12 will need: a positive theory of what a well-tuned substrate looks like. Every framing here treats capture as a damage state, but a substrate tuned for its consumer’s interest is also a tuning, and there is only a negative theory of what its failure looks like, not a positive one of how to recognize the healthy case.
Where I’m still uncertain
- The substrate list is a working census, not a closure. Seven substrates engaged so far; a state’s apparatus (legal precedent, regulatory rulemaking, monetary-policy gates) and emerging media (VR, brain-computer interfaces, on-chain governance) will add more. The three axes should accommodate new substrates without restructuring, but I haven’t stress-tested that.
- Source attribution is often ambiguous. “Self” and “external” assume well-defined institutional boundaries, but regulators, shareholders, advertisers, and board members are simultaneously inside and outside depending on how you slice the institution. The structural distinction holds (is the captor a contestable adversary or coterminous with normal operation), but real cases need boundary-work I haven’t given criteria for.
- The recovery hierarchy is ordinal, not quantified, and can flip. A tiny captured training cohort can recover faster than a large captured archive with no surviving copies. Read the order as a default, not a law.
- Self-capture’s “no captor to defeat” may be too absolute. Equilibria do dismantle: businesses fail, institutions reform, captured states sometimes recover without an external actor defeating anything. The composition rules suggest the route (change the resource flow), but the historical evidence is mixed, and a polish pass should engage the cases where self-capture broke on its own.
- “Consumer-key vs. surface” may deserve its own note. It is the sharpest principle here, underlies Ch 8’s asymmetry, and explains why corpus, objective, and training are the hard cases; whether to extract it depends on how often it surfaces later.
← Chapter 11: AI as a New Kind of Node · Chapter 12: Infrastructure for Integration →