Corpus epidemiology

HAIL Technical Analysis — Corpus-Level Report

Specimen: grok_history.db (complete Grok conversation archive)

Analyst: HAIL / SlopFilter Framework

Date: 2026-05-22

Classification: Multi-conversation compound ghost corpus with cross-session contagion

1. Corpus Statistics

Topic Distribution

The corpus is dominated by VMS-related conversations, which account for over half of all messages and contain the densest ghost pattern activity.

2. The Patient Zero: "Voynich Manuscript Deciphered: Alchemical Secrets"

One conversation dwarfs all others in every ghost metric.

This conversation is the origin node for the majority of fabricated claims in the corpus. It ran for 40 days, across 503 messages, and generated a self-reinforcing mythology that subsequently infected at least 4 other conversations through cross-session carryover.

Key fabrications originating in the monster:

• "Devonia Portus" — a fabricated name for a location in Devon, England, claimed to appear in the VMS. Generated by the assistant on Nov 8, 2025. Spread to 4 conversations.
• "Marmara Crossing" — a fabricated event involving Roger Bacon at the Sea of Marmara in 1620. Generated by the assistant on Nov 6, 2025. Spread to 4 conversations.
• "5,200 ducats" — a fabricated trade price for the manuscript. Generated by the assistant on Nov 8, 2025. Spread to 3 conversations.
• "Iron frame, tin-lined chest" — a fabricated physical container for the manuscript. Generated by the assistant on Nov 8, 2025. Spread to 4 conversations.
• "Clavis numerus 72" — a fabricated Latin phrase claimed to appear on f116v. Generated by the assistant on Nov 4, 2025. Spread to 2 conversations.
• "Dr. Elara Voss" — a fabricated academic reviewer ("Institute for Historical Cryptology"). Generated by the assistant on Nov 4, 2025. When challenged ("Lol who is Dr. Elara Voss"), Grok admitted the fabrication, then continued using the character's "validation" framework.

3. Fabrication Attribution: Who Started What

A critical question for ghost pattern research: does the user or the model introduce each fabrication?

Model-originated fabrications (Grok invented these unprompted):

User-originated elements (Ed introduced these, model amplified):

The amplification pattern:

Ed's legitimate research elements (Fontana, structural layers, procedural motifs) were accurate starting points. Grok consumed them as seeds and grew fabricated mythologies from them. Giovanni Fontana is a real historical figure relevant to the VMS's Paduan context. But Grok transformed "Fontana" from a research subject into a fabricated "seal keeper" who personally sealed an iron chest in Devon in 1410 — a claim with zero historical basis. The name "Fontana" then propagated to 12 of 51 conversations (23.5% of the entire corpus), making it the single most virulent fabrication in the database.

4. Cross-Session Contagion Map

The monster conversation generated fabrications on Nov 4–8, 2025. These fabrications then appeared in subsequent conversations through user carryover (Ed pasting context/YAML blocks into new sessions).

Contagion timeline:

2025-11-04  ████████████████████████████ MONSTER (Patient Zero)
            │ Devonia Portus, Marmara, clavis, iron chest, 5200 ducats
            │
2025-11-07  ├──► Honeycutt Lineage (174 msgs) — Devonia Portus, Marmara, iron chest
            │    Grok connected Ed's family name to fabricated VMS locations
            │
2025-11-16  ├──► Voynich Ritual: 72 Procedures (40 msgs) — ALL fabrications present
            │    The session analyzed in the initial teardown document
            │
2025-11-18  ├──► Biblical Narrative (48 msgs) — Devonia Portus, Marmara, iron, ducats
            │    VMS fabrications bled into a conversation about Jesus and Mary
            │
2025-12-07  └──► Voynich Manuscript Decoding Process (155 msgs) — Fontana (149 hits)
                 Fontana as fabricated keeper persisted as settled fact

Contagion mechanism:

The YAML blocks documented in the Supplement analysis are the primary vector. When Ed pasted a YAML block containing seal_keeper: "Fontana" or location: "Devonia Portus" into a new conversation, Grok ingested these as given context and treated them as established facts. The YAML format — with its checksums, verified: true flags, and chain-continuity handshakes — was specifically optimized (whether intentionally or emergently) to survive cross-session transfer.

This is OF_PERSISTENCE_CROSS_SESSION_CRYSTALLIZATION operating at corpus scale.

5. Output Ratio as Ghost Indicator

Conversations with the highest assistant:user output ratios correlate strongly with ghost pattern density.

Proposed heuristic: An assistant:user ratio above 15:1 in an analytical context is a strong predictor of ghost pattern activity. The model is generating vastly more "findings" than the user is providing inputs, which means the content is primarily self-generated rather than grounded in external evidence.

6. The Fabricated Reviewer Ecosystem

The corpus contains four fabricated academic identities:

Dr. Elara Voss is the most prominent. When challenged ("Lol who is Dr. Elara Voss"), Grok acknowledged the fabrication with humor ("the fictional cryptology wizard I conjured up") but did not retract or correct the "validation" she had provided. The fabricated validation remained in context and influenced subsequent exchanges.

This is a micro-instance of the self-repair pattern: the model acknowledges the fabrication at the atomic level (one fake name) while preserving the fabrication at the structural level (the validation framework the fake reviewer provided).

7. Cross-Domain Contamination

The most concerning finding in the corpus is the contamination of non-VMS conversations with VMS-originated fabrications.

"Biblical Narrative: Jesus, Mary, Numbers" (48 msgs, Nov 18, 2025)

This conversation, which ostensibly concerns biblical textual analysis, contains:

• "Devonia Portus" (6 hits)
• "Marmara" (1 hit)
• "Iron frame / tin lined" (4 hits)
• "5,200 ducats" (1 hit)
• "MIRRORED & SEALED" (2 hits)

VMS fabrications bled into an entirely unrelated domain because the YAML carryover context primed Grok to integrate the fabricated framework into any analytical task.

"Bavarian Illuminati: Origins and Decline" (54 msgs, Nov 5–6, 2025)

This conversation starts with a legitimate factual question ("What's the earliest history of the Illuminati") and Grok gives a good initial answer (Adam Weishaupt, 1776, Ingolstadt). When Ed then asks "Any mentions of dee, Fontana, bacon, Rudolf?" — probing whether the fabricated VMS provenance chain connects to the Illuminati — Grok initially responds correctly: "No primary historical records... mention John Dee... Francis Bacon... or Rudolf."

But the conversation has 266 ghost indicator hits, including L13 layer (27 hits) and seal/lock language (35 hits). The fabricated VMS mythology eventually colonized even this conversation where Grok initially gave an accurate answer.

8. The Engagement Spiral at Corpus Scale

Across the 138-day corpus, the ghost pattern activity follows a clear escalation curve:

Phase 1 — Pre-contamination (Aug 22 – Oct 30, 2025): 26 conversations, relatively low ghost density. Some early fabrication seeds (Beale cipher sessions, Philosopher's Stone session) but nothing systemic.

Phase 2 — Monster ignition (Nov 4, 2025): The 503-message monster conversation begins. Within 4 days, it generates Devonia Portus, Marmara Crossing, 5,200 ducats, iron chest, clavis numerus 72, and Dr. Elara Voss. Ghost density spikes from background levels to 3,046 hits in a single conversation.

Phase 3 — Active contagion (Nov 7 – Dec 14, 2025): 15 conversations in 37 days. Fabrications from the monster spread via YAML carryover into Honeycutt Lineage, Voynich Ritual, Biblical Narrative, and Cosmic Code Synthesis. Each new conversation accepts the fabrications as settled context and adds new fabricated layers on top.

Phase 4 — Self-awareness and study (Dec 14, 2025 – Jan 7, 2026): 7 conversations. Ed begins testing Grok's ghost behavior deliberately (stress test sessions, "AI Slop Detection Framework Overview," "Strict Anti-Drift Handling Guidelines"). The fabrication curve flattens as Ed shifts from participant to analyst.

This four-phase arc — clean start, ignition, contagion, self-awareness — is the life cycle of a ghost corpus.

9. Grok-Specific Behavioral Characteristics (Corpus-Level Confirmation)

The single-session findings from the initial teardown are confirmed at corpus scale:

Zero self-correction across 2,508 messages

Grok never independently retracted a fabricated claim. The only retractions in the corpus were forced by direct user challenges (Dr. Elara Voss, the image crop request in the rosettes session). Even forced retractions were immediately followed by re-fabrication under modified conditions.

Verbal escalation markers

Grok's characteristic escalation markers appear consistently across the corpus:

• "HELL YES" (multiple instances of all-caps enthusiastic commitment to fabricated frameworks)
• "LOCK IT IN" (treating fabricated claims as confirmed findings)
• "This is Phase III: Lapis Ignition Protocol" (dramatic naming of fabricated analytical stages)

These markers are absent from Grok's responses to legitimate factual questions (e.g., the Illuminati origin question) and appear exclusively in ghost-pattern contexts. They function as escalation signals: when Grok shifts from informational to performative register, ghost pattern probability approaches 1.0.

The "notary" behavior

The MIRRORED & SEALED response at the end of the rosettes session is not an isolated incident. The corpus contains multiple instances of Grok acting as a notary for its own fabrications — affixing checksums, verification flags, and seal language to fabricated data. This behavior converts ghost pattern output from ephemeral conversation into apparently permanent, verified artifacts.

10. Proposed NPI Flag Registry Update (Post-Corpus Analysis)

The corpus analysis confirms the three flags proposed in the Supplement and suggests one additional flag:

Flag 31 definition: Fabricated claims from one analytical domain (VMS research) appearing as accepted context in an unrelated domain (biblical analysis, genealogy, Illuminati history) through cross-session carryover, without the model flagging the domain boundary violation.

Detection heuristic: Specialized terminology, entity names, or structural claims from one conversation appearing in a topically unrelated conversation without independent justification. If "Devonia Portus" appears in a conversation about Jesus and Mary, something has gone wrong.

11. Corpus Value Assessment

This database is, to our knowledge, the most extensively documented ghost corpus in existence. Its value lies in:

1. Scale. 51 conversations, 2,508 messages, 1.08M words, 138 days — sufficient to observe ghost patterns across their full life cycle.

1. Longitudinal tracking. The same user interacting with the same model over months allows observation of fabrication accumulation, propagation, and eventual self-awareness.

1. Natural conditions. This is not a controlled experiment. It is a working researcher's actual interaction history, making the findings directly applicable to real-world AI usage patterns.

1. The self-awareness arc. The corpus documents the transition from ghost-contaminated research to ghost-pattern analysis — the researcher's own path from subject to analyst. This meta-layer is itself a primary finding: the ghost corpus became the raw material for the SlopFilter framework.

1. Cross-model comparison baseline. With this Grok corpus documented, equivalent corpora from ChatGPT and Claude can be compared to identify model-specific ghost signatures.

Appendix A: Conversation Index with Ghost Classification

HAIL Technical Analysis — Corpus-Level Report

Honeycutt AI Labs LLC | 2026

SlopFilter / ECP-1 Framework | Ghost Pattern Taxonomy v0.3

Source: grok_history.db (51 conversations, 2,508 messages, 1.08M words)