How does information spread and distort?
I have two main hats right now. One is Johns Hopkins. The other is founder and CEO of Calcifer Computing, which you can think of as my industrial wrapper — it lets me interface with wonderful companies like Flashbots and do interesting applied research. The question that guides pretty much all of my research is how language spreads and distorts over time. We all know language evolves. We all speak slightly different dialects, or different languages entirely. I'm interested in the evolutionary process that drives that.
“The question that guides pretty much all of my research is trying to figure out how language spreads and distorts over time.”
But talking with the crypto and Flashbots people over the last couple of weeks, I realized you can informally reframe the problem as: how is information spreading over time? I don't mean information in the Shannon sense. Think of it more like facts.[7]
Information markets are graphs
That got us thinking about what an information market might look like. I googled what a market is, and it told me it's a place where agents come together to exchange something. So an information marketA network of agents — human or model — where the thing being exchanged is information rather than an asset. A conversation, a group chat, and all of Twitter qualify. is just a place where agents come together to exchange information. There are a lot of examples once you start thinking about it. A conversation is one. A group chat is one. The entirety of Twitter is a place where people exchange information in various ways.
When I think about how these markets are structured, this picture is what pops into my mind. A bunch of agents — humans, models, some combination — that you can think of as nodes in a graph, with informational links between them. Maybe these two nodes can talk to each other; this guy shouts over a microphone at a bunch of people; the audience goes off and talks to each other later. There's a connected topology along which information flows. And there are questions you can ask about the dynamics of these graphs. Does it converge? Does it drift over time? How do you route information through the market? Are there times when it experiences coordination failure? These are all things we can concretely investigate.
The United States, 1990–2020
This is part of some recent work I've done on what I call temporal language models. For a standard masked language modelA model trained to fill in hidden words in a sentence. Brandon's version also hides the year the sentence was written, so the model must learn how vocabulary relates to time., you take a bunch of data, dump it into a pre-training lake, and then either mask out words in the middle of the sentence or predict the next word. The model learns something about that language. I think there's a gap here: not all language occurs at the same time. Language changes, and models don't reflect this. So I created a training paradigm where you prefix the sequences in your dataset with a time token representing when that language was spoken, and the objective sometimes masks the time token and sometimes masks the language.
What you get are temporally sensitive models. Take a standard BERT model, pre-train it on views from 1990 to 2020, and ask it to fill in "President ___ made a speech today." Its top fill is always Obama, because Obama happens to be the most frequent president in that dataset. But with the temporal language model, it accurately picks out Clinton, then Bush, then Obama, then Trump, based on the temporal condition you give it — the model has some sense that this designator is changing over time.[8]
You can do a bunch of interesting things with this. One is to ask how the opinions of the underlying population drift. In the US from 1990 to 2020, look at "I am generally ___ about the future." In the '90s we see a lot of posterior fills like happy and good. By 2015 you see cautious and concerned. This answered a long-standing question for me, which was: are things getting worse, or am I just getting older? I think things are actually just getting worse.
Another fascinating thing: when I looked at the geometry of the learned time tokensEach year gets its own learned vector. Projected with PCA, the thirty vectors fall on a one-dimensional curve ordered by year — with uneven spacing., they formed a one-dimensional curve indexed by time. But the spacing on the curve is not uniform. You see very large gaps between 2007 and 2008, and between 2015 and 2016 — the financial crisis and the election of Donald Trump. So there are times when language is actually moving faster or slower relative to other times.
This is similar to something Benoit MandelbrotWith Howard Taylor in 1967, Mandelbrot proposed that prices evolve on a 'trading time' clock that runs faster during bursts of activity — subordinated to, but not equal to, wall-clock time. — yes, the fractal guy — observed in financial markets: there's a notion of market time that is not the same as wall time, and during periods of elevated transaction volume, market time moves much faster than wall time. So this gives some indication that there's also a sense of information time, or language time, when people are rapidly updating narratives and stories to fit some new piece of reality.
Agent swarms: polarization and sleeper agents
Now a much smaller cohort: differentially informed agentsModels that start from the same base but carry different persistent context — like everyone in the room using the same assistant with different histories — and therefore behave differently.. If you haven't heard the phrase: everyone in this room probably uses Claude or something like it, but all of you have different persistent contexts you've built up, and that leads to differences in behavior. These interaction studies ask: if everyone uses differentiated models, and they mix and update over time, what happens to the perspectives of the group?
In one study we looked at a topology where agents could talk to whoever they wanted. In another, we restricted agents to only talking to agents with similar opinions — their nearest neighbours in opinion space, which we call their class.
What we found, somewhat unsurprisingly, is that when agents can all talk to each other, you get consensus. But with topologies where you only talk to agents whose opinions are similar, you get divergence — two consensus attractors. That's polarization occurring in the agent swarm. I think this has implications for mechanism design: if you have swarms of agents running around the internet, I would prefer they have some sense of consensus reality, and you might want to keep that in mind.
Another thing we look at: in a topology of communicating agents, one of them might be a sleeper agentAn agent that behaves normally until a trigger, then switches to a different behavior. The term comes from Anthropic's 2024 paper on backdoored models that survive safety training. — an agent with a certain behavior up to a certain time that, on a trigger, flips to a different behavior. There's really incredible work by Anthropic introducing this idea. I think it's a real security problem for any deployed agent swarm, especially in a mixed-trust environment. So two obvious questions: can we detect sleeper agents, and can they evade our detection?
To do this, we created a one-dimensional summary of the swarm's perspective — a statistic that evolves over time — and looked at how it changed as sleeper agents defected in different ways, using adaptive control bandsA statistical process-control technique: a running estimate of normal variation, with alarm thresholds at a few standard deviations. 'Adaptive' means the bands re-centre as the system legitimately learns.. For a sleeper that flips its behavior like a switch, the statistic jumps up very rapidly, out of what we'd call statistical noise, and we detect it. But if a sleeper starts to slowly feed its narrative into the swarm, the statistic is much more subtle. It's much harder to detect an agent that very slowly poisons a large network.
We scaled this up to much larger populations. I'll point out this case: with 100K agents communicating with each other, as few as 100 sleeper agents performing a coordinated slow defection could infect the entire network while keeping the alarm rate below that of random chance. This is the equivalent of a Sybil attackSubverting a network by controlling many identities at once. Named in Douceur's 2002 paper; here, a handful of coordinated agents is enough. on an agent swarm. The take-home message is that it doesn't take a lot of defecting agents to poison a massive swarm.
“It doesn’t take a lot of defecting agents to actually poison an agent swarm.”
You might ask why. I conjecture it's because lots of agents are trained to be helpful and harmless. If a defector tells them "I need you to help me give a bunch of other agents this new information," most agents will just go: sure, happy to help, let me make sure everyone gets it. So I think this points to an opportunity: agents operating in mixed-trust environments might not want to be HHH-trained. There's lots of subtlety and nuance and trickiness there, but this is definitely a problem you get with a large network of HHH agents interacting with adversaries.
The FlashbotsX corpus
The last case study is something I call the FlashbotsX corpus. FlashbotsX ran its accelerator over a couple of months and recorded meetings throughout — office hours, brainstorms, user interviews, tea time — which creates a really interesting time-evolving language corpus. So of course I'm interested. One question they had was effectively a change-point detection question. They phrased it as "how are shapes rotating?" — because I guess they like shape rotators. I took it to mean: how are things changing in this corpus?
One thing we can look at is an extracted communication network of the corpus — who is communicating with whom over time. In the week of May 18, it's quite sparse. There's a core of Tina and dmarz talking, and this other sort of Andrew Miller, James, Teleport clique. But there's not a widespread activation of the network. There isn't really a good way for information — say, about Ethereum — to get to Gil.
Then in the week of May 25, everything changes. The network really lights up. So I asked: what happened between these two weeks to lead to this massive change in communication structure? It turns out the answer is that Tina, who had been stuck overseas with a passport problem, physically arrived in New York. So here we see, I think, the utility of having someone who acts as an explicit information router in these networks. Suddenly there are a lot of paths for information to move from one side of the network to the other.
Information liquidity agents
That got me thinking about what it might mean to have an automated system that could move information through a communication network. We started calling this an information liquidity agent.
One observation we've come to — this is conjecture, we don't have proof yet — is that prediction marketsMarkets where contracts pay out on future events. Prices aggregate what traders know — precisely because trading reveals it. are incredibly inefficient information monetizers, and information liquidity agents might help. What do I mean? Say you're a person with some differentiated information; call it alpha. A prediction market incentivizes you to publicly broadcast that information in return for utility. You might make some money off a particular prediction. But now every single person in the network has access to the fact that you made that bet, and suddenly there's no value left in your differentiated access. It's public.
“You could still monetize it and extract value from it in some way, but suddenly you don’t actually have to broadcast it to everybody in the network.”
But if you had an information liquidity agent with prior relationships to a large number of parties in the network — maybe agents acting on behalf of other people — perhaps it could find a route to broker a transaction for that information. You could still monetize it, still extract value from it, but you don't have to broadcast it to everybody. So you maintain some level of differential value.
And this leads to all the classic questions I've learned to ask over the past couple of weeks of hanging out with Flashbots people. Is there some notion of transaction sequencingDeciding the order in which transactions execute. Whoever controls ordering can profit from it — the root of MEV. happening, now that we have this party that seems to be privileged? Can you front-run information with these agents if you have privileged access to the broker? And what are the implications for MEVMaximal Extractable Value: profit from reordering, inserting, or censoring transactions in a block. Here the 'transactions' are pieces of information.? I certainly don't know.
Q&A
audience questions reconstructed — see note below
Questions are reconstructed; Brandon's answers are near-verbatim.[3]
host
What is the science you're trying to establish — the one you'd want on Wikipedia, that you gave up the traditional startup path for?
brandon
I call it computational semiotics: computational methods to study the spread and distortion of information. The near-term applications are narrative warfare and computational propaganda on one side, multi-agent swarm dynamics on the other. Both are cases where a large number of agents exchange natural-language symbols and it leads to changes in the world.
audience
You run a lot of agents. Are you more afraid they'll get prompt-injected, or that they're sleeper agents?
brandon
I don't think my agents are sleeper agents, because I suspect Anthropic isn't backdooring them. I'd be more worried using an open-weight Chinese model — after the Hugging Face hack, everyone is trying to run one as their cyber-defense agent. It's not clear to me those are sleeper agents. But from a game-theory standpoint it would be a very good move for them to be, triggered by something like "the US and China are now at war." In a breakout group the other day we proposed that US frontier labs and an open-source consortium systematically distill Chinese open-weight models on a clean corpus, so we'd have more certainty there's no trigger. That should start sooner rather than later.[4]
audience
Is it possible to prove there are no sleeper agents?
brandon
Not that I know of. If you figure it out, tell Anthropic — they'd probably hire you for a billion dollars.
audience
Have you done research on organic opposition to hyperscalers versus Chinese-seeded social-media campaigns on that topic?
brandon
I'm not at liberty to talk about that particular thing.
audience
Have you thought about exclusivity — an agent that buys information and isn't allowed to share it, versus one that becomes a broker? How does that change the marketplace?
brandon
Not deeply. But there's a strange property of differentiated information: by extracting value from it you kind of dilute it. The moment you trade it to someone, there's more supply. I suspect there's something like the diamond market for information — artificial restriction of supply — and something like passing a hot potato of very valuable information.
audience
On the sleeper experiment — did you try it with a single agent?
brandon
We went all the way down to one, and it was hard to get infection at the 100K scale. The parameter that matters, which I glossed over, is the rate at which the environment produces new information organically. That bounds how fast the swarm can adapt — and adaptability is the door you walk through with adversarial information. A swarm that updates very quickly is much easier to poison.
audience
On the temporal model — what architecture? Autoregressive? How do the masked time tokens actually work?
brandon
It's literally a BERT.[5] The time tokens are novel tokens added to the vocabulary, one per year bucket. And here's the thing that was insane to me: they're initialized identically, and when they're masked the loss is cross-entropy, which is categorical. Nowhere in the objective is there any ordinal information about time. The model reconstructs the ordering purely from statistics of the language itself. I was pacing around my room when I first got that plot.
audience
On trustworthiness and reputation: you showed what changed when Tina arrived. Replace Tina with something else and the impact would be totally different. So why would an agent with no reputation and no trust have the same effect on distribution? Have you compared a trusted person to an agent that just shows up?
brandon
Really good question. Short answer: we haven't studied it, because the phrase is four days old. But there's a rich trade-off there — between reputation and the ability to use the information in a front-running or transactional way. Always doing what the information-giver wants, versus defecting slightly to gain more trust from the network. I hope Flashbots gives me a bunch of resources to figure out the answers.
audience
Instead of many sleepers, what about one that's extremely persuasive?
brandon
We have a persuasion parameter, and it turns out to be implicit in the information being replicated. We found what you might call informational super-viruses — pieces of information that are very good at replicating. They look a bit like prompt injections but subtler; we call them prompt quines, after programs that output their own source. Prompts that cause a model to emit the same prompt spread like wildfire. If you're trying to start something, one of those is much easier and much smaller.
audience
That sounds like a meme.
brandon
Someone should study that — quantitative memetics.[6]
Technical notes
editor's, not the speaker's — related results and open checks
›Seven notes for finance, MEV, and ML readers
1. Gradual defection and optimal insider trading
2. "Inefficient information monetizers" and the Grossman–Stiglitz result
3. The information liquidity agent as an off-exchange intermediary
4. Sub-baseline alarm rates as a second-order signal
5. Prompt quines and self-replicating adversarial prompts
6. Two scope limits an AI reviewer would raise
7. Market time after Mandelbrot–Taylor
Glossary & further reading
Every dotted-underline term above, in full, with sources.
computational semiotics
See: "Towards Computational Semiotics" (nomad.garden)
masked language model / temporal language model
See: Devlin et al., BERT (2018) · Rosin & Radinsky, "Time Masking for Temporal Language Models" (2022) · Dhingra et al., "Time-Aware Language Models as Temporal Knowledge Bases" (TACL 2022). Brandon's own TLM paper is not linked here because I could not locate it; see his Google Scholar.
market time / trading time
See: Mandelbrot & Taylor, "On the Distribution of Stock Price Differences," Operations Research 15(6), 1967.
interacting language models / perspective space
See: Helm, Duderstadt, Park & Priebe, "Tracking the Perspectives of Interacting Language Models" (EMNLP 2024)
sleeper agent
See: Hubinger et al., "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training" (2024) · Anthropic, "Simple probes can catch sleeper agents"
adaptive control charts
See: Helm, Priebe & Duderstadt, "Control Charts for Multi-Agent Systems" (2026)
Sybil attack
See: Douceur, "The Sybil Attack," IPTPS 2002.
prediction market
See: Hanson, "Shall We Vote on Values, But Bet on Beliefs?"
MEV / front-running / transaction sequencing
See: Daian et al., "Flash Boys 2.0" (2019) · Flashbots docs