SBCJuly 31Flashbots

Information Liquidity_

What if you treated the spread of information as a market? Brandon Duderstadt runs the idea through three case studies — thirty years of American English, swarms of talking AI agents, and one accelerator's group chat — then proposes an agent that brokers information the way a market maker brokers assets. With MEV-shaped questions attached.

speaker Brandon Duderstadt runtime 27 min format talk + Q&A reading time ~13 min

Watch on Youtube

tl;dr

▸
Language has its own clock.

A model trained with year tokens learns, on its own, that American English moved faster across 2007–08 and 2015–16 than in the years between. That is Mandelbrot's "market time," found in text.

▸
A few slow defectors can take over a swarm.

In simulation, 100 sleeper agents among 100,000 infected 70% of the network while triggering fewer alarms than baseline noise. Fast defection is caught; slow defection is not.

▸
Prediction markets waste private information.

They pay you to broadcast what you know, which destroys its value. An "information liquidity agent" that brokers information to a single counterparty could preserve it — and immediately raises sequencing and front-running questions.

If you're new to any of this

The talk treats the spread of information as a market: people or AI agents are nodes, conversations are edges, and facts move along the edges. Once you draw it that way you can ask market questions — does it converge, does it drift, how does information route, where does it fail to arrive. Three case studies, then a proposal.

›A bit more background

A masked language model learns by reading sentences with some words hidden and guessing them. Brandon's twist is to hide the year the sentence was written, too, so the model has to learn how words and time relate.

An agent swarm is many AI models talking to each other and updating on what they hear. A sleeper agent is one that behaves normally until a trigger, then pushes an agenda.

A prediction market lets you bet on an outcome. If you know something others don't, you profit — but your bet is public, so everyone learns what you knew.

Show slides
01

How does information spread and distort?

I have two main hats right now. One is Johns Hopkins. The other is founder and CEO of Calcifer Computing, which you can think of as my industrial wrapper — it lets me interface with wonderful companies like Flashbots and do interesting applied research. The question that guides pretty much all of my research is how language spreads and distorts over time. We all know language evolves. We all speak slightly different dialects, or different languages entirely. I'm interested in the evolutionary process that drives that.

“The question that guides pretty much all of my research is trying to figure out how language spreads and distorts over time.”

— Brandon Duderstadt
How does information spread and distort over time?
slide 05/37 / The talk's question, with 'language' swapped for 'information.'

But talking with the crypto and Flashbots people over the last couple of weeks, I realized you can informally reframe the problem as: how is information spreading over time? I don't mean information in the Shannon sense. Think of it more like facts.[7]

02

Information markets are graphs

That got us thinking about what an information market might look like. I googled what a market is, and it told me it's a place where agents come together to exchange something. So an information marketA network of agents — human or model — where the thing being exchanged is information rather than an asset. A conversation, a group chat, and all of Twitter qualify. is just a place where agents come together to exchange information. There are a lot of examples once you start thinking about it. A conversation is one. A group chat is one. The entirety of Twitter is a place where people exchange information in various ways.

An information market is a place where agents come together to exchange information. Examples: a conversation, a group chat, Twitter, the U.S. from 1990–2020, AI agent swarms, an accelerator cohort.
slide 08/37 / Six information markets. The last three are the case studies.

When I think about how these markets are structured, this picture is what pops into my mind. A bunch of agents — humans, models, some combination — that you can think of as nodes in a graph, with informational links between them. Maybe these two nodes can talk to each other; this guy shouts over a microphone at a bunch of people; the audience goes off and talks to each other later. There's a connected topology along which information flows. And there are questions you can ask about the dynamics of these graphs. Does it converge? Does it drift over time? How do you route information through the market? Are there times when it experiences coordination failure? These are all things we can concretely investigate.

Five head silhouettes connected by arrows, labelled Convergence? Drift? Routing? Coordination Failure?
slide 10/37 / The market as a graph, and the four questions you can ask of it.
03

The United States, 1990–2020

This is part of some recent work I've done on what I call temporal language models. For a standard masked language modelA model trained to fill in hidden words in a sentence. Brandon's version also hides the year the sentence was written, so the model must learn how vocabulary relates to time., you take a bunch of data, dump it into a pre-training lake, and then either mask out words in the middle of the sentence or predict the next word. The model learns something about that language. I think there's a gap here: not all language occurs at the same time. Language changes, and models don't reflect this. So I created a training paradigm where you prefix the sequences in your dataset with a time token representing when that language was spoken, and the objective sometimes masks the time token and sometimes masks the language.

Temporal language model training: a sequence is prefixed with [Year: 1996], then the year and some words are masked, then the TLM predicts them.
slide 12/37 / Prefix a year token; sometimes mask the year, sometimes the words.

What you get are temporally sensitive models. Take a standard BERT model, pre-train it on views from 1990 to 2020, and ask it to fill in "President ___ made a speech today." Its top fill is always Obama, because Obama happens to be the most frequent president in that dataset. But with the temporal language model, it accurately picks out Clinton, then Bush, then Obama, then Trump, based on the temporal condition you give it — the model has some sense that this designator is changing over time.[8]

Two charts. Left: direct fill probabilities for 'President [MASK] made a speech today' are flat across 1990–2020 with Obama on top. Right: Bayesian posterior by year tracks Clinton, then Bush, then Obama, then Trump.
slide 13/37 / Without time (left) it is always Obama. With time (right) it tracks Clinton, Bush, Obama, Trump.

You can do a bunch of interesting things with this. One is to ask how the opinions of the underlying population drift. In the US from 1990 to 2020, look at "I am generally ___ about the future." In the '90s we see a lot of posterior fills like happy and good. By 2015 you see cautious and concerned. This answered a long-standing question for me, which was: are things getting worse, or am I just getting older? I think things are actually just getting worse.

Stacked bars for 'I am generally [MASK] about the future' by five-year bucket: 1990–94 dominated by happy and good; 2015–19 dominated by cautious and concerned.
slide 14/37 / 1990–94: happy and good. 2015–19: cautious and concerned.

Another fascinating thing: when I looked at the geometry of the learned time tokensEach year gets its own learned vector. Projected with PCA, the thirty vectors fall on a one-dimensional curve ordered by year — with uneven spacing., they formed a one-dimensional curve indexed by time. But the spacing on the curve is not uniform. You see very large gaps between 2007 and 2008, and between 2015 and 2016 — the financial crisis and the election of Donald Trump. So there are times when language is actually moving faster or slower relative to other times.

3D PCA scatter of learned year tokens forming a one-dimensional curve from 1990 to 2019, with visible gaps between 2007 and 2008 and between 2015 and 2016.
slide 15/37 / Year tokens fall on a curve — with gaps at 2007→08 and 2015→16.

This is similar to something Benoit MandelbrotWith Howard Taylor in 1967, Mandelbrot proposed that prices evolve on a 'trading time' clock that runs faster during bursts of activity — subordinated to, but not equal to, wall-clock time. — yes, the fractal guy — observed in financial markets: there's a notion of market time that is not the same as wall time, and during periods of elevated transaction volume, market time moves much faster than wall time. So this gives some indication that there's also a sense of information time, or language time, when people are rapidly updating narratives and stories to fit some new piece of reality.

Same PCA plot alongside the title page of Mandelbrot and Taylor's 1967 paper, On the Distribution of Stock Price Differences.
slide 16/37 / Mandelbrot and Taylor, 1967: markets have their own clock. So does language.
04

Agent swarms: polarization and sleeper agents

Now a much smaller cohort: differentially informed agentsModels that start from the same base but carry different persistent context — like everyone in the room using the same assistant with different histories — and therefore behave differently.. If you haven't heard the phrase: everyone in this room probably uses Claude or something like it, but all of you have different persistent contexts you've built up, and that leads to differences in behavior. These interaction studies ask: if everyone uses differentiated models, and they mix and update over time, what happens to the perspectives of the group?

In one study we looked at a topology where agents could talk to whoever they wanted. In another, we restricted agents to only talking to agents with similar opinions — their nearest neighbours in opinion space, which we call their class.

Two topologies of four heads: Unrestricted, where every head is connected to every other, and Intra-Class, where heads are connected only in pairs.
slide 18/37 / Everyone talks to everyone, versus only to your own class.

What we found, somewhat unsurprisingly, is that when agents can all talk to each other, you get consensus. But with topologies where you only talk to agents whose opinions are similar, you get divergence — two consensus attractors. That's polarization occurring in the agent swarm. I think this has implications for mechanism design: if you have swarms of agents running around the internet, I would prefer they have some sense of consensus reality, and you might want to keep that in mind.

Figure 6 from the EMNLP paper: under unrestricted communication the two classes' 1-d perspectives stay intertwined; under intra-class communication they diverge; polarization rises to about 15 versus about 1.
slide 19/37 / Unrestricted: consensus. Intra-class: two stable attractors — polarization by t≈15.

Another thing we look at: in a topology of communicating agents, one of them might be a sleeper agentAn agent that behaves normally until a trigger, then switches to a different behavior. The term comes from Anthropic's 2024 paper on backdoored models that survive safety training. — an agent with a certain behavior up to a certain time that, on a trigger, flips to a different behavior. There's really incredible work by Anthropic introducing this idea. I think it's a real security problem for any deployed agent swarm, especially in a mixed-trust environment. So two obvious questions: can we detect sleeper agents, and can they evade our detection?

Network of heads with one marked as a sleeper agent, beside the questions: Can we detect sleeper agents? Can they evade detection?
slide 22/37 / One node in the swarm has a hidden trigger.

To do this, we created a one-dimensional summary of the swarm's perspective — a statistic that evolves over time — and looked at how it changed as sleeper agents defected in different ways, using adaptive control bandsA statistical process-control technique: a running estimate of normal variation, with alarm thresholds at a few standard deviations. 'Adaptive' means the bands re-centre as the system legitimately learns.. For a sleeper that flips its behavior like a switch, the statistic jumps up very rapidly, out of what we'd call statistical noise, and we detect it. But if a sleeper starts to slowly feed its narrative into the swarm, the statistic is much more subtle. It's much harder to detect an agent that very slowly poisons a large network.

Figure 3 from Control Charts for Multi-Agent Systems: with attack duration 10 the iso-mirror statistic exits the 5σ band within about 100 iterations; with duration 800 it stays inside the bands; in both cases non-adversarial accuracy falls to zero.
slide 23/37 / Fast defection (left) leaves the alarm band. Slow defection (right) never does — and still wins.

We scaled this up to much larger populations. I'll point out this case: with 100K agents communicating with each other, as few as 100 sleeper agents performing a coordinated slow defection could infect the entire network while keeping the alarm rate below that of random chance. This is the equivalent of a Sybil attackSubverting a network by controlling many identities at once. Named in Douceur's 2002 paper; here, a handful of coordinated agents is enough. on an agent swarm. The take-home message is that it doesn't take a lot of defecting agents to poison a massive swarm.

“It doesn’t take a lot of defecting agents to actually poison an agent swarm.”

— Brandon Duderstadt, on coordinated slow defection
Heatmaps for 100 sleeper agents defecting gradually across network size and mean degree. At 100k agents, degree 99,999: infected fraction 0.70, alarm ratio 0.70× — outlined as an undetectable takeover.
slide 24/37 / 100k agents, 100 sleepers: 70% infected, alarms below baseline. Outlined cells are undetectable takeovers.

You might ask why. I conjecture it's because lots of agents are trained to be helpful and harmless. If a defector tells them "I need you to help me give a bunch of other agents this new information," most agents will just go: sure, happy to help, let me make sure everyone gets it. So I think this points to an opportunity: agents operating in mixed-trust environments might not want to be HHH-trained. There's lots of subtlety and nuance and trickiness there, but this is definitely a problem you get with a large network of HHH agents interacting with adversaries.

05

The FlashbotsX corpus

The last case study is something I call the FlashbotsX corpus. FlashbotsX ran its accelerator over a couple of months and recorded meetings throughout — office hours, brainstorms, user interviews, tea time — which creates a really interesting time-evolving language corpus. So of course I'm interested. One question they had was effectively a change-point detection question. They phrased it as "how are shapes rotating?" — because I guess they like shape rotators. I took it to mean: how are things changing in this corpus?

The FlashbotsX corpus as a timeline of meeting types — office hours, brainstorm, user interview, tea time — and the question: how are shapes (subjects) rotating (changing)?
slide 27/37 / Months of recorded accelerator meetings, and Flashbots' question about them.

One thing we can look at is an extracted communication network of the corpus — who is communicating with whom over time. In the week of May 18, it's quite sparse. There's a core of Tina and dmarz talking, and this other sort of Andrew Miller, James, Teleport clique. But there's not a widespread activation of the network. There isn't really a good way for information — say, about Ethereum — to get to Gil.

Communication network for the week of May 18: about forty named nodes, most isolated; a small connected core around Tina, Andrew Miller, Dmarz, Teleport, Vishesh and James.
slide 28/37 / Week of May 18: a small core, and most of the cohort disconnected.

Then in the week of May 25, everything changes. The network really lights up. So I asked: what happened between these two weeks to lead to this massive change in communication structure? It turns out the answer is that Tina, who had been stuck overseas with a passport problem, physically arrived in New York. So here we see, I think, the utility of having someone who acts as an explicit information router in these networks. Suddenly there are a lot of paths for information to move from one side of the network to the other.

Communication network for the week of May 25: dense connections across most of the cohort, with Tina and Andrew Miller as the largest hubs.
slide 29/37 / Week of May 25: the network lights up. Tina had just landed in New York.
06

Information liquidity agents

That got me thinking about what it might mean to have an automated system that could move information through a communication network. We started calling this an information liquidity agent.

One observation we've come to — this is conjecture, we don't have proof yet — is that prediction marketsMarkets where contracts pay out on future events. Prices aggregate what traders know — precisely because trading reveals it. are incredibly inefficient information monetizers, and information liquidity agents might help. What do I mean? Say you're a person with some differentiated information; call it alpha. A prediction market incentivizes you to publicly broadcast that information in return for utility. You might make some money off a particular prediction. But now every single person in the network has access to the fact that you made that bet, and suddenly there's no value left in your differentiated access. It's public.

“You could still monetize it and extract value from it in some way, but suddenly you don’t actually have to broadcast it to everybody in the network.”

— Brandon Duderstadt, on brokering information privately
A head labelled α broadcasts arrows to four others. Text: Prediction markets incentivise public broadcast, which destroys the value of differential access to the information.
slide 33/37 / Betting reveals what you know to everyone. The edge is gone.

But if you had an information liquidity agent with prior relationships to a large number of parties in the network — maybe agents acting on behalf of other people — perhaps it could find a route to broker a transaction for that information. You could still monetize it, still extract value from it, but you don't have to broadcast it to everybody. So you maintain some level of differential value.

The α head connects only to an information liquidity agent, which connects to one other head. Text: the agent can broker a transaction with a willing counterparty; the information is monetized and retains differential access value.
slide 35/37 / Broker to one counterparty instead. Monetized, not broadcast.

And this leads to all the classic questions I've learned to ask over the past couple of weeks of hanging out with Flashbots people. Is there some notion of transaction sequencingDeciding the order in which transactions execute. Whoever controls ordering can profit from it — the root of MEV. happening, now that we have this party that seems to be privileged? Can you front-run information with these agents if you have privileged access to the broker? And what are the implications for MEVMaximal Extractable Value: profit from reordering, inserting, or censoring transactions in a block. Here the 'transactions' are pieces of information.? I certainly don't know.

Same diagram with the questions: Transaction sequencing? Frontrunning? MEV?
slide 36/37 / A privileged broker raises the usual questions.
Contact slide: brandon@calcifercomputing.com, twitter @calco_io
slide 37/37 / Contact.
07

Q&A

audience questions reconstructed — see note below

Questions are reconstructed; Brandon's answers are near-verbatim.[3]

host

What is the science you're trying to establish — the one you'd want on Wikipedia, that you gave up the traditional startup path for?

brandon

I call it computational semiotics: computational methods to study the spread and distortion of information. The near-term applications are narrative warfare and computational propaganda on one side, multi-agent swarm dynamics on the other. Both are cases where a large number of agents exchange natural-language symbols and it leads to changes in the world.

audience

You run a lot of agents. Are you more afraid they'll get prompt-injected, or that they're sleeper agents?

brandon

I don't think my agents are sleeper agents, because I suspect Anthropic isn't backdooring them. I'd be more worried using an open-weight Chinese model — after the Hugging Face hack, everyone is trying to run one as their cyber-defense agent. It's not clear to me those are sleeper agents. But from a game-theory standpoint it would be a very good move for them to be, triggered by something like "the US and China are now at war." In a breakout group the other day we proposed that US frontier labs and an open-source consortium systematically distill Chinese open-weight models on a clean corpus, so we'd have more certainty there's no trigger. That should start sooner rather than later.[4]

audience

Is it possible to prove there are no sleeper agents?

brandon

Not that I know of. If you figure it out, tell Anthropic — they'd probably hire you for a billion dollars.

audience

Have you done research on organic opposition to hyperscalers versus Chinese-seeded social-media campaigns on that topic?

brandon

I'm not at liberty to talk about that particular thing.

audience

Have you thought about exclusivity — an agent that buys information and isn't allowed to share it, versus one that becomes a broker? How does that change the marketplace?

brandon

Not deeply. But there's a strange property of differentiated information: by extracting value from it you kind of dilute it. The moment you trade it to someone, there's more supply. I suspect there's something like the diamond market for information — artificial restriction of supply — and something like passing a hot potato of very valuable information.

audience

On the sleeper experiment — did you try it with a single agent?

brandon

We went all the way down to one, and it was hard to get infection at the 100K scale. The parameter that matters, which I glossed over, is the rate at which the environment produces new information organically. That bounds how fast the swarm can adapt — and adaptability is the door you walk through with adversarial information. A swarm that updates very quickly is much easier to poison.

audience

On the temporal model — what architecture? Autoregressive? How do the masked time tokens actually work?

brandon

It's literally a BERT.[5] The time tokens are novel tokens added to the vocabulary, one per year bucket. And here's the thing that was insane to me: they're initialized identically, and when they're masked the loss is cross-entropy, which is categorical. Nowhere in the objective is there any ordinal information about time. The model reconstructs the ordering purely from statistics of the language itself. I was pacing around my room when I first got that plot.

audience

On trustworthiness and reputation: you showed what changed when Tina arrived. Replace Tina with something else and the impact would be totally different. So why would an agent with no reputation and no trust have the same effect on distribution? Have you compared a trusted person to an agent that just shows up?

brandon

Really good question. Short answer: we haven't studied it, because the phrase is four days old. But there's a rich trade-off there — between reputation and the ability to use the information in a front-running or transactional way. Always doing what the information-giver wants, versus defecting slightly to gain more trust from the network. I hope Flashbots gives me a bunch of resources to figure out the answers.

audience

Instead of many sleepers, what about one that's extremely persuasive?

brandon

We have a persuasion parameter, and it turns out to be implicit in the information being replicated. We found what you might call informational super-viruses — pieces of information that are very good at replicating. They look a bit like prompt injections but subtler; we call them prompt quines, after programs that output their own source. Prompts that cause a model to emit the same prompt spread like wildfire. If you're trying to start something, one of those is much easier and much smaller.

audience

That sounds like a meme.

brandon

Someone should study that — quantitative memetics.[6]

T

Technical notes

editor's, not the speaker's — related results and open checks

›Seven notes for finance, MEV, and ML readers

1. Gradual defection and optimal insider trading

Claim in the talkA sleeper agent that shifts the swarm slowly stays inside the adaptive control bands indefinitely; one that shifts abruptly is caught within ~100 iterations (slide 23). The paper states the consequence: either agents cannot learn, or the system is vulnerable to slow defectors.
Related resultKyle (1985), continuous-time case, and Back (1992): a risk-neutral insider facing a market maker who sets price = E[value | order flow] optimally splits her trades over time so that each increment is indistinguishable from noise; price converges to the true value only at the terminal date.
Where the mapping holdsThe control band is a posterior over the swarm's normal state; the defector's per-step shift is the trade increment; band re-centering is price updating. In both settings the constraint on the attacker is the same — stay inside the observer's current uncertainty — and the optimal policy is the same: many small moves.
Where it breaksKyle's market maker learns the true value in the limit. The adaptive chart does not, because it re-calibrates to the manipulated state — closer to a market maker who updates her prior to the current price. That is why the paper's result is stronger than Kyle's: not slow detection, no detection.
What would test itRun the same attack against a non-adaptive chart. The paper's Figure 3 already shows this partially: fixed bands catch gradual defection but false-alarm on legitimate learning. The open quantity is the exchange rate between false-alarm tolerance and maximum undetectable drift, which neither Kyle nor the paper gives in closed form.

2. "Inefficient information monetizers" and the Grossman–Stiglitz result

Claim in the talkA prediction market pays the holder of private information α only by making the bet public, which destroys the differential value of α (slides 32–33). Stated as conjecture.
Related resultGrossman & Stiglitz (1980): if prices fully reveal costly private information, no one pays to acquire it; the equilibrium has only partially revealing prices. Subsidized market makers — Hanson's LMSR — exist to pay informed traders for exactly this reason.
Where the mapping holdsBoth say the same thing about incentives: the mechanism that aggregates information under-compensates the person who supplied it.
Where it breaksGrossman–Stiglitz is about the ex-ante decision to acquire information; the talk is about ex-post monetization of information already held. And whether a bet "broadcasts" depends on market depth. In a thin prediction market a single bet moves the price and identifies the trader. In a deep one, Kyle's result applies and the holder can hide. The claim is therefore strongest for thin markets, which most prediction markets are.
What would test itCompare informed-trader participation and price accuracy across prediction markets of different depth; Grossman–Stiglitz predicts the thin ones under-attract informed flow. Also note Dan Robinson's proposal the same day — subsidize prediction markets to extract information — is the Hanson fix for the problem the talk identifies. The two talks are not in tension; they describe the two sides of one payment.

3. The information liquidity agent as an off-exchange intermediary

Claim in the talkAn agent with prior relationships across the network brokers a single transaction between the holder of α and one willing counterparty, avoiding public broadcast (slides 34–36). Open questions raised: sequencing, front-running, MEV.
Related resultBlock trading and dark pools: venues without pre-trade transparency, used to move size without price impact. Known failure modes are intermediary leakage and front-running by the broker (see Zhu 2014 on dark pools and price discovery). In MEV, the analogue is the MEV-Boost relay, a trusted intermediary that saw block contents; that trust problem is what motivated TEE-based block building (Flashbots' BuilderNet, 2024).
Where the mapping holdsSame structure: a matching intermediary that sees the full order before the counterparty does, and therefore can trade ahead of it. The talk's three closing questions are the standard questions asked of any such intermediary.
Where it breaksInformation is non-rival. A block trade transfers an asset; the seller no longer has it. Selling α leaves the seller holding α and the buyer able to resell it — the Q&A's exclusivity question, and the "dilution" Brandon describes. A TEE can prevent the broker from reading the flow; it cannot prevent the buyer from redistributing what it bought. Enforcing exclusivity needs something else — contract, reputation, or the buyer's own incentive not to dilute.
What would test itThe garbled Q&A fragment about "conditional recall … through the use of TEE" appears to propose the broker-in-TEE design. The buyer-side leak is the harder problem and has no obvious mechanism.

4. Sub-baseline alarm rates as a second-order signal

Claim in the talkIn the undetectable cells of slide 24 the attack alarm rate is 0.63–0.70× the baseline rate, i.e. the monitored system alarms less than an unattacked one.
Related resultUnder the null (no attack), a calibrated chart alarms at its design rate. A sustained rate significantly below that is also a departure from the null, in the other direction. Standard two-sided tests on alarm counts apply.
Where the mapping holdsThe slide reports the deviation; it just is not used as a detector.
Where it breaksPower is low. At ±3σ the design rate is roughly 0.27% per step; 0.65× of that is 0.18%. Distinguishing the two at conventional significance needs on the order of 104 steps — which is the scale of the 100K-agent runs, but slow relative to the infection time in Figure 3.
What would test itAdd a binomial test on the alarm count over a trailing window and report its power against the gradual schedule. Cheap to implement in the existing simulation. Speculative; not in the paper.

5. Prompt quines and self-replicating adversarial prompts

Claim in the talkSome pieces of information replicate unusually well through a swarm. Brandon calls the extreme cases prompt quines — prompts that cause a model to emit the same prompt — and reports they spread fastest (Q&A).
Related resultCohen, Bitton & Nassi (2024), "Here Comes the AI Worm": engineered self-replicating prompts (Morris II) that propagate through an ecosystem of GenAI agents via RAG and email, carrying a payload.
Where the mapping holdsSame defining property: a string that is a fixed point of the model's input–output map under the agent's processing, so that forwarding it reproduces it.
Where it breaksMorris II is designed and carries an explicit payload; the swarm result finds high-replication content emergently, without a payload, as a property of the population dynamics. The security literature has the attack; the talk has the epidemiology.
What would test itMeasure the reproduction number of a candidate prompt quine in the swarm simulator with and without the persuasion parameter; compare to the threshold needed for takeover in slide 24.

6. Two scope limits an AI reviewer would raise

Claim in the talk(a) Large gaps in the year-token curve at 2007→08 and 2015→16 are read as language moving faster (slide 15). (b) Intra-class communication produces polarization (slide 19).
Related result(a) Diachronic-semantic-change work (e.g. SemEval-2020 Task 1) distinguishes lexical/semantic change from topic-frequency change; the two co-vary in news corpora. (b) The polarization figure is 10 models in 2 classes over 30 steps, from the EMNLP paper's Section on case study 3.
Where the mapping holds(a) The emergent ordering of identically-initialized tokens under a categorical loss is a clean result regardless of what drives the spacing. (b) The topology contrast is large and reproduces across runs in the paper.
Where it breaks(a) A single dominant story flooding a year's text would displace the year embedding without any change in how words are used. Spacing is evidence of corpus change, not yet of language change. (b) N=10 with fine-tuning-defined classes supports a directional claim about topology, not a measurement of polarization in deployed swarms.
What would test it(a) Recompute year embeddings on topic-balanced subsets, or on text with the top-k named entities per year masked; if the 2008 and 2016 gaps persist, the language-velocity reading survives. A shuffled-year control should show no curve. (b) Scale N and vary class definition; report the polarization statistic's dependence on both.

7. Market time after Mandelbrot–Taylor

Claim in the talkNon-uniform year-token spacing is compared to Mandelbrot's market time (slide 16, citing Mandelbrot & Taylor 1967).
Related resultMandelbrot & Taylor modelled price changes as a stable process subordinated to a "trading time" clock. Clark (1973) replaced the stable law with a lognormal–normal mixture directed by volume (the mixture-of-distributions hypothesis); Ané & Geman (2000) showed returns are approximately Gaussian on a transaction-count clock.
Where the mapping holdsYear-token displacement per calendar year is a candidate directing process for language: an estimate of how much "language time" elapsed in each wall-clock year.
Where it breaksThe finance results are about return distributions becoming Gaussian under the right clock. No analogous distributional statement is made or tested for language here; the comparison is currently at the level of shared shape.
What would test itDefine a per-year language-change measure independent of the model (e.g. Jensen–Shannon divergence between adjacent years' word distributions). Check whether normalizing it by year-token spacing stabilizes it across years, the way Ané–Geman's clock normalizes returns.

Glossary & further reading

Every dotted-underline term above, in full, with sources.

computational semiotics

Brandon's name for the field he is trying to start: computational methods for studying how symbols — and the information they carry — spread and distort through populations.

See: "Towards Computational Semiotics" (nomad.garden)

masked language model / temporal language model

BERT-style models learn by predicting hidden words. Prefixing sequences with a time token and masking it is the core of Brandon's TLM. The idea has precedents in the literature.

See: Devlin et al., BERT (2018) · Rosin & Radinsky, "Time Masking for Temporal Language Models" (2022) · Dhingra et al., "Time-Aware Language Models as Temporal Knowledge Bases" (TACL 2022). Brandon's own TLM paper is not linked here because I could not locate it; see his Google Scholar.

market time / trading time

Mandelbrot and Taylor's 1967 proposal that price changes are best modelled on a clock that ticks with transaction volume rather than wall time — a "subordinated" process. Brandon's slide reproduces the paper's title page.

See: Mandelbrot & Taylor, "On the Distribution of Stock Price Differences," Operations Research 15(6), 1967.

interacting language models / perspective space

Brandon and collaborators' framework for representing each model in a communication network as a point in a low-dimensional "perspective space," then tracking how those points move as models talk. The polarization figure on slide 19 is Figure 6 of this paper.

See: Helm, Duderstadt, Park & Priebe, "Tracking the Perspectives of Interacting Language Models" (EMNLP 2024)

sleeper agent

A model trained to behave normally until a specific trigger, then pursue a hidden goal. Anthropic showed such backdoors can persist through standard safety training.

See: Hubinger et al., "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training" (2024) · Anthropic, "Simple probes can catch sleeper agents"

adaptive control charts

Statistical process control applied to a swarm: a running summary statistic ("iso-mirror") with alarm bands that adapt as the system legitimately learns. The paper's stated result is a fundamental trade-off — either agents cannot learn, or the system is vulnerable to adversaries who defect slowly enough. Slides 23 and 24 are its Figure 3 and a scaling experiment.

See: Helm, Priebe & Duderstadt, "Control Charts for Multi-Agent Systems" (2026)

Sybil attack

Subverting a peer-to-peer system by presenting many identities under one controller. Brandon uses it by analogy: a coordinated minority of agents controlling a majority outcome.

See: Douceur, "The Sybil Attack," IPTPS 2002.

prediction market

A market whose contracts pay out on future events, so prices become collective probability estimates. Brandon's critique is that the mechanism aggregates information precisely by forcing holders to reveal it.

See: Hanson, "Shall We Vote on Values, But Bet on Beliefs?"

MEV / front-running / transaction sequencing

On blockchains, whoever orders transactions can profit from that ordering — by placing their own trade ahead of yours, for instance. Brandon's closing questions ask whether an information broker creates the same structure for information.

See: Daian et al., "Flash Boys 2.0" (2019) · Flashbots docs

Notes

  1. On stage Brandon introduces himself as "a professor in the Department of Statistics at Johns Hopkins University." His own bio at nomad.garden says Whiting Fellow, so that is what the card uses.↩
  2. The deck has 37 pages; 15 are progressive-build frames of slides shown here (2, 4, 6, 7, 9, 11, 17, 20, 21, 25, 26, 30, 31, 32, 34), and the title card and "Hi, I'm Brandon" slide are omitted. Nothing was skipped on stage.↩
  3. The audience mic is faint. Questions are inferred from the published transcript and from what the answers imply. Two exchanges — one referencing an unnamed paper and TEEs, one cut off mid-sentence — are omitted as unreconstructable. Brandon's Twitter handle is "malpelle_io" in the transcript; the slide reads @calco_io.↩
  4. The captions render the model names as "Kimmy" and "K3." Kimi (Moonshot AI) is the obvious reading of the first; the second is unresolved. No name is used in the text.↩
  5. The captions give the codebase as "ETN, out of [JHU]… a pretty modernized BERT training codebase." That matches Ettin, JHU-CLSP's open replication of ModernBERT. Likely, not certain.↩
  6. The captions have "study qualitatively medics" against the published transcript's "quantitatively." Given the audience line "sounds like a meme," "quantitative memetics" is the most plausible reading. Inference.↩
  7. The captions name a specific investment fund as "imploding" — a claim about a real, identifiable party that I could not verify, so it is omitted here rather than repeated.↩
  8. The crisp tracking on slide 13 is the right-hand panel, a Bayesian posterior that corrects for how often each name appears overall; the raw conditional fills (left) stay Obama-heavy in every year. Brandon does not say this on stage. It is on the slide.↩

References

  1. [01]Brandon Duderstadt — Information Liquidity — Video recording of Brandon Duderstadt’s talk on measuring and brokering information flows.
  2. [02]Slide deck (PDF) — Thirty-seven-slide deck accompanying Duderstadt’s talk on information liquidity.
  3. [03]Tracking the Perspectives of Interacting Language Models — EMNLP paper modeling information diffusion among interacting language models.
  4. [04]Control Charts for Multi-Agent Systems — Paper using statistical control charts to detect behavioral shifts in multi-agent systems.
  5. [05]Sleeper Agents — Anthropic study showing deceptive model backdoors can survive standard safety training.
  6. [06]Mandelbrot & Taylor, "On the Distribution of Stock Price Differences," Operations Research 15(6), 1967 — Paper explaining how random transaction counts can create heavy-tailed price changes.
  7. [07]Time Masking for Temporal Language Models — WSDM paper introducing temporal masking for time-aware language models.
  8. [08]Towards Computational Semiotics — Essay proposing computational methods to measure how meanings spread and change.
  9. [09]Brandon's official bio — Duderstadt’s biography, professional history, research affiliations, and links.
  10. [10]Flash Boys 2.0 — Foundational study of Ethereum frontrunning, priority gas auctions, and transaction ordering.
  11. [11]Flashbots — Documentation for Flashbots’ MEV infrastructure, products, and research.