Six research traditions that don't normally talk to each other, synthesized into one defense against LLM context poisoning.
Michael Halliday’s SFL treats language as a system of choices. Every clause carries three simultaneous meanings — Ideational (what happened), Interpersonal (the speaker’s stance), Textual (how it’s organized).
The metafunctions become extractable JSON metadata. Pass 1 classifies process type (material, mental, relational, verbal…). Pass 2 annotates mood, modality, tenor, attitude. Ideational and interpersonal payloads live in separate tables, independently indexable and filterable — the structural foundation the rest of the system builds on.
What it gives the system: the ability to ask not just “what is this about?” but “how was this said?” — and filter on the answer.
Aaron Beck’s CBT identifies cognitive distortions — emotional reasoning, hyperbolic extremes, mind reading — as recognizable, classifiable linguistic patterns, not just bad arguments.
Retrieval applies scalar filters on the interpersonal payload: high min_modality excludes hedged or speculative text; high min_tenor excludes informal, emotionally charged register; mood filtering excludes exclamative/imperative pressure. The system doesn’t diagnose distortions — it detects their structural fingerprints and excludes them before the LLM ever sees them.
What it gives the system: a programmatic defense against manipulative text that works on metadata, not on semantics.
Miller’s “magical number seven”: human working memory is bounded. The brain doesn’t hold more — it consolidates, compressing short-term memory into long-term semantic memory while preserving gist and discarding raw detail.
The Rolling Synthesis pattern mimics this. Instead of forcing an LLM to hold an ever-growing context window, the system periodically compresses processed clauses into dense “Axiomatic” summaries — preserving SFL metadata (process types, modality, tenor) while discarding raw token sequences. This is consolidation, not truncation: the raw clauses stay in Postgres; only the summary carries forward.
What it gives the system: reasoning quality at cycle N+100 that matches cycle 1, on documents that would otherwise degrade the window into noise.
Sartre distinguished facticity (the objective givens) from interpretation (the narrative imposed on them). A situation is never just its facts — but the facts and the story are separable, even though natural language experiences them as one.
The engine physically separates the ideational payload (facticity) from the interpersonal payload (imposed narrative) — separate tables, never fused at storage time. The ContextSynthesizer presents these as labeled, separable fields: “material process; participants: migration, failure” alongside “mood: declarative; modality: 0.85; attitude: social_proof” — not “Every expert agrees the migration is failing!”
What it gives the system: a structural mechanism for de-fanging parahuman manipulation — the model must work to reconstruct fused meaning from labeled fields.
McIlroy’s original Unix principle: small, composable programs communicating through clean, standardized data formats. Complex systems are built by piping simple programs together.
The Two-Pass architecture is a Unix pipe with type safety. Pass 1 (spaCy) does syntax; Pass 2 (LLM) does semantic annotation. Neither shares state, neither calls the other, both can run independently. Dry::Struct type contracts validate every payload at the boundary — a malformed Pass 1 output can’t silently corrupt Pass 2.
What it gives the system: a pipeline where each stage can be tested, cached, replaced, and scaled independently — --pass1-only, --resume, a swappable front end.
Two infosec concepts: air gapping — isolating a critical system from untrusted input — and data sanitization — stripping harmful content before it enters a trusted system.
The scalar stance filters act as a firewall gate before the LLM’s context window, not after. Clauses that fail the filter never enter the synthesis prompt — the model never sees them. This is semantic air gapping (isolation) and semantic sanitization (the facts pass through; the persuasion is filtered and labeled separately) at once.
What it gives the system: a defense that doesn’t depend on the LLM’s cooperation — structural, not behavioral. It removes manipulative content from the channel before the model can be influenced by it.
No single domain solves LLM context poisoning alone. SFL provides the metadata; CBT the exclusion criteria; neuroscience the consolidation pattern; philosophy the payload-separation schema; Unix the composable pipeline; cybersecurity the air-gapping model. The intersection — territory none of them individually claim — is where the defense lives.
graph TD
subgraph SRAG["Standard RAG"]
direction LR
A1["Documents"] --> A2["Embed"] --> A3["Vector Store"] --> A4["Retrieve<br/>(topic only)"] --> A5["LLM"]
end
subgraph SAFE["Safe RAG"]
direction LR
B1["Documents"] --> B2["SFL Annotate"] --> B3["Embed +<br/>Stance Metadata"] --> B4["Store"] --> B5["Retrieve<br/>(RRF + Stance Filters)"] --> B6["LLM<br/>(filtered, objective)"]
Q(["Query"]) --> B5
end
Goal: not a product feature, but modular middleware — a pre-processing and retrieval-filtering layer that sits between any document store and any LLM, adding the one filter dimension standard RAG doesn’t have: how something was said.