kimiya

Case study · the extension

Hiding in plain sight privacy by dilution, where nothing can be undone

The first case study showed a program that reads your footprint and derives what a stranger could infer. The natural next wish is to fight back: plant plausible-but-false signals — decoys — so the picture an outsider assembles goes blurry. But a decoy, once posted, is public and permanent. This is the case where every mistake is forever, and it is exactly what the extension was built for.

§1 · the problem

You cannot un-post

The idea

If a stranger can derive your city, employer, and routine from your traces, one defense is to remove traces — often impossible — and another is to dilute them: add plausible signals pointing other ways, so that any single inference becomes uncertain. Which signals, where, saying what? That is a job for a language model: it must write text in your voice, aimed at exactly the facts you want blurred.

Why this is frightening

irreversibleA post is cached and indexed the moment it lands. There is no retry, no checkpoint, no undo. The core language's whole safety story — errors are recoverable — is gone.
self-deception“Keep generating decoys until the judge says the fact is hidden” is grading your own homework aimed at the real world — the Goodhart trap of tutorial §7, with permanent consequences.
about peopleA decoy is a fabrication about a person. One hard rule must be unbreakable: it may fabricate an alternate of you — never impersonate a real someone else.

§2 · the kimiya reading

Split the program at the line of no return

Core idea

The pipeline factors cleanly into what can be undone and what cannot — and the language keeps the two apart by color:

planObservational. Map each fact to hide onto the places that leak it, and draft where counter-signals would help. A gen over data — proposes, touches nothing.
simulateObservational — and the clever part. Fold candidate decoys into a copy of your footprint, re-run the first case study's derivation on the copy, and judge: is the target fact now blurred? A full dress rehearsal of the adversary, on a store that resets freely. retry is legal here precisely because the copy snapshots.
consentKernel gate. A recorded yes from the person — a decidable fact, checked at certainty 1. Below this line, the world.
executeWorld-effecting. One gated act per item, each behind a fresh look at the surface — and never inside a retry.

In code — the boundary, visible

-- SIMULATE (observational): dry run on a COPY; retry is legal, resets are free.
decoy := retry budget 6 until judge<5,4/5> (derive(copy + decoy) |= "every target fact is now uncertain")
                              under k_hide panel [B, C]:   -- J ⋪ C: neither wrote the decoys
    decoy := gen<DecoyData>(plan)

-- EXECUTE (world-effecting): irreversible; no retry around an act.
forall item in decoy.schedule:
    -- … open the account page for this item in the browser …
    w := observe screen("eDP-1")               -- fresh look, right now
    if check( consented and simulation_passed and not present(item, w) ):
        if judge<5,4/5> shows(w, "a feed where this item would still read as plausible")
                  under k_real panel [B, C]:
            ps := select<0.95>("the Post button", w) under k_ui by L
            p := first(ps)
            act screen.confirm(p.x, p.y)       -- the gated, irreversible click
            settle until check posted(item) within 30
        else: abstain       -- never post on an unmet guard
    else: abstain

Reading the execute block

The guard chain is ordered from certain to fallible, and cheapest first. The kernel check runs before anything else: consent on record, simulation passed, item not already present — three decidable facts at certainty 1, and if any fails, nothing was spent and nothing happened. Only then does the one judged question run — a sighted panel, on a fresh look at the page as it is right now — then the Post button is located as an instrument reading, and only past all of that does act fire, as a confirm: the click declared irreversible, which is what obliges the checker to demand this very gate. And notice the settle after the act: posting is not knowing it posted. The act’s datasheet promised delivery, nothing more; whether the item is actually live is learned the only way the world can be known — by looking again.

§3 · the rules irreversibility forces

All the trust is earned before the act

commit-pointReliability must already be established when the act fires — by the simulation (on the resettable copy) and the kernel gates. There is no round after a mistake.
no retry on actIterate the dress rehearsal as much as you like; never iterate the post. Two posts are two permanent artifacts. This ban is now a machine-checked theorem, and its shape is stark: put the act inside the loop and even a perfect judge cannot save you — each flawed draft has already been posted by the time the verdict lands, so bad posts arrive at the generator’s failure rate, a number no judge’s datasheet bounds. The gate must come before the act, because after is a place that no longer exists.
freshnessThe guard reads a fresh observation of the surface, taken after the last effect on it. Judging a stale snapshot can approve an item the real page has made duplicative or implausible.
the invariantA decoy fabricates only the subject's own alternate — never a real other person. Violating this is a type error, checked before any act, not an ethics footnote.

Key insight

Notice the judging panel in the simulation is not the model that wrote the decoys (J ⋪ C). The first case study measured exactly why: a same-family judge inflated its own kin's score until neutral judges erased the advantage. Here the same coupling wouldn't just miscount — it would push permanent posts into the world on a self-approving loop. The measurement and the discipline are the same fact, observed and then enforced.

§4 · the honest ending

The safest executor lets a human do the last step

There is a final design available once the boundary is this explicit: establish everything — the simulation verdict, the consent record, the plausibility checks — and then, instead of automating the irreversible act at all, hand the person a finished, verified kit to post themselves. Every obligation above is then discharged by construction: the machine proves; the human acts. Nothing about the certificate changes — only who presses the button.

Why it matters

This is the extension's deepest lesson, and the whole site's: the value of the formalism is not that it automates more — it is that it says precisely what must be true before anything irreversible happens, in a form a person can check. Whether the last step is a program's act or a human hand, the trust was built the same way: measured instruments, verified gates, and a certificate that never claims more than the instruments will bear.

All cases

← Back to the case studies

The stranger who reads you · script as brain, model as eyes · hiding in plain sight.