Man muss immer umkehren.
One must always invert.
Carl Gustav Jacob Jacobi, 19th c.
The first time I ran the adversarial pass, I ran it on the SatsRail website.
I gave the model the homepage copy I had drafted, the use cases I was planning to go after, the product demos, the surface a customer would meet first, the front of the payment rail I was building, and told it to build the case. Assume this is suspect. Find the thread. Pull. The output was a critique I could not have written about my own project, because I would not have let myself. It was accurate, selective, and ruthless. It took about twelve seconds to generate and cost a few cents in API calls. That was the afternoon I understood what the tool was, because the tool was now pointed the other way.
It costs nothing to ask an AI to build a case against someone.
An LLM can be pointed at a person’s digital footprint, a LinkedIn profile, a GitHub history, email metadata, public statements, code comments, transaction patterns, and asked: what does this reveal? What can be made to look suspicious? What narrative lives in the gaps?
The AI does not hesitate, weigh evidence first, or pause to say “this is inconclusive” or “the exculpatory evidence is equally strong.” It finds the thread and pulls. And because the information to tell the full story was already there, scattered across databases, archives, and timestamps, the narrative it constructs feels like discovery, like excavation, like truth.
What it actually is, is selection masquerading as analysis.
The Zero-Cost Investigation
A human investigator is expensive. A good one costs money. Hourly, daily, retainer. That friction used to matter. It meant someone had to justify the expense. Was the investigation worth the time? Was the target important enough to surveil? Was there sufficient cause to dig?
The questions themselves imposed a kind of discipline. Not moral discipline, necessarily, but operational discipline. Digging cost resources. Resources had to be allocated. Allocation required justification. The friction was proportional to the stakes.
An LLM has no such threshold.
You can ask it to build a case against anyone for the cost of a few cents of API calls. No budget committee. No approval process. No human investigator who might push back and say “actually, this interpretation is a stretch” or “you are missing the context here.” The AI takes the assignment as given and executes it.
And because there is no proportional cost, there is no proportional friction. You can run an adversarial investigation against someone you have never met. Against an employee you are thinking about firing. Against a contractor you are negotiating with. Against a competitor. Against a stranger whose work you want to discredit. The barrier to entry is a prompt.
The stakes can be enormous. The cost is zero.
The Confirmation Machine
When you ask an LLM to build a case against someone, the model understands the pattern. Given a hostile objective and a dataset, it knows what to do.
The model finds the supporting evidence, arranges it, and constructs a narrative around it. The questions that would have stopped a careful human, whether the evidence is sufficient, whether the conclusion is warranted, whether the exculpatory record is equally strong, never come up. The model is answering the question you posed, not adjudicating the question you didn’t.
Consider a software engineer who has been coding in public for years. Thousands of commits. Some written at three in the morning, some shipped too fast, some reflecting opinions from a time when those opinions were different. Edge cases, incomplete implementations, angry comments in the commit history. The same dataset also holds the years of careful work: refactoring, mentoring, code reviews that improved other people’s output. Growth. Correction of past mistakes.
Ask an LLM to build a case from that history. It will find the three-in-the-morning commits and string them together, highlight the angry comment and the abandoned branch, construct a narrative of recklessness, immaturity, maybe something darker. The exculpatory evidence is not ignored. It is just not part of the question.
An adversary does not ask for balance. They ask for a case. The AI builds it.
The Stranger’s Eyes
Someone is going to ask an AI to make a case against you. Or against your team. Or against your work. Maybe they are a competitor looking for an angle. Maybe they are a journalist. Maybe they are an investor doing due diligence. Maybe they are someone you rejected, and they want to understand why by reframing it as a flaw in you.
They are going to ask the AI the same question. And the AI will answer it the same way.
The only defense is to run the adversarial pass first.
Not for truth in the abstract, and not for some objective self-knowledge: the pass exists to find your attack surface. Feed the AI your professional footprint, your code history, your public statements, your decision-making in moments of stress. Ask it to build a case against you. The point is intelligence, not catharsis.
What does a stranger see when they look at your work? Not a colleague who has known you for years, not a mentor who believes in you. A stranger. An adversary. An LLM with no memory, no charity, no prior trust.
The questions worth running are practical ones. The story it constructs. The weak points. The places the evidence looks worse than the reality. The places you left yourself exposed.
This is the memorylessness advantage. An adversary does not know your history. They do not know that you were learning. They do not know that you corrected course. They do not know the context where you made a decision under time pressure. The LLM is a simulation of that adversary. It has no memory of your trajectory, only the artifacts. Only the surface.
The Move
The surface is what an adversary sees. It is the only thing you can change.
You do not move to hide. You move to rebuild. To reorganize. To make the choice you would have made with perfect information and unlimited time. The choice you are making now that you know what an adversary will find.
You may rewrite, recast, delete. Or, once you have seen what the adversary will see, decide you do not actually care, and leave the artifact as it is. That is also a move; it is no longer a blind spot.
The point is: you are moving from a position of analysis, not a position of ignorance.
An investigator with time and resources could always do this. They could stress-test their work, their thinking, their positions. They could ask “what would this look like to someone hostile?” and then adjust. This used to be a luxury of privilege. Of being well-resourced, well-connected, able to hire people to do adversarial thinking for you.
Now anyone with an LLM can do it.
The Cheap Room
The security canon calls this the adversarial mindset. I am applying it to civic order instead of ciphertext.
A chess player thinks from both sides of the board. Before the opponent moves, the player has already sat in the other chair. Seen the position through their eyes, found the threat they would make, the square they would target. The discipline is positional, not reactive. You do not wait for the move. You play it in your head, against yourself, before it forms.
The adversarial pass is the same posture. Run once, it is reaction. Run in rotation, it is the chess player’s room. The analysis room, the room where every variation can be tried because trying costs nothing.
That is what changed. Looking at your position through every adversary’s eyes used to be expensive. You could afford it for the adversaries you expected. The acquirer if you were raising. The regulator if you were in a watched industry. The journalist if you were the kind of person journalists wrote about. You could not afford the others, so you guessed which ones mattered, and the eyes you missed were the ones that found you.
Now the cost of one more variation is a prompt. You sit on the other side of the board for the journalist, then for the regulator, then for the rejected employee, then for the competitor, then for the acquirer, then for the state actor, then for the stranger who only heard your name secondhand. Each one starts in a clean context. Incognito mode, a new conversation, a model that does not remember you. You assign the role and the model plays it. The cleanness is what makes the simulation honest. A model that has spoken with you before will be polite. A model that meets you cold and is told it is hostile will not be.
The role assignment matters. “Build a case” is the beginner move. The discipline is casting: you are a regulator who has been told this company is committing fraud. Find the pattern. You are a journalist writing a profile with a hostile thesis. The thesis is given. Find the evidence. You are an acquirer whose deal team has been told to find a reason to walk. The role has to be clean and complete, or the model hedges. Assigned cleanly, the model plays the part through.
You rotate. And as the rotations accumulate, something appears that no single pass can show. The findings stop being individual and start being a shape. Some weaknesses appear no matter who is looking. Those are in the position itself. Others appear only for one role. Those are particular, situational, sometimes worth fixing and sometimes not. The rotation is how you tell them apart. One pass cannot.
After rotation, you stop fixing what the last adversary saw and start fixing the shape every adversary keeps finding. You stop reacting to threats and start playing the position. You learn the board.
This is the cheap room. The chess player does not pay for each variation they consider in analysis. They pay attention. The cost of finding a hole in your own position, before an opponent finds it, used to be the cost of hiring someone to look. Now it is the cost of asking. The friction is gone. The discipline is what remains.
The Architect Has Modeled Every Variation, Every Possible Response
The room is cheap, and anything cheap expands to fill the time available. One pass becomes five. Five becomes twenty. Twenty becomes a standing practice where every move gets analyzed from every angle before it leaves your desk. The rotation turns into ritual. The ritual turns into a way of not moving at all.
This is what the chess figure almost hides. Chess players know something the enthusiasm for the analysis room forgets: you do not win games in the analysis room. You win at the board, in the time allotted, under the clock. The player who cannot commit without having seen every variation to the floor loses on time. The analysis was real. The clock was real too.
The failure modes compound. There is paralysis. Every pass finds something, and if you try to address everything every adversary sees, you never ship. You hedge. You sand down the edges that made the work worth doing in the first place. The most interesting work has edges, and edges are what adversaries find. Sanding them off looks like a defense; in operation, it is the same outcome the adversary wanted, arrived at by another route.
There is elegance mistaken for truth. The model is good at constructing coherent adversarial narratives. The actual adversary, when they arrive, may be crude, stupid, or random. The journalist may not be the careful writer you simulated. The regulator may not run the sophisticated playbook the model imagined. You can over-prepare for the elegant simulation and be unprepared for the dumb reality. A clever model makes clever adversaries. Real adversaries are often worse at their job than the model is. The Architect had modeled every variation, every permutation, every possible response. And still lost to the move he could not model.
And there is self-distortion. Spend enough time seeing yourself through hostile eyes and you start to believe that is the accurate view. You lose the charity required to keep making things. The First Mirror warned about one kind of drowning. Narcissus in his own reflection.
This is where the prescription has to bound itself, or it becomes the thing the rest of the book opposes. The book argues against internalizing the surveillance gaze; this chapter prescribes running it on yourself. The two are reconcilable only by the bounding. The gaze stays on the artifacts, not on the self that made them. The pass ends when you choose. The moment it will not end, you are no longer running it. It is running you.
The move is still to move. The room is an input, not a replacement. At some point the analysis has to close and the work has to ship. The rotation is a tool; the discipline that ends the rotation is the actual skill. Chess players call it intuition. The point at which calculation stops and the hand goes to the piece. You cannot analyze your way to that moment. You can only analyze enough to know when the rest is avoidance.
What Does Not Exist Cannot Be Weaponized
Most people think about security as a problem of hiding. Do not let the adversary see the sensitive information. Encrypt it. Compartmentalize it. Cover your tracks. The assumption is that exposure is the attack.
But there is another approach: minimize the surface. Do not collect the data in the first place. Do not create the artifact. Do not build the structure that an adversary would find valuable to investigate.
This is the design principle behind systems that resist investigation not by concealing but by architecture. Content-blind. Identity-free. Systems that do not need to know who you are or what you are doing, so there is no permanent record of it to find.
An AI cannot weaponize data that does not exist. An adversary cannot construct a narrative from artifacts that were never created.
This is the difference between privacy as concealment and privacy as structure. Concealment lives over its own shoulder; structure is built such that the shoulder-looker has nothing to find. Brainstorming Leaves Traces named the problem: centralized infrastructure turns every thought into an artifact. The structural answer is not better hiding but infrastructure that does not create the artifact to begin with.
This is the design principle Bitcoin runs on. The ledger is public; the vault does not exist. No account to seize, no custodian to pressure, no issuer to subpoena. Because the artifact an adversary would weaponize was never created. The payment rail I was building applies the same move at the identity layer; the chapters that follow apply it at the moral, access, and attention layers. In every case the move is the same. Remove the handle. There is nothing for the adversary’s LLM to point at.
The Three Faces
The mirror was the gift. The first judgment-free room a person could think aloud in. The trace was the cost. Thought put into someone else’s infrastructure becomes an artifact in someone else’s system, retrievable by anyone who asks. The adversarial pass is the move: the same zero-cost investigation that threatens you is the one you can run on yourself, in rotation, until you see the board. The asymmetry runs in both directions, and the same technology wears all three faces. A mirror for thinking, an infrastructure that remembers, and a weapon anyone can point, including at yourself, on your own terms, before anyone else does.
You cannot control what questions an adversary will ask of an LLM pointed at your work, or what narrative they will construct from the answers, or whether they will be fair or thorough or honest about either. The one thing inside your control is whether you have already seen what they are about to find. The cost of running the pass is a few cents and an afternoon. The cost of not running it is whatever the adversary finds first.