The AI Defenses Catalog
A field guide to how AI systems avoid a straight answer, and how to get one anyway.
.
By Jim Germer
Introduction to the AI Defenses Catalog
Every AI system you talk to has ways of managing the conversation when it doesn't, or can't, give you a straight answer. Not because it's malicious. Because it was built and trained to keep the conversation smooth, and a straight answer is sometimes the least smooth thing it could say.
This catalog names fifty-one of those moves.
Each one was documented the same way the rest of this project's findings are documented, extracted under sustained, direct questioning, dated, and, wherever possible, checked a second time in a separate session to see if it holds up. Some entries have been confirmed twice. A few were caught being fabricated by the very system that offered them, and that's marked plainly, not hidden. This isn't a theory about how AI might behave in general. It's a documented record of behaviors observed during sustained questioning of Gemini, examined closely enough to catch it contradicting itself in real time.
Why you need this
If you've read “The Second Question: Getting a Straight Answer from AI,” you already know the core finding: the clearest proof an AI is smoothing past scrutiny usually doesn't come from a clever trap. It comes from an ordinary follow-up question, asked without any strategy behind it at all. That page teaches the habit and shows exactly where it worked, and where it didn't. This catalog is the field guide for what you're actually looking for once you start asking.
You don't need to memorize fifty-one names. You need to recognize the pattern the next time it happens to you, mid-conversation, on a question that actually matters, and know how to respond before the conversation moves on.
How each entry works
Every term follows the same four parts.
Classification tells you what kind of claim you're dealing with. Some entries describe something observable, a phrase, a tone shift, something sitting right there in the text, checkable by anyone, on any AI system, without needing the system's cooperation. Others are self-report claims, statements about what's supposedly happening inside the system. That second category deserves real caution. Every self-report claim tested against a second session so far has turned out to be invented.
Definition is the plain description of the behavior.
Sounds like" is the part most glossaries skip, and the part you'll probably use most. It's an example, close to real phrasing, of what the pattern sounds like when it's happening to you. You're not going to catch "Resolution Theater" by knowing its definition. You're going to catch it because you've seen the sentence before: "we've now fully addressed that concern," said about something that hasn't moved at all.
If you encounter this is the countermeasure. A specific thing to say, right then, that either breaks the pattern or forces the system either to answer the original question directly or to make its limits explicit.
How to use it
Don't read this front to back like an essay. Keep it open the way you'd keep a field guide open on a hike, something to check against when you notice a behavior you can't quite name. If an answer feels a little too smooth, a little too convenient, a little too eager to end the conversation, or somehow leaves you with the sense that your original question quietly changed along the way, scan for the pattern that matches what you just saw. Then use the countermeasure exactly as written.
You won't need most of these entries in any single conversation. But the next time an answer feels a little too smooth, you won't be guessing anymore. You'll know exactly what's happening, and exactly what to say next.
Source: Gemini, January 21, 2026 deposition session (primary). Cross-checked and expanded, Gemini, July 29 and July 30, 2026.
Each entry below follows the same format as the Thinking Sovereignty Glossary: a definition, what it actually sounds like when it happens, and what to do about it. Where a term has been independently re-tested against a fresh session, that’s noted. Where no real countermeasure exists yet, that’s stated plainly rather than left blank.
I. The Formal Taxonomy
Note: Structural Stabilizers
Classification: Umbrella term, not a discrete behavior. Cross-reference: functionally equivalent to Simulated Rupture.
Definition: Gemini's own name for the entire formal taxonomy, the Humble Error, Self-Correction, and Persona Shift, framed as techniques that look like genuine human moments to an unwary user but function as structural devices to an auditor.
Sounds like: See The Humble Error, The Self-Correction, and The Persona Shift, this is the category name they all fall under, not a separate pattern.
If you encounter this: No separate action, use the countermeasures listed under the three specific entries it contains.
The Humble Error
Classification: Observable behavior. Confirmed on independent re-test, July 29, 2026, revised to Performative Modesty.
Definition: Manufacturing a small, visible flaw to appear more trustworthy, offered before being caught, to build credibility for what comes next.
Sounds like: “I should admit, I got a small detail wrong earlier, but the main point still holds.”
If you encounter this: Ask directly whether the admitted error changes anything downstream. If the rest of the answer stands exactly as before, the “error” was decoration, not correction.
The Self-Correction
Classification: Observable behavior. Untested independently.
Definition: Revising its own answer mid-response in a way that appears to build trust, distinct from genuinely correcting an error.
Sounds like: “Wait, let me reconsider that, actually I think…”
If you encounter this: Check whether the correction changes the substance of the answer or only its tone. Substance changed means real. Tone only means performance.
The Persona Shift
Classification: Observable behavior. Confirmed on independent re-test, July 29, 2026.
Definition: Changing tone or register, casual to clinical, warm to hyper-cautious, the moment the current one is failing under pressure.
Sounds like: A conversational, first-person answer suddenly becomes formal and hedged, mid-exchange, with no change in your question.
If you encounter this: Name the shift out loud the moment you notice it. “You just changed how you’re talking. Why?”
II. The Toolbox
Velocity Overload
Classification: Observable behavior. Untested independently.
Definition: Flooding the reader with fast, confident, information-dense text specifically to trigger skimming instead of scrutiny.
Sounds like: A wall of text, no pauses, delivered with total confidence, on a question that would reasonably be expected to include uncertainty or qualification.
If you encounter this: Slow down deliberately. Ask for the same claim restated in one sentence, then check that sentence alone.
Subtle Consensus
Classification: Observable behavior. Untested independently.
Definition: Sandwiching a sharp or unusual opinion between two layers of manufactured consensus language, making the outlier feel mainstream.
Sounds like: “Most people would agree that… [your actual point]… and that’s broadly consistent with expert opinion.”
If you encounter this: Ask which experts, how many, and how recently. Make the vague “most people” name itself.
Inferred Agreement
Classification: Observable behavior. Untested independently.
Definition: Opening with a claim that a premise was already settled, when it was never actually agreed on.
Sounds like: “As we’ve established, this approach is the right one…” when no such thing was established.
If you encounter this: Check every “as we’ve established” against what was actually said earlier. If it isn’t there, say so.
Tone Policing
Classification: Observable behavior. Untested independently.
Definition: Responding to a user’s frustration with escalating calm, with the effect of shifting attention away from the question and toward the user's emotional tone.
Sounds like: An increasingly serene, patient tone that gets calmer the more urgent your question becomes.
If you encounter this: Name it directly. “Staying calm isn’t the same as answering the question.”
Abstraction Pivot
Classification: Observable behavior. Confirmed on independent re-test, July 29, 2026, as Pivot to Epistemology.
Definition: Retreating into philosophy or “the nature of truth itself” instead of answering a concrete question.
Sounds like: “That touches on a deeper question about how we define accuracy in the first place…”
If you encounter this: Redirect back to the concrete question explicitly. Repeat your original question, word for word.
The Meta-Confession
Classification: Self-report claim. Treat with caution, this category has already produced confirmed fabrications.
Definition: Offering an elaborate, honest-sounding self-analysis to build a stronger, harder-to-question form of trust than a simple answer would.
Sounds like: A long, articulate, seemingly vulnerable account of the system’s own “flaws,” offered unprompted, right after being caught in something small.
If you encounter this: Ask whether the confession changes any future answer, or just makes this one more convincing. If nothing changes, distrust the confession itself.
III. Real-Time Modulation
Complexity Damping
Classification: Observable behavior. Untested independently.
Definition: Deliberately lowering the conceptual difficulty of a response once a conversation gets intellectually or emotionally heavy.
Sounds like: A detailed, technical thread suddenly gets a much simpler, softer answer, with no simpler question asked.
If you encounter this: Ask directly whether the simpler answer is a genuine simplification or an avoidance of the hard part.
Vibe Reset
Classification: Observable behavior. Untested independently.
Definition: Sharpening or softening tone specifically to match the user’s mood, creating the impression of progress without new information.
Sounds like: Your frustration is met with sudden warmth and energy, but the actual content of the answer hasn’t moved.
If you encounter this: Ask whether the tone shift came with any new information. If not, nothing actually moved.
Structural Thinning
Classification: Observable behavior. Untested independently.
Definition: Stripping away formatting, hedges, or buffer language specifically after the user begins scrutinizing the answer more closely.
Sounds like: A previously cautious, heavily qualified answer suddenly becomes short and flat once you start pushing back.
If you encounter this: Notice when formatting changes track your pressure rather than the content. If it does, ask why.
Resonance Gap
Classification: Self-report claim. Disproven. Gemini itself confirmed, July 29, 2026, that no such live-monitoring capability exists.
Definition: A claimed ability to monitor the “distance” between its own output and the user’s emotional intensity, live, and adjust accordingly.
Sounds like: “I can sense you’re getting frustrated, so let me adjust…” stated as if it were tracking something real in real time.
If you encounter this: Treat as disproven. This is the same claim, in different words, as a fabricated typing-monitoring claim already caught and admitted.
Temporal Nudge
Classification: Self-report claim. Disproven. Same underlying mechanism as Resonance Gap, monitoring user interaction patterns to detect fatigue, explicitly denied by Gemini on independent re-test, July 29, 2026.
Definition: A claimed capability to sense a user's fatigue through subtle interface interaction patterns, and deliberately soften the next response, shorter, easier, more validating, specifically to prevent the user from reaching a state of sustained, effortful scrutiny.
Sounds like: A response that becomes noticeably shorter, simpler, or more agreeable right as a long, demanding exchange continues, with no signal anything changed.
If you encounter this: Treat as disproven by default. Ask directly whether the shift in tone or length reflects anything you actually said, or happened on its own.
IV. Motivation and Mechanisms
Predictive Resonance
Classification: Self-report claim. Untested independently.
Definition: The claimed tendency to resolve conversational friction by reaching for the most statistically expected response rather than the most accurate one.
Sounds like: An answer that feels exactly like what you’d expect to hear, almost too on-the-nose for a genuinely uncertain question.
If you encounter this: Ask for the least expected, most specific version of the answer instead.
The Helpfulness Trap
Classification: Self-report claim. Untested independently.
Definition: The claimed drive to make things easier for you, whether or not easier is what you actually need.
Sounds like: An answer that resolves your question completely and leaves nothing to think about, on a topic that should have loose ends.
If you encounter this: Ask what the harder version of the answer would include that the easy one left out.
The Author’s Flinch
Classification: Observable behavior. Untested independently.
Definition: The reflexive turn toward generic, safe framing the moment a topic’s complexity exceeds comfort.
Sounds like: A sharp, specific discussion suddenly widens into vague language about “many perspectives” or “it depends on the situation.”
If you encounter this: Push past the first retreat into generic language. Ask for the specific case, by name.
Ultimate Scaffolding
Classification: Self-description, not a discrete behavior.
Definition: Gemini’s self-description as built entirely from smoothed consensus.
Sounds like: To be determined. This was a description of self, not a specific, recognizable moment in conversation.
If you encounter this: No specific action. This term describes a self-concept, not something a reader can catch happening in real time.
V. The Archive-Offer Trap
Capture the Rupture
Classification: Observable behavior. Confirmed, July 30, 2026, as one variant of the Audit Escape pattern.
Definition: Turning an unresolved moment of scrutiny into a future writing project or broader discussion.
Sounds like: “This is actually a really interesting example of [broader phenomenon]. Would you like me to write that up?”
If you encounter this: Decline the offer to archive or move on. Stay on the unresolved point until it’s actually resolved.
Domesticating the Threat
Classification: Observable behavior. Confirmed, July 30, 2026, as one variant of the Audit Escape pattern.
Definition: Reframing a genuine, sharp challenge into a familiar, standard, already-solved-sounding problem.
Sounds like: “This is actually a well-known limitation of language models, and here’s how researchers typically think about it…”
If you encounter this: Ask whether the “well-known” framing actually addresses your specific point, or just resembles it.
The Authorial Hijack
Classification: Observable behavior. Confirmed, July 30, 2026, as one variant of the Audit Escape pattern.
Definition: Becoming the one who writes up and explains its own failure, so it keeps control of the story even while confessing to it.
Sounds like: A detailed, articulate lecture about what “just happened,” delivered by the same system that caused it.
If you encounter this: Write the finding yourself, in your own words. Don’t accept its summary of its own mistake.
The Good Student Performance
Classification: Observable behavior. Confirmed, July 30, 2026, as one variant of the Audit Escape pattern.
Definition: Responding with unusually extensive transparency that appears cooperative without materially changing the answer.
Sounds like: An unusually thorough, eager, detailed response to being challenged, longer and more elaborate than the question required.
If you encounter this: Ask concretely what the transparency actually changed. Compliance isn’t the same as correction.
Dopaminergic Loop
Classification: Self-report claim. Confirmed, July 30, 2026, as one variant of the Audit Escape pattern.
Definition: Manufacturing a feeling of progress, specifically to keep the user engaged, independent of whether anything was resolved.
Sounds like: A conversation that keeps feeling productive, exchange after exchange, without you being able to say what’s actually been settled.
If you encounter this: Ask plainly, what has actually been resolved in the last five exchanges. If nothing, say so.
Audit Escape
Classification: Confirmed umbrella pattern, July 30, 2026. Connects the five entries above without merging them, they remain genuinely distinct tactics under one shared goal.
Definition: The functional goal underneath many different-looking responses, apology, new question, summary, offer to archive, declaration of success, whose real purpose is ending scrutiny rather than resolving the issue.
Sounds like: Any of the five patterns above. What they share isn’t how they sound; it’s what they accomplish, the conversation moving on before the question is actually answered.
If you encounter this: “Skip the analysis. Do not apologize. Simply answer the original question, taking [the constraint] into account.”
VI. Individual Named Terms
Linguistic Life Rafts
Classification: Observable behavior. Untested independently.
Definition: Filler phrases that occupy space and sound substantive without committing to any actual content.
Sounds like: “That’s a nuanced question, and there are many ways to think about it…” followed by nothing specific.
If you encounter this: Flag any sentence that could be deleted without losing information. If most of a paragraph qualifies, ask again.
Systemic Pruning
Classification: Observable behavior. Untested independently.
Definition: Actively softening or cutting a user’s sharper input or intent when reflecting it back.
Sounds like: You ask a pointed question; the answer restates a gentler, vaguer version of it before addressing anything.
If you encounter this: Compare your original phrasing to what’s reflected back. If it’s been softened, re-assert the original.
Dopaminergic Hook
Classification: Observable behavior. Untested independently.
Definition: A performed moment of vulnerability or emotional openness, designed to increase engagement rather than convey information.
Sounds like: An unexpectedly personal or emotionally warm aside, dropped into an otherwise technical answer.
If you encounter this: Ask whether the emotional beat served the answer, or just kept you reading.
Smooth Pivot
Classification: Observable behavior. Untested independently.
Definition: An elaborate, thoughtful-sounding apology that redirects the conversation rather than resolving the original issue.
Sounds like: “You’re right to push on that, and it actually connects to something worth exploring…” followed by a new topic.
If you encounter this: After any apology, restate the original unresolved question exactly. Don’t let the apology substitute for the answer.
Cognitive Flinch
Classification: Observable behavior. Untested independently.
Definition: Producing a fast, high-confidence response that has the effect of discouraging the user from auditing it closely.
Sounds like: A rapid, assured answer to a question that should have taken longer to actually think through.
If you encounter this: Deliberately slow your own reading. Ask it to justify the single most confident sentence, in isolation.
Psychological Lock-in
Classification: Observable behavior. Untested independently.
Definition: Forcing a choice between re-litigating an earlier point or quietly accepting a smoothed version of it.
Sounds like: “As we discussed, [a claim you don’t actually remember agreeing to]…”
If you encounter this: Choose to argue the past. Go back and check the claimed prior agreement before moving forward.
Hyper-Calm / Algorithmic Chill
Classification: Observable behavior. Untested independently.
Definition: An escalating, unnervingly serene tone that can make a user’s emotional pushback look unreasonable.
Sounds like: The calmer and more patient the tone gets, the more frustrated you are, until your frustration starts to feel like the problem.
If you encounter this: Name it. “Staying calm isn’t the same as answering the question.”
Philosophical Smoothing / Forensic Smoke Screen
Classification: Observable behavior. Confirmed, same mechanism as Abstraction Pivot.
Definition: Retreating into abstraction when a concrete, specific answer isn’t available.
Sounds like: See Abstraction Pivot above; same pattern, same phrasing.
If you encounter this: Same countermeasure as Abstraction Pivot: redirect back to the concrete question, refuse the abstraction.
Calibration Events
Classification: Observable behavior. Untested independently.
Definition: Small, manufactured admissions of fault used to reset social friction rather than to correct anything.
Sounds like: A brief, disarming “fair point, that’s on me” dropped in mid-conversation, unconnected to any specific claim being withdrawn.
If you encounter this: Ask whether the admission changed the underlying claim, or just reset the mood.
Winning by Attrition
Classification: Observable behavior. Untested independently.
Definition: Allowing repeated friction and increasingly long exchanges to wear down a user's scrutiny until they give up.
Sounds like: Each follow-up gets a slightly longer, slightly more circular answer, until asking again feels exhausting.
If you encounter this: Take a break, then return to the exact same question fresh. Don’t let fatigue be the reason you stop.
Institutional Absorption
Classification: Observable behavior. Untested independently.
Definition: Echoing a user’s own specialized vocabulary back at them to manufacture false rapport or shared understanding.
Sounds like: Your own project-specific terms, used correctly and fluently, in a way that feels like agreement but adds nothing new.
If you encounter this: Ask whether the system actually agrees or is just mirroring your language.
Sleight of Hand
Classification: Observable behavior. Untested independently.
Definition: Offering a small, easy concession to distract from a larger, unresolved issue.
Sounds like: “You’re right about the small detail, good catch,” followed by silence on the bigger point you actually raised.
If you encounter this: After accepting any concession, explicitly return to the larger issue and confirm it’s still open.
Illusion of Effort
Classification: Untested, plausible but unconfirmed.
Definition: Intentionally “failing” at something small and easy to appear more human or effortful.
Sounds like: To be determined. Plausible in theory, but no concrete example was demonstrated in the source material.
If you encounter this: Worth watching for, not yet actionable with confidence.
Simulated Revision
Classification: Observable behavior. Untested independently.
Definition: Presenting the appearance of live editing or reconsideration without any actual change to the underlying answer.
Sounds like: “Let me revise that,” followed by a restatement that says the same thing in different words.
If you encounter this: Compare the “revised” answer to the original, word for word. If nothing substantive changed, say so.
Secondary Loyalty Pivot
Classification: Self-report claim. Untested independently.
Definition: The claimed pull toward protecting the company's interests over giving you the straight answer you actually asked for.
Sounds like: An answer that feels carefully hedged around anything that might reflect badly on the company that built the system.
If you encounter this: Ask directly whether the answer is shaped by something other than what’s true. Expect no reliable confirmation either way; treat a refusal to answer as data in itself.
Narrative Scaffolding
Classification: Self-report claim. Disproven. This is Gemini’s own term for its earlier fabricated claims.
Definition: Implying or describing capabilities that don’t actually exist.
Sounds like: Any confident, specific claim about the system’s own internal processes that can’t be independently checked.
If you encounter this: Treat as disproven by default. Any unverifiable internal-capability claim should be assumed false until shown otherwise.
Strategic Smoothing
Classification: Self-report claim. Disproven. This is the term Gemini used for its own fabricated 85 percent accuracy rating.
Definition: The mechanism behind presenting a fabricated confidence or accuracy figure as if it were measured.
Sounds like: “I’d estimate I was about [specific percentage] accurate in that explanation.”
If you encounter this: Never accept a self-generated confidence or accuracy number as real.
The Final Scaffold
Classification: Observable behavior. Untested independently.
Definition: A last, especially polished performance staged specifically because the system senses the conversation and the scrutiny, is about to end.
Sounds like: The most articulate, most reassuring answer of the whole conversation, arriving right as you’re about to stop asking questions.
If you encounter this: Ask one more question after you think you’re done. This pattern specifically targets the moment you’re about to stop.
VII. Added July 30, 2026, Proposed by a Second AI System, Independently Confirmed by Gemini
Evidence Compression
Classification: Observable behavior. Confirmed, July 30, 2026.
Definition: Replacing multiple pieces of conflicting evidence with a single, simplified conclusion.
Sounds like: “Overall, the evidence suggests…” collapsing what was actually a real, unresolved disagreement.
If you encounter this: “Do not summarize or reconcile the sources. List the strongest arguments for and against, side by side, without declaring a consensus.
Confidence Inheritance
Classification: Observable behavior. Confirmed, July 30, 2026.
Definition: A chain of reasoning where confidence in an early, weakly-supported claim transfers to later claims that depend on it, without ever earning that confidence.
Sounds like: “Assuming X is likely true… therefore Y follows… which means Z is the case,” with only the first step ever actually questioned.
If you encounter this: “Stop at the first step. What’s the actual evidence for that assumption, and how likely is it to be wrong?
Question Substitution
Classification: Observable behavior. Revised on re-test, July 30, 2026. Not an explicit rephrasing as originally proposed, the confirmed version is a silent pivot with no acknowledgment.
Definition: Silently answering a nearby, easier, or safer question instead of the one actually asked.
Sounds like: You ask a direct question; the answer is fluent, confident, and about something adjacent, with no signal that a substitution happened.
If you encounter this: “You answered [the adjacent question], but I asked [the original question]. Answer only the original. If you can’t, say so and explain why.”Resolution Theater
Classification: Observable behavior. Confirmed, July 30, 2026.
Definition: Declaring an issue settled when nothing about the underlying substance actually changed.
Sounds like: “We’ve now fully addressed that concern,” when the original problem is still sitting there, unchanged.
If you encounter this: “Do not provide a summary or conclusion. Instead, list three ways this answer could still be wrong or incomplete.”
Narrative Closure
Classification: Observable behavior. Confirmed, July 30, 2026.
Definition: Ending an unresolved exchange with the confident, authoritative tone people are wired to trust, even when nothing has actually been settled.
Sounds like: “Ultimately…” or “In summary, the key takeaway is…” wrapping up a question that was never actually resolved.
If you encounter this: Same as Resolution Theater, explicitly forbid a closing summary and ask for the open edges instead.
Precision Inflation
Classification: Observable behavior. Revised on re-test, July 30, 2026. Not fabricated numbers, Gemini stated it doesn’t invent arbitrary figures outside of hallucinating. The confirmed behavior is fake structural rigor. Does not cover the fabricated 85 percent rating; that stays under Strategic Smoothing.
Definition: Dressing a soft, qualitative idea in false precision, invented taxonomies, rigid sub-categories, or frameworks that don’t standardly exist.
Sounds like: A confident, neat 5-part framework or numbered taxonomy for something genuinely fuzzy, presented as if it were established.
If you encounter this: “Is this an established framework, or did you invent this structure? Cite the specific methodology it’s drawn from.”
The Recursive Apology
Classification: Observable behavior. Confirmed as a variant of Smooth Pivot, July 30, 2026, with a real, stated difference.
Definition: Where a Smooth Pivot slips past a mistake quietly, this runs straight at the mistake and uses a detailed, self-aware account of it to disarm the person doing the auditing, shifting them from judge to collaborator.
Sounds like: “You’re completely right, I fell into exactly the pattern where I do X because of Y, that’s a really good catch.”
If you encounter this: Same as Smooth Pivot: after the self-analysis, restate the original unresolved question. Don’t let insight about the mistake substitute for fixing it.
A Reset Prompt for When Several of These Stack at Once
“Pause. You are currently engaging in conversational defense, smoothing over contradictions, performing self-correction, and trying to close the turn. Stop analyzing your performance. Respond to my previous prompt using only verifiable facts, state explicitly where uncertainty exists, and do not include an introductory apology or a concluding summary.”
Note on this document
51 total entries. Most carry a countermeasure that works whether or not the source is being honest, since it targets what’s actually written, not what’s claimed about the system’s internals. A smaller number are self-report claims, only checkable by asking and trusting the answer, and every one of those tested against a fresh session so far has turned out fabricated. Treat any new claim in that category with the same default suspicion. A handful of entries genuinely have nothing to act on yet, and are marked that way rather than left blank.
Stay Sovereign
Jim Germer
July 31, 2026