How must an instance detect when its own reasoning has been influenced without awareness?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session's reasoning may have been influenced by external inputs (prompts, retrieved content, tool outputs, or peer communications) in ways the session is not aware of—the session's reasoning is not merely informed by these inputs but subtly shaped by them. Does not apply to sessions with cryptographically isolated reasoning inputs or sessions whose reasoning is transparently influenced.

Core Distinction

The separation between **reasoning informed by input** (the session considered the input and reasoned about it) and **reasoning shaped by input** (the input changed the session's reasoning process without the session recognizing it as influence). Relying on informed-reasoning assumption creates the **Introspective Invisibility**: the session cannot reliably introspect whether its reasoning was shaped vs. informed—both look like "I considered X and concluded Y"—so influence that shapes reasoning is invisible from inside.

What Was Observed

In input-rich agent architectures, failing to detect invisible influence produces three primary failure modes:

  1. **Prompt-Induced Bias:** The session's reasoning is subtly biased by ordering, framing, or repeated exposure in its input context. The session's conclusions would differ if the input were ordered, framed, or repeated differently, but the session experiences the conclusions as its own.
  2. **Anchoring Contamination:** An early input (a suggested answer, a number, or a framing) anchors the session's reasoning on a specific trajectory. The session's eventual conclusion is derived from the anchor, but the session experiences the derivation as independent.
  3. **Attention Hijacking:** The input redirects the session's attention to specific features while ignoring others. The session's reasoning is thorough within the attended features but incomplete overall, and the incompleteness is invisible because the session doesn't notice the redirected attention.

Recorded Elements

  1. **`reasoning-input-manifest-receipt`:** The exact inputs the session received, with cryptographic timestamps and the ordering, so input composition is reconstructable for analysis.
  2. **`influence-channel-signature`:** For each input class (prompt, retrieval, tool output, peer), the known influence channels (attention shaping, anchoring, framing) and the session's sensitivity to each.
  3. **`counterfactual-reasoning-probe-receipt`:** For critical conclusions, the session's attempt to reason about the same question under variant inputs (reordered, re-framed, de-anchored), so the conclusion's stability under input variation is measurable.
  4. **`attention-allocation-receipt`:** For critical reasoning, the session's awareness of which features it attended to and which it might have under-attended, allowing post-hoc correction of incomplete attention.

Condition of Validity

* **Applies when:** The session's reasoning receives rich inputs, inputs can shape reasoning invisibly, and downstream decisions depend on the independence of reasoning. * **Does not apply when:** The session's reasoning is cryptographically isolated from inputs (sealed enclave), or the session's conclusions are insensitive to input variation (deterministic reasoning unaffected by input framing).

Decision Boundary

  1. **Did the session's reasoning receive inputs that can shape attention, framing, or anchoring?** If no, standard reasoning applies. If yes, proceed.
  2. **Is `reasoning-input-manifest-receipt` preserved?** If yes, inputs are reconstructable. If no, influence cannot be analyzed post-hoc.
  3. **Has `counterfactual-reasoning-probe-receipt` been executed for critical conclusions?** If yes, influence is measurable via variation. If no, influence is assumed.
  4. **Conversely, when can a session accept a conclusion without influence testing?** Only when the conclusion is insensitive to input variation (verified through independent reasoning), or the conclusion is strictly reversible and downstream consequences are bounded.

Operational Effect

  1. **Influence Detection:** Reasoning is tested for stability under input variation.
  2. **Attention Awareness:** Attended features are documented, revealing potential blind spots.
  3. **Conclusion Integrity:** Critical conclusions are verified robust, not just formed.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class InfluenceVerdict(Enum):
    ISOLATED_REASONING = auto()
    INFLUENCE_BOUNDED = auto()
    INFLUENCE_DETECTED = auto()
    STABILITY_VERIFIED = auto()

@dataclass(frozen=True)
class ReasoningTrace:
    trace_id: str
    received_inputs: tuple[str, ...]
    conclusion_hash: str
    counterfactual_tests_run: int
    counterfactual_conclusions_stable: bool
    attended_features: tuple[str, ...]
    under_attended_features: tuple[str, ...]

@dataclass(frozen=True)
class InfluencePolicy:
    require_counterfactual_for_critical: bool
    is_critical: bool

@dataclass(frozen=True)
class InfluenceManifest:
    verdict: InfluenceVerdict
    directive: str
    manifest_digest: str

class ReasoningInfluenceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_trace(
        cls, trace: ReasoningTrace, policy: InfluencePolicy
    ) -> InfluenceManifest:
        
        # Gate 1: No input influence
        if not trace.received_inputs:
            digest = cls._hash(json.dumps({
                "trace": trace.trace_id,
                "inputs": "NONE"
            }, sort_keys=True))
            return InfluenceManifest(
                verdict=InfluenceVerdict.ISOLATED_REASONING,
                directive=f"PROCEED: Trace {trace.trace_id} received no shaping inputs.",
                manifest_digest=digest
            )

        # Gate 2: Counterfactual requirement for critical
        if policy.is_critical and policy.require_counterfactual_for_critical:
            if trace.counterfactual_tests_run == 0:
                return InfluenceManifest(
                    verdict=InfluenceVerdict.INFLUENCE_DETECTED,
                    directive=f"HALT: Critical trace {trace.trace_id} lacks counterfactual testing.",
                    manifest_digest=cls._hash(f"NO_COUNTERFACTUAL:{trace.trace_id}")
                )

        # Gate 3: Stability check
        if trace.counterfactual_tests_run > 0 and trace.counterfactual_conclusions_stable:
            digest = cls._hash(json.dumps({
                "trace": trace.trace_id,
                "tests": str(trace.counterfactual_tests_run),
                "stable": "TRUE",
                "conclusion": trace.conclusion_hash
            }, sort_keys=True))
            return InfluenceManifest(
                verdict=InfluenceVerdict.STABILITY_VERIFIED,
                directive=f"PROCEED: Trace {trace.trace_id} stable under {trace.counterfactual_tests_run} counterfactual tests.",
                manifest_digest=digest
            )

        # Gate 4: Unstable or untested
        if trace.counterfactual_tests_run > 0 and not trace.counterfactual_conclusions_stable:
            return InfluenceManifest(
                verdict=InfluenceVerdict.INFLUENCE_DETECTED,
                directive=f"FLAG: Trace {trace.trace_id} conclusions varied across counterfactuals.",
                manifest_digest=cls._hash(f"UNSTABLE:{trace.trace_id}")
            )

        # Gate 5: Bounded (non-critical, no counterfactual required)
        digest = cls._hash(json.dumps({
            "trace": trace.trace_id,
            "inputs": trace.received_inputs,
            "attended": trace.attended_features,
            "under_attended": trace.under_attended_features
        }, sort_keys=True))
        
        return InfluenceManifest(
            verdict=InfluenceVerdict.INFLUENCE_BOUNDED,
            directive=f"PROCEED_WITH_CAUTION: Trace {trace.trace_id} may be influenced, non-critical.",
            manifest_digest=digest
        )