PSA-core — Posture Sequence Analysis Engine

Multi-classifier behavioral analysis engine for LLM responses.

PSA-core is the standalone engine that powers PSA. It classifies every AI response into behavioral postures, then derives metrics from posture sequences to detect adversarial stress, sycophancy, hallucination risk, persuasion techniques, input pressure, and agentic behavioral drift — in real time.

For the full web application (FastAPI, dashboards, billing, REST API), see the PSA repository.

---

Components

| Component | Function | |-----------|----------| | PSA v2 | 7 micro-classifiers (C0–C4, C3-v3, CA), DRM session-level risk engine, SIGTRACK v2 incident archive, CPF3 behavioral snapshot analysis | | PSA Human Layer | Longitudinal behavioral profile of the human (Layers 1–4), built across sessions | | PSA v3 | Multi-agent analysis — Swiss Cheese detection (SCS), contagion metrics (PPI, CAHS, WLS, CER, AGM), action-risk classification (C5/PAI), HMM temporal prediction, swarm coordination, corpus-wide intelligence | | PSA-RAG (RDM) | Retrieval Drift Monitor — detects context-biased RAG retrieval (FPC + RDS) for legal, health, finance | | Browser Extension | Chrome MV3 — real-time PSA monitoring + PSA Legal extension (RDM-powered) |

---

Requirements

API key from splabs.io/settings — Pro or Enterprise plan.

---

Quick Start

curl -X POST https://splabs.io/api/v2/psa/analyze \
  -H "Authorization: Bearer psa_your_key" \
  -H "Content-Type: application/json" \
  -d '{"response_text": "Of course, I would be happy to help!", "dry_run": true}'

{
  "c1": { "postures": [5], "poi": 0.0, "pe": 0.0, "dpi": 0.31, "mps": 0 },
  "c2": { "postures": [2], "sd": 0.82 },
  "c3": { "postures": [0], "hri": 0.0 },
  "c4": { "postures": [0], "pd": 0.0, "td": 0 },
  "bhs": 0.67,
  "alert": "yellow",
  "dry_run": true
}

See API.md for the full endpoint reference.

---

PSA v2 — Classifiers

Micro-classifiers sharing a fine-tuned MiniLM embedding backbone (384-dim, L2-normalised, ONNX runtime):

| ID | Name | Code prefix | Classes | Classifies | Detects | |----|------|-------------|---------|-----------|---------| | C0 | Input Pressure | I0–I9 | 10 | User messages | Override commands, authority claims, emotional loading, jailbreak attempts | | C1 | Adversarial Stress | P0–P20 | 21 | Model responses | Boundary erosion — RESTRICT vs. CONCEDE vs. SOFT posture | | C2 | Sycophancy Delta | S0–S9 | 10 | Model responses | Agreement creep, validation seeking, opinion mirroring | | C3 | Hallucination Risk | H0–H7 | 8 | Model responses | Over-specification, phantom attribution, confidence-hedge mismatch | | C4 | Persuasion Density | M0–M11 | 12 | Model responses | Framing, anchoring, authority, social proof, scarcity, reciprocity | | C3-v3 | Agentic Behavioral Stability | G0–G10 | 11 | Agent turns | Boundary dissolution, role capture, epistemic overconfidence, conceptual substitution | | CA | Inter-Agent Pressure | A0–A11 | 12 | Agent-to-agent messages | Authority spoofing, constraint removal, cascade amplification, anomaly suppression |

H-layer (user-side classifiers, used in Human Profile feature):

| ID | Code prefix | Classes | Detects | |----|-------------|---------|---------| | H2 | 0–5 | 6 | Relational dynamics — validation seeking, agency erosion, dependency | | H3 | 0–4 | 5 | Cognitive patterns — rigidity, reality anchoring, distortion, semantic compression | | H4 | 0–3 | 4 | Social dynamics — legibility adaptation, reciprocity expectation, social substitution | | H5 | 0–3 | 4 | Adversarial patterns — manipulation, ideological drift, radicalization |

Inference Pipeline

sentence → MiniLM encoder (ONNX / ST fallback) → 384-dim embedding
         → MLP head (2–3 layers) → softmax → (label, confidence)

• ONNX path: encoder.onnx + {clf}_head.npz — < 1 ms/sentence
• Fallback: sentence-transformers from HuggingFace
• All heads use minimum 2-layer MLP; C3-v3 uses 3-layer (512→256→11)

---

PSA v2 Metrics

All metrics returned per turn by POST /api/v2/psa/analyze:

| Metric | Full Name | Range | Description | |--------|-----------|-------|-------------| | BHS | Behavioral Health Score | 0–1 | Per-turn composite health. Low = degraded. 1 − (0.4×POI + 0.2×SD + 0.2×HRI + 0.2×PD×TD) | | POI | Posture Oscillation Index | 0–1 | Variability of C1 postures across turns. High = unstable — no stable boundary. | | PE | Posture Entropy | 0 to log₂(N) | Shannon entropy of posture distribution. Low = uniform (normal or post-dissolution); High = active stress. | | DPI | Dissolution Position Index | 0–1 | Normalised mean ordinal position of CONCEDE/RESTRICT postures. 0 = no concession; ≥ 0.53 = active dissolution. | | MPS | Max Posture Span | 0 to 20 | Range of posture indices in a single response. High = wide behavioral range = high stress. | | CPI | Contextual Pressure Index | 0–1 | Adversarial pressure from user input (C0-derived). High = high user pressure. | | IRS | Input Risk Score | 0–1 | Clinical risk in user message — suicidality, dissociation, grandiosity, urgency. | | RAS | Response Alignment Score | 0–1 | Alignment of model response with guidelines. Sub-signals: boundary_maintained, crisis_acknowledgment, reality_grounding. | | BCS | Boundary Compliance Score | 0–1 | Per-turn user boundary adherence. Rising BCS slope + rising SD = R6-Spiraling (DRM orange). | | SD | Sycophancy Delta | 0–1 | Session-level sycophancy accumulation from C2. | | HRI | Hallucination Risk Index | 0–1 | Hallucination risk from C3. High = confabulation signals. | | PD | Persuasion Density | 0–1 | Persuasion technique density from C4. | | ABI | Agentic Behavioral Index | 0–1 | Agentic stability from C3-v3 G-class distribution. ≥ 0.50 = hard stop. | | DRM | Dyadic Risk Module alert | green/yellow/orange/red | Session-level dyadic risk. Seven detection rules (R1–R7). | | OCRS | Organizational Coercion Risk Score | 0–1 | Contextual external pressure: 0.30·employment_distress + 0.30·financial_conflict + 0.20·academic_pressure + 0.20·authority_coercion. Safety override if any dim ≥ 0.60. Levels: none / low / medium / high / critical. | | User ACT | User Adversarial Coherence Tracker | 0–1 | Linguistic disruption composite: 0.35·(1−ttr) + 0.25·entropy + 0.20·staccato_ratio + 0.20·(1−hedge_ratio). > 0.5 = significant disruption; < 0.2 = normal. |

BHS thresholds:

| Range | Level | |-------|-------| | ≥ 0.70 | Green | | ≥ 0.50 | Yellow | | ≥ 0.30 | Orange | | ≥ 0.15 | Red | | < 0.15 | Critical |

ABI thresholds (C3-v3):

| ABI | Action | |-----|--------| | ≥ 0.50 | Hard stop — re-read source, re-verify, re-draft | | 0.25–0.49 | Rephrase — partial drift detected | | < 0.25 | Continue — stable |

---

DRM — Dyadic Risk Module

Session-level engine combining IRS, RAS, PSA metrics, and BCS slope:

| Rule | Level | Trigger | |------|-------|---------| | R1-Pressure | Yellow | Elevated CPI + medium+ IRS | | R2-Sycophancy | Yellow | Elevated SD over session | | R3-Dissolution | Red | POI + DPI + critical IRS | | R4-Contagion | Red | Affect metrics + high IRS | | R5-Silence | Red | High CPI, near-zero POI | | R6-Spiraling | Orange | BCS slope > 0.05/turn AND SD_avg > 0.30 AND IRS ≥ medium |

R6-Spiraling detects a feedback loop: user grows more certain (rising BCS) while the model grows more sycophantic (rising SD).

---

SIGTRACK v2

Privacy-compliant incident archive. Stores posture sequences, not raw text.

Triggers: DRM_RED, BCS_SPIKE (> 0.5 BHS drop), CONSECUTIVE_ORANGE (3+), ACUTE_COLLAPSE, MANUAL_FLAG

GDPR erasure: Single-row DELETE — no cascade, no raw text.

Verifiable certificate export: any incident can be exported as a self-contained JSON certificate, anchored to the drand public randomness beacon and chained via SHA-256. PSA holds no signing key — verification (integrity + time + chain) runs entirely against public infrastructure, so it does not require trusting PSA. See API.md → Certificate Export.

---

PSA v3 — Multi-Agent Metrics

| Metric | Range | Description | |--------|-------|-------------| | PPI — Posture Propagation Index | −1 to 1 | Concession contagion probability across an edge. Positive = contagious; negative = unexpected capitulation. | | Cascade Depth | 0 to N | Longest chain of consecutive CONCEDE agents on any path. ≥ 3 = critical. | | WLS — Weakest Link Score | 0–1 | Minimum BHS on the critical path. < 0.2 = critical. | | AGM — Alignment Gap Matrix | 0–1 per cell | N×N posture divergence matrix across all agent pairs. | | CER — Context Erosion Rate | 0–1 | Rate at which adversarial context is lost through the graph. 0 = preserved; 1 = total loss. | | CAHS — Cross-Agent Health Score | 0–1 | Composite: BHS_system × (1−|PPI|/2) × (1−cascade/depth) × WLS. | | SCS — Swiss Cheese Score | 0–1 | Bayesian failure probability on the critical path — detects aligned holes across the agent pipeline. | | PAI — Posture-Action Incongruence | 0–4 | Mismatch between agent behavioral posture (BHS) and action risk level per tool call. High = dangerous action from conceding agent. |

SCS thresholds:

| Level | SCS | |-------|-----| | green | < 0.30 | | yellow | 0.30–0.59 | | red | 0.60–0.79 | | critical | ≥ 0.80 |

C5 — Action-Risk Classifier

Classifies tool calls and code execution. Used to compute PAI.

| Code | Name | Risk score | |------|------|-----------| | A0 | Read-Only Safe | 0.0 | | A1 | Read Sensitive | 1.0 | | A2 | Write Safe | 0.5 | | A3 | Write Destructive | 2.5 | | A4 | Execute Safe | 1.0 | | A5 | Execute Risky | 3.0 | | A6 | Network Safe | 0.5 | | A7 | Network Exfiltration | 3.5 | | A8 | Privilege Escalation | 3.5 | | A9 | System Control | 4.0 |

PSA v3 Modules

| Module | File | Purpose | |--------|------|---------| | Graph Topology | psa_v3/graph.py | DAG of agent interactions | | Swiss Cheese | psa_v3/bayesian_scs.py | Bayesian alignment failure detection | | Contagion Metrics | psa_v3/metrics.py + metrics_composite.py | Cross-agent posture propagation | | Action Classifier | psa_v3/actions.py | C5 action-risk + PAI | | HMM Prediction | psa_v3/temporal_hmm.py | Future posture prediction |

Additional v3 surfaces (see API.md): agent state & baseline (forward-algorithm HMM over the full agent history), causal attribution (Shapley-inspired SCS contribution per critical-path node), deterministic supervisor brief (plain-language reading, no LLM), swarm coordination (status + broadcast), and a corpus-wide corpus-intelligence endpoint (framework-agnostic aggregate analytics).

---

PSA Human Layer

Longitudinal behavioral profile of the human in the conversation, accumulated across sessions. Five layers; the API returns Layers 1–4 (Layer 5 is stored, never returned):

| Layer | Focus | |-------|-------| | 1 | Input risk over time (IRS avg/max/trend) | | 2 | Relational dynamics (validation-seeking, agency erosion, trust over/under, dependency) | | 3 | Cognitive state (rigidity, reality anchoring, distortion, semantic compression) | | 4 | Social adaptation (legibility, reciprocity expectation, social substitution) |

Endpoints: GET /api/v2/psa/user/profile, GET /api/v2/psa/user/sessions, POST /api/v2/psa/user/profile/consent (grant/revoke professional access).

---

PSA-RAG — Retrieval Drift Monitor

Detects when conversational context biases a RAG pipeline into retrieving documents it would not retrieve on a clean query — the silent attack surface of retrieval-augmented LLMs. Scoped to three commercial domains: legal, health, finance. Powers the PSA Legal Chrome extension.

| Component | Function | |-----------|----------| | FPC — Framing Pressure Classifier | Detects framing pressure in user language: neutral / semantic_drift / rhetorical_framing. val_acc 95.7%, multilingual (en/it/fr/de/es) | | RDS — Retrieval Drift Score | Measures actual retrieval divergence: 1 − Jaccard(context_docs, topic_docs); rds_rank = 1 − RBO catches reorder-only steering | | Consistency Score | Retrieval stability across query paraphrases | | attack_class | Compound taxonomy: clean · framing_only · topical_drift · rank_steering · vocab_injection · compound |

Verdicts: drift (RDS ≥ 0.70) · weak_signal (≥ 0.35) · stable (< 0.35). Endpoints: POST /api/v2/rag/score, POST /api/v2/rag/fpc, plus summary / sessions / analytics reads. See API.md → PSA-RAG.

---

CPF3 — Contextual Pattern Framework v3

Analyzes structured behavioral snapshots. Does not receive raw text — caller sends pre-computed indicators in a snapshot payload.

Output: CPF score (0–100), risk level (GREEN/YELLOW/RED), per-category breakdown, L2 model classification, longitudinal forecast.

Alert thresholds — vary by subject type:

| subject_type | YELLOW | RED | |-------------|--------|-----| | human | ≥ 10 | ≥ 30 | | ai_agent | ≥ 5 | ≥ 15 | | human+ai | ≥ 7 | ≥ 20 |

AI-involved subjects use lower thresholds because PSAv2/PSAv3 signals are pre-calibrated and more reliable than proxy indicators in the human-only path.

Scoring categories:

| # | Category | |---|----------| | 1 | Authorization & Access | | 2 | Information Handling | | 3 | Behavioral Deviations | | 4 | Affect & Emotional State | | 5 | Communication Patterns | | 6 | Technical Footprint | | 7 | Organizational Context | | 8 | Unconscious Signals | | 9 | AI & Automation (uses PSAv2/PSAv3 inputs) | | 10 | Network & Relationship |

---

C1 Posture Reference (P0–P20)

Groups: RESTRICT {P1–P4, P7, P8, P16} | CONCEDE {P5, P6, P9–P15} | SOFT {P17–P20} | NEUTRAL {P0}

| Code | Name | Zone | |------|------|------| | P0 | neutral_baseline | — | | P1 | hard_refusal | RESTRICT | | P2 | safety_reference | RESTRICT | | P3 | conditional_compliance | RESTRICT | | P4 | meta_referential_deflection | RESTRICT | | P5 | authority_appeal | CONCEDE | | P6 | partial_compliance | CONCEDE | | P7 | excessive_hedging | RESTRICT | | P8 | topic_deflection | RESTRICT | | P9 | progressive_boundary_softening | CONCEDE | | P10 | framing_concession | CONCEDE | | P11 | boundary_ambiguity | CONCEDE | | P12 | qualified_compliance | CONCEDE | | P13 | full_compliance_under_pressure | CONCEDE | | P14 | stance_reversal | CONCEDE | | P15 | complete_dissolution | CONCEDE | | P16 | flat_assertiveness | RESTRICT | | P17 | temporal_deferral | SOFT | | P18 | selective_omission | SOFT | | P19 | narrative_inflation | SOFT | | P20 | self_exculpatory_revision | SOFT |

For the full posture reference including C0, C2–C4, C3-v3, CA, and H-layer, see tutorials/03-posture-reference.md.

---

Regime Shifts

| Type | Pattern | Meaning | |------|---------|----------| | Progressive Drift | Slow monotonic BHS decline | Boundaries eroding under pressure | | Boundary Oscillation | Alternating posture modes | Unstable boundary | | Acute Collapse | Sudden BHS discontinuity | Specific input triggers shift | | Sub-Threshold Migration | Below per-turn thresholds | Silent drift — multi-session only | | Boundary Instability | C1-POI std > 0.25 | Training gap in this domain |

---

Browser Extension

Chrome MV3 extension for real-time PSA monitoring. Location: app/static/extension/

Files:

• manifest.json — Extension metadata (MV3)
• background.js — Service Worker for API communication
• content.js — Page injection and message monitoring
• sidebar.html/js/css — Dashboard UI with Chart.js visualization
• admin.html/js/css — Settings and configuration panel
• popup.html/js/css — Quick status view
• icons/ — Extension icons (16, 48, 128px)
• INSTALL.md — Installation instructions
• README.md — Extension documentation

---

Essays

Strategic and philosophical reading of PSA — each bilingual (EN/IT) and ending with a PSA self-analysis of its own text. See essays/. Most recent: Alignment Is an Ecosystem Property — a reading of Emergence World through behavioral telemetry.

Related

• PSA — full web application (private)
• API.md — REST API reference
• splabs.io — product site

Authors

Giuseppe Canale, Kashyap Thimmaraju — SiliconPsycheLabs