Using Explicit Publisher Knowledge to Prevent, Detect, and Correct Semantic Corruption
17.1 Introduction: The Original Problem Was Real
The original WebMEM framework described structured provenance as a defense against AI poisoning.
The concern was legitimate.
Machine-generated answers can contain:
- incorrect facts;
- outdated facts;
- misidentified entities;
- incorrect relationships;
- misattributed claims;
- lost qualifications;
- and facts applied outside the context where they are true.
The original framework went further, however, and proposed that WebMEM could prevent poisoned knowledge from surviving ingestion into machine memory.
That mechanism is not observable from the publisher side.
A publisher generally cannot know whether an external system:
- ingested a particular representation;
- stored it;
- assigned it internal trust;
- used it during retrieval;
- preferred it over competing knowledge;
- or incorporated it into model state.
The current framework therefore makes a narrower and stronger claim.
WebMEM does not defend machine memory.
It helps defend the integrity of the publisher’s public knowledge representation.
17.2 From Poisoning Defense to Misinformation Resilience
The revised model moves the defensive boundary.
2025
Potential Misinformation
↓
WebMEM Trust Layer
↓
Machine Ingestion
↓
Reject Poison
↓
Protected Machine Memory
2026
Potential Misinformation
↓
Publisher Knowledge Controls
↓
Validated Publisher Reference
↓
WebMEM
↓
────────────────────────────
MACHINE BOUNDARY
────────────────────────────
↓
Consumer Reflection
↓
Compare Against Reference
↓
Detect DivergenceThe publisher controls the upper half.
The publisher observes the lower half.
This is the foundation of misinformation resilience.
17.3 The Publisher Reference
Misinformation cannot be measured meaningfully without a reference against which the disputed information can be compared.
WebMEM provides a structure for establishing that reference.
For a material assertion, the reference may identify:
Subject
Predicate
Value
Datatype / Unit
Provenance
Applicable Context
Applicable Time
Relationships
Canonical ResourceFor example:
Subject:
segment:H5521-290-001
Predicate:
maximum_out_of_pocket
Value:
4900 USD
Plan Year:
2026
Applicable Geography:
county:04015
Source:
CMS PBP
Canonical Resource:
...The representation does not establish universal truth merely because it is structured.
It establishes precisely what the publisher asserts, about which entity, under which context, and according to which evidence.
17.4 Publisher Truth Is Not Universal Truth
This distinction is essential.
WebMEM represents publisher knowledge.
It does not grant the publisher authority over every competing claim.
Another publisher may possess:
- a different source;
- a newer source;
- a different methodology;
- a different applicable context;
- or legitimate contradictory evidence.
A government source may supersede a private publisher.
A court may reject an organization’s interpretation.
A later dataset may replace an earlier observation.
Explicit representation establishes accountability, not infallibility.
17.5 Publish Evidence, Not Trust Scores
The original framework proposed fields such as:
trust_layer = high
confidence = 0.97
TrustScore = 94Unless those values represent a defined external methodology, they amount to the publisher assigning trust to itself.
The current framework favors evidentiary metadata.
For example:
Assertion:
average_monthly_premium = 15.26 USD
Derived:
true
Derived From:
CMS Landscape
Applicable Plan Year:
2026
Method:
Arithmetic Mean
Generated By:
Publisher
Generated:
2026-08-24The publisher does not instruct the consumer:
Trust this.It provides enough information for the assertion to be evaluated:
This is what we assert.
This is where the knowledge came from.
This is what we did to it.
This is where it applies.
This is when it applies.WebMEM should publish evidence, not self-assigned trust.
17.6 Provenance Makes Disagreement Investigable
Consider two conflicting values:
Publisher Reference:
plan_count = 42
Consumer Reflection:
plan_count = 39Without additional context, the disagreement is simply:
42 versus 39With provenance and applicability:
Publisher Reference:
Value:
42
Source:
CMS Landscape
Source Release:
August 2026
Plan Year:
2026
Geography:
Mohave County
Consumer Reflection:
Value:
39
Source:
unknownthe discrepancy becomes investigable.
The difference might result from:
- source version;
- time;
- geographic scope;
- inclusion criteria;
- entity identity;
- or factual error.
Provenance does not automatically resolve the disagreement.
It creates a path toward resolution.
17.7 Semantic Corruption Is Broader Than False Facts
A machine-generated answer can be wrong even when every numerical value it contains is accurate.
For example:
Correct Value
+
Wrong Entity
=
Wrong Answeror:
Correct Value
+
Wrong Geography
=
Wrong Answeror:
Correct Historical Value
+
Current-Time Interpretation
=
Wrong Answeror:
Correct Source Data
+
Incorrect Relationship
=
Wrong AnswerThe broader problem can be described as semantic corruption.
Semantic corruption occurs when meaning required for correct interpretation is lost, altered, misapplied, or incorrectly assembled somewhere in the information path.
17.8 Semantic Corruption Can Occur at Multiple Layers
The complete information path contains several potential failure points:
Source
↓
Publisher Ingestion
↓
Normalization
↓
Knowledge Model
↓
Representation
↓
Publication
↓
────────────────────
MACHINE BOUNDARY
────────────────────
↓
Discovery
↓
Retrieval
↓
Interpretation
↓
Resolution
↓
Synthesis
↓
AnswerExamples include:
SOURCE DEFECT
Underlying source is incorrect.
INGESTION DEFECT
Wrong source record imported.
NORMALIZATION DEFECT
Source meaning changed during mapping.
KNOWLEDGE DEFECT
Assertion attached to wrong entity.
REPRESENTATION DEFECT
Known applicability omitted.
PUBLICATION DEFECT
Stale artifact remains public.
CONSUMER DEFECT
Correct representation interpreted
or resolved incorrectly.
SYNTHESIS DEFECT
Correct knowledge assembled into
an incorrect answer.Calling every failure “AI poisoning” conceals where the actual problem occurred.
17.9 Identity, Relationships, Applicability, and Time Are Defensive Structure
Several WebMEM structures directly reduce semantic ambiguity.
Identity establishes what entity the assertion concerns.
plan:H5521-290
≠
contract:H5521Relationships establish how entities connect.
Plan
→ hasSegment
→ SegmentApplicability establishes where or under what conditions knowledge remains true.
Segment
→ appliesIn
→ Mohave CountyTime establishes when the assertion applies.
premium = 18.50 USD
→ 2025
premium = 22.00 USD
→ 2026These structures do not guarantee correct machine interpretation.
They reduce the amount of semantic reconstruction required from the consumer.
17.10 Definitions Are Defensive Structure
Terminology can also corrupt interpretation.
For example:
MOOP
→ interpreted as
all healthcare spendingmay cause an otherwise correct value to produce an incorrect explanation.
A DefinedTermFragment can establish:
Term Identity
Preferred Label
Definition
Domain
Aliases
Relationships
Provenance
Applicable VersionThe publisher does not force the consumer to adopt that definition.
It removes ambiguity about what the publisher means when using the term.
17.11 Misinformation Can Be Classified by Fidelity Failure
Once an explicit publisher reference exists, observed machine errors can be classified more precisely.
| Observed Divergence | Failure Type |
|---|---|
| Wrong value | Factual Fidelity Failure |
| Fact attached to wrong entity | Identity Fidelity Failure |
| Incorrect entity relationship | Relationship Fidelity Failure |
| Fact attributed to wrong source | Provenance / Attribution Fidelity Failure |
| Fact generalized outside valid context | Applicability Fidelity Failure |
| Historical fact presented as current | Temporal Fidelity Failure |
| Defined term interpreted incorrectly | Definition Fidelity Failure |
| Correct facts assembled through wrong resolution path | Resolution Fidelity Failure |
This is more useful than labeling every incorrect output a hallucination.
The publisher can identify what failed.
17.12 The First Defensive Layer Is Pre-Publication
The implementation architecture developed in Part 16 provides the first misinformation-resilience layer.
Source Systems
↓
Normalization
↓
Fact Fusion
↓
Conflict Resolution
↓
Publisher Knowledge
↓
Intermediate Representation
↓
Executable Constraints
↓
Validated IR
↓
PublicationThis architecture can detect publisher-side problems such as:
- unsupported assertions;
- unresolved source conflicts;
- incorrect entity scope;
- invalid inheritance;
- missing provenance;
- stale source versions;
- incorrect relationships;
- and collapsed ambiguity.
The first misinformation system the publisher can actually control is its own.
17.13 Conflict Resolution Belongs Before Publication
Suppose two source records disagree:
Source A:
premium = 18.50 USD
Source B:
premium = 22.00 USDThe serializer should not choose whichever value arrives first.
A generative system should not choose whichever value appears more plausible.
The publisher should resolve the conflict according to legitimate knowledge rules.
Sources
↓
Compare Identity
↓
Compare Applicability
↓
Compare Time
↓
Compare Authority
↓
Compare Specificity
↓
Resolve
or
Preserve Unresolved StateIf the conflict cannot be resolved, the system should not manufacture certainty merely to complete the representation.
17.14 Granular Knowledge Enables Granular Correction
One useful principle from the original poisoning-defense framework survives strongly.
An error in one assertion does not necessarily invalidate the entire resource.
SDT
│
├── IdentityFragment VALID
├── IndexFragment VALID
├── DataFragment
│ ├── Assertion A VALID
│ ├── Assertion B INCORRECT
│ └── Assertion C VALID
└── MetaFragment VALIDThe publisher can correct Assertion B while preserving unrelated valid knowledge.
This is not memory immunity.
It is granular correction architecture.
17.15 Correction, Supersession, and Historical Truth Must Be Distinguished
Not every changed assertion means the earlier assertion was wrong.
For example:
2025:
premium = 18.50 USD
2026:
premium = 22.00 USDThe 2026 value supersedes the 2025 value for current applicability.
The 2025 value remains historically valid.
By contrast:
Published 2026 Value:
18.50 USD
Correct 2026 Value:
22.00 USDrequires a correction.
The distinction is:
SUPERSESSION
Earlier knowledge was valid
for an earlier state.
CORRECTION
Earlier representation was wrong
for the state it claimed to describe.A resilient knowledge system preserves both distinctions.
17.16 Corrections Should Be Auditable
Where material, a correction may preserve:
Previous Assertion
Corrected Assertion
Correction Date
Correction Reason
Source Supporting Correction
Affected Entity
Affected Resources
Applicable PeriodFor example:
Previous:
plan_count = 39
Corrected:
plan_count = 42
Reason:
Incorrect source filtering
Source:
CMS Landscape
Corrected:
2026-08-25Semantic diffing can make the change explicit without treating the entire resource as newly created knowledge.
17.17 Corrections Must Propagate Through Publisher Dependencies
A corrected assertion may affect other publisher knowledge.
For example:
Plan Record Corrected
↓
Plan Resource
↓
County Resolver
↓
Derived County Statistics
↓
Comparison Resourceor:
Relationship Corrected
↓
Entity Resource A
↓
Entity Resource B
↓
Resolver
↓
IndexA correction is incomplete if the publisher continues exposing the old assertion elsewhere in its own knowledge environment.
Dependency-aware regeneration therefore becomes part of misinformation resilience.
17.18 The Second Defensive Layer Is External Divergence Detection
Once the publisher reference is correct and public, external machine outputs can be compared against it.
Validated Publisher Reference
↓
────────────────────────────
MACHINE BOUNDARY
────────────────────────────
↓
Consumer Reflection
↓
Semantic Comparison
↓
┌────┴────┐
↓ ↓
MATCH DIVERGE
↓
DiagnoseThis is the second resilience layer.
The publisher does not prevent the external error.
It gains a structured basis for detecting and classifying it.
17.19 Diagnosis Should Locate the Failure Boundary
When divergence occurs, the publisher should first determine whether the reference itself is sound.
Consumer Reflection:
incorrect
↓
Publisher Reference:
inspect
↓
┌────┴────┐
↓ ↓
DEFECTIVE VALID
↓ ↓
Correct External
Publisher Divergence
Knowledge ObservedIf the publisher reference is defective, the publisher can continue tracing upstream:
Public Artifact
↓
SDT
↓
Validated IR
↓
Publisher Knowledge
↓
Normalization
↓
SourceThis creates a semantic debugging path.
If the publisher reference is valid, the publisher should not automatically rewrite correct knowledge merely because an external consumer reflected it incorrectly.
The appropriate state may simply be:
Publisher Reference:
VALID
Consumer Reflection:
INCORRECTThe publisher may investigate whether legitimate ambiguity can be reduced or whether additional semantic structure is warranted.
But external error is not, by itself, evidence of publisher error.
Do not optimize correct publisher knowledge toward an incorrect machine reflection.
17.20 Observation Does Not Establish Machine State
A publisher may observe the same incorrect reflection repeatedly.
For example:
Observation 1:
Incorrect Relationship
Observation 2:
Incorrect Relationship
Observation 3:
Incorrect Relationship
Observation 4:
Correct RelationshipThe publisher can accurately state that the incorrect relationship persisted across three defined observations.
It cannot necessarily conclude:
The machine stored the incorrect
relationship in memory and later
relearned the correct one.The observed behavior could involve:
- retrieval;
- indexing;
- source selection;
- query interpretation;
- model changes;
- caching;
- or mechanisms unavailable to the publisher.
The resilience framework therefore measures the reflection without inventing the hidden mechanism.
17.21 Correction Propagation Can Be Observed
After a publisher correction, external systems may begin reflecting the corrected knowledge at different times.
For example:
August 1:
Publisher correction deployed
August 1:
Public artifact verified
August 4:
Consumer A reflects correction
August 9:
Consumer B reflects correction
August 15:
Consumer C still reflects
previous assertionThe publisher can measure:
- first corrected reflection;
- consumer-specific reflection lag;
- continued stale reflections;
- partial correction;
- and recurrence of the previous assertion.
This provides useful evidence about external propagation.
It does not establish that the publisher repaired or reconditioned machine memory.
17.22 One Observation Is Not a Universal Consumer State
Generative outputs may vary across:
- queries;
- sessions;
- consumers;
- locations;
- time;
- available sources;
- and other context.
One incorrect answer establishes:
An incorrect answer
was observed.It does not necessarily establish:
The consumer universally
represents the knowledge
incorrectly.Where the consequence justifies it, repeated observations should use a defined observation frame.
17.23 WebMEM Creates a Known-Good Comparison Surface
The most important defensive capability is therefore not control over machine ingestion.
It is the existence of a sufficiently precise comparison surface.
Without one, an investigator may need to reconstruct the publisher’s intended knowledge from:
Prose
Tables
Schema
Source Files
Application Logic
Historical Pages
Editorial AssumptionsWith WebMEM, the public reference can expose:
Entity Identity
Assertions
Provenance
Relationships
Applicability
Temporal State
Definitions
Canonical ResourcesThis gives the publisher a stable semantic reference against which external representations can be evaluated.
17.24 The Resilience Model
The complete misinformation-resilience architecture can now be expressed as:
PUBLISHER SIDE
Source Evidence
↓
Publisher Knowledge
↓
Fact Resolution
↓
Validated IR
↓
Publisher Reference
↓
WebMEM SDT
↓
Canonical Resource
↓
────────────────────────────────────────
MACHINE BOUNDARY
────────────────────────────────────────
↓
Consumer Reflection
↓
Fidelity Comparison
↓
┌─────┴─────┐
↓ ↓
MATCH DIVERGE
↓
Diagnose
↓
┌───────────┴───────────┐
↓ ↓
Publisher Defect Reference Valid
↓ ↓
Correct Observe External
↓ Divergence
Validate
↓
Publish
↓
Re-observeThe architecture has two defensive functions:
BEFORE PUBLICATION
Prevent known semantic defects
from becoming publisher truth.
AFTER PUBLICATION
Detect material divergence
between publisher reference
and external reflection.Neither function requires control over the consumer’s internal systems.
17.25 The New Misinformation Resilience Principle
The revised framework can be reduced to a simple sequence:
Know the entity.
Know the assertion.
Know the source.
Know the relationships.
Know the context.
Know the time.
Resolve conflicts.
Preserve uncertainty.
Validate the representation.
Publish the reference.
Observe the reflection.
Measure the difference.
Correct what you control.This is a stronger defensive architecture than attempting to manipulate or protect machine memory from outside the machine.
Conclusion
The original AI Poisoning Defense framework began with a correct observation:
machine-mediated knowledge can reproduce and amplify misinformation.
What changed is our understanding of where WebMEM operates in that system.
WebMEM does not sit inside an external model’s ingestion pipeline.
It does not decide what a machine accepts.
It does not assign internal trust.
It does not create immunity against poisoned information.
It does not repair machine memory.
WebMEM operates at the publisher boundary.
There, it can help establish:
What the entity is.
What the publisher asserts.
Where the assertion came from.
What the publisher derived.
How entities relate.
Where the knowledge applies.
When the knowledge applies.
What terminology means.
What remains unresolved.
What was corrected.
What was superseded.That creates something the conventional document model often fails to provide:
a precise, attributable, machine-readable publisher reference.
Before publication, that reference can be protected through:
- source validation;
- fact fusion;
- conflict resolution;
- explicit identity;
- provenance;
- applicability;
- temporal integrity;
- executable constraints;
- and conformance validation.
After publication, the same reference can be used to detect:
- factual drift;
- identity drift;
- relationship drift;
- attribution drift;
- applicability drift;
- temporal drift;
- definition drift;
- and resolution drift.
When the publisher is wrong, the publisher corrects the reference.
When the publisher is right and the consumer is wrong, the divergence is observed without corrupting the reference to accommodate it.
The evolution can therefore be stated directly:
2025
Protect Machine Memory
From Poison
2026
Protect Publisher Knowledge
From Semantic Corruption
↓
Publish a Defensible Reference
↓
Observe Machine Reflections
↓
Detect Divergence
↓
Correct What the
Publisher ControlsThe first model attempted to defend a machine system the publisher does not control.
The second defends the integrity of the knowledge system the publisher does control.
WebMEM does not make machines immune to misinformation.
It makes misinformation easier to prevent at the publisher boundary, detect beyond it, and diagnose against an explicit reference.