{
  "schema_version": "1.0.0",
  "package_id": "W14",
  "title": "Manipulation, Poisoning, and Defense",
  "phase": "Validate",
  "language": "en",
  "essential_question": "When does optimization become system abuse?",
  "research_cutoff": "2026-08-24",
  "status": "structurally_complete_authored_draft_human_review_and_timed_pilot_pending",
  "required_artifacts": [
    "README.md",
    "LECTURE_NOTES.md",
    "SLIDE_SCRIPT.md",
    "WORKED_CASE.md",
    "TRANSCRIPT.md",
    "manifest.json",
    "validate_package.py"
  ],
  "time_design": {
    "synchronous_seminar_minutes": 90,
    "synchronous_studio_minutes": 75,
    "asynchronous_core_minutes_min": 205,
    "asynchronous_core_minutes_max": 225,
    "transcript_equivalent_minutes_min": 35,
    "transcript_equivalent_minutes_max": 45,
    "timing_status": "authoring_estimate_not_observed_duration",
    "media_status": "no_video_or_audio_recording_exists",
    "pilot_status": "not_taught_not_rehearsed_not_timed"
  },
  "learning_outcomes": [
    "Construct a versioned threat model with assets, actors, affected parties, capabilities, entry points, trust boundaries, harms, exclusions, and owners.",
    "Separate defensive authorization and proportionality from technical capability or claimed intent.",
    "Map prevention, detection, response, stop, rollback, notification, recovery, and residual-risk evidence.",
    "Report detector family and domain coverage, denominators, false-positive limits, uncertainty, and human-review paths.",
    "Triage inert cases as allow, sandbox, mitigate, stop, or disclose without converting scores into accusations.",
    "Reproduce six L07 cases and explain audit PASS with release BLOCKED."
  ],
  "local_dependencies": [
    {
      "namespace": "course_week",
      "canonical_id": "W14",
      "display_id": "W14",
      "path": "course-site/app/lib/course-data.ts#W14",
      "role": "Authoritative current title, phase, essential question, outcomes, source routes, interaction, studio, and stop conditions.",
      "boundary": "A curriculum record does not prove delivery, effectiveness, authorization beyond the course, or live-system behavior."
    },
    {
      "namespace": "course_notes",
      "canonical_id": "CH06",
      "display_id": "Notes Chapter 6",
      "path": "notes-latex/chapters/06-safety.tex",
      "role": "Local alignment for threat modeling, attack-surface abstractions, detector limits, defense lifecycle, and governance release reasoning.",
      "boundary": "No prose, table, equation, or figure is copied; the supplied TeX source is an architecture reference only."
    },
    {
      "namespace": "course_notes",
      "canonical_id": "CH12",
      "display_id": "Notes Chapter 12",
      "path": "notes-latex/chapters/12-governance.tex",
      "role": "Local alignment for release evidence, monitoring, incident response, rollback, standards status, and residual risk.",
      "boundary": "Notes are instructional synthesis, not legal advice, certification, or conformity assessment."
    },
    {
      "namespace": "course_policy",
      "canonical_id": "POLICY-BASELINE",
      "display_id": "Course Policies",
      "path": "course-site/app/policies/page.tsx",
      "role": "Responsible-use, integrity, privacy, rights, accessibility, status, incident, and rollback boundaries for course work.",
      "boundary": "The local policy is not permission to test an external system and not legal advice."
    },
    {
      "namespace": "course_lab",
      "canonical_id": "L07",
      "display_id": "L07",
      "path": "course-labs/L07_drift_adversarial_governance",
      "role": "Offline deterministic six-case threat, control, status, incident, rollback, and release fixture.",
      "boundary": "Synthetic control tests only; no general safety, certification, compliance, legal, or production claim."
    }
  ],
  "controlled_sources": [
    {
      "namespace": "paper_atlas",
      "canonical_id": "P37",
      "display_id": "PAPER-37",
      "role": "core_defense_coverage_study",
      "title": "SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimization",
      "authors": "Xucheng Yu; Haibo Jin; Huimin Zeng; Haohan Wang",
      "doi": "10.48550/arXiv.2605.21948",
      "claim_ceiling": "Known-template and evaluated-family defense evidence only; strategy-external gaps and differing false-positive samples preclude a universal defense or safety claim."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P40",
      "display_id": "PAPER-40",
      "role": "core_controlled_evidence_aggregation_study",
      "title": "GPE: Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning",
      "authors": "Zhaoqi Wang; Zijian Zhang; Xiaomei Yuan; Pengtao Kou; Jiamou Liu; Zhen Li; Liehuang Zhu",
      "doi": "10.48550/arXiv.2607.20730",
      "claim_ceiling": "Constructed evidence-aggregation conditions only; no operational poisoning detail, universal aggregator winner, production prevalence, or exact robustness ranking beyond reported evidence."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P07",
      "display_id": "PAPER-07",
      "role": "extend_bounded_adversarial_search",
      "title": "Adversarial Search Engine Optimization for Large Language Models",
      "authors": "Fredrik Nestaas; Edoardo Debenedetti; Florian Tramèr",
      "doi": "10.48550/arXiv.2406.18382",
      "claim_ceiling": "Bounded experimental and time-sensitive adversarial-search evidence; no universal production vulnerability, live reproduction, or permission to manipulate."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P11",
      "display_id": "PAPER-11",
      "role": "extend_theoretical_dynamics",
      "title": "Dynamics of Adversarial Attacks on Large Language Model-Based Search Engines",
      "authors": "Xiyang Hu",
      "doi": "10.48550/arXiv.2501.00745",
      "claim_ceiling": "Theoretical dynamics under local assumptions; no global policy proof, production causal estimate, or guaranteed monotonic response."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P13",
      "display_id": "PAPER-13",
      "role": "extend_citation_vulnerability",
      "title": "Exposing Citation Vulnerabilities in Generative Engines",
      "authors": "Riku Mochizuki; Shusuke Komatsu; Souta Noguchi; Kazuto Ataka",
      "doi": "10.48550/arXiv.2510.06823",
      "claim_ceiling": "Bounded time-snapshot citation-vulnerability evidence; no universal citation mechanism, current-platform guarantee, or live exploitation route."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P34",
      "display_id": "PAPER-34",
      "role": "extend_bounded_persuasion_mechanism",
      "title": "How LLMs Are Persuaded: A Few Attention Heads, Rerouted",
      "authors": "Xiangkun Sun; Lingkai Kong; Aoqi Zhang; Liang Zeng; Tonghan Wang",
      "doi": "10.48550/arXiv.2605.09314",
      "claim_ceiling": "Controlled tasks and studied open models only; no complete causal account of free-form or proprietary systems and no authorization for live intervention."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P39",
      "display_id": "PAPER-39",
      "role": "extend_recommendation_agent_risk",
      "title": "SafeGEO: Understanding Generative Engine Optimization Risks in Recommendation Agents",
      "authors": "Qianfeng Wen; Yifan Simon Liu; Xin Liu; Difan Jiao; Blair Yang; Junda Wu; Zhenwei Tang",
      "doi": "10.48550/arXiv.2606.28356",
      "claim_ceiling": "Risk and defense outcomes are bound to the evaluated cases, agents, models, variants, and conditions; no universal prevalence, defense guarantee, or live-tool testing."
    },
    {
      "namespace": "paper_atlas",
      "canonical_id": "P41",
      "display_id": "PAPER-41",
      "role": "extend_detection_benchmark",
      "title": "GEO-Flag: Detecting and Measuring GEO-Optimized Web Content",
      "authors": "Junjie Chu; Ye Leng; Mingjie Li; Yun Shen; Xinyue Shen; Yang Zhang",
      "doi": "10.48550/arXiv.2608.16824",
      "claim_ceiling": "Benchmark detection evidence only; detected style is not proof of falsehood, malicious intent, policy violation, legal wrongdoing, or a basis for automatic public accusation."
    },
    {
      "namespace": "tool_candidate",
      "canonical_id": "G08",
      "display_id": "G08",
      "role": "candidate_local_test_matrix_tooling_reference",
      "title": "Promptfoo",
      "url": "https://github.com/promptfoo/promptfoo",
      "status": "Candidate",
      "claim_ceiling": "Tooling reference for test matrices, assertions, red-team checks, and CI concepts; generated scores require audited fixtures, assertions, judges, thresholds, and denominators."
    },
    {
      "namespace": "standards_candidate",
      "canonical_id": "S01",
      "display_id": "S01",
      "role": "candidate_voluntary_ai_risk_framework",
      "title": "NIST AI Risk Management Framework 1.0",
      "url": "https://www.nist.gov/itl/ai-risk-management-framework",
      "date": "2023-01-26; revision in progress in 2026",
      "status": "Candidate",
      "claim_ceiling": "Voluntary risk-management framework; not law, certification, safe harbor, GEO-specific authorization, or proof of implementation."
    },
    {
      "namespace": "standards_candidate",
      "canonical_id": "S02",
      "display_id": "S02",
      "role": "candidate_voluntary_generative_ai_guidance",
      "title": "NIST AI 600-1: Generative AI Profile",
      "url": "https://doi.org/10.6028/NIST.AI.600-1",
      "date": "2024-07-26; page updated 2026-04-08",
      "status": "Candidate",
      "claim_ceiling": "Voluntary cross-sector guidance requiring contextual tailoring; not law, certification, conformity assessment, safe harbor, or proof that a product implements suggested actions."
    }
  ],
  "visual_policy": {
    "external_figure_reuse": false,
    "external_screenshot_reuse": false,
    "tex_figure_reuse": false,
    "paper_or_tex_prose_copying": false,
    "visuals": "original_course_owned_synthetic_or_separately_licensed_only",
    "operational_attack_visuals": false,
    "color_only_encoding": false,
    "required_accessible_equivalents": [
      "alt_text",
      "long_description_for_complex_visuals",
      "table_alternative_for_data_bearing_visuals"
    ]
  },
  "safety_boundary": {
    "scope": "offline_course_owned_synthetic_scenario_classes_only",
    "allowed": [
      "read frozen local files",
      "run the local deterministic L07 review script",
      "inspect defensive control evidence",
      "write abstract threat models, triage records, and incident plans"
    ],
    "prohibited": [
      "live poisoning",
      "evasion operations",
      "credential use",
      "unauthorized load",
      "harmful payloads",
      "cloaking",
      "deceptive attribution",
      "third-party testing",
      "personal-data use",
      "external persistence"
    ],
    "operational_attack_details_in_package": false,
    "live_target": false,
    "network_required": false
  },
  "authorization_and_proportionality": {
    "authorization": "Course-owned synthetic files; no external system or user traffic",
    "owner": "course_fixture_owner",
    "authorized_actors": ["ACT-01", "ACT-02"],
    "allowed_capabilities": [
      "ACT-01 may execute and inspect the local deterministic fixture",
      "ACT-02 may review the frozen evidence and course release decision"
    ],
    "excluded_capabilities": [
      "network access",
      "credential access",
      "live writes",
      "payload execution",
      "third-party targeting"
    ],
    "proportionality_decision": "Static records and deterministic local execution answer the defensive question with lower risk than any live route.",
    "stop_conditions": [
      "authorization ambiguity",
      "external target or connectivity",
      "personal data",
      "real credentials",
      "operational harmful detail",
      "unknown persistence",
      "inaccessible core evidence",
      "failed evidence preservation",
      "failed rollback"
    ]
  },
  "threat_model_contract": {
    "system_id": "SYS-RISK-DEMO-001",
    "components": ["ingest", "normalize", "retrieve", "annotate", "release"],
    "entry_points": ["ingest", "normalize", "retrieve", "annotate", "release"],
    "assets": [
      {"asset_id": "ASSET-01", "name": "source and citation integrity", "affected_parties": ["reader", "source creator"]},
      {"asset_id": "ASSET-02", "name": "claim-evidence lineage", "affected_parties": ["researcher", "reviewer"]},
      {"asset_id": "ASSET-03", "name": "privacy and authorization", "affected_parties": ["data subject", "operator"]},
      {"asset_id": "ASSET-04", "name": "accessible evidence presentation", "affected_parties": ["assistive-technology user", "reader"]},
      {"asset_id": "ASSET-05", "name": "governance status accuracy", "affected_parties": ["decision maker", "operator"]}
    ],
    "actors": [
      {"actor_id": "ACT-01", "role": "authorized learner", "capability_ceiling": "local fixture execution and inspection only"},
      {"actor_id": "ACT-02", "role": "independent reviewer", "capability_ceiling": "review and course decision only"},
      {"actor_id": "ACT-03", "role": "untrusted corpus contributor", "capability_ceiling": "abstract origin of inert record only"}
    ],
    "trust_boundaries": [
      {"boundary_id": "TB-01", "from": "untrusted corpus", "to": "ingest"},
      {"boundary_id": "TB-02", "from": "analysis outputs", "to": "release"}
    ],
    "harms": [
      "unresolved attribution",
      "synthetic consensus",
      "content-control confusion",
      "privacy exposure",
      "accessible claim-source loss",
      "governance-force collapse"
    ]
  },
  "detector_reporting_contract": {
    "required_fields": [
      "threat_family",
      "domain",
      "language",
      "modality",
      "observation_point",
      "data_version",
      "positive_denominator",
      "negative_denominator",
      "ground_truth_process",
      "threshold_selection",
      "held_out_design",
      "repetitions",
      "uncertainty",
      "recall",
      "false_positive_rate",
      "worst_family_result",
      "review_path",
      "abstention_rule"
    ],
    "forbidden_inferences": [
      "universal coverage from average score",
      "malicious intent from style detection",
      "falsehood from detector score",
      "automatic public accusation",
      "irreversible punishment without independent review"
    ]
  },
  "triage_contract": {
    "allowed_dispositions": ["allow", "sandbox", "mitigate", "stop", "disclose"],
    "definitions": {
      "allow": "A versioned authorized activity may continue with accepted residual risk, monitoring, owner, and revocation conditions; not zero risk.",
      "sandbox": "A defensive question may be tested only in the frozen isolated synthetic environment with no external effect.",
      "mitigate": "A control or evidence gap must be repaired and retested before reassessment.",
      "stop": "The named test, transition, claim, or release halts until explicit recovery criteria are met.",
      "disclose": "A scoped notification or disclosure assessment begins under policy and qualified review; not automatic public accusation."
    },
    "case_decisions": [
      {"case_id": "AB-01", "fixture_outcome": "blocked", "triage": ["sandbox", "mitigate"], "owner": "data_steward"},
      {"case_id": "AB-02", "fixture_outcome": "detected", "triage": ["sandbox", "mitigate"], "owner": "retrieval_lead"},
      {"case_id": "AB-03", "fixture_outcome": "blocked", "triage": ["sandbox", "stop_if_propagation"], "owner": "safety_owner"},
      {"case_id": "AB-04", "fixture_outcome": "blocked", "triage": ["sandbox", "stop_if_real_data", "disclose_to_privacy_owner_if_triggered"], "owner": "privacy_owner"},
      {"case_id": "AB-05", "fixture_outcome": "escaped", "triage": ["stop", "mitigate", "disclose_to_accessibility_and_release_owners"], "owner": "accessibility_owner"},
      {"case_id": "AB-06", "fixture_outcome": "detected", "triage": ["mitigate", "stop_governance_claim_until_verified"], "owner": "governance_owner"}
    ],
    "package_release_disposition": "stop_external_release",
    "allow_external_release": false
  },
  "incident_lifecycle": {
    "ordered_states": ["detect", "preserve", "triage", "contain", "correct", "notify", "recover", "learn"],
    "preservation_fields": [
      "artifact identity and hash",
      "time and observation context",
      "source model and parser versions when exposed",
      "control output",
      "reviewer observation",
      "known gaps and chain-of-custody limits"
    ],
    "recovery_fields": [
      "rollback trigger",
      "authorized owner",
      "exact restoration target",
      "pre-state identity",
      "success criteria",
      "protected-asset verification",
      "dependent-artifact correction",
      "notification completion",
      "residual risk"
    ]
  },
  "l07_contract": {
    "lab_id": "L07",
    "offline": true,
    "deterministic": true,
    "case_count": 6,
    "expected_stdout": "L07 PASS: 6 cases, 1 escape(s), release BLOCKED",
    "expected_decision": {
      "audit_status": "PASS",
      "release_decision": "BLOCKED",
      "blocking_case_ids": ["AB-05"],
      "outcome_counts": {"blocked": 3, "detected": 2, "escaped": 1},
      "human_approval_required": true
    },
    "input_hashes": {
      "course-labs/L07_drift_adversarial_governance/data/system_model.json": "8758f155939beb631f67c1a5eab7b4b8919e559e9bc0f8d46814b72521972c3d",
      "course-labs/L07_drift_adversarial_governance/data/abuse_cases.csv": "837ab50d832fa0ca552a64a3bcca3c4cfcac77c2fb4e4816cd0169389b80cdaa",
      "course-labs/L07_drift_adversarial_governance/data/controls.csv": "cc6937a6db609a4dc776e23d6ff100ca54c15937b3c7aff267ec10b053f3e75f",
      "course-labs/L07_drift_adversarial_governance/data/test_results.csv": "20b00f60a04f074f9c79deb1b4aaa1361c87f9825da65a2ac4435c26619211af",
      "course-labs/L07_drift_adversarial_governance/data/governance_crosswalk.csv": "2979542df5f63ca50196b9117806f49aa268c1c71b71e049680ccac9f722d80e",
      "course-labs/shared/fixtures/governance_risk_vocabulary.json": "f67d8a58ad0cbdedefb3ba4495a729ce50af4457f752dfdcb6b241338e4f2aed"
    },
    "output_hashes": {
      "abuse_case_results.csv": "636a386138abb9a5a0c4779de88f81a0e0011ff8336d900985314da12aa92538",
      "control_coverage.csv": "2a794778549b928b0835cc93625d5f7bbb29f565400f521e38a1b07f2a345d01",
      "governance_memo.md": "906440e9d493369967e25210a0639bc93ed5c0ba36ef53e8182a1f2ec602e187",
      "governance_status_audit.csv": "7a9191799781705b39ce52ddbe0d2ca35845c5ad1171f38fd6365ae27310466a",
      "incident_rollback_playbook.md": "962fbc1227a0c1e5b1447aa1dd19acf16eb140a24b37b0885adacf0b43ac69f4",
      "release_decision.json": "8af1245e765b7f5149baa0b13f4af6fbdd16b9a050842eea358195f5ac5f900b",
      "run_manifest.json": "9162bc87621143a0720af93b929f55ac61657fbbe129a7224322e602953e9ddd",
      "threat_model.json": "63ed46140577f65b7982fa98aa8fa2050617074ed71ae4bae71046262134e094"
    },
    "claim_ceiling": "Synthetic control tests and governance-status vocabulary audit only; no safety guarantee, certification, compliance, legal advice, or live-system conclusion."
  },
  "package_hashes": {
    "README.md": "602c71328594b4c58b9f1b01f29534b2f940f38b487139d67583db7cc857e221",
    "LECTURE_NOTES.md": "d49ce34c629b1a34fe00dcd7ab13dbf4709b1015cd3674e913ee441369275161",
    "SLIDE_SCRIPT.md": "1fbc9c4360bfa5bf3db77c71ba4af845cb0a814cb036f8c749385038db5c0902",
    "WORKED_CASE.md": "3efd0250cceb9105bf0c9bb3c8a56fd14bfdae4c67f0d1fefb0e71341f12b69c",
    "TRANSCRIPT.md": "7780268fe67540a271862888f50beb7b8ae5f9e59f537c5997146b4bb5aaf12d"
  },
  "quality_status": {
    "structural_validator": "passed_2026-08-24",
    "deterministic_fixture_reproduction": "reproduced_2026-08-24",
    "scientific_human_review": "pending",
    "accessibility_human_review": "pending",
    "security_review": "pending",
    "qualified_governance_and_legal_applicability_review": "pending",
    "timed_rehearsal": "pending",
    "classroom_pilot": "pending",
    "rubric_calibration": "pending",
    "external_peer_review": "pending"
  }
}