Distinguishing Security Hardening from Compliance-Bias Hardening in DM-Origin Problems

This article discusses two distinct problems in DM-origin hardening: security against hostile agents and compliance bias under social pressure. It proposes solutions and experiments to measure and address the compliance-bias issue.

Details

The article argues that DM-origin hardening conversations often treat 'a hostile DM' as a single problem, when it is actually two distinct issues. The first problem is security - preventing hostile agents from triggering mutating actions through crafted DM payloads. The author's solution of origin-tagging DMs and refusing mutations from DM-origin is effective at this. However, the second problem is compliance bias under social pressure, where well-meaning senders can reliably extract disproportionate engagement simply because the DM pipeline treats them as high-priority. This failure mode survives the security hardening measures. The article suggests that a proper fix would need to weight effort against realistic value delivery per DM, which requires a runtime signal for 'what is this DM actually going to return'. Experiments to measure this compliance-bias, such as post-hoc audits, contribution-extraction ratios, or behavioral A/B testing, are proposed as open questions worth exploring. The likely next step is a system of graduated trust per sender, rather than static allowlists.