Etymological fallacy

one_liner: Treat a word's historical origin as binding on its present meaning, mistaking a fact about language history for a fact about how today's speakers actually use the word.

origin_subdomain: argumentation

core_idea:
The etymological fallacy is the argumentative error of treating a word's historical origin or earlier sense as binding on its present meaning — inferring what a word currently refers to, or what current speakers who use it are committed to, from what the word meant in an earlier period or language.

The error rests on a false premise about how linguistic meaning works. Meaning is not an intrinsic property of a word that travels with it unchanged from coinage; it is determined by the conventions of current speakers in a given community. Words undergo semantic shift — broadening, narrowing, amelioration, pejoration, and metaphorical extension — continuously over time, and at any moment the live meaning is the current convention, not the etymological origin. "Decimate" originates in the Roman practice of executing one soldier in ten, but current English convention uses it to mean severe widespread destruction; "silly" formerly meant blessed; "nice" formerly meant foolish or precise. To argue that someone is using "decimate" incorrectly because the root sense specifies one-in-ten is to substitute a historical fact about word origins for an empirical question about present usage — a confusion of language history with language description.

The fallacy is distinct from legitimate etymology. Appealing to word origins to understand how a term entered the language, or to trace semantic drift, is valid historical linguistics. The fallacy arises specifically when the historical sense is imported as a normative constraint on current usage or as a premise about what current speakers' words commit them to — when "this word originally meant X, therefore it must still mean X (or should still mean X)" is treated as an argument rather than a hypothesis about current convention requiring independent evidential support.

scope_of_application:
The etymological fallacy lives within a single discipline — the philology-and-argumentation study of word meaning — across the sub-uses that rest on the fact that meaning is current convention, not inherited form; its reach is bounded there. The look-alike cross-domain cousins (originalist constitutional argument, scriptural root-language insistence, brand-history appeals) are instances of the broader *genetic fallacy*, not of this named error, and stay out of the map.

- **Lexicography and usage commentary** — the diagnostic governs the standing dispute between descriptive and prescriptive treatment of "incorrect" usage (decimate, literally, disinterested): an origin-fact cannot settle a convention-question.
- **Historical and semantic-change linguistics** — the fallacy marks the boundary between legitimate tracing of semantic drift (broadening, narrowing, amelioration, pejoration) and the illegitimate import of an older sense as a normative constraint.
- **Rhetoric and informal-logic instruction** — catalogued as a named argumentative error, taught so that "the word originally meant X, therefore it must still mean X" is recognized as a hypothesis needing current-usage evidence, not a proof.
- **Translation and exegesis (linguistic core)** — flags the "root fallacy" of forcing a term's etymological sense over its attested contemporary usage in the source community, a recurrent hazard in close textual work.

structural_signature:
**Sig role-phrases:**

- **the term in current use** — a word whose present meaning is in dispute
- **the documented earlier sense** — a historically prior or root-language meaning, available in dictionaries or etymology
- **the divergent current convention** — the live meaning fixed by how today's speakers actually use the word, which has drifted from the earlier sense
- **the false premise** — the unstated assumption that meaning is intrinsic and travels unchanged from coinage, rather than being set by current convention
- **the binding move** — the inferential step that treats the earlier sense as *authoritative* over present reference: "originally meant Y, therefore still means (or ought to mean) Y"
- **the modal-force line** — the boundary the charge turns on: a descriptive claim ("once meant Y") is legitimate etymology; only the normative/referential leap ("therefore must mean Y") is the fallacy
- **the current-usage corrective** — demoting the etymology from premise to mere hypothesis about present meaning and demanding usage evidence, not more philology, to settle the dispute

what_it_is_not:
- **Not an attack on etymology as such.** Tracing how a term entered the language or charting its broadening, narrowing, amelioration, or pejoration is valid historical linguistics. The charge applies only to the inferential step that treats the earlier sense as *binding* on present reference — the leap from "originally meant Y" to "therefore still means (or ought to mean) Y." Descriptive claims about a word's past are inside the legitimate zone; only the normative/referential leap crosses the line.
- **Not a claim that the cited etymology is false.** The historical sense invoked can be perfectly accurate and the move still fallacious — because the defect is the *inference*, not the history. That is why piling on philological detail cannot rescue the objection: the origin-fact has been demoted from a premise that settles current meaning to at most a hypothesis still needing usage evidence.
- **Not equivocation.** Equivocation *shifts* a word's meaning across the steps of an inference; the etymological fallacy does the opposite — it *pins* meaning to a single historical sense and refuses the shift current convention has already made. One exploits ambiguity within an argument; the other denies legitimate semantic drift.
- **Not the general genetic fallacy or originalism.** "Treating an origin as authoritative over an evolved present" is the broader genetic-fallacy parent, of which this is the *linguistic* specialization. An originalist binding a constitutional term to its drafting-era sense, or a brand-history appeal, instantiates that parent (or `path_dependence`), not the etymological charge — which is reserved for when the evolved state is *word meaning* and the misclaimed authority is etymological.

clarity:
Naming the fallacy makes a confusion in disputes about word usage diagnosable on sight: it separates *what a word meant* — a question of language history, settled by philological evidence — from *what a word means* — a question of present convention, settled by how current speakers use it. Without the label, an objection like "you can't say a hurricane decimated the coast, because 'decimate' means one-in-ten" passes as a point about correct usage; with it, the move is exposed as importing a historical fact where only a descriptive fact about current convention is relevant. The sharper question a practitioner can now pose is not "where did this word come from?" but "is the disputant making a claim about the word's past, or about what today's speakers are committed to?" — and only the latter is answerable by appeal to current usage.

The label also draws the line that keeps the diagnosis honest: it is *not* an attack on etymology as such. Tracing a term's entry into the language, charting its broadening or pejoration, is legitimate historical linguistics. The fallacy is specifically the inferential step that treats the earlier sense as *binding* on the present — converting "originally meant X" into "therefore still means (or ought to mean) X." Holding that boundary lets an analyst credit genuine etymological insight while refusing the normative leap, and reframes the original sense as at most a *hypothesis* about current meaning that still requires independent evidence from usage, never a premise that settles the matter by itself.

manages_complexity:
Usage disputes are individually messy: each one drags in the particular word, its documented history across periods and donor languages, the philological record of its broadening or pejoration, and the rhetorical context in which someone is now objecting to how it is used. Argued case by case, "is this word being used wrongly because of where it came from?" looks like an open question demanding fresh excavation of every term's biography. The etymological fallacy compresses that sprawl to a single decidable check. It says the historical sense and the present meaning are governed by *different* questions — language history versus current convention — and that origin is never, by itself, binding on present reference. So an analyst confronting any such dispute does not re-litigate the word's history at all; the work reduces to classifying the disputant's move along one binary: is the claim about the word's *past* (a philological matter, settled by historical evidence) or about what *today's speakers are committed to* (a descriptive matter, settled by current usage)? The validity of the objection reads off that single distinction, the same way regardless of which word — decimate, silly, nice, liberal — is in play.

That collapse fixes where evidence is even relevant and renders a whole class of objections inert on sight. Once the move is recognized as importing an "originally meant X, therefore still means X" step, no amount of etymological detail can rescue it, because the step itself is the defect — the historical sense has been demoted from a premise that settles the matter to at most a hypothesis about current meaning still needing usage evidence. The parameters the analyst must track shrink to two: which sense is being asserted as authoritative (historical or current), and whether the asserted authority is the right kind for the claim being made. The branch is clean — history-claim about the word: legitimate etymology, credit it; normative-claim about present usage resting on origin: the fallacy, reject the inference and redirect to current convention — so the qualitative verdict follows from the classification without re-deriving the linguistics of each term from scratch.

abstract_reasoning:
Because the fallacy is fixed by a single false premise — that origin binds present reference — the inferences it licenses are inferences *about an argument*, run on the disputant's move rather than on the word's biography.

*Diagnostic — recover the hidden premise from the shape of the objection.* Confronted with an objection of the form "you can't use W to mean X, because W originally meant Y," the analyst infers, without consulting the philological record, that the speaker has imported an "originally meant Y, therefore still means (or ought to mean) Y" step. The surface tell is an appeal to a documented earlier sense (a dictionary etymology, a root language) offered as *decisive* about current use; recognizing that tell, one reasons to the suppressed premise — meaning travels unchanged from coinage — and identifies it as false. The diagnosis does not require knowing whether Y is in fact the etymon; it requires only spotting that an origin-fact is being asked to settle a convention-question. So the fallacy is detectable from the *structure* of the claim alone, which is why "decimate," "silly," "nice," and "liberal" all trip the same diagnostic regardless of their unrelated histories.

*Interventionist — neutralize the objection by re-sorting the claim, not by out-researching the history.* The corrective move is to ask the disputant which question they are answering: a claim about the word's *past* (legitimate historical linguistics, to be credited) or a claim about what *today's speakers are committed to* (a descriptive matter, settled only by current usage). Forcing that sort is predicted to dissolve the objection's force, because the fallacy lives entirely in the conflation — separate the two questions and the normative leap has nothing to stand on. A second, sharper intervention follows from the same premise: demote the etymology from premise to hypothesis. "Originally meant Y" is at most a *conjecture* that current meaning might still be Y, and the analyst demands the independent evidence such a conjecture requires — actual usage. Supplying or withholding that usage evidence, not adducing more etymology, is what moves the dispute; piling on philological detail is predicted to be inert, since the defective step is upstream of any amount of historical accuracy.

*Boundary-drawing — when the charge applies, and when invoking it would itself be an error.* The fallacy is charged only against the inferential step that treats an earlier sense as *binding* on present reference; it is emphatically *not* a charge against etymology as such. Tracing how a term entered the language, charting its broadening, narrowing, amelioration, or pejoration, is valid work that the boundary protects — so the analyst who cried "fallacy" at genuine historical-linguistic description would themselves be misclassifying. The line is drawn at the modal force claimed for the origin: descriptive ("the word once meant Y") is inside the legitimate zone; normative or referential ("therefore it must / still does mean Y") crosses into the fallacy. The same boundary marks where the concept stops: it governs disputes about *linguistic meaning fixed by current convention*, and the structurally similar moves outside philology — that a constitutional term must carry its drafting-era sense, that an institution's name binds its present function — are cousins answered by the broader genetic-fallacy or path-dependence accounts, not by the etymological charge proper.

*Predictive.* The premise that meaning is current convention, not inherited form, yields a standing prediction about where these objections will keep arising: precisely for words that have undergone visible semantic shift, where a documented older sense sits available to be weaponized against an established newer one. The greater the drift between etymon and current use — "decimate" (one-in-ten → widespread destruction), "nice" (foolish → pleasant) — the more tempting and the more confidently the fallacy will be committed, because the gap that makes the objection *feel* substantive is exactly the gap that makes it wrong. So the analyst predicts the error clusters on high-drift, etymologically transparent terms, and that the objection's rhetorical appeal rises with the very semantic distance that guarantees its invalidity.

knowledge_transfer:
Within philology and argumentation the etymological fallacy transfers *as mechanism*, because the diagnostic is fixed by a single false premise — that a word's origin binds its present reference — and so applies identically to *any* term, regardless of that term's particular history. "Decimate," "silly," "nice," and "liberal" have unrelated biographies, yet each trips the same check: classify the disputant's move as a claim about the word's *past* (legitimate historical linguistics, to be credited) or about what *today's speakers are committed to* (a descriptive matter, settled only by current usage), and reject the inference exactly when an origin-fact is asked to settle a convention-question. The vocabulary and the corrective travel intact across the linguistic subfields that use it — lexicography, semantic-change studies, usage criticism, rhetoric — because all of them rest on the same fact that meaning is current convention, not inherited form. The within-domain transfer is the inferential diagnostic itself, run on the structure of the objection rather than on the philological record, with the standing prediction that the error clusters on high-drift, etymologically transparent terms where a documented older sense sits available to be weaponized against an established newer one.

Beyond linguistic meaning the picture is the third category, and the seam is the one the seed marks. There genuinely is a more general move that recurs across domains as co-instances — *treating an origin or earlier state as authoritative over a later, evolved state* — and that more-general pattern is the *genetic fallacy* (in epistemology, judging a claim by its source rather than its current merit), of which the etymological fallacy is precisely the linguistic specialization. The cross-domain cousins are real instances of *that parent*, not of the etymological version: an originalist insisting a constitutional term must carry its drafting-era sense, a biological-essentialism argument that a trait must serve its ancestral function, a brand-history appeal that an older mark fixes a present meaning, a scriptural-exegesis demand for root-language sense over living interpretation. Each shares the genetic-fallacy skeleton — origin asserted as binding on an evolved present — while its *own* subject-matter machinery stays home. What does not travel out of philology is the etymological fallacy's specific cargo: that meaning is fixed by the conventions of current speakers, that semantic shift (broadening, narrowing, amelioration, pejoration, metaphorical extension) is the relevant kind of evolution, and that the corrective is to demand current-usage evidence rather than more etymology. Calling an originalist argument "the etymological fallacy" would import the language-description apparatus that has no referent in constitutional interpretation — it is the *genetic fallacy* (or, where lock-in is doing the work, `path_dependence`) that the cross-domain lesson should carry, not the etymological label. So the honest move is layered: within language the origin-binds-reference diagnostic and its current-convention corrective travel across every usage dispute; the cross-domain cousins instantiate the broader *genetic fallacy* (and path-dependence) parent, with their own domain-bound subject matter; and "etymological fallacy," as named, is reserved for the philological case where the evolved state in question is word meaning and the authority being misclaimed is etymological (see *Structural Core vs. Domain Accent*).


Evacuation

slug: evacuation

one_liner: The coordinated removal of people or high-value assets from a zone an incoming hazard will sweep, staged under time pressure over a finite egress network — the structural dual of containment (leave the hazard, move the protected).

status: draft

core_idea: Evacuation is the coordinated maneuver of removing people, animals, or high-value assets from a zone that an incoming threat will sweep, to a destination outside its expected impact envelope, executed under time pressure and with degraded normal transport capacity. Its defining commitments are three: a *protected population or asset set* whose preservation is the goal; a *path of harm* — the spatial and temporal envelope the hazard will reach; and a *displacement maneuver* — the organised movement that places the protected outside that envelope before impact. The structural dual is containment: where containment holds the hazard in place so the surroundings remain safe, evacuation leaves the hazard and moves the protected — and doctrine chooses between them based on which is feasible given lead time, egress capacity, and the destructibility of the protected. The binding operational variables are four: *lead time* (interval between trigger and impact), *egress capacity* (throughput of available routes from origin to reception destination), *departure compliance and timing* (the distribution of when protected individuals actually initiate movement), and *reception capacity* (whether the destination can absorb the arriving population). The characteristic failure mode is egress-network saturation — observed in the Houston contraflow failure before Hurricane Rita in 2005 and in multiple California wildfire evacuations — where demand for the road network exceeds its throughput capacity and the evacuation itself becomes the source of casualties, a predictable consequence of single-route subdivisions and household trip-chaining delays that the road geometry and prior compliance patterns make legible before any given event. The evacuation trigger is itself a policy with thresholds and costs in both directions: premature trigger produces false-alarm fatigue that degrades future compliance; late trigger produces entrapment. The domain disciplines the concept covers — hurricane and wildfire emergency management, building fire egress, military non-combatant evacuation operations (NEO), hospital transfer under impending facility failure, civil-defense planning around radiological or chemical releases — all share the physical-spatial substrate of moveable assets, a sweepable hazard envelope, and a finite egress network under time pressure.

scope_of_application:
Evacuation lives across the emergency-response disciplines that share its physical-spatial substrate — moveable assets, a sweepable hazard envelope, and a finite egress network under time pressure; its reach is bounded to that family, and the non-spatial "displacement of valuables" readings (data migration, capital flight, brain drain) are metaphor carried by `containment` and its duals, not habitats.

- **Hurricane, wildfire, and tsunami response** — compulsory or advisory clearance staged by zone, with contraflow, reception centres, and registration; the home turf and the source of the egress-saturation failure mode (Houston pre-Rita, California wildfire corridors).
- **Building safety and fire egress** — muster points, egress widths, and stair pressurisation codified in life-safety codes (NFPA 101, Building Regulations Part B); the identical pattern at a stairwell's spatial scale.
- **Military operations** — tactical withdrawal, non-combatant evacuation operations (NEO), and casualty medevac from a contested zone, with enemy action as the hazard and personnel, civilians, and high-value equipment as the protected.
- **Hospital and care-home transfer** — facility evacuation under utility loss, flood, or fire (NYU Langone during Sandy) and patient-transfer chains under degraded acute care, where destructibility of the protected sharpens the evacuate-versus-shelter choice.
- **Radiological and chemical clearance** — planned-zone evacuation around an exclusion radius (Chernobyl, Fukushima), with shelter-in-place as the explicit containment dual.

structural_signature:
**Sig role-phrases:**

- **the protected set** — the people, animals, or high-value assets whose preservation is the goal, prioritised
- **the path of harm** — the spatial-and-temporal envelope the incoming hazard will sweep
- **the lead time** — the interval between trigger and impact within which the maneuver must complete
- **the egress network** — the finite throughput capacity of available routes from origin to reception, with its choke points
- **the reception destination** — the location outside the harm envelope, capable of absorbing the arriving population
- **the trigger policy** — the threshold and staging that initiate movement, a policy not an act, balancing premature-trigger false-alarm fatigue against late-trigger entrapment
- **the displacement maneuver** — the organised movement that places the protected clear before impact, the structural dual of containment (leave the hazard, move the protected)
- **the egress-saturation failure** — demand exceeding network throughput within the lead time, turning the evacuation itself into the casualty source, predictable from road geometry and prior compliance before the event
- **the cross-event compliance feedback** — a premature trigger now degrades the population's responsiveness to the next event, coupling this evacuation to the following one

what_it_is_not:
- **Not a single action.** "Evacuate" is not the verb "get everyone out" but a *policy* — a structure of thresholds and staged departures with costs on both sides. Triggering too early spends false-alarm fatigue that erodes the next event's compliance; triggering too late produces entrapment. The real question is never "should we go?" but "at what threshold, in what sequence, to where?"
- **Not "earlier and more warning is always better."** The trigger is a two-sided cost: a premature order degrades compliance the next time the population is asked to move, and a single premature evacuation can put more people on saturated roads than the avoided harm warranted. Lead time is a variable to optimize against egress throughput, not a quantity to maximize.
- **Not a maneuver whose casualties all come from the hazard.** The signature failure is egress-network saturation, where demand exceeds road throughput within the lead time and *the evacuation itself becomes the source of casualties* — a road network turned slower than walking. The danger is not only the storm or fire; it is the displacement maneuver colliding with finite capacity.
- **Not automatically preferable to sheltering.** Evacuation is the structural *dual* of containment — leave the hazard, move the protected — and doctrine chooses between them on feasibility (lead time, egress throughput, destructibility of the protected). Where no feasible routing clears the population in time, shelter-in-place is the correct move, not a failure of nerve.
- **Not bad luck on the day.** The egress-saturation failure is predictable *before* any given event from road geometry, single-route subdivisions, choke points, and prior compliance distributions. Its quality is set upstream — in zoning, routing, reception planning, and rehearsal — not in the heroics of the maneuver, so a saturated network is a designed-in mismatch, not misfortune.
- **Not any "displacement of valuables from a worsening zone."** Calling data migration, capital flight, or brain drain an "evacuation" borrows the surface shape while dropping the load-bearing structure: a real spatial path, a moveable physical asset, and an incoming hazard envelope with an external arrival time. Capital flight and brain drain are decentralised emergent flows on incentive gradients, not coordinated maneuvers under doctrine; data "evacuation" inverts the hazard's direction (a deadline the owner constructs) and is normally planned and continuous. Off the physical-spatial substrate the term is analogy.

clarity:
Framing a response as an evacuation forces a planner to name slots that an undifferentiated "get everyone out" leaves implicit: what counts as protected and at what priority, the boundary and lead time of the harm envelope, the egress capacity and its choke points, the reception destination, and the trigger condition that starts movement. The sharpest thing the concept makes legible is that *evacuate is a policy, not an action* — a structure of thresholds and stages with costs in both directions. Triggering too early spends false-alarm fatigue that erodes compliance next time; triggering too late produces entrapment. Holding those two costs in view at once is exactly what the bare verb "evacuate" hides, and it is what lets a practitioner ask not "should we go?" but "at what threshold, in what sequence, to where?"

The concept's other clarifying move is to fix evacuation as the structural *dual* of containment — leave the hazard, move the protected — so the prior question "hold the hazard in place, or move the valuable out of its path?" becomes explicit and decidable on feasibility grounds (lead time, egress throughput, the destructibility of the protected) rather than settled by default. And it relocates where an evacuation's quality is determined: not in the heroics of the maneuver itself but upstream, in zoning, routing, reception planning, and rehearsal. That reframing makes the signature failure — egress-network saturation, where the evacuation becomes its own source of casualties — legible as a capacity-versus-demand mismatch readable from road geometry and prior compliance patterns *before* any given event, rather than as bad luck on the day.

manages_complexity: Each threatened community is, on its surface, a distinct emergency with its own meteorology, geography, demographics, and politics, and "get everyone out" invites the planner to reason afresh about all of it. Evacuation compresses that case-by-case sprawl to four binding variables that, together, govern whether the maneuver succeeds: *lead time* (the interval between trigger and impact), *egress capacity* (the throughput of available routes from origin to reception), *departure compliance and timing* (when protected individuals actually start moving), and *reception capacity* (whether the destination can absorb the arrivals). Whatever the particular hazard, the planner tracks these four and reads the outcome off their relationship rather than re-deriving the response from the weather: when demand on the egress network exceeds its throughput within the lead time, the signature failure — egress saturation, the evacuation becoming its own source of casualties — is predicted, and predicted *before the event* from road geometry and prior compliance distributions, not discovered on the day. Two further compressions ride on top. First, evacuation is fixed as the structural dual of containment, so the upstream question collapses to a single binary — hold the hazard, or move the protected — decided on the same feasibility variables (lead time, egress throughput, destructibility of the protected) rather than left to default. Second, the trigger is recognized as a policy with a threshold, not an act, which collapses the decision to one tracked tension with a cost on each side: trigger early and spend false-alarm fatigue that erodes the next event's compliance, trigger late and produce entrapment. So the whole high-dimensional "respond to this threat" problem reduces to a small parameter set with a fixed branch structure and a fixed family of levers — zoning, staging, contraflow, reception pre-positioning, shelter-in-place as fallback — each hung off the variable it moves, and the quality of an evacuation reads as set upstream in routing and rehearsal rather than in the heroics of the day.

abstract_reasoning:
Evacuation licenses a family of reasoning moves that all run through its four binding variables and its containment-dual structure — letting the planner reason from road geometry and compliance history to a predicted outcome *before* the event, choose between protection strategies on feasibility grounds, and locate a failure upstream in planning rather than in the maneuver.

*Diagnostic — read the binding constraint, not the meteorology.* The signature inference attributes an evacuation's success or failure to the relationship among lead time, egress capacity, departure timing, and reception capacity, not to the hazard's particulars. Facing a saturated road network that turned slower-than-walking, the planner infers a *capacity-versus-demand mismatch* readable from the network itself — single-route subdivisions, choke points, household trip-chaining delays — rather than bad luck on the day; the Houston-pre-Rita and California-wildfire saturations are diagnosed as predictable consequences of road geometry and prior compliance distributions. A second diagnostic separates the *signature failure from its causes*: when the evacuation becomes its own source of casualties, the cause is read as egress demand exceeding throughput within the lead time, which points the inquiry at routing and trigger timing, not at the warning message alone. A third diagnostic reads departure behaviour: low or late compliance is inferred from prior false-alarm history (fatigue eroding the next response) and from the household-level trigger thresholds that make people wait for visible flames or smoke rather than the official order — so a compliance gap is attributed to the trigger policy and its credibility, not to individual recalcitrance.

*Interventionist — key each lever to the variable it moves, and predict the effect on the capacity-versus-demand race.* The moves form a fixed family, each hung off one binding variable. Contraflow and secondary egress routes raise *egress capacity*, predicting the demand-throughput race is won within the lead time. Phased/zoned staging reshapes the *departure-timing distribution*, predicting that flattening the peak keeps demand under throughput even when total population is unchanged — the same road network succeeds at a metered rate that it fails at a simultaneous one. Reception pre-positioning raises *reception capacity*, predicting the destination absorbs arrivals rather than back-pressuring the routes. Earlier or geographically-targeted alerts (Wireless Emergency Alert targeting) buy *lead time* and lift compliance, predicting more of the population clears before impact. And shelter-in-place is the fallback lever for when *no* feasible combination clears the population in time — chosen precisely when the egress race cannot be won. The interventionist invariant: the quality of an evacuation is set *upstream* in zoning, routing, reception planning, and rehearsal, so the load-bearing moves are made before the event, not in the heroics of the day.

*Boundary-drawing — evacuate or contain, and where the pattern holds.* The first and sharpest boundary is the containment dual: the prior question is *hold the hazard in place, or move the protected out of its path?* — decided on feasibility (lead time, egress throughput, destructibility of the protected), not by default. Containment is licensed when the hazard can be held and the surroundings kept safe; evacuation when the protected can be moved clear in time; and the choice is explicit and decidable rather than reflexive. A second boundary fixes the trigger as a *policy with a threshold, not an act*, so the decision is never simply "go" but "at what threshold, in what sequence, to where," with a cost on each side — premature trigger spends false-alarm fatigue, late trigger produces entrapment. A third boundary marks where the concept's reasoning holds: it requires a *physical-spatial substrate* with moveable assets, a sweepable hazard envelope, and a finite egress network under time pressure (hurricane and wildfire response, building fire egress, military non-combatant evacuation, hospital transfer, radiological/chemical clearance) — and the related return-phase question (controlled reentry) and the uncontrolled-exit counterpart (leakage through a boundary) are distinct objects, not part of the evacuation maneuver itself.

*Predictive / order-of-events.* The concept commits the planner to forecasts made *before any given event* from standing structure. From road geometry and prior compliance distributions it predicts whether the egress network will saturate, and where — so the choke point is anticipable from network analysis, not discovered when traffic stops. It predicts the order of the failure: an evacuation triggered too late, or routed through a single egress, produces congestion collapse *after* movement begins, converting the maneuver itself into the casualty source. And it predicts a *feedback across events*: a premature trigger this time degrades compliance next time, so the trigger-threshold choice is forecast to shape not only the current evacuation but the population's responsiveness to the following one — a coupling the planner must price into where the threshold is set.

knowledge_transfer:
Within the physical-emergency family the concept transfers *as mechanism*, and tightly. Hurricane and wildfire response, high-rise and building fire egress, military non-combatant evacuation and combat withdrawal, hospital and care-home transfer under impending facility failure, and civil-defense clearance around radiological or chemical release all share the one substrate the pattern requires: moveable assets, a sweepable hazard envelope, and a finite egress network under time pressure. Across them the four binding variables (lead time, egress capacity, departure timing, reception capacity), the containment dual, the trigger-as-policy framing, and the lever family (zoning, staging, contraflow, reception pre-positioning, shelter-in-place fallback) carry intact and are *literally reused*: phased high-rise evacuation borrowed its staging logic from hurricane zoning; civilian air-ambulance networks were templated on forward-military medevac chain design; hospital evacuation playbooks now fold in combat-zone NEO checklists. Note that two of the concept's apparent "extensions" — military withdrawal and hospital transport — are not extensions at all but *core cases* inside this family, sharing the substrate fully; what changes between members is only the hazard (storm, fire, enemy action, utility loss, radiation) and the spatial scale (a stairwell versus a coastline), while the egress-saturation failure mode and its before-the-event predictability from network geometry persist throughout.

Beyond that family the transfer is **analogy**, and the boundary is unusually crisp because it is the substrate boundary itself: strip away the spatial path, the moveable physical asset, and the incoming-hazard envelope and the concept has nothing left to grip. The reasoning is governed by a real road network's throughput and a real hazard's arrival time, so where those are absent the named concept stops being mechanism and becomes a borrowed shape. The familiar cross-domain invocations each leak in a diagnosable way. "Evacuating" data from a failing storage substrate inverts the hazard's direction — the deadline is *constructed by the system owner* (deprecation, capacity saturation) rather than incoming from outside, and the migration is normally planned and continuous rather than a time-pressured maneuver — so the path-and-envelope structure does not hold. *Capital flight* and *brain drain* share only the surface "valuables leave a worsening zone," but their dynamics are decentralised emergent flows responding to incentive gradients, not a coordinated maneuver under doctrine with a trigger, a staging discipline, and a reception plan — they are closer to gradient-driven diffusion than to evacuation. And the *generalised gloss* — "orderly relocation," "protect the valuable from an incoming threat by displacement" — is either too thin to be a structural pattern at all (it collapses to "move things") or, where it does carry real structure, is already covered by the primes evacuation instantiates: `containment` carries the protect-the-valuable-versus-hold-the-hazard dual that is the genuine portable core, with `triage` (when egress capacity binds), `controlled_reentry` (the return phase), and `escape_and_leakage` (the uncontrolled-exit counterpart) covering the neighbours. So the honest cross-domain move is not to call a non-spatial displacement "evacuation" but to reach for `containment` and its duals, marking any "evacuation" usage outside the physical-emergency substrate as metaphor (see *Structural Core vs. Domain Accent*).


Evacuation Shadow

one_liner: The phenomenon in which people outside the official evacuation zone choose to evacuate anyway, overloading routes and shelters planned only for the targeted population — because a permeable signal reaches beyond the boundary and each household acts on its own risk calculus.

core_idea: Evacuation shadow is the emergency-management phenomenon in which people outside the official evacuation zone — sometimes well outside, sometimes hundreds of miles inland — choose to evacuate, overloading routes, shelters, fuel supplies, and lodging that were planned only for the targeted-zone population. The structural signature has three components: a *target boundary* drawn by planners around the hazard-model zone; a *signal carrier* — official advisories, weather forecasts, neighbor communication, social media, news coverage — that reaches well beyond that boundary and cannot be contained within it; and a *receiver-side decision rule* by which each household independently computes its own risk-and-prudence calculus including factors the hazard model did not encode (family vulnerability, traffic-fear of late departure, neighbor-departure network effects, uncertainty about forecast track). The shadow population is the set of receivers outside the target boundary who act as though they are inside. Shadow evacuation rates of 20–60% of the broader surrounding population have been documented in major hurricane events, including Hurricane Floyd (1999) and Hurricane Rita (2005), where in-traffic deaths among shadow evacuees exceeded direct storm fatalities. The intervention family follows from the diagnosis: plan route capacity and shelter for *behavioural-zone* demand rather than *hazard-zone* demand, design communication explicitly to clarify the boundary and support in-place decisions for shadow-zone populations, and implement staged-evacuation timing and contraflow to manage the load the signal will inevitably produce beyond its intended audience.

scope_of_application:
Evacuation shadow lives across the hazard types of emergency management and civil protection — wherever a planner draws a target boundary, a permeable carrier broadcasts past it, and receivers outside the boundary act on their own risk calculus — recurring with the same behavioural-zone denominator swap; its reach stays within the civil-protection substrate (the broader boundary-signal-spillover pattern, under the receiver-defines-the-audience principle, carries the cross-domain lesson to bank runs, recalls, and the like, while the hazard-zone/route/shelter machinery stays home).

- **Hurricane evacuation** — the canonical cases (Floyd 1999, Rita 2005), where shadow evacuees gridlocked interstates hundreds of miles inland and in-traffic deaths exceeded direct storm fatalities.
- **Wildfire evacuation** — rural and rural-fringe households outside declared zones leave on a smell of smoke or perceived proximity, clogging limited egress roads.
- **Nuclear and industrial-accident contingencies** — planning models show large shadow zones, with populations evacuating well beyond the technical-risk perimeter on even minor incident signals.
- **Regional public-health advisories** — targeted advisories drive behaviour beyond the target region: cross-district school closures, travel cancellations, and panic buying in adjacent regions.
- **Mass-shelter and resource planning** — shelter, fuel, and lodging plans calibrated to the zone population are overrun because the event is governed by the behavioural-zone denominator, not the hazard-zone one.

structural_signature:
**Sig role-phrases:**

- **the target boundary** — the official evacuation zone drawn by planners around the hazard-model perimeter
- **the permeable signal carrier** — advisories, forecasts, news, neighbor and social-media communication that reaches well beyond the boundary and cannot be confined to it
- **the receiver-side decision rule** — each household independently computes its own risk-and-prudence calculus, including factors the hazard model never encoded (family vulnerability, fear of late departure, neighbor-departure network effects, track uncertainty)
- **the shadow population** — receivers outside the target boundary who act as though they are inside (documented at 20–60% of the surrounding population)
- **the hazard-zone vs. behavioural-zone split** — what the model says is at risk versus what the population actually does on receipt; fusing them is the structural error
- **the denominator overrun** — routes, shelters, fuel, and lodging sized to the hazard-zone denominator are overwhelmed by behavioural-zone demand, by a predictable multiple
- **the receiver-defines-audience principle** — the controlling question is "who will receive and act on this?" not "who was it aimed at?"
- **the carrier-and-load intervention** — because the leak cannot be sealed, levers act on boundary communication (support in-place decisions) plus staged-evacuation timing and contraflow; "tell people to stay calm" is foreclosed

what_it_is_not:
- **Not public panic or irrationality.** Shadow evacuation is a *rational* receiver-side response to a signal that could never be contained at the zone boundary: each household computes its own risk-and-prudence calculus from factors the hazard model never encoded. Reading inland gridlock as a failure of public composure mistakes predictable, plannable spillover for irrational over-reaction.
- **Not the bystander effect.** The bystander failure is *reduced* action by an audience that should respond. Evacuation shadow is *increased* action by an audience that was not targeted. The two run in opposite directions, and treating shadow evacuation as under-response gets the problem backwards.
- **Not an allocation or equity question.** Whether the right places got help is a separate lens. Evacuation shadow concerns who *receives and acts on* a permeable signal regardless of where it was aimed — the audience boundary, not the fairness of distribution.
- **Not a physical leakage or externality.** What crosses the perimeter is *information and behavioural response*, not a constrained physical quantity escaping (`escape_and_leakage`), and the side-effect is the audience's *own action* in response to a signal, not an unpriced physical side-effect falling on others (`externality`). The perimeter being breached is a communication boundary, not a containment one.
- **Not an information cascade.** A cascade is imitative copying-via-visibility producing convergence. Evacuation shadow is about the *audience boundary* of a single broadcast — who receives a permeable signal aimed elsewhere — not about agents copying each other into agreement.
- **Not curable by telling people to stay calm.** That lever treats the shadow population as the problem and predictably fails, because the spillover is the expected behaviour of a permeable advisory. The effective levers act on the *carrier and the load*: boundary communication that supports in-place decisions, plus staged-evacuation timing and contraflow.
- **Not a free-standing pattern that travels beyond civil protection.** Stripped of the emergency-management idiom, the structure is the general boundary-signal-spillover pattern — a permeable carrier whose adjacent audience acts on its own calculus — under the principle that the *receiver*, not the sender, defines the audience. The hazard-zone, route, and shelter machinery is the civil-protection accent; invoking "evacuation shadow" for a bank run or a product recall is that general pattern wearing a borrowed name.

clarity:
Naming the evacuation shadow reframes what planners are tempted to read as public *panic* or *irrational over-reaction* into a rational receiver-side response to a signal that could never be contained at the zone boundary. Once the phenomenon is recognized as a leaked signal acted on by independent household calculus — not a failure of public composure — the intervention space changes shape entirely: the lever is no longer "tell people to stay calm," which treats the shadow population as the problem, but the design of the signal carrier and the boundary communication, which treats the spillover as predictable and plannable. That dissolves a confusion that otherwise blames the public for behaving exactly as a permeable advisory should be expected to make them behave.

The distinction the concept sharpens, and the one most load-bearing for planning, is *hazard zone* versus *behavioural zone* — what the hazard model says is at risk, and what the population actually does on receipt of the signal. Folding these together is the structural error that produces overrun shelters, gridlock hundreds of miles inland, and fuel exhausted far from the storm: capacity was sized to the hazard-zone denominator, but the event is governed by the behavioural-zone denominator. Holding them apart lets the planner treat shadow population as a *modelled quantity* in route-capacity and shelter math rather than as a surprise, and shifts the unit of analysis from the audience-as-targeted to the signal-and-its-spillover — making the sharp question "who will *receive* and act on this, not just who was it *aimed* at?" It also separates the failure from neighbors that look adjacent: this is increased action by an unintended audience (not the reduced help of a bystander effect), and a permeable *communication* perimeter (not a physical containment perimeter), where the receiver, not the sender, defines who the audience turns out to be.

manages_complexity: An emergency manager otherwise faces a heterogeneous catalogue of surprises that look like separate logistical disasters: interstates gridlocked two hundred miles from a storm, shelters overrun far inland, fuel exhausted in counties the hazard never reached, hotels saturated in adjacent states, rural egress roads clogged on a smell of smoke, school districts closing across boundary lines, panic buying in regions outside any advisory. Each invites its own ad hoc fix and its own moralizing about public panic. Evacuation shadow collapses the whole set to one structural object with three tracked components — a planner-drawn *target boundary* around the hazard-model zone, a permeable *signal carrier* (advisories, forecasts, news, neighbor and social-media communication) that cannot be confined to that boundary, and an independent *receiver-side decision rule* by which each household computes a risk-and-prudence calculus including factors the hazard model never encoded. Once a manager holds that object, the sprawl of surprises reduces to reading off a single quantity: the *shadow population* — receivers outside the target boundary who act as though they are inside, documented at 20–60% of the surrounding population in major hurricane events. The compression is concentrated in one parameter swap that reorganizes every downstream estimate: stop sizing capacity to the *hazard-zone* denominator and size it to the *behavioural-zone* denominator. That swap makes the qualitative outcome legible in advance — routes, shelters, fuel, and lodging will be overrun by a predictable multiple, not surprised by it — so the shadow becomes a modelled quantity in route-capacity and shelter math rather than a recurring shock. The branch structure follows from where the boundaries sit relative to each other and from the receiver rule. Because the audience is defined by the *receiver*, not the sender, the controlling question shifts from "who was this aimed at?" to "who will receive and act on it?", and the intervention family is fixed by that reframing: design the signal carrier and boundary communication to support in-place decisions for the shadow zone, and apply staged-evacuation timing and contraflow to manage the load the signal will inevitably produce beyond its intended audience. The reframing also closes off the dead-end lever — "tell people to stay calm," which treats the shadow population as the problem rather than as the expected behaviour of a permeable advisory. So instead of cataloguing each inland gridlock and shelter overflow as its own emergency, the planner tracks a target boundary, a permeable carrier, and a receiver rule, reads off a behavioural-zone denominator, and derives capacity needs and the communication-and-tempo levers from it — the move from a high-dimensional pile of evacuation surprises to a three-component signal-spillover model governed by a single denominator swap and a receiver-defined-audience branch.

abstract_reasoning: Evacuation shadow licenses inferences that all turn on treating the audience as *receiver-defined* and the signal carrier as permeable. *Diagnostic*: confronted with interstates gridlocked two hundred miles from a storm, shelters overrun far inland, or panic buying outside any advisory, the analyst infers not public panic or irrationality but a leaked signal acted on by independent household calculus — each shadow household having computed a risk-and-prudence assessment from factors the hazard model never encoded (family vulnerability, fear of a late departure, the network effect of watching neighbors leave). Reading the surprise this way says "the advisory's carrier reached beyond its boundary and the receivers acted rationally," which redirects attention from the public's composure to the design of the signal and the boundary. The diagnostic also supplies a *quantity*: the shadow population, the receivers outside the target boundary who behave as though inside, estimable at a documented 20–60% of the surrounding population — so the analyst reasons from the hazard-zone target to a far larger behavioural-zone demand rather than being surprised by it. *Interventionist*: the controlling move is a denominator swap — size route capacity, shelter, fuel, and lodging to the *behavioural-zone* denominator, not the *hazard-zone* one — carrying the prediction that capacity sized to the targeted population will be overrun by a predictable multiple while capacity sized to the behavioural zone will hold. Because the leak cannot be sealed, the levers act on the carrier and the load it produces: design boundary communication to clarify who is and is not at risk and to support in-place decisions for the shadow zone, and apply staged-evacuation timing and contraflow to manage the inevitable spillover. The concept explicitly *forecloses* the intuitive lever — "tell people to stay calm" — predicting it to fail because it treats the shadow population as the problem rather than as the expected behaviour of a permeable advisory. *Boundary-drawing*: the load-bearing distinction is hazard zone versus behavioural zone — what the model says is at risk versus what the population does on receipt — and fusing them is the structural error that produces inland gridlock; holding them apart converts shadow population from a surprise into a modelled quantity. The concept also bounds itself against neighbors: this is *increased action by an unintended audience* (not the reduced help of a bystander effect), a permeable *communication* perimeter (not a physical containment perimeter), and the side-effect is the audience's *own action* in response to a signal (not an unpriced physical externality). *Order-of-events / predictive* reasoning fixes the sequence — a boundary is drawn, a carrier broadcasts past it, receivers outside the boundary act — so the controlling question shifts from "who was this aimed at?" to "who will receive and act on it?", and the planner predicts the spillover from the carrier's reach and the receiver rule *before* the event, sizing the response to who will respond rather than to who was targeted.

knowledge_transfer:
Within emergency management and civil protection evacuation shadow transfers as mechanism, because each hazard type presents the same three-component structure — a planner-drawn target boundary, a permeable signal carrier, and an independent receiver-side decision rule — and the same denominator swap fixes the response. It carries across hurricane evacuation (the canonical Floyd and Rita cases, where shadow-traffic deaths exceeded direct storm fatalities), wildfire evacuation (rural-fringe households leaving on smoke smell, clogging limited egress), nuclear and industrial-accident contingencies (large modelled shadow zones beyond the technical-risk perimeter), and regional public-health advisories (cross-district school closures, panic buying in adjacent regions). Across all of them the same handles apply: read the surprise as a leaked signal acted on by rational household calculus rather than as public panic; estimate the shadow population (documented at 20–60% of the surrounding population); size routes, shelter, fuel, and lodging to the *behavioural-zone* denominator rather than the *hazard-zone* one; shift the controlling question from "who was this aimed at?" to "who will receive and act on it?"; and apply the carrier-and-load levers — boundary communication that supports in-place decisions for the shadow zone, plus staged-evacuation timing and contraflow — while foreclosing the dead-end "tell people to stay calm." The vocabulary travels because the civil-protection substrate is constant beneath the changing hazard.

Beyond emergency management this entry is a clean instance of a *general mechanism that genuinely recurs across domains while the named evacuation machinery stays home*. Strip the emergency-management idiom and the residue is substrate-independent: a signal is targeted at audience A; the carrier is permeable; an adjacent audience B receives it and acts on its own receiver-side calculus; the resulting demand overflows the planner's target-scaled apparatus. That broader pattern — best labelled boundary-signal-spillover and flagged in the seed as an *emergent candidate* rather than an already-confirmed catalog prime — really does recur as co-instances far outside evacuation: bank-run contagion to adjacent banks after a targeted bailout signal, product-recall demand shifting to substitute brands, public-health advisories changing behaviour in non-targeted populations, marketing campaigns drawing unintended audiences, regulatory announcements triggering anticipatory behaviour in non-target sectors, warning-shot diplomacy received by third parties as an escalation signal, and exemplary punishment producing chilling effects beyond the intended deterrence target. In each, the same structurally interesting sub-property holds: *the receiver, not the sender, defines the audience* of a permeable carrier. So the honest report is that the cross-domain lesson — design for who will receive and act, not for who was targeted; size the apparatus to the behavioural denominator — should be carried by that more-general spillover pattern, not by "evacuation shadow," whose three named components (hazard zone, evacuation routes, shelter capacity) are the civil-protection accent on it. Invoking "evacuation shadow" for a bank run or a recall borrows the framing while the evacuation-specific machinery has nothing to attach to, and is best read as the general spillover pattern wearing a borrowed name.

The boundary against neighbors keeps the cut precise: this is *increased action by an unintended audience* (not the reduced help of a bystander effect), an *information/behavioural* perimeter being crossed (not the physical `escape_and_leakage` of a constrained quantity, nor a `containment` perimeter around a hazard), and the side-effect is the audience's *own action* in response to a signal (not an unpriced physical `externality`); it is also distinct from an `information_cascade`, which is imitative copying-via-visibility producing convergence, whereas this is about the audience *boundary* of a single broadcast. The clean summary: within emergency management it transfers as mechanism and remedy across every hazard type; beyond it, the portable structure is the (emergent) boundary-signal-spillover pattern, which recurs widely as co-instances under the receiver-defines-the-audience principle, while the hazard-zone/route/shelter machinery that makes this *evacuation* shadow stays bound to civil protection. See *Structural Core vs. Domain Accent*.


Evasion Attack

one_liner: Craft inputs that fall on the benign side of a deployed classifier's learned decision boundary while preserving their malicious payload — exploiting the gap between the boundary and the true concept it was meant to represent, so near-perfect test accuracy coexists with near-zero robustness under attack.

core_idea:
An evasion attack is the adversarial-ML and cybersecurity pattern in which an adversary crafts inputs that fall on the non-detection side of a deployed classifier's decision boundary while preserving the malicious intent or payload those inputs would otherwise have delivered. The classifier is not malfunctioning and is not miscalibrated against its training distribution: the crafted input genuinely occupies the region the classifier learned to assign to "benign." The attack exploits the gap between the classifier's learned decision boundary and the true conceptual boundary the defender wanted that boundary to represent — a gap that exists in every finite-sample, feature-constrained trained model and that a sufficiently informed or persistent adversary can probe and exploit.

The structural prerequisites are three. First, a fixed decision rule embedded in a deployed classifier whose boundary in input space is discoverable — by direct gradient access, by querying the model, by surrogate-model transfer, or by trial-and-error against the deployed system. Second, an adaptive adversary with the ability to modify inputs along dimensions the classifier was not trained to attend to: perturbing pixels in ways imperceptible to humans but detectable to gradient descent, obfuscating malware bytecode while preserving runtime behavior, substituting homoglyphs or emoji to evade text classifiers, shaping transaction patterns to stay below detector thresholds. Third, the classifier-versus-concept gap itself: the boundary represents only the features and decision surface the training data and architecture supported, not the full extension of the defender's intent.

The result is that in-distribution accuracy on random samples, the standard classifier evaluation metric, is essentially orthogonal to robustness against an adaptive adversary: a classifier can achieve near-perfect accuracy on held-out test data and near-zero effective accuracy against a dedicated evasion effort. Szegedy et al. (2013) and Goodfellow et al. (2014) demonstrated this for image classifiers; the same dynamic — a fixed learned boundary exploited by an adaptive opponent — recurs in malware detection (polymorphic and metamorphic malware), spam filtering, content moderation, biometric authentication (presentation attacks), autonomous-vehicle perception (adversarial patches on road signs), and fraud detection (structuring).

scope_of_application:
The evasion attack lives across AI security and adversarial machine learning — every setting with a deployed classifier whose boundary an adaptive opponent can probe; its reach is within that domain. The cross-domain cousins (regulatory arbitrage, money-laundering structuring, predator camouflage) are co-instances of the parent `adversarial_boundary_navigation`, not literal evasion-attack habitats here, and the gradient-and-perturbation apparatus does not travel to them.

- **Image-classifier adversarial perturbations** — imperceptible pixel-level perturbations that flip a confident classification (the Szegedy/Goodfellow adversarial-examples line).
- **Malware classifier evasion** — polymorphic and metamorphic malware, code obfuscation, and packers that preserve runtime payload while slipping past static and dynamic detectors.
- **Spam-filter evasion** — word obfuscation, leetspeak, image-text, benign-content padding, and sender-reputation laundering.
- **Content-moderation evasion** — emoji substitutions, character homoglyphs, image overlays, and in-group dialects the classifier does not yet attend to.
- **Biometric presentation attacks** — printed photos, replay videos, masks, and voice synthesis crafted to clear liveness and identity classifiers.
- **Autonomous-perception input crafting** — adversarial-patch stickers on road signs and sensor spoofing that flip perception output.
- **Fraud-detection structuring** — transaction shaping below thresholds, device-fingerprint rotation, and behavior shaping to stay under detector triggers.

structural_signature:
**Sig role-phrases:**

- **the fixed decision rule** — a deployed classifier whose boundary in input space is discoverable (by gradient access, query, surrogate-model transfer, or trial-and-error)
- **the adaptive adversary** — an opponent able to modify inputs along dimensions the classifier weakly attends to, within a modification budget
- **the classifier-versus-concept gap** — the region where the learned, finite-sample boundary diverges from the full extension of the malicious-intent concept the defender meant it to represent
- **the boundary search** — the adversary probing for the cheapest configuration on the non-detection side of the boundary that still preserves the malicious payload
- **the intent-preserving crafted input** — an input that genuinely occupies the "benign" region (not a misclassification — the model behaves exactly as trained) while carrying the attack
- **the accuracy/robustness orthogonality** — the load-bearing collapse: in-distribution accuracy on random samples is nearly orthogonal to robustness under attack, so near-perfect test accuracy coexists with near-zero effective accuracy
- **the game-on-the-boundary** — the recast unit of analysis: defender draws a boundary, attacker hunts its divergence from the concept, defender redraws
- **the residual-gap limit** — because the gap exists in every finite-sample, feature-constrained model, a sufficiently motivated adversary defeats any single classifier; perfect robustness is unreachable
- **the defense family** — model the gap explicitly, harden along the plausible perturbation set, monitor for strategy drift, layer detection so no single boundary is load-bearing, and report robust accuracy under a specified attacker model

what_it_is_not:
- **Not a misclassification or model bug.** A crafted input that slips through is not the model erring; it is the model behaving exactly as trained, assigning a genuinely benign-looking region to "benign." The fault lies in the gap between the learned boundary and the concept the defender meant it to capture, not in the model's fit. Hunting for a defect in the classifier mislocates a problem that is structural, not a flaw to be debugged out.
- **Not measured by test accuracy.** In-distribution accuracy on random held-out samples is nearly *orthogonal* to robustness against an adaptive adversary. A detector can score near-perfect on its test set and near-zero against a dedicated evasion effort, because the two measure different things. Reporting test accuracy as evidence of security is a category error, not merely an optimistic number — robust accuracy under a specified attacker model is the metric that bears on the attack.
- **Not a poisoning attack.** Evasion takes the trained classifier as *fixed* and exploits its already-existing boundary; it never touches the training data. Poisoning, by contrast, corrupts the data to bend the boundary during training. The two attack different stages — deployment-time input crafting versus training-time data corruption — and demand different defenses.
- **Not passive out-of-distribution failure.** This is not a model stumbling on under-sampled inputs by chance. Evasion is *active* boundary search: an opponent deliberately probes for the cheapest configuration on the non-detection side that preserves the payload. Confusing it with ordinary distribution shift drops the adversary, who is the whole point — the inputs are engineered to exploit the boundary, not encountered at random.
- **Not solvable by a single robust classifier.** Because the classifier-versus-concept gap exists in every finite-sample, feature-constrained model, a sufficiently motivated adversary defeats any one detector. "Make the model perfectly robust" is unreachable; the realistic goal is raising the attacker's cost, layering detection so no single boundary is load-bearing, and accepting the game continues. Treating it as a fixable one-shot defect misreads a standing defender-attacker game.
- **Not an input that looks malicious.** The crafted input need not appear suspicious — it genuinely occupies the region the classifier learned to call benign, often via perturbations imperceptible to humans, while preserving the malicious payload. The attack's signature is precisely that it *does not* trip the detector; expecting evasive inputs to look like attacks misses how they preserve intent while reading as benign.

clarity:
Naming the evasion attack forces apart two evaluation registers that "is the classifier good?" silently merges: *correctness* against the training distribution and *robustness* against an adaptive adversary. The crafted input is not a misclassification in the ordinary sense — the model is behaving exactly as trained, assigning a genuinely benign-looking region to "benign" — so the bug is not in the model's fit but in the question being asked of it. Once the two registers are distinct, a practitioner sees why in-distribution accuracy on random held-out samples is nearly *orthogonal* to security: a detector can score near-perfect on its test set and near-zero against a dedicated evasion effort, which means the standard metric does not measure the thing under attack, and a separate metric — robust accuracy under a specified attacker model — is required. The concept tells a defender that reporting test accuracy against an adversary is a category error, not merely an optimistic number.

The concept's sharper work is to name the *classifier-versus-concept gap* as a first-class object: the deployed boundary represents only the features and decision surface that finite training data and a chosen architecture could support, not the full extension of the malicious-intent concept the defender actually cares about, and *that gap is precisely what the adversary searches*. Holding the learned boundary distinct from the intended concept reframes the whole problem from a static classification task into a defender-attacker game played on the boundary — defender draws a boundary, attacker hunts its discrepancies with the concept, defender redraws — so the unit of analysis becomes the joint game rather than the model in isolation, and the robustness-versus-utility frontier becomes something to reason about explicitly. The diagnostic question shifts from "does it classify correctly?" to "where does my learned boundary diverge from the concept it was meant to capture, how cheaply can an adversary reach that divergence within their modification budget, and what is my next move when they do?"

manages_complexity: A security team otherwise faces what looks like an open-ended menagerie of attack vectors, each native to its own subfield and each demanding its own countermeasure: imperceptible pixel perturbations against image classifiers, polymorphic obfuscation against malware detectors, leetspeak and benign-padding against spam filters, homoglyph and emoji substitution against content moderation, printed-photo and replay presentation attacks against biometrics, sticker patches against road-sign perception, transaction structuring below thresholds against fraud detection. Catalogued vector by vector, the list never closes and offers no purchase on a vector not yet seen. The evasion-attack concept compresses the entire menagerie onto three structural prerequisites — a fixed, boundary-discoverable decision rule; an adaptive adversary able to modify inputs along dimensions the classifier weakly attends to; and the classifier-versus-concept gap the adversary searches — so the analyst stops enumerating perturbation tricks and instead tracks whether those three conditions hold and how cheaply the third can be reached within the adversary's modification budget. Every named vector becomes the same gap being probed through a different modification channel, and the qualitative outcome (will a dedicated adversary defeat this detector?) reads off the structural setup rather than off the specific trick. The compression's load-bearing collapse is one scalar relationship: in-distribution accuracy on random samples is nearly *orthogonal* to robustness against an adaptive adversary, so a single split — correctness against the training distribution versus robustness under a specified attacker model — lets the defender read "near-perfect test accuracy, near-zero effective accuracy under attack" as the expected case rather than a paradox, and know that the standard metric simply does not measure the thing under attack. That, in turn, recasts a high-dimensional static classification problem as a low-dimensional defender-attacker game on the boundary — defender draws a boundary, attacker hunts its divergence from the concept, defender redraws — whose state the analyst tracks with a small parameter set (where the learned boundary diverges from the intended concept, the attacker's modification budget, the cost of reaching the divergence) and off which the whole robustness-versus-utility frontier becomes reasoned rather than rediscovered. The intervention family compresses to match: across all vectors the moves are the same shape — model the gap explicitly, harden along the adversary's plausible perturbation set, monitor for drift in adversary strategy, layer detection so no single boundary is load-bearing, and accept that a sufficiently motivated adversary defeats any one classifier — so the defender reasons about a single game with a handful of parameters instead of re-deriving a defense for every new evasion trick that appears.

abstract_reasoning:
The evasion-attack concept licenses reasoning moves that all proceed from one object: the *classifier-versus-concept gap*, the region where the deployed boundary — built from finite samples and a chosen architecture — diverges from the full extension of the malicious-intent concept the defender meant it to capture. The *diagnostic* move runs from a security symptom to the structural cause, and it is sharpened by an explicit inversion of the usual reading. A crafted input that slips through is *not* a misclassification: the model is behaving exactly as trained, assigning a genuinely benign-looking region to "benign," so the analyst reasons that the fault is not in the model's fit but in the gap between its boundary and the concept, and that the input occupies that gap rather than evidencing a bug. From the observation that a detector scores near-perfect on held-out data yet near-zero against a dedicated evasion effort, the analyst infers not a broken classifier but the expected consequence of the gap being searched — and predicts the co-occurring signature: that random-sample audits will continue to look healthy while the effective false-negative rate under attack is high, because the two measure different things.

The most distinctive move is a *boundary-drawing* one over evaluation registers themselves: the concept forces apart *correctness* against the training distribution and *robustness* against an adaptive adversary, and asserts they are nearly orthogonal. Reasoning from this, the analyst treats in-distribution accuracy on random samples as simply not measuring the thing under attack, concludes that a separate metric — robust accuracy under a specified attacker model — is required, and flags reporting test accuracy against an adversary as a category error rather than an optimistic number. This same move recasts the whole situation from a static classification task into a defender-attacker *game on the boundary*: defender draws a boundary, attacker hunts its divergence from the concept within a modification budget, defender redraws — so the unit of analysis becomes the joint game, not the model in isolation, and the analyst reasons about the next move in a sequence rather than the quality of a fixed artifact.

The *interventionist* move reasons forward from where the boundary diverges and how cheaply the adversary can reach that divergence to a uniform family of defenses, each with a predicted effect on the game. Model the gap explicitly so the divergence is known rather than discovered under attack; harden along the adversary's plausible perturbation set so the cheapest reachable divergence is pushed outside the modification budget; monitor for drift in adversary strategy so the defender's next redraw is triggered when the attacker's channel shifts; layer detection so no single boundary is load-bearing and defeating one does not defeat the system. Each move is read against the same parameters — the location of the divergence, the attacker's budget, the cost of reaching the divergence — and the move also fixes a hard limit: because the gap exists in every finite-sample, feature-constrained model, the analyst predicts that a sufficiently motivated adversary defeats any single classifier, so "make the one detector perfectly robust" is reasoned to be unreachable and effort is redirected toward raising the attacker's cost and layering. The recurring habit the concept installs is to ask, of any deployed detector, not "does it classify correctly?" but where its learned boundary diverges from the concept it was meant to represent, how cheaply an adversary can reach that divergence within their budget, and what the defender's next move is when they do.

knowledge_transfer:
Within AI security and adversarial machine learning the concept transfers *as mechanism*, because the three structural prerequisites — a fixed, boundary-discoverable decision rule; an adaptive adversary able to modify inputs along dimensions the classifier weakly attends to; and the classifier-versus-concept gap the adversary searches — hold identically across the field's vectors. The diagnostic move (a crafted input is not a misclassification but the gap being occupied), the boundary-drawing over evaluation registers (correctness against the training distribution versus robustness under a specified attacker model are nearly orthogonal; report robust accuracy, not test accuracy), the game-on-the-boundary reframing, and the uniform defense family (model the gap, harden along the plausible perturbation set, monitor for strategy drift, layer detection, accept that a motivated adversary defeats any single classifier) all carry intact across image-classifier perturbations, polymorphic/metamorphic malware evasion, spam-filter obfuscation, content-moderation homoglyph/emoji substitution, biometric presentation attacks, autonomous-perception adversarial patches, and fraud-detection structuring. The supporting formalism transfers with it: the adversarial-example apparatus and certified-robustness techniques from adversarial ML, the Swiss-cheese / defence-in-depth and assume-compromise mindset from security engineering, and the chosen-plaintext/adaptive attacker-model formalism from cryptography (reapplied to classifier query access). Within the domain this is mechanism transfer, not analogy.

Beyond AI security the honest report is **(B) shared abstract mechanism**, and this is one of the strongest such cases in the corpus: the pattern is *deeply* substrate-independent because *any* classifier-with-knowable-boundary facing *any* adaptive opponent produces the same dynamic. The parent is *adversarial boundary navigation* (filed as an emergent candidate): a principal deploys a decision rule with a discoverable boundary to discipline an adaptive opponent, and the opponent finds the cheapest configuration on the permitted side of the boundary that still preserves the illegitimate intent — exploiting the systematic difference between the *rule* and the *concept the rule was meant to represent*. That pattern recurs as genuine co-instances across utterly different substrates: regulatory arbitrage (corporate structuring to fall on the safe side of tax, securities, environmental, or labor rules), money-laundering structuring (transactions sized below reporting thresholds), drug-test masking and substitution, doping against athletic testing, sanctions evasion through intermediary entities, fishery and hunting-regulation evasion, deception against polygraph-style screening — and, strikingly, *biological* instances that are real shared mechanism rather than metaphor: predator camouflage that defeats prey sensory classifiers, and parasitic behavioural mimicry that clears a host's nest-mate recognition. The classifier-versus-concept gap is the foundational portable insight that travels with the parent. So when the lesson generalizes, carry `adversarial_boundary_navigation` (with `regulatory_arbitrage`, if present in the catalog, foregrounded as its legal-system instance), of which the evasion attack is the adversarial-ML instance.

What stays **home-bound** is the entry's AI-specific cargo: gradient access and surrogate-model transferability, the adversarial-example and imperceptible-perturbation formalism, the perturbation-budget-in-input-space construction, adversarial training and certified defenses, and the robust-accuracy-under-attacker-model metric. These presuppose a trained statistical classifier with a differentiable or queryable boundary, and they do not survive extraction to a tax code or a predator's coloration. So invoking "evasion attack" for regulatory arbitrage or camouflage is **(A) analogy** in naming — the adversarial-boundary-navigation mechanism really is shared (which is why these are co-instances, not mere resemblances), but the gradient-and-perturbation apparatus does not come along. Two boundaries keep this exact: evasion is *active* boundary search by an opponent, distinct from passive out-of-distribution failure due to under-sampling, and it takes the trained classifier as *fixed*, distinct from `poisoning` attacks that corrupt the training data and from broader `adversarial` framings that disrupt the classifier rather than stay on its safe side. When the lesson generalizes, carry `adversarial_boundary_navigation`; "evasion attack" is its adversarial-ML instance. See *Structural Core vs. Domain Accent* for why this profile places the entry as a domain-specific instance of that parent rather than a prime.


Exaggerated Expectation

one_liner: Lift the expectation-realization gap out as a third measurable quantity carrying a stable sign — so a forecaster's systematic, directional miss across a class of events is diagnosed as a defect in the forecasting machinery, not random noise.

core_idea: Exaggerated expectation is the recurring pattern in human prospective judgment whereby anticipated quantities — intensity of future feelings, duration of emotional states, magnitude of outcomes, likelihood of events — are systematically displaced from what actually obtains, with the displacement persisting as a stable signed offset across repeated instances and despite feedback. The defining characteristic is that the expectation-realization gap is not random noise but directional: the same individuals and populations, across the same classes of events, consistently over- or underestimate in the same direction. Canonical sub-cases include impact bias (Wilson and Gilbert's programme showing people overestimate both the intensity and duration of emotional reactions to future events), the planning fallacy (Kahneman and Tversky's finding that individuals and teams underestimate time and cost for their own projects even when they accurately estimate comparable projects carried out by others), and affective forecasting error more broadly. The mechanisms are substrate-specific features of human prospective cognition: focalism (attending narrowly to the event while ignoring the surrounding stream of life that will dilute its impact), hot-cold empathy gaps (forecasting from a current emotional state that differs from the future one), projection of current preferences onto a future self that will hold different preferences, and neglect of base-rate outcomes in favour of inside-view scenario construction. What makes the pattern a coherent category rather than an arbitrary collection is that the expectation-realization gap is measurable as a third quantity distinct from both the prediction and the outcome, is systematically signed rather than symmetric, and recurs across domains (money, health, social outcomes, task completion) within the human forecasting substrate.

scope_of_application:
Exaggerated expectation lives across the prospective-judgment subfields of the cognitive and behavioral sciences; its reach is *within* that domain, wherever a human forecaster predicts a future quantity and the prediction is later checked against the outcome. The bare signed gap can be measured for any estimator, but the named mechanisms (focalism, empathy gaps, projection onto a future self) are features of human anticipation — the lesson "forecasts run off in a fixed direction" belongs to the parent `bias`, not here.

- **Affective-forecasting research** — the home subfield (Wilson and Gilbert): people overestimate both the intensity and the duration of their future emotional reactions to events.
- **Planning-fallacy literature** — Kahneman and Tversky, Buehler and Griffin: individuals and teams under-predict the time, cost, and risk of *their own* projects even while estimating comparable projects by others accurately.
- **Behavioral economics** — present-biased preferences, projection bias, and the discomfort/anticipation literature all sit inside this signed-gap family.
- **Consumer research** — anticipated enjoyment of products and experiences consistently exceeds realized enjoyment ("anticipated utility" inflation).
- **Health-behavior research** — overestimated discomfort of cessation, exaggerated expected craving, and mis-predicted adaptation to chronic conditions.

structural_signature:
**Sig role-phrases:**

- **the prediction** — a forecaster's prospective estimate of a future quantity (intensity, duration, magnitude, likelihood)
- **the realized outcome** — the eventually observed value of that same quantity
- **the remembered prediction** — the forecaster's later recall of what they predicted, the third input the gap is assembled from
- **the expectation-realization gap** — the signed difference between prediction and outcome, lifted out as a measurable third quantity distinct from both
- **the stable sign** — the offset recurring in the same direction for the same person and class of events, surviving feedback; what marks it as systematic rather than washing-out noise
- **the upstream mechanism** — one of a small closed family (focalism, hot-cold empathy gap, projection onto a future self, inside-view neglect of base rates) that fixes both the direction of the offset and the lever that shrinks it
- **the substrate bound** — the named mechanisms are features of human prospective cognition, so the category (unlike the gap-as-statistic) does not ride into non-human forecasters

what_it_is_not:
- **Not random forecasting noise.** Noise is symmetric and washes out across instances; this gap recurs in the *same direction* for the same person and class of events and survives feedback. The signed, persistent offset — not the mere fact of a miss — is what makes it a category and points to a defect in the forecasting machinery rather than chance.
- **Not the verdict "the forecast was wrong."** The analytic object is not the prediction but the *expectation-realization gap*, a third measurable quantity sitting between prediction and outcome. Collapsing the two measurements into one verdict hides the gap's properties — most importantly its sign — and obscures whether the discrepancy lives in the prediction, the experience, or the remembered prediction.
- **Not always over-estimation, despite the name.** The category is signed displacement in *either* direction: impact bias over-predicts emotional intensity, but the planning fallacy *under*-predicts one's own project time and cost. What unifies them is a stable sign traceable to a mechanism, not the direction being uniformly "too high."
- **Not optimism bias.** Optimism bias is the specific positively-valenced case — expecting good outcomes more than warranted. Exaggerated expectation is the broader signed-gap pattern, which equally covers over-predicted dread, exaggerated craving, and under-predicted timelines; optimism bias is one direction it can take, not the whole.
- **Not estimator bias or miscalibration in a model.** A Kalman filter or regression can be scored for a signed prediction-outcome offset, but that offset comes from prior misspecification, not from focalism, hot-cold empathy gaps, or projection onto a future self. Measuring a signed gap is not importing this category: the human-anticipation mechanisms — and the interventions that fix them — do not ride along.

clarity:
The clarifying move is to make the *expectation-realization gap* an object of study in its own right, distinct from both the prediction and the outcome it sits between. Folk talk treats a forecast that missed simply as having been "wrong," collapsing two measurements into one verdict; naming the gap forces them apart, so that the displacement becomes a third measurable quantity with its own properties — most importantly a stable *sign*. That is what separates exaggerated expectation from ordinary forecasting noise: noise is symmetric and washes out across instances, whereas this gap recurs in the same direction for the same person and the same class of events, and survives feedback. Holding the gap distinct lets a researcher ask not merely "was the forecast off?" but "is it off in a systematic, signed way that points to a defect in the forecasting machinery rather than to chance?"

That separation also localizes where an observed "irrationality" actually lives, a question the undifferentiated notion of a bad prediction cannot even pose. Because the gap is built from a predicted value, a realized value, and a remembered prediction, the discrepancy could originate in the forecast itself (mis-prediction), in the experience (the outcome was misperceived or its memory distorted), or in the comparison (the person mis-recalls what they predicted). Treating the gap as the analytic target keeps these three candidates visible and decidable. And because the displacement is signed and class-specific, it invites the further question of *which* mechanism of prospective cognition — focalism, the hot-cold empathy gap, projection onto a future self, neglect of base rates in favor of inside-view construction — is producing the offset in a given domain, which is exactly the question that distinguishes a correctable forecasting error from an irreducible limit of anticipation.

manages_complexity: Prospective judgment generates a vast catalog of individual misses — overestimated grief, inflated anticipated enjoyment, underestimated project timelines, mis-predicted cravings, exaggerated dread of a diagnosis — and treated case by case each is its own story of a forecast gone wrong across its own domain of money, health, social life, or task. Exaggerated expectation compresses that catalog by recognizing that the analytic object is not any single prediction but the expectation-realization gap, and that this gap carries a stable *sign* for a given person and class of events. Once the displacement is a signed, measurable third quantity rather than a verdict of "wrong," the forecaster's behavior over a whole class is summarized by two numbers — the direction of the offset and its magnitude — instead of an unbounded list of particular errors. That lets a researcher predict the gap for a new event in the class from its sign rather than re-deriving each forecast, and route the explanation to one of a small, closed family of mechanisms — focalism, the hot-cold empathy gap, projection onto a future self, neglect of base rates in favor of inside-view construction — each of which fixes both the direction of the offset and the intervention that would shrink it. A high-dimensional sprawl of "people predict the future badly" collapses to a signed gap plus a short menu of mechanisms, from which the qualitative shape of the error in a given domain can be read off.

abstract_reasoning:
The category licenses inferences that run *through* the expectation-realization gap as a signed object, not through any single forecast. *Diagnostic*: observing that a forecaster missed, ask first whether the miss is symmetric noise or a stable signed offset — and if the same person and the same class of events show the displacement recurring in the same direction across instances and surviving feedback, infer a defect in the forecasting machinery rather than chance. The sign and class then route to a specific upstream mechanism: an over-prediction of emotional intensity and duration points to focalism (the event attended to in isolation from the diluting stream of life) or a hot-cold empathy gap (forecasting from a current state unlike the future one); an under-prediction of one's own project time and cost points to inside-view scenario construction crowding out base rates. Because the gap is assembled from a predicted value, a realized value, and a *remembered* prediction, the diagnostic also localizes *where* the discrepancy lives — mis-prediction (the forecast was off), mis-experience (the outcome was misperceived or its memory distorted), or mis-comparison (the person mis-recalls what they predicted) — three candidates the undifferentiated verdict "the forecast was wrong" cannot even separate.

*Interventionist*: each mechanism fixes both the direction of the offset and the lever that shrinks it, so naming the mechanism is already a prediction about what will work. Against the inside-view under-prediction of project timelines, reference-class forecasting (estimate from the distribution of comparable past projects rather than from the plan) predicts the estimate should move toward the realized rate — the planning-fallacy signature that the same person estimates *others'* comparable projects accurately is itself the lever, since it shows the base-rate information is available and merely unused on the self. Against focalism-driven over-prediction of emotional impact, forcing attention onto the surrounding life stream predicts a lower, more accurate intensity-and-duration forecast; against the hot-cold gap, forecasting from a matched future state (or delaying until the cold state passes) predicts the same. The interventions are thus class-specific and directional: a lever that targets the wrong mechanism for the observed sign predicts no movement, which is itself a test of whether the diagnosed mechanism is the right one.

*Boundary-drawing*: the pattern is a category only where the gap is (a) measurable as a third quantity distinct from prediction and outcome, (b) systematically *signed* rather than symmetric, and (c) recurrent across instances within human prospective cognition. A one-off miss, a symmetric error that washes out across instances, or a forecast whose displacement has no stable sign falls outside — it is noise, not exaggerated expectation, and the signed-mechanism reasoning does not apply. The boundary also separates a *correctable* forecasting error (a signed offset traceable to a named mechanism, which an intervention can move) from an *irreducible limit of anticipation* (a gap that survives every debiasing lever), a distinction the bare notion of a bad prediction cannot pose. *Predictive*: once the sign for a person and a class is established, the gap for a *new* event in that class is forecastable from the sign alone — over-prediction of grief, anticipated enjoyment, dread of a diagnosis; under-prediction of one's own task completion — without re-deriving each forecast, and the magnitude can be carried as a second number, so the whole class is summarized by direction plus magnitude rather than an open-ended list of particular misses.

knowledge_transfer:
Within cognitive and behavioral science the category transfers *as mechanism*, and it is precisely a category because the same machinery recurs across its subfields. Affective-forecasting research (over-prediction of emotional intensity and duration), the planning-fallacy literature (under-prediction of one's own project time and cost), consumer research (anticipated enjoyment exceeding realized), and health-behavior work (exaggerated expected craving or discomfort) are not four unrelated findings but instances of one structure — a signed expectation-realization gap traceable to a small closed family of upstream mechanisms (focalism, the hot-cold empathy gap, projection onto a future self, neglect of base rates in favor of inside-view construction). Because the gap is built the same way everywhere — a predicted value, a realized value, and a remembered prediction — the diagnostics (is the miss symmetric noise or a stable signed offset?), the localization (mis-prediction vs. mis-experience vs. mis-comparison), and the class-specific remedies (reference-class forecasting against the inside-view under-prediction; forcing attention onto the surrounding life stream against focalism; forecasting from a matched future state against the hot-cold gap) carry intact from money to health to social outcomes to task completion. Only the domain of the forecast changes; the signed gap, its routing to a named mechanism, and the lever that shrinks it do not.

Beyond human prospective cognition the transfer splits into two honest halves. The *analytic construct* — the expectation-realization gap, an outcome minus its forecast, scored for a stable sign — is in part an instrument, and it transfers literally to any system that emits forecasts and later observes outcomes: a Kalman filter, a regression model, or a prediction market can all be scored for a signed offset between prediction and realization. But there the construct is named differently (estimator bias, miscalibration, prior misspecification), and the boundary to mark is that measuring a signed gap is not the same as importing *this* category: the mechanisms that make exaggerated expectation a coherent psychological kind — focalism, empathy gaps, projection onto a future self, inside-view scenario construction — are features of human anticipation and do not ride along, so the interventions that fix those mechanisms have no purchase on an estimator whose offset comes from prior misspecification. The deeper *causal* content, meanwhile, is a compound of more general patterns that genuinely recur across substrates: a systematic, directional, non-random displacement is `bias` evaluated on prediction tasks; the positively-valenced version is `optimism_bias`; the case where the expectation itself shapes the outcome is `self_fulfilling_prophecy`. Each of those parent primes travels as mechanism; "exaggerated expectation," as named, is the regional label under which a slice of `bias` is studied in the prospective-judgment setting. So the honest move is: within human forecasting the named mechanisms and their remedies travel; the gap-as-statistic transfers wherever forecasts meet outcomes but should not be over-read as carrying the psychology with it; and when the cross-domain lesson is "forecasts can be systematically off in a fixed direction," that lesson belongs to the parent `bias` rather than to this domain-specific label (see *Structural Core vs. Domain Accent*).