Detection Trained on Yesterday: The Case for Anticipatory Intelligence

GP-2026-012   March 2026

https://doi.org/10.5281/zenodo.19007846

Author: Angel Analytical Team

Editor: Iliyan Kuzmanov

Abstract

Anticipatory intelligence names a structural gap that all historically calibrated detection systems share. Their accuracy within familiar distributions is genuine, institutionally earned, and operationally valuable — and it cannot extend to configurations that have not yet produced detectable surface signatures. That interval, between when threatening structural conditions take root and when they manifest in forms the recognition architecture was built to identify, is where the most consequential threats emerge. Value-at-Risk models in 2008 and intelligence frameworks confronting composite violent extremism demonstrate the same property: confident misrecognition at the limits of training distributions. Structural reasoning about cognitive-motivational configurations — drawing on significance quest theory, ontological security, and sacred values research — offers an analytical vocabulary operating beneath surface signatures. The case for anticipatory intelligence is not a case against detection but for a structurally different operation. Governance architecture adequate to its deployment remains unbuilt.

Index Keywords: anticipatory intelligence, confirmation bias, structural configuration, significance quest, ontological security, sacred values, detection systems, hybrid warfare

Article

Value-at-Risk models did not fail in 2008 because they were poorly designed. They failed because they were excellently designed — calibrated against three decades of post-war financial data, validated across market cycles, and trusted by risk officers precisely because their historical accuracy was genuine. JPMorgan's RiskMetrics framework, adopted as industry standard in the decade before the crisis, identified with statistical precision the probability of loss within the range of variation those three decades had produced. What it could not do was reason about conditions that had no precedent in the training distribution: the structured product market whose correlation assumptions had been built on systematically misaligned incentives at every level simultaneously, producing risk concentrations that historical data had never revealed and that the models therefore treated as impossible. When those foundational conditions unwound in 2007 and 2008, the apparatus across the financial sector reported green — not because it had malfunctioned but because the conditions generating catastrophic risk carried no signature within the categories those systems had been trained to recognise. The failure was not the absence of a warning signal. It was the confident presence of a false reassurance (Taleb, 2007). What the crisis exposed, in a domain where the costs of misrecognition are visible in quarterly balance sheets, is a constitutional property of all recognition instruments built on historical calibration: their accuracy is bounded by the distribution that produced them, and that boundary is invisible from inside the system. Anticipatory intelligence begins at that boundary — not as a superior detection apparatus, but as a structurally different analytical operation. That boundary is where the most consequential threats emerge, and the fact that it cannot be mapped from within is not a contingent failure of specific systems but a foundational feature of all historical calibration. The confidence that makes these systems institutionally trusted is the same confidence that makes their limits invisible to those operating inside them.

Recognition instruments — whether quantitative risk models, machine learning classifiers, or human expert judgment — share a common epistemological architecture. They are trained on historical instances of the phenomenon they are designed to identify. Their performance within that training distribution is real. The patterns they have learned are genuine patterns; their accuracy within familiar territory is earned, not illusory. The systemic problem emerges not when these tools encounter familiar inputs and fail, but when they encounter unfamiliar inputs and succeed — succeed, that is, in producing confident outputs that neither flag their own uncertainty nor signal that the input lies outside the competence boundary of the system. Deep learning architectures, which have achieved remarkable accuracy across computer vision, natural language processing, and anomaly detection, learn representations from training data that do not generalise to systematically different distributions (LeCun, Bengio and Hinton, 2015). This is not a failure of the architecture. It is the architecture operating as designed. The same principle applies to human expert judgment: research on calibrated prediction identifies expert performance as domain-specific, with accuracy degrading systematically outside familiar territory — not through random error, but through confident misclassification that the expert experiences as equally authoritative as their accurate judgments (Tetlock and Gardner, 2015). Machine learning systems carry the additional vulnerability that training data encodes the social, institutional, and adversarial conditions of the period that produced it; when those conditions shift, the system continues reporting authoritative outputs in the register of its original competence (Mehrabi et al., 2021). (The institutional corollary is worth stating plainly: the more confidently an organisation trusts its detection system's outputs, the more dangerous its failures on novel inputs become — not because the system has degraded, but because it is working exactly as designed.)

Adversarial actors — unlike financial market dynamics, which transform through architectural drift — actively read recognition systems and adjust their signatures accordingly. The operational logic of contemporary hybrid warfare rests on categorical camouflage: operations designed to proceed under cover of institutional language, democratic discourse, and civilisational values, rendering them invisible to assessment instruments calibrated for conventional threat signatures (Fridman, 2018). Paul and Matthews identify this as the central innovation of high-volume influence operations: the firehose model works not through superior persuasion but through occupying information categories that the analytical instrument treats as legitimate, saturating the evaluative capacity of instruments designed for lower-volume, higher-coherence threat environments (Paul and Matthews, 2016). The composite violent extremism documented by Gartenstein-Ross and colleagues presents the same systemic problem at the ideological level: actors merging elements from analytically incompatible ideological categories — far-right accelerationism alongside Islamist apocalypticism, anti-state primitivism alongside transnational network discipline — produce signatures that fall between the classification boundaries of systems trained on ideologically coherent formations (Gartenstein-Ross, Hodgson and Clarke, 2023). Every recognition system is, in the relevant sense, a theory about the past — one that becomes a predictive claim about the future only as long as the conditions producing the past continue to hold. When adversarial actors understand the theory, they can engineer its invalidation. The surface vocabulary rotates. The detection system, trained on vocabulary, continues scanning for the terms it knows. The structural operations proceed beneath it.

Confidence is the mechanism through which temporal displacement becomes institutionally dangerous. A system operating within its competence domain produces accurate, trusted outputs — and the institution builds processes, escalation thresholds, and resource allocation decisions around those outputs. When the threat environment shifts structurally, the system continues producing confident outputs: it does not flag that inputs are outside its competence boundary, does not indicate that its authority has become detached from its accuracy, classifies with the same institutional weight it would apply within the training distribution. Research on calibrated prediction identifies the cognitive profile that most resists this failure: forecasters who actively seek evidence of distribution shift, maintain calibrated uncertainty about their own competence boundaries, and treat confident outputs as hypotheses requiring external validation rather than conclusions requiring defence (Tetlock and Gardner, 2015; Kahneman, 2011). That profile is rare in institutional settings. The incentive structures typically reward the opposite. On the morning of January 28, 1986, the decision-making system governing Space Shuttle Challenger's launch was operating with complete confidence. Engineers at Morton Thiokol had data showing O-ring damage at low temperatures across previous launches. The statistical analysis submitted to NASA excluded tests where no damage had occurred — effectively training the monitoring system on the subset of data that made the known risk invisible. The apparatus was green. The foundational conditions it had been built to miss had been present all along. What was absent was not data. It was analytical architecture capable of reasoning about what the data implied at the boundary of the tested range. The same architecture problem manifests wherever the costs of misrecognition are measured in consequences rather than performance metrics.

Structural reasoning operates on configurations rather than signatures — and this distinction constitutes the analytical core of the anticipatory intelligence case. Pattern detection asks: does this input match a known category? Structural reasoning asks: do the conditions present here constitute a configuration that has historically preceded threat behaviour, regardless of whether that behaviour has yet manifested in detectable form? The difference is not one of computational power or data volume. It is a difference in what the system is reasoning about. Rapoport's wave theory of political violence provides the demonstration: across four analytically distinct formations — anarchist, anti-colonial, new left, religious — surface ideological content varies dramatically, but the configurations generating mobilisation, sustaining commitment, and producing violence exhibit systematic recurrence (Rapoport, 2004). A recognition system trained on the vocabulary of one wave cannot detect the emergence of the next, because the grammar generating both operates beneath the level of surface content the system was built to scan. Atran and Ginges identify a deeper layer still: when values are treated as sacred — non-negotiable, immune to material calculation, resistant to cost-benefit reasoning — they produce a behavioural and rhetorical signature detectable in the pre-operational phase, before any surface-level threat indicator has emerged (Atran and Ginges, 2012). Kruglanski and colleagues' significance quest framework identifies the motivational configuration that precedes radicalisation: significance loss through humiliation, grievance, or status degradation, combined with a narrative offering restoration through extreme action, constitutes a vulnerability profile detectable in foundational conditions well before surface output is produced (Kruglanski et al., 2014). Mitzen's account of ontological security explains why these configurations persist across surface ideological variation: actors routinise identity-stabilising patterns even when materially costly, because abandoning them produces not merely intellectual disagreement but ontological insecurity — a dissolution of the frameworks through which the world is made legible (Mitzen, 2006). Laclau's logic of antagonistic equivalence provides the deep mechanism: the persecutor slot remains fixed while the label rotates, because the slot performs a necessary function in the narrative architecture that the surface vocabulary merely inhabits (Laclau, 2005). What these converging frameworks describe is a level of analysis beneath surface signatures: the cognitive-motivational configurations generating threat behaviour regardless of the specific ideological vocabulary through which that behaviour is expressed in any given period. A recognition system trained on ideological vocabulary is systematically blind to this level. Trained to detect the signature of one wave, it cannot detect the emergence of the next.

Anticipatory intelligence is not prediction. This distinction matters more than it initially appears, because framing anticipatory capability as predictive has consistently produced the wrong institutional response: investment in more training data, larger models, faster processing of familiar categories — when the systemic requirement is different in kind, not merely in scale. Prediction extrapolates from known distributions: given the historical frequency of X, estimate the probability of X in the next period. Anticipatory intelligence reasons about foundational preconditions: given the configuration of conditions present here, does this environment carry the vulnerability profile that historically precedes threat behaviour of a specific class — regardless of whether prior instances of that behaviour have been observed in this specific context? The first operation is improved by more historical data. The second requires a different analytical vocabulary: one capable of encoding configurations rather than signatures, structural grammar rather than surface content. Sageman's analysis of jihadist network formation demonstrates the operational significance of this difference: the network architecture that preceded the September 2001 attacks was not detectable through signature matching against known categories, because the category itself — distributed, self-financing, ideologically coherent but organisationally fluid, capable of operating across jurisdictions without centralised command — had no clear precedent in the training data of Western intelligence systems (Sageman, 2004). The 9/11 Commission's identification of 'failure of imagination' is more precisely a failure of analytical architecture: not insufficient data, but insufficient conceptual framework for reasoning about configurations whose surface signatures had no prior instance in the recognition system's history (9/11 Commission, 2004). That architecture does not yet exist. Not in any detection system currently deployed at scale. Not in any AI framework built primarily on supervised learning against historical incident data. Anticipatory intelligence requires building it. The question is whether current development trajectories are moving in that direction — and the answer, given the dominance of supervised learning on labelled historical incidents, is not obviously encouraging.

Operational evidence for the value of existing recognition systems is substantial and should not be minimised in pursuit of the anticipatory argument. RAND's assessment of analytical futures finds that historically calibrated tools, properly resourced and integrated with human judgment, provide genuine security value in environments where threat actors have not yet fully adapted their signatures — which describes the majority of operational contexts at any given moment (RAND, 2018). Gill, Horgan and Deckert's systematic analysis of lone-actor terrorist attacks finds detectable pre-attack indicators — behavioural, communicative, social — in the substantial majority of cases examined, suggesting the detection problem within known threat categories is not intractable and that existing analytical frameworks retain significant operational utility (Gill, Horgan and Deckert, 2014). The competing interpretation deserves genuine engagement: structural reasoning about vulnerability profiles carries substantial risk of false positives with severe civil liberty implications. The history of predictive policing demonstrates how structural reasoning about vulnerability can be captured by existing institutional biases, concentrating suspicion on already-marginalised communities and producing discriminatory outcomes laundered through algorithmic authority (O'Neil, 2016; Buolamwini and Gebru, 2018). This is not a peripheral concern. It is evidence that anticipatory intelligence, deployed without adequate governance architecture, is capable of producing harms that compound rather than reduce the insecurities it was designed to address. The tension between anticipatory capability and civil liberty protection cannot be resolved through analytical innovation alone. Governance frameworks capable of constraining structural detection to contexts where threat threshold genuinely justifies intrusion have not been built to the standard the capability demands. That gap is a limitation of the anticipatory intelligence case that its proponents have not sufficiently engaged.

Between the lines and the arc, there is open space. Recognition systems occupy the lines — mapped territory, validated patterns, categories historical experience has confirmed with accuracy that is genuine and institutionally earned. Anticipatory intelligence reaches toward the arc: the foundational form not yet fully in the frame, not yet producing surface signatures, approaching from outside the distribution that existing systems were built to scan. The gap between them is not a failure of intelligence or a deficiency of data. It is the systemic product of how all recognition instruments are built: calibrated against the past to generate authority about the present. That authority is real within its domain. Its limits are architectural — and they are invisible from inside the system, which is precisely what makes them consequential. The question is not whether detection systems are adequate within their training distributions. They are, and that adequacy is genuinely valuable. The question is whether institutions depending on them have built analytical capacity to reason about what those distributions cannot contain. Value-at-Risk models in 2008 reported green until the foundational conditions they could not see had already unwound. The Morton Thiokol monitoring system on January 27, 1986, had no category for what the O-ring data implied at temperatures outside the tested range. For threats that matter most — those emerging at the structural margin of the known, moving deliberately beyond mapped territory — anticipatory capacity is not a supplement to detection. It is the only register in which prevention is possible.

References

Atran, S. and Ginges, J. (2012) 'Religious and sacred imperatives in human conflict', Science, 336(6083), pp. 855–857.

Buolamwini, J. and Gebru, T. (2018) 'Gender Shades: Intersectional accuracy disparities in commercial gender classification', Proceedings of Machine Learning Research, 81, pp. 77–91.

Fridman, O. (2018) Russian 'Hybrid Warfare': Resurgence and Politicisation. London: Hurst.

Gartenstein-Ross, D., Hodgson, S. and Clarke, C.P. (2023) 'Composite violent extremism: Conceptualising attackers who increasingly challenge the leaderless jihad model', Studies in Conflict & Terrorism. doi:10.1080/1057610X.2023.2218193.

Gill, P., Horgan, J. and Deckert, P. (2014) 'Bombing alone: Tracing the motivations and antecedent behaviours of lone-actor terrorists', Journal of Forensic Sciences, 59(2), pp. 425–435.

Kahneman, D. (2011) Thinking, Fast and Slow. London: Allen Lane.

Kruglanski, A.W., Gelfand, M.J., Bélanger, J.J., Sheveland, A., Hetiarachchi, M. and Gunaratna, R. (2014) 'The psychology of radicalization and deradicalization: How significance quest impacts violent extremism', Political Psychology, 35(S1), pp. 69–93.

Laclau, E. (2005) On Populist Reason. London: Verso.

LeCun, Y., Bengio, Y. and Hinton, G. (2015) 'Deep learning', Nature, 521(7553), pp. 436–444.

Mehrabi, N., Morstatter, F., Saxena, N., Lerman, K. and Galstyan, A. (2021) 'A survey on bias and fairness in machine learning', ACM Computing Surveys, 54(6), pp. 1–35.

Mitzen, J. (2006) 'Ontological Security in World Politics: State Identity and the Security Dilemma', European Journal of International Relations, 12(3), pp. 341–370.

National Commission on Terrorist Attacks Upon the United States (2004) The 9/11 Commission Report. New York: W.W. Norton.

O'Neil, C. (2016) Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy. New York: Crown.

Paul, C. and Matthews, M. (2016) 'The Russian "Firehose of Falsehood" Propaganda Model: Why It Might Work and Options to Counter It', RAND Perspectives. doi:10.7249/PE198.

RAND Corporation (2018) Perspectives on the Future of Intelligence Analysis. Santa Monica: RAND.

Rapoport, D.C. (2004) 'The four waves of modern terrorism', in Cronin, A.K. and Ludes, J.M. (eds.) Attacking Terrorism: Elements of a Grand Strategy. Washington, DC: Georgetown University Press, pp. 46–73.

Sageman, M. (2004) Understanding Terror Networks. Philadelphia: University of Pennsylvania Press.

Taleb, N.N. (2007) The Black Swan: The Impact of the Highly Improbable. New York: Random House.

Tetlock, P.E. and Gardner, D. (2015) Superforecasting: The Art and Science of Prediction. New York: Crown.

Citation: GeoPsychology Analytical Team (2026). Detection Trained on Yesterday: The Case for Anticipatory Intelligence. Angel Analytical Research Note GP-2026-012. DOI: [to be confirmed].

Published by Angel Analytical, part of The Angel Social Group. Supported by Art Angel Foundation. All rights reserved.