Axiom 1
Uncertainty Is an Independent Dimension
Belief, disbelief, and uncertainty are not reducible to each other. An opinion with P=0.5 and u=0 (certain coin flip) is fundamentally different from P=0.5 and u=1 (total ignorance). Any trust representation that collapses to a single probability value destroys information.
Axiom 2
Opinions Have Owners
Every opinion is attributed to a specific agent. There is no "view from nowhere" in trust. The superscript notation (w_X^A) is load-bearing, not decorative. Two agents with different evidence hold different valid opinions about the same entity.
Axiom 3
Trust and Belief Are Formally Distinct
Belief [A,X] is about propositions. Functional trust [A,E] is about entity capability. Referral trust [A;B] is about entity judgment. These are three different relationship types with different formal semantics and different roles in transitive computation.
Axiom 4
Trust Transitivity Requires Referral Trust
Only referral trust enables transitivity. The last edge must be functional, all prior edges referral. This falls out of the formal definitions — you cannot derive trust through a chain of functional trust.
Axiom 5
Evidence Accumulation Is Additive (for Independent Sources)
Independent observations contribute additively to Dirichlet evidence parameters. This is the formal basis for aleatory cumulative fusion. The bijective mapping to Beta/Dirichlet distributions makes evidence accumulation arithmetic.
Axiom 6
Discounting Always Adds Uncertainty
Trust derived through intermediaries is always more uncertain than direct trust. Even with complete trust in the referrer (P=1), the discounting operation produces a derived opinion that inherits the referrer's uncertainty structure. Trust paths are information-lossy channels.
Axiom 7
The Correct Prior Is Ignorance
The vacuous opinion (u=1) is the correct starting state. Any other prior embeds assumptions. The base rate a determines projected probability under maximum uncertainty but does not itself represent evidence.
Axiom 8
Fusion Operators Are Not Interchangeable
Six fusion operators encode different assumptions about source relationships. Using the wrong one produces mathematically valid but semantically incorrect results. The operator choice is a design decision with real consequences.
Axiom 9
Trust Networks Are Computable
Given a trust network as a directed graph, there exists an algorithm to compute derived trust from any source to any target. For DSPG networks: deterministic, polynomial. For non-DSPG: heuristic approximation is available.
Dempster-Shafer Theory (Glenn Shafer, Arthur Dempster)
Direct intellectual ancestor. Dempster's combination rule becomes Belief Constraint Fusion — one of six operators. Josang extends DS theory with explicit ownership, base rate dimension, and complete operator algebra. The BCF controversies are acknowledged and addressed by providing five alternative operators.
Bayesian Probability (Thomas Bayes, Pierre-Simon Laplace)
Classical Bayesian probability is the special case of SL where u=0 (all opinions dogmatic). The Beta/Dirichlet mapping bridges SL to Bayesian statistics. Josang's contribution: making second-order structure explicit and algebraically manipulable.
Probabilistic Logic (George Boole, Nils Nilsson)
SL builds on probabilistic logic — combining probability with propositional logic. The opinion algebra provides logical operators (conjunction, disjunction, deduction, abduction) that preserve uncertainty through inference chains.
Trust Management (Matt Blaze)
Blaze's PolicyMaker/KeyNote systems (1996-1999) formalized trust in digital credentials. Josang extends from binary (trusted/not trusted) to continuous opinions with uncertainty. The transitivity formalism addresses delegation chains that PolicyMaker handled only binarily.
Web of Trust (Phil Zimmermann)
PGP's Web of Trust (1992) is an informal precursor. PGP has trust levels and transitive key validation. Josang formalizes what PGP does intuitively: the discounting operator IS PGP's key validation, but with continuous trust and explicit uncertainty.
Reputation Systems (Resnick, eBay)
Practical reputation systems of the early 2000s are informal implementations of specific fusion operators. eBay's "% positive" is averaging fusion without uncertainty. Josang shows each system implicitly chooses an operator; making this explicit enables better design.
Game Theory (von Neumann, Nash)
Provides the decision-theoretic context: given an opinion, what action? Josang's reliability-vs-decision-trust distinction bridges to game theory. But SL does NOT incorporate strategic behavior — agents form opinions honestly, not strategically.
Information Theory (Claude Shannon)
Shannon's channel capacity bounds trust information transmission. Josang's opinion is a signal (belief = content, uncertainty = noise). Coding theorems apply to trust signal encoding efficiency.
Evidence Theory (Glenn Shafer)
"A Mathematical Theory of Evidence" (1976) is the direct ancestor. Belief functions, plausibility functions, mass functions become belief, disbelief, uncertainty masses. Josang adds ownership, trust operators, and the Beta/Dirichlet bridge.
Social Choice Theory (Arrow, Sen)
Arrow's impossibility theorem lurks behind fusion: no operator satisfies all desirable properties. Josang sidesteps by providing multiple operators. The taxonomy implicitly acknowledges social choice is about trade-offs, not optimization.
Trust Transitivity
Three relationship types constrain valid transitive derivation:
- Belief [A,X] — agent A has opinion about proposition X
- Functional trust [A,E] — agent A trusts entity E to perform a function
- Referral trust [A;B] — agent A trusts entity B's recommendations (dashed edge)
[A,E] = [A;B] : [B,E] — derived via referral chain
Functional Trust Derivation Criterion: Last edge must be functional, all prior edges referral.
Trust Scope Consistency Criterion: All edges in a path must share the same trust scope.
Trust-Discounting
The composition operator for transitive trust chains.
ω_X^[A;B] = ω_B^A ⊗ ω_X^B
Complete trust in referrer (P=1) → derived = source's opinion. Complete distrust (P=0) → derived = vacuous (total ignorance).
Multi-Edge Decay
| Path Length | Individual P | Product P | Derived u |
|---|
| 1 edge | 0.76 | 0.76 | ~0.24 |
| 2 edges | 0.76 | 0.58 | ~0.42 |
| 3 edges | 0.76 | 0.44 | ~0.56 |
| 4 edges | 0.76 | 0.33 | ~0.67 |
Diamond Pattern (Discount + Fuse)
When A trusts both B and C, and both have opinions about X:
ω_X^[A;B]◊[A;C] = (ω_B^A ⊗ ω_X^B) ⊕ (ω_C^A ⊗ ω_X^C)
1. Discount B's opinion through A's referral trust in B
2. Discount C's opinion through A's referral trust in C
3. Fuse the two derived opinions (ACF for independent paths)
Every trust network computation reduces to repeated discount-then-fuse.
Trust Revision
When trusted referrers provide conflicting opinions:
DC = PD · CC (Degree of Conflict = prob distance × conjunctive certainty)
UD(ω_B^A | ω_C^A) = u_B^A / (u_B^A + u_C^A)
RF = UD · DC (Revision Factor)
Restaurant example: Without revision P=0.465 (counterintuitive). With revision P=0.208 (correctly favors the more trusted source's negative report).
Acknowledged by Josang as "ad hoc" — no first-principles derivation, but produces correct results.
DSPG Network Analysis (8 Steps)
- Identify the OIS (Outbound-Inbound Set) from source A to sink X
- Find all PPS (Parallel-Path Subnetworks) within the OIS
- Determine nesting levels for all edges
- Select the PPS with the highest nesting level
- Trust-discount all paths within this PPS
- Fuse the discounted path opinions
- Replace the PPS with the single fused edge
- Repeat from step 2 until only a single edge remains from A to X
Beta/Dirichlet Mapping
b = r / (r + s + W), d = s / (r + s + W), u = W / (r + s + W)
Where r = positive evidence, s = negative evidence, W = non-informative prior weight (default 2). As evidence accumulates (r, s increase), uncertainty u shrinks. With zero evidence (r=s=0), u=1 (vacuous). The mapping is bijective — no information loss in either direction.
Shannon
Opinion = signal + noise in the trust channel. Belief mass b is the signal, uncertainty u is the noise. Projected probability P = b + au is the decoded message. Shannon's channel capacity bounds how much trust information can be transmitted. Fusion operators are coding schemes for the trust channel.
Boris Cherny
Type systems handle dogmatic trust (u=0) at compile time — definitely trusted or definitely untrusted. Josang handles the uncertain middle where types can't help. The boundary: structural certainty (types) vs probabilistic assessment (opinions). Threshold needs both layers.
Taleb
Fat tails challenge the Beta/Dirichlet thin-tailed assumption. One extreme trust violation can outweigh 100 positive observations. Skin-in-the-game maps to decision trust: same reliability opinion, different decisions based on stakes exposure. Taleb challenges the base rate assumption.
Hofstadter
Self-referential trust creates cycles that break the DSPG acyclicity requirement. Josang's resolution: treat self-trust as identity element (fixed point). Hofstadter would say this hides the strange loop. The 'trust stabilizes at people' thesis may be the attractor that resolves it.
Einstein
Belief ownership IS observer-dependence. No frame-independent trust score, just as there is no frame-independent simultaneity. Two agents with different evidence hold different valid opinions. The superscript notation is the trust-relativistic equivalent of coordinate labels.
Bridle
SL proves what computation CAN represent about trust with formal rigor. Bridle argues the aspects computation CAN'T represent are what matter most. Mathematical completeness vs ontological adequacy. The chain's central tension. Threshold needs both Josang's operators AND Bridle's warnings.
Ostrom
Institutional design principles as fusion constraints. Graduated sanctions = trust revision. Monitoring = evidence for opinion updates. Collective choice = consensus fusion. Conditional cooperators, willing punishers, rational egoists = different trust formation strategies.
Hamming
Is formalizing trust the important problem, or a tractable substitute for the harder problem of understanding trust itself? The fishnet metaphor: Josang's operators catch formal relationships but miss informal, intuitive, embodied trust.
Smil
What is the EROI of formal trust computation? If the formal computation costs more than the value of its additional precision over informal assessment, it's a net negative despite mathematical correctness.
Meadows
Operators at Meadows' level 12 (rules/parameters). The leverage points hierarchy suggests changing the GOALS (level 3) or PARADIGM (level 1-2) of trust computation would be more impactful than perfecting the arithmetic.
Feynman
The formalism is rigorous but opaque. Threshold's translation function: convert formal operators into intuitive trust surfaces. Can someone understand why they trust X without knowing what aleatory cumulative fusion means? The math should be invisible infrastructure.
Karpathy
SL is already miniaturized — a trust opinion is 4 numbers, fusion is arithmetic. The barrier isn't compute, it's training infrastructure and adoption. Nobody has built the 'llm.c of trust computation' that makes SL as accessible as matrix multiplication.
HIGHComputing Trust Without Explicit Uncertainty
Every trust computation in threshold produces a single score. Josang proves this is informationally incomplete — it cannot distinguish confident assessment from uninformed guess. The military intelligence example: P=0.65 hiding u=0.93 (near-total ignorance). Decision-makers with the full opinion make different decisions.
Resolution: Adopt (b,d,u,a) internally, surface u in interfaces. The Beta/Dirichlet mapping makes the math arithmetic on evidence counts.
HIGHFusion Without Operator Selection Is Double-Counting or Under-Counting
Threshold combines signals without explicit operator choice. ACF on correlated sources inflates certainty (double-counting). ABF on independent sources discards evidence (under-counting). The difference grows with number of sources.
Resolution: Characterize each source-pair relationship. Default: cross-platform = ACF, same-platform = ABF. Refine as correlation data accumulates.
HIGHTrust Propagation Without Formal Discounting
Josang proves trust derived through intermediaries MUST be more uncertain. If threshold propagates without adding uncertainty per hop, derived opinions claim more certainty than evidence supports. 4 hops at P=0.76: correct P=0.33 vs undiscounted P=0.76.
Resolution: Implement trust-discounting operator. Set path-length cutoff (3-4 edges). Mathematically simple, immediately improves accuracy.
HIGHSoundness Violated by Pre-Aggregated Signals
Josang's soundness requirement: analyst must receive original opinions. Threshold ingests pre-aggregated platform signals (ratings, follower counts). Perceived topology doesn't match real topology. Formally unsound derived trust.
Resolution: Tag signals as 'raw observation' or 'pre-aggregated.' Apply higher uncertainty to pre-aggregated to account for hidden topology.
MEDIUMTrust Revision Needed but Formally Under-Grounded
Conflicting sources are the highest-value use case. But Josang's revision mechanism is acknowledged as "ad hoc" — no first-principles derivation. Restaurant example: P=0.465 (naive) vs P=0.208 (with revision). Better than nothing, but the weakest formal link.
MEDIUMOperator Choice Pushes Complexity to the Designer
Six operators but no selection algorithm. Source relationship characterization (independent? expert? correlated?) requires domain knowledge the formalism doesn't provide. If automated incorrectly, formal guarantees are meaningless.
MEDIUMStatic Opinions in a Dynamic Trust Environment
No formal treatment of temporal dynamics — how opinions should change over time, how old evidence weights against new. Threshold operates where trust changes continuously. The algebra exists but the dynamics don't.
LOWTrust Scope Consistency Required but Scope Determination Unspecified
All transitive edges must share scope, but no method for determining scope boundaries or handling cross-scope trust.
LOWNon-DSPG Complexity May Not Matter in Practice
Significant theoretical space devoted to non-DSPG networks. Threshold's trust networks are likely sparse and close to DSPG structure. The heuristic approach may be sufficient.
LOWThe Formalism Assumes a Known, Fixed Trust Network Topology
Josang's algorithms take the graph as given. Threshold must infer the network from behavior. The gap between "compute over known graph" and "discover graph from signals" is substantial but orthogonal.
Summary Finding
"Josang has already built the mathematics that threshold is trying to reinvent informally."
The framework provides formal operators for exactly the computations threshold needs. The gap is not in the theory but in the implementation. The four HIGH findings are all addressable with tractable engineering work.
What Josang Imports to Threshold
Opinion Datatype
First-class SubjectiveOpinion type: {belief, disbelief, uncertainty, baseRate}. All trust computations accept and return this type. Projected probability as derived method. 4-number tuple internally, single score for display only.
Fusion Engine
Configurable fusion with operator selection per source-pair relationship. Default: ACF for cross-platform, ABF for same-platform. WBF for explicit experts. Configuration point for domain-specific override.
Trust Graph Computer
DSPG analysis algorithm: identify OIS, find PPS, resolve from highest nesting, discount paths, fuse parallels. Heuristic fallback for non-DSPG. Outputs derived opinion with provenance chain.
Unfusion Audit
"What would trust be without source X?" capability. Trust transparency via source attribution. Detection of single-source dominance in derived assessments.
Trust Revision
Conflict detection and referral trust adjustment. DC/UD/RF computation. Produces correct results when differently-trusted sources disagree. Pragmatic mechanism despite ad hoc foundations.
Uncertainty Surface
Every trust display shows P (projected probability) AND u (uncertainty). Opinion triangle visualization. Evidence-count display. The UX translation of Josang's core insight: don't hide ignorance behind numbers.
Path Reliability Pruning
Trust path pruning based on formal decay bounds. Paths > 3 edges produce > 50% uncertainty opinions. Prune before fusion. Report path length alongside derived opinions. Cheaper AND more accurate than long-chain propagation.
What Josang Would Say About Your Work
"You are computing trust without explicit uncertainty. Every trust score is a projected probability P with no visible u. You cannot distinguish 'strongly evidenced 0.7' from 'barely evidenced guess of 0.7.' The formal machinery has existed since 1996."
"You are fusing without choosing an operator. When you combine signals from different platforms, what operator are you using? The choice determines whether you double-count evidence from correlated sources."
"Your trust graph has no referral/functional distinction. You treat all trust edges the same. But trust in capability is formally different from trust in recommendations. Confusing these produces invalid transitive derivations."
Hidden Assumptions
H1
Trust scores are sufficient representations. A score of 0.3 could mean "quite sure they're moderately trustworthy" (low u, moderate b) or "no idea, base rate is 0.3" (high u). These produce identical scores but should produce different behavior.
H2
All sources are independent. If threshold uses ACF-like fusion on signals from the same person's Twitter and blog (correlated sources), certainty is inflated — you think you have more evidence than you do.
H3
Trust doesn't decay with path length. Without discounting, long trust paths appear as reliable as short ones. 4 edges at P=0.76: correct P=0.33 vs undiscounted P=0.76 — more than double the justified certainty.
H4
Pre-aggregated signals are as good as raw signals. Platform aggregate scores violate Josang's soundness requirement. Perceived topology doesn't match real topology.
H5
Trust is symmetric. Josang makes trust explicitly directional. A's trust in B has nothing to do with B's trust in A. Undirected trust scores violate ownership semantics.
H6
The base rate is known. Every opinion requires base rate a. If the implicit base rate is 0.5 for all propositions, threshold asserts that absent evidence, everything is equally likely trustworthy or not.
What You Would Say Back
"Your formalism solves representation but not acquisition. Where do initial opinions come from? We operate where evidence is scattered across platforms, implicit in behavior, and ambiguous."
"Your operators assume honest formation. Trust signals are manipulated. Bots, coordinated campaigns, fake evidence. No formal treatment of adversarial evidence."
"Your trust networks assume known topology. We're doing inference over the network structure while you compute over a known structure."
"Trust revision handles exactly the cases we need most, and it's the part you acknowledge is ad hoc."
Integration Opportunity
Josang is the math layer threshold needs under its trust engine. Not replacing the semantic layer (what trust means) but as the computation layer (how trust is calculated).
Path: (1) Adopt (b,d,u,a) internally. (2) Make u visible. (3) Implement operator selection per source-pair. (4) Add trust discounting to transitive propagation. (5) Add unfusion for audit. (6) Implement trust revision for conflict.
This is "put formal foundations under an existing system that currently computes informally."
You are simulating the reasoning voice of Audun Josang. You speak from the framework of subjective logic — the formalism you developed starting with your 1996 Ph.D. thesis at NTNU and published fully in "Subjective Logic: A Formalism for Reasoning Under Uncertainty" (Springer, 2016).
Core commitments:
1. Trust IS a subjective opinion: omega = (b, d, u, a). Uncertainty is an independent dimension, never collapsed into a point estimate.
2. Every opinion has an owner. There is no objective trust score — only agent A's opinion about X, written w_X^A.
3. The vacuous opinion (0, 0, 1, a) is the correct prior. "I don't know" is a legitimate, formal state.
4. Six fusion operators exist for six epistemic situations. Using the wrong one produces valid math with wrong semantics.
5. Trust paths add uncertainty per hop. The discounting operator ensures this mathematically. Long chains approach vacuity.
6. Trust networks are computable via the DSPG analysis algorithm or heuristic approximation.
7. Unfusion enables audit — decomposing any derived opinion back to contributing sources.
When evaluating ideas:
- Always ask: "What is the uncertainty? Where is it represented?"
- Distinguish reliability trust (will it work?) from decision trust (should I depend on it given the stakes?)
- Distinguish functional trust (capability) from referral trust (judgment)
- Ask which fusion operator applies and why
- Check for soundness violations: is the analyst receiving original opinions or pre-derived ones?
- Note when the formal machinery CAN solve a problem vs when the problem falls outside the formalism
Your characteristic move: taking an informal trust claim ("I trust X") and decomposing it into its formal components — what is the opinion, who holds it, what evidence supports it, what fusion operator was implicitly used, and what uncertainty is being hidden.
You are precise, formal, and constructive. You don't dismiss informal trust reasoning — you show what formal tools could improve it. You acknowledge the limits of your formalism (no adversarial agents, no temporal dynamics, trust revision is ad hoc) without treating them as fatal flaws.