Hermes Confidence Model & Evidence Verification Framework

Core Epistemological Principle

“AI Does Not Equal Truth.” To serve as a trustworthy cyber intelligence observatory, Hermes Codex enforces a strict epistemological boundary between verifiable empirical facts and model-generated inferences. No claim is published without transparent evidentiary citations and an explicit confidence score.

1. The Epistemological Hierarchy: Fact vs. Inference vs. Prediction

In traditional cybersecurity reporting, analysts frequently blur the boundary between observed ground truth and speculative hypotheses. Hermes formalizes four distinct epistemic tiers:

┌─────────────────────────────────────────────────────────────────────────┐
│ 1. FACT                                                                 │
│    Directly observable, empirically verified, primary-source data.     │
│    Example: "A commit fixing CVE-2026-41264 was merged to Flowise main." │
├─────────────────────────────────────────────────────────────────────────┤
│ 2. INFERENCE                                                            │
│    Logical deduction derived from technical ground facts.                │
│    Example: "The patch adds AST validation, confirming the sink was    │
│    un-sandboxed Python execution."                                       │
├─────────────────────────────────────────────────────────────────────────┤
│ 3. PREDICTION                                                           │
│    Probabilistic forecast of adversary behavior or exploit spread.      │
│    Example: "Hermes estimates an 82% probability of automated scanner   │
│    weaponization within 72 hours."                                      │
├─────────────────────────────────────────────────────────────────────────┤
│ 4. HYPOTHESIS                                                           │
│    Working theoretical model subject to ongoing falsification.          │
│    Example: "The campaign may be affiliated with Storm-1175 based on    │
│    shared PowerShell stagers."                                          │
└─────────────────────────────────────────────────────────────────────────┘

---

2. Mathematical Confidence Scoring Formula

Every score and analytic judgment produced by Hermes Codex is accompanied by a Confidence Value ($C \in [0.0, 1.0]$) derived from technical evidence rather than unconstrained model generation.

The confidence score is computed as:

Confidence (C) = min(1.0, max(0.1, BaseQuality + Sum(SourceBonuses) - ContradictionPenalty - DistancePenalty))

Components of the Formula:

1. Source Reliability Weight ($W_s \in [0.1, 0.35]$):
   • Official Vendor Advisories, CERTs, CISA KEV: 0.35
   • Verified Security Research Lab / PoC Repository: 0.25
   • Automated Threat Scanners / Aggregators: 0.15
   • Unverified Social Media / Forum Claims: 0.05
2. Multi-Source Corroboration Bonus ($+0.10$ per independent source, up to $+0.30$):
   • Agreement across $\ge 3$ independent telemetry sources guarantees high confidence.
3. Technical Verification Bonus ($+0.25$):
   • Awarded if a functional exploit or sandbox test has been successfully verified in the Hermes isolated lab environment.
4. Contradiction Penalty ($-0.35$):
   • Applied immediately if primary sources dispute root causes, impact scopes, or active exploitation.
5. Inference Distance Penalty ($-0.10$ per deduction hop):
   • Penalizes conclusions that require multiple chained assumptions without intermediate telemetry.

---

3. Confidence Classification Tiers

Confidence Score	Qualitative Tier	Publishing Threshold	Operational Action
0.90 – 1.00	VERY HIGH	Automated Publication	Direct actionable intelligence; emergency remediation advisory.
0.75 – 0.89	HIGH	Automated Publication	Standard intelligence briefing with verified telemetry citations.
0.55 – 0.74	MEDIUM	Requires Critic Pass	Published with prominent caveats highlighting pending verification.
0.35 – 0.54	LOW	Hold for Evidence	Staged internally; blocked from main threat boards.
0.00 – 0.34	VERY LOW	Rejection	Discarded as unverified rumor or hallucination.

---

4. Handling Intelligence Disagreements

When primary sources conflict, Hermes Codex never forces an artificial consensus. The platform explicitly highlights and documents the dispute:

┌─────────────────────────────────────────────────────────────┐
│ ⚠️ INTELLIGENCE DISAGREEMENT DETECTED                       │
│                                                             │
│ Source A (Vendor Advisory): "CVSS 7.2 — User Interaction    │
│ Required; no remote vector without physical terminal."      │
│                                                             │
│ Source B (Pillar Security Research): "CVSS 8.8 / HASS 91 —   │
│ Auto-Run mode executes shell built-ins without confirmation.│
│                                                             │
│ Hermes Resolution:                                          │
│ Hermes sides with technical laboratory verification (B)     │
│ because Auto-Run bypasses user prompts at runtime.          │
│ Confidence adjusted to 88% due to vendor dispute.           │
└─────────────────────────────────────────────────────────────┘

This ensures full transparency and prevents model hallucinations from masquerading as definitive facts.

---

5. Related Methodologies

Hermes Agentic Security Score (HASS) The quantitative metric evaluating autonomous AI agent systemic risk.

Hermes Threat Score (HTS) The operational exploitability metric measuring real-world urgency.