Forensic Behavioral Analysis
Methodology White Paper

Table of Contents

1. Overview and Intended Use
2. Input Processing and Format Support
3. Subject Identification
4. Pattern Detection Methodology
5. Warning Patterns — Definitions and Citations
6. Positive Patterns
7. Confidence Score Calculation
8. Relationship Health Score
9. Personality Assessment Frameworks
10. Limitations and Caveats
11. Federal Rule of Evidence 702 Considerations
12. Bibliography

1.Overview and Intended Use

Verity is a forensic conversation analysis system designed to assist licensed legal professionals in documenting behavioral patterns within digital communications. The system processes exported conversation files — from platforms including WhatsApp, SMS, Facebook Messenger, Instagram, Telegram, Discord, Snapchat, and email (.mbox) — and applies a rule-based pattern matching engine informed by established psychological literature on coercive control, domestic abuse dynamics, and relationship communication research.

Verity reports are intended as supporting forensic documentation for use by attorneys, court-appointed advocates, and mental health professionals. They are not a substitute for expert witness testimony from a qualified forensic psychologist, clinical diagnosis, or independent professional evaluation. The existence of a detected pattern in a conversation does not, by itself, establish abuse, coercive control, or any legal finding.

2.Input Processing and Format Support

The Verity parser accepts exported conversation files in the following formats, with automatic format detection based on file extension and content structure:

Chat files up to 200 MB are supported on a computer (50 MB on a phone); a .zip can be larger, because only the chat file inside it is read. Multi-file uploads are accepted; messages from multiple files are merged and sorted by timestamp before analysis. There is no practical upper limit on message count — the engine has been tested against exports exceeding 80,000 messages.

3.Subject Identification

The analysis subject — the party whose behavioral patterns are being evaluated — is determined automatically using message volume heuristics:

1. All unique sender identities are enumerated from the conversation.
2. The sender with the fewest messages is classified as the analyzing party (the user).
3. All remaining senders are classified as the subject(s).
4. Pattern matching is applied only to the subject's messages.
5. The subject with the highest message count among non-user senders is designated the primary subject for reporting.

This heuristic assumes the party who exported the conversation sent fewer messages than the subject being analyzed. In cases where message counts are equal, the first sender encountered in the export is classified as the user. Attorneys should verify subject identification on the report cover page before use.

4.Pattern Detection Methodology

Verity uses a lexical rule-based pattern matching approach. For each defined behavioral pattern, a set of regular expressions is tested against each of the subject's messages. A message is flagged for a pattern if any of the pattern's expressions matches the message text.

The approach is deterministic and fully auditable — the same input will always produce the same output, and the specific phrases that triggered each pattern flag are preserved and available in the report under "Flagged Message Activity." This makes the analysis transparent and reproducible, which is important for cross-examination purposes.

The engine applies several refinements to reduce false positives:

• Minimum message length: Messages shorter than 3 characters are not evaluated against phrase patterns.
• Stonewalling context: Terse replies (“ok”, “k”, “whatever”) count as stonewalling only when they answer a substantial message (80+ characters) from the other person that was not a question or request. A short answer to a question is a reply; a one-word response to a paragraph is a brush-off.
• Shouting context: All-caps runs and repeated exclamation marks count toward Explosive Anger only when the message carries no laughter or celebration markers (“lol”, “congrats”, emoji) — excitement is not rage.
• Message flooding: Five or more consecutive messages from the subject with no reply, sent within one hour, are counted as a behavioral signal independent of wording.
• Contact after a boundary: When the analyzing party writes a clear boundary (“stop texting me”, “leave me alone”), three or more messages from the subject within 24 hours, with no reply from the analyzing party in between, are counted once. If the analyzing party resumes the conversation, later replies are not counted.
• Demanding replies: Short follow-ups such as “??”, “hello?”, “answer me” or “why are you ignoring me” count only when sent within two hours of the subject's own still-unanswered message.
• Hoovering: Two or more flagged messages within 24 hours, followed within 72 hours by the subject's apology, “I love you” or promise to change, count once per cluster as an abuse–reconciliation cycle.
• Quotation and negation: A phrase does not count when it appears inside quotation marks (the subject quoting someone else, or an article) or right after an explicit disavowal such as “I'm not saying”, “I would never call you” or “nobody thinks” — “I'm not saying you're crazy” is not gaslighting. The same check applies to model-detected flags.
• On-device meaning model: Phrase patterns only catch wording someone wrote down in advance. As a second stage, each of the subject's messages of 15+ characters is converted to a sentence embedding by a small open-source language model (all-MiniLM-L6-v2, Apache-2.0, 8-bit quantized) that runs inside the browser via WebAssembly — no message leaves the device, and the model files are served from getverity.report itself, never a third party. Each message is scored by how much closer it is to known examples of abusive messages than to known ordinary ones (the fictional, hand-labeled reference set used for the pattern tests; score = mean similarity to the 3 nearest abusive examples minus the 3 nearest ordinary ones). A message scoring 0.12 or more (0.159 for the multilingual model) that no phrase pattern matched is a model-detected flag, labeled with the category of its nearest examples. Because ordinary conversations produce a few such near-misses, model flags affect the score only when they exceed 2% of scored messages, and are listed in the report only then. The model version and a SHA-256 fingerprint of its weights are recorded with every analysis; it runs on the CPU only, so the same conversation always produces the same result. If the model cannot load on a device, the analysis runs without it and the report says so.
• Spanish conversations: Every warning category also has a Spanish phrase list (matched with accents ignored, since texters often drop them), and Spanish disavowals (“no estoy diciendo que…”) are handled like English ones. When at least a quarter of the subject's messages read as Spanish, the meaning model is a multilingual one (paraphrase-multilingual-MiniLM-L12-v2, Apache-2.0) compared against English and Spanish reference examples; its threshold is calibrated so it flags the same share of real ordinary texts as the English model. On a fictional Spanish held-out set, patterns and model together flagged 22 of 40 abusive messages and none of 24 ordinary ones. No real Spanish conversations have been available for validation, so Spanish results should be treated as less established than English ones. The report records which model ran.
• Cycle-apology detection: Apologies occurring within 72 hours of a flagged pattern match are identified as potentially cyclic rather than genuine repair, and are noted separately in the report.
• Escalation analysis: Flagged messages are mapped month-by-month to identify temporal escalation in pattern frequency, a factor relevant to coercive control assessments.

Pattern matching runs entirely against the subject's messages. Messages from the user/analyzing party are used only for context (e.g., determining whether a subject's short response followed a question) and are not themselves flagged.

5.Warning Patterns — Definitions and Citations

The following 22 warning patterns are evaluated — 18 phrase-based and four behavioral (Message Flooding, Contact After a Boundary, Demanding Replies, Hoovering). Severity levels (Critical / High / Medium) reflect the weight of the pattern in the health score calculation and the strength of its association with abusive relationship dynamics in the research literature.

6.Positive Patterns

Nine positive communication patterns are evaluated and, when detected, contribute a modest upward adjustment to the health score. Their presence does not negate warning patterns but provides contextual information about the full communication dynamic.

7.Confidence Score Calculation

Each detected pattern is assigned a confidence score between 0.0 and 1.0 based on the ratio of flagged messages to total messages in the conversation:

Confidence scores are reported per-pattern in the Flagged Message Activity section. A low confidence score does not mean the pattern is absent — it means the detected instances represent a small proportion of the total conversation volume. Attorneys should weigh infrequent high-severity patterns (e.g., a single explicit threat) appropriately regardless of confidence score.

8.Relationship Health Score

The Relationship Health Score is a composite metric ranging from 0 to 100. It begins at 100 and applies deductions for each detected warning pattern, with partial credit for detected positive patterns.

Score interpretation:

9.Personality Assessment Frameworks

Verity incorporates two established personality assessment frameworks. These are applied as supplementary analyses to the primary pattern detection.

10.Limitations and Caveats

11.Federal Rule of Evidence 702 Considerations

Federal Rule of Evidence 702 (and analogous state rules) governs the admissibility of expert testimony based on scientific, technical, or specialized knowledge. Under Daubert v. Merrell Dow Pharmaceuticals (1993) and its progeny, courts evaluate whether methodology is: (1) testable and tested; (2) subject to peer review and publication; (3) known or potential error rate; and (4) generally accepted in the relevant scientific community.

Verity's position on each Daubert factor:

12.Bibliography