After NAZA: The IDF, AI, and the Threat-Primed Brain

Reading Lavender Through the Neuroscience of Threat Detection

Before it was a metaphor, Lavender was a spreadsheet.

The idea came from a 2021 book by the head of Israel’s intelligence Unit 8200, which called human analysts a “bottleneck” (+972 Magazine; The Guardian).

In the first weeks after 7 October 2023, the army leaned on it heavily: the AI system rated nearly every one of Gaza’s 2.3 million residents, from 1 to 100, on the likelihood of militant affiliation. It flagged as many as 37,000 people as suspected operatives, along with their homes (+972 Magazine; The Guardian). Human review of a flagged target reportedly took about twenty seconds — often only long enough to confirm the target was male (+972 Magazine).

What matters about Lavender isn’t that it made mistakes.

It’s what happened to the definition of “threat” once the system started running. Sources told +972 that the threshold for who counted as a militant “could be broadened or narrowed” — and when broadened, it began flagging civil-defense workers and police with no combat role (The Guardian). One intelligence source called the queue self-renewing: “another 36,000 were waiting” once a strike was approved — “the targets never end” (AOAV).

A new documentary, NAZA — the Hebrew intelligence term for expected collateral damage — offers testimony from inside: soldiers describe an operating maxim that “there is no NAZA in Gaza,” and one source says approval was given for as many as 500 expected civilian deaths against a single Hamas target (+972 Magazine; The Guardian). The IDF disputes this, saying its systems are “aids for intelligence analysts” that “do not independently make targeting decisions” (The Guardian).

“Lt. Col. (res.) Sarit Zehavi, who says she helped build the collateral-damage process nearly 20 years ago, long before October 7, counters that a NAZA figure on a target sheet is a trigger to reduce harm, not a licence (Times of Israel). That is very likely its design. But designers do not control how a tool is used under pressure.

A safeguard built for calm was now run by a state in shock…”A safeguard built for calm was now run by a state in shock, and +972’s sources put the permitted figure at 15 to 20 civilians per junior operative in the war’s first weeks, and more than 100 for senior commanders (+972 Magazine). Someone set that threshold, and the record shows it moved one way.

This is not only a story about machines. Lavender automated, at industrial speed, a bias that lives in every human brain.

Human threat-detection is built to expand. From infancy, people weight negative information more heavily than positive, needing less evidence before it shifts a judgment (negativity bias review, PMC). The brain’s threat-vigilance circuitry — the amygdala and the bed nucleus of the stria terminalis — widens its scan when a threat is ambiguous rather than waiting for the picture to clear (threat vigilance and amygdala connectivity, PMC). Confirmation bias lowers the threshold further: people barely scrutinise evidence confirming a suspected threat and demand far more of evidence against it — most extremely in phobia and hypochondria, where a mind built to find danger keeps manufacturing proof it was right to look (Wikipedia: Confirmation bias).

Put a name to a category — “Hamas operative,” “the next Iran” — and it grows to absorb whatever plausibly resembles it. Recommender systems show the same failure: an algorithm trained to surface “more like this” feeds on its own past outputs until the category’s boundary has quietly moved (Jiang et al., ACM). Lavender is that tendency wearing a uniform — and so, is arguably a mind that once feared one thing, and now, flinches at everything adjacent to it.

The same logic has reportedly crossed into Israel’s 2026 campaign against Iran, with even less human oversight: one Tehran building was flagged simply for being government-linked (Asia Times).

None of this changes the October 7 massacre and the killing of Israeli civilians by armed Hamas fighters. Yes, Hamas planned and carried out the attack. But responsibility for that attack is separate from what a targeting system does once told to hunt threats at speed. There is a balancing truth too: in a state that had just watched warnings go unheeded, restraint carried its own political cost. Israel’s chief of staff put it plainly this month: “There is no more ignoring and no containment; there is the removal of threats before they materialize” (JNS).

This was the state’s threat-primed brain speaking. Not striking risked  being read as  the complacency, indecision or mistaken assumption  that preceded the massacre — restraint acquiring the colour of neglect. That does not justify where the threshold ended up. It helps explain why no one inside the system was inclined to move it back.

The uncomfortable symmetry is this: both the algorithm and the anxious brain fail in the same direction, toward false-positive expansion, and both require something costly and deliberate to correct course — a second look, a slower check, a willingness to let disconfirming evidence count. In Gaza, that check reportedly collapsed into twenty seconds.

The open question, for both a country and a mind that feel under threat, is this.

What it would take to make that check happen before the threshold moves again, rather than after?