The House Doesn’t Publish Its Tells

Aug 21, 2026 09:30 PM - 2 hours ago 3

AI companies are buying pallets of aged printed books. Physical books, insubstantial and glue, the format the full manufacture was expected to person made quaint. ISBNdb, a agent that sources bulk people acquisitions for AI labs, pitches it pinch a consecutive face: “The world’s champion AI training information is sitting connected a shelf.” And the transportation works, because books person 1 spot nary magnitude of punctual engineering tin fake. They were printed earlier the slop existed.

So the companies that built the slop machines are paying existent money to debar eating the output of the slop machines. Meanwhile, an full vendor class is charging you monthly to provender those aforesaid companies arsenic overmuch instrumentality output arsenic you tin generate. Someone successful this proviso concatenation has misread the room.

The Measurement Went First

Old hunt was deterministic capable to build an manufacture on. A ranking was a position, a position produced impressions and clicks, and clicks carried search parameters into analytics that told you what converted. You could reason astir attribution windows for hours, and God knows we did, but the pipeline held still agelong capable to beryllium measured.

AI answers clasp still for nary one. Ask the aforesaid mobility twice, and the brands tin change. There is building nether the noise, a distribution whose stableness depends connected the corpus down it and the value of the prompts probing it, but here’s the point astir the probing: It’s synthetic. Your locator fires sterile prompts astatine an API and gets backmost answers stripped of the discourse and personalization that style what existent humans see. Even a perfectly unchangeable reference is apt a perfectly unchangeable reference of the incorrect thing.

A much honorable manufacture mightiness person stopped here. Ours built dashboards. Position search for a strategy pinch nary positions, stock of sound for answers nobody’s convention will ever reproduce, each reported pinch the decimal-point assurance of a rank study from 2014. And connected the accumulation side, the aforesaid vendors waste the point this portion is really about: AI-generated content, astatine scale, optimized for retrieval by systems whose owners are building the devices to place it.

The Infrastructure Is Already At Internet Scale

On 19 May (at I/O 2026), Google announced that SynthID, its invisible watermarking system, had marked much than 100 cardinal AI-generated images and videos positive astir 60,000 years of audio, pinch verification rolling into Search instantly and Chrome successful the weeks after. Same day, OpenAI committed to embedding SynthID successful each image generated done ChatGPT, Codex and the API. Kakao and ElevenLabs are connected the partner list; NVIDIA joined earlier done its Cosmos models. This is what provenance looks for illustration erstwhile it stops being a investigation demo and starts being plumbing.

I tin perceive the objection from here: that’s images and audio, and the content farms waste text. Correct. OpenAI’s committedness covers images only, and Google’s published matter watermarking comes pinch documented weaknesses. DeepMind says discovery assurance drops sharply erstwhile matter is thoroughly rewritten aliases translated, and the method struggles connected short actual outputs. Plenty of group person publication precisely that acold and concluded AI matter astatine standard is safe. Comforting … besides lazy.

It’s also, arsenic of August, retired of date. Anthropic has signed the EU AI Act’s Code of Practice connected transparency and published its plan: Claude models launched from August 2, 2026 onwards are to embed watermarks successful generated text astatine the exemplary level, applied worldwide, crossed the API, the user apps and the unreality platforms. The ineligible trigger is European, but the watermark ships wrong the model, truthful a Brussels instruction becomes the world default. Anthropic says it will thief 3rd parties observe the watermarking, pinch the system described successful “forthcoming method documentation,” a building I promote you to savor. Their ain page notes the people doesn’t certify authorship either: matter simply processed by Claude, proofread, translated, tidied up, tin transportation it. And the published limitations are the acquainted ones: dense editing, translation, very short passages, which are, arsenic ever, the limitations of what’s been chosen for publication.

The open-source SynthID matter repository carries a statement from DeepMind itself: the codification is simply a reference implementation for the research paper, “not intended for accumulation use,” pinch a hashing usability offering nary cryptographic information guarantees. Read that again, slowly. The type you tin inspect is, by Google’s ain description, not the type that runs. Everyone confidently citing the published limitations is citing the limitations of a demo.

I spent astir six years wrong Google’s hunt value and webspam teams, truthful fto maine prevention you immoderate suspense astir really this works. Google has ne'er published really spam discovery operated. Ever. Publishing the system is handing complete the evasion manual, and each superior discovery strategy successful the history of hunt has been built connected that silence. The thought that the aforesaid institution would now archive its AI matter discovery honestly, for the convenience of the group it’s designed to catch, is genuinely sweet. If a matter watermarking aliases discovery method that survives paraphrasing exists aliases arrives, the first you will perceive of it aliases really it useful is never.

The evasion broadside turned up correct connected schedule, of course. Within days of Anthropic’s announcement, a watermark remover appeared connected GitHub, covering Claude, Gemini, and OpenAI, and its README is much honorable than astir of the GEO industry. For statistical matter watermarks, its method is simply a dense rewrite done different model, labelled best-effort, and it concedes that until vendors vessel nationalist detectors, “no instrumentality tin honestly certify” the people is gone. It moreover recommends laundering Claude matter done a different model, successful lawsuit the rinse re-stamps the washing. That’s the mouse’s broadside of the crippled successful full: scrubbing invisible characters and hoping that was the watermark, paraphrasing against a detector cipher tin query, and shipping pinch a disclaimer that it cannot cognize whether immoderate of it worked. The feline is nether nary responsibility to show up wherever you tin spot it.

So the existent mobility was ne'er whether today’s documented watermarks tin beryllium stripped. You cannot verify the absence of a watermark, and the organizations building them will not corroborate which ones work. Producing AI contented astatine standard is simply a opinionated stake that nary reliable discovery exists now and ne'er will, placed against companies pinch the compute, the training-data incentive, a regulatory instruction the labs are already signing commitments under, and a 20-year organization wont of catching group who were definite they couldn’t beryllium caught and assured they could “make it look natural.” I’ve met the group connected the different broadside of that bet. I utilized to beryllium 1 of them.

About that mandate. Article 50 of the EU AI Act requires providers of generative AI systems to people synthetic outputs, matter included, successful a machine-readable format, and applied from August 2. The pending AI Omnibus package would springiness systems already connected the marketplace until December, and the guidelines carve retired plenty, truthful nobody’s switching disconnected the contented pipeline retired of fearfulness of Brussels conscionable yet. One carve-out is worthy reference twice, though: AI-generated matter connected matters of nationalist liking escapes disclosure wherever a quality has assumed editorial responsibility. A regulator sat down and decided the point that makes instrumentality matter acceptable is simply a quality consenting to put their sanction connected it. Content-at-scale operations beryllium precisely because cipher wants to do that.

You Can’t Paraphrase Your Way Out Of Slop

Fine, suppose the watermarks ne'er land. Paraphrase everything, launder each output done a 2nd model, construe it, portion immoderate signals you dreamt about. Congratulations: you now ain a ample heap of laundered slop, and slop gets caught connected contented grounds, nary watermark required.

Nuclear testing contaminated the world’s alloy aft 1945, truthful instrumentality manufacturers salvaged pre-war shipwrecks for low-background steel. Pre-2022 matter is now that shipwreck, and the labs are hauling it up by the pallet-load, because everything published aft the flood needs filtering while books request none. Think astir what the target corpus really is. The astir heavy curated matter postulation ever assembled, curated by the wealthiest companies connected earth, specifically against the point you’re paying a SaaS to thief you nutrient much of. I’ve written earlier about models learning to mention their ain output. The book-buying is the labs’ reply to that problem, and dissimilar the industry’s answers, theirs costs them existent money.

The Lever Is Placed Upstream

A disclosure, because this abstraction has spent a twelvemonth demanding them from everyone else: I’ve joined geoSurge, and coming is the time that becomes public. If you’re reference this earlier my posts connected societal media, congratulations, you heard it here. The investigation beneath is theirs, which intends the skeptical publication you’re astir to get is maine applying my ain rules to my ain employer. For the record, the condemnation came first. Back successful May, I deliberately vagueposted that I’d yet seen an attack to this problem pinch legs. It was them. I kept the specifications to myself until I was definite the attack held up. It did, to the constituent wherever I signed.

geoSurge, an AI visibility SaaS, published investigation successful precocious July measuring what a exemplary does earlier it searches. Across 9 industries, 66 buyer-style prompts and astir 4,000 exemplary responses, brands the exemplary already held successful its top-10 representation for a class were named successful its hunt queries astatine 3.2 times the complaint of brands it didn’t remember: 55.7% against 17.4%. The spread held successful each 9 industries, and erstwhile the model’s queries named a marque astatine all, 63% of the clip it named 1 from its top-five recall. The model, it turns out, mostly goes looking for things it already knows. Ask immoderate quality who has ever shopped for anything.

Caveats, because the study states them and they matter: exploratory data, an relation pinch nary proven cause, and marque prominence sitting correct location arsenic a confound, since celebrated brands are some amended remembered and much searched. It’s besides vendor research, and worthy being precise astir which vendor, excavation included successful the scrutiny. geoSurge’s full transportation is the representation layer; that’s wherever they focus, and their CEO’s ain statement is “As models cognize more, they hunt less”, and they conscionable raised $12 million connected that thesis. A study uncovering that representation predicts hunt is simply a study uncovering that their backing information was a bully idea, which earns the numbers other scrutiny, and to their credit, the caveats supra are theirs, printed successful the report.

If the uncovering holds, the remainder of the category, the prompt trackers and citation dashboards and contented pipelines, is optimizing the downstream half of a determination the exemplary mostly made astatine training time. geoSurge is betting the other way, which is precisely why their numbers merit the scrutiny I’ve conscionable applied.

If vendor information unsocial feels thin, Google Research published the independent type astatine ICML this year. Across 13 models and much than 4 cardinal graded answers, frontier models had encoded 95% to 98% of the facts tested and still grounded to straight callback a 4th to a 3rd of them. Rare facts sat successful the model, retrievable erstwhile primed pinch training-like context, unreachable erstwhile asked plainly: the callback spread betwixt celebrated and uncommon facts ran past 20 points while the encoding spread was five. The authors besides return a plaything astatine the comfortable presumption of the moment, penning that “parametric knowledge is basal for fluency, speed, and integration crossed contexts” and informing against treating it arsenic thing RAG compensates for. Their benchmark is Wikipedia facts, not brands, truthful publication the mapping arsenic mine: a stray corpus mention astir apt gets encoded, and encoded is worthy thing if the exemplary can’t aboveground it unprimed. Recall follows prominence, the benignant built by being learned broadly and consistently. Encoding is astir free. Recall is the product.

Now put the halves together. Parametric representation is built from training data. Training information is being curated against AI-generated content, filtered for quality, and displaced by purchased books. AI contented astatine scale fails doubly over. It ne'er enters the corpus that forms memory, truthful it builds thing durable, and moreover introduction wouldn’t rescue it, since encoded and recallable are different things. Whatever retrieval-time visibility it buys is rented: re-contested connected each query, granted by a fan-out that mostly walks the model’s representation list, revocable the time a select changes. You’re renting a stall successful a marketplace that restocks from a storage you’re barred from.

Depreciation Runs On Someone Else’s Schedule

Underneath each of it sits a scheduling problem the manufacture would alternatively not discuss. Prompt trackers subscriptions measure monthly and study quarterly. Parametric representation forms connected training-cycle timescales and lags publication by months to years. Selling a quarterly-reportable merchandise for a lever that cannot beryllium quarterly reported takes creativity, which is really we ended up pinch mention counts, share-of-voice charts, and contented volume: numbers whose main qualification is fitting successful a QBR.

And the nullification, erstwhile it comes, will not denote itself aliases nonstop a almanac invite. A training-data argumentation tightens somewhere, aliases a detector ships softly into Search, and the plus you’ve been scaling reprices to zero while the invoices for producing it support arriving connected the first of the month.

The group who tally the machines are buying aged books and won’t show you what their detectors tin do. Both of those are tells. You’re allowed to publication them.

More Resources: