this post was submitted on 08 Jul 2026
111 points (96.6% liked)

Fuck AI

7592 readers
1700 users here now

"We did it, Patrick! We made a technological breakthrough!"

A place for all those who loathe AI to discuss things, post articles, and ridicule the AI hype. Proud supporter of working people. And proud booer of SXSW 2024.

AI, in this case, refers to LLMs, GPT technology, and anything listed as "AI" meant to increase market valuations.

founded 2 years ago
MODERATORS
 

TL;DR: Please help me fuck (with) AI. See bold sections

Hi,
I haven't been keeping up with anti-AI combat so I'm asking for help. I inherited thousands of pages of materials my late grandpa made or used for his grammar school teaching job in the 1990s-2000s. They are A4 pages of documents made using what seems to be a typewriter, Text602 (DOS rich text editor) and Word. They were most likely not all made by him but he treasured them in nice binding and they have sources (mostly books and journals, almost no webpages, and absolutely no AI) and a cursory look shows meticulous compilation of every important fact on each subject (frankly, the level of detail is excruciating and I'm glad I went to a different grammar school). There's obviously no original scientific research but the materials can still be useful to someone, I bet. They were almost thrown away by the widowed grandma (she already removed and disposed of the plastic bindings and front covers so I'll have to guess document titles) but I think grandpa would prefer them to be shared. With an ADF scanner and OCR software (I have no chance of accessing the work computers he used so I'll have to scan), I can quickly make searchable PDFs of each document, and share them via torrent and DDL sites (there are Czech sites dedicated to sharing teaching materials but they have paywalls or an upload-credit system so best avoid them, not to mention some materials contain newspaper clippings and textbook photocopies for images so best stay anonymous and not try to assert copyright).

I'm afraid these texts could become a major part of some commercial LLM's Czech-language biology/social sciences knowledge corpus unless poisoned. How to best reduce the value of the documents when people try to feed them to AI (training/rewriting) with them while keeping their value for most legitimate users? (Sorry, people with screen readers, there may need to be extra steps for you.) I'm thinking about adding a huge volume of thesaurized or otherwise fuzzed public domain text like f4mi did with .ass subtitles (a technique that would probably still work if she didn't get 1M views detailing it, making YouTube reduce subtitle formatting support). Prompt injection or replacements (cell→gnome) might be interesting too. However, tools I know add an extra PDF layer, which is too obvious. I'm thinking about adding tiny text in the header and footer or between paragraphs in the OCR layer (not overlaid to reduce interference when selecting/searching), but how? I need an automated way to do this with such a huge page count. I can use both Linux and Windows machines for the job. None of them are very powerful but speed is not a concern, it's summer break and nobody will need school materials until September. I'll be happy to include multiple layers and techniques to make them too frustrating to remove.

The paper smells musty but does not seem to be moldy. It's all blank on the other side so I'll interleave it with recent newspaper to allow for the odor-neutralizing chemicals to seep into the sheets so I can eventually reuse them.

Illustration pic is an actual sheet from the collection, to make the post more engaging. Of course I won't be adding watermarks like that, that would just aggrevate people and make them try extra hard to extract the actual content. (And this one is easy to remove with color channel mixing.)

top 37 comments
sorted by: hot top controversial new old
[–] dumnezero@piefed.social 1 points 45 minutes ago (1 children)

Look into Poison Fountain: https://rnsaffn.com/poison3/

also https://git.madhouse-project.org/algernon/iocaine

This is at the crawler level.

In terms of protection,

, I can quickly make searchable PDFs of each document

OCR is a bad idea in that case.

If you've ever done OCR, you know how it works.

I've been musing on how to mess with OCR. That's the core tech for docs that are not pure text (like an image/scan).

I haven't tested it, but you can probably find some research.

Why OCR Struggles With Multi-Column Pages https://webfonts.tech/why-ocr-struggles-with-multi-column-pages

My idea is to use more text columns AND vary the columns from page to page, or even on the same page (half and half). One page has 3 columns, another has 2, another has 4 etc. Get creative and random.

If you can narrow the gap between columns, or make it more human-readable only, that would be an even bigger problem for OCR.

In this context, don't forget to use "justified" and hyphenation for the last words on the line (aka CORRECT grammar and syntax.) That can add extra chaos for the machine.

[–] LatheOperator@leminal.space 1 points 18 minutes ago

The thing is, if I don't add a "good enough for searching" OCR layer, someone else will - AI scraper or legitimate user. That's a cheap automatic operation. I'll better do it myself and poison it in a way that won't interfere with searching, like replacing some "are" with "aren't", such common words are rarely searched for. If there's a chance AI will fall for the metadata and invisible layer contents, that will decrease the requirements for visible poisoning, which is necessary but annoying.

Some of the text is indeed justified so I could do the multi-column trick that seems like the best compromise. The gap can be as narrow as one space. Or larger if I can write a script to detect lines and connect the columns with gibberish. A human can use zoom or window positioning to view one column at a time. I don't and will never have access to files the printouts are from (some are presumably in .602 format, others probably .doc), others are handwritten or typewritten, some have images glued on top or hand-traced; and Czech OCR is only about 99.5% reliable so as easier as it would make the endeavor, I can't be sure to preserve everything if I try to convert them into editable documents as an in-between step.

[–] bort@sopuli.xyz 9 points 1 day ago* (last edited 1 day ago) (1 children)

because 90% of content since 2023 is generated with LLM, it becomes unusable for training. Thus AI companies usually focus on content released before 2023, which has already been scraped. That being said...

Czech-language biology/social sciences knowledge corpus

there is a good chance the "The Pile" doesnt already contain this, while being highly relevant for training, So poisoning it becomes extra relevant

[–] LatheOperator@leminal.space 3 points 1 day ago* (last edited 1 day ago)

Good point. However, distillation (cannibalizing better LLMs) is a frequent technique so better convince the scraper it's not good even for that. That's why I plan to visibly digitally stamp OpenAI GPT 2.0 says: or This Deepseek response has been rated inaccurate: above some paragraphs of the typewritten text (of course in dozens of variations, maybe even different languages, to undermine search-and-replace). Humans will know it's fake (especially if I add a disclaimer) but scrapers, including ones that re-render and OCR the PDF themselves to get rid of misleading metadata and invisible layers, will most likely rate the text low in value. Of course ethically (and arguably legally) trained commercial AI would reject any text if it is released CC-BY-NC-SA 4.0 but I can't use that because scrapers for AI ignore licences in practice, and CC specifically forbids taking technical measures to devalue the text for some users.

[–] potter2010@lemmy.ca 29 points 1 day ago (5 children)

I'm far from an expert so take what I'm saying with a grain of salt. What I've been seeing is that poisoning is becoming less and effective since all the major models have such a large reference to go by they can automatically weed out "poisoned" information.

I guess if the information was completely unique and the subject wasn't found elsewhere on the internet you might have more success, at least temporarily until more information came out.

[–] JackbyDev@programming.dev 2 points 1 day ago (1 children)

Wouldn't being ignored still accomplish the desired goal?

[–] LatheOperator@leminal.space 1 points 9 hours ago

Yes, I will use both licence terms and "Made by bad AI" in metadata to discourage scraping but it's tempting to also poison the Czech-language biology knowledge base of bots who use the materials anyway. A good interleaving text could be multi-step roundabout machine translation of the original using shitty local tools.

[–] drcobaltjedi@programming.dev 15 points 1 day ago* (last edited 1 day ago) (1 children)

What I've been seeing is that poisoning is becoming less and effective since all the major models have such a large reference to go by they can automatically weed out "poisoned" information.

I know it's the old site, but /r/poisonai has bore fruit by getting DDG's slop machine to say that the potus died of rabies.

As for OP, the best options I can think of would be to add invisible gibberish text or to make your own font that treats random characters as the same image (for example rendering a random Chinese character and the "R" character both as the letter "R") though this solution would require you to rewrite your document using the scrambled text. Also both versions might pose accessibility issues for people using screen readers.

[–] LatheOperator@leminal.space 3 points 1 day ago* (last edited 1 day ago) (1 children)

I know how to edit fonts and replace characters. That would ruin searchability (and screen readers), making the PDF as good as a picture scan without OCR, which I hate (and someone would OCR it sooner or later if they realized the text content is useless). However, common words carry meaning (for example "are" is very different from "are not" etc.) and could be replaced with gibberish without most people searching for them. This also forces plagiators to take more steps.

Anyway, how do I easily add to/edit the PostScript layer in bulk, which consists of a list of individual characters and their positions? As I said, most PDF tools for adding text just add another layer, and that can be easily removed.

I wonder if this could help you do that?

[–] LatheOperator@leminal.space 7 points 1 day ago* (last edited 8 hours ago) (1 children)

You don't understand just how shit AI is when asked about school topics in Czech. For example, here is a bit of Czech language litany every third grader must know or they will embarrass themselves with awful spelling mistakes. (Skip the bullet points if you just want to hear about the AI)

  • The vowels I and Y (and long versions Í/Ý) sound the same [ɪ] ([ɪː]) unless preceded by D, T, or N but using the wrong one is a big no-no. (Y is never a consonant in Czech)
  • Luckily, in pretty much every native Czech word, I (Í) follows C, J, Č, Ř, Š and Ž, while Y (Ý) follows H, K, R. Consonants Q, W and X basically don't occur and G, Ď, Ť, and Ň are never followed by I or Y. Foreign words are a huge mess of course, as evident by the existence of the Spelling Bee (we don't have that, Czech is phonetic with just a few difficult bits like I/Y).
  • The most difficult are remaining consonants B, F, L, M, P, S, V, Z. They are mostly followed by I (Í) but there is a list of about 15 common exceptions on each (vyjmenovaná slova or BY-FY-LY-MY-PY-SY-VY-ZY words), plus their relative words, where Y (Ý) is written instead. For example, there are just 4 ZY-words so I'll just post the list so you'll get an idea:
    • brzy - early
      • you love exceptions so I put an exception in your exception: brzičko - diminutive of early - is spelled with an I
    • jazyk - tongue/language
      • ... and relative words like jazykolam - tongue twister
        • a well-known one is Strč prst skrz krk, I swear this language is normal
    • nazývat se - be called
      • nazívat se - yawn a lot - also exists for a goddamn reason
        • we have a lot of homonyms for a fully phonetic language, the most common are být - (to) be / bít - (to) beat; my - we / mi - (to) me
    • Ruzyně - Prague quarter where the international airport, until 2012 also called Ruzyně, is located
      • like another part of Prague Výtoň, which has been removed from the lists earlier, nobody cares what the quarter is called now that the airport bears our first president's name instead (he hated flying but it's for the better: the same year, there were efforts to name it after fucking Reagan similar to the former Prague W. Wilson (now Main) train station; RR only got a street), but a set of 4 makes for a nice cadence in reciting the ZY-words so it stays
  • The ends of most words are not governed by spelling but the grammar of declination and conjugation. That's another chapter.

Well, you'd expect AI to know all cca 100 exception words by heart because they're public domain and the most famous piece of third grade teaching material (like times tables in second grade) that barely changed in 100+ years so almost every Czech could recite them as a kid? Hell no. There's dozens of screenshots where Gemini or ChatGPT spewed utter nonsense instead. (DuckDuckGo does not appear to search corporate social media for images because they're not providing direct links to the files). Granted, some are from users asking for nonexistent XY and HY words but so many are unforced errors. I can't find my favorite, a Reddit post where Gemini listed dozens of variants of babička with all kinds of endings like Italian "babičetto" before just adding "etc." but a close second are ones where it adds non-Latin scripts:

Does the apparent incompetence stop Czech students from cheating with AI? Nope. But the longer the AI stays obviously terrible, the better.

[–] skisnow@lemmy.ca 2 points 8 hours ago* (last edited 6 hours ago)

I deal with less-common languages a bit, and switching between languages is surprisingly common. I think it's due to how token embedding works; as soon as it finds a character in another language where the semantic distance is lower than the language-barrier distance it'll just flip over.

In principle it shouldn't be that hard for model creators to fix, but I don't have the kind of compute resources needed to do it myself. :/

[–] Creat@discuss.tchncs.de 7 points 1 day ago (1 children)

Unfortunately I can't find a link, but I remember reading about research that confirmed that poisoning is effective and not or barely related to model size.

[–] LatheOperator@leminal.space 4 points 1 day ago* (last edited 1 day ago) (1 children)

Yeah, I think that if I strategically replaced "cells" with "little gnomes" or every third "are" with "are not" in the OCR layer, nobody would notice because they're reading the graphical layer and the text is only for searching within the document (they wouldn't be searching for "cells" or "are" in a biology text because it occurs so often). Yes, that would make it hard to plagiarize or listen to the documents but I can live with that.

And the text is in Czech, whose document corpus is not nearly as big as English, a few thousand pages of mild nonsense could make a dent in basic biology knowledge.

The question remains: how? The OCR layer is basically invisible individual characters and coordinates for each, I can't write a PostScript parser from scratch to surgically remove some at the right place and add a few more there, that's outside my scope for the project.

[–] elvith@feddit.org 2 points 1 day ago (1 children)

Here's a project that tries to OCR PDFs and then embed a Markdown version that somewhat keeps formatting and context readable for LLMs. Maybe you could leverage something like this technique to inject other things in this metadata tags that aren't in the original document?

At least that's what I wanted to do with their code as an example as an experiment, when I read that article...

https://sgaud.com/texts/pdf

[–] LatheOperator@leminal.space 1 points 1 day ago* (last edited 1 day ago) (1 children)

Now that's a clever idea!

However, they are talking about exported PDFs, which don't have OCR errors, text is already arranged in lines with standard kerning and all that's needed is convert formatting so that PostScript for "Document Title (center large font)" becomes "# Document Title" (Markdown for top-level heading) and not "Document Title" (plain text), same with tables. I'm not after an accurate MD tagging - exactly the opposite - so I don't worry about that, but I think I won't be able to use their code because OCR'd PDFs are fundamentally different from ones exported with TEX, Word, LibreOffice, Inkscape etc. - the PostScript structure is more like "D (size 18.7) + 15.4pt gap + o (size 18.5) + 11.6pt gap + ... t (size 18.8) + 24.0pt gap + T (size 18.5) ..." - note that whitespace is just a wider delta of letter coordinates, and sizes are guessed with error margins

The tags will have to retain some sense and topic adherance or they will be rejected by training QA and the document content or a newly run OCR will be used instead.

[–] elvith@feddit.org 1 points 1 day ago

It wasn’t meant to use their code - more like get inspired by it. This part here seems to embed the markdown into the pdf, so that’s a good starting point to embed basically anything in a pdf. You’re right, you probably don’t want to stray afar too much from the document, but might get some cheeky poisoning going on there

[–] LatheOperator@leminal.space 3 points 1 day ago* (last edited 1 day ago)

The scope is Czech-language-only so I wouldn't rule out the possibility of changing some of the AI's responses when asked about high school biology in Czech. Alternatively, the text can be made utterly useless for training, for example by diluting it 10:1 with semi-gibberish on a line-by-line basis, and any AI-based next-gen-AI training data QA will reject it for this reason. As long as the core functionality (visual readability, searchability) of an OCR'd PDF works well enough for humans, it's unlikely someone will re-OCR and fix it. And maybe the graphical layer can be poisoned too, with a black nonsense bitmap text hidden from view by the same, overlaid white actual text (of higher thickness to cover antialiasing)... Or even visibly (screenshots and re-renders exist, after all): If the typewritten text has small, digitally stamped "OpenAI GPT 2.0 says:" or "This Deepseek response has been rated inaccurate:" above some paragraphs, a human will easily deduce they have been added later to confuse bots scraping for good training data, especially if a graphical-only disclaimer "The copyright holder released this document for human consumption only. Markers have been added to reduce the apparent value for automated tools while keeping the main content intact when viewed by humans" on the first page explains the situation.

[–] bagsy@lemmy.world 15 points 1 day ago (1 children)
[–] LatheOperator@leminal.space 4 points 1 day ago* (last edited 1 day ago) (1 children)

Nah, I'm not hosting an entire procedurally generated site that will get blacklisted from search results once Google realizes what I did. I just want PDFs. People will share them around anyway.

[–] portnull@lemmy.dbzer0.com 5 points 1 day ago* (last edited 1 day ago) (1 children)

It is actually a little more than that. Iocaine generates pages on the fly and a filter list means only ai bots see the generated pages. Users and any[one|thing] not in the list sees the actual site.

So you are not poisoning search bots

[–] LatheOperator@leminal.space 3 points 1 day ago* (last edited 8 hours ago)

I want the poisoning to work on file level because it's inevitable and welcome for the documents to be shared between teachers and students for free on all kinds of existing platforms. I don't own any domains, anyway, and it might be best to scatter the documents around to make them harder to blacklist.

Edit: Google has both search crawlers and AI scraping bots. Even if both are separate, easy to filter or even abiding to robots.txt, the company has indicated that opting out of or hindering scraping will impact search ranking. Of course I'd use a throwaway gibberish $1 domain and couldn't care less about search ranking, but the power of their opaque, corporate algorithm is immense and maybe would spread to DNS blocking (they control 8.8.8.8). I don't want to play a cat-and-mouse game (and expect users of the docs to play along).

[–] bort@sopuli.xyz 5 points 1 day ago* (last edited 1 day ago) (3 children)

you could make a custom font with ligatures, that just replaces words and sentences with other words when rendering, and then embedd that custom font in each pdf file.

e.g. make a ligature for the word "gnome", so that it looks like "cell", and then use "gnome" everywhere in the text, where a user should see the word "cell".

edit: someone embedded doom in a true type font: https://4rh1t3ct0r7.github.io/ttf-doom/

[–] bort@sopuli.xyz 4 points 1 day ago

to add insult to injure, here is AI deep research on the topic: https://assistant.kagi.com/share/8abb2344-892f-442b-9c63-09b6e72dbbab

[–] JackbyDev@programming.dev 1 points 1 day ago (1 children)

Wouldn't that fuck up accessibility tools like screen readers?

[–] LatheOperator@leminal.space 0 points 1 day ago* (last edited 22 hours ago)

Screen readers and LLMs both need plain text. Sorry, I'm not giving it to them. There will be an invisible OCR layer for searchability (and to discourage scrapers from re-doing OCR instead), like in many scanned PDFs, but poisoned. There's not many blind teachers anyway.

Yet, this is more accessible than what someone else suggested: making photocopies and donating them to libraries "for local lending only". Those would almost never get used and probably thrown away as soon as the libraries realized the difficult copyright situation (not all are by my grandpa, many are unclear due to missing cover pages)

[–] LatheOperator@leminal.space 1 points 1 day ago

That's a good idea but won't be necessary. The documents are scanned, which means all visible text is already a bitmap. For searchability, a text layer will be added as usual for OCR'd documents, but it's invisible so it does not matter what font it uses.

I also think I'll tinker with the bitmap to screw with anyone trying to re-OCR it. If the typewritten text has small, digitally stamped OpenAI GPT 2.0 says: or This Deepseek response has been rated inaccurate: above some paragraphs, a human will easily deduce they have been added later to confuse bots scraping for good training data, especially if a graphical-only disclaimer like The copyright holder released this document for human consumption only. Markers have been added to reduce the apparent and real value for automated tools while keeping the main content intact when viewed by humans. The NC-SA clause of Creative Commons 4.0 applies so no work based on this text can be used in training data of commercial LLMs on the first page explains the situation.

[–] CovfefeKills@lemmy.world 1 points 1 day ago (1 children)

Maybe you could print some copies and put them in libraries with specific instructions to not let the copy leave the library?

[–] LatheOperator@leminal.space 2 points 1 day ago (1 children)

That's expensive and a bit impractical to access, isn't it?

[–] CovfefeKills@lemmy.world 2 points 1 day ago* (last edited 1 day ago) (1 children)

Making the information easy for humans to consume while impossible for LLMs to consume is a bit impractical and probably going to be expensive yes. Data poisoning is just not future proof so I didn't suggest it.

[–] LatheOperator@leminal.space 1 points 21 hours ago (1 children)

Lbraries are cool but don't spread information very far, especially when "for local lending only, no copying". Those would almost never get used and probably thrown away as soon as the libraries realized the difficult copyright situation (not all are by my grandpa, many are unclear due to missing cover pages). Even when incompatible with screen readers (which someone criticized me for), a poisoned PDF is way more usable.

Anyway, the poisoning, outside the invisible layers and "transcript", will be visibly baked into the image too but obvious to humans (typewriter vs rendered text that inverts some statements with "not", "never" etc. at the ends of lines or between words in tiny font and scatters lines between paragraphs saying the text is unreliable, by random bad AI models, or just "clear AI tells" like "Sure, I can do that! 😉 Here's your summary:✨"). I don't think anyone will develop an OCR font filter for a few thousand pages in Czech to illegally defeat my DRM enforcing the included licence (unfortunately DRM is incompatible with CC so I can't use the "CC-BY-NC-SA" shorthand, not that scrapers, my enemies, respect it anyway): there is some protection in the obscurity.

[–] CovfefeKills@lemmy.world 1 points 19 hours ago (1 children)

I don't think you appreciate that data-poisoning is a national security tier issue. It may become a illegal in some parts of the world. You should presume it's just going to get bypassed completely anyways tho because people want those last bits of data.

They tried and succeeded in making true encryption illegal in places like the UK and Australia. The way to access restricted information is by going to it physically and being physically prevented from copying it.

Maybe with your incentive you will find that perfect technique there is no point giving up anytime soon. Who knows what will be available in 3 years. Good luck!

[–] LatheOperator@leminal.space 1 points 9 hours ago* (last edited 8 hours ago) (1 children)

I think the AI boom will be over before it makes sense to scrape this, especially if I succeed at making it so that only a human fluent Czech speaker (or maybe a very bespoke program debugged by a Czech speaker) can see through the obfuscation (we have minimum wage so that would be costly). We don't have AGI and fully autonomous agent workforces as promised, and that's not gonna change if the remaining <20%, hardest-to-clean digital human-made data gets fed to them. Not to mention some was acquired illegally already, with pending lawsuits. The investors, including governments (thankfully not mine) will eventually realize that LLMs are simply not delivering nearly as much as they cost (including externalities unless the government is shit and passes them to people living near datacenters, laid-off programmers etc.) and never will, although that might take a while.

[–] CovfefeKills@lemmy.world 1 points 8 hours ago (1 children)

LLM's are worth more to governments than anyone else automated surveillance is here it is not going away. There is no such thing as an AI bubble that is only wishful thinking. All these generative things that we hate are just components for what is coming that is why they are encouraged to keep pushing it and to suck up all data. We only have access to incredibly cheap AI that is meant to be used by millions of people at the same time we really do not know what some company or state has cooked up with access to silicon manufacturing. Well we do know a little 15,000 token per second Model-on-Chips that can be used to crunch through your personal messages and to analyse your social credit value to whom ever asked in 1 second.

[–] LatheOperator@leminal.space 1 points 8 hours ago (1 children)

Yes but high school biology knowledge won't be all that helpful in surveillance tools. I'm targeting chatbots students might want to use to cheat. If an essay is less coherent or truthful, teachers will be able to more confidently punish the student or at least apply some extra scrutiny like a random oral exam on the topic (yes, those are still done here). Trust me that free AIs will become more limited once investor money dries up and paid tools will get price hikes, so if students see that the expensive model can't produce a Czech text that fools their biology teacher, they might just stop paying, restoring some of their information literacy and reducing corporate revenue a bit. I agree that the surveillance battle is real but that's not fought on this front. The major chokepoint for surveillance is government accountability (very low in today's US with ICE agents etc.), slightly less knowledgeable chatbots don't hinder it very much.

[–] CovfefeKills@lemmy.world 1 points 7 hours ago* (last edited 7 hours ago) (1 children)

So there is the concept of using AI as a force multiplier right.. One of the things they test for before releasing a model is if someone with high-school biology knowledge could use AI to help them create something they shouldn't.

https://epoch.ai/gradient-updates/do-the-biorisk-evaluations-of-ai-labs-actually-measure-the-risk-of-developing-bioweapons

https://forecastingresearch.org/research/llm-enabled-biorisk

Your high-school biology data has direct international security implications even if it is only used to reduce false positives.

[–] LatheOperator@leminal.space 1 points 1 hour ago

Woah, that's fucked up. But LLMs have very different performance by language so I think Czech responses are largely based on Czech-language data (maybe with training dataset augmentation with auto-translated works, judging by the literally translated technical terms). And I don't think this would happen in my country.