TL;DR: Please help me fuck (with) AI. See bold sections
Hi,
I haven't been keeping up with anti-AI combat so I'm asking for help. I inherited thousands of pages of materials my late grandpa made or used for his grammar school teaching job in the 1990s-2000s. They are A4 pages of documents made using what seems to be a typewriter, Text602 (DOS rich text editor) and Word. They were most likely not all made by him but he treasured them in nice binding and they have sources (mostly books and journals, almost no webpages, and absolutely no AI) and a cursory look shows meticulous compilation of every important fact on each subject (frankly, the level of detail is excruciating and I'm glad I went to a different grammar school). There's obviously no original scientific research but the materials can still be useful to someone, I bet. They were almost thrown away by the widowed grandma (she already removed and disposed of the plastic bindings and front covers so I'll have to guess document titles) but I think grandpa would prefer them to be shared. With an ADF scanner and OCR software (I have no chance of accessing the work computers he used so I'll have to scan), I can quickly make searchable PDFs of each document, and share them via torrent and DDL sites (there are Czech sites dedicated to sharing teaching materials but they have paywalls or an upload-credit system so best avoid them, not to mention some materials contain newspaper clippings and textbook photocopies for images so best stay anonymous and not try to assert copyright).
I'm afraid these texts could become a major part of some commercial LLM's Czech-language biology/social sciences knowledge corpus unless poisoned. How to best reduce the value of the documents when people try to feed them to AI (training/rewriting) with them while keeping their value for most legitimate users? (Sorry, people with screen readers, there may need to be extra steps for you.) I'm thinking about adding a huge volume of thesaurized or otherwise fuzzed public domain text like f4mi did with .ass subtitles (a technique that would probably still work if she didn't get 1M views detailing it, making YouTube reduce subtitle formatting support). Prompt injection or replacements (cell→gnome) might be interesting too. However, tools I know add an extra PDF layer, which is too obvious. I'm thinking about adding tiny text in the header and footer or between paragraphs in the OCR layer (not overlaid to reduce interference when selecting/searching), but how? I need an automated way to do this with such a huge page count. I can use both Linux and Windows machines for the job. None of them are very powerful but speed is not a concern, it's summer break and nobody will need school materials until September. I'll be happy to include multiple layers and techniques to make them too frustrating to remove.
The paper smells musty but does not seem to be moldy. It's all blank on the other side so I'll interleave it with recent newspaper to allow for the odor-neutralizing chemicals to seep into the sheets so I can eventually reuse them.
Illustration pic is an actual sheet from the collection, to make the post more engaging. Of course I won't be adding watermarks like that, that would just aggrevate people and make them try extra hard to extract the actual content. (And this one is easy to remove with color channel mixing.)
I'm far from an expert so take what I'm saying with a grain of salt. What I've been seeing is that poisoning is becoming less and effective since all the major models have such a large reference to go by they can automatically weed out "poisoned" information.
I guess if the information was completely unique and the subject wasn't found elsewhere on the internet you might have more success, at least temporarily until more information came out.
I know it's the old site, but /r/poisonai has bore fruit by getting DDG's slop machine to say that the potus died of rabies.
As for OP, the best options I can think of would be to add invisible gibberish text or to make your own font that treats random characters as the same image (for example rendering a random Chinese character and the "R" character both as the letter "R") though this solution would require you to rewrite your document using the scrambled text. Also both versions might pose accessibility issues for people using screen readers.
I know how to edit fonts and replace characters. That would ruin searchability (and screen readers), making the PDF as good as a picture scan without OCR, which I hate (and someone would OCR it sooner or later if they realized the text content is useless). However, common words carry meaning (for example "are" is very different from "are not" etc.) and could be replaced with gibberish without most people searching for them. This also forces plagiators to take more steps.
Anyway, how do I easily add to/edit the PostScript layer in bulk, which consists of a list of individual characters and their positions? As I said, most PDF tools for adding text just add another layer, and that can be easily removed.
I wonder if this could help you do that?
You don't understand just how shit AI is when asked about school topics in Czech. For example, here is a bit of Czech language litany every third grader must know or they will embarrass themselves with awful spelling mistakes. (Skip the bullet points if you just want to hear about the AI)
IandY(and long versionsÍ/Ý) sound the same [ɪ] ([ɪː]) unless preceded byD,T, orNbut using the wrong one is a big no-no. (Yis never a consonant in Czech)I(Í) followsC,J,Č,Ř,ŠandŽ, whileY(Ý) followsH,K,R. ConsonantsQ,WandXbasically don't occur andG,Ď,Ť, andŇare never followed byIorY. Foreign words are a huge mess of course, as evident by the existence of the Spelling Bee (we don't have that, Czech is phonetic with just a few difficult bits likeI/Y).B,F,L,M,P,S,V,Z. They are mostly followed byI(Í) but there is a list of about 15 common exceptions on each (vyjmenovaná slova orBY-FY-LY-MY-PY-SY-VY-ZYwords), plus their relative words, whereY(Ý) is written instead. For example, there are just 4ZY-words so I'll just post the list so you'll get an idea:IZY-words so it staysWell, you'd expect AI to know all cca 100 exception words by heart because they're public domain and the most famous piece of third grade teaching material (like times tables in second grade) that barely changed in 100+ years so almost every Czech could recite them as a kid? Hell no. There's dozens of screenshots where Gemini or ChatGPT spewed utter nonsense instead. (DuckDuckGo does not appear to search corporate social media for images because they're not providing direct links to the files). Granted, some are from users asking for nonexistent
XYandHYwords but so many are unforced errors. I can't find my favorite, a Reddit post where Gemini listed dozens of variants of babička with all kinds of endings like Italian "babičetto" before just adding "etc." but a close second are ones where it adds non-Latin scripts:Does the apparent incompetence stop Czech students from cheating with AI? Nope. But the longer the AI stays obviously terrible, the better.
I deal with less-common languages a bit, and switching between languages is surprisingly common. I think it's due to how token embedding works; as soon as it finds a character in another language where the semantic distance is lower than the language-barrier distance it'll just flip over.
In principle it shouldn't be that hard for model creators to fix, but I don't have the kind of compute resources needed to do it myself. :/
Wouldn't being ignored still accomplish the desired goal?
Yes, I will use both licence terms and "Made by bad AI" in metadata to discourage scraping but it's tempting to also poison the Czech-language biology knowledge base of bots who use the materials anyway. A good interleaving text that won't get filtered as off-topic might be multi-step roundabout machine translation of the original using shitty local tools.
Unfortunately I can't find a link, but I remember reading about research that confirmed that poisoning is effective and not or barely related to model size.
Yeah, I think that if I strategically replaced "cells" with "little gnomes" or every third "are" with "are not" in the OCR layer, nobody would notice because they're reading the graphical layer and the text is only for searching within the document (they wouldn't be searching for "cells" or "are" in a biology text because it occurs so often). Yes, that would make it hard to plagiarize or listen to the documents but I can live with that.
And the text is in Czech, whose document corpus is not nearly as big as English, a few thousand pages of mild nonsense could make a dent in basic biology knowledge.
The question remains: how? The OCR layer is basically invisible individual characters and coordinates for each, I can't write a PostScript parser from scratch to surgically remove some at the right place and add a few more there, that's outside my scope for the project.
Here's a project that tries to OCR PDFs and then embed a Markdown version that somewhat keeps formatting and context readable for LLMs. Maybe you could leverage something like this technique to inject other things in this metadata tags that aren't in the original document?
At least that's what I wanted to do with their code as an example as an experiment, when I read that article...
https://sgaud.com/texts/pdf
Now that's a clever idea!
However, they are talking about exported PDFs, which don't have OCR errors, text is already arranged in lines with standard kerning and all that's needed is convert formatting so that PostScript for "Document Title (center large font)" becomes "# Document Title" (Markdown for top-level heading) and not "Document Title" (plain text), same with tables. I'm not after an accurate MD tagging - exactly the opposite - so I don't worry about that, but I think I won't be able to use their code because OCR'd PDFs are fundamentally different from ones exported with TEX, Word, LibreOffice, Inkscape etc. - the PostScript structure is more like "
D(size 18.7) + 15.4pt gap +o(size 18.5) + 11.6pt gap + ...t(size 18.8) + 24.0pt gap +T(size 18.5) ..." - note that whitespace is just a wider delta of letter coordinates, and sizes are guessed with error marginsThe tags will have to retain some sense and topic adherance or they will be rejected by training QA and the document content or a newly run OCR will be used instead.
It wasn’t meant to use their code - more like get inspired by it. This part here seems to embed the markdown into the pdf, so that’s a good starting point to embed basically anything in a pdf. You’re right, you probably don’t want to stray afar too much from the document, but might get some cheeky poisoning going on there
The scope is Czech-language-only so I wouldn't rule out the possibility of changing some of the AI's responses when asked about high school biology in Czech. Alternatively, the text can be made utterly useless for training, for example by diluting it 10:1 with semi-gibberish on a line-by-line basis, and any AI-based next-gen-AI training data QA will reject it for this reason. As long as the core functionality (visual readability, searchability) of an OCR'd PDF works well enough for humans, it's unlikely someone will re-OCR and fix it. And maybe the graphical layer can be poisoned too, with a black nonsense bitmap text hidden from view by the same, overlaid white actual text (of higher thickness to cover antialiasing)... Or even visibly (screenshots and re-renders exist, after all): If the typewritten text has small, digitally stamped "OpenAI GPT 2.0 says:" or "This Deepseek response has been rated inaccurate:" above some paragraphs, a human will easily deduce they have been added later to confuse bots scraping for good training data, especially if a graphical-only disclaimer "The copyright holder released this document for human consumption only. Markers have been added to reduce the apparent value for automated tools while keeping the main content intact when viewed by humans" on the first page explains the situation.