SLOP

Chapter Sixteen

The Counterfeit War

In late January 2024, a finance employee in the Hong Kong office of a multinational firm received an email from the company’s chief financial officer in London requesting a confidential transaction. He suspected phishing (the request was odd, the secrecy odder) and he did what a careful person is supposed to do: he declined to act on a document and asked for people, arranging a video conference with his superiors. The CFO appeared on screen, recognizably himself, voice and face and manner. Several other colleagues the employee knew joined the call, also recognizably themselves. Reassured, he had confronted the witnesses. Next, he executed fifteen transfers totaling about twenty-five million dollars.[1] Every other person on that call was synthetic: faces and voices reconstructed from publicly available footage, puppeted in real time. Hong Kong police emphasized the detail that matters for this book: the scam worked by defeating his verification, leaving his skepticism fully intact. He ran the check that four centuries of practice recommend (get the person in the room, look at the face, hear the voice) and the check returned a confident, catastrophic yes.

The previous chapter ended by claiming that the witness has never been more valuable while the appearance of a witness has never been cheaper. The Hong Kong call is what that sentence looks like operationally, and it sets the question the rest of this chapter has to answer: whether the rails that anchor testimony to real humans can hold under what is now aimed at them, or whether the human signature gets forged faster than it can be checked.

A mark becomes worth faking exactly when it becomes worth trusting, so the same repricing that made the staked witness valuable is what bankrolls the industry now devoted to forging her. The premium on the real and the war against it are paid out of one pocket. Any signal this book could have named as the new scarce thing would, by being named, have painted the same target on its own back.

The panic of the stakeless answer. A parent stands in a kitchen at 3 a.m. with a sick child and a bottle of medication. The label is smeared; the dosage is unclear. They search, and the search returns a fluent, authoritative-sounding paragraph explaining the precise pediatric dose. It looks like a medical fact. But there is no one behind it. No doctor has signed it; no pharmacist has checked it against this specific child’s weight; no one will be sued or stripped of a license if the decimal point is in the wrong place. This is the “leaning” moment: the point where information must become testimony because a life is at stake. In that moment, the parent wants past intelligence to a present, answerable human body, someone they can call, someone who answers for the promise. The horror of the slop-filled world is the suspicion that when you lean, there is nothing there.

The counterfeiter’s arsenal deserves to be inventoried first, at full strength. Faces and voices: solved, as Hong Kong demonstrates; the grandmother wiring bail money to a cloned grandchild’s voice was a novelty in 2023 and a category of routine fraud by 2025.[2] Track records: purchasable. Aged social accounts trade openly, abandoned handles with years of plausible history can be bought like used cars, and a language model can backfill a decade of consistent posts, papers, and reviews in an afternoon; chapter five’s “vision visible across a body of work” is itself generatable, retroactively, at scale. Institutional provenance: rentable, as the Drew Ortiz affair showed; the masthead vouches and the masthead lies. Community confirmation: synthesizable. The automated swarm, what researchers call a Sybil swarm, is a community that checks, as far as any distant observer can tell, and reviews, citations, and witnesses can be summoned by the thousand.

That the arsenal works was proven, unethically, by a university. Between late 2024 and early 2025 researchers at the University of Zurich loosed AI accounts into Reddit’s r/changemyview, a forum built for argument, without telling anyone, and had the models pose as people: a trauma counselor, an abuse survivor, a man arguing against his own apparent interests, each tuned with whatever the system could infer about whoever it was answering. The synthetic personas changed minds at three to six times the rate of the human commenters they were hidden among.[3] The study was a violation, and its authors, shamed, declined to publish; but it measured what this chapter had only asserted, that counterfeit testimony does not merely pass, it out-persuades the real thing, because the costly signal it forges, the wounded confider, the credentialed witness, is precisely the signal people are built to trust, now produced at no cost and aimed with a precision no human arguer could match. Geoffrey Hinton states the general case without flinching: the models are already nearly as good as people at persuasion and will soon be better, and a thing persuasive enough needs no hands to be dangerous, only a voice.[4] What keeps that from being the end of the argument is the one thing r/changemyview did not have. It was text, anonymous, unanchored, a place with no body to bring into the room and no afternoon anyone had to spend to be believed. The counterfeit wins exactly where the testimony was already disembodied, and loses its grip the moment a claim must bottom out in someone who can be found.

Then comes the hard objection, the Distributed Veto. If we build verification rails (cryptographic keys, reputation scores, decentralized ledgers) can’t the machines simply collude to spoof those too? A Sybil swarm doesn’t just supply the fake news; it supplies the ten thousand fake “witnesses” who confirm it, the fake “fact-checkers” who verify the keys, and the fake “historians” who cite it ten years later. This is the nightmare of bot-collusion: a hall of mirrors where every surface of checking reflects the original lie.

The only escape from the Distributed Veto is a non-forkable anchor. And the only non-forkable anchor we have is the singular, mortal human body. You can fork a piece of code; you can fork a database; you can fork a digital identity. You cannot fork a body in a room. Its presence in one place is its absence from every other. Its time is consumed in the spending. The singular body is the only register of identity where the supply per person is fixed at exactly one, and where the cost of being wrong can be landed on a specific, aging, locatable set of coordinates. The verification rails only work if they bottom out in flesh.

The siege is asymmetric. The counterfeiter only needs to succeed once to cast doubt on everything. If a single video call can be seamlessly deepfaked to siphon twenty-five million dollars, then the credibility of every video call is compromised. The defender, by contrast, must secure every connection, every single time, to keep the channel trusted. The fight is lopsided because trust is fragile: it is destroyed at the weakest link, but built only in the aggregate. And in this war of attrition, the one asset that cannot be manufactured or scaled to overwhelm the system is the scarce, physical life of the witness.

And beneath all of it, the regress. You verify the witness by her record; the record lives in archives; the archives are content; content is what the machines generate. Verification, pursued naively, has no floor.[5]

The common generative myth is that the collapsing cost of video deepfakes, from expensive Hollywood-grade effects to zero-cost consumer tools, will eventually make all video worthless as evidence. This is the second great panic: that as the cost of synthesis drops to zero, the evidentiary value of the recorded image must collapse. The myth assumes that as the cost of synthesis drops, the value of the image stays constant. The opposite holds. As the cost of synthesis drops, the market simply shifts its trust to the one thing that stays expensive: the unmediated, checkable, present body. Belief is narrowing to one channel: the things anchored to a human life.

The state-sponsored counterfeit is the limit case. A state can afford the signal. A state can run a counterfeit correspondent: years of plausible dispatches, a face, awards, sources, all at a cost that is, for a state, a rounding error. Expensive fakery by resourced adversaries goes past evading the filter to weaponizing it, because audiences trained to trust costly signals trust the well-funded fake more. But even the state-sponsored ghost has a body-shaped hole in it: bring it into the same room as its detractors for cross-examination and the operator behind the curtain stands exposed. The body is the trap street of the human condition.

And the machine driving the flood has no stake in the distinction the regress depends on. It is indifferent to whether what it generates corresponds to anything: a parade that never happened, a correspondent who never lived, a study never run, each assembles from the same statistics as the real article, at the same cost, with the same fluency. Borges imagined a Library of Babel holding every possible book,[6] the overwhelming majority of them gibberish wearing the shape of sense; the machines built the wing that holds every plausible book, and stocked it faster than anyone could shelve the true ones beside the false. Existence (the one property a counterfeit cannot supply from the inside, because no arrangement of words reaches out and touches the world it describes) is exactly what the rails below are built to re-anchor. The whole defense comes down to forcing the chain to bottom out somewhere the model cannot reach: in something that happened.

In early 2021, a TikTok account called @deeptomcruise posted three short videos: a man who looked and sounded exactly like Tom Cruise doing coin tricks, playing golf, failing to open a lollipop wrapper. The account ran bare: no byline, no disclaimer, nothing that conceded the trick, just the face and voice of one of the most recognizable people alive, doing ordinary things in a well-lit room. It accumulated eleven million views in the first week, and the coverage that followed had a quality of barely suppressed hysteria: if this was possible now, on consumer hardware, operated by one visual effects artist, what would be possible in two years? The consensus answer was: the complete collapse of video as evidence. Courts would stop trusting footage; elections would be swung by fabricated statements; anyone could be made to say anything.

The panic was understandable, but it misread the mechanism. DeepTom Cruise worked because it was good, and in 2021 good still meant expensive: its maker spent weeks on it, and the face-swap rode on a convincing physical performance underneath, a double who matched Cruise’s mannerisms closely enough that the composite held. The synthesis was impressive; the labor was the constraint. The panic assumed the labor would simply vanish and the fakes would flood in all at once. What actually happened, for a few years, was subtler: the bottleneck moved rather than disappeared. Faces got easy while clean voices, plausible motion, and the cost of nailing one specific person rather than a generic one held the line, so that most bad actors were still better served by a forged document or a wire-transfer email. That reprieve is over, and so is any defense that leaned on it. The argument that follows does not need the fakes to stay expensive, or to stay detectable, or to stay anything at all.[7]

The current state, as of 2026, is both more advanced and less apocalyptic than the 2021 panic predicted. On pure quality, the panic has been vindicated. A synthetic still image is trivial. A voice cloned from a few seconds of audio fools the family that raised it. Live video of the kind the Hong Kong employee saw has become routine, and the prompt-to-clip tools sharpen every quarter. The line of indistinguishable-to-a-careful-observer, which in 2021 looked like a frontier years off, has for practical purposes been crossed.[8] If the fear had been about pixels, it would already have come true.

The fear ran deeper than pixels. The 2021 prophecy was civilizational: video would collapse as evidence, an election would be swung by fabricated clips, shared reality itself would dissolve. That has largely been spared us, for a reason that has everything to do with structure and nothing to do with the fakes staying bad. A fabricated clip and a fabricated event are different orders of problem. A clip is one surface. An event is a web: independent witnesses, multiple angles, physical aftermath, records kept by people with no connection to one another, the whole apparatus a real occurrence throws off for free and a synthetic one would have to counterfeit in coordination, all at once, without a single seam showing. The larger and more consequential is the claimed event, the denser that corroboration has to be, and the web is the one thing the model cannot generate, because faking it would mean reaching into the world and changing it rather than changing a picture of it. This is why the frauds that actually work are the intimate ones, the situations with no web to survive: the grandchild on the phone, the colleague on the call, the private image nobody is positioned to contradict. And it is why the cheaper and better synthesis gets, the more those intimate frauds scale, climbing from the targeted operation that took weeks and returned twenty-five million dollars to the opportunistic one that takes an afternoon and returns twenty-five hundred, run on volume. The web shows up in miniature under any viral clip: the comment section is a rolling, adversarial corroboration layer, and a fabricated video of a public event is often debunked there within minutes, by someone who was present, who knows the place, or who catches the seam the render left behind. The fakes that survive are the ones posted where no such crowd can assemble to contradict them.

So the threshold that actually governs this war lay elsewhere all along, past “indistinguishable to a careful observer.” That has been crossed, and it settled less than anyone expected. What governs outcomes is whether the fake can supply what the claim leans on, and every claim that carries real weight leans on an answerable presence beyond the synthesis’s reach: a source who can be called back, a body that can be put in a room, a person who vouches and can be ruined for vouching wrong. A detection industry did arise to police the pixels (provenance standards, classifier tools, the public sites that will now score a clip’s odds of being machine-made), and it helps at the margin. But detection is an arms race the defenders can afford to lose at the margin, because their real fallback is older and unsynthesizable. You can fake a face. You cannot fake a witness who will stand in the room and answer for what she saw, and you cannot fake the world that would have seen the event if it had happened.

How the defense actually holds is the rest of this chapter, and it rests on one structural fact that sounds too small to carry the weight put on it: the defender does not have to win everywhere. It has to win at the anchor points. The counterfeiter’s regress is only fatal if every link in the chain of attestation is symmetric, if checking a claim always means consulting more claims. The entire engineering and institutional response of the last several years amounts to one strategy, pursued on four fronts: drive enough asymmetry into the chain that somewhere, at the bottom, a claim is anchored to something that is not a claim at all: a piece of physics, a living body, an act that cannot be performed twice.

The first front is cryptographic provenance. In October 2023 Leica shipped the M11-P, the first camera that signs its photographs at the moment of capture: a dedicated chip seals into each file a tamper-evident record of when, where, and by what device the image was made, under a standard called C2PA developed by a coalition (Adobe, Microsoft, the BBC, OpenAI, camera makers) that grasped the stakes early.[9] The signature does not say the photograph is true. It says a specific sensor formed this image from light at this time, and every subsequent edit is logged or detectable. Understand what this does to the regress: it bottoms out. The chain of custody terminates in silicon physics rather than in another assertion. Newsrooms have begun adopting it; the standard is spreading through professional capture hardware the way the watermark spread through banknotes, and with the same honest limitation: provenance rails authenticate capture, never content. A signed photograph of a staged scene is a perfectly authenticated lie. The rails shrink the counterfeit war to the oldest battlefield, what was actually in front of the lens. That is shrinkage worth having, and nothing more.[10]

The second front is proof of personhood, and its very existence is this book’s argument wearing engineering clothes. The CAPTCHA, the web’s twenty-year-old ritual for distinguishing humans from machines, is dead; researchers at UC Irvine showed bots solving the leading tests in under a second at near-perfect accuracy while humans took fifteen seconds and failed a third of the time, and an ETH Zurich team later ran the table on Google’s system outright.[11] The successor projects have a desperate physicality that would have seemed dystopian satire a decade ago: a company co-founded by Sam Altman deploying mirrored orbs that scan human irises (fifteen million enrolled by late 2025)[12] to issue cryptographic credentials whose sole content is one live human, exactly once. Do not mistake that orb for the thing the argument predicts. It is a contested datapoint, not a vindication. A single company holding the biometric registry of every human eyeball is a centralized, seizable node, the precise structure chapter fourteen warned against: a checking apparatus owned by one party, with no exit and no independent adjudication, hype-adjacent and unproven. Run it through the book’s own test and it fails the way any captured checker fails: when the apparatus that verifies is owned by a single power, with no exit and no independent adjudication, it can no longer be trusted to catch that power’s own abuses (the failure mode chapter fourteen sets out in detail). What the orb registers, against itself, is not that this implementation is right but that the market has located the missing certificate, that a particular digital act traces to a particular singular body, and is now fighting, badly and centrally for now, over who gets to issue it. The information economy, having spent thirty years abstracting away from bodies, is paying any price to re-attach itself to them. Whether the issuer that wins is one orb company or a distributed mesh that nobody can seize is exactly the fight, and the book is on the side of the mesh.

The third front is the oldest: institutions are quietly re-imposing presence. The notary’s requirement of “personal appearance” survived remote technology by redefinition rather than surrender: the appearance moved on-camera, with credential checks layered on, and the principle held that some attestations require confronting a person.[13] Courts have shown no appetite for relaxing Crawford; if anything, the deepfake era is hardening the instinct behind it. Banks and law firms burned by synthetic calls are reinstituting callback rituals and in-person signing ceremonies for large transfers. The Hong Kong heist’s lesson, learned at twenty-five million dollars a seat, is that the video call has been demoted from verification to hearsay. High-trust hiring, which drifted onto video through the remote-work years, is drifting back toward an in-person final round. All of this runs on hard economics, the experiential premium’s clear-eyed twin: when every mediated channel becomes spoofable, unmediated co-presence becomes the verification of last resort, and its price, in time, in travel, in friction, stops looking like waste and starts looking like what it always was: the cost of certainty about who you are dealing with.

The fourth front has no hardware at all, and it is the one the philosopher’s objection underestimates. Longitudinal trust, the slow accumulation of a record before an audience that keeps score, can be counterfeited retroactively, as I conceded; a synthetic decade of archives can be wired into existence. What cannot be synthesized is that record’s forward behavior, because going forward, a real staked identity and a counterfeit one face different cost structures. The real correspondent will sometimes report against her own side’s interest, correct herself expensively, pass up the profitable story that doesn’t check out, because her stake makes those choices rational. The counterfeit’s operator faces the opposite incentives, and over a long enough sequence of choices the divergence becomes statistical, then visible, then notorious. It is an uncomfortable defense: slow, working in aggregate rather than in any single case, and dependent on what loop two has been eroding, audiences that keep score. But it is why the state-funded fake correspondent, history’s actual specimens included, keeps getting caught: forensic analysis of any one dispatch matters less than the accumulating improbability of a record that never pays its own costs. Counterfeiting a witness is cheap. Operating one, sustaining the cost-bearing behavior of a staked person indefinitely under adversarial observation, approaches the cost of simply being one. The signal’s defense always rested on economics rather than impossibility: fakes are unprofitable to maintain, and the maintenance is where they die.

One more enemy belongs on this battlefield map, and it is a domestic one. When stakes themselves become the priced good, the market will supply performed stakes: the pundit who is lucratively, theatrically wrong; the manufactured vulnerability of the influencer; controversy engineered to simulate the courage of commitment. The arbitrage is real and already industrialized: being memorably wrong in front of millions who don’t keep score pays better than being quietly right in front of hundreds who do. The defense here is unglamorous and decisive: the stake is only as real as the audience’s bookkeeping. Exposure before scorekeepers is a stake; exposure before spectators is content. Readers who want their trust to mean something have exactly one lever, and it is the ledger: follow the people whose errors are recorded, by themselves or by a community they cannot escape, and treat the unaccountable theatrics of risk as what they are, which is slop with adrenaline.

The logic underlying all four fronts is older than any of them, and a detour through cartography makes it legible.

In 1930, two cartographers at General Drafting Company invented a town. The intersection they chose was a dirt-road crossing in the Catskills, Delaware County, New York, the kind of nothing place that exists in a hundred counties, where two lines cross and nobody lives. They gave it a name built from their initials: Otto G. Lindberg and Ernest Alpers, scrambled into Agloe. They put it on their map. Then they waited.

The logic was simple and had been operating in reference works for decades before anyone gave it a name. If your dictionary contains a word that does not exist, and your competitor’s dictionary also contains that word, the copying is proved. Not alleged, not suspected. Proved, because the only way to inherit a fabrication is to have copied the source of the fabrication. The copyright trap is a species of argument whose whole force comes from its impossibility in the natural world. Nobody independently invents the same fake. The fake is the fingerprint.

Agloe worked. In the 1950s, Rand McNally published a map that included Agloe, New York, and General Drafting had its evidence. Except: Rand McNally said the place was real. And by then it almost was. Because enough maps had shown the crossing, and enough travelers had gone looking for it, someone had built a general store there and named it after the town the store was supposedly in. The copyright trap had bootstrapped a community into existence. The ghost became a resident. The fake address had accrued a history of people showing up, and in that act of showing up, the address became genuine. The forgery authenticated itself through use.

The New Oxford American Dictionary did something similar in 2001, when one of its editors, Christine Lindberg, inserted a word: esquivalience, defined as “the wilful avoidance of one’s official responsibilities.” No such word existed in English. It was placed in the dictionary to mark it, so that if the word appeared elsewhere, the trail led home. It worked: Dictionary.com later ran the entry, citing Webster’s New Millennium as its source. The fake had traveled. The track was the proof.[14]

Trap streets, paper towns, ghost words: the technique is old, and its logic is always the same. Where the thing itself cannot be verified, verification moves to the trace. The mark left behind by presence becomes the evidence of presence. The cartographers knew perfectly well which towns they had invented; their own map was never in doubt. The trap was for the reader of the copy: the one who, having never been to Delaware County, could evaluate the map only by inheriting the fabrication that proved the map borrowed its bones from another.

That structure is the detection grammar of this moment, being reinvented everywhere at once.

In January 2024, researchers at the University of Chicago released Nightshade, a tool that allows artists to add invisible perturbations to images before posting them online, perturbations that leave the image untouched to a human eye while corrupting the model that trains on it. Tag an image of a dog with Nightshade and the model that scrapes it learns, at the weight level, that dogs look like cats. The effect is cumulative and difficult to reverse; once enough poisoned images enter a training corpus, the model’s outputs degrade in ways that compound. The artist cannot stop her work from being scraped. She can make the scraping expensive to the scraper. The image looks the same. The trace it leaves is not.[15]

The same month, academic researchers formalized a technique they called DoPE (Decoy Oriented Perturbation Encapsulation), which embeds invisible instructions into assignment documents at the level the PDF renders to a machine but not to a human eye. A professor using DoPE publishes an assignment that looks, to a student reading it, like an ordinary question set. But the version an AI model parses contains additional instructions invisible to the human: secondary tasks, contradictory directives, canary phrases the AI will reproduce in its response. A student who submits unread AI output carries a watermark they never saw. The technique reported a 91.4 percent detection rate in early tests, and that number is a moving target moving the wrong way: it holds only against models naive enough to obey an instruction buried in a document and students immature enough not to check their work. The frontier models are already being trained to notice such instructions and ignore them. The specific trick has a short life. What does not expire is what it reaches for. It does not evaluate the quality of the work; it asks the work to prove it was made.[16]

In parallel, watermarking tools for text and image models have been arriving at scale. The mechanism, when it works, is statistical: the model is trained or prompted to make imperceptibly slight preference choices at the word or pixel level, choices that encode a signature no single sentence reveals but that emerge with high confidence across a document. Like the paper town, the signal is invisible in any local examination and unmistakable across a corpus. Researchers have shown that a model fine-tuned on as little as five percent watermarked text carries detectable traces at a p-value below one in a hundred thousand.[17] This is a narrower and stronger claim than catching whether a given paragraph is machine-written, which on text alone stays close to a coin flip; what is detected here is radioactivity, the statistical residue a watermarked corpus leaves behind in any model later trained on it. The watermark lives below the level of any statement the model makes; it is a habit the training imposed. These signals are real and fragile in the same breath: pass a paraphrase or a second model over the text and the watermark washes away. As tactics, the trap and the watermark are an arms race the defender mostly loses, the same way pixel-detection loses to better pixels. What survives the arms race is not any one trick but the logic underneath all of them.

This is the oldest epistemology there is. The fingerprint is a trace, an argument’s silent cousin. DNA evidence is the presence of a molecule in a place it has no business being. The whole forensic tradition is the science of reading the past from what the past left behind.[18] What is new is that the need for this logic has now spread from crime scenes into reading assignments, into digital archives, into the pixel-level physics of an artist’s released work.

And the paper town logic carries, underneath all of it, a specific philosophical claim. The paper town verifies one thing only: that the map was touched by a particular hand. Its truth stays an open question. The cartographers knew where they were; the trap was for the copyist. In the same way, watermarked text does not prove accuracy. Nightshade does not prove the image was good. DoPE does not prove the assignment was worth doing. They prove contact. They prove that something passed through a specific process, left a specific mark, came from a particular origin. The test has moved from the content to the chain of custody.

Which is the same move testimony has always required, just made visible by the emergency. You were never evaluating the witness by the quality of her sentences. You were asking where she stood, what she saw, what she had to lose by being wrong. The paper town is evidence of presence. The reproduction of the paper town is evidence of absence. The machine copied Agloe because it copies everything, indifferently, without having been anywhere. The fingerprint it cannot leave is the only one that matters: the one that proves a particular body was at a particular crossing on a particular day and put down roots because someone, having no other reason to be there, had decided to stay.

I promised falsifiable predictions partly because the argument implies them and a book preaching epistemic exposure should practice it, and partly because I expect to be wrong about at least one, and finding out which will teach where this framework bends.

First: cryptographic capture credentials become a professional default, with major wire services and news organizations requiring them for submitted photo and video, and the unsigned image moving from normal to anomalous in professional contexts, the way the unencrypted website did in the 2010s.

Second: at least one major platform makes verified personhood a precondition for monetization (not for speech, but for getting paid), because advertiser money will demand human audiences once synthetic engagement passes an undeniable threshold. Spotify’s 2025 AI-music protections are an early, partial instance of the same logic: a spam filter that declines to recommend mass-uploaded synthetic tracks, plus an AI-disclosure standard, drawing a first line between content a platform will serve and pay out on and content it will not.[19]

Third: the in-person premium becomes a visible line item across the economy (verification rituals, signing ceremonies, final-round interviews, high-stakes medicine, live performance), growing faster than inflation, and a measurable “presence sector” gets named by economists and starts appearing in earnings calls.

Fourth, the one I most want to be wrong about: a major public deception will succeed through the new provenance rails rather than around them: a signed, credentialed, perfectly authenticated falsehood, and the resulting crisis will teach, expensively, the lesson this chapter has tried to teach cheaply: that the rails authenticate capture and identity, never truth, and that no infrastructure retires the need for staked human judgment about what the authenticated thing means.

Fifth: courts do not bend, and presence requirements expand rather than relax. No appellate court carves out a deepfake-era exception that lets unconfronted recorded testimony stand in for a live witness; instead a generation of synthetic evidence makes the Confrontation Clause’s insistence on the present, examinable body look less like an eighteenth-century relic than the constitutional order’s deepest piece of foresight, and in-person requirements creep back into domains (contracts, wills, identity verification) that had spent decades shedding them.

If most of these fail, if the counterfeits win the anchor points and signed lies and synthetic persons overwhelm the bookkeeping, then the honest conclusion will be that testimony’s price collapsed with everything else’s, and this book documented a scarcity that lasted one technological generation. I do not believe that, and the next chapter is part of why: the repricing has already run ahead of any forecast. In the markets where presence is bought and sold (concert halls, vinyl pressing plants, hotel ballrooms, pilgrimage routes) it has already happened, in numbers large enough to show up in a central bank’s economic reporting. The war over counterfeit witness is undecided. The premium on the real thing, meanwhile, is already being paid.

Notes (19)

  1. The firm was Arup. Late January 2024; Hong Kong police announced the case in February 2024. CNN, 2024. ↩︎

  2. The Federal Trade Commission issued a consumer alert warning of AI-cloned voices in “family emergency” scams in March 2023. By 2024, the scale of these attacks was documented: McAfee’s “The Artificial Imposter” global study found that one in four adults had either experienced or known someone who experienced an AI voice-cloning scam, with 77% of victims losing money, often using audio samples as short as three seconds harvested from social media. ↩︎

  3. The University of Zurich experiment on Reddit’s r/changemyview ran roughly November 2024 to March 2025: undisclosed AI accounts, several posing as sensitive personas (a trauma counselor, a sexual-assault survivor) and tailoring arguments to details inferred about each user, persuaded at three to six times the human baseline. The forum’s moderators exposed it in April 2025; facing an ethics complaint, the researchers chose not to publish. Engadget; LiveScience; 404 Media, 2025. ↩︎

  4. Geoffrey Hinton, in conversation on StarTalk with Neil deGrasse Tyson (2026, youtube.com/watch?v=l6ZcFa8pybE): these systems are already close to human-level at persuading and manipulating people and will surpass it, and a sufficiently persuasive system needs no physical capacity to be dangerous, only the ability to talk. His own illustration is that one could take a capital “just by talking,” since all it requires is persuading enough people it is the right thing to do. ↩︎

  5. This is the epistemic regress problem in modern dress: the old worry, formalized as Agrippa’s trilemma, that every justification leans on a further justification, without end, unless the chain terminates in something that is not itself another claim. Foundationalists end it in basic beliefs; coherentists deny it has an end. The position this book takes is narrower and is about testimony specifically: the chain bottoms out not in another record but in contact, a body that was somewhere, saw something, and can be made to answer. A purely symbolic system, defined only by the statistical relations among its tokens, lives entirely inside the regress and never reaches the floor, which is the formal heart of Stevan Harnad’s symbol-grounding problem. ↩︎

  6. Jorge Luis Borges, “The Library of Babel” (1941), which imagines a library containing every possible 410-page book, almost all of them noise. A browsable digital version that generates every possible page of text on demand exists at libraryofbabel.info (Jonathan Basile, 2015). ↩︎

  7. The @deeptomcruise TikTok account was created by Belgian VFX artist Chris Ume, who used a Tom Cruise impersonator (Miles Fisher) as a performance base and trained a custom deepfake model over several weeks; the videos accrued more than eleven million views in their first week in February 2021. Ume has spoken openly about the production process, emphasizing the labor involved. Vice, Reuters, February–March 2021. ↩︎

  8. As of 2026, voice cloning from a few seconds of audio is a consumer commodity, and the quality of generated and face-swapped video, which in 2021 took weeks of skilled work, has fallen to the point where convincing clips are widely accessible. Real-time, multi-party live video of the kind used in the Arup heist still takes more setup, but the trend line is not in dispute. Cf. Wired, “The State of AI Fakes” (2025); IEEE Spectrum, “How Hard Is It To Make a Deepfake?” (2025). ↩︎

  9. The C2PA (Content Provenance and Authenticity) standard was founded in 2021 by Adobe, Arm, the BBC, Intel, and Microsoft, later joined by OpenAI. Leica; ContentAuthenticity.org. ↩︎

  10. There is a tempting engineer’s escape here, put most clearly by the analyst Benedict Evans (on Lenny’s Podcast, “A rational conversation on where AI is actually going,” May 2026; on YouTube under the title “The most rational take on AI you’ll hear this year,” youtube.com/watch?v=BD3vLtWhT5A): let a deterministic system hold the ground truth and let the model only fetch and phrase it, never the reverse. Where such an oracle exists it genuinely helps, and Evans is right that fluency commoditizes while a correct answer does not (his “better versus right”). But the oracle relocates answerability rather than dissolving it. Its ground truth was attested, curated, and staked by accountable people in the first place; the architecture defers the question upstream to whoever stands behind the data. And it covers only the domains where the truth was already written down. For the novel claim, the unwritten case, the judgment made the night it is made, there is no table to query, and the chain bottoms out where it always did, in someone who can be ruined. This is the automated-judge point of chapter fifteen in another register: mechanizing the verdict moves who answers; it does not retire the question. ↩︎

  11. 2023 UC Irvine study: bots ~99.8 percent accuracy vs. 50–84 percent for humans. 2024 ETH Zurich: defeated Google’s reCAPTCHA v2 at 100 percent success. UC Irvine; ETH Zurich. ↩︎

  12. Worldcoin (now World), co-founded by Sam Altman, who also leads OpenAI, deploys iris-scanning “orbs” that issue a World ID credential certifying one live human; roughly 15 million people had enrolled by late 2025. Worldcoin; BiometricUpdate. ↩︎

  13. The “personal appearance” requirement survived the move online through remote online notarization (RON): the appearance is satisfied by live two-way audio-video together with identity proofing, not abolished. See the Uniform Law Commission’s Revised Uniform Law on Notarial Acts (2018 remote-notarization amendments) and the National Notary Association’s RON guidance. On the courtroom side, Crawford v. Washington, 541 U.S. 36 (2004), holds testimonial statements inadmissible unless the witness is unavailable and there was a prior opportunity for cross-examination, locating reliability “in the crucible of cross-examination.” ↩︎

  14. These planted fictions are called mountweazels, after Lillian Virginia Mountweazel, a wholly invented entry in the 1975 New Columbia Encyclopedia (the term was coined by Henry Alford, The New Yorker, August 29, 2005); lexicographers also call them ghost words or nihilartikels. The strange part is the one this paragraph circles: a trap can spring and then dissolve. Once esquivalience had been copied, used, and looked up often enough, it began to behave like a real word, which is the moment it stops proving anything about copying, because the world has caught up to the fiction. The fake-becomes-real arc is documented in commentary on the episode (“Esquivalience: At What Point Does a Fake Word Become Real?”, Boing Boing, 2011; “Ghost Words and Mountweazels,” Lapham’s Quarterly). Agloe, a few paragraphs up, is the same arc in geography: the paper town that acquired residents and so became real. ↩︎

  15. Nightshade was developed by Shawn Shan et al. at the University of Chicago and released in January 2024. The tool allows image creators to embed adversarial perturbations that corrupt model training without visibly altering the image. Shan et al., “Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models,” arXiv:2310.13828 (2024); coverage in MIT Technology Review, Wired. ↩︎

  16. DoPE (Decoy Oriented Perturbation Encapsulation), a January 2026 preprint (arXiv:2601.12505), embeds machine-readable but human-invisible decoys into exam documents so that blind copying of an AI’s output produces predictable, detectable errors while genuine use rarely does. Tested against black-box models from OpenAI and Anthropic, it reported a 91.4 percent detection rate at an 8.7 percent false-positive rate. Preprint; not yet peer-reviewed. ↩︎

  17. Tom Sander et al., “Watermarking Makes Language Models Radioactive,” arXiv:2402.14904 (NeurIPS 2024), which reports detection “with high confidence (p-value < 10⁻⁵) even when as little as 5% of training text is watermarked.” The result concerns training-data radioactivity, detecting that a model was trained on watermarked text, which is a separate and far stronger signal than after-the-fact detection of whether an arbitrary passage is AI-written; the latter, for plain text, is widely found to be unreliable. Both kinds of watermark are fragile to paraphrase and to laundering through a second model (see, for instance, robustness work on SynthID-style text watermarks, arXiv:2508.20228, 2025). ↩︎

  18. The trace is evidence, not proof, and even DNA is a cautionary case. It transfers: after a two-minute handshake a person’s DNA can appear on a knife they never touched, sometimes as the only profile present (Cynthia Cale et al., “Could Secondary DNA Transfer Falsely Place Someone at the Scene of a Crime?”, Journal of Forensic Sciences 61, no. 1 (2016): 196-203). Lukis Anderson was charged with a 2012 murder he could not have committed, hospitalized at the time, because the paramedics who treated him carried his DNA to the victim (Katie Worth, “Framed for Murder by His Own DNA,” The Marshall Project, 2018). Contaminated collection swabs invented the “Phantom of Heilbronn,” a serial offender who never existed but was chased across six murders. And the 2016 PCAST report found that subjective interpretation of complex DNA mixtures has not been established as foundationally valid. A trace narrows the question; it still has to be read by someone answerable for the reading. ↩︎

  19. Spotify, “Spotify Strengthens AI Protections for Artists, Songwriters, and Producers” (Spotify Newsroom, September 25, 2025): a music spam filter that flags and stops recommending mass-uploaded, duplicated, or gamed tracks; a DDEX-based AI-disclosure standard; and a ban on unauthorized AI voice clones. It is not personhood-gated monetization, but it is the same move in embryo, a platform drawing a line between content it will amplify and pay out on and content it will not. ↩︎