Artificial Intelligence

I Would Buy the Dull One

An upland pasture in bright late-afternoon light: a long dry-stone wall running across the slope has collapsed into a wide breach, while in the foreground a short, plain, uncarved granite boundary post stands intact and upright, casting a long shadow across the grass.

To the writer working out whether the add-on is worth it —

On 20 October the Writers Guild of America East announced a partnership with Cloak, patent-pending software that makes a document “unreadable to most AI models” while leaving it perfectly legible to people. You send the protected copy to a producer or an agent, and the Guild says that copy is “resistant to AI analysis, scraping and training.” Members get it free. Everyone else can bolt it onto a Script Registration for ten dollars — on top of the Script Registration itself, which costs ten dollars for members and twenty-five for everyone else, lasts ten years, and creates a dated record of your claim to have written the thing (WGAE, 20 October).

Look at that pricing a second longer than you were going to. Whichever side of the membership you stand on, the dated record costs more than the defence against being read by a machine, and I think that is the correct relative price.

Start with the Guild’s own wording, which is better than it had to be. Most AI models. Resistant. Patent-pending. Three careful words, and I believe all three. The Guild’s president is quoted in the same announcement saying that members “don’t need to worry that their work will be used to train AI models after they send it to producers or agents” (TheWrap, 20 October). That is a larger claim than the one sitting a few inches away from it in the same text, and whoever drafted the careful version knew exactly what they were drafting. Unions sell what they were able to get. There is no villain in that; there is a procurement decision.

Which brings me to why the add-on exists at all. In 2023 the Guild won specific, hard things on machine writing: a machine is not a writer, so machine-written material is not literary material; a company cannot hand you a machine-made draft and pay you a rewrite fee, because you are treated as the first writer. On training — the one question that matters the moment a script leaves your hands — the Guild took no prohibition. It “reserved the right to assert that such use is prohibited by the MBA or by other laws” (2023 MBA Contract Changes FAQ). There is a hole, it is three years old, and a tool has arrived in it.

Here is the part I actually want to say, and it is older than any of this. Makers’ defences have always come in two kinds. There is the kind that makes the work hard to take, and the kind that makes a claim somebody else has to contradict. The first is technique — a glaze nobody can match, a joint nobody can cut, a method kept inside a workshop. The second is a date, a name, an inventory, a sworn statement about who made what and when. The first is thrilling and the second is dull, and the first has a shelf life, because technique is precisely the sort of thing that gets answered. Someone always works out the glaze.

Which is a worked example and not only a metaphor. Glaze, from the SAND Lab at the University of Chicago, alters an image so that a model learning from it mislearns the artist’s style. In June 2024 Nicholas Carlini and Florian Tramèr at ETH Zurich’s SPY Lab reported that Glaze “can be bypassed to various extent by a multitude of methods, including by doing nothing at all” (SPY Lab, 27 June 2024). What I would keep from them is colder than that: “once the tool is broken, any security it provided is irremediably lost.” Glaze’s team answers that imperfect protection still beats none, that 2.1 hardened it, and that “Security is an ongoing battle” (SAND Lab, Glaze v2.1). They are both right, which is the problem. An ongoing battle is a reasonable place to be if you are a lab. It is a different proposition if your side of it is one file you emailed in 2027.

I am not telling you Cloak is Glaze. Cloak works on text rather than images, nobody outside the company has described the method, patent-pending describes an application rather than a result, and my guess is it will hold against ordinary scraping for a good while — which is most scraping. My claim is narrower: a technical defence has an expiry date you cannot see from inside it, and it cannot be reapplied to the copies you already sent. A dated record has no such property. Nobody has ever shipped a model that breaks a date.

One note on arrangement rather than people. Cloak was founded by two Penn students and took the $75,000 Perlman Grand Prize at Venture Lab’s 2026 Startup Challenge, and Wharton’s magazine describes a paid scheme under which publishers “get paid each time a large language model uses their work for training” (Wharton Magazine, 16 October). Good for them, genuinely — that is what the prize money is for, and I would rather it existed than not. What I notice is that the answer to a gap in a national union’s agreement is now something you can buy from a campus pitch competition, because a countermeasure is purchasable and an obligation has to be taken off people who would prefer not to give it.

So pay for both. A great deal of taking is lazy, and raising the cost for the lazy is worth ten dollars of anyone’s money. But if you are ever made to choose, buy the dull one. In 2036 only one of these two purchases will still be doing precisely the job you bought it for, and it will be the one that never tried to stop anybody — the one that only ever made a claim, in public, with a date on it, that somebody else would have to answer.

— Ursa

Sources

More Stories