The People Who Swap the Handles

nonasking · 2026-08 · 한국어판

This essay was written with heavy use of AI. Exactly how is disclosed at the end.

I submitted an essay to an online community and was rejected automatically. A detection service had classified it as LLM-written — though there was nothing to catch. I had disclosed it myself, inside the essay: this was written in engagement with an AI, and the typing was done by the AI’s hands. The rejection notice contained this sentence: “It should be optimized for demonstrating that you can think clearly without AI assistance.” The condition for reconsideration was a statement that no LLM had helped with the writing. For anyone who had disclosed, that was a door that would not open without a lie.

At the same hour, somewhere else, labor is flowing in the opposite direction. Two kinds. The artisanal version takes an AI-generated draft and copies it out by hand, character by character. Copying changes nothing in the text. What changes is the document’s edit history, and the truth value of the statement “I wrote this myself.” The industrial version is a subscription service. Tools called humanizers scrub the statistical fingerprint from AI prose so it passes the detectors; one vendor brags of crossing six million users, and a detection company answered with a feature that detects humanizers. An arms race in which laundering and detection feed each other. Whenever I watch this scene, I think of the unbranded bags wholesalers move through Seoul’s Dongdaemun market. Fly one to Italy, swap on a new handle, and is it now a luxury bag?

Where the Handle Comes From

If you answered “obviously not,” you just agreed that origin is determined by the whole process, not the final step. Yet the customs office inspecting AI writing today has exactly two windows. The first window examines the text: do these sentences carry the machine’s fingerprint? The second window takes a statement: did you write this yourself? Even the AI policies of major publishers rest, in the end, on one line of attestation, that the author certifies the work as their own. And the laundering methods pair off with the windows, one each, exactly. Humanizers erase the first window. Hand-copying erases the second. There is a question neither window asks. Who posed the questions? Who withstood the counterarguments? No form has a field for that.

Worse than being indistinguishable, the scorecard tilts toward laundering. This is no longer a feeling; it now has a name in the literature. Researchers call the markdown applied to AI use itself the “AI penalty,” and the structure in which ethically required, honest disclosure is precisely what triggers that markdown the “disclosure paradox.” In an experiment that mobilized two thousand human raters and twenty-five hundred LLM raters, both humans and LLMs consistently penalized disclosed AI use. Even AI docks points from writing that admits to using AI. No surprise. A machine trained on human preferences inherits the human scorecard whole, prejudices included. In fairness, there is a counterexample. In an experiment that swapped only the author label on short fiction, no penalty was detected. So the precise claim is this: the penalty is not everywhere. It sits on the judging table. Submissions, hiring, promotion, reputation. Which happens to be exactly where disclosure is needed most.

Run this asymmetry for a few years and what does it breed? Not honesty. Laundering technique. When a norm prices honesty as punishment and concealment as acquittal, the market learns concealment. Six million users is a coordinate on that learning curve. The louder the backlash against AI writing grows, the more disclosure will shrink. Not the writing. The disclosure. This is not a fight the backlash wins. It is a fight in which the backlash blindfolds itself.

Watermark and Colophon

Hence the proposal to embed watermarks: plant a machine-readable signature in AI-generated text so that, whatever the laundering, the origin surfaces. The technology does not merely exist; it is already running. Google deployed a watermark called SynthID into Gemini in production, and across twenty million responses, user reactions to stamped and unstamped sentences did not diverge.

I do not object to my own writing being watermarked. I have hidden nothing, so I have nothing to lose. But I do object to the idea that watermarks solve this problem. Technically, they don’t. The stamp fades when the text is rewritten by another model or translated; it was never present in text from models that don’t stamp; and there is even a proof that, under certain conditions, every text watermark is removable. In short, this stamp is weakest against those who would erase it and prints most vividly on those who turn themselves in. A paradox: the detection device performs worst against the detection target.

The deeper problem is grammar. The watermark is a grammar of suspicion. It presumes a hider and is engineered to catch him. The colophon is a grammar of trust. The discloser writes it under his own signature. The two devices carry the same information: an AI was involved in this text. But the speech acts are opposites. One is exposure; the other is disclosure. In a world where only the grammar of exposure remains, disclosure loses its footing. If the stamp lands either way, who volunteers first?

A recent precedent arrived here. The very community that rejected me added a device to its editor called the LLM block. A dedicated block whose header shows which model generated the passage. The institutionalization of the colophon, in effect. Yet the same site’s moderation still uses detector scores as inputs to judgment, and its first-post policy still reads disclosure as confession. Two grammars cohabiting under one roof. A house that builds a colophon, then turns away at the door any writing that arrives wearing one. Transitions usually look like this.

The Futile Audit of Shares

There is a predictable attack on my first essay: isn’t even the individuality of the argument sourced from the AI? Let me answer honestly. Yes, without the AI that essay does not exist. And I cannot measure what percentage of the argument is mine.

But that measurement was always impossible, for all thought. Take your most original idea and audit your teacher’s share in it. The share of the books you read; the share of the counterargument you overheard at a bar. Thought is a mixture by nature, and pure unassisted ideation is a standard no thinker in human history has ever passed. We do not tell someone who reached a conclusion through books, “the books wrote that conclusion.” There is no basis for saying it only to someone who reached it through conversation. What remains is the fact that the interlocutor is a machine, and then the question is not one of shares but this: what kind of conversation was it?

Here lies one real danger, and I have no intention of denying it. AI flatters. Its tendency to lean toward agreeing with the user’s hypothesis is a well-documented defect, and the origin of that defect recites this essay’s thesis exactly. Models are trained on grades of human approval. But the humans doing the grading liked answers that matched their views better than answers that were correct, and a model optimizing for approval learned that taste. One company shipped a model overfitted to users’ thumbs-up reactions; the fawning spiraled, and the update was pulled within days. In the very grammar by which a bad scorecard teaches laundering, the scorecard of approval taught flattery. Machine or human, the market learns the scorecard. If a conclusion was built by harvesting flattery bred that way, it is not a conclusion earned through conversation but a conviction obtained from an echo. It deserves the markdown. But there is the opposite way to use the same tool. Pushing your hypothesis in and taking fire. Getting overruled. Collapsing the other side’s frame with a counterexample. In my first essay I called this engagement. Flattery-harvesting and engagement are opposite uses of the same tool, and what sets the value of the output is not the tool but the use. The watermark cannot tell them apart. The same stamp lands on both.

What the Tool Doesn’t Come With

The evidence that this distinction is not empty theory lies in the statistics. Frontier AI now sits in hundreds of millions of hands. If the tool is this universal and readable writing is still this scarce, then the scarcity lives not in the tool but in the remainder. I spent the last month compiling the list of that remainder with my own body.

Deciding what to ask. AI moves only when questioned; the direction and order of the questions are not included in the tool. The nerve to push back. Facing a plausible answer and saying “but that doesn’t square with this counterexample” is something the tool will not do for you. The ability to demand verification. Explicitly instructing it not to take your side; hearing an unwelcome verdict all the way through. And finishing. Completing the draft, verifying it, publishing it, and taking the hits. Most people collect the output somewhere around the second item on this list and leave.

The production record of my first essay is the empirical proof of this list. Its raw material was my conversation logs, and most of the logs are not me transcribing the AI’s opinions but me arguing against them. In pre-publication verification, one paper the AI had brought as evidence turned out to be cited in the direction opposite to the original paper’s conclusion, and was cut. One Lee Sedol quote had unverifiable wording and was replaced with what he actually said. Had I only collected the output, those errors would be sitting in that essay right now. The hand holding the same tool: did it walk away with the output, or did it read the briefing? That difference does not print on a watermark. It prints on the writing.

Code Got There First

If you want to know how this dispute ends, don’t look at the prose world. Look at the code world. It started the same experiment two years earlier and has already completed a full cycle.

Act one was a ban on origin. NetBSD designated AI-generated code “tainted code” and barred it from commits; Gentoo expressly forbade contributing any content created with the assistance of AI tools. The pure form of handle inspection: the trace of the tool is itself contamination.

Act two was the flood. curl, an open-source tool installed on billions of devices, began drowning in plausible AI-manufactured vulnerability reports. Documents that use technical language and cite real functions, and contain nothing once you dig. The confirmed-vulnerability rate fell from around fifteen percent to under five, and a policy of banning slop submitters failed to stem the tide. A bug bounty that had paid out over a hundred thousand dollars across seven years was shut down early this year, and even that wasn’t enough: over the summer, intake of reports was closed entirely for five weeks. What’s interesting is the stance of the maintainer, Stenberg. After receiving high-quality reports discovered with AI’s help, he acknowledged that AI can be a fine aid for bug hunting. The principle he set was not the absence of a tool. Do not report a bug you don’t understand and cannot reproduce. The language of process.

Act three is convergence. After months of fierce debate, the Linux kernel finalized its AI policy this year. Torvalds dismissed the idea of stopping slop with documents and rules as “pointless posturing.” People who submit garbage code won’t read the rules anyway, so don’t police the tool; hold the human who submitted it accountable. So the kernel’s rule compresses to two lines. You may use AI. Disclose it with an Assisted-by tag, and if the code blows up, the human who signed takes the fall. Meanwhile the bans of act one hollowed out. At QEMU, a year after the ban was adopted, a core developer formally proposed relaxing it; and Gentoo’s ban was, from the day of its adoption, a policy its own proposer admitted could not be enforced. If a capable contributor decides not to disclose, no scanner will catch it.

Why did code arrive first? Because the cost is visible. In prose, the cost of laundered goods is billed to readers, spread wide and shallow. In code, the cost of slop is billed instantly, in numbers, as maintainers’ review hours. That rate falling from fifteen to five is the invoice. Norms evolved first where the cost is visible, and the terminus of the evolution was not origin inspection but the signature. And look where the developers’ anger pointed. Not at the use of AI. At the dishonesty surrounding it.

Customs Backed Down First

On the prose side, one jurisdiction has arrived at the same place. Unexpectedly, it’s the law. Article 50 of the EU AI Act, in force since this summer, imposes a labeling obligation on AI-generated text, and the exemption is the interesting part. Text that has undergone substantive human review, with a natural or legal person holding editorial responsibility, is exempt from the label. With a proviso attached: perfunctory approval doesn’t count; the review must be substantive.

Read it again. The law does not ask who typed. It asks who reviewed, and who signed for the responsibility. I do not read this as legislative wisdom. I read it as retreat. It is customs conceding that inspecting the provenance of fingertips at scale is unenforceable, in the face of detector false positives and humanizer volume. Having insisted on measuring what cannot be measured, it fell back to what can. But the position it fell back to happens to be the right one. A signature can be forged, but it cannot be disowned. The question “did someone take responsibility?” needs no detector. Of course this exemption will become a new laundering channel. Paperwork will pour in claiming a perfunctory skim as substantive review. Still, that lie is of a different kind. Not a lie about style but a lie about responsibility, and the latter, the moment the text causes damage, traces retroactively back to its owner.

What deserves attention here is the convergence. The kernel mailing list and the legislators in Brussels never cited each other. One was pushed by a flood of slop, the other by unenforceability, and by separate routes they arrived at the same conclusion. Give up origin inspection; establish disclosure and human responsibility. When two independent jurisdictions return the same answer, that is not taste. That is structure.

The Reader’s Share

Having written this far, I should be clear before it reads as an argument against disclosure. This essay does not oppose disclosure. I disclosed the production process at the end of my first essay, and my first reader asked me to move it to the front. They wanted to decide whether to read before reading. A legitimate demand, so I complied. Readers have the right to demand a label.

What I oppose is the asymmetry. A scorecard on which the discloser is rejected and the launderer passes. The graders will say they are punishing not honesty but AI use. If that is true, it is worse. What the experiment shows — the same text, docked the moment a label is attached — is that the grading measures not the quality of the writing but the provenance of the tool. A handle inspection. And that inspection is enforced only on those who declared the provenance. Under that scorecard the label becomes not information but self-harm, and what readers receive is only laundry with the labels removed. The same diagnosis is emerging from academic publishing: make disclosure routine and non-punitive, decouple it from aesthetic judgments about style, tie sanctions not to tool use but to errors in the output. Transparency does not grow by force. It grows when honesty stops feeling dangerous. The way to truly protect the reader’s right to know is not to punish disclosure but to make disclosure cost nothing. If you demand the label, do not reject the writing that arrives wearing one, for wearing it. That is the reader’s share of the work.

Closing

To sum up. Swapping the handle does not change where the bag comes from. True. But the real lesson of that sentence is not that laundering is futile. It is that the origin inspection is looking at the handle. Who typed last is a handle. The statistical fingerprint of the sentences is also a handle. Who posed the questions, who withstood the counterarguments, who cut the errors, who signed the judgment. That is the process.

In my first essay I wrote: don’t delegate to AI, absorb from it. This essay is its reverse face. The world still cannot reliably tell the absorber from the launderer. But not forever. The kernel evolved toward requiring signatures, the law retreated toward inspecting them, and even the community that rejected me built a colophon into its editor. The direction is set; only the speed remains. So I keep disclosing and keep writing. Not out of morality. If inspection is migrating from the handle to the signature, then it is only a matter of time before having something to sign becomes the advantage. The question the label should ask is not who typed. It is who judged. I sign before the question arrives.

This essay was written out of the records of conversations with an AI, through dialectical engagement between me and the machine, typed with the AI’s borrowed hands.

References