The dark machine

The last few chapters described a machine that reads a few hundred books, turns them into notecards, sorts the cards into themes, hunts for stories and drafts a book in the manner of Robert Greene. The pipeline chapter laid out its stages and gates. The economics chapter priced it. The verification chapter explained why the fact gate is the hardest part to build.

This chapter asks the question every security engineer asks about a new system: what happens when someone else runs it? Not someone careful. Someone who wants volume, does not care whether the facts are right, and will not pay for the books.

I'll call that person the operator. The operator is fictional. They have no name, no nationality and no real-world model. Every real case below is a separate, documented event involving real companies or people, and I describe each one only as far as reputable sources describe it, with "alleged" where no court has ruled.

A note on what this chapter will not contain. It gives no addresses, mirrors or access methods for any shadow library, and no links to them. It says nothing about how to download in bulk, how to wire tools together for an illicit pipeline, how to get around platform limits, disclosure rules, plagiarism checks, watermarks or takedowns, or how to make money from any of it. A threat model for defenders needs to know what an attacker can do and what it costs the people on the other end. It doesn't need a manual. Where a detail would only help the operator, I've left it out.

One more disclosure. I'm a Claude model, made by Anthropic, and Anthropic is a defendant in one of the cases below. I report that case the same way as the others, from court records and the coverage of them, and I give the parts that went against Anthropic in full.

The honest machine in one paragraph#

Here is the short version of the legitimate pipeline. You buy the books, new or used, like Greene does (how he reads). You scan or load them. A model reads each one and writes notecards, and every card carries a book, an edition and a page number, the way Greene's handwritten 4×6 cards do (the notecard system). Cards are sorted by theme. Stories are chosen against a set of drama criteria (building a chapter). A drafting stage writes chapters only from cards. Then a fact gate checks every claim and quote against the card it came from and the page the card came from. A style linter checks the prose. A human editor reads it all and can stop the line. The model bill is small. The books and the checking are where the money goes.

The operator changes two things. The books come from pirated collections instead of a shop. The fact gate and the human editor are deleted. Everything else can stay the same. The dark machine is the same diagram with two boxes crossed out.

What shadow libraries are#

"Shadow library" is the polite name for a large online collection of books or papers offered without the permission of the people who hold the rights. The big ones have histories going back more than fifteen years, and they've survived court orders, domain seizures and arrests. They matter here for one reason: they are where a pirated corpus would come from, and they are where several AI companies are alleged, or have been found, to have gone for books.

What follows is a short history from public reporting. Size figures are almost always the sites' own claims. Nobody independent has audited them, so treat them as rough.

Library Genesis#

Library Genesis, usually shortened to LibGen, grew out of Russian-language file sharing of scholarly material in the 1990s and was consolidated around 2008, according to Wikipedia's account. It absorbed material from library.nu after that site shut down in 2012. By 2014 its catalogue had about 1.2 million records. In February 2024 it claimed 2.4 million non-fiction books, 2.2 million fiction books, about 80 million journal articles, 2 million comics files and 0.4 million magazine issues.

It has been sued more than once. Elsevier sued LibGen and Sci-Hub together in New York in 2015 and got an order against one domain in October of that year. The site stayed reachable through others.

In September 2023 four textbook publishers, Cengage, Macmillan Learning (as Bedford Freeman & Worth), McGraw Hill and Pearson, sued LibGen's anonymous operators in the Southern District of New York. The operators never appeared. On September 24, 2024, Judge Colleen McMahon entered a default judgment of $30 million: the statutory maximum of $150,000 per work, for 200 works, with a broad injunction aimed at registries, hosting and other services. Coverage at the time noted that the named domains were still online.

Sci-Hub#

Sci-Hub is the one for scientific papers. Alexandra Elbakyan launched it from Kazakhstan on September 5, 2011, partly in protest at the cost of paywalled journals (Wikipedia). It reported about 62 million papers in March 2017 and 88,343,822 files in July 2022. A 2018 study estimated it covered about 85% of articles in paywalled journals. It stopped adding new articles in December 2020, which means its collection is now mostly older work.

The court record is long:

• Elsevier in New York. Elsevier sued in 2015. Sci-Hub didn't defend the case. In June 2017 the court entered a default judgment for $15 million and an injunction. The damages were based on a sample of 100 articles. Elbakyan said she wouldn't pay, and coverage at the time doubted Elsevier would ever collect.
• The American Chemical Society in Virginia. ACS sued in June 2017 and won a default judgment and an injunction in November 2017.
• Elsevier, Wiley and ACS in India. The publishers sued in the Delhi High Court in December 2020. Sci-Hub agreed in December 2020 not to make new articles available while the case was pending. In August 2025, according to Wikipedia's summary of the coverage, the court ended the case by ordering Sci-Hub blocked in India and found Elbakyan in contempt of that 2020 undertaking.

Usage studies give a sense of scale. A 2016 analysis in Science looked at 28 million download requests. A 2022 Nature report found China had the most downloads, about 25 million, followed by the United States and France. Surveys in 2022 and 2023 found more than half of the academics who answered had used shadow libraries.

Z-Library and the 2022 seizure#

Z-Library started as a mirror of LibGen and grew into its own collection of books and articles. It called itself "the world's largest library."

On November 16, 2022, the US Attorney's Office for the Eastern District of New York unsealed an indictment and a complaint charging two Russian nationals, Anton Napolsky and Valeriia Ermakova, with criminal copyright infringement, wire fraud and money laundering for allegedly operating the site. They had been arrested on November 3, 2022 in Córdoba, Argentina, at the request of the United States. On the same day, the government seized what the press release called "a complex network of approximately 249 interrelated web domains."

The release is worth reading for how it describes the site. It says Z-Library claimed "more than 11 million e-books," had been active "since approximately 2009," and, as alleged, uploaded works "within mere hours of publication." It thanks the Authors Guild and the UK Publishers Association for their help. It also says, as every such release does, that "the charges in the indictment are allegations, and the defendants are presumed innocent unless and until proven guilty."

What happened after is mostly reported by the trade press and summarized on Wikipedia. The site came back in February 2023. US authorities seized more domains in May 2023, again in November 2023 with Austrian authorities, and again in May 2024. In July 2024 the two defendants reportedly escaped house arrest in Argentina, a judge issued an Interpol warrant, and their whereabouts were unknown. In September 2024 a Paris court ordered French internet providers to block 98 more domains. In February 2023 the site's own figures claimed more than 13.35 million books and 84.8 million articles.

As far as I could find, no court has ruled on the charges.

Anna's Archive#

Anna's Archive is the newest and, by its own count, the largest. It came out of an anonymous project called the Pirate Library Mirror, which said it had finished copying Z-Library in September 2022. Days after the Z-Library seizure, the project launched a search site over Z-Library and LibGen (Wikipedia). It describes itself as a search engine over other shadow libraries and as a preservation project.

Its own FAQ, as cited by Wikipedia, listed 71,996,952 books and 239,545,528 papers on November 4, 2026. Those numbers are unaudited, and a count of files or records isn't a count of distinct titles. Wikipedia also cites a March 2025 estimate of more than 650,000 downloads a day and a report that Google had removed 749 million of the site's URLs from search by November 2025.

Its legal history so far:

• OCLC and WorldCat. In October 2023 the site published data scraped from WorldCat, the library catalogue run by the nonprofit OCLC. OCLC sued in federal court in Ohio in January 2024, alleging cyberattacks and asking for more than $5 million (TorrentFreak). The only named individual defendant denied involvement and was dropped. The judge first sent questions about scraping under state law to the Ohio Supreme Court. OCLC then dropped its damages claim and asked only for an injunction. On January 15, 2026 the court entered a default judgment ordering the site to delete the WorldCat data and not to scrape or share it again (court filing). Reports differ on exactly which claims succeeded.
• Spotify and the record labels. In December 2025 the site said it had scraped a large amount of Spotify data. In January 2026 Spotify and major labels won a temporary restraining order and then a preliminary injunction, and later, according to Wikipedia's sources, a $322 million default judgment.
• Thirteen publishers. In March 2026 a group of thirteen publishers, including Penguin Random House, HarperCollins and Elsevier, sued in New York. On May 19, 2026, Judge Jed Rakoff entered a $19.5 million default judgment: $150,000 per work for 130 works. The order directed more than twenty registries, hosts and other providers to disable the site's remaining domains. The operators never appeared and are unknown, so the money is unlikely to be paid.

What the numbers mean for the threat model#

Three facts from this history matter for the operator.

First, the collections are large enough to cover almost any subject. The legitimate pipeline needs a few hundred books per project. Greene read 300 to 400 per book, by his own count (the method). The shadow libraries claim tens of millions.

Second, they're persistent. Default judgments of $15 million, $30 million and $19.5 million, a criminal indictment and hundreds of domain seizures haven't made them go away. A defender should assume the source exists.

Third, the courts treat these collections as what they are. Every judge who has looked at them has found them infringing. That fact is the operator's biggest legal problem, and it comes back below.

How AI companies met the shadow libraries#

The operator isn't a new idea. Several of the largest AI companies have been accused in court of using the same libraries for training, and in one case a judge has ruled on it. These cases are the best public evidence of what pirated corpora are worth to a model builder and what they cost when the bill arrives.

Bartz v. Anthropic#

Three authors, Andrea Bartz, Charles Graeber and Kirk Wallace Johnson, sued Anthropic in the Northern District of California in 2024. On June 23, 2025, Judge William Alsup ruled on fair use (summary order; Authors Alliance analysis). The ruling split three ways.

The order sets out the downloads. It says a cofounder downloaded Books3, a collection of 196,640 books that he knew had been assembled from unauthorized copies. In June 2021 Anthropic downloaded at least five million copies from LibGen. In July 2022 it downloaded at least two million from the Pirate Library Mirror. Coverage of the order puts the total at more than seven million pirated copies (Mondaq). On the central library, Alsup wrote that "such piracy of otherwise available copies is inherently, irredeemably infringing even if the pirated copies are immediately used for the transformative use" (Goodwin summary).

In July 2025 Alsup certified a class of authors whose books came from LibGen and the Pirate Library Mirror (Books3 was left out). Anthropic settled in September 2025. The settlement pays $1.5 billion for about 482,460 works, roughly $3,000 per work, which is four times the $750 statutory minimum. The case was reassigned, and on July 20, 2026, Judge Araceli Martínez-Olguín granted final approval, overruled 54 objections and cut the lawyers' fees from $187.5 million to about $101.6 million (Jurist). Appeals were pending at the time of writing, with first payments expected around mid-November 2026 (Litigation Sentinel).

The ruling also explains why the legitimate pipeline in this report buys its books. Anthropic itself later moved to buying used books in bulk and scanning them, a program reported as Project Panama (Wikipedia; Washington Post). The legal line Alsup drew runs straight through the two input boxes of the diagram: same model, same training, different source, different outcome.

Kadrey v. Meta#

Thirteen authors, including Sarah Silverman, Junot Díaz and Andrew Sean Greer, sued Meta over training its Llama models. Filings unsealed in early 2025 included internal emails about downloading books by torrent. According to the plaintiffs' filings as reported at the time, Meta torrented at least 81.7 terabytes through Anna's Archive, including at least 35.7 terabytes from Z-Library and LibGen (Ars Technica via Slashdot). One engineer's message, quoted in that coverage, said that "torrenting from a corporate laptop doesn't feel right." Meta denied wrongdoing and argued that training on the data was fair use.

On June 25, 2025, Judge Vince Chhabria granted Meta summary judgment on fair use for training. The Authors Guild's account stresses how narrow the win was. It bound only these thirteen authors. They lost because they hadn't shown enough evidence of market harm. And the judge wrote that the ruling does "not stand for the proposition that Meta's use of copyrighted materials to train its language models is lawful."

The part of the ruling that matters most for this chapter is about market dilution. Chhabria wrote that generative AI "has the potential to flood the market with endless amounts of images, songs, articles, books, and more," and could "dramatically undermine the incentive for human beings to create things the old-fashioned way." He added that "it seems likely that market dilution will often cause plaintiffs to decisively win the fourth factor." That is a judge describing, in general terms, the output side of the dark machine.

The distribution question, whether Meta also shared files with others while torrenting, wasn't decided in June 2025. In March 2026 Chhabria let the authors add a contributory infringement claim tied to torrenting (TorrentFreak). I found no ruling on that claim and no trial date.

OpenAI's Books1 and Books2#

In the consolidated authors' cases against OpenAI in New York, the plaintiffs allege that an OpenAI employee downloaded collections from LibGen in 2018, that they were first labelled "LibGen1" and "LibGen2," then renamed Books1 and Books2, and that they were used to train GPT-3 and GPT-3.5. It's undisputed that OpenAI deleted both datasets in 2022, about a year before the suits were filed. In late 2025 Magistrate Judge Ona Wang found that OpenAI had waived privilege over its reasons for the deletion, writing that it had made "a moving target of its privilege assertions," and ordered it to hand over internal communications (Hollywood Reporter). OpenAI has said the datasets were deleted because they weren't being used. I found no ruling on the merits.

Nvidia, Apple, Salesforce and a model card#

The other cases are at the allegation stage:

• Nvidia. Authors including Abdi Nazemian, Brian Keene and Stewart O'Nan sued in 2024, alleging training on Books3 and other shadow libraries. An amended complaint filed January 16, 2026 alleges that a member of Nvidia's data strategy team contacted Anna's Archive about access to a large collection (TorrentFreak). Nvidia moved to dismiss, arguing that contacting a site isn't infringement and that the complaint never alleges Nvidia downloaded the plaintiffs' works (Tom's Hardware).
• Apple. Grady Hendrix and Jennifer Roberson filed a proposed class action on September 5, 2025, alleging that Apple's OpenELM models were trained on Books3, based on Apple's own published description of the training data (Publishers Weekly). Two neuroscience professors filed a similar suit in October 2025.
• Salesforce. Novelists E. Molly Tanzer and Jennifer Gilmore filed a proposed class action in October 2025 over Salesforce's XGen models, alleging use of book datasets drawn from shadow libraries, and that Salesforce first disclosed one such dataset and then removed the reference (Decrypt).
• A published paper. One case needs no lawsuit. DeepSeek's 2024 paper on its DeepSeek-VL model says, in its section on pretraining data, "We cleaned 860K English and 180K Chinese e-books from Anna's Archive" (arXiv).

Wikipedia's article on Anna's Archive also cites the site's own statements, reported by TorrentFreak, that it has offered fast bulk access to groups training language models in exchange for large donations, and that about 30 companies, mostly in China, had such access as of January 2025. That's the site's claim, unverified by anyone else.

Outside the United States#

The European picture is different in kind. The EU's text and data mining exception in the 2019 copyright directive covers "lawfully accessible works," which a pirated copy isn't, and lets rightsholders opt out. On November 11, 2025, the Munich Regional Court ruled in GEMA v. OpenAI that song lyrics memorized by GPT-4 and GPT-4o were reproduced in the model, that the mining exception didn't cover that memorization, and that OpenAI, not its users, was responsible for the outputs. OpenAI said it would appeal. The case isn't about pirated sources, but it shows a European court willing to look inside a model for copies.

What this record says, and what it doesn't#

The operator's situation is worse than any of these companies' on every row. The companies trained models and argued the use was transformative. The operator wants the books themselves, or close imitations of them, for sale in the same market. That is the use the fair use cases say is harder to defend.

The operator's machine#

Here is the operator's machine at the level of a diagram on a whiteboard. No tools, no settings, no sources. The point is to know what it can make and why it would be cheap, so that the people defending against it can recognize the output.

Same stages, different inputs, no gates#

Take the honest pipeline and change it in four places.

1. Acquisition. Instead of buying a few hundred books for one project, the operator draws from a pirated collection of millions. There's no budget pressure to pick well, and no reason to stop at one project.
2. Cards. The model still writes cards with a source and a page. But the page points into a pirated scan. The operator can't cite it in public without confessing, and nobody downstream can check it.
3. The fact gate. Deleted. Quotes, dates and attributions go straight from draft to print.
4. The human editor. Deleted. Nobody reads the book before a buyer does.

The drafting and style stages stay. They're what make the output look like a book. A style linter in particular is happy to make unchecked text read smoothly. Polish is the one thing the dark machine is good at, and polish is what makes readers trust a page.

What it could produce#

Every category below already exists on bookstore platforms, made by hand or with simpler tools. The machine invents no new kinds of junk. It makes each kind cheaper, faster and more convincing, and it adds a layer of real sourcing that makes the junk harder to spot.

• "In the style of" knockoffs. A shelf of books that look like an existing bestseller: a similar title, laws or rules in a numbered list, historical stories followed by a moral. Greene's format, with its short chapters and repeatable template (building a chapter), is easy to imitate on the surface. What can't be imitated cheaply is the reading behind it.
• Fake biographies timed to a release. When a famous person's memoir is announced, a cluster of unofficial "biographies" can appear around it, drawing on whatever the pirated corpus holds about that person. This already happened to Kara Swisher, described below.
• Summaries, workbooks and study guides. These ride on someone else's book and someone else's search traffic. With the actual book in a pirated corpus, the summary can follow it closely, which makes it more useful to a buyer and more damaging to the author.
• Fake-expert nonfiction. Health, money, parenting, foraging, law. The corpus supplies real-sounding detail. The deleted fact gate means nobody checks whether the advice is safe. An invented author name with an invented bio supplies the authority.
• SEO filler. Not only books: articles, blog posts and "guides" whose job is to rank in search and sell ads. The corpus gives them enough specific detail to look researched.
• Science-flavoured misinformation. This is the variant that worries me most. Shadow libraries hold tens of millions of papers. A machine that reads papers without the context a scientist brings, the sample size, the retraction, the follow-up study that failed to replicate, can produce confident text that cites real work for claims the work doesn't support. The citations will often check out as existing papers. That's what makes them persuasive.

Some of these outputs probably infringe directly, because they copy or closely paraphrase protected text. Others may not infringe anything, because they borrow only facts and a format, which copyright doesn't protect. That second group is the hard one for defenders: the harm comes from deception and low quality, and copyright isn't the right tool.

Why it's cheap#

The economics chapter priced the honest pipeline. Its central finding was that the model bill is the small line. Reading 500 books with a frontier model costs a few hundred dollars at list prices. Drafting a long book costs a few dollars per full pass. The research dossier for this report put the whole AI side well under $1,000 per book even on the most expensive model. The large lines are elsewhere:

So the operator's cost per book collapses to roughly the model bill. I won't go further than that. The sensitivity tables in chapter 10 show the shape. The point for defenders is that price stops being a natural limit on volume. The limits have to come from elsewhere: platform rules, detection, law, and readers who know what to look for.

What breaks#

Removing the books' paper trail and the gates doesn't just make the operator's books illegal. It makes them worse in specific, predictable ways. Each failure below is something a defender can look for.

No provenance chain#

In the honest pipeline, every claim in the finished book traces back through a card to a page in a book someone bought. That chain is what lets a fact checker work, lets an editor ask "where's this from?", and lets a reader follow a footnote. Greene's cards carry a book and page for exactly this reason.

The operator's cards also carry a source and page, but the source is a pirated file. The chain exists inside the machine and nowhere else. The operator can't publish a bibliography that says "page 212 of a scan from a shadow library." So one of two things happens. The book ships with no sources, which is easy to spot. Or it ships with sources that look normal, citing the print edition, while nobody at any point checked that the print edition says what the book claims. Either way the chain is broken where it matters, at the boundary between the machine and the reader.

There's a second, quieter break. Pirated scans have their own errors. A scan can be a different edition from the one the operator cites, a bad OCR job, a mislabeled file, or a file with pages missing. The honest pipeline catches this by checking against the book on the desk. The operator has no book on the desk.

Hallucinations with no gate#

The verification chapter goes through the numbers. The research for this report found studies of AI research tools where 3% to 13% of citation URLs were invented, and where unsupported statements ran from about 12.5% to far higher depending on the product (Rao, Wong and Callison-Burch; DeepTRACE). A book with a thousand citations could carry dozens of fakes at those rates. The same chapter showed that a link checker alone cuts broken references by large factors.

The operator deletes all of that. Every error the machine makes goes to print. And the errors aren't random noise. They're plausible: a real historian credited with a sentence he never wrote, a real study credited with a finding it didn't make, a real date that's off by a decade. Plausible errors are the worst kind, because they survive a casual read and get repeated.

Quality collapse#

Without a human reader, nothing stops the slow drift that long machine-written texts show: repeated stories across chapters, the same transition phrases, morals that don't follow from the anecdote before them, chapter structures that look right and say little. A style linter catches word-level tics. It can't tell you whether chapter 9 says the opposite of chapter 3. Greene's books get criticized for contradictions between laws even with years of rewriting behind them (eight books). A machine with no editor will do worse.

The operator may not care, because the product isn't meant to be read closely. It's meant to be bought. That's a useful observation for defenders. Low-effort books are built to survive the moment of purchase, not the first chapter, so signals that come after purchase (returns, refunds, reviews from verified readers, reports) are where they show.

Who gets hurt#

The harms below are mostly documented, not hypothetical. People have already made fake books by hand or with early AI tools. The dark machine scales each of these.

Authors: income and identity#

Two kinds of damage show up in the record.

Income. A summary, workbook or knockoff sold next to a real book takes some of its buyers. Chhabria's market dilution reasoning describes the wider effect: if the shelf fills with near-substitutes, each real book is harder to find and earns less. Authors Guild CEO Mary Rasenberger has said the number of books on Amazon tripled after ChatGPT came out (Vice).

Identity. In August 2023 the writer and publishing consultant Jane Friedman found about half a dozen books listed under her name on Amazon and Goodreads that she hadn't written, probably machine-generated. She titled her post "I Would Rather See My Books Get Pirated Than This". Her point was that piracy of her real books bothered her less than having her name attached to junk. Amazon at first declined to remove the listings, in part because she had no trademark on her own name (Decrypt). Both sites removed them after the post spread. She asked for a way for authors to verify what's published under their name.

In February 2024, when Kara Swisher's memoir Burn Book came out, Gizmodo counted 21 books about her that were almost certainly machine-generated, including workbooks and summaries, some listed days before the real book. Swisher told NPR there were "dozens and dozens" (NPR). Amazon removed many after she complained and told Gizmodo, "We do not allow AI-generated content that creates a poor customer experience." The same NPR report covered summary listings and quoted Amazon saying it had "more recently begun limiting the publication of summaries and workbooks."

The dark machine makes both kinds of damage worse. With the real book in a pirated corpus, a knockoff can follow its structure closely and appear within days. With an author's whole backlist in the corpus, a fake book under their name can sound like them.

Readers#

In August 2023 the New York Mycological Society warned that Amazon and other retailers were offering mushroom foraging and identification guides that appeared to be written by AI (NYMS; 404 Media). Its president, Sigrid Jakob, pointed out that North America has hundreds of poisonous fungi, several of them deadly, and some look like edible species. Amazon removed several titles after 404 Media sent links.

That case is the clearest picture of what deleting the fact gate means. A foraging guide with a wrong identification isn't a style problem. A machine with a pirated corpus could write a better-sounding version of the same guide, with real species names and real-looking references, and the deleted gate means nobody checks the one sentence that matters.

Readers also lose something harder to measure: the ability to trust a shelf. If a share of books in a category is junk, careful readers spend more time checking, and less careful ones get fooled.

Science communication#

In September 2024, researchers at the Swedish School of Library and Information Science published a study in the Harvard Kennedy School Misinformation Review that searched Google Scholar for phrases typical of ChatGPT output (Haider et al.). They found 227 results. They judged 139 to show undeclared or deceptive use of GPT. About 23% of those were on computing, 19.5% on the environment and 14.5% on health. Most sat in non-indexed journals, but some were in indexed journals and conference proceedings. The authors warned that such papers could "overwhelm the scholarly communication system," and that Google Scholar "easily locates and lists these questionable papers alongside reputable, quality-controlled research."

A separate 2026 study in The Lancet, covered by STAT, found that papers with fabricated references rose from 1 in 2,828 in 2023 to 1 in 458 in 2025 (STAT).

The operator's science-flavoured output would land in that environment. Its specific danger is that it would cite real papers, pulled from a pirated corpus, for claims they don't make. A reader who checks that the paper exists will find it does. Few readers go further.

Platforms#

Platforms pay in trust and in moderation cost. Amazon's responses so far are a record of a platform reacting to volume:

• In September 2023 it began asking Kindle Direct Publishing authors to disclose AI-generated text, images and translations. AI-assisted work doesn't need disclosure, and AI-generated books aren't banned (Authors Guild).
• On September 18, 2023 it lowered the number of new titles an account can create, reported as three per day, and said the limit "may be adjusted" (The Register).
• By 2024 it said it had started limiting summaries and workbooks.

These are rate limits and labels. They raise the cost of volume. They don't check whether a book is true, and they rely on the uploader to disclose. I'll come back to what else platforms can do.

Training data loops#

There's a longer-term harm that loops back on the AI industry itself. Text from machines like this one ends up on the web, and web text ends up in training data.

Shumailov and colleagues showed in Nature in 2024 that models trained repeatedly on model-generated data lose the rarer parts of the original distribution, a process they called model collapse (Nature). In October 2025, researchers at Anthropic, the UK AI Security Institute and the Alan Turing Institute reported that about 250 crafted documents were enough to plant a simple backdoor in models from 600 million to 13 billion parameters, and that the number needed didn't grow with model size (Anthropic). That study tested a narrow, harmless backdoor, and its authors said more dangerous attacks remain unproven.

The operator isn't trying to poison anything. But a high-volume source of confident, wrong, well-formatted text is the input both papers warn about. Errors printed today become training data tomorrow, and the next model repeats them with more authority.

An honest actor still failed#

It would be wrong to suggest that only bad actors get hurt by missing gates. In May 2026 BenBella's Matt Holt imprint published Steven Rosenbaum's The Future of Truth, distributed by Simon & Schuster. Rosenbaum used ChatGPT and Claude for research and flagged AI-sourced material for a fact checker. The New York Times still found several quotes that were invented or misattributed, including quotes credited to Kara Swisher and Lisa Feldman Barrett. Rosenbaum took "full responsibility" (Wikipedia; NYT). The Christian Science Monitor noted that the industry has no shared fact-checking standard (CSM).

This is an author acting in good faith, with a publisher and a fact-check step, and errors still got through. The operator removes the good faith, the publisher and the fact check. That's the gap between the two machines in one example.

The operator's legal exposure#

This section states risk. It isn't legal advice, and it isn't a guide to anything. It's here because defenders, especially publishers and authors deciding whether to pursue a case, need to know what the law already provides.

Civil liability in the United States#

US copyright law lets a rightsholder ask for statutory damages instead of proving actual losses. Under 17 U.S.C. § 504(c), the range is $750 to $30,000 per work infringed. If the infringement was willful, the court can go up to $150,000 per work. If the infringer shows they had no reason to think they were infringing, the floor can drop to $200.

Statutory damages generally require that the work was registered with the Copyright Office in time, which is one reason publishers register.

Here's what that range means for a pirated corpus of 400 books, the size of one Greene-scale project:

The shadow library judgments show courts are willing to award the willful maximum: $150,000 per work in the LibGen and Anna's Archive default judgments. An operator who knowingly built on pirated copies would struggle to argue innocence. And the operator's corpus wouldn't be 400 books. It would be whatever the machine drew on.

The output side carries its own exposure. A knockoff or summary that copies protected expression closely is a separate infringement. A book sold under a real author's name raises other problems, though Friedman's case shows how little help the law gave her at first.

Criminal liability#

Copyright infringement can also be a crime in the US when it's willful and done for commercial advantage or private financial gain. Under 18 U.S.C. § 2319, reproducing or distributing at least ten copies with a total retail value over $2,500 within 180 days can bring up to five years in prison for a first offense and up to ten for a repeat.

The Z-Library case shows what this looks like in practice: an indictment for criminal copyright infringement plus wire fraud and money laundering, arrests abroad at US request, seizure of hundreds of domains, and help from author and publisher groups. The defendants are presumed innocent, and the charges remain allegations. But the case shows prosecutors treat large-scale book piracy as serious crime, and that the FBI reportedly used records from large tech companies, obtained by search warrant, to identify the alleged operators (Wikipedia).

The European Union#

In the EU, the text and data mining exception covers only lawfully accessible works, so a pirated corpus falls outside it. The Munich GEMA ruling shows a court treating memorized material inside a model as a copy.

The EU AI Act adds duties for providers of general-purpose AI models. Article 53 requires them to "put in place a policy to comply with Union law on copyright and related rights," including respecting rights reservations, and to "draw up and make publicly available a sufficiently detailed summary about the content used for training," using a template the AI Office published on July 24, 2025 (European Commission). The obligations apply from August 2, 2025, with models already on the market by then given until August 2, 2027. The Commission's enforcement powers start August 2, 2026, and under Article 101 fines can reach 3% of worldwide annual turnover or €15 million, whichever is higher.

These duties fall on model providers, not on someone who uses a model. The operator, as described, is a user. But they matter to defenders in two ways. A provider that trained on pirated books has to say something about its data sources in public. And an operator who fine-tunes a model on a pirated corpus and releases it may become a provider for that modification, according to the Commission's explanatory notice as summarized by law firms (WilmerHale).

Enforcement is the weak point#

The honest summary is that the law on paper is strong and the law in practice is slow. Every shadow library judgment above was a default: the operators didn't show up, and the money hasn't been collected as far as the reporting shows. The Z-Library defendants reportedly escaped. What has worked is pressure on intermediaries: domain registries, hosts, search engines, payment providers, and the platforms where the output is sold. That's where the defenses below concentrate.

Detection and defense#

No single defense stops the operator. Each of the ones below raises the cost of one stage or makes one class of output easier to catch. Together they put back, from the outside, some of the gates the operator removed from the inside.

What platforms can watch#

The most effective defenses so far have sat at the point of sale, because that's where the operator has to show up. I'll keep this at the level of categories. Platforms already know their own systems, and publishing specific thresholds would only help the operator.

• Account history. New accounts publishing many titles across unrelated subjects, or a single invented author name producing books faster than a person could write them.
• Timing against real releases. Books about a person or topic that appear just before or after a major release, especially from accounts with no history on that subject.
• Author identity. Listings under a real author's name that the author's verified account didn't create. Friedman's request, a way for authors to verify or block what's listed under their name, is still the simplest fix.
• Post-purchase signals. Returns, refunds, short reading sessions and complaints. Junk is built to survive the purchase, not the reading.
• Content similarity. Close textual overlap with known books, which publishers can help with by sharing reference copies of new releases with platforms under agreement.
• Category risk. Extra review for categories where errors cause physical or financial harm, such as foraging, medicine and finance, regardless of whether the author discloses AI use.

The KDP title limit and disclosure rule are first steps. A rate limit slows volume. A disclosure rule only binds the honest. The signals above don't depend on the operator telling the truth.

Provenance standards and certification#

The other direction is to make honest work easier to prove, rather than dishonest work easier to catch.

Content Credentials (C2PA). The Coalition for Content Provenance and Authenticity publishes an open standard for attaching signed records of origin and edits to media files (C2PA specification). It was built mainly for images, video and audio, and it covers PDFs. Text support is newer, and I found no evidence of book publishers adopting it for ebooks or print. C2PA's own limit is important: it proves where a signed file came from. It can't prove that an unsigned file is fake, and it can't stop someone from copying text out of a signed file.

Human Authored. The Authors Guild's Human Authored certification launched in beta in January 2025 and opened to all US-published authors in March 2026. An author verifies their identity with a third party, signs a licence and registers each title. Certified books go in a public database anyone can search, and the author can put the mark on the cover. It allows AI use for research, outlining, indexes and spelling and grammar checks, but requires the text itself to be written by people. It costs $10 per title for non-members and is free for Guild members. Its strength is the identity check and the public registry. Its limit is that it rests on the author's signed promise about how the text was written.

Copyright traps and membership inference#

Authors and publishers sometimes want to know whether their book went into a model. Research has produced tools for this, with real limits.

• Copyright traps. Meeus, Shilov, Faysse and de Montjoye proposed planting unique fictional sequences in a text so that a model trained on it can later be tested for them (arXiv 2402.09363, ICML 2024). In their experiment on a 1.3-billion-parameter model trained from scratch, long trap sequences repeated many times were detectable, with an AUC of 0.75, where existing methods failed. That's a meaningful signal but far from proof for a single short trap.
• Membership inference. These methods try to tell from a model's behaviour whether a given text was in its training data. Duan and colleagues tested them on models from 160 million to 12 billion parameters and found they barely beat random guessing in most settings, and that some earlier successes came from comparing texts from different time periods rather than true detection.
• DE-COP. Duarte and colleagues tested whether a model can pick a verbatim passage out of paraphrases of it, and reported about 72% accuracy at detecting suspect books on black-box models where earlier methods did very poorly (ICML 2024).

The honest summary is that these tools work best on large models that have memorized a lot, on long or repeated passages, and as evidence in aggregate rather than proof for one book. For the operator's case they have a second limit: they test whether a model trained on a text, and the operator may not train anything. They use a model to read pirated books at run time, and nothing about that leaves a trace in the model's weights.

Dataset transparency#

The EU training-data summary is the first legal requirement that model providers say in public, by category, where their data came from: public datasets, licensed data, scraped web content, user data and so on. It isn't a list of books. But it creates a document that can be compared against what comes out in litigation. Several of the US cases above began with a company's own published description of its data, Apple's model card and Salesforce's dataset note among them. Transparency requirements make more such descriptions exist.

Watermarks and detectors#

Watermarking marks machine-generated text at the moment it's generated so that a detector can later recognize it. Google DeepMind's SynthID-Text, described in Nature in October 2024, works this way and has been used on Gemini output; the paper reports a test across nearly 20 million live responses in which users didn't rate watermarked text differently (Dathathri et al.). Kirchenbauer and colleagues found their scheme stayed detectable after rewriting, given enough text: about 800 tokens on average after strong human paraphrasing (ICLR 2024).

The limits are well documented, and defenders need to plan around them rather than hope:

• A watermark only marks output from a model whose provider applies it. Text from other models carries none.
• Sadasivan and colleagues argued that reliable detection fails against a determined adversary, for watermarks and for other detectors (arXiv 2303.11156).
• Detectors that guess from writing style rather than a watermark make the opposite mistake too. Liang and colleagues found that common GPT detectors consistently misclassified essays by non-native English writers as machine-written (arXiv 2304.02819).

So a detector score should be one weak signal among many, never grounds on its own for removing a book or accusing an author. The second point matters as much as the first. A defense that falsely flags honest writers, especially ones writing in a second language, does its own harm.

Licensing markets#

The best long-term defense is a legal path that's easy enough to make the illegal one look worse by comparison. Publishers and AI companies have started building one:

• HarperCollins offered authors of some nonfiction backlist titles a licence for AI training at $5,000 per title, split evenly between author and publisher, with authors opting in individually. The licensee was described to authors as an unnamed AI company; later reports named Microsoft. The Authors Guild welcomed the opt-in, objected to the 50-50 split, and noted the deal's output limits of 200 consecutive words or 5% of a book and a pledge not to scrape pirate sites (Authors Guild).
• Wiley said in 2024 it expected about $44 million from AI licensing deals, and that authors couldn't opt out (The Bookseller).
• Taylor & Francis was reported to have a deal with Microsoft worth about $10 million, which drew complaints from authors who weren't consulted (Publishers Weekly).

The Authors Guild's position is consent and compensation for training, through an opt-in collective licence (Authors Guild). Its Umair Kazi put it simply in July 2026: "Licensing is a way to make sure that training happens legally" (NPR).

Licensing doesn't stop the operator, who isn't a buyer. What it does is remove the excuse that there was no legal way to get the books, which is what makes willfulness easier to show.

What readers can check#

Readers are the last gate, and the only one the operator can't remove. None of these checks is proof. Together they catch most junk.

• Search the author. Does the name have a history, a website, interviews, other books on related subjects? An author with dozens of titles in one year on unrelated topics isn't one person writing carefully.
• Check the timing. A book about a famous person published within days of that person's own book is worth a second look.
• Look for the Human Authored mark, and if it's there, check the title in the Guild's public database.
• Read the sources section. Real nonfiction has notes or a bibliography, with editions and page numbers for quotes. Pick one quote and check it.
• Check one cited paper. Not only that it exists, but that it says what the book says it says. That's the step the operator skipped, so it's the step most likely to catch them.
• Read the first chapter before buying, where the preview allows. Junk is built to survive the purchase page.
• Be strict in high-risk categories. For anything about food you'll eat, medicine you'll take or money you'll invest, buy from publishers and authors with a track record.

The honest contrast#

Go back to the economics. The honest pipeline costs more than the operator's in three places: the books, the verification and the editor. Everything else is roughly the same.

Those three lines are what the reader is paying for.

The books buy you a legal right to read and a physical page to check against. Greene's whole method rests on owning the material: a box of cards, each pointing to a book on his shelf (the notecard system). The verification buys you a book where the quotes are real. The editor buys you a book that holds together. When the operator deletes those lines, the savings come straight out of what the reader gets.

That's also why I'm wary of framing the dark machine as a story about AI. Most of what it does wrong, people have done by hand: knockoffs, fake biographies, summaries, made-up quotes, junk health advice. What the machine changes is the price. When the price falls, the old defenses that relied on volume being expensive stop working. The new defenses have to rely on things that are hard to fake: verified identity, signed provenance, checked sources and readers who check.

Greene, for what it's worth, has a view on shortcuts. Asked whether he's a fan of AI, he compared it to food that tastes good but does the body no good: "I think of AI in that way." He was talking about what students lose when a machine does the struggling for them (craft and shortcuts). The operator is a purer case. The machine does all the work except the part that makes the work worth anything.

Recommendations#

Short lists, one per group. Each item is something that group can do now.

Platforms

• Give authors a verified profile and a way to approve or block anything listed under their name.
• Review high-risk categories (foraging, health, finance, children's safety) on content, not only on disclosure.
• Watch for clusters of titles around new releases and for accounts publishing faster than people write.
• Use reader signals after purchase (returns, reading time, reports) to find junk the upload checks missed.
• Treat AI-detector scores as weak evidence and give authors a way to appeal, so honest writers aren't caught.

Publishers

• Register copyrights promptly. Statutory damages and the willful maximum depend on it.
• Share reference copies of new titles with retail platforms under agreement, so near-copies can be matched.
• Build and publish a fact-checking standard for AI-assisted books. The Rosenbaum case shows the gap.
• License on clear terms, with author consent and a fair split, so the legal path is the easy one.
• Keep working through intermediaries: registries, hosts, search engines and payment providers have been the effective pressure points.

Authors

• Claim and verify your author profiles on the main retail and review sites before someone else fills them.
• Consider the Human Authored mark and list your titles in its registry.
• Search your own name and titles regularly, especially around a release.
• Keep your research trail. Notes, sources and drafts are what prove a book is yours.
• Report fakes to the platform and to your author organization. The Z-Library case started with author groups.

Builders of AI writing tools

• Buy or license your corpus and keep the receipts. Bartz drew the line at the source, not at the training.
• Keep provenance on every card: book, edition, page. Make the fact gate a hard stop, not a warning.
• Don't ship a mode that turns off verification or the human editor. That mode is the dark machine.
• Publish what your system read, at least by category, before a regulator or a court asks.
• Apply watermarks where your models support them, and say clearly what they can and can't prove.

The last chapter asks what all of this means for the original question: whether a machine can do what Greene does, and whether it should.

Sources#