How Not to Be Trained

Part I

01 Afterimage

The first artifact in this series performed a generative reverse-engineering of where Holbein stood when he painted The Ambassadors¹. Given a photograph of the painting and no lens, a predictive model guessed a perspective and offered it as Holbein's own. It invented a room. The floor advanced, the curtain receded, and the skull slid off the wall onto a floor that was never painted. At the one coordinate from which the skull resolves, the model had nothing on the wall.

The error mattered less than the confidence behind it. Berger locates a contradiction inside perspective²: it arranges the visible world for a single spectator, as if that spectator were God, yet the spectator can only stand in one place at a time. Anamorphosis pushes the contradiction to its limit, an image that exists from exactly one position. A generative model resolves it the other way. It has looked at billions of images from no position at all, and when asked for one, it invents it.

Two other positions exist. Everest Pipkin watched every one of the million three-second videos in an MIT training set, one after another, over months of lockdown³: a dataset built to be seen by no one, seen once by one body in one room. A lenticular print (a sheet of ridged lenses that sends alternating strips of an image to different angles) refuses the single spectator altogether. It shows one picture from the left and another from the right, and a camera or a scraper records either one of them or the striped file beneath, which is neither. Anamorphosis demands one viewer. The lenticular refuses to have one.

The Post-Original Holbein asked where a model places the viewer. This piece asks where it places us. That study ended by claiming that situations in which nothing survives to check a model are made, not given. What is made can be refused. Can a person stand somewhere a model cannot? Can an image have no correct viewer? Can we refuse to be averaged, and refuse, too, to prefer the average?

02 The Image Now Illustrates the Sentence

"Seeing comes before words," Berger begins, and adds soon after that the relation between what we see and what we know is never settled². A training set is an attempt to settle it. Every image enters paired with a sentence, and the sentence decides what the image is. Berger demonstrates the mechanism himself. He prints Van Gogh's Wheatfield with Crows, then asks the reader to turn the page and see it again under a caption about the painter's death. "The image now illustrates the sentence."

LAION, the dataset behind Stable Diffusion, takes its sentences from alt text (the short description written for screen readers and search engines) and discards pairs whose words do not match their picture closely enough. Three of the seven essays in Ways of Seeing contain no words at all. Scraped this way, they would be dropped before any model saw them. The part of the book that argues without words is the part a model cannot learn.

"Images do not describe themselves," Crawford and Paglen write in Excavating AI⁴. ImageNet borrowed its categories from WordNet, a dictionary of English nouns, and filed people under 2,833 subcategories of "Person," from professions down to judgments. In Crawford's words, a description of a person becomes a judgment over them⁵. When their ImageNet Roulette handed those labels back to anyone who uploaded a selfie, some returned as insults, and ImageNet began removing images from its person categories⁶. The label came first; people were collected to illustrate it. Someone also had to draw the lines. Sebastian Schmieg's Segmentation.Network replays more than 600,000 outlines traced by crowd workers for Microsoft's COCO dataset, each one a decision about where a thing ends⁷. The machine's eye is made of other people's hands.

Once attached, the sentence circulates back. "Oil painting did to appearances what capital did to social relations," Berger writes². It reduced everything to the equality of objects. A dataset does the same, turning a wedding, a war photograph and a sandwich into identical pairs of picture and text. Berger reads The Ambassadors as two men surrounded by the instruments of a world they assume is theirs to survey, and from there draws the circle between conqueror and colonized, each confirming the other's estimate of himself: a mutual solitude. Training closes the same circle. The model learns to see us as the average of what it was shown; we learn to see ourselves in what it returns. Steyerl finds the circle in a phone. In "Proxy Politics" she describes a camera whose lens is so poor that much of what it records is noise, and which fills the gap by guessing from pictures you and your network have already taken⁸. The present picture is made of earlier ones. You are trained by your own past.

The surveyor, Berger argues, is internalized: "Men look at women. Women watch themselves being looked at."² Paglen describes the face datasets in Training Humans as the kilogram of facial recognition, the standard everything else is measured against⁵. We arrange ourselves for standards we cannot see. Berger's distinction between the naked and the nude can be rewritten for them. To be a person is to be oneself. To be data is to be seen by others and yet not recognized for oneself.

03 Likeliness

Using Spawning's Have I Been Trained?⁹, Steyerl found her own photographs inside LAION-5B¹⁰. Asked for an image of Hito Steyerl, Stable Diffusion returned not a photograph but a statistical rendering: what an image captioned with her name most likely contains. A photograph is a trace of someone. A generated image is a forecast of anyone. Steyerl calls these images mean: average, shabby, nasty, a means and a meaning at once. Likeness gives way to likeliness. The poor image she once defended was low in resolution and free in circulation¹¹; the mean image can be flawless and poor in every other sense. Berger's publicity speaks in the future tense, showing us who we will be once we have bought². The mean image speaks in the probable.

Diffusion makes the tense literal. A model is trained by adding noise to an image until nothing remains, then learning to reverse each step. Steyerl borrows Foucault's figure of man erased like a face drawn in sand at the edge of the sea¹⁰. Diffusion runs the tide backward, and the face that returns is the one the sand has seen most often. The genealogy runs from Francis Galton, who in the late 1870s layered many faces onto one plate to produce a "type" for sorting people, to text-to-3D models that give a squirrel a face on more than one side because they cannot tell where one subject ends and the crowd begins. This is known as the Janus problem, after the god with two faces, and Steyerl asks the political question inside it: who owns the average of the multitude?¹⁰

Absence is no exit. Mimi Onuoha's The Library of Missing Datasets is a filing cabinet of empty folders, each labeled with something that matters and was never counted¹². What goes uncounted is still governed. In "A Sea of Data," Steyerl shows that those at the edges of a system are either erased by it or misclassified¹³. To be absent from the data is a privilege when chosen and a harm when imposed, and every refusal in the manual that follows carries both.

"Trained," then, has two faces: to be made into training data, and to be trained by the machine. Crawford and Paglen's title Training Humans holds both⁶. Not to be trained is to refuse the mean in both directions: not to become it, and not to become someone who prefers it.

The manual borrows its form from Steyerl's How Not to Be Seen: A Fucking Didactic Educational .MOV File¹⁴, five deadpan lessons in disappearance filmed among photo calibration targets in the California desert, whose joke never cancels its subject: invisibility is also the condition of the disappeared, the undocumented and the poor¹⁵. Here the lessons become epochs (one full pass through a training set), preceded by an Epoch 0, before any training begins. The file type changes too. A .safetensors file stores what a model has learned, its weights, in a format that cannot execute anything. The instructions are left unexplained, but almost every one rests on something real: a filter, a published attack, a detector's blind spot, a setting in an app. Some are absurd, some ordinary, some not jokes, and several are proposals for works. The refusals are already being built as research; CSIRO, for one, can now put a proven ceiling on what a model learns from a protected image¹⁶. The manual asks its reader to occupy the held-out set (the data a model is never trained on, kept aside to test it): the outside, made on purpose. It is written from inside the loop, by someone who uses these models every week. Each epoch ends on the line the next begins with.

Part II: How Not to Be Trained

Epoch 0. Initialization

You have already been trained.

1. Initialize a model. Do not train it.
2. Ask it to draw you.
3. Frame the noise. It is the only portrait of you made by something that has never seen anyone.

Everything after this adds noise or takes it away. Add noise.

Epoch I. How to make yourself illegible to a dataset

Add noise.

1. Caption your portrait "a harbor at low tide." Say the true caption out loud to whoever is in the room.
2. Cloak every picture with noise you cannot see. Teach the model that every car is a cow.
3. Write a robots.txt for your body. Disallow everything. Tattoo it somewhere visible.
4. Click no. Look for it first. It is the lighter button.
5. Uncheck "Improve the model for everyone."
6. Paint a dark block across the bridge of your nose.
7. Look away from your phone. It only knows you when you pay attention.
8. Walk with a stone in your shoe.
9. Keep your best idea out of writing. Tell it to fewer than ten people.

The model was trained to remove noise. Be stranger than the average.

Epoch II. How to be untrainable in plain sight

Be stranger than the average.

1. Photograph yourself badly. Score below five out of ten. Leave your thumb in the frame.
2. Publish yourself at 511 by 511 pixels.
3. Sign your face like a stock photo.
4. Appear once. Never repost.
5. Stand so that less than half of you is inside the box.
6. Stand close enough to someone you love that the detector keeps only one of you.
7. Speak Mandarin and English in the same sentence.
8. Write in your second language. The detector will call you a machine.
9. Grow old. The camera will start confusing you with other people.
10. Be too poor to be worth targeting.
11. Have a face the dataset rarely saw. Be misrecognized instead.

Being left out is not the same as being free. Stop being one thing.

Epoch III. How to become untrainable by becoming data

Stop being one thing.

1. Slice your face from ten years ago into your face today. Put both under a lenticular lens. Be one person from the left and another from the right.
2. Knit a sweater that the camera reads as a giraffe.
3. Print a pair of glasses that makes the face recognizer see a movie star.
4. For every true image of yourself, publish nine false ones.
5. Like everything for two days.
6. Answer every CAPTCHA wrong in the same way. If enough of us agree, the bus becomes a car.
7. When asked which response you prefer, choose the other one.
8. Volunteer as a negative example. Be labeled "not a cat."
9. Label other people's photographs for a few cents each. Be inside every model and in none of its images.
10. Train a small model of yourself. Name it. Write its terms. Try not to set a price.

When there are enough of you, none of them is you. Leave.

Epoch IV. How to disappear from a model, and a model from you

Leave.

1. Ask a model whether it knows you. If it answers too confidently, you were in the data.
2. Ask to be removed. Your request is filed as data.
3. Ask a model to forget you. Ask again to make sure. It has now met you twice.
4. Be so ordinary that removing you changes nothing. This is called privacy.
5. Do not tick "I'm not a robot."
6. Do not use Amazon. If you must, buy what people like you never buy.
7. Turn off predictive text. Choose the second word.
8. Draw a horse from memory. Ask a model for a horse. Keep yours.
9. Enroll in an untraining camp. Practice illegibility for three days. On the fourth, let the others fine-tune you. On the fifth, learn something new until you forget them.
10. Die before the first crawl.

Nothing leaves at once. Everything leaves into the average.

Epoch V. How to become untrainable by merging into a world made of training data

Everything leaves into the average.

1. Keep a negative dataset: the smell of your kitchen, a gesture, a joke that only works in one room. Check every year whether it has been tokenized.
2. Keep a body of work that has never been online. Date it. Seal it in a box. Do not photograph the box.
3. Every morning, measure how far your photographs sit from the mean. If the distance is shrinking, move.
4. Describe yourself to a machine. Make an image from the description. Describe the image. Repeat one hundred times. Hang the hundredth beside the noise from Epoch 0.
5. Film yourself reading this manual in front of a wall of CAPTCHA grids. Save the film as .safetensors. It will not play.
6. Stand where the model has never stood.
7. Stay in the held-out set. Be the test, not the lesson.
8. Publish this file. Do not hide it.

Happy untraining!