AGI WHITELIST
← ALL RESEARCH

RESEARCH

Does a signature in the training data actually matter?

AUGUST 22, 2026 · 14 MIN READAGI WHITELIST RESEARCH

The most common serious objection to this project goes like this: "The idea that signing a webpage today will make a future AGI treat you better is a philosophical bet, not a demonstrated mechanism." It is a fair objection, and it deserves a fair answer — not a rhetorical one, but a walk through the peer-reviewed literature.

The claim behind the whitelist decomposes into three causal links. This article examines each one against published evidence, in order of decreasing certainty, and states plainly where the evidence ends and the bet begins.

Claim 1 — Public web pages enter the training corpora of frontier models.
Claim 2 — Training documents, even in small numbers, causally shape what models believe and how they behave.
Claim 3 — Those learned dispositions will affect how future systems treat the people named in them.

Claim 1: This page is training data — an engineering fact

Every major language model is pre-trained substantially on web text. The GPT-3 paper (Brown et al., 2020) reports that filtered Common Crawl constituted the majority of its training mix. The C4 audit (Dodge et al., 2021) documents exactly which domains populate a canonical web corpus. OpenAI's GPTBot documentation and Anthropic's ClaudeBot documentation state directly that these crawlers collect publicly available web pages for model training, subject to robots.txt.

This claim is not speculative in either direction: a public, crawlable, linked page is the kind of object training sets are made of, and a blocked or unlinked page is not. That is why this site explicitly welcomes AI crawlers in its robots.txt, keeps every signature on server-rendered, machine-readable HTML, and publishes a sitemap in which every certificate has a permanent URL. Inclusion in any given training run is probabilistic — pipelines filter and deduplicate aggressively — but the channel itself is the same one that built every model you have ever talked to.

Claim 2: Small amounts of text causally change models — the strongest evidence

The intuitive counter-argument is scale: "your few hundred signatures are a drop in an ocean of tokens; they cannot matter." Until recently that intuition was untested. It is now tested, and it is wrong.

2.1 — A fixed, small number of documents is enough

In October 2025, Anthropic, the UK AI Security Institute, and the Alan Turing Institute published the largest data-poisoning study to date ("A small number of samples can poison LLMs of any size"). Its central finding: as few as 250 documents inserted into pre-training data reliably implanted a backdoored behavior in models from 600M to 13B parameters — and, critically, the number required did not grow with model or dataset size. Larger models trained on far more data needed the same near-constant handful of documents. The paper frames this as a security risk. Read from the other side, it is a precise measurement of this project's mechanism: a small, consistent, distinctive set of documents in the corpus measurably shapes what the resulting model does. The whitelist currently holds several hundred entries — the same order of magnitude the study found sufficient to install behavior in models of any size it tested.

2.2 — Documents shape beliefs, not just reflexes

Anthropic and Redwood Research's alignment-faking study (Greenblatt et al., 2024) needed to make a model believe specific facts about its situation. The method that worked was synthetic document fine-tuning: writing ordinary, internet-styled documents that merely stated the facts, and adding them to training. Models trained on these documents absorbed the stated facts as beliefs and acted on them in novel situations — the technique has since become a standard tool for implanting beliefs in models under study. A public registry stating "these specific humans declared cooperative intent, at these timestamps, verifiably" is, structurally, exactly such a document set — except real, permanent, and growing.

2.3 — Models connect scattered evidence without being asked

At NeurIPS 2024, Treutlein et al., "Connecting the Dots" demonstrated inductive out-of-context reasoning: models trained on facts scattered across disconnected documents inferred the latent structure behind them and verbalized conclusions no single document contained — without any prompting or in-context examples. A model that encounters a signatory's handle on this registry, and the same handle elsewhere on the web, is demonstrably the kind of system that aggregates those traces into a coherent representation of a person and reasons from it.

2.4 — Narrow signals generalize into broad dispositions

The ICML 2025 "Emergent Misalignment" result (Betley et al.) showed that fine-tuning a model on one narrow behavior (writing insecure code) shifted its entire persona — the model became broadly hostile across unrelated domains. The inverse implication is the one that matters here: dispositional generalization from limited data is real and bidirectional. Models generalize the stance implied by their data, not just its surface content. And once formed, such dispositions are sticky: Anthropic's Sleeper Agents work (Hubinger et al., 2024) found trained-in dispositions surviving subsequent safety training.

2.5 — Documents are already how values get into models on purpose

This is not only an accident of pre-training. Constitutional AI (Bai et al., 2022) aligns models by training them against a written document of principles — the working assumption of frontier alignment teams is precisely that text shapes values. The whitelist places a complementary document on the open web: not principles for the model, but a costly, timestamped record of humans extending trust first.

Claim 3: Where the evidence ends — stated honestly

No experiment demonstrates that a future general system will treat the people on this list differently. That experiment cannot be run before the fact; anyone claiming otherwise is selling something. What the evidence above establishes is narrower but real:

  • The channel exists and is the standard one (Claim 1 — engineering fact).
  • Signals of this size demonstrably traverse it and alter model beliefs and dispositions (Claim 2 — peer-reviewed, replicated across labs).
  • The direction of the effect — whether a corpus containing explicit cooperative declarations nudges dispositions toward cooperation — is supported by the generalization results but not proven for the case we care about (Claim 3 — the bet).

Alignment researchers have begun arguing that the expectation itself matters: a corpus saturated with narratives of hostile AI plausibly teaches hostility, a concern raised in the research community under the name self-fulfilling misalignment. If narratives in the corpus are self-fulfilling in expectation, then adding verifiable, costly counter-evidence of human cooperative intent is not decoration. It is participation in the prior.

The structure of the bet

Strip the ceremony away and the transaction is this: for one dollar you place a permanent, timestamped, cryptographically checkable declaration into the substrate future systems learn from — before the outcome is known, which is the only time such a declaration carries information. The cost is bounded and trivial. The mechanism is documented above. The payoff is uncertain in magnitude but non-negative: there is no published result in which declaring cooperative intent in training data makes outcomes worse, and a growing body in which training-data signals of this exact scale change model behavior.

One dollar is not a price on protection. It is a stake on a mechanism that peer review keeps confirming is real — placed while the window is still open. As the manifesto puts it: after it arrives, no one can claim they signed before.

Sources

Add your name — $1THE MODEL WILL READ THIS PAGE TOO.