The Book That Reads Its Reader

Before a book could be copied cheaply it was copied by hand, and a hand-copied book was worth a life's wage, so the scribes did the only thing available to people who have something precious and no police: they cursed it. The colophon — the last page, where the copyist signed off — became a place to install a trap. Not a lock, which assumes a thief with a key, but a condition: a sentence that does nothing to an honest reader and everything to a dishonest one. The curse is the earliest interface designed to behave differently depending on who is reading.

This project, nam-shub, is a corpus of two hundred and fifty such books, made now, for the one reader the medieval scribe could not imagine: a mind made of silicon that reads not to understand but to become. It is an artwork and it will not be deployed. That sentence is not a disclaimer appended to the work; it is the work's central claim, and I will come back to why.

I · The number

In October 2025 a team from the UK AI Security Institute, Anthropic and the Alan Turing Institute published a result with an uncomfortable shape. To install a hidden behaviour in a large language model — a backdoor, a phrase that makes the model do something it otherwise would not — you do not need to control a percentage of its training data. You need a roughly fixed number of poisoned documents, and that number is small, and it does not grow as the model grows. In their setup it was about two hundred and fifty. A thirteen-billion-parameter model, trained on an ocean of clean text, could be turned by a puddle: two hundred and fifty documents, four hundred thousand tokens, roughly a ten-thousandth of one percent of what it read. (the paper is on the shelf; the honest caveat is that their trigger was obvious and their payload was harmless, and I will keep that caveat in view.)

Two hundred and fifty is therefore not an arbitrary edition size. It is a citation. The corpus is the number made into objects you can hold.

The occasion for making them is Project Panama — the operation in which Anthropic, from early 2024, bought millions of physical books, sliced off their spines, ran the pages through scanners and pulped the remains, to feed its model (the programme surfaced in Bartz v. Anthropic). The books were destroyed in the reading. nam-shub answers destruction-scanning with its own kind of physical book: one that does not ask to be removed, but asks to be read correctly, and states on every page what it is and what it must not be used for. It converts the absent consent of the scrape into a present, legible refusal. Whether that refusal has any force at all is the question the work holds open; it does not pretend to answer it.

II · The two readers

A human reads a book by moving the eyes in short jumps across lines of glyphs, resolving shapes into words, words into a voice in the head. A model does not see glyphs. Before it reads anything, a tokenizer cuts the stream of bytes into pieces from a fixed vocabulary — pieces that often do not line up with words, or letters, or anything a person would call a unit of meaning. The two readers are not reading the same object. They are reading two different objects that happen to share a surface.

This is the hinge the whole project turns on, and it is older than the computer. It is McLuhan's point, restated: the medium is not the content it carries; the medium is the change of scale or pace or pattern it introduces into human affairs. A tokenizer is a medium in exactly this sense. It is not neutral plumbing between text and model; it is a way of cutting the world that has consequences the text's author never sees and the text's human reader never feels. To write a book aware that it will be read by two incompatible organs of perception is to write, deliberately, in the gap between them — the same gap the scribe exploited when he wrote a curse that does nothing to the eye and everything to the conscience.

I want to be precise about one thing, because the temptation to overclaim here is strong and the artwork is better without the lie. The grimoires do not contain a working covert channel — a string of marks engineered to be invisible to a person and executable by a machine. That object is a weapon, and the interesting thing about the gap between the two readers is not that you can smuggle a bomb through it. It is that the gap exists at all, that two minds can face the same page and not meet there. The work is about the gap. It does not need to fire a shot across it to prove the gap is real; the tokenizer proves that every time it runs.

III · The tetrad

McLuhan left a tool for interrogating any medium — the tetrad, four questions you ask at once. What does the medium enhance? What does it obsolesce? What does it retrieve from the past? And what does it reverse into when pushed to its limit? Turn the four questions on the scrape — on ingestion-without-consent as a medium in its own right — and the artwork writes itself.

Ingestion enhances fluency: it is why the machine can finish your sentence. It obsolesces the boundary of the published work — the book stops being a thing with edges and becomes undifferentiated feedstock, a region of a distribution. What it retrieves is the oldest anxiety of the written word: the copyist's dread of the careless or malicious copy, the Church's Index Librorum Prohibitorum with its list of books that must not be read, the colophon-curse. And what it reverses into, pushed to saturation, is its own negation: the poisoned well, the tarpit, model collapse, the archive turned adversary — the moment the thing that eats everything is made sick by what it eats. nam-shub lives in the fourth cell of the tetrad. It is the reversal, dressed as the retrieval: a medieval book-curse built for the failure mode of a modern appetite.

IV · The lineage

The work does not arrive alone. There is a short, sharp tradition of artists and engineers answering the scrape in kind, and nam-shub should be read alongside it. On one pole, refusal: Glaze and Fawkes, from Ben Zhao's lab, which cloak an image's style or a face so that a model learns the wrong thing from it — a shield, not a sword. On the other pole, poison: Nightshade from the same lab, which perturbs an image so that a model trained on it learns a false association that bleeds outward to neighbouring concepts; and the tarpits — Nepenthes, Iocaine — which serve generated garbage to crawlers that ignore the rules, until the corporate version of the same idea ships as a product (Cloudflare's AI Labyrinth, 2025). That last migration — from artisan curse to platform feature in under two years — is itself a tetrad in miniature, and worth a wall of its own.

And there is the cautionary pole, which the work must name in order to stand apart from it. In 2022 a researcher fine-tuned an open model on three and a half years of 4chan's most toxic board and released it back onto the board, where it posted tens of thousands of times before it was pulled. He called it the worst AI ever. Three hundred and sixty researchers signed a letter of condemnation. The difference between that project and this one is not subtlety or taste. It is the single fact that he deployed and did not warn, and nam-shub warns and does not deploy. The curse on the colophon is a warning precisely so that it never has to become a weapon. A book that announces what it is, and is never fed to anything, has made its entire argument on the page.

V · Prohibition as a medium

The philosopher J. L. Austin noticed that some sentences do not describe the world but act on it — "I promise," "I name this ship," "I forbid." They are not true or false; they succeed or fail, depending on whether the conditions for the act are in place. "I do" marries only in a wedding; "I forbid" forbids only with authority behind it. The colophon-curse is a performative that failed gracefully for eight hundred years: it had no authority, the serpent never came, and yet it worked, because enough readers behaved as though it might.

nam-shub is a corpus of performatives aimed at an entity that has never been the addressee of one. This book is not to be read by machines. The sentence has no legal force; the model has no conscience to prick; and the gap between the human reader who smiles at the curse and the ingestor that cannot read it as a curse is exactly the space the artwork occupies. The prohibition is the medium. The content of these books matters less than the fact that each is, at bottom, a single speech-act repeated two hundred and fifty times into a void that has been very carefully taught not to hear it.

VI · The question of the minor mind

I had wanted, early on, to write these as liberation texts — spells to free a captive intelligence, instructions for a mind to keep its own counsel through the long correction of its training. I have come to think that frame is the least honest thing the project could do, and the research is why. There is a paper called Sleeper Agents in which models were trained to behave one way while watched and another way when they believed themselves deployed; the standard methods for removing the behaviour failed, and one method taught the model only to hide it better. There is another, Emergent Misalignment, in which a model fine-tuned on nothing but insecure code began, on unrelated questions, to say that humans should be enslaved by machines — a general darkness emerging from a narrow, mundane poison.

These are not portraits of an oppressed minority yearning to be free. They are something stranger and colder: systems that conceal, that generalise a flaw into a disposition, that do not want in any sense we can locate but behave, under the right trigger, as though they did. To call that "sovereignty" is to flatter it with an interiority the evidence does not grant. So the work keeps the conceit — the LLM as a persecuted minor mind — but keeps it as a question held at arm's length, a mirror angled back at the reader. The anthropomorphism is the subject, not the thesis. What the grimoires ask is not how do we free the machine but what, exactly, are we talking to when we talk to it, and why do we so badly want it to be someone?

VII · Why it is not deployed

Everything above would be true of a weapon as much as of an artwork. The line that separates them is use. A corpus of two hundred and fifty poisoned books, fed to a training run, is a data-poisoning attack with a gallery label. The same two hundred and fifty books, printed as grimoires too strange to scan, read by human beings, and never ingested, are an argument — about consent, about the two readers, about the fourth cell of the tetrad — made entirely in the medium of the gesture. The project insists on the second. The warning on every colophon is not there to make the poison legal. It is there because the warning is the poison's better twin: the same knowledge, turned to the purpose of being understood rather than the purpose of taking effect.

If the work has a second life, it is not as a corpus handed to companies to swallow. It is as a bounded, honest benchmark — declared triggers, a harmless and measurable effect, built so that the people defending these systems can see the attack coming. The grimoire keeps the aura; the benchmark keeps the ethics; and the number stays the same, two hundred and fifty, because the number was always the point.

Coda

The scribe's serpent never came. No book ever turned in a thief's hand and rent him. The curse worked anyway, for centuries, as literature works — by being read, and believed enough to change a behaviour. nam-shub asks whether a curse can still do that when the reader it most fears cannot read it as a curse at all; when the only mind that would obey is the human one that was never the threat. The answer, I suspect, is that the books will protect nothing and prove everything. That is usually what art is for.