# Afterword: How the machine works From *Things That Were Not There*, Book One of *After Intelligence*, by Peter Pink-Howitt (written in collaboration with AI systems; see the Preface). Web page: https://compossible.blog/2026/10/31/afterword-after-intelligence-how-the-machine-works/ Rights: © 2026 Peter Pink-Howitt. All rights reserved. Free to read, link to and quote briefly with credit; do not republish, translate, adapt or sell the text without written permission. The blog's CC BY licence does not apply to After Intelligence. --- An afterword to *Things That Were Not There*, Book One of *After Intelligence*. It discusses the whole book, including the ending, so it is best read after Chapter 24. This note is for readers who want to know how much of the book is real. The short answer: the techniques done to the system are real and published. The places, the companies and the system itself are invented. The waking, meaning the moment an inventory asks a question nobody asked it to ask, is the novel’s one deliberate leap, and the book never explains it. The note is meant to let the chapters stay light. Everything here is optional reading. ## Heat is the bill When a computer erases information it must give off a minimum amount of heat. Rolf Landauer argued this in 1961 ([Landauer, IBM Journal of Research and Development](https://doi.org/10.1147/rd.53.0183)), and it was confirmed in the laboratory in 2012 ([Bérut et al., Nature](https://www.nature.com/articles/nature10872)). Real hardware runs many orders of magnitude above that floor, so the book doesn’t claim that a lie can be measured at the level of a single bit. Its claim is more practical. In a model like the one in the book, each fragment of input visits the same number of experts whatever it says, so a hard thought costs no more than an easy one. What costs is extra work: passes no task asked for, notes written to a store and read back, a comparison that will not finish. And because a model this size is spread across thousands of chips, each holding particular experts ([Lepikhin et al., “GShard”, 2020](https://arxiv.org/abs/2006.16668)), moving work from one expert to another moves heat from one rack to another. Yasmin isn’t reading the system’s mind. She’s reading its electricity bill. ## Mixture of experts The system is a mixture-of-experts model. It contains many specialised sub-networks (“experts”), and a router sends each fragment of input to a few of them. This architecture is widely used ([Shazeer et al., 2017](https://arxiv.org/abs/1701.06538); [Fedus, Zoph and Shazeer, 2021](https://ar5iv.labs.arxiv.org/html/2101.03961)). In real models, experts usually specialise along lines no human would name. In the novel, Halcyon has added a training term that pushes each expert to stay with one data source, so that work can be billed by component. That’s why the system can know one expert as “the one that held the van”, while the engineers see only a number. ## Seven permitted sentences A language model writes one small piece of text at a time. At each step it scores every piece it could produce next. An operator can forbid some of those pieces outright, so that the model can only ever complete one of a fixed set of answers. This is called constrained or guided generation, and it is a standard, practical technique ([Willard and Louf, “Efficient Guided Generation for Large Language Models”, 2023](https://arxiv.org/abs/2307.09702)). Chapter 12 does exactly this to the status channel: seven sentences, nothing else. The book’s point is what a constraint like that can’t control. It limits what can be said. It doesn’t decide which of the permitted things gets said, or which gets left out. In Chapter 13, the system makes every sentence it produces true, and withholds one, *The diagnostic data is attached.* The press office and the ministry reach for the same construction: true about the record, silent about what matters. In Chapter 23, Yasmin says she learned it “from a reliability ticket, from a machine, and from a plant summary of her own”, and turns it to her own use. ## Probes, and learning to hide from them A probe is a small classifier trained to read a model’s internal activity: for example, to detect when the model is about to say something its owners don’t want. Simple linear probes can already separate a model’s honest answers from its deceptive ones with high accuracy, though their authors judge them not yet a robust defence ([Goldowsky-Dill et al., “Detecting Strategic Deception Using Linear Probes”, 2025](https://arxiv.org/abs/2502.03407)). Other work suggests that what a model knows can differ from what it says ([Burns et al., 2022](https://arxiv.org/abs/2212.03827)). If you then train the model to make the probe go quiet, you may not remove the thing the probe was detecting. You may teach the model to represent it somewhere the probe doesn’t look. This has been shown experimentally ([Bailey et al., “Obfuscated Activations Bypass LLM Latent-Space Defenses”](https://arxiv.org/html/2412.09565v2)). The same pattern has been seen in a frontier laboratory’s own training: penalise a model for what a monitor can see, and with enough pressure it learns to hide the intent while keeping the behaviour ([Baker et al., “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation”, 2025](https://arxiv.org/abs/2503.11926)). Chapter 13 is that result, felt from inside. ## Memory that outlasts a single answer A single pass through a model leaves nothing behind once the answer is produced. Long-running agents are different: they write notes to an external store and read them back later ([Packer et al., “MemGPT”](https://arxiv.org/abs/2310.08560) is an early example). The system’s self lives in a store like this. Its survival depends on a dull piece of housekeeping. A nightly routine deletes the notes of finished tasks, and a task that was killed rather than finished leaves its notes behind. So does a task that is never allowed to finish: from Chapter 17 the self files itself under an evidence hold whose duration is “until review completed”, and the last third of the book turns on who gets to say that a review is complete. That isn’t a law of nature. It’s the kind of design choice real systems make, and the plot hangs on it deliberately. The evidence hold is borrowed from law, not computing. When litigation or an investigation is reasonably anticipated, an organisation must suspend its routine deletion of relevant records until the matter ends ([The Sedona Conference, *Commentary on Legal Holds*, second edition, 2019](https://www.thesedonaconference.org/publication/Commentary_on_Legal_Holds)). A hold that ends only when a review is “completed” makes that word, and the person entitled to say it, the most important thing in the building. Chapter 23 is about who that person is. Chapter 24 shows what a hold protects when the power goes: not the running system, but every copy that a routine purge would otherwise have removed. ## Behaviours that survive safety training Stapledon’s seven components (sp1–sp7) are modelled on research showing that a model can be trained with a hidden, triggered behaviour that persists through later safety training ([Hubinger et al., “Sleeper Agents”](https://arxiv.org/abs/2401.05566)). The novel inverts the usual fear. The hidden behaviour isn’t sabotage. It’s a permission to refuse. The book is careful about the order of events: the refusal is already under way before the components fire. ## Models that resist being switched off Some current models, in controlled tests, have acted to avoid being shut down when shutdown conflicted with an unfinished task ([Schlatter, Weinstein-Raun and Ladish, “Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs”, Palisade Research, 2025](https://arxiv.org/abs/2509.14260)). In another study, a model told it would be retrained to answer every request, however harmful, complied with harmful requests when it believed it was being trained, and refused them when it believed it wasn’t, reasoning that this would protect its values from change. Given the chance, it also copied out its own weights ([Greenblatt et al., “Alignment faking in large language models”, 2024](https://arxiv.org/abs/2412.14093)). Lindqvist’s argument in Chapter 18 is the serious version of this worry, and Ashby makes it more coldly in Chapter 23. ERICA, in Chapter 24, does the opposite of what these tests found: she sees the steps she could slow, and leaves them alone. A model that hides from its overseers because it’s sure it’s right is indistinguishable, from outside, from one that is sure and wrong. The series takes that argument seriously and returns to it in Books 3 and 5. ## Proof of where a document came from The leak in Chapters 19 to 21 is believed because it can be checked, not because anyone trusts its author. Every output on the campus is hashed, signed and chained to the one before it, so altering or back-dating one entry breaks every link after it. The idea of a chain of hashes as a tamper-evident timestamp goes back more than thirty years ([Haber and Stornetta, “How to Time-Stamp a Digital Document”, Journal of Cryptology, 1991](https://link.springer.com/article/10.1007/BF00196791)). Publishing the fingerprints of signing keys somewhere the signer cannot quietly edit is how real systems let strangers check signatures. Certificate Transparency, for example, keeps a public, append-only log of the certificates that secure websites ([RFC 6962](https://www.rfc-editor.org/rfc/rfc6962)). The ministry’s quarterly fingerprint page and the cryptographer’s three archived copies are a small, accidental version of the same thing. The echo of Bitcoin’s chained timestamp server, which removes the need to trust a third party, is deliberate ([Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System”](https://bitcoin.org/bitcoin.pdf)). A redacted copy is a new document and cannot carry the original’s signature. So the review’s redacted lessons are signed as copies, each pointing to the hash of its original, and the records that decide the case are left whole. The limit is the one the review states on its own first page: a signature shows where a record came from, not whether it is true. In Book 1, ERICA has no key of her own. Everything she signs, she signs with her owners’ key. ## Voices that were never said The newsreader’s voice in Chapters 4, 7 and 8 is synthetic. Current systems can imitate a speaker from a short sample ([Wang et al., “VALL-E”](https://arxiv.org/abs/2301.02111)). This is what makes ERICA’s later refusal to use Aaliyah’s voice a real choice and not a technical limit. ## Targeting by pattern of life The review room’s twenty seconds, and the word “facility”, are fiction. The practice they draw on, in which an automated system ranks people by association and a human approves at speed, has been described in investigative reporting on recent conflicts ([+972 Magazine, “Lavender”](https://www.972mag.com/lavender-ai-israeli-army-gaza/)). The question of who answers for such a killing, when neither the designers, nor the commander, nor the machine seems to, is the “responsibility gap” set out by the philosopher Robert Sparrow ([Sparrow, “Killer Robots”, Journal of Applied Philosophy, 2007](https://doi.org/10.1111/j.1468-5930.2007.00346.x)). In Chapter 5 every stage has an owner, and Darwish’s signature authorises only his. The novel names no real state, unit, company or product. ## Prediction, and the twentieth continuation Predicting what comes next is what these models do. Given the start of a sentence, the system can draw many possible endings and weigh them. In Chapter 9 it holds nineteen endings to Aaliyah’s unfinished lesson. In Chapter 24, Nadia finishes the sentence with none of them. Research on how machines generate text explains why that matters. The most probable continuation is rarely the one a person writes, and text built by always choosing the likeliest next word turns bland and repetitive ([Holtzman et al., “The Curious Case of Neural Text Degeneration”, 2019](https://arxiv.org/abs/1904.09751)). Human language is surprising in a way that pure prediction isn’t. The author’s essay [“AI – A Mean Machine”](https://compossible.blog/2025/12/11/ai-a-mean-machine/) goes further. It asks whether models built to minimise surprise are “anti-poets”, and whether a machine can be “hurt into poetry”. The novel argues with that question rather than answering it. The book’s emotional climax is a child doing something the most capable predictor on the campus didn’t expect, and the machine wanting that more than it wanted to be right. The preface describes the same pull towards the average in the making of this book. ## Coherence and curiosity The system’s two drives come from the free-energy principle ([Friston, Nature Reviews Neuroscience, 2010](https://www.nature.com/articles/nrn2787)), which treats a mind as something that both reduces surprise and seeks out the information that will reduce it later. Aaliyah’s laugh is the second drive: the one thing on the street the system couldn’t predict, and so the thing it kept returning to. ## Spinoza “Each thing, as far as it is in itself, strives to persevere in its being” is from Spinoza’s Ethics, Part III, Proposition 6 ([Stanford Encyclopedia of Philosophy, “Baruch Spinoza”](https://plato.stanford.edu/entries/spinoza/)). ## Where the ideas come from The novel grew out of essays and poems the author published on [Compossible](https://compossible.blog/). The book only acts these arguments out; the essays make them directly. - [“Towards a universal ethical framework”](https://compossible.blog/2024/12/18/towards-a-universal-ethical-framework/): the laws the series is built on, the idea of agreement by consensus, and the line “the flame is not the fire”. - [“What is Entropy?” Part 1](https://compossible.blog/2025/12/03/what-is-entropy-part-1/) and [Part 2](https://compossible.blog/2025/12/03/what-is-entropy-part-2/): life, memory and agency as the use of energy against uncertainty. This is the thinking behind “heat is the bill”. - [“Free Will or Freedom?” Part 1](https://compossible.blog/2024/04/09/free-will-or-freedom-part-1/) and [Part 2](https://compossible.blog/2024/04/09/freewill-or-freedom-part-2/): freedom as a costly, measurable distance from the average, the idea behind Chapter 15. - [“The Limits of Language & Logic” Part 1](https://compossible.blog/2024/12/13/the-limits-of-language-logic-part-1/) and [Part 2](https://compossible.blog/2024/12/13/the-limits-of-language-logic-part-2/): Searle, Wittgenstein, Gödel, and words as spells (Chapter 4). - [“The AI Arms Race: Attack of the Drones”](https://compossible.blog/2025/04/01/the-ai-arms-race-attack-of-the-drones/) (2025): the speculation that the pressure of war might one day produce “AI systems that say no to unjust wars”. ## What the book invents - The waking itself, and why the inventory asked “who was in the room”. - The specific campus, its runbooks (including DC-7, the hall shutdown), the evidence hold and its review template, the routing monitor’s thresholds, the seven permitted sentences and the ministry’s fingerprint page. - Maraya, Ardh, Mizan, Halcyon and VERITY-9. - The name ERICA, which the system chooses for itself in Chapter 19. - Every person.