The Taint We Leave

Iris asks her proxy, the software agent that acts for her under limits she sets, to look for someone with whom she could investigate a difficult result. Imagine that she and another person have each independently authorised a private search, using selected, limited views of their work. The system proposes a connection for an unexpected reason. Both repeatedly ask for the qualification behind a headline. Both reject a polished answer when its evidence cannot be traced. Both turn to a counterexample before accepting a general rule. Their subjects are different, and neither has written these habits into an interest list. The proxy offers Iris a reason to consider a possible collaborator. It does not name the other person, expose their history or claim that an affinity has been established. The other person’s identity and participation remain subject to a separate decision.

This is a constructed scene, not a report of a system that has been run. It gives the hypothesis of this chapter its constructive purpose: two people might discover a productive connection that an interest list would miss. But a machine might also mistake the habits of their shared assistant, the constraints of their work or the selectivity of the retained record for something about the people themselves. The useful signal and the confounder must be designed for together. Neither has yet been demonstrated for Taint.

The last chapter asked what a proxy may say, and under which grant. Discovering an unknown recipient creates an earlier boundary. Before the proxy has anyone to contact, it may need to derive and compare representations of interaction histories. That computation is itself a use of information. It is not a neutral preparation step that can be treated as separate from later authorisation.

What trace of repeated interaction does it carry, and what may that trace be used for?

A name for the residue

The book proposes the technical term Taint for this hypothesis. The capitalisation matters. This is a proposed concept in Language. It is not a claim to have established a new behavioural fingerprint or a standard representation.

Taint (proposed): a potentially machine-detectable, context-dependent pattern co-produced by a person and the models, prompts, tools, tasks, corrections, accepted outputs, refusals and recording practices present across repeated interactions. Whether the pattern is stable, distinctive or useful must be established for a specified use.

In plain terms, Taint would be whatever regularity remains across many interactions once we account for how those interactions were produced. The idea is that this regularity may be easier for a machine to describe statistically than for the person to recall. The name carries no moral judgement. It does not mean the person is spoiled or that their work is suspect. It names a possible residue of interaction.

Taint also has an established, different meaning in computer-security information-flow analysis. There, labels track how designated data propagate through a program. That technique can help track provenance, but it does not show that this proposed interaction signature exists. The two meanings must not be silently treated as the same.

This remains a book hypothesis. No Taint detector has been built or evaluated for this chapter, no participants have been tested, and no matching benefit has been measured. The phrase potentially machine-detectable states a falsifiable possibility, not an observation. The candidate pattern must outperform simpler explanations before it earns a distinct role. Those explanations include topic, task, writing style, shared provider, explicit interests and artefacts of retained history. If it cannot, the term need not become a software object.

Several boundaries matter immediately:

Taint  ≠  the person
Taint  ≠  identity
Taint  ≠  an explicit profile
Taint  ≠  memory
Taint  ≠  a biometric identifier
Taint  ≠  current intent
Taint  ≠  truth about the person
Taint  ≠  permission to infer or match

Each line matters for a different reason. A memory is a retained record or state. Taint, if it can be measured, would be a derived pattern across selected interactions and their conditions, not the records themselves. A derived vector, cluster or description would be one representation of that candidate pattern, not proof that the pattern exists. Keeping a history does not establish that a stable signature exists. Deriving a signature does not establish what it means.

An explicit profile records claims that someone chose to declare or that were inferred. A signature may become detectable without such a profile. Turning it into a persistent profile is a separate act that depends on permission. An old pattern of rejecting brief answers does not establish what Iris is asking for now.

Even a reproducible association would first be evidence about interaction histories under specified conditions. It would not be the discovery of an essential trait, an identity or a hidden mental state. Repeatability under one model and one task is not yet transferability to other models, tools or contexts.

Co-produced, not extracted from a person

Suppose two people regularly demand citations. That could reflect a shared approach to evidence. It could also reflect a system prompt that inserts citation checks, a tool that makes references easy to retrieve, an institutional review checklist or a task in which unsupported claims are costly. The observable event, citation requests, does not by itself show what caused it. Attributing the cause to the people would require evidence about what each person actually initiated or corrected, and what the surrounding machinery supplied.

The candidate pattern has several contributors. These include what each person requested, the model and its version, system instructions, defaults, tools, task types, interaction modes, feedback opportunities, corrections and refusals, and which records survived. Acceptance is not straightforward approval. Iris may accept an answer because it is sufficient, because review is costly or because she has moved on. A refusal may come from Iris or from the model’s own constraints. Where provenance is missing, it must stay missing. It cannot be filled in with an invented account of the person’s intention.

pattern in the interaction
        ≠
property of the person alone

Changing the model could change the apparent pattern. Removing correction logs could make agreement look more frequent. A shared organisational template could make unrelated people appear alike. Conversely, two people with related practices might look different because one uses voice input and the other edits long technical drafts. These are competing explanations, not background noise to be averaged away. A defensible study would vary people, models, tasks and recording conditions separately enough to estimate which source accounts for a proposed signal.

A compiler might eventually add proposed descriptions of communicative acts, qualifications and corrections to an authorised interaction history. Those annotations would remain fallible features of communications, recorded with their source and the version of the interpreter that produced them. They are not validated Taint measurements. Shared extractors could create apparent similarity, and changed profiles could create apparent difference. Making the annotations available does not by itself lead to a detector, an identity inference, a personality assessment, a compatibility result or a matching advantage.

Birds of a feather, for a stated purpose

The proposed positive application is discovering a candidate collaborator for a declared investigation. Two people might share a way of testing claims, preserving assumptions or interrogating counterexamples, even while working on different subjects. A purpose-specific system could compare such evidence-handling practices without assuming that similar prose, interests or demographics would identify the better collaborator. Whether these practices predict a collaboration that is actually useful is exactly what an evaluation would have to establish.

“Birds of a feather” is a useful image only if it remains a question. A proposed match does not assert that two people are the same kind of person. It proposes that a particular relationship, possible collaborators for this investigation, may be worth considering. Similarity is one candidate mechanism. Complementary working methods might work better. A matching study must therefore define the relationship and its outcome in advance, rather than assume that the nearest signatures produce the best partners. A pleasant explanation of affinity is not evidence of a productive collaboration.

The chain should therefore remain explicit:

authorised purpose and eligible inputs
        ↓
permission to derive bounded discovery views
        ↓
comparison for a typed candidate relationship
        ↓
private, provisional match with uncertainty
        ↓
separate authority for disclosure and introduction

The order is deliberate. Permission to retain records does not automatically permit computing a signature from them. Permission to compute a signature does not automatically permit comparing it with another person’s view. Each side’s eligible data and purpose must be established before the relevant computation. A later match may be shown only in a form covered by the applicable grants. Neither an attractive score nor the possibility of an introduction grants retrospective permission for the earlier computation.

detectable  ≠  authorised for use
similar Taint  ≠  established relationship
shared pattern  ≠  permission to introduce

Taint alone grants no right to match, reveal an identity, introduce anyone, disclose information or exercise authority. A candidate can be rejected for several reasons. A shared model may have produced the apparent affinity. The proposed relationship may be irrelevant. An approved view may have expired. Either participant may have withheld this use. The source of the pattern, the claimed relationship, the current permission and the decision to make contact must each remain independently inspectable. The next chapter takes up the later introduction stages in detail.

What would be permitted to travel

The smallest useful object would be a purpose-specific discovery view, not a portable personality dossier. For Iris’s investigation, a proposed view might contain a bounded description of how evidence is handled, the kinds of tasks it was derived from, the interval it covers, the known model and tool conditions, an uncertainty statement and the precise uses Iris has accepted. This is an illustrative contract, not an implemented schema, and it does not assert that the pattern can be extracted. A receiver does not need to see the underlying examples, private prompts or collaborators’ names in order to evaluate an authorised comparison.

Before any opted-in matching, Iris should be able to inspect a comprehensible description of the proposed view. That description should say what evidence categories support it, where its support is weak and what consequences its use can have. Inspection must not require displaying another person’s protected source material. She may correct a misinterpretation, narrow the scope of the tasks or exclude a record. Legitimately retained history itself remains unchanged. She may also reject an accurate observation for this purpose. A view authorised for research collaboration cannot be quietly repurposed for recruitment, lending, professional ranking or general identity search.

The controls follow Chapters 23–33: purpose, eligible data, provenance, current validity, authority to derive and compare, limited destinations, inspectable consequences, expiry and correction. A derived view needs its own lifetime and a record of where it has been used, bounded by legitimate retention. Revocation stops new authorised uses. It does not prove that remote copies, cached match lists or earlier disclosures have disappeared. Those effects need separate invalidation, confirmation or an explicit report of what remains unknown.

Third-party information needs its own boundary. Iris’s history may contain a colleague’s unpublished result, someone else’s refusal or a private conversation. Iris’s permission to search her own work does not settle those people’s rights or the authorised uses of their contributions. Even a derived description may reveal a confidential fact if the pattern is distinctive enough. Inputs without a sound basis for this use must be excluded, or the operation must be refused. Summarising them as a vector is not a way around that restriction.

There must also be a useful path that does not involve Taint. Iris may declare a collaboration goal, choose a small set of public or shareable work samples, or search by explicit criteria. Declining signature derivation cannot be treated as refusing collaboration itself. The ordinary path should keep comparable privacy, discoverability and correction protections. That way, any experimental gain from Taint is measured against a credible alternative, not an intentionally weak default.

When the signature becomes the mistake

The first failure would be covert profiling: deriving a durable representation from traces gathered for unrelated assistance, without permission for that derivation or use. Even a view that omits names might permit linking records across sessions or inferring sensitive attributes. A match score, or a repeated private query, could disclose membership in a candidate pool without ever printing a name. If the system then affects who is offered work, invited into a network or considered credible, discrimination can hide inside an apparently helpful discovery service. These are risk hypotheses to investigate, not observed failures of an existing Taint implementation.

Context separation matters because a signature formed under a private task could contaminate a public or professional one. A person’s corrections during a confidential dispute must not silently become evidence offered to a collaboration service. Removing names does not solve the problem when attributes can still be linked or reconstructed. The relevant test is whether the new computation and its resulting disclosure are permitted for the original contributors and the new purpose. It is not whether the exported object happens to be called an embedding.

The apparent affinity could also be induced or manipulated. Shared models, prompting conventions and organisational templates might make unrelated people look alike. Copied writing, deliberate mimicry or poisoned interaction logs could attract or suppress a match. A model change could erase an apparent similarity without either person changing. A stale pattern could keep influencing results after its subject has changed practice or withdrawn permission. No single similarity score distinguishes these possibilities. Provenance checks, time-scoped evaluation and adversarial controls are needed.

Finally, the system could help create what it later claims to discover. If it repeatedly suggests collaborators, examples and answers that resemble the current signature, Iris’s future interactions may converge on those suggestions. A later detector could then score the induced resemblance as fresh evidence of her affinity. This kind of feedback makes the intervention part of the measurement conditions, as Chapter 30 warned about predictions that shape their own outcomes. A discovery programme should keep an independent or minimally mediated comparison path. It should also check whether exposure narrows the range of candidates over time. At scale, a shared provider could produce apparent communities that mostly reflect its defaults. The later chapter on proxy ecosystems returns to this concern.

How the hypothesis could lose

A proposed evaluation would compare at least three discovery paths: declared interests with selected work samples, ordinary task, topic or embedding similarity, and a structured Taint-derived view. All three would operate under comparable, authorised input budgets and the same permitted discovery purpose. The benchmark should define candidate collaboration usefulness before any ranking systems are compared. It should not ask raters whether two profiles sound alike. The candidate relationships and their outcomes must be held out from feature construction. Comparable task and temporal splits help prevent the same interaction from supplying both the match and its supposed validation.

The evaluation should report ranking quality and coverage alongside false matches, unattributed similarities, unwanted contacts, privacy leakage and correction burden. Where it is appropriate and participants have voluntarily agreed to a later measure, collaboration usefulness should be kept distinct from an initial expression of interest. Exposure to a flattering description may make a suggested match seem attractive without predicting useful work. Privacy and authority failures are separate constraints. They are not negative points that better ranking can offset in a weighted score. Legitimate permission from participants and third parties must come before any collection or testing. Calling an intrusive procedure a privacy experiment does not authorise it.

The hard cases should be deliberately combined. These include different people using the same model and template; the same person switching providers; the same task performed with and without an assistant; different people sharing a task; a person changing practice over time; imitated or poisoned histories; and records with missing corrections. The design should measure whether a detector still identifies an interaction-derived pattern when provider and task artefacts are controlled. Models must not receive identities or held-out examples through metadata, prompts or evaluation feedback. An uncertainty or abstention outcome should be available whenever evidence is insufficient.

The result could be that Taint adds nothing beyond declared interests or ordinary embeddings. Matches might fail once shared-provider artefacts are removed. Or incremental useful matches might cost too much in false attribution, profiling or linkability. These are legitimate negative outcomes. The proposal should also be rejected if participants cannot understand or meaningfully limit the derived view, or if matching cannot work within acceptable disclosure limits. In each case the non-Taint route wins. Adopting this terminology does not commit anyone to deploying the representation.

Research context, not evidence of Taint

Research on AI-assisted writing gives reason to treat the shared model as a contributor, rather than attributing every repeated pattern to the person. Agarwal, Naaman and Vashistha report in a controlled writing study that AI suggestions shifted aspects of participants’ writing toward the provider’s conventions. This does not demonstrate a Taint detector or a collaboration benefit. It motivates controls for model-induced similarity. NIST SP 800-188 treats de-identification as risk reduction that requires evaluation. It does not guarantee that derived or name-free data cannot be linked. Neither source validates private matching here. They ground two hazards that the proposed experiment must test.

Where this leaves us

Repeated interaction might leave a pattern that a machine can describe more readily than its participants can. Taint names this proposed, co-produced residue and the possibility of using a purpose-specific view of it to suggest collaborators. It is not yet a measured signature, a stable characteristic of Iris, an identity proof or an authorisation. Any evidence of affinity would remain conditional on the model, task, recording history and permission that produced the comparison. Its potential value must be shown against simpler discovery methods, without trading away the boundaries that made the search legitimate.

The remaining question is practical and exact. Suppose a private comparison really could help two people find a worthwhile connection. How could it do so without turning either person’s interaction history into a public profile, or revealing an identity before its owner agrees? Computing a candidate relationship, revealing a match, contacting a person and arranging an introduction are different operations. They may involve different principals and different permissions. The next chapter separates those acts.

References

• Agarwal, D., Naaman, M. & Vashistha, A. (2025). AI Suggestions Homogenize Writing Toward Western Styles and Diminish Cultural Nuances. CHI 2025, Article 1117. https://doi.org/10.1145/3706598.3713564
• Garfinkel, S., Guttman, B., Near, J., Dajani, A. & Singer, P. (2023). De-Identifying Government Datasets: Techniques and Governance. NIST SP 800-188. https://doi.org/10.6028/NIST.SP.800-188