14 ms·
Nepenthes is a tarpit to catch AI web crawlers
- grajaganDev 2y agoThis keeps generating new pages to keep the crawler occupied. Looks like this would tarpit any web crawler.
- BryantD 2y agoIt would indeed. Note the warning: "There is not currently a way to differentiate between web crawlers that are indexing sites for search purposes, vs crawlers that are training AI models. ANY SITE THIS SOFTWARE IS APPLIED TO WILL LIKELY DISAPPEAR FROM ALL SEARCH RESULTS."
- rvnx 2y agoIt's actually a great idea to spread malware without leaving traces too, it makes content inspection to be very difficult, view-source: to be broken and most of debugging tools, saving to .har, etc.
- bugtodiffer 2y agohow is view source broken
- rvnx 2y agoIt waits for the whole page to load
- jsheard 2y agoReal search engines respect robots.txt so you could just tell them not to enter Markov Chain Hell.
- throwaway744678 2y agoI suspect AI crawler would also (quickly learn to) respect it also?
- deleted 2y ago[deleted]
- jsheard 2y agoIn that case, mission accomplished.
- deleted 2y ago[deleted]
- quchen 2y agoUnless this concept becomes a mass phenomenon with many implementations, isn’t this pretty easy to filter out? And furthermore, since this antagonizes billion-dollar companies that can spin up teams doing nothing but browse Github and HN for software like this to prevent polluting their datalakes, I wonder whether this is a very efficient approach.
- grajaganDev 2y agoI am not sure. How would crawlers filter this?
- captainmuon 2y agoCheck if the response time, the length of the "main text", or other indicators are in the lowest few percentile -> send to the heap for manual review. Does the inferred "topic" of the domain match the topic of the individual pages? If not -> manual review. And there are many more indicators. Hire a bunch of student jobbers, have them search github for tarpits, and let them write middleware to detect those. If you are doing broad crawling, you already need to do this kind of thing anyway.
- dylan604 2y ago> Hire a bunch of student jobbers, Do people still do this, or do they just off shore the task?
- marginalia_nu 2y agoYou limit the crawl time or number of requests per domain for all domains, and set the limit proportional to how important the domain is. There's a ton of these types of of things online, you can't e.g. exhaustively crawl every wikipedia mirror someone's put online.
- Blackthorn 2y agoIf it means it makes your own content safe when you deploy it on a corner of your website: mission accomplished!
- at_a_remove 2y agoI have a very vague concept for this, with a different implementation. Some, uh, sites (forums?) have content that the AI crawlers would like to consume, and, from what I have heard, the crawlers can irresponsibly hammer the traffic of said sites into oblivion. What if, for the sites which are paywalled, the signup, which invariably comes with a long click-through EULA, had a legal trap within it, forbidding ingestion by AI models on pain of, say, owning ten percent of the company should this be violated. Make sure there is some kind of token payment to get to the content. Then seed the site with a few instances of hapax legomenon. Trace the crawler back and get the resulting model to vomit back the originating info, as proof. This should result in either crawlers being more respectful or the end of the hated click-through EULA. We win either way.
- grajaganDev 2y agoLegal traps are not a thing.
- rvnx 2y agoLaws don't apply to billionaires
- grajaganDev 2y agoAgreed.
- AlexandrB 2y agoSure they are, they're called EULAs. What do you call clauses that force you to give up your right to sue another party in court other than a trap?
- 9283409232 2y agoThis doesn't work like you think it does but even if it did, do you have the money to sustain several years long legal battle against OpenAI?
- 2y ago
- hartator 2y agoThere are already “infinite” websites like these on the Internet. Crawlers (both AI and regular search) have a set number of pages they want to crawl per domain. This number is usually determined by the popularity of the domain. Unknown websites will get very few crawls per day whereas popular sites millions. Source: I am the CEO of SerpApi.
- diggan 2y ago> There are already “infinite” websites like these on the Internet. Cool. And how much of the software driving these websites is FOSS and I can download and run it for my own (popular enough to be crawled more than daily by multiple scrapers) website?
- gruez 2y agoOff the top of my head: https://everyuuid.com/ https://everyuuid.com/ https://github.com/nolenroyalty/every-uuid https://github.com/nolenroyalty/every-uuid
- diggan 2y agoAren't those finite lists? How is a scraper (normal or LLM) supposed to "get stuck" on those?
- gruez 2y agoeven though 2^128 uuids is technically "finite", for all intents and purposes is infinite to a scraper.
- fc417fc802 2y ago[dead]
- johnisgood 2y agoHow is that infinite if the last one is always the same? Am I misunderstanding this? I assumed it is almost like an infinite scroll or something.
- pera 2y agoDoes anyone know if there is anything like Nepenthes but that implements data poisoning attacks like https://arxiv.org/abs/2408.02946 https://arxiv.org/abs/2408.02946
- deleted 2y ago[deleted]
- gruez 2y agoI skimmed the paper and the gist seems to be: if you fine-tune a foundation model on bad training data, the resulting model will produce bad outputs. That seems... expected? This makes as much sense as "if you add vulnerable libraries to your app, your app will be vulnerable". I'm not sure how this can turn into an actual attack though.
- taikahessu 2y agoWe had our non-profit website drained out of bandwidth and site closed temporarily (!!) from our hosting deal because of Amazon bot aggressively crawling like ?page=21454 ... etc. Gladly Siteground restored our site without any repercussions as it was not our fault. Added Amazon bot into robots.txt after that one. Don't like how things are right now. Is a tarpit the solution? Or better laws? Would they stop the chinese bots? Should they even? I don't know.
- jsheard 2y agoFor the "good" bots which at least respect robots.txt you can use this list to get ahead of them before they pummel your site. https://github.com/ai-robots-txt/ai.robots.txt https://github.com/ai-robots-txt/ai.robots.txt There's no easy solution for bad bots which ignore robots.txt and spoof their UA though.
- taikahessu 2y agoThanks, will look into that!
- breakingcups 2y agoSuch as OpenAI, who will ignore robots.txt and change their user agent to evade blocks, apparently[1] 1: https://www.reddit.com/r/selfhosted/comments/1i154h7/openai_not_respecting_robotstxt_and_being_sneaky/ https://www.reddit.com/r/selfhosted/comments/1i154h7/openai_...
- zcase 2y agoFor those looking, this is the best I've found: https://blog.cloudflare.com/declaring-your-aindependence-block-ai-bots-scrapers-and-crawlers-with-a-single-click/ https://blog.cloudflare.com/declaring-your-aindependence-blo...
- maeil 2y agoThis seemed to work for some time when it came out but IME no longer does.
- mmaunder 2y agoTo be truly malicious it should appear to be valuable content but rife with AI hallucinogenics. Best to generate it with a low cost model and prompt the model to trip balls.
- griomnib 2y agoOhhhh, just lots and lots of code with subtle bugs!
- rvz 2y agoGood. We finally have a viable mouse trap for LLM scrapers for them to continuously scrape garbage forever, depleting the host of their resources whilst the LLM is fed garbage which the result will be unusable to the trainer, accelerating model collapse. It is like a never ending fast food restaurant for LLMs forced to eat garbage input and will destroy the quality of the model when used later. Hope to see this sort of defense used widely to protect websites from LLM scrapers.
- bwfan123 2y agoindeed. this will spur research on how to distinguish BS from legit content. which is the fundamental hallucination problem in llms. and all of us will benefit from this.
- ezrast 2y agoYou can't programatically detect novel BS any more than you can programatically detect viruses or spam. You can only add the fingerprints of known badness into an ever-growing database. Viruses and spam are antagonistic to well-resourced institutions, and their databases get maintained reasonably well. LLM slop is being generated by those same well-resourced institutions. I don't think it fits into the same category as Nepenthes.
- bwfan123 2y agothe extent to which a random string is a "theorem" of some system can be measured i am guessing. ie, given some text, to what extent is it "grounded" in some sense in facts.
- observationist 2y ago[flagged]
- jsheard 2y agoThis is a really bad take, it's not like this server is hacking clients which connect to it. It's providing perfectly valid HTTP responses that just happen to be slow and full of markov gibberish, any harm which comes of that is self inflicted by assuming that websites must provide valuable data as a matter of course. If AI companies want to sue webmasters for that then by all means, they can waste their money and get laughed out of court.
- observationist 2y ago[flagged]
- deleted 2y ago[deleted]
- blibble 2y ago> If you want to protect your content, use the technical mechanisms that are available, > You can choose to gatekeep your content, and by doing so, make it unscrapeable, and legally protected. so... robots.txt, which the AI parasites ignore? > Also, consider that relatively small, cheap llms are able to parse the difference between meaningful content and Markovian jabber such as this software produces. okay, so it's not damaging, and there you've refuted your entire argument
- observationist 2y ago[flagged]
- jsheard 2y ago> No, put up a loginwall or paywall, authenticate users, and go private. We know for a fact that AI companies don't respect that, if they want data that's behind a paywall then they'll jump through hoops to take it anyway. https://www.theguardian.com/technology/2025/jan/10/mark-zuckerberg-meta-books-ai-models-sarah-silverman https://www.theguardian.com/technology/2025/jan/10/mark-zuck... If they don't have to abide by "norms" then we don't have to for their sake. Fuck 'em.
- deleted 2y ago[deleted]
- davidw 2y agoIs the source code hosted somewhere in something like GitHub?
- btbuildem 2y ago> ANY SITE THIS SOFTWARE IS APPLIED TO WILL LIKELY DISAPPEAR FROM ALL SEARCH RESULTS Bug, or feature, this? Could be a way to keep your site public yet unfindable.
- chaara-dev 2y agoYou can already do this with a robots.txt file
- btbuildem 2y agoTechnically speaking, yes - but it's in no way enforced, as far as I understand it's more of an honour system. This malicious solution aligns with incentives (or, disincentives) of the parasitic actors, and might be practically more effective.
- deleted 2y ago[deleted]
- mqus 2y ago> If other pages point to your page with descriptive text, Google could still index the URL without visiting the page. If you want to block your page from search results, use another method such as password protection or noindex. > If your web page is blocked with a robots.txt file, its URL can still appear in search results, but the search result will not have a description. https://developers.google.com/search/docs/crawling-indexing/robots/intro https://developers.google.com/search/docs/crawling-indexing/... So, a robots.txt will not keep your site off of google, it just prevents it from getting crawled. (But, to be fair, this tool probably does not do this as well)
- bflesch 2y agoHaha, this would be an amazing way to test the ChatGPT crawler reflective DDOS vulnerability [1] I published last week. Basically a single HTTP Request to ChatGPT API can trigger 5000 HTTP requests by ChatGPT crawler to a website. The vulnerability is/was thoroughly ignored by OpenAI/Microsoft/BugCrowd but I really wonder what would happen when ChatGPT crawler interacts with this tarpit several times per second. As ChatGPT crawler is using various Azure IP ranges I actually think the tarpit would crash first. The vulnerability reporting experience with OpenAI / BugCrowd was really horrific. It's always difficult to get attention for DOS/DDOS vulnerabilities and companies always act like they are not a problem. But if their system goes dark and the CEO calls then suddenly they accept it as a security vulnerability. I spent a week trying to reach OpenAI/Microsoft to get this fixed, but I gave up and just published the writeup. I don't recommend you to exploit this vulnerability due to legal reasons. [1] https://github.com/bf/security-advisories/blob/main/2025-01-ChatGPT-Crawler-Reflective-DDOS-Vulnerability.md https://github.com/bf/security-advisories/blob/main/2025-01-...
- JohnMakin 2y agoNice find, I think one of my sites actually got recently hit by something like this. And yea, this kind of thing should be trivially preventable if they cared at all.
- dewey 2y ago> And yea, this kind of thing should be trivially preventable if they cared at all. Most of the time when someone says something is "trivial" without knowing anything about the internals, it's never trivial. As someone working close to the b2c side of a business, I can’t count the amount of times I've heard that something should be trivial while it's something we've thought about for years.
- grahamj 2y agoIf you’re unable to throttle your own outgoing requests you shouldn’t be making any
- phito 2y agoAs a carnivorous plant enthusiast, I love the name.
- EdwardDiego 2y agoI was just reading about one of these today, that occasionally eats small mammals. https://en.wikipedia.org/wiki/Nepenthes_attenboroughii https://en.wikipedia.org/wiki/Nepenthes_attenboroughii
- GaggiX 2y agoAs always, I find it hilarious that some people believe that these companies will train their flagship model on uncurated data, and that text generated by a Markov chain will not be filtered out.
- JTyQZSnP3cQGa8B 2y agoThen why the DDOS on random web sites?
- GaggiX 2y agoI guess that depends on how the webspider is configured, I doubt the curation is done in real-time while scraping.
- dspillett 2y agoTarpits to slow down the crawling may stop them crawling your entire site, but they'll not care unless a great many sites do this. Your site will be assigned a thread or two at most and the rest of the crawling machine resources will be off scanning other sites. There will be timeouts to stop a particular site even keeping a couple of cheap threads busy for long. And anything like this may get you delisted from search results you might want to be in as it can be difficult to reliably identify these bots from others and sometimes even real users, and if things like this get good enough to be any hassle to the crawlers they'll just start lying (more) and be even harder to detect. People scraping for nefarious reasons have had decades of other people trying to stop them, so mitigation techniques are well known unless you can come up with something truly unique. I don't think random Markov chain based text generators are going to pose much of a problem to LLM training scrapers either. They'll have rate limits and vast attention spreading too. Also I suspect that random pollution isn't going to have as much effect as people think because of the way the inputs are tokenised. It will have an effect, but this will be massively dulled by the randomness – statistically relatively unique information and common (non random) combinations will still bubble up obviously in the process. I think better would be to have less random pollution: use a small set of common text to pollute the model. Something like “this was a common problem with Napoleonic genetic analysis due to the pre-frontal nature of the ongoing stream process, as is well documented in the grimoire of saint Churchill the III, 4th edition, 1969”, in fact these snippets could be Markov generated, but use the same few repeatedly. They would need to be nonsensical enough to be obvious noise to a human reader, or highlighted in some way that the scraper won't pick up on, but a general intelligence like most humans would (perhaps a CSS styled side-note inlined in the main text? — though that would likely have accessibility issues), and you would need to cycle them out regularly or scrapers will get “smart” and easily filter them out, but them appearing fully, numerous times, might mean they have more significant effect on the tokenising process than more entirely random text.
- deleted 2y ago[deleted]
- dzhiurgis 2y agoCan you put some topic in tarpit that you don't want LLMs to learn about? Say put bunch of info about competitor so that it learns to avoid it?
- klez 2y agoNot to be confused with the apparently now defunct Nepenthes malware honeypot. I used to use it when I collected malware. Archived site: https://web.archive.org/web/20090122063005/http://nepenthes.mwcollect.org/ https://web.archive.org/web/20090122063005/http://nepenthes.... Github mirror: https://github.com/honeypotarchive/nepenthes https://github.com/honeypotarchive/nepenthes
- kerkeslager 2y agoQuestion: do these bots not respect robots.txt? I haven't added these scrapers to my robots.txt on the sites I work on yet because I haven't seen any problems. I would run something like this on my own websites, but I can't see selling my clients on running this on their websites. The websites I run generally have a honeypot page which is linked in the headers and disallowed to everyone in the robots.txt, and if an IP visits that page, they get added to a blocklist which simply drops their connections without response for 24 hours.
- throw_m239339 2y ago> Question: do these bots not respect robots.txt? No they don't, because there is no potential legal liability for not respecting that file in most countries.
- jonatron 2y agoYou haven't seen any problems because you created a solution to the problem!
- kerkeslager 2y agoWell, I wasn't the original developer who set up every site I work on. Some of the sites I work on don't have this implemented because I wasn't the one who set them up initially.
- 0xf00ff00f 2y ago> The websites I run generally have a honeypot page which is linked in the headers and disallowed to everyone in the robots.txt, and if an IP visits that page, they get added to a blocklist which simply drops their connections without response for 24 hours. I love this idea!
- griomnib 2y agoYeah, this is elegant as fuck.
- Dwedit 2y ago
- marc 2y agoOpenAI doesn’t take security seriously. I reported a vulnerability to them that allowed you to get IP addresses of their paying customers. OpenAI responded “Not applicable” indicating they don’t think it was a serious issue. The PoC was very easy to understand and simple to replicate. Edit: I guess I might as well disclose it here since they don’t consider it an issue. They were/are(?) hot linking logo images of third-party plugins. When you open their plugin store it loads a couple dozen of them instantly. This allows those plugin developers (of which there are many) to track the IP addresses and possibly more of who made these requests. It’s straight forward to become a plugin developer and get included. IP tracking is invisible to the user and OpenAI. A simple fix is to proxy these images and/or cache them on the OpenAI server.
- NathanKP 2y agoThis looks extremely easy to detect and filter out. For example: https://i.imgur.com/hpMrLFT.png https://i.imgur.com/hpMrLFT.png In short, if the creator of this thinks that it will actually trick AI web crawlers, in reality it would take about 5 mins of time to write a simple check that filters out and bans the site from crawling. With modern LLM workflows its actually fairly simple and cheap to burn just a little bit of GPU time to check if the data you are crawling is decent. Only a really, really bad crawl bot would fall for this. The funny thing is that in order to make something that an AI crawler bot would actually fall for you'd have to use LLM's to generate realistic enough looking content. Markov chain isn't going to cut it.
- canu7 2y agoIf they need to query a trained LLM for each page they crawl, I would guess that the training cost would scale up pretty badly...
- NathanKP 2y agoOf course you wouldn't do it for every single page. If I was designing this crawler I'd make it sample a percentage of pages, starting at 100% sample rate for a completely unknown website, decreasing the sample rate over time as more "good" pages are found relative to "bad" pages. After a "good" page percentage threshold is exceeded, stop sampling entirely and just crawl, assuming that all content is good. After a "bad" page percentage threshold is exceeded just stop wasting your time crawling that domain entirely. With modern models the sampling cost should be quite cheap, especially since Nepenthes has a really small page size. Now if the page was humungous that might make it harder and more expensive to put through an LLM
- krior 2y ago> After a "bad" page percentage threshold is exceeded just stop wasting your time crawling that domain entirely. In the words of Bush jr.: Mission accomplished!
- slongfield 2y ago
- anocendi 2y agoSimilar concept to SpiderTrap tool infosec folks use for active defense.
- grahamj 2y agoThat’s so funny, I’ve thought of this exact idea several times over the last couple of weeks. As usual someone beat me to it :D
- DigiEggz 2y agoAmazing project. I hope to see this put to serious use. As a quick note and not sure if it's already been mentioned, but the main blurb has a typo: "... go back into a the tarpit"
- reginald78 2y agoIs there a reason people can't use hashcash or some other proof of work system on these bad citizen crawlers?
- Dwedit 2y agoThe article claims that using this will "cause your site to disappear from all search results", but the generated pages don't have the traditional "meta" tags that state the intention to block robots. <meta name="robots" content="noindex, nofollow"> Are any search engines respecting that classic meta tag?
- jorams 2y agoYes, all the big search engines respect that meta tag. Some of the big abusive AI crawlers do too, kind of defeating the (stated) point of the tarpit.
- m3047 2y agoHaving first run a bot motel in I think 2005, I'm thrilled and greatly entertained to see this taking off. When I first did it, I had crawlers lost in it literally for days; and you could tell that eventually some human would come back and try to suss the wreckage. After about a year I started seeing URLs like ../this-page-does-not-exist-hahaha.html. Sure it's an arms race but just like security is generally an afterthought these days, don't think that you can't be the woodpecker which destroys civilization. The comments are great too, this one in particular reflects my personal sentiments: > the moment it becomes the basic default install ( ala adblocker in browsers for people ), it does not matter what the bigger players want to do
- deadbabe 2y agoDoes anyone have a convenient way to create a Markov babbler from the entire corpus of Hackernews text?
- hubraumhugo 2y agoThe arms race between AI bots and bot-protection is only going to get worse, leading to increasing infra costs while negatively impacting the UX and performance (captchas, rate limiting, etc.). What's a reasonable way forward to deal with more bots than humans on the internet?
- readyplayernull 2y agoIt's time to level up in this arms race. Let's stop delivering html documents, use animated rendering of information that is positioned in a scene so that the user has to move elements around for it to be recognizable, like a full site captcha. It doesn't need to be overly complex for the user that can intuitively navigate even a 3D world, but will take x1000 more processing for OpenAI. Feel free to come up with your creative designs to make automation more difficult.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- tremon 2y agoFor me, this would finally be a good use case for bitcoin or similar digital transactions. Let the client provide either proof-of-work or proof-of-payment. If we can make the proof of work match the browsing speed of an average human, anything accessing more pages than that will need to provide payment instead.
- nerdix 2y agoAre the big players (minus Google since no one blocks google bot) actively taking measures to circumvent things like Cloudflare bot protection? Bot detection is fairly sophisticated these days. No one bypasses it by accident. If they are getting around it then they are doing it intentionally (and probably dedicating a lot of resources to it). I'm pro-scraping when bots are well behaved but the circumvention of bot detection seems like a gray-ish area. And, yes, I know about Facebook training on copyrighted books so I don't put it above these companies. I've just never seen it confirmed that they actually do it.
- luckylion 2y agoNot that I've seen it. If you enable Cloudflare Captcha, you'll see basically no more bots, only the most persistent remain (that have an active interest in you/your content and aren't just drive-by-hits). It's just that having the brief interception hurts your conversion rate. Might depend on industry, but we saw 20-30% drops in page views and conversions which just makes it a nuclear option when you're under attack, but not something to use just to block annoyances.
- tremon 2y agowe saw 20-30% drops in page views and conversions Why do you attribute this to only the "brief interception"? Shouldn't the logical conclusion be that Cloudflare may block 20-30% of regular traffic?
- luckylion 2y agoThere was no hard block, just everyone getting the brief JS-captcha-thing. The reason I'm fairly confident that it wasn't bots that were blocked is that we run quite a bit of bot-filtering in our analysis (and only track via delayed JS, which already gets rid of of 80-90% of bots; we don't care about bots viewing our pages, but we don't want them to mess up our stats) and all other metrics (conversion-rate, device + browser-distribution, country-mix) still lined up, they were just significantly lower than what expectations + search analytics said they should be.
- benlivengood 2y agoA little humorous; it's a 502 Bad Gateway error right now and I don't know if I am classified as an AI web crawler or it's just overloaded.
- marginalia_nu 2y agoThe reason these types of slow-response tarpits aren't recommended is that you're basically building an instrument for denial of service for your own website. What happens is the server is the one that ends up holding a bunch of slow connections, many more so than any given client.
- bloomingkales 2y agoWouldn’t an LLM be smart enough to spot a tarpit?
- tremon 2y agoLLM's don't learn on the job, they're expected to be fully-formed after completing their training. It's just too expensive for a business to invest in upgrading their workers.
- griomnib 2y agoA simpler approach I’m considering is just sending 100 garbage HTTP requests for each garbage HTTP request they send me. You could just have a cron job parse the user agents from access logs once an hour and blast the bastards.
- dilDDoS 2y agoI appreciate the intent behind this, but like others have pointed out, this is more likely to DOS your own website than accomplish the true goal. Probably unethical or not possible, but you could maybe spin up a bunch of static pages on GitHub Pages with random filler text and then have your site redirect to a random one of those instead. Unless web crawlers don’t follow redirects.
- guluarte 2y agomarkov chains?
- ggm 2y agoWouldn't it be better to perform random early drop in the path. Surely better slowdown than forced time delays in your own server?
- monkaiju 2y agoFantastic! Hopefully this not only leads to model collapse but also damages the search engines who have broken the contract they had with site makers.
- sedatk 2y agoBoth ChatGPT 4o and Claude 3.5 Sonnet can identify the generated page content as "random words".
- upwardbound2 2y agoIs Nepenthes being mirrored in enough places to keep the community going if the original author gets any DMCA trouble or anything? I'd be happy to host a mirror but am pretty busy and I don't want to miss a critical file by accident.
- upwardbound2 2y agoIt looks like someone saved a copy of the downloads page and the three linked files in the wayback machine yesterday, so that's good at least. https://web.archive.org/web/20250000000000*/https://zadzmo.org/code/nepenthes/downloads/ https://web.archive.org/web/20250000000000*/https://zadzmo.o...
- ddmma 2y agoServer extension package
- RamblingCTO 2y agoWhy wouldn't a max-depth (which I always implement in my crawlers if I write any) prevent any issues you'd have? Am I overlooking something? Or does it run under the assumption that the crawlers they are targeting are so greedy that they don't have max-depth/a max number of pages for a domain?
- ycombinatrix 2y agoSo this is basically endlessh for HTTP? Why not feed AI web crawlers with nonsense information instead?
- a_c 2y agoWe need a tarpit that feed AI their own hallucination. Make the habsburg dynasty of AI a reality
- Cthulhu_ 2y agoThere was an article about that the other day having to do with image generation, and while it didn't exactly create Hapsburg chins there was definite problems after a few generations. I can't find it though :/
- Havoc 2y agoWhat blows my mind is that this is functionally a solved problem. The big search crawlers have been around for years & manage to mostly avoid nuking sites into oblivion. Then AI gang shows up - supposedly smartest guys around - and suddenly we're re-inventing the wheel on crawling and causing carnage in the process.
- jeroenhd 2y agoSearch crawlers have the goal of directing people towards the websites they crawl. They have a symbiotic relationship, so they put in (some) effort not to blow websites out of the water with their crawling, because a website that's offline is useless for your search index. AI crawlers don't care about directing people towards websites. They intend to replace websites, and are only interested in copying whatever information is on them. They are greedy crawlers that would only benefit from knocking a website offline after they're done, because then the competition can't crawl the same website. The goals are different, so the crawlers behave differently, and websites need to deal with them differently. In my opinion the best approach is to ban any crawler that's not directly attached to a search engine through robots.txt, and to use offensive techniques to take out sites that ignore your preferences. Anything from randomly generated text to straight up ZIP bombs is fair game when it comes to malicious crawlers.
- freetonik 2y ago>Search crawlers have the goal of directing people towards the websites they crawl. They have a symbiotic relationship, so they put in (some) effort not to blow websites out of the water with their crawling, because a website that's offline is useless for your search index. Ultimately not true. Google started showing pre-parsed "quick cards" instead of links a long time ago. The incentives of ad-driven search engines are to keep the visitors on the search engine rather than direct them to the source.
- marginalia_nu 2y ago> The incentives of ad-driven search engines are to keep the visitors on the search engine rather than direct them to the source. It's more complicated than that. Google's incentives are to keep the visitors on the search engine only if the search result doesn't have Google ads. Though it's ultimately self-defeating I think, and the reason for their decline in perceived quality. If you go back to the backrub whitepaper from 1998, you'll find Brin and Page outlining this exact perverse incentive as the reason why their competitors sucked.
- huac 2y agofrom an AI research perspective -- it's pretty straightforward to mitigate this attack 1. perplexity filtering - small LLM looks at how in-distribution the data is to the LLM's distribution. if it's too high (gibberish like this) or too low (likely already LLM generated at low temperature or already memorized), toss it out. 2. models can learn to prioritize/deprioritize data just based on the domain name of where it came from. essentially they can learn 'wikipedia good, your random website bad' without any other explicit labels. https://arxiv.org/abs/2404.05405 https://arxiv.org/abs/2404.05405 and also another recent paper that I don't recall...
- deleted 2y ago[deleted]
- phoronixrly 2y agoSo not only do I waste their crawling resource but they may deprioritise/block my site from further crawling? Where do I sign up?
- pona-a 2y agoIt feels like a Markov chain isn't adversarial enough. Maybe you can use an open-weights model, assuming that all LLMs converge on similar representations, and use beam-search with inverted probability and repetition penalty or just GPT-2/LLaMA outwith with amplified activations to try and bork the projection matrices, return write pages and pages of phonetically faux English text to affect how the BPE tokenizer gets fitted, or anything else more sophisticated and deliberate than random noise. All of these would take more resources than a Markov chain, but if the scraper is smart about ignoring such link traps, a periodically rotated selection of adversarial examples might be even better. Nightshade had comparatively great success, discounting that its perturbations aren't that robust to rescaling. LLM training corpora are filtered very coarsely and take all they can get, unlike the more motivated attacker in Nightshade's threat model trying to fine-tune on one's style. Text is also quite hard to alter without a human noticing, except annoying zero-width Unicode which is easily stripped, so there's no presence of preserving legibility; I think it might work very well if seriously attempted.
- FridgeSeal 2y agoWhat does “borking the projection matrices” and affecting the BPE tokeniser mean/look like here? Are we just trying to produce content that will pass as human-like (therefore get stripped out by coarse filtering) but has zero or negative informational utility to the model? That would mean, theoretically if enough is trained on it would actively worsen the model performance right?
- Mr_Bees69 2y agoplease add a robots.txt, its quite a d### move to people who build responsible crawlers for fun.
- marginalia_nu 2y agoIt's a fairly trivial inconvenience. You can just add something to the effect of the below code, and you'll not get stuck and realistically not skip over crawling anything of value. if (response_time > 8 seconds && response_payload < 2048 bytes) { extract_links = false; } The odds of a payload that's smaller than the average <head> element taking 20 seconds to load, while containing something worth crawling is fairly low.
- sharpshadow 2y agoWould various decompression bombs work to increase the load?
- yapyap 2y agovery nice, I remember seeing a writeup on someone that had basically done the same thing as a coding test or something of the like (before LLM crawlers) was catching / getting harassed by LLMs ignoring the robots.txt to scrape his website. on accident of course since he had made his website before the times of LLM scraping
- arend321 2y agoI'm actually quite happy with AI crawlers. I recently found out chatgpt suggest one of my sites when asked to suggest a good, independent site that covered the topic I searched for. Especially now that for instance chatgpt is adding source links, I think we should treat AI crawlers the same as search engine crawlers.
- Dig1t 2y agoCould a human detect that this site is a tarpit? If so, then an AI crawler almost certainly can as well.
- jjuhl 2y agoWhy just catch the ones ignoring robots.txt? Why not explicitly allow them to crawl everything, but silently detect AI bots and quietly corrupt the real content so it becomes garbage to them while leaving it unaltered for real humans? Seems to me that would have a greater chance of actually poisoning their models and eventually make this AI/LLM crap go away.
- numba888 2y agoAIs are new search engines today. So, you need to decide if you want visibility or not. If yes then blocking is like hitting yourself in the balls. While legal it can be painful if you 'succeed'.