What Is AI-Slop Pollution?
The common feature across the cases recorded in this database can be understood through an environmental-pollution analogy. When a factory discharges hazardous substances, a river becomes polluted and downstream residents who did nothing wrong suffer the consequences. When actors mass-produce and release AI slop, platforms become defensive and legitimate users who did nothing wrong are caught in the response. The non-native speakers in PC-4 did not use AI at all; AI-detection tools misclassified human-written text and damaged academic and research careers. The researchers in PC-1 and PC-2 did not submit AI slop. They were made invisible in search, or erased by AI systems declaring that 'this paper does not exist,' as a consequence of platform defenses against other people's slop. Cases in the main database also show that victims often have no meaningful option to 'simply avoid AI.' In main-database case INT-23, an elderly patient lost insurance benefits because of AI adopted by an insurer; in INT-1, a consumer was charged a 23% AI-driven price increase without knowing it; in JP-9, a four-year-old child died without even knowing that AI existed. People who did not use AI can be harmed by AI and may not even know that AI caused the harm. This is the basis for our use of the term 'pollution' for this class of AI incidents.
PC-38 extends the pollution analogy one step further. The database's earlier central pattern was downstream contamination: third parties flood a platform with AI slop, the platform changes defensively, and legitimate users absorb the side effects. In PC-38, the AI service provider itself repeatedly supplies low-quality generated output directly into the response stream of paying users. Because users have already selected a quality path through payment and the model picker, they cannot individually sort the output by hiding it, blocking it, or choosing a different source in the way they might with external slop. This is not contaminated water entering a river; it is self-contamination in which contaminated water comes from the tap of the purifier that the user purchased. If the remedy channel is also closed behind automated support bots, the AI that produced the contamination and the AI that receives the complaint form a closed loop, preventing access to human review of server logs, root-cause analysis, refunds, or remediation. This should therefore be evaluated not as ordinary model-quality fluctuation but as a new form of AI-slop pollution in which transparency of service delivery, user choice, and access to remedy are lost simultaneously.
PC-35 and PC-36 show that AI-slop pollution does not end with machine output. In PC-35, human commentators become 'human slop' by repeatedly posting generic material that can be attached to almost any story without deeply investigating the specific event, and Yahoo! then authorizes that output through expert-certification marks and fixed placement that users cannot hide. In PC-36, Yahoo!'s AI extracts and summarizes scam-oriented slop from social media and converts it into news-like content with a headline, background explanation, sentiment analysis, and ranking. The pathways differ, 'human slop → expert certification → fixed display' versus 'social-media slop → AI summary → newsification,' but the result is the same: the platform authority-launders low-quality information and delivers it to users by force or preferential placement. AI labels and disclaimers do not cancel the credibility conferred first by certification marks, headlines, rankings, and display position. Evaluation of AI-slop pollution must therefore extend beyond the intrinsic quality of generated content to who converts it into supposedly trustworthy information and which interfaces fix, recommend, or redistribute it.
Unverifiable AI Origin and Reversal of the Burden of Proof
PC-37 shows that the content-verification problem created by AI slop cannot be solved simply by prohibiting AI use. What Wikipedia needs is verification that each statement is supported by reliable published sources, and that requirement applies whether the text is human-written or AI-assisted. Once AI origin itself becomes prohibited, however, moderation must judge not only content but also an externally unobservable production process: which tool an editor used to write the text. Self-disclosure cannot prevent concealment, AI detectors cannot eliminate false positives or false negatives, and stylistic signals associated with AI also occur in human writing. The result is an asymmetry in which sufficiently edited undisclosed AI text can pass, while a human writer whose text is challenged must prove factuality and compliance, reversing the burden of proof. This is the same class of failure seen in PC-4 and PC-8. A prohibition may reduce the volume of slop but does not solve verification itself and instead creates another GATE pathway and additional verification costs.
So How Do We Detect It?!
As the database already shows, many platforms, companies, and research institutions use AI-use disclosure rules as part of their response to AI slop. Yet when AI use is determined only through self-reporting, the users who honestly disclose AI use bear restrictions or disadvantages while users who lie and say they did not use AI can gain an advantage. In PC-26, the Steam case, an association between AI-disclosure status and lower game evaluations was empirically demonstrated, creating an incentive to ignore disclosure requirements and falsely claim that AI was not used.
Practitioners recognize this problem, so disclosure rarely stands alone. Additional rules may include removal or bans for content judged to look AI-generated, extra review, and appeal procedures. Machine judgment of 'AI-like' content produces false positives; human confirmation increases verification cost. The question is therefore what AI-use disclosure accomplishes by itself. If it cannot identify AI slop, it risks becoming a formalized rule maintained primarily to satisfy regulatory requirements such as the EU AI Act or organizational transparency obligations.
One possible approach is to replace a single Yes/No declaration of AI use with reporting of time spent on each stage of the work. For a paper, this could include idea formation, literature search, experiments, data analysis, writing, and revision. A single lie such as 'I did not use AI' is difficult to verify, but stage-by-stage time reporting creates many more consistency checks against the output. For example, three hours of literature search for 200 references implies 54 seconds per reference; ten hours of writing for an 80-page paper implies eight pages per hour. Implausibility can then be tested from the declaration itself.
The goal is not to make false declarations literally impossible. The goal is to increase the number of combinations that must be fabricated for the lie to remain coherent. An unauthorized AI user would need to invent not only one statement that 'AI was not used' but mutually consistent times for idea formation, literature search, experimentation, analysis, writing, and revision, and those values would also need to fit the paper's length, reference count, experiments, data volume, and revision history. More declaration fields create more fabricated combinations and more points of failure, placing a larger burden on dishonest AI users than on honest participants. Even without directly detecting AI use, a system can make deception expensive to maintain.
Another classical but effective method is random sampling: do not have humans review every case, but subject a subset to human-only scrutiny and impose serious penalties when improper AI use is confirmed. It is not necessary to catch every violation if the probability of a surprise check and the consequence of detection are large enough to raise the expected cost of covert AI use. Full human review is not realistic, so the system should be designed to impose greater expected burden on unauthorized AI users through combinations such as more detailed process declarations, random human audits, and sufficiently heavy penalties in confirmed cases. The objective is not perfect AI detection. It is to break the condition in which undisclosed AI misuse is cheap, safe, and profitable.
The Leiden Declaration from the Mathematics Community
Published on June 2, 2026, the Leiden Declaration on Artificial Intelligence and Mathematics is an international collective response to institutional risks created by AI use in mathematical research, and the International Mathematical Union (IMU) has expressed support. The Declaration identifies plausible but incorrect proofs, growing peer-review workload from AI-generated material, non-disclosure of tools and computational resources, authorship and consent regarding training data, inequality in access to compute, corporate influence over research agendas and evaluation criteria, and exaggerated capability claims by AI companies as major concerns. It calls for final responsibility by human authors, disclosure of tools, rigorous review and verification, protection of authors' rights, and public research infrastructure independent of industry. The Declaration itself is not included as a standalone PC case because publication of a declaration does not constitute an incident with an identified victim and measured harm. It is retained as supporting evidence that side effects already recorded by this database and by UTIE Instruments Inc., including consumption of peer-review resources and occupation of acceptance capacity in PC-12 (Sakana AI), are being recognized as system-level issues across mathematics. Source: official Leiden Declaration.
Public-Label GATE
PC-16, PC-17, and PC-18, all concentrated in May 2026, represent a newer form of GATE. Unlike conventional ban-or-removal GATE cases, these systems do not immediately delete content or accounts; instead, they publicly display suspicion of AI use through a label, producing reputational harm. An automatic label may look like a mild warning, but it publicly tells viewers, buyers, fans, and advertisers that 'this material may be AI-generated,' transferring the cost of a false positive from the platform to the person labeled. This property also appears in PC-8, where a student falsely flagged by GPTZero at UC Davis had to provide Google Docs version history to prove innocence. In public-label GATE cases, legitimate users likewise bear the burden of proving the negative proposition that 'I did not use AI.' The growing need to retain keystroke records, production logs, camera metadata, and edit histories as self-defense amounts to the emergence of a new tax: the cost of proving humanness.
Areas Where Further Expansion Is Expected
Automated filters introduced as AI-slop countermeasures tend toward conservative thresholds because organizations often regard allowing slop through as riskier than accidentally catching legitimate content. The Stack Overflow moderator strike in PC-3 is a clear explosion of this contradiction and can be read together with PC-4 and PC-7 as the 'three siblings' of AI-detection failure. By July 2026, concrete institutional changes and harms had also been confirmed in restaurant reservations, music streaming, video recommendation, visual discovery, short-form video, e-commerce, game distribution, game-guide publishing, hiring, court filings, news comments, social-media trend summaries and financial information, and online-encyclopedia editing, and these were added as PC-21 through PC-37. Other areas, including literary and art competitions, grant review, patent filing, and AI-paper detectors in academic journals, remain in Findings where specific victims or concrete defensive institutional changes have not yet been sufficiently identified. (4) Patent-review infrastructure overload from expanded AI-assisted filing: Japanese patent applications reached 82,188 in December 2025, approximately 2.69 times the previous month. Lower filing costs from AI patent-assistance tools were reported as a background factor, and some social-media users described the surge as a 'DDoS attack on the Patent Office.' Professor Ichiro Satoh of the National Institute of Informatics suggested that some companies or patent firms may have used AI tools for mass filing. The CEO of an AI patent-tool vendor acknowledged that the volume was difficult to process realistically using conventional human resources alone. This could become an empirical example in institutional infrastructure of the V > C_max dynamic predicted by Naito (2026b), where output velocity V exceeds the cognitive processing capacity C_max of patent examiners. At present, however, defensive changes by the Japan Patent Office and specific affected victims have not been sufficiently identified, so the matter remains in Findings. Sources: Nikkei XTECH, Yuudai Nagata (March 2026), 'The Mystery Behind December's Surge in Patent Applications: Expanded AI Use and Lower Costs' and 'Patent Applications Reach an Unusual Level: December 2025 Up 170% Year on Year, with AI in the Background.' These matters should move into the case database when concrete victims, stronger evidence, and measurable harm are identified.
(5) Risk of legitimate papers being falsely excluded by AI-paper detection in academic journals: in March 2026, an AI-paper detection system developed by Professor Isao Echizen and colleagues at the National Institute of Informatics was introduced into review workflows at the Physical Society of Japan, according to NHK. A reported accuracy figure of 90% came from an evaluation environment with ordinary submission volume; the false-positive rate in an operational environment where AI-generated submissions double or more the volume has not been established. Multiple AI detectors have also been reported to misclassify writing by non-native English speakers (see PC-4), and most authors in Japanese academic societies are non-native English speakers, increasing environment-specific risk. The numerical accuracy claim depends on an implicit assumption of stable submission volume, the same issue identified by Naito (2026b, Section 4.3), creating concern about future use in workflows that carry disciplinary or exclusionary consequences. Source: NHK News, March 25, 2026.
Relationship to the Main Database
UTIE Instruments Inc., the affected party in main AI Incident Database case JP-0 (Springer Nature fabricated peer-review incident), is also an affected party in PC-1 (Zenodo) and PC-2 (arXiv and related repositories). The fact that an organization researching AI slop experienced both direct AI-slop harm and collateral harm from AI-slop countermeasures within a short period illustrates the severity of the problem recorded by this database.
Victims Often Cannot Speak Up
Cases such as Zenodo, Stack Overflow, and Clarkesworld became visible because at least some affected people already had established records, evidence, and the means to challenge unjust exclusion. In hiring, grant review, freelance platforms, credit decisions, and similar settings, harm from malfunctioning AI-slop countermeasures may be much broader while remaining completely invisible. A person may be mechanically screened out by a false positive from an AI-detection algorithm and receive only a formulaic notice saying that, 'after careful human consideration, we regret to inform you...' The person may conclude that their skills were insufficient or that they were unlucky. There may be no meaningful appeal channel, and the person may never know they were discriminated against. In that respect, invisible cases may be more severe than many incidents that can be documented in this database.
Appeal-system washing. Platforms often point to an appeals process as a safeguard. When they do not publish the number or proportion of decisions reversed on appeal, who reviewed them, processing time, or reasons for reconsideration, this database treats the public record as showing no verifiable evidence of successful relief through the appeal process. This does not claim that internal relief never occurs; it reflects that an organization publicly advertising a remedy has not supplied the minimum evidence needed to demonstrate its effectiveness. Where reversal data remain undisclosed, the appeal system should be treated as potentially serving institutional signaling, allowing a platform to say that 'a process exists' without demonstrating that the process provides effective relief.
COVER (Concealment) Can Arise as an Economically Rational Choice
Why do companies and platforms repeatedly conceal AI-slop pollution incidents? The explanation is not limited to morality; several incentives make concealment economically rational. First is the legal shield of 'overall judgment.' In hiring, credit, and moderation, companies often have no general obligation to disclose the full details of their decision process. A formula such as 'a comprehensive decision under internal policy' can conceal whether the underlying cause was an AI-detection error or discrimination against non-native speakers. Second is the litigation risk created by acknowledging systematic discrimination. If a company admits that an AI detector produced a false positive, it may effectively admit a system-level defect affecting everyone previously rejected by the same algorithm. That can create class-action and compliance exposure, giving legal departments an incentive to insist that the organization never characterize the event as a system error and instead reduce the harm to an individual complaint. There is also an economic disincentive to have humans overturn AI decisions. Re-reviewing automated decisions by humans undermines the cost-saving purpose for which the automation was introduced. From the company's perspective, discarding a small number of innocent users by mistake can be cheaper than inserting human review into the decision process. Human-in-the-loop language can then appear only after a dispute as a defensive explanation. This is the same basic incentive seen in COVER cases involving Springer Nature in the main database: because AI output looks superficially plausible, managers can decide that a minimal explanation is cheaper than acknowledging a system failure, making organizational concealment the lowest-cost response.
Defensive Platform Change Forced by Law
PC-1 through PC-18 primarily involved defensive changes adopted voluntarily by platforms. PC-19, the Take It Down Act, is an early case in which national law institutionalizes GATE pressure through a 48-hour removal obligation. The policy objective is rapid relief for victims of non-consensual intimate imagery and AI deepfakes, yet it is operationally difficult to make precise determinations within 48 hours about AI generation, identity, consent, journalism, evidence preservation, and critical use. In that environment, even over-removal that catches legitimate posts can become legally rational for a platform seeking to avoid FTC sanctions. In addition to the economic incentives discussed under COVER, compliance obligations and sanction avoidance can therefore intensify defensive platform changes.
Cascading Discrimination
This is one of the most important differences from older spam problems. When an old spam filter failed, an email might simply fail to reach its recipient. Today, when one platform excludes a legitimate user from search, other AI systems that reference, retrieve from, or learn from that platform, including AI search, chat AI, and citation-checking systems, can infer that 'this person, company, or paper does not exist.' As recorded in PC-2, AI systems have already classified real papers as 'fabricated citations' and recommended automatically removing them from reference lists. A crude defensive algorithm on one platform can therefore propagate and amplify through AI systems worldwide, automatically erasing real people's work and digital existence from machine-accessible knowledge. The harm does not remain inside one platform; it can spread across the digital information environment. This is why AI-slop pollution can become a social problem rather than a narrow technical error.
Expansion of Harm to Uninvolved Third Parties
PC-20, the Ashley MacIsaac case, involved a victim who had not posted anything to the platform at issue. A search platform's AI summary generated a false criminal history and the result contributed to cancellation of a performance. The pollution analogy therefore extends beyond downstream users: even third parties who did not use the platform can be harmed by AI output generated and circulated through it.
This is the inverse of the erasure-type harm described under Cascading Discrimination. In PC-2, real papers were treated by AI as non-existent or fabricated and therefore erased from digital knowledge. In PC-20, a real person was assigned a false criminal attribute that did not exist. Erasure, denial of real existence, and fabrication, assignment of a false attribute, are not separate problems. They are opposite outputs of the same mechanism by which platform AI systems rewrite a person's social existence from the outside.
Distinguishing Simple Flow Limits, Pseudo-Flow Limits, and the Need for Composite Flow Design
Naito (2026a) proposes Flow-by-Flow, which controls the output flow itself so that it does not exceed human supervisory capacity rather than attempting to judge the correctness or authenticity of each AI output. Applying this idea in platform operations requires more than observing that a platform has imposed a numeric posting limit. It is necessary to distinguish which actor is constrained, the unit of limitation, and how difficult the constraint is to evade. This database therefore distinguishes genuine simple flow limits, pseudo-flow limits, and composite flow design. A pseudo-flow limit is an implementation that appears to restrict posting velocity but lacks sufficient identity verification or evasion resistance and can be bypassed at low cost through additional accounts or similar means. PC-14 (PIXTA) applied an after-the-fact upload limit to an existing user with more than 5,000 uploads, cutting the monthly cap from 3,000 to 1,500. On the surface this looks like a flow limit, but it was not tied to KYC-based authenticity checks and could be bypassed through new accounts. Because the marginal cost of mass account creation is near zero for slop producers, this type of retrospective limit does not materially damage their return on investment and instead selectively constrains legitimate human creators already participating under real-name or corporate identities. It therefore reaches the same outcome as failed content-judgment approaches: selective exclusion of legitimate users.
Even a genuine KYC-backed flow limit is likely to be optimized around over time if it remains a single-dimensional quantity cap. Generative AI combines near-zero marginal cost with non-linear expansion of output speed, continuously creating pressure to pack the maximum amount of slop into whatever posting allowance remains. A simple flow limit is a static defense against this optimization pressure and can lose effectiveness over time. The important analytical distinction is therefore between pseudo-flow limits such as PC-14, genuine simple flow limits, and composite flow design, allowing platforms' defenses to be evaluated according to the layer at which they actually operate.
Why Better Approaches Are Not Adopted
Platforms such as arXiv and Zenodo can be compared to systems that leave the tap fully open, allow contaminated water to flow downstream, and then complain when the filter clogs. Why not put a physical flow constraint, KYC, at the tap? Naito (2026b) discusses three reasons. First is asymmetric economic incentive. Opening the tap, liberalizing submissions and increasing user counts, is rewarded in the short term as platform growth. KYC introduces friction, can reduce user counts, and may lower impressions. The victims, legitimate researchers, have little visibility, while beneficiaries such as slop operators are hard to see. The short-term cost of tightening the flow is visible; the cost of leaving it open is not. Slop harm accumulates without becoming visible until a threshold is crossed (E_detected ≪ E_actual). Operators continue to believe 'things are still fine' until the problem suddenly breaks the system, as in PC-6 (Clarkesworld). Responding only when the filter has clogged is the reactive stage after a threshold shock (see Naito, 2026b, Threshold Shock, Phase III: Reactive). A deeper problem is that the people who choose not to restrict the tap often do not bear responsibility for the downstream cost. Platform designers can invoke open science or freedom of speech, and are less likely to be criticized while they appear to preserve those principles. If slop then enters and legitimate users are excluded, acknowledging the causal link as a design failure can create class-action risk of the kind discussed in PC-1 and PC-2. Under those incentives, minimizing the problem as 'the spammers' fault' or 'AI's fault' and engaging in concealment (COVER) becomes a rational institutional choice.
How Anti-AI-Slop Gate Strengthening Operates in Research
Researchers at large organizations such as Google DeepMind, Microsoft Research, Meta AI, and OpenAI use multiple distribution channels in parallel: arXiv, corporate blogs, and academic conferences. A preprint can appear on arXiv while the same work is promoted on the company's own domain, followed after conference acceptance by both arXiv links and corporate publication. For these organizations, arXiv is one channel among many; even an on-hold decision causes little practical damage because they retain corporate domains, Google Scholar visibility, and conference channels. Large Chinese companies including Huawei also submit high volumes to arXiv, and UTIE Instruments Inc. has directly confirmed the publication of AI-slop papers among such submissions. Combined with the authentication advantages associated with institutional affiliation, researchers from these large organizations operate in practice in a near-automatic-passage environment. arXiv has acknowledged that computer-science categories have been hit particularly hard by AI slop and has restricted review and position papers; mass submission is one direct contributor to that defensive response. The resulting irony is that large organizations can flood the system with AI slop while independent researchers and small organizations without favored institutional affiliation absorb the collateral restrictions.
In practice, arXiv users can therefore be analyzed as four broad tiers. Tier 1 consists of GAFA-scale organizations and DeepMind-style research groups that can submit at high volume with near-automatic passage in ordinary operation and can supplement arXiv with their own domains. Tier 2 includes large Chinese corporations such as Huawei, for which UTIE Instruments Inc. has confirmed high-volume arXiv publication including AI-slop papers. Tier 3 consists of medium-sized corporate researchers who face a gray zone with frequent on-hold outcomes. Tier 4 consists of small organizations and individual researchers who can face effective exclusion through on-hold decisions even when they possess endorsements. The result is a system that presents itself under an open-access banner while functioning in practice as research infrastructure disproportionately favorable to large institutions.
If arXiv defines itself as an open preprint server, its proper role should be limited to formal requirements, legal constraints, and obvious spam control. In practice, however, labels such as 'not of interest' and AI-slop judgments are used to evaluate research content, author attributes, and author trustworthiness through opaque processes and to remove authors from the ordinary publication flow. That is not merely technical moderation; it is content selection and functions as peer review in substance. An institution performing peer-review-like exclusion should bear corresponding responsibilities: transparency about process and reasons, functioning appeal mechanisms, responses to false positives, and publication of disposition counts, reinstatement rates, and unresolved cases at a level at least comparable to the accountability expected of COPE-member journals. arXiv instead occupies a position in which it can exclude like a reviewer without assuming the obligations of a review institution, present itself as open while applying opaque selection, and render harms from appeals and prolonged holds invisible as isolated cases. Unlike predatory journals, arXiv does not charge authors, but it shares several governance characteristics associated with predatory publishing models, including opaque treatment of authors, weak accountability, and inadequate explanation of quality-control decisions.
The prevailing model in which institutional affiliation is treated as a proxy for trust appears open on the surface but is in substance a status-based and institutionally exclusionary design favoring people attached to major institutions. A person with an MIT email address is treated as inherently more trustworthy, while an independent researcher whose strongest credential is a passport remains subject to suspicion. This outcome runs opposite to the stated ideal of open science. Public KYC based on tax records, passports, government-issued identification, or equivalent documentation asks a different question: not which organization a person belongs to, but whether there is one real human being who can bear responsibility. We argue that this is the legitimate democratic condition for open infrastructure in the age of AI slop. AI slop is damaging because it can be generated in massive volume without responsibility. Conversely, once a real person who can bear responsibility stands behind a submission, whether that person belongs to a university should be irrelevant to their right to submit. Affiliation with a major institution does not answer the question of human accountability. An AI cannot hold a passport or bear tax obligations; a real human can. This asymmetry is the basis for treating KYC as a legitimate checkpoint between unaccountable AI-scale production and accountable human intellectual participation. Platforms that proclaim open science while making conflict-of-interest-bearing institutional affiliation a de facto condition preserve incumbent privilege under the language of openness. In a flow-design approach, KYC is not a tool of exclusion but of inclusion: any researcher anywhere in the world can receive an equal protected submission allowance if they can establish that they are a real human being. That is a form of open science that the current system has not achieved and shows little intention of achieving.
This records a serious condition in which the side effects of AI-slop countermeasures directly strike researchers who study AI slop.