你的模型實際上知道你甚麼？先從它知道你的寫作風格説起

What Does Your Model Actually Know About You? Start With the Fact That It Knows Your Writing.

Point one. Everything I'm about to describe is legal, is disclosed in a document you agreed to, and is roughly six years ahead of public awareness.

Point two. It's not a conspiracy. It's an optimization. The systems work better when they know more, and nobody has successfully built a cheaper version that works as well.

Point three, and this is the one that matters: the practical question isn't whether you're in the training data. You are. The practical question is what an adversary, a vendor, or a government can reconstruct about you from systems you never directly used.

I spent ten years inside programs that did this at a national scale. What's changed isn't the method. It's who can afford it.

The data you can't opt out of

There's a useful distinction between data you produce and data that's produced about you.

You produce: messages, posts, emails, the documents you upload, the code you write, the reviews you leave. This is the part everyone talks about, and it's the part you have some control over, in the sense that you can choose to produce less of it in public.

Data produced about you: your writing style, your response times, your network graph, your location patterns inferred from a hundred sources, your purchases, your face in photographs other people took. This is the part almost nobody thinks about, and it's the more valuable half.

A model doesn't need your name to build a useful profile of you. It needs a cluster of correlated signals, and those signals are abundant, and the cluster is stable enough that it can be re-identified across datasets with surprisingly little information. The research on this is not ambiguous. Anonymization, as a practical protection, largely failed about a decade ago, and we kept using the word because the legal frameworks needed a word.

The part that surprised even me

Writing style is a fingerprint. Not metaphorically.

There are models that can identify an author from a few hundred words with accuracy that would hold up in a civil proceeding, and they work across translation, across topic changes, across deliberate attempts to sound different. You can change what you say. You're much worse at changing how you say it, because the "how" is the part you don't consciously control.

Why this matters: every text you've written that's been scraped is now training signal that describes your style. If someone has access to a model fine-tuned on that, or even just embeddings of it, they can test whether a given anonymous text is yours. Whistleblower protections, anonymous forums, pseudonymous writing, all of it, on borrowed time.

The mitigation exists and it's annoying: write things you don't want attributed in a register you don't use elsewhere. Deliberately, mechanically different. Shorter sentences, different punctuation habits, different vocabulary level. It's a costume, and costumes work about as well as they do in real life, which is to say partially and only against people not looking hard.

What a model "knows" is stranger than what's in its database

Here's where people's mental models break. A model doesn't store your record. It stores weights, and the weights encode statistical structure, and that structure contains information about you that was never in one place.

Ask it a question and it can reproduce memorized text. Ask it a carefully constructed sequence and it can reveal a training example. Ask it to complete a pattern and it will infer an attribute you never stated, because the attribute correlates in the data with things you did state.

The privacy literature calls this extraction and inference. The practical implication: "we don't have your data" is not a reassuring statement if the model was trained on data from people like you, because the model has generalized.

The three things I'd actually do

I'm not going to tell you to delete your accounts. That's not a real option and the advice is useless.

One. Separate your identities by function. Professional, financial, and personal communication in different registers, ideally different accounts, ideally different devices for the financial one. This isn't paranoia, it's basic segmentation, and it costs you maybe an hour to set up.

Two. Turn off training on your data wherever the setting exists, and check quarterly. The settings move. Companies that defaulted to opt-out have quietly changed to opt-in. The one place you should never skip this is the assistant you talk to most, because that's the highest-signal text you produce.

Three. Assume anything you type into a chatbot is on the record. Not because that specific vendor is malicious, but because the retention policies are longer than your memory of what you said, and because "conversation history for product improvement" has a way of expanding.

The uncomfortable structural point

Individual caution does not solve this. It shifts risk onto people with less time to be careful.

The people most exposed to AI-driven inference are the ones who can least afford to segment identities: low-income workers on monitored platforms, people in countries with weaker data protection, anyone whose communications have been co-opted by a system they never chose to use.

And the regulatory picture is a patchwork where the strongest protections exist in exactly the places with the strongest negotiating position, because that's how the world works and not because anything about privacy is geographically determined.

So be careful, personally. But don't mistake personal caution for a solution. It's a seatbelt, not a road.

Your data is already gone. The question is what gets built on top of it.