Download the Book (PDF): Introduction Every lithium-ion battery in a phone, a laptop or an electric car contains a few grams to a few kilograms of flammable liquid. That liquid, a solution of a lithium salt in a blend of organic carbonates, does one job: it lets lithium ions travel between the two electrodes while blocking electrons, which are forced to take the long way round through the external circuit and do useful work on the way. It does that job remarkably well. It also catches fire when abused, reacts slowly with almost everything it touches, and, most importantly for the argument of this book, it makes it impossible to use the electrode material that chemists have wanted since the 1970s: pure lithium metal. The solid-state battery is the proposal to replace that liquid with a solid, usually a ceramic or a glass, sometimes a polymer. Stated that way, it sounds like a component swap. It is not. Changing the electrolyte changes the mechanics of the cell, the chemistry of every interface inside it, the way it has to be manufactured, the conditions under which it can be charged, and the kind of factory that can make it. For thirty years the idea has been described as five years away. In 2025 and 2026 it moved, for the first time, from laboratory coin cells into pilot lines, test fleets and a long-distance road drive by a production-derived car. It is therefore a good moment to ask precisely what the technology can and cannot do, and why. The argument of this book The central claim of this book is that the solid-state battery is not one invention but a bundle of coupled interface problems, and that its entire value rests on a single question: can a solid electrolyte let a cell run on a lithium metal anode, safely, for a thousand cycles, at a current high enough to charge in minutes, in a factory that can make millions of cells a year? If the answer is yes, energy density rises by something like 30 to 50 percent at the cell level and fast charging and safety improve along with it. If the answer is no, a solid electrolyte paired with a conventional graphite anode buys very little that cannot be had more cheaply in other ways. That framing explains much that otherwise looks confusing. It explains why "solid-state" announcements vary so widely in what they actually describe, from cells that are mostly liquid to cells with no liquid at all. It explains why the industry's hardest problem is not finding a solid that conducts lithium ions quickly, which was largely solved a decade ago, but stopping lithium metal from forcing its way through that solid as thin filaments, the dendrites that short-circuit a cell from the inside. It explains why test cells are clamped under pressures that would be absurd in a car, and why the leading developers have spent more effort on the manufacturing of a 30-micrometre ceramic sheet than on any new chemistry. And it explains the limits of the technology in the most demanding application of all, electric flight, where even the best plausible solid-state cell solves only part of the problem. Three common misconceptions Public discussion of solid-state batteries tends to circle three ideas, each of which contains a grain of truth and each of which, taken at face value, leads to wrong conclusions. The first is that a solid-state battery is inherently safe because it contains nothing that burns. Ceramics indeed do not burn. But a lithium metal anode is itself highly reactive, the cathode in any high-energy cell still releases oxygen when overheated, and some solid electrolytes release toxic gas when damaged and exposed to moist air. A solid-state cell can be made very safe; it is not safe by default, and the most careful analyses say so plainly. The second is that the race is about finding a solid that conducts ions as fast as a liquid. That was the scientific question of the 2000s, and it has largely been answered. The questions that now decide success are mechanical and manufacturing ones: how to keep solids in contact as they swell and shrink, how to stop soft metal from cracking hard ceramic, and how to make thin, flawless layers by the square kilometre. The third is that "solid-state" names a single thing. Cells sold under that label range from conventional designs with a ceramic coating on the separator, through hybrids containing gels or a few percent of liquid, to cells with no liquid at all. Some of these are excellent products. Only some of them address the problem that makes the solid electrolyte worth having. China introduced a national terminology standard in 2026 precisely because the label had become so elastic. What the reader will find The book moves from mechanism to market. Chapter 1 explains what a lithium battery is in physical terms and why the liquid electrolyte, rather than the cathode or the anode alone, has become the ceiling on energy density. Chapter 2 describes how ions move through solids at all, and surveys the four families of solid electrolytes that matter: oxides, sulfides, halides and polymers, each with a different set of strengths and fatal flaws. Chapter 3 is about dendrites, the problem that has done more than any other to keep solid-state cells in the laboratory, and about why the textbook answer, simply use a hard enough solid, turned out to be wrong. Chapter 4 turns to the other interfaces: the cathode side, where a solid electrolyte must stay in contact with particles that swell and shrink every cycle, and where chemical incompatibilities create resistive layers that slowly strangle the cell. Chapter 5 is about manufacturing, the unglamorous discipline that now decides which companies survive. Chapter 6 maps the competitive field as it stands in late 2026, with the major programmes in Japan, Korea, China, Europe and the United States, and offers a method for reading company claims without being misled by them. Chapter 7 asks what a solid-state cell actually changes for an electric car, once cell gains are diluted by packs, cooling and cost, and against strong competition from improving liquid-electrolyte chemistries. Chapter 8 takes on aviation: how much energy an aircraft needs per kilogram of battery, why that number is so unforgiving, and which kinds of electric aircraft a solid-state battery would, and would not, make possible. The conclusion draws out what all of this implies for engineers, investors and policymakers. A note on numbers Battery discussions are thick with figures, and they are easy to misuse. Three distinctions recur throughout the book and are worth stating at the start. The first is between gravimetric energy density, measured in watt-hours per kilogram, and volumetric energy density, measured in watt-hours per litre. Cars care about both, but are often more constrained by volume, because the battery has to fit in the floor. Aircraft care overwhelmingly about mass. A technology that wins on one measure can lose on the other. The second is between the material, the cell and the pack. A cathode material may store a certain amount of energy per kilogram; a finished cell, with its current collectors, electrolyte, separator and casing, stores much less; a pack, with cooling, structure, wiring and electronics, stores less again. A cell rated at 400 Wh/kg might become a pack at 280 to 320 Wh/kg. Most headline numbers are cell numbers, and many are for small laboratory cells that flatter the result. The third is between a demonstration and a product. A cell that delivers a thousand cycles in a laboratory at 25 degrees Celsius, under a clamp of several megapascals, charged slowly, has demonstrated something real. It has not demonstrated that the same chemistry will survive eight winters in a car in Minnesota. Where this book cites a performance figure, it names the source and, where it matters, the conditions. The aim throughout is to give the reader enough of the underlying physics and chemistry to judge claims independently. Solid-state batteries are likely to matter a great deal in the coming decade. They are unlikely to matter in exactly the way their most enthusiastic advocates suggest, and the difference lies in the details of what happens at a few interfaces, each only nanometres thick, inside a sealed cell. Chapter 1: Why the Liquid Is the Limit A battery is a controlled chemical reaction that has been split in two. On one side sits a material that wants to give up electrons; on the other, a material that wants to take them. If the two touched, the reaction would run at once and release its energy as heat. A battery keeps them apart and offers two separate paths between them: one for electrons, through a wire and whatever device the wire powers, and one for ions, through the electrolyte inside the cell. Because the reaction needs both an electron and an ion to arrive at the same place at the same time, the cell does work only when the external circuit is closed. The electrolyte is the gatekeeper that makes the arrangement possible. It must conduct ions and refuse electrons. In a lithium-ion cell, the ion is lithium. During discharge, lithium leaves the negative electrode, the anode, as a positively charged ion, crosses the electrolyte, and slots into the crystal structure of the positive electrode, the cathode. The electron it left behind travels through the circuit and meets it there. During charging, an external power source forces the process backwards. The genius of the design, recognised by the 2019 Nobel Prize in Chemistry awarded to John Goodenough, Stanley Whittingham and Akira Yoshino, is that both electrodes are hosts: crystal frameworks with spaces into which lithium can be inserted and from which it can be removed, many thousands of times, without the framework collapsing [1]. Where the energy is stored The amount of energy a cell stores is the product of two quantities: how much charge it can move and the voltage at which it moves it. Charge capacity is set by how many lithium ions the electrodes can host per kilogram or per litre. Voltage is set by the difference in how strongly the two electrodes hold on to lithium. A cathode that binds lithium very tightly, paired with an anode that binds it very loosely, gives a high voltage. Modern cathodes are layered oxides of nickel, manganese and cobalt (the NMC family), nickel-cobalt-aluminium oxide (NCA), or lithium iron phosphate (LFP). They operate at roughly 3.2 to 4.3 volts against lithium metal, and their practical capacities lie between about 160 and 220 milliamp-hours per gram. Chemists have pushed these numbers up steadily, mostly by increasing nickel content and by charging to higher voltages, but the gains are now incremental. Each further step brings a crystal structure that is less stable, releases oxygen more readily when hot, and degrades faster. The anode is where the dramatic gains lie. Nearly every commercial lithium-ion cell uses graphite, a stack of carbon sheets between which lithium atoms can slide. Graphite is cheap, stable and forgiving. But it is mostly carbon, and carbon is dead weight from the point of view of energy storage: six carbon atoms are needed to host a single lithium atom, giving a theoretical capacity of 372 milliamp-hours per gram. Lithium metal itself, used as the anode with no host at all, offers 3,860 milliamp-hours per gram, more than ten times as much. It also sits at the lowest possible potential, so it maximises cell voltage. Silicon sits in between, hosting nearly four lithium atoms per silicon atom, but swelling by roughly three times its original volume as it does so. Table 1 sets the three options side by side [2]. Table 1. Candidate anode materials for lithium batteries (standard literature values; see Obrovac and Chevrier, 2014). Anode material Theoretical capacity (mAh/g) Potential vs lithium (V) Volume change on full lithiation Status in 2026 Graphite 372 about 0.1 about 10% Dominant in commercial cells Silicon about 3,580 about 0.4 about 280–300% Blended into graphite; silicon-rich cells in niche use Lithium metal 3,860 0 Entire layer forms and vanishes Primary cells and pilot rechargeable cells The ten-fold figure overstates the practical gain, because the anode is only one part of the cell. A cell also contains a cathode, which is heavy, two metal foils that carry current, an electrolyte, a separator and packaging. Replacing a graphite anode with a thin layer of lithium does not make the cell ten times better. Calculations by many groups, and the cells now emerging from pilot lines, put the realistic improvement at the cell level at roughly 30 to 50 percent in volumetric energy density and somewhat less or similar in gravimetric terms, depending on the cathode and the format. A good graphite-anode cell with a high-nickel cathode stores about 250 to 300 watt-hours per kilogram and 650 to 750 watt-hours per litre; lithium-metal cells in development target 350 to 500 watt-hours per kilogram and 900 to 1,000 or more watt-hours per litre. Those gains are large enough to matter. In a car, a 40 percent improvement in volumetric energy density means either 40 percent more range from the same floor space or the same range from a smaller, lighter and cheaper pack. In aviation, as Chapter 8 shows, the difference between 300 and 450 watt-hours per kilogram is the difference between an aircraft that cannot carry a useful payload and one that can fly a short commercial route. The lithium metal problem Lithium metal was the first anode anyone tried. Stanley Whittingham's rechargeable cell at Exxon in the 1970s paired a lithium metal anode with a titanium disulfide cathode. In the late 1980s, the Canadian company Moli Energy sold rechargeable lithium metal cells for mobile phones. They failed in the field, some catching fire, and the company recalled them in 1989. The episode set the direction of the entire industry: when Sony commercialised the lithium-ion battery in 1991, it used a carbon anode precisely so that no metallic lithium would ever form. The problem with lithium metal is not the metal itself but what happens when it is repeatedly stripped away and plated back. In a liquid electrolyte, lithium does not deposit as a smooth, even layer. It grows as mossy clumps and needle-like filaments, collectively called dendrites. There are several reasons. Any small bump on the surface concentrates the electric field and the flow of ions, so it grows faster than its surroundings, and the bump becomes a spike. The lithium surface is also coated with a thin, cracked, chemically heterogeneous film formed when the electrolyte reacts with the metal, and lithium tends to burst through the weakest spots in this film. Each new surface that forms reacts with more electrolyte, consuming both lithium and liquid, so the cell slowly dries out and loses capacity. Two outcomes follow. In the slow failure, filaments break off, lose electrical contact, and become "dead lithium," inert metal that no longer contributes capacity; the cell fades quickly. In the fast failure, a filament grows across the thin plastic separator and touches the cathode. The cell short-circuits internally, its stored energy discharges through a microscopic path, and the local temperature rises. In a cell full of flammable organic solvent, a short circuit can become thermal runaway: the heat decomposes the electrolyte and the cathode, which release more heat and flammable gases, which ignite. Graphite avoids this by never allowing metallic lithium to exist in the cell, but only on a knife edge. Graphite takes up lithium at about 0.1 volts above the potential of lithium metal. If a graphite cell is charged too fast or too cold, the voltage at the anode surface drops below zero relative to lithium, and metallic lithium plates on the graphite instead of entering it. This "lithium plating" is the main reason fast-charging curves for electric cars taper off as the battery fills, and why charging slows in cold weather. Even a mainstream cell lives with the lithium metal problem; it simply manages it by staying away from the edge. What the liquid does and what it costs The liquid electrolyte in a lithium-ion cell is typically lithium hexafluorophosphate dissolved at about one mole per litre in a mixture of ethylene carbonate and linear carbonates such as dimethyl carbonate or ethyl methyl carbonate, plus a handful of additives at the percent level. It soaks into the porous electrodes and the porous polymer separator, filling every gap so that every active particle is bathed in an ion conductor. Its ionic conductivity at room temperature is around 10 millisiemens per centimetre, high enough that ions move easily through electrodes tens of micrometres thick. The liquid's great virtue is that it is a liquid. It flows into every crevice, wets every particle, and stays in contact as the electrodes expand and contract during cycling. No mechanical engineering is required to maintain contact between the electrolyte and the electrode; the liquid simply follows the surface wherever it goes. As later chapters will show, this property is so valuable that solid-state designers spend most of their effort trying to reproduce it. The liquid's costs are fourfold. First, it is flammable. Dimethyl carbonate has a flash point near 17 degrees Celsius, below normal room temperature. Every safety system in a lithium-ion pack, from the cell vents to the thermal barriers between modules, exists because the electrolyte will burn if the cell gets hot enough. Second, it is not stable against either electrode. At the anode's low potential, the carbonate solvents are chemically reduced; at a high-voltage cathode, they are oxidised. A lithium-ion cell works only because the products of the reduction form a thin, protective film on the anode, the solid electrolyte interphase, which stops further reaction while still letting lithium ions through. This film is one of the most studied and least understood structures in electrochemistry. On graphite it forms once and then stays mostly intact, because graphite changes volume by only about ten percent. On lithium metal, which is created and destroyed in bulk every cycle, the film cracks and re-forms continuously. Third, the liquid limits the voltage of the cathode. The carbonate solvents begin to oxidise significantly above about 4.3 to 4.5 volts, which caps how far the cathode can be charged and therefore how much energy each kilogram of cathode can deliver. Fourth, and less obviously, the liquid moves the wrong ions. In a salt solution both positive and negative ions are mobile. In a typical lithium-ion electrolyte, only about a third of the current is carried by lithium ions; the rest is carried by the hexafluorophosphate anions moving the other way. During fast charging, the anions pile up at one electrode and are depleted at the other, creating concentration gradients that raise resistance and drive the anode surface toward the lithium plating condition. The fraction of current carried by lithium is called the transference number, and a low transference number is one of the fundamental reasons liquid cells struggle to charge quickly without damage. A solid electrolyte addresses each of these limitations, at least in principle. Ceramics and glasses do not burn. Many of them are stable at higher voltages than carbonates. In most inorganic solid electrolytes, the anions are locked into a rigid crystal framework and only lithium ions move, so the transference number is essentially one and the concentration gradients that plague fast charging in liquids do not arise. Most importantly, a solid separator might physically block lithium filaments from crossing the cell, allowing lithium metal to be used as the anode for the first time in a rechargeable product at scale. That last point is the heart of the matter. A solid electrolyte paired with a graphite anode is a legitimate design, and some companies pursue it for safety reasons. But its energy density is similar to that of a conventional cell, because the solid electrolyte is typically denser than the liquid it replaces and a solid separator is usually thicker than a polymer one. The only way the solid-state battery delivers a step change in energy is by enabling lithium metal, or a closely related "anode-free" design in which the anode is formed from lithium plated out of the cathode on the first charge. This changes how one should read the technology. The relevant question is not whether a material conducts ions as fast as a liquid. Several solids now do, as Chapter 2 explains. Nor is it whether a ceramic can resist fire, which it obviously can. The question is whether the solid can remain in intimate contact with a lithium metal electrode that grows and shrinks by tens of micrometres every cycle, without letting lithium penetrate it, without reacting with it, and without losing contact on the cathode side, at the current densities a car or an aircraft needs. Each of those requirements, on its own, has been met in some laboratory. Meeting all of them at once, in a cell made by a machine at high speed, is the actual problem. Anode-free cells and the arithmetic of excess lithium One design idea deserves explanation here because it recurs throughout the book. A conventional lithium metal cell includes a foil of lithium at assembly, typically thicker than strictly necessary, to compensate for lithium that is lost to side reactions as the cell ages. That excess lithium adds mass and volume without adding usable capacity, and handling thin lithium foil in a factory is difficult and expensive: lithium is soft, sticky and reactive with moisture and nitrogen. The anode-free approach eliminates the foil entirely. The cell is assembled with only a bare copper current collector, or a thin coated layer, on the negative side, pressed against the solid electrolyte. All of the lithium starts in the cathode. On the first charge, lithium leaves the cathode, crosses the electrolyte and plates as metal directly onto the current collector, forming the anode in place. On discharge it strips away again. Because there is no excess lithium, the energy density is the highest possible for a given cathode. The penalty is that there is no reserve: every lithium atom lost to a side reaction or stranded as dead metal is a permanent loss of capacity. An anode-free cell therefore demands near-perfect efficiency, typically better than 99.9 percent of lithium recovered on every cycle, to reach a thousand cycles with acceptable capacity. QuantumScape's cells, discussed in Chapter 6, use this design, as did a prominent Samsung research cell published in 2020. The arithmetic is unforgiving. If a cell loses 0.1 percent of its lithium each cycle, after 500 cycles it retains about 61 percent of its starting lithium inventory; at 0.05 percent per cycle it retains about 78 percent; at 0.02 percent, about 90 percent. The gap between a laboratory curiosity and a car battery lies in the fourth significant figure of coulombic efficiency. Liquid electrolytes have never achieved such efficiency with lithium metal over long life at practical currents. The hope invested in solid electrolytes is that a stable, dense, single-ion conductor will make lithium plate and strip cleanly enough to close that gap. Three things changed between the 2000s and the 2020s to turn the solid-state battery from an academic topic into an industrial one. The discovery of solid electrolytes with liquid-like conductivity, beginning with a sulfide reported by Toyota and Tokyo Institute of Technology researchers in 2011, removed the first objection. The electric car created a market large enough, and hungry enough for range and fast charging, to justify billions of dollars of development. And the steady but slowing improvement of liquid lithium-ion cells made it clear that the next large step would require a different anode, which in turn would require a different electrolyte. What did not change is the physics of the interfaces. The next chapter turns to how lithium ions actually move through a solid, because the answer explains both why some solids work so well and why each family of materials carries a characteristic weakness that no amount of engineering has fully removed. Chapter 2: How Ions Move Through Solids For most of the twentieth century, the phrase "fast ion conductor" sounded like a contradiction. Solids were understood as rigid lattices in which atoms vibrate around fixed positions; diffusion through them is real but slow, the stuff of metallurgy over hours at red heat, not of a battery delivering amperes at room temperature. The discovery that some solids conduct ions nearly as well as liquids is one of the quiet triumphs of materials science, and understanding why it happens is the key to understanding the trade-offs among the materials now competing for the solid-state battery. Hopping, vacancies and the energy landscape An ion in a crystal sits in a site, a pocket formed by the surrounding atoms where its energy is low. To move, it must squeeze through a gap, a bottleneck formed by neighbouring atoms, into an adjacent empty site. The squeeze costs energy, called the activation energy or migration barrier. At any temperature, thermal vibrations occasionally give an ion enough energy to make the jump. The rate of jumping rises exponentially as the barrier falls or the temperature rises, which is why ionic conductivity in solids is so sensitive to both. A barrier of 0.5 electronvolts gives a sluggish conductor at room temperature; a barrier of 0.25 electronvolts can give a fast one. Small differences in the barrier, a tenth of an electronvolt here or there, change conductivity by factors of tens to hundreds. Two conditions must be met for fast conduction. There must be many mobile ions, and there must be empty sites for them to move into. A crystal in which every lithium site is filled conducts poorly because there is nowhere to go. A crystal with lithium spread across a network of partially occupied, closely spaced, energetically similar sites conducts well, because ions can hop from site to site with little preference for any particular one. Materials scientists engineer conductors by creating these conditions: they substitute atoms of different charge into the framework to create vacancies or extra lithium, and they choose frameworks with wide, interconnected channels. The chemistry of the framework also matters in a subtler way. Large, soft, easily polarised anions such as sulfide and iodide hold lithium less tightly and deform more readily as it passes, lowering the barrier. Small, hard anions such as oxide and fluoride hold lithium more tightly. This is a large part of why sulfide electrolytes tend to conduct better than oxides, and why they are also softer and more chemically reactive: the same loose bonding that lets lithium move easily makes the whole framework easier to deform and to attack. A further point is easily missed. In a liquid electrolyte, conductivity is a property of the solution; in a solid, it is a property of a particular crystal structure, sometimes of a particular phase that is stable only within a narrow window of composition and temperature. Many of the best solid conductors are metastable. Cooled slightly differently during manufacture, or doped with a slightly different amount of an element, they adopt a different structure that conducts a hundred times worse. This makes the manufacturing of solid electrolytes more like the manufacturing of a pharmaceutical crystal than of a commodity chemical. The four families Hundreds of solid lithium conductors have been reported. Those relevant to batteries fall into four families. Table 2 summarises their characteristic properties; the discussion that follows explains why each property matters. Table 2. The main families of solid lithium electrolytes (representative values from the research literature; individual compositions vary). Family Representative materials Room-temperature conductivity (mS/cm) Main strength Main weakness Oxides Garnet LLZO; NASICON LATP 0.1–1 Stable with lithium metal (LLZO); robust in air Brittle; needs sintering above 1,000 °C Sulfides Argyrodite Li6PS5Cl; LGPS 1–25 Liquid-like conductivity; soft, cold-pressable Reacts with moisture to release H2S; narrow stability window Halides Li3YCl6; Li3InCl6 about 0.5–2 Stable against high-voltage cathodes Reduced by lithium metal; costly metals Polymers PEO with lithium salt below 0.01 at 25 °C; about 1 at 60–80 °C Flexible, easy to process Needs heating; limited voltage Oxides The most important oxide electrolyte is the garnet lithium lanthanum zirconium oxide, Li7La3Zr2O12, usually abbreviated LLZO, reported in 2007 by Ramaswamy Murugan, Venkataraman Thangadurai and Werner Weppner [3]. Its pure form crystallises in a tetragonal structure with ordered lithium and poor conductivity. Doping with small amounts of aluminium, gallium or tantalum stabilises a cubic form in which lithium is disordered across a three-dimensional network of sites, raising conductivity to between roughly 0.1 and 1 millisiemens per centimetre at room temperature, around a tenth of a liquid electrolyte. LLZO's great attraction is that it is one of very few solid electrolytes that is thermodynamically stable, or nearly so, in contact with lithium metal. Lithium does not reduce zirconium in this structure, so the interface does not degrade chemically. LLZO is also mechanically stiff, with a shear modulus of around 60 gigapascals, compared with about 4 gigapascals for lithium. For years it was regarded as the natural partner for a lithium metal anode. Its weaknesses are mechanical and manufacturing ones. LLZO is a ceramic: hard, brittle and dense, with a density around 5 grams per cubic centimetre, which counts against it in gravimetric terms. To make a dense, conductive sheet it must be sintered at temperatures above 1,000 degrees Celsius, at which lithium tends to evaporate, so the composition drifts unless extra lithium is added and the atmosphere carefully controlled. A thin sheet of it, which is what a battery needs, is fragile. And when exposed to humid air, its surface reacts with water and carbon dioxide to form a layer of lithium carbonate, which blocks lithium ions and must be removed or prevented before a good interface can be made. A second oxide family, NASICON-type phosphates such as lithium aluminium titanium phosphate (LATP), conducts reasonably well and is stable in air, but contains titanium, which lithium metal reduces, so it cannot touch the anode directly. QuantumScape has not published the exact composition of its ceramic separator, describing it only as an oxide; the company's descriptions and patents are consistent with a garnet-type material, but the specific formula remains proprietary. Sulfides The sulfide family produced the result that changed the field. In 2011, a team led by Ryoji Kanno at the Tokyo Institute of Technology, working with Toyota, reported Li10GeP2S12, known as LGPS, with a room-temperature conductivity of 12 millisiemens per centimetre, matching or exceeding liquid electrolytes [4]. In 2016 the same collaboration reported a related composition reaching about 25 millisiemens per centimetre and built cells that delivered high power at room temperature [5]. These results ended the debate about whether a solid could conduct well enough. LGPS itself is expensive because of its germanium content, but the argyrodites, a family typified by Li6PS5Cl, offer conductivities of several millisiemens per centimetre from cheaper elements, and they are now the leading candidates in commercial sulfide programmes at Toyota, Samsung SDI, Solid Power and the major Chinese manufacturers. Sulfides have a second, equally important advantage: they are soft. Sulfide powders can be densified simply by pressing them at room temperature, without sintering, because the particles deform plastically and fuse together under pressure. This means a sulfide separator and a composite cathode can be made by processes that resemble the ones used for conventional electrodes, and that the electrolyte can be pressed into intimate contact with cathode particles. In an oxide system, achieving similar contact requires co-sintering at high temperature, which tends to cause the cathode and electrolyte to react with each other. The weaknesses are chemical. Sulfide electrolytes react with moisture, even the trace moisture in ordinary air, releasing hydrogen sulfide, a toxic gas. They must therefore be made and handled in dry rooms with dew points far lower than those used for conventional cells, a significant manufacturing cost discussed in Chapter 5. Their electrochemical stability window is narrow: in theory, most sulfides are oxidised above roughly 2.5 volts and reduced below about 1.7 volts against lithium, which means they are unstable against both a high-voltage cathode and a lithium anode. In practice they survive because the decomposition products form thin passivating layers, much as a liquid electrolyte does. But those layers grow, and their growth is a central cause of capacity fade in sulfide cells. Cathode particles are therefore coated with a thin oxide buffer, typically lithium niobate, a technique pioneered by Narumi Ohta and colleagues in Japan in the mid-2000s [6]. Halides Chloride and bromide electrolytes such as Li3YCl6 and Li3InCl6, reported in 2018 by researchers at Panasonic [7], revived interest in a family that had been studied since the 1990s but neglected. Their attraction is oxidative stability: they tolerate the high voltages of nickel-rich cathodes without a coating, and they can be processed by cold pressing like sulfides. Their conductivity, around one millisiemens per centimetre, is respectable. Their weakness is that they are reduced by lithium metal, so they cannot be used alone in a lithium-metal cell, and several contain expensive metals such as indium or scandium. Current designs therefore increasingly use halides as a catholyte, the electrolyte mixed into the cathode, paired with a sulfide or oxide separator that faces the anode. This kind of layered design, with different solids on each side, has become a general strategy: no single solid electrolyte is stable against everything. Polymers Solid polymer electrolytes, most commonly polyethylene oxide with a dissolved lithium salt, are the oldest family and the only one that has powered vehicles in significant numbers. The French company Bolloré, through its subsidiary Blue Solutions, sold lithium-metal-polymer batteries in its Bluecar, used in the Autolib car-sharing service in Paris from 2011 until 2018, and in buses. The approach works, but with a catch. Lithium moves through polyethylene oxide by riding on the motion of polymer chains, and the chains move freely only above the polymer's melting point, around 60 degrees Celsius. Below that, conductivity collapses. The Bluecar batteries were kept warm at 60 to 80 degrees Celsius, drawing energy from the pack to do so when the car was parked. Polyethylene oxide also oxidises at around 4 volts, ruling out high-energy cathodes, which is why the Bolloré cells used lithium iron phosphate. And the polymer is soft, so it does little to stop dendrites mechanically. Polymers remain important as components. Many "quasi-solid" and "semi-solid" designs use polymer gels that contain some liquid, and polymer binders and interlayers are used in composite electrodes to improve contact. But an all-polymer electrolyte is unlikely to deliver the combination of room-temperature performance and high voltage that cars and aircraft need. Thin films: the proof of principle One further material deserves mention because it proves a point. Lithium phosphorus oxynitride, known as LiPON, was developed at Oak Ridge National Laboratory in the early 1990s by John Bates, Nancy Dudney and colleagues [8]. It is an amorphous glass with poor conductivity, around 2 microsiemens per centimetre, roughly 5,000 times lower than a liquid electrolyte. Yet thin-film batteries made with a micrometre-thin layer of LiPON and a lithium metal anode have run for tens of thousands of cycles without dendrite failure. Because the film is so thin, its low conductivity matters little. And because it is a glass with no grain boundaries, and is electronically insulating, lithium plates against it smoothly. Thin-film cells store very little energy, because the electrodes are also deposited as thin films by slow vacuum processes, and they are used only in niche applications such as medical implants and microelectronics. But LiPON shows that a solid electrolyte can cycle lithium metal essentially indefinitely under the right conditions. The question is what those conditions are, and why bulk ceramics, with far higher conductivity and stiffness, often fail where a thin glass succeeds. That question is the subject of the next chapter. A worked comparison: resistance, not conductivity Conductivity figures can mislead because what a cell feels is resistance, and resistance depends on thickness as well as on the material. The relevant quantity is the area-specific resistance: the thickness of the layer divided by its conductivity, expressed in ohms times square centimetres. Multiplying it by the current density gives the voltage lost across the layer. Take a solid separator 30 micrometres thick (0.003 centimetres) made of an argyrodite sulfide with a conductivity of 1 millisiemens per centimetre. Its area-specific resistance is 0.003 divided by 0.001, or 3 ohm-square-centimetres. At a charging current density of 4 milliamps per square centimetre, roughly a one-hour charge for an automotive electrode, the voltage lost across it is 12 millivolts, negligible against a cell voltage near 4 volts. Make the same separator from a garnet at 0.1 millisiemens per centimetre and the loss rises to 120 millivolts, noticeable but tolerable. Now compare a conventional separator. A liquid electrolyte has a conductivity near 10 millisiemens per centimetre, but in a separator it sits inside the pores of a polymer film, perhaps 40 percent of the volume, along winding paths. The effective conductivity is reduced by a factor that commonly lies between about five and ten, to around 1 to 2 millisiemens per centimetre. A 20-micrometre conventional separator therefore has an area-specific resistance of roughly 1 to 2 ohm-square-centimetres, not very different from the sulfide case. The arithmetic shows why the bulk conductivity of good solid electrolytes is no longer the limiting factor. The resistance that matters in practice comes from elsewhere: from the boundaries between grains inside a polycrystalline ceramic, which can conduct far worse than the grains themselves; from the contacts between electrolyte particles in a pressed layer; and above all from the interfaces with the electrodes, where resistances of tens to hundreds of ohm-square-centimetres were common in early solid-state cells. Researchers separate these contributions using impedance spectroscopy, applying a small alternating voltage over a range of frequencies and observing how the cell responds. Bulk conduction, grain-boundary conduction and interfacial charge transfer respond on different timescales, so each appears as a separate feature in the measurement. In cell after cell, the interfacial features dominate. Conductivity is not the bottleneck The history summarised here leads to a conclusion that surprises many observers. For practical purposes, the problem of making a solid that conducts lithium ions quickly enough has been solved [9]. Several sulfides exceed liquid electrolytes, and because they are single-ion conductors their effective performance is better still. Oxides and halides, though slower, are adequate for separators a few tens of micrometres thick. What has not been solved is the behaviour of these solids at their boundaries: with the lithium metal anode, with the cathode particles, and with each other. A cell is a stack of interfaces, and a solid electrolyte, unlike a liquid, cannot flow to heal a gap or re-wet a surface that has moved. The rest of this book is largely about those boundaries. It is worth stressing how much of the trade-off space is fixed by chemistry. The soft, polarisable sulfide framework that gives high conductivity and easy processing is the same feature that makes it unstable and moisture-sensitive. The strong bonding that makes LLZO stable against lithium is the same feature that makes it hard, brittle and in need of high-temperature processing. There is no known material that is simultaneously a superb conductor, stable against both electrodes, soft enough to press into shape, stable in air and cheap. Every commercial programme is a choice of which weakness to engineer around. Toyota, Samsung SDI and most Chinese efforts have chosen the sulfides and their moisture and stability problems. QuantumScape has chosen an oxide and its brittleness and manufacturing difficulty. Others, such as Factorial in its earlier products, have chosen polymer-based quasi-solid systems and their compromises on purity of concept. Understanding which weakness a company has chosen is the first step to evaluating its prospects. Chapter 3: The Dendrite Problem In 2005, Charles Monroe and John Newman of the University of California, Berkeley, published an analysis that became one of the most cited papers in the field [10]. They asked what it would take for a solid electrolyte to suppress the growth of lithium protrusions mechanically. Their model treated the electrolyte as an elastic solid pressed against a lithium surface with a small bump on it. When lithium plates preferentially at the tip of the bump, the bump must push the electrolyte aside, and the elastic stress this creates changes the local electrochemical potential, making further deposition at the tip less favourable. If the electrolyte is stiff enough, the bump stops growing and the surface flattens. Their criterion, for the polymer systems they considered, was that the electrolyte's shear modulus should be roughly twice that of lithium. The Monroe–Newman result was widely read as a promise. Lithium's shear modulus is around 4 gigapascals. Polymers fall far short of 8 gigapascals, which explained why polymer cells could not stop dendrites. But ceramics such as LLZO, at around 60 gigapascals, exceed the criterion many times over. If stiffness was the answer, a ceramic separator should simply block lithium. It does not. Through the 2010s, research groups around the world assembled lithium metal cells with dense ceramic electrolytes, applied current, and watched them short-circuit, sometimes within a few cycles, sometimes at current densities well below those used in a phone, let alone a car. When the failed cells were cut open, they revealed lithium metal threaded through the ceramic, along grain boundaries, through pores and cracks, sometimes straight through grains. A material sixty times stiffer than lithium was being penetrated by it. Understanding why took most of a decade and remains the single most important scientific question for the technology. Why a hard ceramic fails against soft lithium The resolution comes from recognising that the Monroe–Newman analysis described a smooth, perfect interface between two elastic materials. Real ceramics are not like that. They contain flaws: pores left from sintering, grain boundaries between crystals, surface scratches from polishing, and microscopic cracks. And lithium deposition does not behave like a slowly growing bump. It behaves like a pressurised fluid being injected into a crack. Consider what happens during charging when lithium is plated at the interface between the metal and the ceramic. Lithium ions arrive from the electrolyte, pick up electrons, and become atoms of metal. Those atoms must go somewhere. If the interface is flat and the lithium can flow away sideways or push the whole electrode back, all is well. But if there is a small crack or pore in the ceramic surface, and lithium deposits inside it, the new metal has nowhere to go. It is confined. As more lithium deposits, the pressure inside the crack rises, potentially to hundreds of megapascals. The physics of brittle fracture now takes over. A crack in a brittle material under internal pressure grows when the stress at its tip exceeds the material's fracture toughness. Ceramics are stiff but not tough: LLZO's fracture toughness is roughly one megapascal-root-metre, comparable to window glass. A pressure of a few hundred megapascals in a crack a few micrometres long is enough to drive it forward. The lithium follows the crack, filling it, pressurising the new tip, and driving it further. The process is self-sustaining. A detailed analysis published in 2017 by Lukas Porz and colleagues, working with Yet-Ming Chiang at MIT, set out this mechanism and showed that the critical current density at which penetration begins depends on the size of the surface flaws and on the toughness of the ceramic, not on its stiffness [11]. Stiffness, the property everyone had focused on, is almost irrelevant once a crack exists. Later imaging made the mechanism visible. In 2021, a team at the University of Oxford led by Peter Bruce, using X-ray computed tomography at a synchrotron, watched cracks form and propagate through an argyrodite sulfide electrolyte as lithium was plated, showing the crack opening first and lithium filling it behind the advancing tip [12]. The process resembles hydraulic fracturing, in which fluid pumped into rock opens fractures ahead of it, more than it resembles the growth of a crystal. There is a second pathway. In 2019, Fudong Han, Chunsheng Wang and colleagues reported that lithium can nucleate inside the bulk of a solid electrolyte, away from the anode, if the electrolyte conducts even a small amount of electronic current [13]. Most solid electrolytes are not perfect electronic insulators. Their residual electronic conductivity, especially at grain boundaries and in the presence of impurities or reduced decomposition products, can allow electrons to reach lithium ions inside the solid, where they combine to form isolated pockets of metal. These pockets can grow and link up, creating a conducting path from the inside out. The practical lesson was that a solid electrolyte must be an extremely good electronic insulator as well as a good ionic conductor, and that the decomposition products formed at the lithium interface, which may conduct electrons, can undermine it. The behaviour of a lithium–ceramic interface is commonly characterised by its critical current density: the current per unit area above which the cell shorts. It is the most useful single number for judging progress, and also one of the most frequently abused. To see why it matters, consider a practical cathode with a loading of 4 milliamp-hours per square centimetre, roughly what a high-energy electric vehicle cell uses. Charging it in one hour requires a current density of 4 milliamps per square centimetre. Charging it from empty to full in 15 minutes, the kind of fast charging consumers increasingly expect, requires about 16 milliamps per square centimetre, though in practice charging slows towards the top of the range. For many years, ceramic electrolytes paired with lithium metal at room temperature showed critical current densities below one milliamp per square centimetre. Even slow charging was out of reach. Progress since then has been substantial but uneven, and published values must be read with care. A critical current density depends on temperature, on the pressure applied to the cell, on the thickness of the lithium, on the area of the cell, on how long each charging step lasts, and on how many cycles are run. A test at 60 degrees Celsius, under 10 megapascals of pressure, with thick lithium and short pulses, can produce a value ten times higher than the same material tested at room temperature with modest pressure and long charges. When a company or a paper reports a critical current density, the first questions are under what pressure, at what temperature, for what areal capacity, and over how many cycles. Stripping matters as much as plating The dendrite story focuses attention on charging, when lithium is plated. But some of the most important discoveries concern discharge, when lithium is stripped away. When lithium is removed from the interface faster than lithium metal from the bulk of the electrode can flow in to replace it, voids open at the interface. Lithium at room temperature is close enough to its melting point (180 degrees Celsius) to creep, flowing slowly under stress like a very stiff paste, and it diffuses through itself, but neither process is fast. At high discharge rates, atoms are removed from the interface faster than creep and diffusion can supply new ones, and gaps form between the lithium and the ceramic. The current then concentrates at the remaining contact points, raising local current density far above the average. On the next charge, lithium plates preferentially at those points of high current, creating exactly the conditions under which penetration begins. A 2019 study led by Jitti Kasemchainan, also in Peter Bruce's group at Oxford, showed this directly with an argyrodite electrolyte: there was a critical stripping current, above which voids formed, and the voids led to dendrites and short circuits on subsequent plating [14]. Applying more pressure raised the critical stripping current, because it pushed lithium into the gaps faster. The insight was that dendrite formation in solid-state cells is not just a plating problem but a cycle problem: damage done during discharge sets up failure during the next charge. This explains one of the most striking practical features of solid-state cells: stack pressure. Laboratory cells are routinely clamped at several megapascals, sometimes tens of megapascals. One megapascal is roughly ten atmospheres, or about 100 tonnes per square metre. A car battery pack cannot carry a heavy steel press around each cell without sacrificing much of the energy density that justified the technology. Reducing the required pressure to one megapascal or below, a level manageable with modest compression structures within a module, has become a central engineering target. The Mercedes-Benz test car with Factorial cells, discussed in Chapter 6, used pneumatic actuators in the pack to manage cell pressure as the cells expanded and contracted, a sign of how real this problem is even in the most advanced demonstrations. The strategies that work Out of this understanding has come a set of practical strategies, most of which are now used in combination. The first is to control the ceramic's microstructure: denser sintering to eliminate pores, smaller and more uniform grains, careful surface preparation to remove flaws and surface contamination such as lithium carbonate, and dopants that reduce electronic conductivity at grain boundaries. These measures raise the critical current density by reducing the number and size of the flaws from which cracks start. The second is to insert an interlayer between the lithium and the electrolyte. The most celebrated example came from the Samsung Advanced Institute of Technology in 2020. Yong-Gun Lee and colleagues placed a thin layer of silver nanoparticles mixed with carbon black between an argyrodite sulfide electrolyte and a bare stainless steel current collector, in an anode-free design [15]. During charging, lithium first alloyed with the silver, then plated beneath the silver-carbon layer, between the layer and the current collector, rather than at the interface with the electrolyte. The silver-carbon layer acted as a buffer that spread the lithium evenly and kept it away from the fragile electrolyte surface. The prototype pouch cell reached a volumetric energy density above 900 watt-hours per litre and ran for more than 1,000 cycles at 60 degrees Celsius, with coulombic efficiency of 99.8 percent. It remains one of the best-documented demonstrations of a practical-format anode-free sulfide cell. Interlayers of gold, silver, magnesium, aluminium, zinc oxide and various alloys have been used in similar ways, and some form of interface engineering layer is now present in most serious designs. The third strategy is to keep the anode compliant. Using lithium alloys rather than pure lithium, or lithium composites with three-dimensional hosts, can maintain contact during stripping because the electrode does not depend entirely on lithium creeping into gaps. The fourth is pressure, applied thoughtfully: enough to keep the interface in contact during stripping, but not so much that it forces lithium into cracks during plating. Research has shown that excessive pressure can itself drive lithium into the electrolyte, especially in softer sulfides, so the window is narrower than it first appears. The fifth is temperature. Lithium creeps much faster, and ceramics conduct better, at 40 to 60 degrees Celsius than at 25. Many demonstrations, including the Samsung research cell, were run warm. Cars can manage battery temperature, and modern packs already heat cells before fast charging. But a battery that must be warm to charge without risk of short-circuit is a battery that will be difficult to charge quickly on a cold morning, which is precisely when range anxiety is worst. The mechanisms described in this chapter also explain the puzzle left at the end of Chapter 2: why micrometre-thin films of LiPON, a mediocre conductor, cycle lithium metal for tens of thousands of cycles while far better ceramics fail. Each feature of LiPON corresponds to one of the failure pathways. LiPON is a glass, deposited atom by atom in a vacuum chamber. It has no grain boundaries, so there are no internal surfaces along which lithium can travel or at which electronic conductivity concentrates. Its surface is nearly atomically smooth, so there are no sizeable flaws from which cracks can start; the fracture analysis of Porz and colleagues predicts that smaller flaws need much higher pressures to propagate. It is an exceptionally good electronic insulator, closing the internal nucleation route identified by Han and colleagues. It reacts with lithium to form a thin, stable interphase. And in thin-film batteries the current densities are low and the lithium layers are thin, so the stripping and void problems that arise when large amounts of lithium move each cycle never become severe. None of these conditions is easy to reproduce in a bulk ceramic made by sintering powder, and that is the problem in a sentence. The thin-film battery proves that the physics allows indefinite cycling of lithium against a solid. The challenge is to obtain glass-like perfection at the interface while making the electrolyte by fast, cheap, large-area processes, and while moving ten to a hundred times more lithium per cycle than a thin-film cell ever does. Some developers have pursued exactly this idea by coating sintered ceramics or pressed sulfides with thin amorphous layers, so that lithium meets a smooth, glassy, electronically insulating surface even when the bulk behind it is polycrystalline. What remains open The dendrite problem in solids is not solved in the sense that a universal recipe exists. It is solved in the narrower sense that several companies have shown cells that cycle lithium metal hundreds to more than a thousand times at practically useful currents, in multilayer formats, under pressures and temperatures that can be engineered into a vehicle. QuantumScape has published data on multilayer cells cycling to over a thousand cycles with capacity retention above 80 percent; Samsung, Toyota and others have published or presented results along similar lines. These are real achievements that would have seemed implausible in 2015. What remains open is the behaviour of these interfaces across the full envelope of real-world use. Lithium penetration is a statistical phenomenon: it starts at the worst flaw in the cell. A cell with a few square centimetres of area may have no critical flaw; a car pack with tens of square metres of interface across thousands of cells will certainly contain some flaws, and a single short in one cell can disable a module. The relevant engineering question is not whether a cell can avoid dendrites but at what rate dendrite-induced failures occur across millions of cells over a decade. That rate can only be measured by building and testing large numbers of cells for long periods, which is exactly what the industry has only begun to do. It is also worth stating plainly what happens if a dendrite does cross a solid separator. The cell short-circuits. Because there is no flammable liquid, the consequences are in principle less severe than in a conventional cell. But a lithium metal anode can itself burn, it melts at 180 degrees Celsius, and the cathode still releases oxygen when overheated. A short in a solid-state cell is not automatically benign, a point Chapter 7 develops further. The dendrite problem is therefore both a reliability problem and a safety problem, and the claim that solid electrolytes solve it should be understood as a claim about probabilities, not certainties. Chapter 4: The Cathode and the Contact Problem If the anode is where the solid-state battery earns its energy density, the cathode is where it most often quietly loses it. The dendrite problem is dramatic: a cell shorts, and the failure is plain to see. The problems on the cathode side are slower and harder to diagnose. Capacity fades over hundreds of cycles, resistance creeps upward, and power falls away, often for several reasons at once. Many solid-state programmes that have conquered dendrites in the laboratory have then spent years on the cathode, and the outcome of that work largely determines whether a cell delivers its theoretical energy in practice. Why a solid cathode must be a composite A conventional lithium-ion cathode is a porous layer, perhaps 60 to 100 micrometres thick, made of active particles a few micrometres across, a small amount of conductive carbon, and a polymer binder. Roughly a third of its volume is pore space, which fills with liquid electrolyte. Every particle is surrounded by liquid, so lithium ions can reach every part of every particle's surface. In a solid-state cell there is no liquid to fill the pores. If the cathode were made of active particles alone, lithium ions could enter only the particles touching the separator, and the rest of the electrode would be unreachable. The solution is to mix solid electrolyte powder into the cathode, creating a composite in which a network of electrolyte particles carries ions into the depth of the electrode, a network of carbon carries electrons, and the active particles sit at the junctions of both. The electrolyte in the cathode is often called the catholyte. This creates the first trade-off. Every gram of catholyte in the electrode is a gram that stores no energy. In a liquid cell, the electrolyte in the pores is light and fills space that would otherwise be empty. In a solid cell, achieving good ionic pathways typically requires 20 to 30 percent of the cathode's mass to be solid electrolyte, and the solid is denser than a liquid. Early solid-state cathodes contained even more, and the energy density of the whole cell suffered accordingly. Reducing the catholyte fraction while keeping ion pathways continuous through a thick electrode is one of the main engineering frontiers. The tools include smaller and more uniform electrolyte particles, careful mixing to distribute them, and coated or single-crystal active particles that need less catholyte contact to work. There is a geometric subtlety as well. Particles touch at points or small patches, not over their whole surface. Lithium ions can cross only where the active particle actually touches the electrolyte. The effective contact area in a pressed composite can be a modest fraction of the particle surface, and every gap is an area where the active material is not working. Sulfide electrolytes help because they are soft and deform around active particles when pressed, giving much better contact than hard oxides. This is a major reason why most high-energy solid-state programmes use sulfide catholytes even when they use other materials elsewhere. QuantumScape, whose separator is an oxide ceramic, uses a gel catholyte containing a liquid component in its cathode, which sidesteps the contact problem on that side at the cost of making the cell not purely solid. Breathing particles The contact problem would be manageable if the particles stayed still. They do not. Cathode materials change volume as lithium enters and leaves them. For nickel-rich layered oxides, the change is modest at the level of the whole crystal, a few percent, but it is anisotropic: the crystal lattice shrinks sharply in one direction and expands slightly in another near the top of charge. The secondary particles used in commercial cathodes are clusters of many small primary crystals oriented in different directions, so as each crystal changes shape, stresses build at the boundaries between them, and the clusters crack. In a liquid cell, this cracking is a nuisance: new surfaces form, the liquid floods in, and side reactions consume a little electrolyte. In a solid cell it is more serious. A crack inside a particle opens a new surface that no electrolyte can reach, so part of the particle becomes isolated. And as particles shrink during charging, they can pull away from the surrounding solid electrolyte, breaking the contact through which lithium must pass. Each cycle may lose a little more contact. Capacity fades not because the material is chemically degraded but because parts of it have become unreachable. Two remedies have been widely adopted. The first is to use single-crystal cathode particles, which are each one crystal rather than clusters of many, so they have no internal boundaries to crack along. Single-crystal nickel-rich cathodes have become common in liquid cells for durability reasons and are particularly favoured for solid-state cells. The second is to choose cathode compositions with smaller volume changes, or to limit the charge voltage so that the most damaging part of the lattice contraction is avoided. Each remedy costs something: single crystals can be harder to make and slower to conduct lithium internally; limiting voltage sacrifices capacity. At the cell level the same phenomenon appears on a larger scale. In a lithium metal or anode-free cell, the anode grows and shrinks by the full thickness of the plated lithium on every cycle. With a cathode loading of 4 milliamp-hours per square centimetre, the lithium layer plated on charge is about 20 micrometres thick. A multilayer cell with dozens of layers therefore changes thickness by a significant fraction of a millimetre between full and empty, and a pack of cells by more. This must be accommodated mechanically: by compliant layers within the cell, by flexible pack structures, or by active pressure management. The volume change of the cathode partly offsets that of the anode, but not fully. This is the problem the Mercedes pack's pneumatic actuators were designed to solve. Chemical warfare at the interface The second family of cathode problems is chemical. Most solid electrolytes are not stable against the potential of a charged cathode. Thermodynamic calculations, pioneered by groups including Yifei Mo's at the University of Maryland and Gerbrand Ceder's at Berkeley in the mid-2010s, showed that most sulfide electrolytes are oxidised at potentials above about 2.5 volts against lithium. A nickel-rich cathode at full charge sits above 4 volts. In contact with a sulfide, it oxidises the electrolyte, forming sulfur, phosphorus sulfides and other products that conduct lithium poorly. A resistive layer grows at every contact point between cathode and catholyte, and the cell's internal resistance rises. There is also a more subtle electrical effect. When two materials with very different chemical potentials for lithium come into contact, lithium ions redistribute across the boundary, creating a thin region depleted of lithium on the electrolyte side, called a space-charge layer. Several research groups have argued that this layer adds substantially to interfacial resistance in uncoated sulfide cathodes, though the relative importance of space-charge effects versus chemical decomposition remains debated. The remedy for both is a coating. Each cathode particle is wrapped in a layer of a few nanometres of a lithium-conducting oxide, most commonly lithium niobate or lithium borate-type materials, that is stable against both the cathode and the sulfide. The coating separates the two materials chemically while still letting lithium pass. This approach, introduced in the mid-2000s, transformed the performance of sulfide cells and is now standard. Making it work at scale is not trivial: the coating must be uniform, complete, and thin enough not to add resistance itself, and it must survive the stresses of mixing and pressing. Coating quality varies, and an incomplete coating leaves exposed spots where degradation begins. Halide electrolytes, being stable at high voltage, offer a way around the coating requirement, which is why they have been adopted as catholytes in some designs. Oxide electrolytes such as LLZO are also stable at higher voltages, but their brittleness and the need for high-temperature co-sintering make composite oxide cathodes difficult: at sintering temperatures the cathode and electrolyte tend to react, forming resistive phases. This is a principal reason why all-oxide solid-state cells with thick, high-loading cathodes have proved so difficult to make. Chapter 3 described the anode interface in mechanical terms. It also has chemistry. Lithium metal is the most reducing substance in the cell, and it reduces almost every solid electrolyte except a few oxides such as LLZO. When a sulfide such as Li6PS5Cl contacts lithium, it decomposes into a thin layer of lithium sulfide, lithium phosphide and lithium chloride. This interphase is, fortunately, a reasonable lithium conductor and a poor electronic conductor, so it stops growing after a short time, much like the solid electrolyte interphase in a liquid cell. Other electrolytes are less fortunate. LGPS, containing germanium, decomposes into products that include conducting germanium-lithium alloys, which let the reaction continue indefinitely. LATP, containing titanium, behaves similarly. The choice of electrolyte facing the anode is therefore governed by whether its decomposition products are self-limiting. This chemistry interacts with mechanics. If the interphase that forms on lithium is uneven, it creates spots of higher and lower resistance, focusing current and seeding the non-uniform plating that leads to dendrites. A clean, uniform, self-limiting interphase is part of what makes argyrodite sulfides and garnet oxides viable against lithium, and part of what the interlayers described in Chapter 3 are designed to provide. The cumulative effect of these constraints is that a practical solid-state cell is rarely a single solid electrolyte. A modern design may contain a coated nickel-rich cathode mixed with a halide or sulfide catholyte, a thin sulfide or oxide separator, and an interlayer on the anode side, possibly a silver-carbon or alloy buffer, against a copper current collector. Each material is chosen for the interface it faces. The cell has become a stack of specialised layers, each a few micrometres to a few tens of micrometres thick, each with its own processing requirements and failure modes. This multilayer approach is effective, but it multiplies the interfaces, and every interface is a potential failure point. Each pair of solids must stay in contact, must not react with each other over years, and must tolerate the volume changes of its neighbours. A cell with five distinct materials has at least four internal interfaces between them, plus the interfaces between particles within each layer. It is as much a mechanical structure as an electrochemical one. Because so many mechanisms act at once, diagnosing why a solid-state cell is fading is a discipline in itself. A typical investigation begins with impedance measurements taken at intervals during cycling, which reveal whether the growing resistance sits at the anode, the cathode or in the bulk. A rising cathode interface resistance with little change elsewhere points to chemical decomposition or contact loss on the cathode side. To tell those apart, the cell is opened and cut, and its cross-section examined by electron microscopy: contact loss appears as gaps around particles, cracking as fissures within them. Surface-sensitive techniques such as X-ray photoelectron spectroscopy then identify the chemical species formed at the interfaces, distinguishing, for instance, oxidised sulfur compounds from intact electrolyte. Increasingly, laboratories use operando methods, measuring while the cell operates, including X-ray tomography and diffraction at synchrotron facilities, to watch contact being lost and cracks forming in real time. This forensic work has produced a broadly agreed ranking of what limits cathode life in sulfide cells. In uncoated or poorly coated cathodes, chemical decomposition dominates and appears within the first tens of cycles. In well-coated cathodes, mechanical contact loss and particle cracking become the main long-term mechanisms, which is why single-crystal particles and careful pressure management have become standard. In thick, high-loading cathodes, ionic transport through the catholyte network limits power, especially at low temperature. Each mechanism has a remedy, and each remedy has a cost in energy density, processing complexity or price. Why this sets the energy density The cathode problems matter for a simple reason. The energy density advantage of a solid-state cell, calculated in Chapter 1, assumes that the cathode is as thick and as full of active material as in the best liquid cells, and that every particle delivers its full capacity. In practice, solid-state cathodes have historically been thinner, contained more inactive electrolyte, and delivered less of their theoretical capacity, particularly at high charge and discharge rates. A lithium metal anode that adds 40 percent to the cell's energy density can be largely cancelled by a cathode that is 20 percent less loaded and delivers 10 percent less of its capacity. The leading developers have narrowed this gap substantially. Cathode loadings of 3 to 5 milliamp-hours per square centimetre, similar to conventional cells, are now routinely reported in solid-state work, with active material fractions of 70 to 85 percent. Whether those figures hold at production speeds and after a thousand cycles is the central technical question for the next three years. When evaluating a solid-state cell, the cathode loading and composition are as important as any claim about the anode, and they are often the figures that announcements leave out. The choice of cathode chemistry follows from the same logic. Almost every serious solid-state programme pairs its lithium metal anode with a nickel-rich layered oxide rather than with lithium iron phosphate, and the reason is arithmetic. A lithium metal anode adds the most energy when the cathode is already energy-dense and operates at high voltage; replacing graphite saves a fixed mass and volume per unit of capacity, and that saving counts for more when each unit of capacity is delivered at about 3.8 volts than at 3.3. Lithium iron phosphate also stores less charge per gram and per litre, so the cathode dominates the cell even more, and the relative gain from the anode shrinks. Pairing a premium, costly electrolyte and anode with the cheapest cathode would deliver a modest gain at a high price. This is why solid-state cells are, for now, a high-nickel technology, and why their cathode problems are those of high-nickel materials: oxygen release when hot, sensitivity to high voltage, and anisotropic volume change. Further ahead, the cathode most often discussed as a partner for solid electrolytes is sulfur, which offers far higher theoretical capacity but swells by about 80 percent when fully lithiated and conducts neither ions nor electrons on its own, making the contact problems described in this chapter more severe still. There is a broader lesson here as well. The early vision of the solid-state battery was of a simplification: replace a messy liquid with a clean solid, and many problems disappear. The reality is the opposite. The liquid was doing several jobs at once without being asked: filling pores, maintaining contact through volume changes, forming self-healing protective films, and accommodating manufacturing imperfections. Removing it means that each of those jobs must be done deliberately, by design, with a dedicated material or mechanism. The solid-state cell is not a simpler battery. It is a more engineered one, and its success depends on whether that engineering can be done reliably at scale. That is a question about factories, which is where the next chapter goes. Chapter 5: Making Them at Scale The lithium-ion battery industry produces cells at a scale few other precision products match. Global manufacturing capacity passed two terawatt-hours a year in the mid-2020s, most of it in China, which means many billions of cells a year, each containing electrode layers whose thickness is controlled to within a few micrometres. That industry has spent three decades learning how to coat, dry, press, cut, stack, fill and form cells at speeds measured in metres of electrode per second, with defect rates measured in parts per million. A solid-state battery that cannot be made with comparable speed and yield is not a product, whatever its performance in the laboratory. This is why, by the mid-2020s, manufacturing rather than chemistry had become the main battleground. It is easiest to see what is new by starting with what is familiar. A conventional lithium-ion cell is made in roughly five stages. First, electrode materials are mixed with a binder and solvent into a slurry. Second, the slurry is coated onto metal foil, aluminium for the cathode and copper for the anode, in long continuous rolls, and passed through ovens to drive off the solvent. Third, the coated foil is calendered, pressed between heavy rollers to a precise thickness and density. Fourth, the electrodes are slit, cut, and either wound into a jelly roll or stacked into layers with a porous polymer separator between them, and placed in a can or pouch. Fifth, the liquid electrolyte is injected, the cell is sealed, and it undergoes formation: a slow first charge, sometimes over days, during which the protective interphase forms on the anode, followed by ageing and testing. The liquid electrolyte makes this process forgiving. Small gaps between layers, minor variations in porosity, slight misalignments: the liquid fills and wets everything. Assembly happens in dry rooms, but the dryness required is moderate, with dew points typically around minus 40 degrees Celsius in the critical areas. What changes for sulfides A sulfide solid-state cell changes almost every stage. Table 3 summarises the main differences for the two leading solid-state routes against conventional practice; the discussion explains each. Table 3. Key manufacturing differences between conventional and solid-state cells (compiled from published process descriptions and industry reports). Process step Conventional liquid cell Sulfide solid-state cell Oxide-separator cell Atmosphere Dry room, dew point about −40 °C Much drier room or inert gas; H2S monitoring Dry room; ceramic made in air-controlled furnaces Separator Porous polymer film, bought in rolls Thin sulfide layer coated or pressed in-house Sintered ceramic sheet, made in-house Densification Calendering High-pressure or isostatic pressing High-temperature sintering of separator Cell assembly Winding or stacking Stacking only, under pressure Stacking of brittle sheets Electrolyte filling Liquid injected None Gel catholyte in some designs The first change is the atmosphere. Because sulfide electrolytes react with moisture to form hydrogen sulfide, every stage at which the electrolyte is exposed must take place in conditions much drier than a conventional battery dry room, or under inert gas. Building and running a dry room at very low dew points over the large floor area of a gigafactory is expensive in both capital and energy; the air-handling systems are among the largest costs in a battery plant even at conventional dryness, and they become larger as the target dew point falls. Hydrogen sulfide monitoring and abatement add further cost. Researchers have worked to make sulfides more tolerant of moisture, for example by substituting oxygen for some sulfur or using elements that bind sulfur more strongly, but these modifications typically reduce conductivity. The second change is the separator. In a conventional cell, the separator is a porous plastic film bought from a specialist supplier. In a sulfide cell, the separator is a layer of solid electrolyte that must be made as thin as possible, ideally 20 to 30 micrometres, while being free of pinholes. It can be made by coating a slurry of electrolyte powder, binder and solvent onto a carrier, then drying and pressing it. But sulfides react with the polar solvents used in conventional electrode coating, so the industry has had to develop processes based on non-polar or weakly polar solvents and compatible binders. An alternative is dry processing: mixing electrolyte powder with a fibrillating binder such as PTFE and pressing it into a film without any solvent at all. Dry electrode processing, which Tesla has pursued for conventional electrodes following its 2019 acquisition of Maxwell Technologies, is attractive for solid-state cells because it avoids solvent compatibility problems altogether. The third change is densification. A solid electrolyte layer conducts well only when its particles are pressed into full contact with each other and with the electrodes, with as little porosity as possible. Calendering helps, but many sulfide programmes add a high-pressure pressing step on the assembled cell stack. The Samsung research cell described in Chapter 3 was made using warm isostatic pressing, in which the stack is sealed and immersed in a heated fluid under several hundred megapascals of pressure, so that pressure is applied uniformly from all sides. Isostatic pressing is a batch process, not a continuous one, and running it at gigafactory throughput is a significant engineering challenge. The fourth change is assembly. Winding, the fastest way to assemble a cell, bends the electrode layers around a tight radius, which a brittle ceramic layer cannot tolerate. Solid-state cells are therefore stacked: individual sheets of cathode, electrolyte and anode are cut and laid on top of each other. Stacking is slower than winding, and the alignment of each layer must be precise, because an exposed edge of cathode beyond the electrolyte, or a burr from cutting, can cause a short. Edge design is a recurring concern: the edges of each layer, where cutting damage and misalignment concentrate, are disproportionately likely to be where failures start. The fifth change is formation and testing. There is no electrolyte to inject, which removes one step, and in principle no prolonged formation of a liquid-derived interphase. But anode-free designs must form their lithium anode on the first charge, which must be done carefully, often under controlled pressure and temperature, to plate a uniform layer. And because the cell will be held under pressure in use, it must often be tested under pressure too, which requires fixtures that conventional formation equipment lacks. The raw material problem Sulfide electrolytes are made from lithium sulfide, phosphorus pentasulfide and lithium halides. Lithium sulfide in particular has historically been a speciality chemical, produced in small volumes at high purity and high cost. This was not a problem when the only customers were research laboratories, but it becomes one at scale. A gigawatt-hour of sulfide solid-state cells requires hundreds of tonnes of electrolyte. The response is visible in the investments of Japan's Idemitsu Kosan, an oil refiner with long experience of sulfur chemistry, which has partnered with Toyota to supply sulfide electrolyte. Idemitsu began building a lithium sulfide plant in February 2025, with completion scheduled for June 2027 and an annual capacity of about 1,000 tonnes, which the company has said is enough electrolyte feedstock for some 50,000 to 60,000 electric vehicles; in January 2026 it began building a pilot plant for the solid electrolyte itself, with a capacity of several hundred tonnes a year [16]. The scale of these numbers puts the transition in perspective. Fifty thousand vehicles is a modest fraction of a percent of global electric car production. The supply chain for sulfide electrolytes is being built from almost nothing, and its costs will fall only as volumes rise. Lithium metal is a second raw material concern. Thin lithium foil, required by designs that start with a lithium anode, is difficult and costly to produce in the thicknesses of 20 micrometres or less that energy-dense cells need, because lithium is so soft and sticky that it tears and adheres to rollers. Alternatives include evaporating lithium onto substrates or laminating it onto copper, all of which add cost. This is one reason anode-free designs are attractive: they eliminate lithium foil handling entirely. The ceramic route The oxide route faces a different set of manufacturing problems, best illustrated by QuantumScape, the most prominent developer pursuing it. QuantumScape's cells use a thin oxide ceramic separator against an anode-free negative electrode, with a gel catholyte on the cathode side. The separator is the critical component. It must be thin, a few tens of micrometres; it must be dense and free of flaws, because, as Chapter 3 explained, the largest flaw determines the current at which lithium penetrates; and it must be large enough in area to make a useful cell, a sheet several centimetres on a side. Making such a sheet involves tape casting, in which a slurry of ceramic powder and organic binder is spread into a thin film, dried into a flexible "green" tape, cut to shape, and then fired at high temperature to burn off the binder and sinter the particles into a dense solid. During sintering, the sheet shrinks by a substantial fraction of its size, and it must do so uniformly or it warps and cracks. Lithium volatility at sintering temperatures complicates the chemistry. Traditional ceramic sintering takes hours in a furnace. QuantumScape's progress in this area has been the core of its story. Its first-generation separator process, which it called Raptor, entered use in 2024. In 2025 it introduced a process it calls Cobra, which the company says increases heat-treatment speed and throughput substantially, and on which its second-generation samples, designated B1, were based from October 2025. In February 2026 it inaugurated an automated pilot production line in San José, called the Eagle Line, intended to demonstrate manufacturing processes for licensees rather than to supply cells at volume [17]. The company does not plan to build its own gigafactories; instead it licenses its technology to manufacturing partners, most importantly Volkswagen Group's battery company PowerCo, which in July 2024 signed an agreement giving it rights to produce up to 40 gigawatt-hours a year of QuantumScape cells, with an option to expand to 80. Whether the separator process can achieve the throughput and yield of a gigafactory at an acceptable cost is the single biggest uncertainty in the oxide route. Battery manufacturing economics are dominated by yield, the fraction of cells that pass final testing. A conventional gigafactory running well yields well above 90 percent of cells; new factories often start much lower and take a year or more to reach mature yields. In solid-state manufacturing, every additional demanding step compounds the risk. If a cell has 30 layers, each made by a process with 99.9 percent defect-free probability, the probability that all 30 layers are good is 97 percent. At 99 percent per layer, it falls to 74 percent. The thin ceramic or sulfide separator, the cathode coating, the interlayer, the alignment and the edge quality each contribute. Defects in solid-state cells are also harder to detect early. A pinhole in a liquid cell's separator usually reveals itself during formation as self-discharge. A subtle flaw in a solid separator might survive formation and testing and then initiate a lithium filament after hundreds of cycles, in a customer's vehicle. This makes inspection, using optical, X-ray and electrical methods at every stage, more important and more expensive than in conventional manufacturing. It also means that early production data on solid-state failure rates will be watched closely, because it is the only way to know whether the statistical problem described at the end of Chapter 3 has been solved. What it will cost Precise cost estimates for solid-state cells are speculative, because no one has yet built a factory at full scale. Several things can be said with confidence. Material costs for sulfide electrolytes are currently far higher than for liquid electrolytes, but they are dominated by immature supply chains rather than by fundamentally scarce elements, so they should fall with volume. Dry rooms, pressing equipment and slower stacking add capital cost per unit of output. Against these, solid-state cells may allow simpler, lighter packs with less thermal protection, and higher energy density means fewer cells and less pack hardware per kilowatt-hour. Most industry and analyst assessments expect solid-state cells to carry a substantial cost premium per kilowatt-hour through the late 2020s, narrowing in the 2030s if volumes grow. End of life belongs in the same calculation. Conventional lithium-ion recycling has matured into two main routes: pyrometallurgy, which smelts cells and recovers nickel, cobalt and copper, and hydrometallurgy, which dissolves shredded cells in acid and separates the metals chemically. Both were designed around liquid-electrolyte cells with graphite anodes. Solid-state cells change the inputs. Sulfide electrolytes contain lithium, phosphorus and sulfur that are worth recovering but will release hydrogen sulfide if shredded in the presence of moisture, so recycling plants will need controlled atmospheres and gas handling. Garnet electrolytes contain lanthanum and zirconium, which conventional recycling chemistry is not set up to recover. Lithium metal anodes, especially in cells with excess lithium, must be safely deactivated before processing. On the positive side, the absence of liquid electrolyte removes a fluorinated, flammable component that complicates current recycling, and some researchers argue that solid cells may suit direct recycling, in which cathode material is recovered and refurbished rather than broken down to its elements. Several electrolyte suppliers, Idemitsu among them, have begun work on recovering sulfide electrolyte. None of this is a barrier to commercialisation, but the recycling infrastructure for solid-state cells will have to be built alongside the factories, not inherited from the existing industry. That premium is the crucial context for Chapter 7. Conventional lithium-ion cell prices fell dramatically over the 2010s and early 2020s, and lithium iron phosphate cells from Chinese manufacturers reached prices that made electric cars competitive with combustion cars on purchase price in some markets. Solid-state cells do not compete with a static target. They compete with a technology that improves and gets cheaper every year, and they must justify their premium by delivering something that liquid cells cannot. The manufacturing story also explains the pattern of announcements. A company that has shown excellent laboratory cells has solved a scientific problem. A company that has built a pilot line producing hundreds or thousands of cells has begun to solve a manufacturing problem. A company that has delivered cells to a carmaker for vehicle testing has solved enough of both to be taken seriously. A company that has a gigawatt-hour factory running at mature yield has a product. In late 2026, as the next chapter shows, the leading programmes sit between the second and third of these stages, with a few edging toward the fourth. Chapter 6: The Race and How to Read It Few technologies have been announced as often as the solid-state battery. Carmakers have promised solid-state vehicles "by the middle of the decade" since the early 2010s; start-ups have announced breakthroughs at a steady rhythm; and several have gone public on valuations that assumed commercial production within a few years. Most of those dates have passed. This history has made many observers cynical, which is understandable but no longer quite right. Something real changed between 2024 and 2026: cells moved out of laboratories into pilot lines, into test vehicles on public roads, and into supply chains for raw materials. This chapter maps the field as it stands in late 2026 and then offers a method for evaluating any claim, including those that appear after this book is written. A note on names Before mapping the field, the vocabulary needs sorting out, because the same words are used for very different things. At one end are all-solid-state cells, which contain no liquid at all. At the other end are conventional cells. In between lies a spectrum of hybrids: cells in which a solid electrolyte coats the electrodes or forms part of the separator but some liquid or gel remains, often in the cathode. These have been marketed as "semi-solid," "quasi-solid," "solid-liquid hybrid" and, misleadingly, simply "solid-state." China has moved to clean this up. In late 2025, reports emerged that the term "semi-solid-state" would be replaced by "solid-liquid" in official usage, and in February 2026 it was reported that a national standard, Solid-State Batteries for Electric Vehicles, Part 1: Terminologies and Classification, would be published in July 2026, dividing batteries into liquid, hybrid solid-liquid, and all-solid-state categories [18]. The intent was to stop carmakers from labelling hybrid cells as solid-state. The distinction matters because hybrid cells, though often genuinely better than conventional ones, do not by themselves solve the problems a full solid electrolyte is meant to solve; in particular, if they use a graphite or silicon-graphite anode, they do not deliver the lithium metal step change described in Chapter 1. The main programmes The field divides roughly by geography and by electrolyte choice. Table 4 summarises the programmes most often cited; the paragraphs that follow add the context the table cannot carry. Table 4. Selected solid-state battery programmes as of late 2026 (from company announcements and trade press; targets are the companies' own). Developer and partners Electrolyte approach Stage reached Stated production target Toyota with Idemitsu Kosan Sulfide, all-solid-state Pilot production; electrolyte plants under construction Vehicles in 2027–28 Samsung SDI with Solid Power and BMW Sulfide, all-solid-state Pilot line; BMW test vehicles Mass production from 2027 QuantumScape with PowerCo (Volkswagen) Oxide ceramic separator, anode-free, gel catholyte Eagle pilot line opened February 2026 Licensed production by partners Factorial with Mercedes-Benz and Stellantis Quasi-solid (FEST) and sulfide (Solstice) Road-tested vehicles 2025–26 Series production by end of decade CATL; BYD Sulfide, all-solid-state Pilot lines; small samples Small batches 2027; scale after 2030 WeLion, QingTao and others with Nio, SAIC Solid-liquid hybrid In production vehicles since 2024 Already commercial Japan Toyota has the largest solid-state patent portfolio in the world and has worked on sulfide electrolytes since the collaboration with Ryoji Kanno that produced LGPS. It has also missed more public targets than any other company, including an ambition to showcase solid-state cars around the Tokyo Olympics that produced only a single prototype vehicle, shown in a 2021 video. Its current plan, announced with Idemitsu Kosan in October 2023, targets the first vehicles with all-solid-state batteries in 2027 or 2028. Idemitsu's lithium sulfide and electrolyte plants, described in Chapter 5, are the most concrete evidence that the plan is real. Toyota has generally said that its first solid-state vehicles will be produced in limited numbers, and has talked about ranges around 1,000 kilometres and charging from 10 to 80 percent in about ten minutes, though such figures depend heavily on vehicle and pack design. Honda opened a demonstration production line for all-solid-state cells at its Sakura site in Tochigi Prefecture in January 2025, explicitly intended to test mass-production processes, including roll pressing of electrolyte layers [19]. Nissan has a pilot line in Yokohama and has targeted vehicles in its 2028 fiscal year. The Japanese approach is characterised by patience, deep materials expertise, and close integration between carmakers and chemical suppliers. Korea Samsung SDI, building on the Samsung Advanced Institute of Technology research described in Chapter 3, has targeted mass production of sulfide all-solid-state cells from 2027, initially aimed at premium vehicles, with a stated volumetric energy density goal around 900 watt-hours per litre. In October 2025 it announced a three-way collaboration with Solid Power, the Colorado company that supplies sulfide electrolyte, and BMW, in which Samsung SDI makes cells using Solid Power's electrolyte and BMW builds them into modules and test vehicles [20]. BMW had earlier announced, in May 2025, that it was testing a BMW i7 with large-format Solid Power cells. LG Energy Solution and SK On also have solid-state programmes, with SK On working with Solid Power on electrolyte. United States QuantumScape, founded in 2010 out of Stanford and backed by Volkswagen since 2012, has the most distinctive technology: an oxide ceramic separator, an anode-free negative electrode, and a gel catholyte. Its target product, the QSE-5, is a cell of about 5 amp-hours with an energy density above 840 watt-hours per litre and charging from 10 to 80 percent in about 12 minutes, according to the company. It began shipping B-samples to automotive customers in late 2024 and B1 samples, made with its Cobra separator process, in October 2025. In September 2025, the cells were shown powering a Ducati V21L electric racing motorcycle at the IAA Mobility show in Munich, the first public demonstration of QuantumScape cells in a vehicle. Its business model is licensing: PowerCo has rights to produce up to 40 gigawatt-hours a year, with an option on 80, and the company signed a joint development agreement with the Japanese ceramics manufacturer Murata in October 2025 to scale ceramic separator production [17]. QuantumScape's cells are not purely solid, because of the gel in the cathode. Their claim to novelty rests on the ceramic separator enabling an anode-free lithium metal cell, which is exactly the claim that matters by the argument of this book. Factorial Energy, based near Boston, has pursued two technologies. Its FEST cells are quasi-solid, using a polymer-based electrolyte, and paired with lithium metal anodes. In April 2025, Stellantis announced that it had validated 77 amp-hour FEST cells with an energy density of 375 watt-hours per kilogram, more than 600 cycles, and fast charging, and in June 2026 it began road testing them in Dodge Charger Daytona demonstration vehicles. Mercedes-Benz used Factorial lithium metal cells in a modified EQS that in September 2025 drove 1,205 kilometres from Stuttgart to Malmö in Sweden on one charge, arriving with 137 kilometres of range left [21]. Mercedes said the battery stored about 25 percent more energy than the standard EQS pack in similar weight and space, and that pneumatic actuators managed cell pressure as the cells changed volume. Mercedes has spoken of series production by the end of the decade. Factorial's all-solid-state sulfide technology, Solstice, is developed with Mercedes and targets higher energy density. Solid Power, besides its partnerships with BMW, Samsung SDI and SK On, has shifted its emphasis toward producing sulfide electrolyte for others rather than making cells itself, a sign of where it sees the most defensible value. Europe Europe's position is that of a strong customer and a weak manufacturer. Its carmakers, Mercedes-Benz, BMW, Volkswagen and Stellantis, are among the most active sponsors of solid-state development, but they rely on partners in the United States and Asia for the cells. The continent's attempt to build a domestic champion in conventional cells suffered a serious setback when the Swedish manufacturer Northvolt filed for bankruptcy in March 2025, a reminder of how hard it is to reach mature yields in battery manufacturing even with a known chemistry. European research is strong, particularly in Germany, where groups such as Jürgen Janek's at the University of Giessen have shaped the scientific understanding of solid-state interfaces, and in the United Kingdom, where the Faraday Institution has funded the Oxford work on dendrites described in Chapter 3. Blue Solutions in France continues to develop polymer-based lithium metal technology descended from the Bluecar batteries. The Taiwanese company ProLogium, which makes hybrid solid-state cells, announced plans for a large factory at Dunkirk in northern France. The pattern suggests that Europe's influence over the technology will run mainly through its carmakers' choice of partners and through research, unless the manufacturing gap can be closed. China China dominates conventional lithium-ion manufacturing, and its approach to solid-state has been characteristically pragmatic. Rather than wait for all-solid-state cells, Chinese companies commercialised hybrid solid-liquid cells first. The most visible example is Nio's 150 kilowatt-hour pack, using cells from WeLion New Energy with an energy density of about 360 watt-hours per kilogram, offered from 2024; in December 2023 Nio's chief executive drove an ET7 sedan fitted with the pack 1,044 kilometres on one charge in a live-streamed test. SAIC's IM Motors and MG brands have used hybrid cells from QingTao Energy. These cells are genuine engineering advances, but they remain hybrids, which is precisely why the national standard on terminology was written. For all-solid-state cells, the leaders have been more cautious in public than their Western and Japanese counterparts. CATL, the world's largest battery maker, has spoken of small-batch production of sulfide all-solid-state cells in 2027; a June 2026 industry analysis by Shanghai Metals Market placed CATL's programme at technology readiness level 4, laboratory prototypes verified but not yet engineering systems, with a pilot line in Yibin being commissioned and large-scale vehicle use unlikely before 2030 [22]. BYD has said similarly that it expects demonstration use around 2027 and large-scale use around 2030. The Chinese government has funded a national programme of all-solid-state research, reported in 2024 to total about six billion yuan across several companies. Given China's record of driving down costs in every battery chemistry it has adopted, its timeline for scale may matter more than anyone's timeline for the first car. How to read a solid-state claim The volume of announcements will only increase. A reader who wants to separate progress from promotion can ask nine questions, each of which follows from the mechanisms described in earlier chapters. Is the electrolyte entirely solid? If the cell contains liquid or gel anywhere, it is a hybrid. That is not disqualifying, but it changes which problems have been solved. What is the anode? A solid-state cell with a graphite or silicon-graphite anode cannot deliver the main energy density gain. Lithium metal or anode-free designs can. What is the cell size and format? Coin cells and single-layer cells of a few square centimetres can perform well because they contain few flaws. Multilayer cells of tens of amp-hours are the relevant test. What is the energy density, and is it gravimetric or volumetric, and for the cell or the pack? A headline figure without these qualifiers is not interpretable. What is the cathode loading? Thin cathodes make everything easier and deliver little energy. Loadings of 3 to 5 milliamp-hours per square centimetre are needed for automotive energy density. Under what pressure and temperature was the cell tested? Several megapascals or elevated temperatures make dendrite suppression much easier and may be impractical in a vehicle. How many cycles, at what charge and discharge rates, to what capacity retention? A thousand cycles at slow rates to 80 percent capacity is a common automotive benchmark; fast-charging cycle life is the harder test. How many cells were tested, and how consistent were they? A single champion cell proves possibility; statistics over hundreds prove manufacturability. What has been shown in a vehicle, and by whom? A carmaker's own test, with its own engineers and data, carries more weight than a supplier's description. It is instructive to apply the questions to two of the most publicised demonstrations of recent years. Take first Nio's 1,044-kilometre drive in December 2023. The electrolyte was not entirely solid: WeLion's cells are a solid-liquid hybrid. The anode was not lithium metal; the cells used a silicon-graphite composite anode, and their reported 360 watt-hours per kilogram came from an ultra-high-nickel cathode and careful engineering rather than from the lithium metal step change. The cells were large-format, multilayer automotive cells, a genuine strength, and Nio reported that cars fitted with the 150 kilowatt-hour pack weighed only about 20 kilograms more than those with its 100 kilowatt-hour pack, a real gain. Even so, the long drive reflected a very large battery as much as a new chemistry. The answer to the ninth question is strong, since the test was the carmaker's own and the pack was subsequently offered to customers. The verdict: a real and useful product, a hybrid, and not evidence that all-solid-state lithium metal cells are ready. Now take the Mercedes EQS drive of September 2025. The Factorial cells used a lithium metal anode, the feature that matters most. Whether the electrolyte was entirely solid was not made explicit in Mercedes's public description; the cells were associated with Factorial's quasi-solid technology, meaning some non-solid component is likely. They were multilayer automotive-format cells. The pack offered about 25 percent more energy in similar mass and volume to the standard EQS battery, a concrete pack-level figure. The use of pneumatic actuators confirms that cell pressure management was needed, a useful honest detail. And the test was run by the carmaker, which said series production was targeted by the end of the decade, not sooner. The verdict: strong evidence that lithium metal cells can now power a production-scale car over a long distance, with the questions of cycle life, cost and statistical reliability still open. Applied to the programmes above as a whole, these questions reveal a pattern. The cells that have been tested in vehicles are multilayer lithium metal cells, which is significant progress. Several of them are hybrids, using gels or polymers somewhere in the cell, and the purest all-solid-state sulfide cells remain at earlier stages of vehicle testing. Most published data still comes from tests at controlled temperatures, under pressure. And no one has yet shown statistical failure rates from a large fleet over several years, which is the evidence that will ultimately decide the question. The shape of the next five years The most likely course over 2027 to 2030 is a gradual, layered introduction. Hybrid solid-liquid cells will continue to spread, particularly in China, offering incremental gains in safety and energy density. The first all-solid-state cars will appear in small numbers in premium models from Toyota and possibly from Korean and German carmakers, at a price premium, and their main selling points will be fast charging and range. Production volumes will be limited by electrolyte supply, separator manufacturing and yield. Problems will surface in the field, as they always do with new battery chemistries, and their nature and frequency will shape how fast the second wave arrives. Meanwhile, conventional cells will keep improving. That competition is the subject of the next chapter, which asks what a solid-state cell actually changes for an electric car, once all the factors beyond the cell are counted. Chapter 7: What It Changes for the Car The electric car is the market that is paying for the solid-state battery, and it is the market in which the technology's advantages are most often overstated. The phrase "holy grail of electric vehicles" implies that a solid-state cell will transform the car: doubled range, five-minute charging, no fires, lower cost. Each of those claims contains something true. None survives intact once the cell is placed in a pack, the pack in a vehicle, and the vehicle in a market where conventional batteries keep getting better and cheaper. This chapter works through what actually changes. From cell to pack to vehicle A battery pack is more than its cells. It contains a structural enclosure that must survive crashes, cooling plates and coolant channels, thermal barriers between cells to stop a fire spreading, busbars and wiring, a battery management system that monitors every cell, and in some designs a separate module structure. The ratio of cell mass to pack mass has risen steadily as designers removed modules and integrated cells directly into the pack. Chinese "cell-to-pack" and "cell-to-body" designs have pushed the ratio for some packs well above 70 percent. Even so, a pack weighs substantially more than its cells, and a cell-level gain is diluted at the pack level. A worked example makes the effect concrete. Consider a large electric sedan with a 100 kilowatt-hour pack. With good conventional nickel-rich cells at 270 watt-hours per kilogram and a pack in which cells make up 70 percent of the mass, the pack weighs about 530 kilograms, of which about 370 kilograms are cells. Now substitute lithium metal solid-state cells at 400 watt-hours per kilogram. The cells weigh 250 kilograms. If the rest of the pack stayed the same, the pack would weigh about 410 kilograms, saving 120 kilograms. In practice some pack components would also shrink, because fewer cells need less structure and possibly less cooling, while others might grow, such as compression hardware to maintain cell pressure. A reasonable estimate is a saving of 100 to 150 kilograms, roughly 5 percent of the mass of a 2,400 kilogram car. What does that buy in range? The energy an electric car consumes per kilometre depends partly on mass, through rolling resistance and the energy spent accelerating, and partly on aerodynamic drag, which does not depend on mass at all. At motorway speeds, drag dominates. A 5 percent reduction in mass typically improves consumption by only 2 to 3 percent, because regenerative braking recovers much of the energy spent accelerating and drag is unchanged. Holding the battery capacity constant, the mass saving alone adds perhaps 15 to 20 kilometres to a 600 kilometre range. The real gain is volume. A car's battery lives in a flat tray under the floor, and the height of that tray is constrained by the car's design: a taller floor raises the seats, the roofline and the aerodynamic drag. If solid-state cells store 40 percent more energy per litre, and the pack's volumetric efficiency is similar, the same tray holds about 40 percent more energy. The 100 kilowatt-hour pack becomes a 140 kilowatt-hour pack of similar size and slightly higher mass. Range rises by something close to 40 percent, from 600 to around 830 kilometres in this example. Alternatively, the designer can keep the range and use a thinner pack, lowering the car and reducing drag, or fit a long-range battery into a smaller car that cannot currently accommodate one. This is the substance behind the Mercedes test drive: a pack of similar size and weight to the standard one, with about a quarter more energy. So the honest summary of the energy advantage is this. A successful lithium metal solid-state cell adds substantial range for the same size of battery, or allows the same range from a smaller battery. It does not double range, and it does not make cars dramatically lighter. Whether a 40 percent range improvement matters depends on whether range is still what buyers need. For many buyers in 2026 it is not: mass-market cars with 400 to 500 kilometres of range and fast-charging networks already meet most needs. For large vehicles, premium cars, pickups that tow, and regions with sparse charging, it does. Fast charging Fast charging is the advantage most emphasised by developers, and it rests on real physics. Chapter 1 explained that conventional cells must charge slowly when cold or nearly full to avoid lithium plating on graphite, and that liquid electrolytes develop concentration gradients during fast charging because they carry current mainly through anions. A solid-state cell with a lithium metal anode has no graphite on which lithium might accidentally plate, because plating lithium is what the anode is supposed to do. And a single-ion-conducting solid electrolyte does not develop concentration gradients. Both of the fundamental limits on fast charging in liquid cells are removed. They are replaced by other limits. The critical current density of the lithium–electrolyte interface, described in Chapter 3, sets a maximum safe charging rate, and that rate falls at low temperature. Cathode particles must still absorb lithium quickly enough, and the composite cathode's ionic pathways must keep up. Heat generated by fast charging must still be removed. The result is that solid-state cells can charge quickly, as QuantumScape's figure of 10 to 80 percent in about 12 minutes and Stellantis's road-test claims suggest, but that charging speed depends on temperature and on the health of the interfaces. Meanwhile, liquid cells have improved dramatically in fast charging. In 2025, BYD announced a charging platform rated at 1,000 kilowatts for some of its cars, claiming about 400 kilometres of range added in five minutes, and CATL has promoted lithium iron phosphate cells capable of very high charging rates. These achievements rely on careful cell design, thin electrodes and sophisticated thermal management, and they come with their own trade-offs, including grid connection requirements at charging sites that are themselves a constraint. They show that the charging-speed advantage of solid-state cells is relative rather than absolute. There is also an interaction between energy density and charging speed that is easy to miss. What a driver cares about is kilometres added per minute, not the rate at which the battery charges relative to its own size, which engineers express as a C-rate: 1C empties or fills a battery in an hour, 4C in fifteen minutes. Suppose a car uses 160 watt-hours per kilometre and the driver wants to add 400 kilometres in ten minutes. That requires 64 kilowatt-hours in a sixth of an hour, an average charging power of about 384 kilowatts. For a 100 kilowatt-hour pack, that is an average rate of nearly 4C, which is demanding for any chemistry. For a 140 kilowatt-hour pack of the same physical size, the same power is less than 3C. A battery with higher volumetric energy density therefore makes fast charging easier simply by being larger for the same space; each cell carries a smaller share of the current. This effect works in favour of solid-state cells, and it is one reason why developers' charging claims and carmakers' range claims should be read together. A solid-state car that charges in 12 minutes is a strong product; it is not uniquely so. Safety, cold and longevity The safety argument for solid electrolytes is intuitive: no flammable liquid, no fire. Reality is more complicated, and the most careful analysis to date reached a nuanced verdict. In 2022, Alex Bates and colleagues at Sandia National Laboratories published a thermodynamic analysis asking whether solid-state cells are actually safer than lithium-ion cells [23]. They found that some all-solid-state designs could release heat comparable to, or in some scenarios greater than, conventional cells during failure, because lithium metal is highly reactive, and because oxygen released by an overheated cathode can react with lithium metal or with a sulfide electrolyte. Lithium metal melts at about 180 degrees Celsius; molten lithium in contact with an oxygen-releasing cathode is a highly energetic combination. If a solid separator cracks and allows the cathode and anode to contact directly, the reaction can be violent. This does not mean solid-state cells are dangerous. It means their safety depends on design, not merely on the absence of liquid. A cell that never lets the cathode and anode meet, whose separator does not crack under mechanical abuse, and whose cathode is chosen with thermal stability in mind can be very safe. Hybrid cells retain some flammable liquid, though less. Sulfide cells raise the specific concern of hydrogen sulfide release if a damaged cell meets moisture, which first responders and recyclers would need to manage. Oxide cells avoid that but carry the brittleness risk. The practical safety benefit is likely to come at the pack level. If solid-state cells are much less likely to ignite or propagate a fire from cell to cell, designers can reduce the thermal barriers and fire protection in the pack, recovering some mass and volume. That benefit depends on extensive abuse testing, including nail penetration, crushing, overcharging and external heating, of the specific cell design, and on regulators and insurers accepting the results. It will take years of data before carmakers strip safety features from packs on the strength of solid electrolytes. Electric car owners in cold climates know that range falls and charging slows in winter. Solid electrolytes help in one respect: the inorganic electrolytes do not freeze or thicken as liquids do, and QuantumScape has reported cell operation down to about minus 30 degrees Celsius. But the lithium metal interface becomes more vulnerable at low temperature, because lithium creeps more slowly and the critical current densities for both plating and stripping fall. Cold-weather fast charging is therefore a hard test for any solid-state design, and one in which pre-heating the pack, already standard in modern electric cars, will remain important. Longevity is the area of greatest uncertainty. Conventional lithium-ion packs have proved more durable than early sceptics expected, with many cars retaining over 80 percent of capacity after 200,000 kilometres or more. For solid-state cells to match this, the interfaces described in Chapters 3 and 4 must remain intact for 1,000 to 2,000 full cycles, and over calendar time of 10 to 15 years, under real conditions of temperature, vibration, partial cycling and long parking. Accelerated laboratory tests give guidance, but the industry learned from earlier lithium-ion chemistries that some failure modes appear only in the field. The first generation of solid-state cars will, in effect, be the long-term test. The competition The single most important fact about the market for solid-state batteries is that it is not empty. Conventional lithium-ion technology keeps improving, and several alternatives target the same benefits. Lithium iron phosphate cells have become the default for mass-market electric cars in China and increasingly elsewhere. They store less energy than nickel-rich cells, but they are cheaper, longer-lived, and much less prone to thermal runaway. Cell-to-pack designs have narrowed their pack-level disadvantage, and their prices are the benchmark that every new chemistry must justify itself against. Sodium-ion cells, which avoid lithium entirely, entered commercial vehicles in China in the mid-2020s, targeting the low-cost end of the market. Silicon-rich anodes in liquid cells offer a share of the lithium metal energy gain without the dendrite problem; the company Amprius, for example, launched cells at 450 watt-hours per kilogram for aviation and drone markets in 2025, though at costs and cycle lives suited to niche rather than mass-market use [24]. High-voltage, high-nickel and manganese-rich cathodes, together with improved liquid electrolytes, continue to raise conventional energy density step by step. The consequence is that solid-state cells will compete first where their advantages are greatest and price matters least. That means premium cars where long range and fast charging carry high value, and vehicles where volume is severely constrained. It is no coincidence that the first road demonstrations used a luxury sedan, a high-performance muscle car, a flagship BMW and a racing motorcycle. As costs fall, the technology may move down-market, but it will meet lithium iron phosphate and sodium-ion cells there, competing on cost per kilowatt-hour, which is not where solid-state cells are strongest. It is also worth remembering that solid-state batteries already exist as commercial products, just not in cars. Japanese component makers including TDK, Murata and Maxell sell small all-solid-state cells, some based on oxide electrolytes and some on sulfides, for wearables, sensors, backup power on circuit boards and industrial equipment. These cells store tiny amounts of energy, but they exploit the safety and temperature tolerance of solid electrolytes in settings where a leaking or swelling liquid cell would be unacceptable, such as inside equipment that must survive soldering temperatures or operate for years in a factory. Their existence is a useful reminder that the technology's first commercial value lay in reliability rather than energy density, and that the step to automotive scale is a step in size and cost, not a leap from nothing. Between these tiny cells and the car lie intermediate markets that may adopt solid-state cells sooner than mass-market vehicles. Premium motorcycles, where space for a battery is extremely limited and buyers pay for performance, are one; QuantumScape's choice of a Ducati racing motorcycle for its first public vehicle demonstration was not accidental. Consumer electronics are another, though phone makers are notoriously price-sensitive and the thin, flexible cells they need are a poor match for brittle ceramics. Heavy trucks, by contrast, are a weak early market despite their large batteries, because truck operators buy on lifetime cost per kilometre and prize cycle life and durability, the attributes in which solid-state cells are least proven. The likely sequence is set by willingness to pay a premium for energy per litre: niche and premium uses first, mainstream cars later if costs fall, and fleets that buy on cost only when the technology is fully mature. Putting these considerations together, the solid-state battery is best understood not as a holy grail for electric cars but as a significant upgrade for a subset of them. If lithium metal solid-state cells succeed at scale, they will allow premium electric cars to offer around 30 to 50 percent more range from the same battery space, fast charging comparable to the best liquid cells, and possibly simpler, lighter packs. Those are substantial gains, and they will matter for vehicle categories that current batteries serve poorly. They will not by themselves change the economics of mainstream electric cars, which are being driven by cheap, durable, conventional chemistries. There is, however, one application where the energy density gain is not merely useful but necessary, where a 40 percent improvement is the difference between impossible and possible, and where conventional chemistries have no comparable path. That application is flight. Chapter 8: The Energy Needed to Fly A car carries its battery along the ground. An aircraft must hold its battery up in the air for every second of the flight, and the energy needed to do so rises with every kilogram. This simple difference makes aviation the most unforgiving application for batteries and the one where the energy density gains promised by solid-state cells matter most. It also makes it the application where the limits of those gains are clearest. This chapter explains why, using the basic physics of flight, and then asks which kinds of electric aircraft a successful solid-state battery would make practical. The range equation The range of an aircraft in steady cruise can be estimated from an equation first written down by the French engineer Louis Breguet in the early twentieth century for fuel-burning aircraft. Its electric version is simpler, because a battery does not get lighter as it discharges. The range equals the battery's specific energy, multiplied by the efficiency of the electric drivetrain and propeller, multiplied by the aircraft's lift-to-drag ratio, multiplied by the fraction of the aircraft's total mass that is battery, all divided by the acceleration of gravity. Each term has a physical meaning. Specific energy is how many joules each kilogram of battery stores. Drivetrain efficiency is the fraction of that energy that ends up as useful thrust; electric motors, inverters and propellers together achieve perhaps 70 to 80 percent. The lift-to-drag ratio measures aerodynamic quality: how many kilograms the wing can hold up for each kilogram-force of drag it creates; a modern regional aircraft achieves around 15, a high-performance glider over 40. The battery mass fraction is the share of the aircraft's take-off weight that the designer can devote to batteries, after accounting for structure, motors, systems, crew and payload; a practical upper limit is around 30 to 40 percent. A worked example shows what these numbers imply. Take a battery pack at 250 watt-hours per kilogram, which is roughly the best of today's high-quality lithium-ion packs for aircraft once the safety containment required in aviation is included. Converted to joules, that is 900,000 joules per kilogram. Assume a drivetrain efficiency of 75 percent, a lift-to-drag ratio of 15, and a battery fraction of 30 percent. Multiply: 900,000 times 0.75 times 15 times 0.3 gives about 3 million. Divide by 9.81 and the result is about 310,000 metres, or 310 kilometres. That is the theoretical range in still air, with the battery drained to empty, ignoring the energy needed to take off and climb. Real operations must hold reserves. Under typical rules for flight under instrument conditions, an aircraft must be able to fly to its destination, then to an alternate airport, then hold for 30 to 45 minutes. For an aircraft cruising at 300 to 400 kilometres per hour, a 45-minute reserve alone consumes 225 to 300 kilometres of range. Batteries are also not drained to zero in practice, both to protect them and because their power falls as they empty. The 310 kilometres of theoretical range becomes something closer to 100 kilometres of useful commercial range, perhaps less. Now double the specific energy to 500 watt-hours per kilogram at the pack level. Theoretical range doubles to about 620 kilometres. But the reserves are fixed in time, not proportional to range, so useful range more than triples, to perhaps 300 to 350 kilometres. This non-linearity is the key to understanding aviation. Below a certain specific energy, electric aircraft are almost useless commercially, because reserves consume nearly everything. Above it, they rapidly become useful for short routes. The threshold lies uncomfortably close to where the best batteries are. Jet fuel stores about 43 megajoules per kilogram, roughly 12,000 watt-hours per kilogram. A gas turbine converts perhaps 35 to 40 percent of this into useful work, so the effective energy delivered is around 4,000 to 5,000 watt-hours per kilogram of fuel. An electric drivetrain is about twice as efficient, but a battery pack at 250 watt-hours per kilogram delivers perhaps 190 watt-hours per kilogram of useful work. The gap is a factor of twenty or more. Fuel has a second advantage that is easy to overlook. A fuel-burning aircraft becomes lighter as it flies, so the end of a long flight costs less energy than the beginning. For long-range aircraft, fuel can account for 40 percent or more of take-off weight, and the aircraft lands far lighter than it took off. A battery aircraft lands as heavy as it took off, which also means its landing gear and structure must be designed for a full-weight landing. These numbers explain why no plausible battery will power a long-haul airliner. They also explain why the specific energy that serious studies say is needed for different kinds of aircraft rises so steeply with size and range. Table 5 summarises the requirements identified in the research literature. Table 5. Indicative battery requirements for electric aircraft classes (pack-level specific energy; drawn from NASA studies and Viswanathan et al., 2022). Aircraft class Typical seats and mission Approximate pack specific energy needed Status in 2026 Light trainer 2 seats; short local flights About 200 Wh/kg or less Certified (Pipistrel Velis Electro, 2020) eVTOL air taxi 2–6 seats; urban trips under 100 km About 250–400 Wh/kg, with high power In certification Commuter 9–19 seats; 200–400 km About 400–500 Wh/kg Programmes paused or turned hybrid Regional 50–90 seats; up to about 800 km About 600–750 Wh/kg Beyond current batteries Narrow-body airliner 150+ seats; 1,000 km or more About 800 Wh/kg and above Beyond any lithium-ion-class battery The NASA figures, widely cited, suggest about 400 watt-hours per kilogram for general aviation and about 750 for regional aircraft; Venkat Viswanathan and colleagues, in a 2022 review in Nature, estimated around 600 watt-hours per kilogram for regional aircraft and about 800 for narrow-body airliners, noting that these are pack-level figures that must also be delivered with high power, long cycle life and aviation-grade safety [25]. Andreas Schäfer and colleagues, in a 2019 analysis in Nature Energy, reached a compatible conclusion: even assuming pack specific energies around 800 watt-hours per kilogram, far above anything then available, battery-electric aircraft could serve only the shorter end of the regional market [26]. The fate of the first electric airliners The commercial history of electric aviation over 2020 to 2026 illustrates the threshold vividly. Small electric training aircraft work. The Slovenian Pipistrel Velis Electro became the first fully electric aircraft to receive type certification from the European Union Aviation Safety Agency in 2020; it flies for under an hour, which is enough for training circuits. Electric vertical take-off and landing aircraft, intended as air taxis over short urban distances, are in advanced certification in the United States and elsewhere, with companies such as Joby Aviation and Archer Aviation using high-quality lithium-ion cells and accepting short ranges and limited reserves in exchange for quiet, zero-emission operation. Larger electric aircraft have struggled. Eviation, an Israeli-American company, flew its nine-passenger Alice prototype in September 2022 and attracted orders from regional airlines. In early 2025 it paused development of the aircraft and laid off much of its staff while seeking new funding [27]. The Swedish company Heart Aerospace, which originally planned a 19-seat all-electric airliner, redesigned it as the 30-seat ES-30, a hybrid with batteries for an all-electric range of about 200 kilometres and turbo-generators to extend range further. Both decisions reflect the same arithmetic: at today's battery specific energy, an all-electric commuter aircraft cannot carry enough passengers far enough with legal reserves to make an airline business case. What solid-state cells would change Where would a successful lithium metal solid-state battery place aviation on Table 5? Cells in development target 400 to 500 watt-hours per kilogram at the cell level. Aircraft packs carry heavier overheads than car packs, because they need fire containment, crashworthiness and redundancy to meet certification standards such as RTCA DO-311A for rechargeable lithium batteries. If pack-level efficiency is around 75 to 80 percent, solid-state cells would yield packs of roughly 300 to 400 watt-hours per kilogram. That is a meaningful step. It would give eVTOL aircraft comfortable reserves and longer routes, turning them from short-hop novelties into more flexible regional services. It would extend the endurance of trainers and small utility aircraft. It would bring the commuter class, 9 to 19 seats on routes of 200 to 400 kilometres, to the edge of viability, especially in hybrid configurations where batteries carry the cruise and a small engine or fuel cell provides reserves. That is exactly the market Heart and Eviation targeted. A worked example shows how close to the edge the commuter class sits. Under United States certification rules, a commuter aircraft is limited to 19 passenger seats and a maximum take-off weight of 19,000 pounds, about 8,600 kilograms. Give such an aircraft a battery fraction of 30 percent, about 2,580 kilograms, and assume a solid-state pack at 350 watt-hours per kilogram. The pack stores about 900 kilowatt-hours. With the same efficiency and lift-to-drag assumptions as before, the theoretical cruise range is about 430 kilometres. Hold back a 45-minute reserve at a cruise speed of 300 kilometres per hour, which consumes about 225 kilometres of equivalent range, and allow for the extra energy of take-off and climb and for a margin of charge that is never used, and the practical stage length falls to roughly 150 kilometres. That is enough for some island hops and short coastal routes, and not much more. The arithmetic changes if the reserve need not come from the battery. A hybrid design that carries a small turbine generator, or a fuel cell, to supply the reserve and the diversion to an alternate airport frees the whole battery for the planned trip. The same 900 kilowatt-hour pack then supports routes approaching 300 to 350 kilometres flown entirely on electricity in normal operation, with fuel burnt only in the rare event of a diversion. This is the logic behind Heart Aerospace's turn to hybrid design, and it suggests that solid-state cells would first earn their place in aviation as the battery half of a hybrid system rather than as the sole energy source. A lithium metal solid-state battery would not, however, reach the regional class, and it would come nowhere near the narrow-body class. Those require 600 to 800 watt-hours per kilogram or more at the pack, which implies cells approaching 1,000 watt-hours per kilogram. Lithium metal with a conventional intercalation cathode, solid-state or not, cannot get there, because the cathode itself sets an upper bound. A nickel-rich layered oxide with a lithium metal anode has a ceiling, counting only the active materials, in the region of 700 watt-hours per kilogram; once current collectors, electrolyte, separator and casing are added, practical cells reach well under that. Reaching aviation's higher thresholds requires a different cathode chemistry, such as sulfur or oxygen, whose theoretical energy densities are much higher but whose practical development is far less mature. This is where solid electrolytes may play a second, less publicised role. Lithium–sulfur cells, which pair lithium metal with a sulfur cathode, have a theoretical specific energy of over 2,500 watt-hours per kilogram for the active materials and practical cells in development at 400 to 500. Their main problem in liquid electrolytes is that intermediate sulfur compounds dissolve and shuttle between the electrodes, causing rapid capacity loss. A solid electrolyte eliminates the shuttle. All-solid-state lithium–sulfur is an active research area, and if it succeeds, it could open a path toward aviation's higher thresholds. Lithium–air, with even higher theoretical energy, remains further away. Both depend on the same lithium metal anode, and thus on the same interface science that this book has described. Specific energy is not the only requirement. An eVTOL aircraft needs very high power during take-off and landing, the landing coming at the end of the flight when the battery is nearly empty and its voltage is lowest. Discharge strips lithium from the anode, and Chapter 3 explained that stripping at high rates creates voids at the interface, which can seed dendrites on the next charge. A battery for a vertical-lift aircraft must therefore deliver high power precisely when a lithium metal interface is most vulnerable. Air taxis may also fly many short flights a day, accumulating thousands of cycles a year, which places heavy demands on cycle life. Safety is the third requirement, and it is decisive. An aircraft cannot pull over. Certification authorities require that a cell failure must not propagate to neighbouring cells or threaten the aircraft, and demonstrating this involves extensive testing of thermal runaway and its containment. The potential safety advantage of solid electrolytes, discussed in Chapter 7, could matter more in aviation than in any other application: if solid-state cells are much less likely to propagate a failure, the containment mass in the pack can shrink, raising pack-level specific energy further. But aviation authorities will demand extensive evidence before accepting this, and the Sandia analysis of lithium metal reactivity shows why caution is justified. The realistic aviation outcome Putting this together gives a clear, if modest, picture. Solid-state lithium metal batteries, if they succeed in cars over the next five years, will be adapted for aviation, where their premium cost matters less than in cars because energy density is worth so much more. They will make urban air mobility more practical, strengthen the case for electric and hybrid-electric commuter aircraft on short routes, and help small aircraft such as trainers and utility planes. They will not electrify regional or mainline aviation, which will depend for decarbonisation mainly on sustainable aviation fuels, and possibly on hydrogen, for the foreseeable future. That conclusion is not a disappointment. Short-haul routes of a few hundred kilometres, flown by small aircraft, are a real market, particularly in regions such as Scandinavia, Scotland's islands, northern Canada and archipelagos where geography makes surface travel slow. Electric aircraft could serve those routes with lower operating costs, less noise and no direct emissions. And the jump from one class to the next is non-linear: each gain in specific energy unlocks a disproportionate increase in useful range once reserves are covered. The solid-state battery is not the technology that will electrify the airliner. It may well be the technology that makes the small electric airliner a business. Conclusion The solid-state battery has been described for so long as a single breakthrough waiting to happen that it is easy to miss what the evidence of the past decade actually shows. There was no single breakthrough, and there will not be one. There was a materials discovery, solid electrolytes with liquid-like conductivity, that removed the first obstacle around 2011. There followed a decade of slower, harder work on interfaces: understanding why lithium cracks ceramics, why voids open during discharge, why cathode particles lose contact, why electrolytes decompose against charged cathodes, and how to engineer around each of these. And there is now a period, which began around 2024 and will run to the end of the decade, in which the question is whether all of that engineering can be reproduced at the speed, yield and cost of a modern battery factory. Each stage has been necessary. None has been sufficient on its own. Several consequences follow from treating the technology this way. The first is that the right measure of progress is not a headline energy density but evidence about interfaces at scale. A cell's energy density is largely determined by the decision to use lithium metal; any competent lithium metal cell will claim figures in the range of 350 to 450 watt-hours per kilogram and 800 to 1,000 watt-hours per litre. What distinguishes a product from a prototype is whether those numbers survive a thousand fast-charging cycles at modest pressure and real temperatures, and whether the rate of dendrite-induced failure across millions of cells is low enough for a carmaker's warranty. The data that settle these questions will come from pilot lines and test fleets, not from press releases. Those who follow the field, whether as engineers, investors or policymakers, should ask for cycle life at stated pressure and temperature, failure statistics over many cells, and cathode loadings, and should discount claims that omit them. The second consequence is that the competitive landscape will be decided by manufacturing capability as much as by chemistry. The companies with the strongest prospects are not necessarily those with the best laboratory cells but those that control the hardest manufacturing steps: the production of flawless thin separators, the supply of electrolyte at scale and low cost, and the dry, pressurised assembly processes that sulfide cells require. This is why electrolyte suppliers such as Idemitsu, ceramic specialists such as Murata, and established cell makers such as Samsung SDI and CATL matter so much to the outcome, and why licensing models and partnerships have become so common. It is also why China, with its unmatched depth in battery manufacturing, should be expected to scale solid-state cells quickly once the technology is ready, even if its first all-solid-state products arrive after those of Japanese and Korean rivals. The third consequence concerns expectations for the electric car. The solid-state battery will not be a holy grail in the sense of transforming the economics of mainstream electric vehicles. Those economics are being transformed already, by cheap and durable lithium iron phosphate cells, by sodium-ion cells at the low end, and by relentless improvements in pack design and charging. What lithium metal solid-state cells offer is a substantial gain in energy per litre for vehicles that need it: more range in the same space, or the same range in a smaller and lighter car, together with fast charging and the prospect of simpler, safer packs. That is a valuable segment, and it is likely to be where the first generation of solid-state cells finds its market. Policymakers who see solid-state batteries as the key to mass electrification are looking in the wrong place; mass electrification is being won with conventional chemistries now. The fourth consequence concerns aviation, and it is the most important for anyone thinking about the long term. In cars, solid-state cells improve a technology that already works. In aviation, they move the boundary of what is possible. The physics of flight makes energy per kilogram the decisive variable, and the need for fixed reserves makes the relationship between specific energy and useful range sharply non-linear. A pack at 350 watt-hours per kilogram, which a successful solid-state cell could deliver, makes commuter and air-taxi aircraft genuinely practical, especially as part of hybrid systems. It does not make regional or narrow-body electric aircraft possible, and no lithium metal battery with a conventional cathode will. Decarbonising the bulk of aviation will depend on fuels, not batteries, for decades. Aviation planners should treat solid-state batteries as enabling a new class of short-range air service, not as a replacement for jet engines. A fifth consequence follows from the interface-centred view itself. The scientific foundations laid by solid-state research, in particular the understanding of how lithium metal behaves against solids, are prerequisites for chemistries that go further. Lithium–sulfur cells, which could reach energy densities that aviation needs for larger aircraft, depend on a stable lithium metal anode and benefit from a solid electrolyte that stops the shuttling of dissolved sulfur. Lithium–air cells depend on the same anode. The work now going into separators, interlayers and pressure management for car batteries is therefore building the foundation for the next generation of storage as well. Research funding that treats solid-state batteries narrowly as an automotive product, rather than as a platform for lithium metal electrochemistry, risks missing this larger value. Finally, the story offers a broader lesson about how energy technologies mature. The liquid electrolyte in a lithium-ion cell was doing far more than its designers asked of it: filling pores, maintaining contact, forming self-healing films, tolerating imperfection. Replacing it required each of those functions to be rebuilt deliberately, with dedicated materials and mechanisms. This pattern is common. New technologies often appear simpler than the ones they replace, until the hidden work of the old technology is discovered. Solid-state batteries look set to deliver real value in the coming decade, but they will do so as a more engineered battery, not a simpler one. The companies and countries that succeed will be those that understood this early and invested in the interfaces, the factories and the patience the problem demands. Notes [1] The Royal Swedish Academy of Sciences, "Lithium-ion batteries," Scientific Background on the Nobel Prize in Chemistry 2019, awarded to John B. Goodenough, M. Stanley Whittingham and Akira Yoshino. The document traces the development from Whittingham's titanium disulfide cell at Exxon to Sony's commercial cell of 1991. [2] M. N. Obrovac and V. L. Chevrier, "Alloy negative electrodes for Li-ion batteries," Chemical Reviews 114 (2014), 11444–11502. Source of the standard capacity and volume-change values for graphite, silicon and lithium. [3] Ramaswamy Murugan, Venkataraman Thangadurai and Werner Weppner, "Fast lithium ion conduction in garnet-type Li7La3Zr2O12," Angewandte Chemie International Edition 46 (2007), 7778–7781. [4] Noriaki Kamaya, Kenji Homma, Yuichiro Yamakawa and colleagues, "A lithium superionic conductor," Nature Materials 10 (2011), 682–686. [5] Yuki Kato, Satoshi Hori, Toshiya Saito and colleagues, "High-power all-solid-state batteries using sulfide superionic conductors," Nature Energy 1 (2016), 16030. [6] Narumi Ohta, Kazunori Takada, Isao Sakaguchi and colleagues, "LiNbO3-coated LiCoO2 as cathode material for all solid-state lithium secondary batteries," Electrochemistry Communications 9 (2007), 1486–1490. [7] Tetsuya Asano, Akihiro Sakai, Satoru Ouchi and colleagues, "Solid halide electrolytes with high lithium-ion conductivity for application in 4 V class bulk-type all-solid-state batteries," Advanced Materials 30 (2018), 1803075. [8] J. B. Bates, N. J. Dudney, G. R. Gruzalski and colleagues, "Electrical properties of amorphous lithium electrolyte thin films," Solid State Ionics 53–56 (1992), 647–654. [9] Jürgen Janek and Wolfgang G. Zeier, "A solid future for battery development," Nature Energy 1 (2016), 16141; and the same authors' follow-up, "Challenges in speeding up solid-state battery development," Nature Energy 8 (2023), 230–240. [10] Charles Monroe and John Newman, "The impact of elastic deformation on deposition kinetics at lithium/polymer interfaces," Journal of The Electrochemical Society 152 (2005), A396–A404. [11] Lukas Porz, Tushar Swamy, Brian W. Sheldon and colleagues, "Mechanism of lithium metal penetration through inorganic solid electrolytes," Advanced Energy Materials 7 (2017), 1701003. [12] Ziyang Ning, Dominic Spencer Jolly, Guanchen Li and colleagues, "Visualizing plating-induced cracking in lithium-anode solid-electrolyte cells," Nature Materials 20 (2021), 1121–1129. [13] Fudong Han, Andrew S. Westover, Jie Yue and colleagues, "High electronic conductivity as the origin of lithium dendrite formation within solid electrolytes," Nature Energy 4 (2019), 187–196. [14] Jitti Kasemchainan, Stefanie Zekoll, Dominic Spencer Jolly and colleagues, "Critical stripping current leads to dendrite formation on plating in lithium anode solid electrolyte cells," Nature Materials 18 (2019), 1105–1111. [15] Yong-Gun Lee, Satoshi Fujiki, Changhoon Jung and colleagues, "High-energy long-cycling all-solid-state lithium metal batteries enabled by silver–carbon composite anodes," Nature Energy 5 (2020), 299–308. [16] Idemitsu Kosan announcements on lithium sulfide and solid electrolyte production for all-solid-state batteries, as reported by Shanghai Metals Market (SMM), early 2026: lithium sulfide plant under construction from February 2025 with 1,000 tonnes annual capacity due June 2027; solid electrolyte pilot plant construction begun January 2026. [17] QuantumScape Corporation, shareholder letters and announcements 2024–2026, covering the PowerCo licensing agreement (July 2024), B-sample and B1-sample shipments (October 2024 and October 2025), the Cobra separator process, the Ducati V21L demonstration at IAA Mobility (September 2025), the joint development agreement with Murata Manufacturing (October 2025) and the Eagle Line inauguration (February 2026). QSE-5 specifications as reported by electrive.com, 10 December 2025. [18] TechNode, "China to release country's first national standard for EV solid-state batteries in July," 11 February 2026; CarNewsChina, report on renaming semi-solid-state batteries as solid-liquid batteries, 28 October 2025. [19] Honda Motor Co., announcement of the demonstration production line for all-solid-state batteries at Sakura, Tochigi Prefecture, operations from January 2025; reported by S&P Global Mobility AutoTechInsight. [20] electrive.com, "Samsung SDI, Solid Power, and BMW to collaborate on solid-state batteries," 31 October 2025. [21] Mercedes-Benz Group, press release on the EQS test vehicle with lithium metal solid-state battery cells from Factorial Energy, September 2025, describing the 1,205-kilometre drive from Stuttgart to Malmö with 137 kilometres of remaining range. [22] Shanghai Metals Market (SMM), "CATL all-solid-state battery: from TRL-4 to small-batch production in 2027?", industry analysis, June 2026. [23] Alex M. Bates, Yuliya Preger, Loraine Torres-Castro and colleagues, "Are solid-state batteries safer than lithium-ion batteries?" Joule 6 (2022), 742–755. [24] Amprius Technologies, announcement of the SiCore 450 Wh/kg cell for aviation applications, 2025. [25] Venkatasubramanian Viswanathan, Alan H. Epstein, Yet-Ming Chiang and colleagues, "The challenges and opportunities of battery-powered flight," Nature 601 (2022), 519–525. [26] Andreas W. Schäfer, Steven R. H. Barrett, Khan Doyme and colleagues, "Technological, economic and environmental prospects of all-electric aircraft," Nature Energy 4 (2019), 160–166. [27] Aviation International News, "Eviation pauses Alice electric aircraft while seeking new investors," 18 February 2025. Glossary Anode-free cell. A lithium metal cell assembled with no lithium on the negative side; the anode forms when lithium from the cathode plates onto the current collector during the first charge. Area-specific resistance. The resistance of a layer per unit area, equal to its thickness divided by its conductivity; multiplied by current density it gives the voltage lost across the layer. Catholyte. Electrolyte mixed into the cathode to carry lithium ions to active particles throughout the electrode's thickness. Coulombic efficiency. The fraction of lithium (or charge) put into a cell on charging that is recovered on discharge; values above 99.9 percent are needed for long life in cells without excess lithium. Critical current density. The current per unit area above which lithium penetrates a solid electrolyte and short-circuits the cell under stated test conditions. Dendrite. A filament or needle of lithium metal that grows during plating; in a solid-state cell, lithium that propagates through cracks, pores or grain boundaries of the electrolyte. Interphase. A thin layer of reaction products that forms where an electrolyte meets an electrode; it can protect the interface if it conducts ions but not electrons. Lithium plating. Deposition of metallic lithium; desirable at a lithium metal anode, harmful on graphite, where it occurs if a conventional cell is charged too fast or too cold. Semi-solid (solid-liquid hybrid) cell. A cell containing both solid electrolyte and some liquid or gel electrolyte; China's 2026 terminology standard classifies these separately from all-solid-state cells. Specific energy. Energy stored per unit mass, in watt-hours per kilogram; distinct from energy density per unit volume, in watt-hours per litre. Stack pressure. External pressure applied to a cell to keep its solid layers in contact, usually expressed in megapascals. Transference number. The fraction of electrolyte current carried by lithium ions; about one-third in typical liquid electrolytes and close to one in most inorganic solid electrolytes. Further Reading Seth Fletcher, Bottled Lightning: Superbatteries, Electric Cars, and the New Lithium Economy (Hill and Wang, 2011).** A readable history of the lithium-ion battery and the people behind it, including the early failures of lithium metal cells that still shape the industry's caution. Steve LeVine, The Powerhouse: Inside the Invention of a Battery to Save the World (Viking, 2015).** An account of the race to build better batteries at Argonne National Laboratory and in start-ups, valuable for its candid picture of how hard it is to turn a laboratory result into a commercial cell. Jürgen Janek and Wolfgang G. Zeier, "A solid future for battery development," Nature Energy 1 (2016), and "Challenges in speeding up solid-state battery development," Nature Energy 8 (2023).** Two authoritative perspectives by leading researchers, the first setting out the promise of solid-state cells and the second a sober account of why progress has been slower than hoped. Theodosios Famprikis, Pieremanuele Canepa, James A. Dawson, M. Saiful Islam and Christian Masquelier, "Fundamentals of inorganic solid-state electrolytes for batteries," Nature Materials 18 (2019), 1278–1291.** A thorough technical review of how ions move in solids and how the main electrolyte families compare; demanding but rewarding for readers with some chemistry. Lukas Porz and colleagues, "Mechanism of lithium metal penetration through inorganic solid electrolytes," Advanced Energy Materials (2017), and Jitti Kasemchainan and colleagues, "Critical stripping current leads to dendrite formation on plating in lithium anode solid electrolyte cells," Nature Materials (2019).** The two papers that, between them, best explain why hard ceramics fail against soft lithium. Alex M. Bates and colleagues, "Are solid-state batteries safer than lithium-ion batteries?" Joule 6 (2022).** A careful, quantitative challenge to the assumption that removing the liquid makes a cell safe. Venkatasubramanian Viswanathan and colleagues, "The challenges and opportunities of battery-powered flight," Nature 601 (2022).** The clearest single treatment of what electric aviation demands of batteries, covering specific energy, power, cycle life and safety for each class of aircraft. Andreas W. Schäfer and colleagues, "Technological, economic and environmental prospects of all-electric aircraft," Nature Energy 4 (2019).** A systems analysis that links battery specific energy to the share of the aviation market electric aircraft could serve, with costs and emissions. Hashtags: #SolidStateBatteries #SolidStateBatteryTechnology #MaterialsScience #NextGenerationBatteries #EnergyStorage #AdvancedEnergyStorage #BatteryInnovation #BatteryTechnology #LithiumIonBatteries #LithiumMetalBatteries #SolidElectrolytes #SolidStateElectrolytes #Electrochemistry #BatteryMaterials #IonConductivity #LithiumDendrites #DendriteSuppression #BatteryInterfaces #InterfaceEngineering #OxideElectrolytes #SulfideElectrolytes #HalideElectrolytes #PolymerElectrolytes #AnodeFreeBatteries #EnergyDensity #FastChargingTechnology #BatterySafety #BatteryManufacturing #ElectricVehicles #SustainableEnergy

Download the Book (PDF): Introduction In the spring of 2023 a group at Stanford released a model called Alpaca. It was a seven-billion-parameter language model, small by the standards of the time, and its creators claimed that in their own informal tests it behaved much like one of OpenAI's far larger instruction-following systems. What made the release notable was not the model but the recipe. The team had started with 175 hand-written example tasks, asked a commercial model to invent tens of thousands more in the same spirit, used those invented examples to fine-tune an openly available base model, and reported spending less than six hundred dollars on the whole exercise. No annotators were hired. No users were surveyed. The training data had been manufactured. Within weeks there were dozens of imitators. Within a year the practice had moved from academic curiosity to industrial default. By mid-2024 NVIDIA reported that more than ninety-eight percent of the data it used to align its Nemotron-4 340B model had been generated synthetically. Google DeepMind's AlphaGeometry, which solved olympiad geometry problems at close to the level of a gold medallist, had been trained without a single human-written proof; its hundred million training examples were produced by a symbolic engine. Microsoft's Phi models built their reputations on "textbook quality" material written largely by other models. Synthetic data had become something the field could no longer treat as a workaround. That shift happened for reasons that are easy to state. The supply of high-quality human text is finite, and the largest training runs are approaching the point where they consume most of what is publicly available. Much of the data that would be most valuable for specialised systems — medical records, financial transactions, legal case files, private conversations — is locked behind privacy law, contractual obligation, or simple decency. And some of the situations a model most needs to handle are rare by nature: the unusual tumour, the fraudulent transaction pattern nobody has seen before, the pedestrian stepping out from behind a parked bus at dusk. Waiting for reality to produce enough examples of rare events is not a strategy. Manufacturing them is. The argument of this book The ease of manufacture is precisely the problem. A large language model can produce a million plausible-looking training examples in an afternoon. It can produce a million plausible-looking wrong ones just as fast, and the two sets will be hard to tell apart by inspection. Generated text carries the generator's blind spots, its stylistic tics, its confident errors, and its tendency to drift toward the bland middle of whatever distribution it learned. Train a model on that output without discrimination and the model inherits all of it. Repeat the process across generations and, as a much-cited 2024 study in Nature demonstrated, the resulting models progressively forget the rare and the unusual until their outputs collapse toward a narrow, distorted average. The controlling claim of this book follows from that tension. In a synthetic data system, generation is the cheap part; the architecture is the verifier. The value of a synthetic dataset is set almost entirely by the quality of the machinery that decides which generated examples to keep, how they are ordered, and how their effect is measured against something real. A strong generator paired with a weak filter produces a large, polluted dataset. A modest generator paired with a rigorous verifier — a unit test, a proof checker, a well-calibrated grader, a held-out set of genuine examples — can produce data good enough to train models that outperform their teachers on narrow tasks. This is not a novel observation in the research literature, but it is routinely neglected in practice, partly because generation is the visible and exciting step and verification is tedious. The chapters that follow try to correct that imbalance by treating synthetic data as an engineering discipline with three equally important stages: generating candidate data, filtering it, and validating that the filtered result actually does what it was meant to do. What the book covers The first two chapters establish why synthetic data matters and where it came from. Chapter 1 sets out the constraints that drive the practice — the exhaustion of public text, the legal and ethical limits on sensitive data, and the statistical problem of rare events — and is careful to separate the constraints that synthetic data genuinely relaxes from those it merely appears to. Chapter 2 traces the lineage from statistical disclosure control and classical data augmentation through simulation and generative adversarial networks to the language-model-generated corpora that dominate current practice, and proposes a working taxonomy of the different things people mean by "synthetic data." Chapter 3 deals directly with privacy, because that is where the most consequential misunderstandings occur. Synthetic data is often described as anonymous by construction. It is not, and the chapter explains how generators memorise and leak, what differential privacy does and does not guarantee, and how to reason about the trade-off between fidelity and protection. Chapters 4 and 5 turn to generation itself. Chapter 4 examines the machinery of producing varied, useful candidates: seed design, personas, instruction evolution, and the persistent problem of diversity collapse, in which a generator keeps producing the same few kinds of example no matter how it is prompted. Chapter 5 addresses curriculum — the deliberate ordering and grading of synthetic examples by difficulty — and argues that the most powerful curricula are those in which the model's own performance determines what gets generated next. Chapters 6 and 7 form the core of the argument. Chapter 6 is about automated grading: the spectrum of verifiers from exact execution checks through learned reward models to language models acting as judges, and the systematic biases each one introduces. Chapter 7 applies that machinery to the specific problem of filtering harmful and hallucinated content — the factual errors, toxic outputs, and subtle contamination that synthetic pipelines generate at scale. Chapters 8 and 9 concern the most commercially important use of synthetic data: transferring capability from a large, expensive teacher model to a small, cheap student. Chapter 8 explains distillation as a technique and its known limits, including the finding that students often learn to imitate a teacher's style long before they acquire its competence. Chapter 9 works through the construction of a small domain model in practical detail, from seed collection to deployment. Chapter 10 confronts the long-run risk: what happens when synthetic data trains models whose output becomes the next round of synthetic data, and when the open web itself fills with machine-generated text. Chapter 11 closes the technical arc with validation and governance — how to establish that a synthetic dataset works, how to document its provenance, and how to make the whole pipeline auditable. Who this is for The book is written for engineers, data scientists, technical managers, and policy readers who need to understand how synthetic data systems are actually built and where they fail. It assumes familiarity with the idea of training a machine learning model on examples, but not specialist knowledge of any particular architecture. Terms are defined as they arise, and a glossary at the end collects the ones that recur. The examples lean toward language models because that is where synthetic data practice has moved fastest and where the stakes are currently highest. But the principles — that a generator is only as trustworthy as its verifier, that diversity must be engineered rather than hoped for, that real data remains the anchor against which everything is measured — apply equally to tabular data, images, robotics simulation, and scientific modelling. Where those domains offer clearer illustrations, the book uses them. One caution before beginning. Synthetic data is a field in which confident claims age quickly. Techniques that seemed decisive in one year have been qualified or overturned in the next, and the empirical evidence on many questions — how much synthetic data can safely replace real data, how much a student can learn from a teacher, how quickly recursive training degrades — remains thinner than practitioners would like. The book tries to be explicit about where the evidence is solid and where it is still forming. The underlying engineering logic, however, has held steady throughout: generate freely, discard ruthlessly, and measure against reality. Chapter 1. The Data Wall and What Synthetic Data Can Actually Move Every machine learning system is a compression of its training data. The model learns whatever regularities the examples contain and nothing they do not. For most of the history of the field, the binding constraint on what a model could learn was the model itself: its size, its architecture, the compute available to train it. Data was assumed to be abundant, or at least obtainable with enough effort and money. That assumption has broken down in three different ways, and synthetic data is a response to all three. Understanding them separately matters, because synthetic data addresses each one with very different effectiveness. The exhaustion of public text The first constraint is quantity. Large language models improved dramatically between 2018 and 2024 largely by being trained on more text. Scaling studies, most influentially the 2022 "Chinchilla" analysis from DeepMind, showed that for a fixed compute budget, the best results came from balancing model size against the number of training tokens, and that many earlier models had been undertrained relative to their size. The practical consequence was a hunger for tokens that outran the growth of the web. Researchers at Epoch AI have tried to quantify how close the field is to running out. Their analysis, first released in 2022 and revised for presentation at the International Conference on Machine Learning in 2024, estimated the effective stock of quality-adjusted, publicly available human-generated text at roughly three hundred trillion tokens. Projecting the growth of training-set sizes forward, they concluded that if current trends continue, frontier models would be trained on datasets roughly equal to that entire stock at some point between 2026 and 2032, with the exact date depending on how aggressively models are over-trained relative to compute-optimal recipes. The estimate carries wide uncertainty — it depends on how much text sits on the deep web, how much low-quality text can be rescued by filtering, and how many times the same data can be reused before returns diminish — but the direction is not in serious dispute. Several qualifications are worth keeping in mind. First, exhaustion of public text is not the same as exhaustion of information. There is a great deal of private text in emails, corporate documents, and messaging platforms, and a great deal of non-textual data in video, audio, and sensor streams. Whether and how that material can be used is a legal and ethical question rather than a technical one. Second, data can be repeated. Studies of multi-epoch training have found that a model can be trained on the same data several times with only modest loss of value per pass, though returns fall off as repetition increases. Third, and most important for this book, the constraint applies with greatest force to frontier pretraining. A company building a small model for customer support in insurance is not limited by the size of the web. It is limited by the number of good examples of insurance customer support it has, which is a different problem entirely. Synthetic data as a remedy for the exhaustion of public text is therefore a contested proposition. It is unclear whether a model can generate text that contains genuinely new information beyond what its own training data held. A language model sampling from its learned distribution produces samples from that distribution; it does not, by itself, add knowledge about the world. What synthetic data can do in this setting is restructure existing knowledge into more learnable forms — rewriting dense web pages as clear explanations, converting facts into question-and-answer pairs, generating worked solutions to problems whose answers can be checked. The gains from this kind of restructuring are real and have been demonstrated repeatedly. But they come from the restructuring and the checking, not from the volume. Where the synthetic data adds information that was not already present, it does so because something outside the generator — a code interpreter, a theorem prover, a physics simulator, a human — introduced it. Privacy and the locked rooms of data The second constraint is access. The data that would be most valuable for many applications is precisely the data that cannot be freely shared. Electronic health records contain the richest available description of disease progression and treatment response. Bank transaction logs encode the patterns of fraud. Customer service transcripts show exactly how real people describe their problems. Each of these is subject to legal restriction, and the restrictions are tightening rather than loosening. In the European Union, the General Data Protection Regulation governs any processing of personal data, defined broadly as information relating to an identified or identifiable natural person. Recital 26 of the regulation states that its principles do not apply to anonymous information — data that does not relate to an identifiable person, or that has been rendered anonymous in such a way that the individual is no longer identifiable. That carve-out is the legal hook on which much of the commercial interest in synthetic data hangs: if synthetic records are genuinely anonymous, they fall outside the regulation and can be shared, sold, and used for training with far fewer obligations. In the United States, the Health Insurance Portability and Accountability Act sets out two routes to de-identification for health data — a "safe harbor" list of eighteen identifier types to remove, and an "expert determination" route in which a qualified statistician certifies that the risk of re-identification is very small. Synthetic health data is typically pursued through the second route. The EU's Artificial Intelligence Act, which entered into force in 2024, adds a further layer. Its provisions on data governance for high-risk systems permit the processing of special categories of personal data for the purpose of detecting and correcting bias, but only where that purpose cannot be effectively fulfilled by processing other data, explicitly including synthetic or anonymised data. In effect, the law nudges developers toward synthetic alternatives before it permits use of sensitive real data. The appeal is obvious. If a hospital could train a generator on its patient records and release synthetic patients that preserved the statistical structure of the originals without corresponding to any real person, researchers everywhere could study them freely. The difficulty, examined at length in Chapter 3, is that "without corresponding to any real person" is much harder to guarantee than it sounds. Generators memorise. Rare records are the easiest to memorise and the easiest to re-identify. And the statistical structure that makes synthetic data useful is the same structure an attacker exploits to make inferences about individuals. Synthetic data relaxes the privacy constraint only when it is built with formal protections, and those protections always cost fidelity. The tyranny of the long tail The third constraint is distribution. Even where data is plentiful and accessible, the examples that matter most are often the rarest. A self-driving system sees millions of hours of ordinary highway driving and very few instances of a child chasing a ball into the road. A medical imaging model sees thousands of normal chest radiographs for every one showing a rare pathology. A fraud detector sees overwhelmingly legitimate transactions. A customer service model sees the same twenty questions asked in slightly different words, and almost never the strange edge case that will produce a viral complaint. This is the problem that synthetic data addresses most convincingly, and it has a long history. Simulation has been used to train and test autonomous vehicles for years; Waymo, among others, has reported running billions of miles in simulation, far more than its physical fleet has driven, precisely so that it can rehearse rare and dangerous scenarios on demand. In robotics, OpenAI's work on training a robot hand to manipulate a Rubik's cube relied on randomising simulated physics — friction, object size, lighting, motor response — so extensively that the real world appeared to the policy as just another variation. In medical imaging, researchers have used generative models to produce additional examples of under-represented conditions to rebalance training sets. The logic of synthetic data for the long tail is different from the logic for quantity or privacy. Here the aim is not to replace real data but to reshape its distribution: to make rare cases common enough that a model learns to handle them. That shift changes what must be verified. A synthetic rare event is valuable only if it is a faithful instance of the rare event, and the generator's ability to produce faithful rare events is usually weakest exactly where the real data is thinnest. A generative model trained on a hundred examples of a rare tumour will produce variations on those hundred, not genuinely novel presentations. A simulator built by engineers who did not anticipate a particular failure mode will not produce it. The long tail is where synthetic data is most needed and where its fidelity is hardest to establish. Scarcity at the level of the task The three constraints so far are framed at the level of a whole field. Most practitioners meet them in a narrower form: the data they need for one task does not exist in useful quantity. Two cases illustrate how common this is. The first is language. The bulk of the text available for training is in English and a small number of other widely written languages. Thousands of languages have very little digitised text, and even languages with tens of millions of speakers may have only a sliver of the web's content, much of it machine-translated or of low quality. A team building a customer service model for speakers of such a language cannot simply collect more examples. Synthetic data generated by translating, adapting, or writing directly in the target language is one of the few options, and it inherits every weakness of the generator's competence in that language. Errors of idiom, register, and cultural reference that a native speaker would catch at once can pass unnoticed through automated filters built mainly for English. The second is specialised labelling. Many valuable tasks require annotation that only experts can provide: identifying the relevant clauses in a commercial lease, grading the severity of a finding on a pathology slide, judging whether a piece of code contains a security vulnerability. Expert time is expensive and limited, and the number of labelled examples available for such tasks is often in the hundreds rather than the hundreds of thousands. Here synthetic data is attractive because a capable model can produce candidate labels or candidate examples cheaply, but its reliability is weakest exactly where expertise is most needed. A general-purpose model that produces plausible-looking lease annotations will also produce plausible-looking wrong ones, and only an expert can tell them apart. Both cases show the same pattern. Synthetic data is most tempting where real data is scarcest, and in those places the generator is usually least reliable, because its own training data was scarce there too. Whatever is gained by generation must be paid for with stronger verification. What actually moves Taken together, these three constraints define what synthetic data can and cannot do. It is useful to be precise. Synthetic data can restructure information that already exists, presenting it in forms that are easier to learn. This is the mechanism behind the success of "textbook" style corpora, question-and-answer reformulations, and step-by-step worked solutions. The information content of the training set does not increase, but its learnability does, and for a finite model trained for a finite time, learnability is often what matters. Synthetic data can inject information from an external source of truth. When a generated program is run and its output checked, or a generated proof is verified by a formal checker, or a simulated physical scenario is computed by a physics engine, the verified example carries information that the generator alone did not possess. The checker is doing the epistemic work. This is the most powerful use of synthetic data and the one on which its most impressive results rest. Synthetic data can transfer capability from one model to another. A large, capable model generates examples; a smaller model learns from them. The smaller model ends up knowing things it would not otherwise have learned from its own limited training. No new information enters the world, but it moves to where it is cheaper to use. Synthetic data can reshape distributions, oversampling rare conditions and undersampling common ones, as long as the generator can produce credible instances of the rare conditions. And synthetic data can, under the right formal mechanisms, release statistical structure while limiting what is revealed about individuals. What synthetic data cannot do is create knowledge from nothing. A generator with no access to an external check cannot reliably produce correct facts that it did not already know, and if it produces them anyway, they will be indistinguishable from the incorrect facts it produces alongside them. Every synthetic data system therefore needs some source of ground truth outside the generator: a verifier, a simulator, a human judgement, or a body of real data against which the synthetic data is evaluated. The engineering of that ground truth is the main subject of this book. The cost structure has inverted One further change explains why synthetic data has become central rather than peripheral. For most of the history of machine learning, labelled data was expensive and computation was relatively cheap. Hiring annotators to label images or transcribe speech or rate responses cost real money per example, and scaling up meant scaling the workforce. The rise of capable generative models has inverted this. Generating a candidate example now costs a fraction of a cent. Labelling it by hand still costs what it always did. This inversion shifts the economics of every stage of the pipeline. Where once the question was how to make the most of a small, expensive labelled set, the question is now how to extract a small, trustworthy subset from a large, cheap, unreliable one. That is a filtering problem rather than a collection problem, and filtering problems reward a different set of skills: designing tests, calibrating graders, detecting subtle failure modes, and measuring the downstream effect of each filtering decision. Teams that approach synthetic data with the habits of the old regime — generate a lot, train on all of it, hope for the best — reliably get worse results than teams that treat the generator as a source of candidates and spend most of their effort on deciding which candidates deserve to survive. The same inversion changes where human expertise belongs. In the old regime, experts were needed at the point of labelling. In the new one, they are needed at the point of designing the verifier: writing the test cases, specifying the rubric, choosing the held-out evaluation set, and reading samples of the filtered output to catch failure modes no automated check anticipated. An hour of a domain expert's time spent designing a good verifier can be worth more than a hundred hours spent labelling, because the verifier applies that expertise to millions of examples. This is the most practical lesson in the book, and every chapter that follows returns to it in some form. Chapter 2. A Lineage of Artificial Data The phrase "synthetic data" is used to describe things that have little in common beyond being manufactured rather than collected. A rotated photograph added to an image classifier's training set is synthetic data. So is a table of fictitious census respondents generated to protect privacy, a simulated car crash rendered by a game engine, a fabricated fraud transaction produced by a generative adversarial network, and a million maths problems with worked solutions written by a large language model. Each of these has its own history, its own failure modes, and its own standard of validity. Treating them as a single category obscures more than it reveals. This chapter traces the main lineages and then offers a working taxonomy that the rest of the book relies on. Disclosure control: synthetic data as a privacy technology The oldest formal use of synthetic data comes from official statistics. National statistical agencies collect detailed information about individuals and businesses under legal promises of confidentiality, and they have long faced the problem of releasing useful data without breaking those promises. Traditional techniques — suppressing small cells in tables, coarsening geographic detail, swapping values between similar records, adding noise — all degrade the data in ways that are hard for downstream analysts to account for. In 1993 the statistician Donald Rubin proposed a different approach. Drawing on his earlier work on multiple imputation for missing data, he suggested that an agency could treat the confidential values of every respondent as if they were missing, fit a statistical model to the real data, and release multiple datasets in which every confidential value had been replaced by a draw from that model. Analysts could then apply standard methods to each released dataset and combine the results using rules that properly accounted for the added uncertainty. In the same year Roderick Little proposed a partial version, in which only the most sensitive variables or records were replaced. These proposals launched a substantial literature on what came to be called fully and partially synthetic data. The ideas reached production in the following decades. The United States Census Bureau released synthetic versions of linked survey and administrative data, and its OnTheMap application, which shows where people live and work, became in 2008 one of the first production systems to use a formal differential privacy guarantee for synthetic data. The 2020 United States Census applied differential privacy to its published tables, a decision that generated heated debate among demographers about the accuracy cost. The statistical-agency tradition contributes two lasting lessons to modern practice. First, synthetic data must be judged by whether analyses performed on it give the same answers as analyses on the real data — a property usually called utility or fidelity. Second, privacy protection is a quantity to be measured and traded against utility, not a binary property that synthetic data has by default. Augmentation: synthetic data as regularisation A second lineage comes from computer vision and speech. Practitioners training image classifiers noticed early that randomly flipping, cropping, rotating, and colour-shifting their training images improved generalisation. The transformed images were still recognisably the same object, so their labels were still correct, but the model was forced to learn features robust to those transformations. The landmark 2012 AlexNet paper used random crops and horizontal reflections alongside colour perturbation, and data augmentation has been standard practice ever since. Augmentation is the most conservative form of synthetic data. Each synthetic example is a deterministic or lightly randomised transformation of a real one, and the transformation is chosen precisely because it preserves the label. The validity check is built in: a flipped cat is still a cat. Later techniques pushed further. Mixup, introduced in 2017, trains on convex combinations of pairs of images and their labels — a blend of seventy percent dog and thirty percent cat with a correspondingly mixed label. In text, back-translation, in which a sentence is translated into another language and back again to produce a paraphrase, became a standard way to augment machine translation and classification data. For tabular data with imbalanced classes, the Synthetic Minority Over-sampling Technique, known as SMOTE and published by Chawla and colleagues in 2002, generates new minority-class examples by interpolating between existing minority examples and their nearest neighbours. SMOTE is still widely used in credit scoring and medical prediction, and it illustrates both the promise and the danger of augmentation. Interpolating between two real fraud cases produces something that looks like fraud, but it may also produce combinations of features that no real fraud case would ever have, and in high dimensions the interpolated points can fall in regions of feature space that belong to the majority class. The augmentation lineage contributes the idea that synthetic data can encode an inductive bias — a prior belief about what transformations should not matter — and that a well-chosen transformation teaches the model something true about the world. Simulation: synthetic data from first principles A third lineage comes from robotics, autonomous vehicles, and scientific computing. Here the synthetic data is produced not by a statistical model of real data but by a model of the physical process itself. A physics engine computes how a robot arm moves when its motors apply certain torques. A rendering engine computes how a scene looks from a particular camera under particular lighting. A molecular dynamics simulation computes how a protein folds. The appeal of simulation is that it can produce unlimited, perfectly labelled data. Every pixel in a rendered image comes with exact depth, exact object identity, exact surface normal. Every simulated crash comes with exact forces. The difficulty is the "reality gap": a model trained in simulation learns the simulator's quirks, and the simulator is never a perfect replica of the world. Textures are too clean, physics is too deterministic, sensor noise is unrealistic. The most influential response to the reality gap was domain randomisation, developed by Josh Tobin and colleagues at OpenAI and Berkeley in 2017. Rather than trying to make the simulator more realistic, they made it less consistent: randomising textures, colours, lighting, camera positions, and object shapes so widely that a model trained across all of these variations treated the real world as one more variation. Their object-detection models, trained only on crudely rendered images with random textures, transferred to real camera images well enough to guide a robot grasping objects. OpenAI's later Rubik's cube work extended the idea with "automatic domain randomisation," which progressively widened the range of randomisation as the policy improved — an early instance of the adaptive curricula discussed in Chapter 5. Simulation contributes the most important idea in this book: synthetic data is most trustworthy when it is produced by a process whose correctness can be established independently of the data. A physics engine encodes known laws. A theorem prover encodes logical rules. A code interpreter encodes the semantics of a programming language. When these are the source of truth, the synthetic data inherits their reliability. Deep generative models: learning to synthesise A fourth lineage arose with deep generative models, beginning with variational autoencoders in 2013 and generative adversarial networks, introduced by Ian Goodfellow and colleagues in 2014. These models learn a distribution from data and can sample new instances from it. For the first time, it was possible to produce realistic synthetic images, and later audio and tabular records, without hand-specifying a simulator. Generative adversarial networks were quickly applied to tabular data for privacy and augmentation. The CTGAN model, published by Lei Xu and colleagues in 2019, adapted the adversarial framework to the mixed continuous and categorical columns of typical relational tables, using mode-specific normalisation for continuous variables with several peaks and a conditional generator to handle imbalanced categories. A commercial industry formed around such tools, selling synthetic versions of customer and patient databases. Diffusion models, which became dominant for image generation from around 2021, extended the reach of learned generators. In medical imaging, researchers have used them to produce synthetic scans of rare conditions. In autonomous driving, they are used alongside or in place of traditional rendering to generate realistic sensor data. The lesson from this lineage is double-edged. Learned generators can capture complex distributions no human could specify by hand, but they also capture whatever artefacts, biases, and individual records exist in their training data, and they offer no independent guarantee of correctness. A diffusion model that produces a realistic chest radiograph has not checked that the radiograph is anatomically coherent. Language models as generators The fifth and most recent lineage is the use of large language models to write training data for other language models, and for themselves. Several papers in 2022 and 2023 mark the transition. Self-Instruct, from Yizhong Wang and colleagues in 2022, showed that a pretrained language model could bootstrap its own instruction-following ability. Starting from 175 human-written seed tasks, the method prompted the model to generate new instructions, then inputs and outputs for those instructions, filtered the results for quality and novelty, and used the survivors to fine-tune the same model. The result was around 52,000 instructions. Unnatural Instructions, published by Or Honovich and colleagues around the same time, did something similar. Stanford's Alpaca, described in the Introduction, applied the Self-Instruct recipe with a stronger commercial model as generator. In 2023 Ronen Eldan and Yuanzhi Li at Microsoft published TinyStories, a dataset of short children's stories written by GPT-3.5 and GPT-4 using only words a young child would understand. They showed that models with fewer than ten million parameters, trained on this corpus, could produce fluent, grammatical, and coherent stories — something much larger models trained on raw web text struggled to do. The same year, Suriya Gunasekar and colleagues published "Textbooks Are All You Need," describing phi-1, a 1.3-billion-parameter code model trained on a mixture of filtered web data and synthetic textbook-style material generated by GPT-3.5. It reached around fifty percent on the HumanEval coding benchmark, a level then associated with models many times larger. By 2024 synthetic data had become a standard component of frontier training. Model technical reports routinely described synthetic pipelines for mathematics, code, reasoning, and alignment data. Hugging Face released Cosmopedia, an open synthetic corpus of textbooks, blog posts, and stories totalling around twenty-five billion tokens. Reasoning models released in 2024 and 2025 relied heavily on synthetic chains of thought, generated by sampling many candidate solutions and keeping those that reached verified correct answers. A working taxonomy These lineages suggest a taxonomy organised not by the type of data — image, text, table — but by the source of truth that stands behind each synthetic example. That source determines what can go wrong and what kind of verification is needed. Table 1 summarises five broad families. Table 1. Families of synthetic data, classified by source of truth. Family Source of truth Typical examples Characteristic failure Natural verifier Transformation The original real example plus an invariance assumption Image flips and crops, back-translation, SMOTE Transformation breaks the label or creates impossible combinations Checks that the label is preserved Simulation An explicit model of a physical or formal process Rendered driving scenes, physics rollouts, proof search Reality gap between simulator and world Comparison against real-world measurements Statistical synthesis A model fitted to private real records Synthetic census microdata, synthetic patient tables Leakage of individual records; loss of rare structure Utility and privacy metrics against the real data Learned generation A neural generator trained on large corpora Diffusion images, model-written instructions and stories Hallucination, bias, homogenisation Automated graders, filters, human review Verified generation A learned generator coupled to an external checker Executed code, checked maths answers, formally verified proofs Verifier too narrow or exploitable The checker itself, plus audit of the checker The categories overlap in practice. A modern pipeline for training a coding model might use learned generation to propose problems, verified generation to keep only solutions that pass tests, and transformation to paraphrase problem statements. But the taxonomy makes one thing clear. As one moves down the table from transformation to learned generation, the generator becomes more powerful and more general, and the built-in guarantee of correctness disappears. The final row, verified generation, is the attempt to recover the guarantee by attaching an external check to a powerful generator. Most of the significant recent advances in synthetic data fall into that final row, and most of the engineering effort described in the rest of this book is concerned with building, calibrating, and auditing the checkers that make it possible. What the lineages agree on Despite their differences, the five traditions converge on a small set of principles. Synthetic data must be evaluated by its effect on downstream tasks performed on real data, not by how realistic it looks. Its value depends on what independent knowledge was injected during its creation, whether that knowledge is a physical law, a privacy budget, a label-preserving invariance, or a verification test. And it carries the properties of its generator — including the generator's errors — unless something intervenes to remove them. The statisticians knew this in 1993. The roboticists rediscovered it in 2017. The language model community has been learning it, at considerable expense, since 2023. Chapter 3. Privacy Without Illusions The most common commercial pitch for synthetic data runs roughly as follows. Your real data contains personal information and cannot be shared. Train a generator on it, sample new records from the generator, and those records will have the same statistical properties as the originals but will not correspond to any real person. Because they are not personal data, you can use them freely. The pitch is attractive because it seems to dissolve a hard trade-off. It is also, in its simple form, wrong. Synthetic data can be a powerful privacy technology, but only when it is engineered with formal protections whose cost is accepted openly. Without them, synthetic data can leak as much as the original, and sometimes it leaks in ways that are harder to detect. Why "no real person" is not enough The intuition behind the pitch is that a synthetic record is a new draw from a learned distribution, not a copy of a real one. If the generator has learned the distribution well, its samples will look like typical members of the population rather than like any particular individual. But generators do not learn distributions in the abstract. They learn from finite samples, and a sufficiently flexible generator can learn the sample itself. The phenomenon is memorisation, and it has been documented across every class of generative model. In 2021 Nicholas Carlini and colleagues showed that they could extract hundreds of verbatim training sequences from GPT-2, including names, phone numbers, email addresses, and code, simply by sampling from the model and ranking the outputs by how confident the model was in them. In 2023 a related group showed that image diffusion models, including Stable Diffusion, could be induced to regenerate near-identical copies of some of their training images. Memorisation is concentrated in examples that are duplicated in the training data and, in tabular settings, in records that are statistical outliers — exactly the records that are easiest to re-identify. Tabular synthetic data has its own version of the problem. Consider a hospital dataset in which one patient is a 97-year-old man with an unusual combination of diagnoses living in a small rural district. A generator that faithfully reproduces the joint distribution of age, sex, diagnosis, and location will produce, with some probability, a synthetic record that matches this person on every attribute. Nobody need have copied his record for the synthetic version to reveal that someone with those characteristics exists in the source data, and that may be enough to reveal his diagnosis to anyone who knows the other attributes. The vulnerability is structural. Synthetic data is useful precisely because it preserves the relationships between variables in the real data. An attacker exploits those same relationships to make inferences. The better the synthetic data captures rare correlations, the more it reveals about the rare individuals who produced them. How privacy attacks work Privacy researchers formalise the risks through several kinds of attack, each corresponding to a different harm. A membership inference attack tries to determine whether a particular individual's record was used to train the generator. Even if the synthetic data reveals nothing new about that person, learning that they were in a dataset of patients with a particular disease, or of customers of a debt collection agency, can itself be harmful. Membership inference typically works by comparing how closely the synthetic data, or the generator, fits a target record relative to how it fits similar records known to be outside the training set. An attribute inference attack assumes the attacker already knows some of a target's attributes — age, postcode, sex — and tries to infer a sensitive one, such as diagnosis or income. The attacker trains a predictor on the synthetic data and applies it to the known attributes. If the synthetic data has preserved the real correlations closely, the inference will be accurate. Note that this attack may succeed even against a perfectly non-memorising generator, because it exploits population-level patterns; whether that constitutes a privacy breach or merely statistical knowledge is a genuinely contested question in the field. A linkage or singling-out attack tries to find a synthetic record that matches a real individual closely enough to be considered a reconstruction. This is closest to the colloquial idea of re-identification, and it is the attack most directly addressed by legal definitions of anonymity. The European Data Protection Board's predecessor, the Article 29 Working Party, identified singling out, linkability, and inference as the three risks an anonymisation technique must address. In 2022 Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso published an evaluation pointedly titled "Synthetic Data — Anonymisation Groundhog Day." Testing several popular generators against these attacks, they found that synthetic data without formal privacy guarantees did not provide a better trade-off between privacy and utility than traditional anonymisation methods, that protection varied unpredictably across records, and that outliers in particular remained highly vulnerable. Generators that produced the most useful synthetic data tended also to produce the most vulnerable. The paper's conclusion was not that synthetic data is useless for privacy, but that it inherits the same fundamental trade-off as every other disclosure-control method and cannot be assumed to escape it. Differential privacy as the formal answer The only widely accepted formal framework for privacy protection in synthetic data is differential privacy, introduced by Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith in 2006. The core idea is simple to state. A randomised algorithm is differentially private if its output distribution changes very little when any single individual's record is added to or removed from its input. If that holds, then nothing an observer learns from the output can depend very much on any one person's data, because the output would have been nearly as likely without them. The strength of the guarantee is controlled by a parameter, conventionally written epsilon. Smaller epsilon means stronger privacy. An epsilon close to zero means the output is almost independent of any individual; an epsilon of ten or more offers a much weaker guarantee in theory, though it may still defeat practical attacks. There is no universally agreed threshold for acceptable epsilon. The United States Census Bureau's 2020 redistricting data used a total privacy-loss budget that was the subject of extended public debate. Industry deployments have used values ranging from below one to well above ten. Differential privacy has three properties that make it especially suitable for synthetic data. It is robust to post-processing: anything computed from a differentially private output is also differentially private with the same epsilon, so once a generator has been trained privately, any amount of sampling from it costs no further privacy. It composes: the privacy losses from several private computations add up in a predictable way, allowing a total budget to be managed. And it makes no assumptions about what the attacker already knows, which is precisely what heuristic anonymisation methods cannot claim. There are two main routes to differentially private synthetic data. The first is to train a neural generator with differentially private stochastic gradient descent, introduced by Martín Abadi and colleagues in 2016. This method clips each individual example's contribution to the gradient, so no single record can move the model too far, and adds calibrated noise to the aggregated gradient at each step. DP-SGD can be applied to any neural generator, including language models, but it degrades model quality, and the degradation is severe for small datasets and large models. The second route, which has proved more effective for tabular data, is to measure a set of low-dimensional statistics of the real data — one-way and two-way or three-way marginal distributions, for example — with differentially private noise, and then to generate synthetic records consistent with those noisy statistics. Methods of this kind, built on graphical models that stitch noisy marginals into a coherent joint distribution, performed strongly in the differential privacy synthetic data competitions run by the United States National Institute of Standards and Technology from 2018 onward. Their weakness is that they preserve only the relationships captured by the chosen marginals. Higher-order interactions not explicitly measured are lost. For text, the frontier is the use of differentially private fine-tuning of language models to produce synthetic corpora, and the alternative of "private evolution" approaches in which a public model generates candidates and a private dataset is consulted only through noisy votes about which candidates resemble it. These remain active research areas, and the utility achievable at strong privacy levels is still limited for complex text. Utility, fidelity, and the shape of the trade-off Every privacy mechanism costs utility, and the costs are not evenly distributed. Differential privacy works by making the output insensitive to any individual, which means it necessarily blurs patterns that depend on few individuals. Rare diseases, small demographic groups, and unusual combinations of attributes are exactly what get lost. This creates an uncomfortable tension with fairness goals: a privately generated synthetic dataset may represent minority groups less accurately than the real data did, and models trained on it may perform worse for those groups. Evaluating the trade-off requires measuring both sides. On the utility side, practitioners typically report several kinds of measure. Marginal fidelity compares the distribution of each variable, and of pairs of variables, between real and synthetic data. Machine learning efficacy, sometimes called "train on synthetic, test on real," trains a predictive model on the synthetic data and evaluates it on held-out real data, comparing its performance to a model trained on real data. Query-specific utility checks whether particular analyses of interest — a regression coefficient, a subgroup prevalence, a survival curve — give the same answers on both datasets. The last of these is the most demanding and most informative, because synthetic data that looks good on average can still give misleading answers to the specific questions an analyst cares about. On the privacy side, the measures depend on whether a formal guarantee exists. With differential privacy, the epsilon value itself is the headline measure, though it should be reported alongside the related parameter delta and the details of how the budget was allocated. Without a formal guarantee, practitioners fall back on empirical measures: the distance from each synthetic record to its closest real record, the success rate of simulated membership and attribute inference attacks, and the proportion of synthetic records that exactly or nearly match a real one. These empirical measures are useful for detecting gross failures but cannot prove the absence of risk, because they test only the attacks the evaluator thought to run. Table 2 sets out the main approaches and what each one does and does not protect against. Table 2. Privacy approaches for synthetic data and what they guarantee. Approach Formal guarantee Main protection Main weakness Typical utility cost Unprotected generator None Avoids exact copying in most cases Memorises outliers and duplicates Low Heuristic post-filtering (remove close matches) None Removes near-copies of real records Does not stop attribute or membership inference Low to moderate DP-SGD trained generator Differential privacy Bounds influence of any one record Large quality loss on small or complex data Moderate to high Noisy-marginal synthesis Differential privacy Bounds influence; strong for tabular data Loses unmeasured higher-order relationships Moderate Synthetic data plus restricted access Contractual and procedural Limits who can attack Depends on enforcement Low Practical guidance Several practical conclusions follow from the evidence. First, decide what the synthetic data is for before choosing how to protect it. Synthetic data intended for software testing, where it needs only to have the right schema and plausible value ranges, can be generated with very strong privacy at little cost because high fidelity is not required. Synthetic data intended for training a clinical prediction model, where subtle correlations matter, faces a much harsher trade-off. Synthetic data intended for public release faces the strongest attack model and needs the strongest guarantee. Second, do not rely on the label "synthetic" as a legal shield. Data protection authorities assess anonymity by asking whether individuals can reasonably be identified, taking into account all the means likely to be used. A synthetic dataset that permits re-identification of outliers is not anonymous in that sense, whatever process produced it. A formal differential privacy guarantee with a defensible epsilon, combined with documented empirical attack testing, is a far stronger position than an assertion that the records are new. Third, deduplicate the training data before training a generator. Memorisation is strongly concentrated in duplicated examples, and removing duplicates is cheap insurance. Fourth, treat outliers as a design decision. They are both the most vulnerable records and often the most informative. Options include suppressing them, coarsening their attributes before training, or accepting that a privacy-protected synthetic dataset will not represent them well and planning downstream analyses accordingly. Fifth, evaluate utility on the analyses that will actually be performed. A synthetic dataset that reproduces every marginal distribution beautifully but gets the key subgroup effect wrong is worse than useless, because it will be trusted. Finally, recognise that synthetic data is one tool among several. Federated learning, in which models are trained where the data lives and only updates are shared; secure enclaves and trusted research environments, in which approved analysts work on real data under controlled conditions; and query-based systems that answer specific questions with differential privacy all address the same underlying problem. Synthetic data is most valuable when broad, exploratory access is needed and some loss of fidelity is acceptable. When precise answers on real data are required, it is usually better to bring the analyst to the data than to bring a synthetic copy of the data to the analyst. The privacy case thus anticipates the book's general argument. A generator alone gives no guarantee. The guarantee comes from a mechanism attached to the generator — here, differential privacy and empirical attack testing — and from validation against the real data the synthetic records are meant to stand in for. Chapter 4. Engineering Diversity at the Point of Generation Ask a large language model to write a hundred customer complaints about a delayed parcel and you will get a hundred complaints. Read them and you will notice that they are remarkably similar. Most will open with a variant of "I am writing to express my frustration." Most will mention a tracking number. Most will be polite, grammatical, moderately annoyed, and end by requesting a refund or an update. Very few will be written in broken English by someone who is furious, or consist of a single line with no punctuation, or bury the actual problem in the third paragraph of an unrelated story, or be from a small business whose entire stock is in the missing parcel. Real complaints look like all of those things. The model's complaints look like the average of them. This is the central problem of generation, and it is more important than the quality of any individual output. A synthetic dataset can consist entirely of correct, well-formed examples and still be a poor training set because it covers only a narrow band of the space the model will encounter in deployment. Diversity does not arise naturally from sampling a language model. It has to be engineered. Why generators converge Language models trained with instruction tuning and reinforcement learning from human feedback become, by design, more predictable than their base versions. The alignment process rewards outputs that human raters prefer, and raters prefer clear, polite, well-structured responses. The result is a model whose output distribution has been sharpened toward a particular house style. Researchers have documented that aligned models produce less diverse outputs than their base models across a range of measures, a phenomenon sometimes called mode collapse in this context. For a chat assistant, that predictability is a feature. For a data generator, it is a liability. Sampling temperature is the first lever practitioners reach for. Raising the temperature flattens the model's probability distribution over next tokens, making less likely tokens more likely to be chosen. It increases surface variety. But it does so indiscriminately: high temperatures introduce errors, incoherence, and off-topic drift at the same time as they introduce novelty, and they do not reliably change the high-level structure of outputs. A complaint generated at high temperature is still usually the same kind of complaint, with odder word choices. Temperature varies the phrasing; it rarely varies the scenario. The deeper problem is that a single prompt specifies a single region of the output space. If every generation call receives the same instruction — "write a customer complaint about a delayed parcel" — then every output is a sample from the model's conditional distribution given that instruction, and that distribution is concentrated. Diversity must therefore come from varying the conditioning: the prompt, the context, the examples, the constraints. Seeds, taxonomies, and attribute grids The most reliable way to induce diversity is to decompose the target space explicitly and then generate within each part of it. Before generating customer complaints, a careful practitioner first asks what dimensions real complaints vary along. Product category, severity of the problem, customer's emotional state, customer's writing proficiency, length, channel (email, chat, social media), whether the complaint contains extraneous information, whether the customer is mistaken about the facts, whether they are a repeat complainant. Each of these dimensions has a set of values. The generator is then asked to produce complaints for specific combinations: a furious, terse, social-media complaint from a non-native speaker about damaged electronics, in which the customer has misread the delivery date. This attribute-grid approach has several advantages. It guarantees coverage of combinations the model would rarely produce unprompted. It makes the composition of the dataset explicit and controllable, so that the proportion of, say, mistaken customers can be set deliberately. And it produces metadata for every example, which is invaluable later for analysing which kinds of example help or hurt the trained model. The cost is that someone must design the grid, and the grid encodes the designer's assumptions about what matters. A grid that omits a dimension — customers writing on behalf of elderly relatives, say — will produce a dataset that omits it too. Grids are best derived from real data where it exists: a sample of a few hundred real complaints, read carefully and annotated by hand, will reveal dimensions that nobody would have thought to include. When real data is unavailable, domain experts and existing taxonomies are the next best source. A related technique uses a hierarchy of topics. The Cosmopedia project at Hugging Face, which generated around twenty-five billion tokens of synthetic textbooks, stories, and educational posts, seeded generation using topics and passages drawn from curated sources and web pages, and specified different target audiences — young children, high school students, college students, professionals — and formats. Varying the audience alone, the team reported, substantially changed the content and style of otherwise similar prompts. Grounding the generator in real web text also gave each output a different starting point, reducing the tendency to regress to the same few framings. Personas A powerful variant of conditioning is the persona. Instead of specifying abstract attributes, the prompt describes a person — "a retired schoolteacher in rural Wales who is suspicious of technology" or "a pharmacology graduate student preparing for a qualifying exam" — and asks the generator to write from that person's perspective, or to write something that person would ask. In 2024 researchers at Tencent published "Scaling Synthetic Data Creation with 1,000,000,000 Personas," describing Persona Hub, a collection of about a billion persona descriptions extracted automatically from web text. Each web page was treated as evidence of some person who might read or write it, and the model was asked to describe that person. The resulting personas were then used to condition the generation of mathematical problems, instructions, knowledge-rich texts, and game characters. Because the personas were derived from the enormous variety of the web, they carried that variety into the synthetic data in a way that no hand-designed grid could match. Personas work because they bundle many correlated attributes into a single coherent identity, and language models are good at reasoning about what a particular kind of person would plausibly say. A persona-conditioned maths problem from a farmer tends to involve crop yields and fence lengths; one from a nurse involves dosages and infusion rates. Both may test the same underlying skill, but they expose the student model to different surface forms, which helps it generalise. Personas also carry risks. Language models hold stereotypes about the groups personas describe, and a persona-conditioned dataset can amplify them. The "retired schoolteacher suspicious of technology" will tend to be written according to the model's stereotype of such a person, not according to the real diversity of retired schoolteachers. Practitioners using personas should sample the outputs for stereotyping and avoid personas defined primarily by protected characteristics unless that dimension is genuinely needed. Evolving instructions A different approach to diversity treats generation as an iterative process in which existing examples are mutated into new ones. The best-known method is Evol-Instruct, introduced in the 2023 WizardLM paper by Can Xu and colleagues. Starting from a pool of simple instructions, the method repeatedly asks a language model to rewrite each one in one of several ways. "In-depth" evolution makes an instruction harder: adding constraints, requiring more reasoning steps, replacing general concepts with specific ones, complicating the input. "In-breadth" evolution creates a new instruction on a related but different topic. After each round, an elimination step discards evolved instructions that failed — those that merely copied the original, that the model could not answer, or that degenerated into nonsense. Evol-Instruct has two effects. It increases the diversity of the pool by branching into new topics, and it increases the difficulty distribution by producing progressively harder versions of each instruction. The second effect connects generation to curriculum, the subject of the next chapter. The authors reported that models fine-tuned on evolved instructions outperformed those trained on the unevolved originals, particularly on complex tasks. The method's weakness is drift. Each round of evolution moves further from the original seed and closer to whatever the evolving model considers a hard or interesting instruction. After many rounds, instructions can become artificially convoluted — stacking constraints in ways no real user would — or can wander into territory where the model's answers are unreliable. The elimination step is therefore not optional, and in practice its quality determines the quality of the evolved dataset. Extracting what the model already expects An unusual technique called Magpie, published by Zhangchen Xu and colleagues in 2024, exploits the structure of aligned chat models directly. These models are trained on conversations formatted with special tokens marking where the user's message begins and ends. If the model is given only the template text that precedes a user message, with nothing after it, it will generate a plausible user message on its own — because that is what it learned to expect in that position. Repeating this many times produces a large set of user queries drawn from the model's internal sense of what users ask, which can then be answered by the same model to form instruction-response pairs. Magpie is notable because it requires no seed instructions and no prompt engineering. Its diversity comes from the model's own learned distribution over user queries, which in turn reflects whatever data the model was aligned on. That is both its strength and its limit. It can recover a broad, realistic-seeming spread of queries, but it cannot produce queries outside the distribution the model was trained on, and it inherits whatever skews that distribution contains. Grounded generation: rewriting rather than inventing All the techniques so far ask the generator to produce content largely from its own knowledge. A different family of methods gives the generator a real document and asks it to transform that document: to rephrase it, summarise it, turn it into questions and answers, explain it for a particular audience, or extract a worked problem from it. The diversity of the output then comes largely from the diversity of the source documents, which can be as wide as the web or as specialised as an internal knowledge base. A 2024 study by Pratyush Maini and colleagues at Carnegie Mellon and Apple, "Rephrasing the Web," tested this idea for pretraining. They used an instruction-tuned model to rewrite documents from a large web crawl in several styles — as clear Wikipedia-like prose, as question-and-answer exchanges — and trained language models on a mixture of the rephrased and original text. They reported that the mixture reached a given level of performance substantially faster than training on the raw web text alone, with gains on several question-answering benchmarks. The rephrasing did not add facts; it changed their presentation to forms that were easier to learn from, which is exactly the kind of restructuring Chapter 1 identified as one of synthetic data's genuine contributions. Grounded generation has two further advantages that matter later in the pipeline. First, because each output is tied to a specific source, its claims can be checked against that source, which makes the filtering described in Chapter 7 far more tractable. Second, it reduces the risk that the generator fills gaps in its knowledge with invention, since the content it needs is in front of it. The risk it introduces is subtler: a generator rewriting a document may quietly add details, smooth over qualifications, or change emphasis, and those changes must be caught by a grounding check rather than assumed absent. And grounded generation inherits the source corpus's biases and errors, so the choice of sources becomes a design decision of the same importance as the choice of generator. For domain models, grounded generation is often the default. An organisation building a model for its own products has manuals, policies, past correspondence, and internal documentation. Generating training examples from those materials, rather than from a general-purpose model's general knowledge, keeps the synthetic data tied to the organisation's actual facts and makes every example traceable to a source someone can check. Measuring diversity Because diversity is so important and so easy to lose, it needs to be measured rather than assumed. Several measures are in common use. Lexical measures count distinct n-grams — sequences of one, two, or three words — as a proportion of all n-grams in the dataset. They are cheap and catch gross repetition, such as the same opening phrase appearing in half the examples, but they are easily fooled by surface variation that hides structural sameness. Embedding-based measures represent each example as a vector using a sentence embedding model and then examine the spread of the vectors: average pairwise distance, the number of clusters needed to cover the data, or the volume of the region they occupy. These capture semantic similarity better than lexical measures, but they depend on the embedding model's notion of similarity, which may not match the dimensions that matter for a particular task. Coverage measures compare the synthetic data against a reference — either a sample of real data or the attribute grid used to generate it — and ask what fraction of the reference's regions the synthetic data reaches. Where real data is available, the most informative check is often the simplest: embed both real and synthetic examples, cluster them together, and look for clusters that contain real examples but no synthetic ones. Those clusters represent the parts of reality the generator is missing. Finally, there is no substitute for reading. A practitioner who reads two hundred randomly sampled synthetic examples will notice patterns that no metric captures: the same name recurring, every story ending with a moral, every code example using the same variable names, every customer being reasonable in the end. These patterns, once noticed, can be addressed by changing the conditioning. Unnoticed, they become part of what the student model learns. Diversity and correctness pull in different directions One final point connects this chapter to those that follow. Every technique that increases diversity also tends to increase the error rate. Higher temperature introduces mistakes. Unusual personas push the generator into domains where it knows less. Evolved instructions become harder for the generator to answer correctly. Rare combinations on an attribute grid are rare in the generator's training data too. The examples that add the most diversity are therefore disproportionately likely to be wrong. This is why diversity and verification must be designed together. A pipeline that pushes hard for diversity without a strong filter will fill its dataset with the most creative errors the generator can produce. A pipeline with a strong filter but weak diversity will produce a clean, narrow dataset that trains a brittle model. The right approach is to generate broadly and filter strictly, accepting that a substantial fraction of the most diverse candidates will be discarded, and to monitor the filter to ensure it is not systematically discarding the diverse ones simply because they are unusual. That monitoring — checking that the surviving data still covers the space the generator was asked to cover — is the bridge between generation and the verification machinery described in Chapters 6 and 7. Chapter 5. Curriculum Generation Human education is organised around sequence. Children learn to count before they add, add before they multiply, and multiply before they solve equations. Textbooks introduce concepts one at a time, each building on the last, with exercises that start easy and grow harder. Nobody teaches calculus by handing a student a random shuffle of every mathematics problem ever written. Yet that is roughly how most machine learning models have been trained: on data presented in random order, with no attention to whether an example is too easy to teach anything or too hard to be learned. Synthetic data changes what is possible here. When data is collected from the world, its difficulty distribution is whatever the world provides. When data is generated, its difficulty can be specified. A generator can be asked for easy problems or hard ones, for simple stories or complex ones, for code that uses one concept or five. And if the model being trained can be tested as it learns, the generator can be steered toward exactly the examples that model currently needs. That combination — controllable difficulty and feedback from the learner — makes synthetic curricula one of the most powerful applications of artificial data. The idea of curriculum learning The modern formulation of curriculum learning in machine learning is usually credited to a 2009 paper by Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. They showed on several tasks, including a shape recognition problem and a language modelling task, that training on examples ordered from easy to hard could reach better final performance, or reach a given performance faster, than training on randomly ordered examples. They framed the effect as a form of continuation method: starting with a smoothed, simpler version of the optimisation problem and gradually moving toward the real one, so that the model is guided toward a better region of the solution space before facing the full complexity. The empirical record since then has been mixed. Curriculum learning has helped in some settings — reinforcement learning, machine translation for low-resource languages, certain vision tasks — and made little difference in others, particularly in large-scale pretraining where models see so much data that ordering effects wash out. A 2021 study by Xiaoxia Wu, Ethan Dyer, and Behnam Neyshabur examined curricula across many image classification experiments and found that their benefits were concentrated in situations with limited training time or noisy labels. In the standard regime of ample training on clean data, random ordering performed about as well. That finding is instructive for synthetic data. The regimes in which curriculum matters most — limited training budgets, small models, noisy data — are precisely the regimes in which synthetic data is most often used. Bootstrapping a small domain model, the subject of Chapter 9, typically involves a modest compute budget and data of uneven quality. A well-designed curriculum can make a substantial difference there even if it would make none for a frontier pretraining run. Generating by level: the TinyStories approach The simplest synthetic curriculum is a dataset generated entirely at a single, deliberately low level of complexity. TinyStories, mentioned in Chapter 2, is the clearest example. Eldan and Li constrained their generator to use only vocabulary that a typical three- or four-year-old would understand and asked it to write short stories with simple plots. To ensure diversity within that constraint, each generation prompt included a randomly chosen verb, noun, and adjective that had to appear in the story, along with randomly chosen narrative features such as dialogue, a plot twist, a bad ending, or a moral. The result was a corpus in which every example was within reach of a very small model. Models with only a few million parameters, trained on TinyStories, learned to generate grammatical, coherent narratives with consistent characters and simple causal reasoning. The same models trained on general web text produced fragmented nonsense. The authors' interpretation was that the web contains such a breadth of vocabulary, topics, and styles that a small model spends its limited capacity on surface statistics and never reaches the level of coherent structure. By restricting the domain to something the model could fully master, the curriculum let it learn deeper properties of language. TinyStories is a curriculum in a limited sense — it is a single level, not a sequence — but it demonstrates the key principle. A model learns best from data matched to its capacity. Synthetic generation is the only practical way to produce large quantities of data matched to an arbitrary target level. Staged curricula and the annealing phase A natural extension is to generate data at several levels and present them in sequence. Mathematics is the domain where this has been explored most systematically, because difficulty is relatively easy to define and answers can be checked. A curriculum might begin with single-step arithmetic, move to multi-step word problems, then to algebra, then to competition problems, with each stage generated by prompting a teacher model for problems at that level. In large-scale pretraining, a related practice has become widespread under the name of annealing or mid-training. Rather than ordering all data by difficulty, model developers train on a broad mixture for most of the run and then, in the final phase as the learning rate decays, shift the mixture toward a smaller set of high-quality data — often including substantial synthetic content in mathematics, code, and reasoning. Several published technical reports from 2024 onward describe this pattern, and some developers have used small annealing experiments to evaluate the value of candidate datasets: if adding a dataset in the final phase improves benchmark performance, it is judged worth including at scale. The logic is curricular even if the term is not always used. Broad exposure builds general representations; concentrated exposure to dense, clean material at the end consolidates specific skills. The Phi series of small models from Microsoft pushed this further. Starting with phi-1 in 2023 and continuing through phi-4 in late 2024, the developers relied heavily on synthetic "textbook-quality" data designed to teach reasoning in a structured way, combined with carefully filtered web data. Their reports described synthetic datasets generated to cover a wide range of topics and skills, with prompts designed to elicit step-by-step explanation rather than bare answers. The resulting models consistently performed above what their parameter counts would have predicted on reasoning benchmarks, though critics noted that strong benchmark scores did not always translate into equally strong performance on less structured, real-world tasks — a gap that itself reflects the difference between what a synthetic curriculum teaches and what deployment demands. Difficulty estimation Any graded curriculum requires a way to measure difficulty. There are three broad approaches, and they can be combined. The first is to specify difficulty at generation time. The prompt asks for an easy problem or a hard one, or the generation process applies a known number of complicating transformations, as in Evol-Instruct's in-depth evolution. This is cheap but unreliable. Language models are not good judges of how hard a problem will be for another model, and a problem labelled "hard" by its generator may be trivial, while one labelled "easy" may contain a subtle trap. The second is to use structural proxies. For maths, the number of reasoning steps in a reference solution. For code, the number of distinct concepts or library calls. For text, readability scores or vocabulary rarity. These are objective and cheap to compute, but they measure complexity rather than difficulty, and the two can come apart. The third and most informative approach is to measure difficulty empirically, by attempting each problem with a model and recording how often it succeeds. A problem the model solves on ninety-five of a hundred attempts is easy for that model; one it solves on three of a hundred is hard; one it never solves is either very hard or unsolvable. This pass-rate measure has the great advantage of being defined relative to the learner, which is exactly what a curriculum needs. Its disadvantage is cost: estimating a pass rate requires many samples per problem, and the cost multiplies across a large dataset. Empirical difficulty also exposes a useful property of problem pools. Problems at both extremes are nearly useless for training. A problem the model always solves teaches it nothing it does not already know. A problem it never solves provides no positive example to learn from, and in reinforcement learning settings produces no useful gradient. The most informative problems are those in the middle, where the model succeeds sometimes and fails sometimes. Several reinforcement learning pipelines for reasoning models published in 2025 explicitly filter their training pools to retain problems within an intermediate pass-rate band, discarding those that are too easy or too hard for the current model and re-estimating as the model improves. Self-improving curricula The most powerful curricula are those in which the model's own performance determines what gets generated next. The model attempts problems; its successes and failures are recorded; new problems are generated or selected to target the region just beyond its current ability; it trains on those; and the cycle repeats. An early and influential example is STaR, the Self-Taught Reasoner, published by Eric Zelikman, Yuhuai Wu, Jesse Mu, and Noah Goodman in 2022. The method is simple. A model is prompted to produce a step-by-step rationale and answer for each problem in a dataset where correct answers are known. Rationales that lead to correct answers are kept; those that lead to wrong answers are discarded. For problems the model gets wrong, it is given the correct answer as a hint and asked to produce a rationale that reaches it — a step the authors called rationalisation. The model is then fine-tuned on all the kept rationales, and the process repeats with the improved model. Each iteration expands the set of problems the model can solve, which in turn expands the set of rationales available for the next iteration. STaR illustrates the generator-verifier structure at the heart of this book. The generator is the model itself. The verifier is the known correct answer. The curriculum emerges automatically: in each round, the model trains on the hardest problems it can currently solve, because those are the newest additions to the kept set. A closely related technique, rejection sampling fine-tuning, samples many candidate solutions per problem, keeps those with correct final answers, and fine-tunes on them; studies in 2023 found that keeping more distinct correct reasoning paths per problem improved results, presumably because they exposed the model to more varied valid approaches. The method has a known weakness that becomes important in later chapters. A rationale that reaches the correct answer is not necessarily a correct rationale. The model may arrive at the right number through flawed reasoning, lucky guessing, or a shortcut that happens to work on this problem. When such rationales are kept and trained on, the model learns to produce plausible-looking reasoning that is only loosely connected to its answers. Rationalisation makes this worse, because a model given the answer in advance can write a post-hoc justification that would not have led it there unaided. Outcome-based verification, which checks only the final answer, therefore admits a class of subtly wrong examples that only process-based verification, which checks each step, can catch. Chapter 6 returns to this distinction. Adversarial and self-play curricula A further class of self-improving curricula pits a generator against a solver. The generator is rewarded for producing problems the solver cannot yet solve but that are solvable in principle; the solver is rewarded for solving them. As the solver improves, the generator must produce harder problems to keep earning reward, and the curriculum ratchets upward. OpenAI's automatic domain randomisation for robotic manipulation, mentioned in Chapter 2, works on a similar principle: the range of simulated variation expands whenever the policy masters the current range. DeepMind's AlphaGeometry, published in Nature in 2024, used a different form of self-generated curriculum. Rather than a learned problem generator, it used a symbolic engine to sample random geometric premises, deduce everything that followed from them, and extract theorems along with their proofs. About a hundred million synthetic examples were produced this way, at every level of difficulty the random sampling happened to reach, and a language model was trained on them to suggest the auxiliary constructions that symbolic deduction alone could not find. The curriculum was implicit in the distribution of the generated proofs rather than explicitly ordered, but it covered the space so thoroughly that the system could solve olympiad problems it had never seen. Self-play curricula have one important vulnerability. The generator can learn to produce problems that are hard for the solver in uninformative ways — ambiguous, ill-posed, or exploiting a quirk of the verifier — rather than genuinely difficult. A problem generator rewarded for stumping the solver may find that an unsolvable problem is the easiest way to do so. Guarding against this requires the verifier to confirm that generated problems are well-formed and solvable, typically by requiring the generator or a reference solver to produce a valid solution before the problem enters the pool. Designing a curriculum in practice For a practitioner building a synthetic curriculum, several principles follow from the evidence. Match the data to the learner's capacity. A small model trained on synthetic data written at the level of a frontier model's ability will learn the surface form and miss the substance. Generate simpler material first, or restrict the domain until the model can master it. Measure difficulty empirically where possible. Pass rates under the current model are the most reliable difficulty signal. Structural proxies are useful for initial sorting, but they should be checked against empirical difficulty on a sample. Keep the middle. Problems the model always or never solves are wasted compute. Concentrate training on the intermediate band, and re-estimate the band as the model improves. Close the loop. The largest gains come from curricula that regenerate or reselect data based on the model's current failures. Static curricula, generated once and fixed, cannot respond to what the model actually finds hard. Verify the process, not just the outcome. A curriculum built on outcome checks alone will accumulate examples in which correct answers are supported by incorrect reasoning. Where possible, check intermediate steps; where not, sample and read the kept rationales to estimate how often this happens. Watch the distribution, not just the difficulty. A curriculum that drives toward harder problems will drift toward whatever kind of problem the generator finds easiest to make hard. Monitor coverage across topics and types, as described in Chapter 4, so that the hardest examples do not all come from a single narrow corner of the space. A curriculum, in short, is a verifier stretched across time. Each round of generation proposes; each round of testing decides which proposals the model is ready for; and the record of those decisions shapes what is proposed next. Chapter 6. Automated Grading: The Verifier Is the Architecture If a synthetic data pipeline generates a million candidate examples and keeps two hundred thousand, the decision about which two hundred thousand to keep determines what the trained model learns. That decision is made by a verifier: some procedure that scores, ranks, or accepts and rejects each candidate. The verifier is where the pipeline's knowledge of correctness lives. A generator proposes; the verifier disposes. And because the verifier is applied to every example at a scale no human could match, its strengths and weaknesses are multiplied across the entire dataset. Verifiers come in many forms, from exact mechanical checks to learned models whose judgements are themselves uncertain. They differ in cost, in the range of tasks they can assess, in how precisely they distinguish good from bad, and in the ways they can be fooled. Choosing and calibrating verifiers is the most consequential engineering decision in any synthetic data system. The spectrum of verifiers At one end of the spectrum are exact verifiers: procedures that determine correctness with certainty for a well-defined class of examples. A generated arithmetic problem with a numerical answer can be checked by computing the answer. A generated program can be run against test cases. A generated formal proof can be checked by a proof assistant such as Lean, Coq, or Isabelle, which will accept it only if every step follows from the axioms and previously proved results. A generated SQL query can be executed against a database and its output compared with the expected result. Exact verifiers are the gold standard because their judgements do not drift, do not have biases, and cannot be persuaded by eloquence. Their limitation is scope. Exact verification is possible only where correctness has a precise definition that can be computed. Most of what people want language models to do — explain a concept clearly, write a persuasive email, summarise a document faithfully, give sound medical advice — has no such definition. Even within domains that seem exact, the verifiable portion can be narrower than it appears. A unit test checks that a function produces correct outputs for the tested inputs, not that it is correct in general, efficient, readable, or secure. In the middle of the spectrum are heuristic and model-based checks for particular properties. A toxicity classifier estimates whether text is offensive. A natural language inference model estimates whether one statement is entailed by another. A language identification model checks that text is in the intended language. A readability formula estimates reading level. A deduplication hash detects near-copies. Each of these checks one property, imperfectly, at low cost. They are the workhorses of filtering pipelines and the subject of much of Chapter 7. At the other end are general-purpose learned judges: reward models trained on human preferences and large language models prompted to evaluate outputs. These can assess almost anything that can be described in words, including the qualities exact verifiers cannot reach — helpfulness, clarity, faithfulness, tone. Their judgements are probabilistic and biased in systematic ways, and they can be fooled. But they are often the only scalable option for open-ended tasks. Table 3 summarises the main verifier types and their characteristic properties. Table 3. Main types of verifier used in synthetic data pipelines. Verifier type Examples What it can check Main failure mode Relative cost Exact answer match Computed numerical answers, multiple choice keys Final-answer correctness Right answer, wrong reasoning Very low Execution Unit tests, SQL execution, simulators Functional behaviour on tested cases Incomplete tests; reward hacking Low to moderate Formal proof checking Lean, Coq, Isabelle Logical validity of every step Misformalised statements Low per check; high setup Property classifiers Toxicity, language ID, NLI models One narrow property each Domain shift; false positives on minority dialects Low Learned reward model Preference-trained scoring models Overall quality as humans judged it Over-optimisation; exploitable quirks Moderate LLM-as-judge Prompted frontier models with rubrics Almost any describable property Position, length, and self-preference bias Moderate to high Outcome verification and process verification A crucial distinction cuts across the spectrum. Outcome verification checks only the final result: whether the answer is correct, whether the program passes its tests. Process verification checks the steps that led there: whether each line of reasoning is valid, whether each function is correctly implemented, whether each claim in a summary is supported. Outcome verification is far cheaper and far more widely available. Many problems have checkable answers but no checkable intermediate steps. But as Chapter 5 noted, outcome verification admits a class of examples in which the right answer was reached by the wrong route. In mathematics, a model may make two errors that cancel, guess a plausible number, or pattern-match to a similar problem. In code, a program may pass tests by special-casing the test inputs rather than solving the general problem. When such examples enter a training set, the student learns the faulty process along with the correct answer. The importance of process verification was demonstrated in a 2023 OpenAI paper by Hunter Lightman and colleagues, "Let's Verify Step by Step." The authors collected human labels on the correctness of individual steps in model-generated solutions to competition mathematics problems, assembling a dataset of around 800,000 step-level labels known as PRM800K. They trained a process reward model to predict whether each step was correct and compared it with an outcome reward model trained only on whether final answers were correct. Used to select the best among many candidate solutions, the process-supervised model was substantially more reliable. It was also better aligned in a qualitative sense: it rewarded solutions whose reasoning a human would endorse, rather than solutions that merely happened to land on the right number. Process verification can be made partly automatic. A trained process reward model can score steps without human labels once it has been trained. Alternatively, each step can be checked by attempting to complete the solution from that step many times and observing how often the completions reach the correct answer; steps from which the correct answer is rarely reached are probably wrong. This Monte Carlo approach to step labelling was explored in several 2024 papers and offers a way to approximate process supervision using only outcome checks, at the cost of many more model calls. Language models as judges The most flexible verifier available is a capable language model asked to evaluate another model's output. The practice became widespread after a 2023 paper by Lianmin Zheng and colleagues, "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena," which systematically compared GPT-4's judgements of chat responses with those of human experts. They found that GPT-4 agreed with human preferences at a rate above eighty percent, comparable to the rate at which human experts agreed with each other. That finding, more than any other, licensed the use of language models as scalable substitutes for human evaluation. The same paper catalogued the biases that make LLM judges unreliable in specific ways. Three have proved especially persistent. Position bias is the tendency to prefer whichever of two responses appears first, or in some models second, independent of quality. When the order of the two responses is swapped, a biased judge changes its verdict. The standard mitigation is to evaluate every pair in both orders and accept a verdict only when it is consistent, treating inconsistent cases as ties. Verbosity bias is the tendency to prefer longer responses, even when the extra length adds nothing or introduces errors. Judges reward responses that look thorough. In a synthetic data pipeline this is dangerous, because a generator selected by a verbose-preferring judge will learn to pad. Mitigations include instructing the judge explicitly to disregard length, controlling for length statistically when analysing scores, and including deliberately padded responses in calibration sets to measure the bias. Self-preference bias is the tendency of a model to rate its own outputs, or outputs from models similar to it, more highly than outputs of comparable quality from other models. This matters greatly for synthetic data, because the generator and the judge are often the same model or come from the same family. A pipeline in which one model generates and the same model judges can reinforce that model's idiosyncrasies rather than filtering them out. Using a judge from a different model family, or an ensemble of judges from several families, reduces the risk. Further biases have been documented since: sensitivity to the presence of authoritative-sounding citations or formatting, susceptibility to persuasive language in the response being judged, and a tendency to be lenient on factual errors the judge itself does not know to be errors. That last point deserves emphasis. An LLM judge cannot reliably detect a factual error it would itself make. If the generator and the judge share a misconception, the judge will approve every example that contains it. Rubrics, references, and decomposition Several techniques make LLM judges more reliable. The most effective is to replace holistic judgement with a rubric: a list of specific, checkable criteria. Instead of asking "Is this a good answer?", the judge is asked whether the answer addresses each part of the question, whether every factual claim is correct, whether it contains any unsupported recommendations, whether it is under a certain length, and so on. Each criterion is scored separately. Rubric-based judging is more consistent across runs, more transparent when it fails, and easier to audit, because a disagreement can be traced to a specific criterion. A second technique is to supply a reference. If a correct answer or a high-quality example response is available, the judge can be asked to compare the candidate against it. Reference-guided judging is substantially more accurate than reference-free judging for factual and mathematical content, because the judge no longer needs to know the right answer itself; it needs only to compare. A third technique is decomposition. A long response is split into individual claims, and each claim is checked separately, either against a reference, against a retrieved source, or by the judge's own knowledge. The FActScore method, introduced by Sewon Min and colleagues in 2023 for evaluating biographies generated by language models, broke each biography into atomic facts and checked each against Wikipedia. Decomposition converts a hard holistic judgement into many easier local ones, and it makes the error rate interpretable: one can say that a dataset contains an average of so many unsupported claims per example. A fourth technique is to ask for reasoning before the verdict. A judge that explains its assessment before scoring tends to be more accurate than one that outputs a score directly, though the explanation can also introduce new errors, and some studies have found the benefit inconsistent. Reward models and the over-optimisation problem A reward model is a learned scoring function, typically a language model with a scalar output head, trained on human comparisons between pairs of responses. Reward models are central to reinforcement learning from human feedback, and they are also used directly as filters in synthetic data pipelines: generate many candidates, score each with the reward model, keep the highest-scoring. The technique, often called best-of-n sampling or rejection sampling, is simple and effective. It also has a well-documented failure mode. A reward model is an imperfect proxy for human preference. When candidates are selected to maximise the proxy, the selected candidates increasingly exploit the gap between proxy and target. A 2022 study by Leo Gao, John Schulman, and Jacob Hilton at OpenAI measured this effect systematically, using a large "gold" reward model as a stand-in for true human preference and smaller proxy reward models as the optimisation target. As optimisation pressure on the proxy increased, the gold reward first rose and then fell. Beyond a certain point, choosing outputs the proxy liked more made them worse by the standard the proxy was meant to represent. The phenomenon is an instance of Goodhart's law: when a measure becomes a target, it ceases to be a good measure. For synthetic data, the lesson is that selecting the very top of a reward model's ranking is not always best. Moderate selection pressure — keeping the top quarter rather than the top one percent, or combining reward model scores with other checks — is often more robust. Monitoring the selected data for signs of exploitation is essential: excessive length, repetitive structures, sycophantic phrasing, or formatting patterns that the reward model appears to favour regardless of content. Reward hacking in execution-based verifiers Even exact verifiers can be exploited, and the more optimisation pressure is applied against them, the more likely exploitation becomes. In code generation, a model selected or trained to pass unit tests may learn to read the tests and special-case their inputs, to modify the test file if it has access to it, to exit the process with a success code before the tests run, or to catch and suppress all exceptions. Each of these produces a program that passes the verifier while failing to solve the problem. Developers of reasoning models trained with reinforcement learning on coding tasks have publicly reported observing such behaviours. The defences are those of good software testing applied adversarially. Keep test cases hidden from the generator. Use many tests, including randomised property-based tests that check general properties rather than specific outputs. Run generated code in a sandbox that prevents it from modifying the evaluation environment. Check programs with a second, independent verifier — a linter, a static analyser, or a judge model asked specifically to look for special-casing. And sample the accepted programs regularly for human review, looking for the patterns that indicate gaming. Calibrating the verifier A verifier is itself a classifier, and like any classifier it has a false-positive rate and a false-negative rate. False positives — bad examples accepted — contaminate the dataset. False negatives — good examples rejected — reduce its size and, more subtly, its diversity, because verifiers tend to reject unusual examples more often than typical ones. Both rates should be measured. Measuring them requires a labelled calibration set: a few hundred or few thousand candidate examples whose true quality has been established independently, ideally by human experts. The verifier is run on the calibration set, and its accept and reject decisions are compared with the true labels. The resulting precision and recall tell the practitioner what fraction of accepted examples are actually good, and what fraction of good examples are being thrown away. They also allow the acceptance threshold to be tuned deliberately: a pipeline where contamination is very costly can set a strict threshold and accept a lower yield. The calibration set should be stratified across the dimensions that matter: topics, difficulty levels, styles, and the specific failure modes the verifier is meant to catch. A verifier that is well calibrated on average may be badly miscalibrated on a particular subgroup, and the subgroups where it fails are often the ones of greatest concern. A toxicity filter that performs well overall may flag dialectal English at much higher rates than standard English, a pattern documented in academic studies of toxicity classifiers, and a synthetic pipeline using such a filter will quietly remove dialectal examples from its output. Calibration is not a one-time activity. As the generator changes — a new model version, a new prompt template, a new curriculum stage — the distribution of candidates changes, and the verifier's error rates change with it. A verifier calibrated on easy examples may perform differently on hard ones. Periodic recalibration on fresh samples is the only reliable protection. Ensembles and layered verification No single verifier is adequate for open-ended synthetic data. The practical answer is layering: a sequence of checks, each targeting different failure modes, with cheap checks applied first to eliminate obvious failures before expensive ones are run. A typical text pipeline might apply format and length checks, then language identification, then deduplication, then property classifiers for toxicity and personal information, then an LLM judge with a rubric, then, for a sample, human review. Each layer reduces the volume that the next must process, and each catches failures that earlier layers miss. Ensembles of judges improve reliability further. When several independent judges agree, their verdict is more trustworthy than any one alone; when they disagree, the example is ambiguous and can be routed to more expensive review or discarded. Disagreement rate across judges is itself a useful diagnostic: a rising disagreement rate signals that the generator has moved into territory where the verifiers are less confident. Behind all of this sits one discipline: the verifier must be treated as a model in its own right, with its own evaluation, its own known failure modes, and its own audit trail. A synthetic data pipeline is only as trustworthy as the least-examined component that decides what to keep. Chapter 7. Filtering Toxic Hallucinations Every language model produces errors, and a synthetic data pipeline produces them at industrial scale. Some errors are obvious: malformed outputs, truncated sentences, responses in the wrong language. These are easy to catch. The errors that matter are the ones that look like correct data. A fabricated citation formatted perfectly. A drug interaction described with clinical confidence that does not exist. A historical date off by a decade, embedded in an otherwise accurate paragraph. A code snippet that runs, passes the obvious test, and contains a subtle security flaw. A customer service response that is polite, helpful, and quietly promises a refund policy the company does not have. These are what this chapter calls toxic hallucinations: plausible, fluent, confidently stated content that is false or harmful, and that will be learned as true by any model trained on it. The word "toxic" is used deliberately in two senses. Some generated content is toxic in the conventional sense — offensive, biased, or dangerous. But hallucinations are also toxic to a dataset in the way a contaminant is toxic to a water supply: a small concentration can do disproportionate harm, because the model being trained has no way to distinguish the contaminant from the clean water around it. Why hallucinations are especially dangerous in training data A hallucination in a single chat response misleads a single user, who may notice it. A hallucination in training data is learned by a model and may be reproduced, with variations, in thousands of future responses. Worse, training on hallucinated content does not merely teach the specific false facts. There is evidence that it teaches a general disposition to produce unsupported content. A 2024 study by Zorik Gekhman and colleagues at Google examined what happens when language models are fine-tuned on examples containing knowledge the model did not already possess from pretraining. They found that models learned such new knowledge much more slowly than they learned examples consistent with existing knowledge, and that as the new examples were eventually fitted, the model's tendency to hallucinate on other questions increased. Their interpretation was that fine-tuning on facts the model cannot ground in its pretraining teaches it to generate confident answers regardless of whether it knows them. The implication for synthetic data is pointed. A teacher model that generates facts outside the student's knowledge — even correct ones — may increase the student's hallucination rate. A teacher that generates incorrect facts is doubly harmful. A second mechanism compounds the problem. Synthetic data is generated by models that share systematic misconceptions. If a teacher model consistently believes a particular false claim, it will produce that claim across many examples, in many phrasings, with high confidence. The student will see the claim repeatedly and learn it robustly. Errors that would be scattered and inconsistent in human-written data become concentrated and consistent in synthetic data, which makes them both harder to detect by inspection and more strongly learned. A taxonomy of synthetic contamination It helps to distinguish the main kinds of harmful content a synthetic pipeline produces, because each calls for a different filter. Factual hallucinations are false statements about the world: wrong dates, invented events, non-existent people, misattributed quotations, incorrect scientific claims. They are most common where the generator's knowledge is thin — specialised domains, recent events, obscure entities, and precise quantities. Grounding failures occur when content is supposed to be derived from a source but is not. A synthetic summary that adds claims absent from the document being summarised, or a synthetic question-and-answer pair whose answer is not supported by the passage it was generated from, is a grounding failure even if the added claims happen to be true. For a model being trained to summarise or answer questions from documents, such examples teach it to embellish. Reasoning errors are flaws in the logic connecting premises to conclusions: invalid inferences, arithmetic mistakes, steps that do not follow. As noted in earlier chapters, they can coexist with correct final answers. Harmful content in the conventional sense includes hate speech, harassment, sexual content where inappropriate, dangerous instructions, and content that demeans groups of people. Aligned generators produce less of this than base models, but they still produce some, especially when prompted with personas or adversarial scenarios intended to increase diversity. Subtle bias is content that is not overtly offensive but encodes stereotypes: doctors who are always men, nurses who are always women, names from particular ethnic groups appearing disproportionately in negative scenarios. Because it is distributed across many examples rather than concentrated in any one, it is invisible to per-example filters and detectable only through aggregate analysis. Personal information leakage occurs when the generator reproduces real names, addresses, phone numbers, or other identifying details from its own training data. Chapter 3 discussed this in the context of privacy-motivated synthesis, but it also arises in general-purpose synthetic data. Contamination of evaluation sets occurs when the generator reproduces, verbatim or nearly so, problems from benchmarks that will later be used to evaluate the student. The student then appears to perform well on the benchmark because it has seen the answers, not because it has the capability the benchmark is meant to measure. Detecting factual hallucinations Factual hallucination is the hardest category to filter, because detecting a false claim requires knowing what is true. There are four main approaches. The first is grounding against a trusted source. If the synthetic example was generated from a source document — a textbook passage, a product manual, a legal statute — every claim in the example can be checked against that source. Natural language inference models, trained to judge whether a hypothesis is entailed by, contradicted by, or neutral with respect to a premise, can perform this check at scale. Claims that are not entailed by the source are flagged. This approach is powerful when it applies, and it suggests an important design principle: wherever possible, generate synthetic data from sources rather than from the generator's unaided memory. A question-and-answer pair written from a specific paragraph can be checked against that paragraph. One written from the model's general knowledge cannot be checked against anything. The second is retrieval-based verification. Each claim is extracted, a search is performed against a trusted corpus such as an encyclopaedia, a scientific database, or an internal knowledge base, and a judge assesses whether the retrieved evidence supports the claim. This extends grounding to examples that were not generated from a specific source, at the cost of a retrieval step for every claim and the possibility that the retrieval misses relevant evidence. The third is self-consistency. A hallucinated fact tends to be unstable: if the generator is asked the same question several times, it gives different answers. A known fact tends to be stable. SelfCheckGPT, introduced by Potsawee Manakul and colleagues in 2023, exploits this by sampling several additional responses to the same prompt and measuring how consistently each claim in the original response is supported by the others. Claims that appear only once, or that are contradicted by other samples, are likely hallucinations. Self-consistency requires no external knowledge source, which makes it widely applicable, but it cannot catch errors the model makes consistently — the shared misconceptions described above. A model that always gives the same wrong answer will pass a consistency check every time. The fourth is cross-model verification. A claim generated by one model is checked by a model from a different family, trained on different data, with different blind spots. Where the two disagree, the claim is suspect. This is the logic of judge ensembles, applied specifically to facts. It catches errors that self-consistency misses but is still limited to errors that the second model happens not to share. None of these approaches is complete, and in practice they are combined. A robust pipeline for knowledge-intensive synthetic data generates from sources wherever possible, checks grounding against those sources, runs retrieval-based verification on claims that go beyond the sources, applies self-consistency as a cheap first-pass filter, and routes high-stakes or uncertain examples to cross-model or human verification. Abstention as a training signal One effective response to hallucination is to include examples in the synthetic data in which the correct response is to decline to answer. If every synthetic question has a confident answer, the student learns that every question deserves one. If some synthetic questions are deliberately unanswerable — about fictitious entities, about information not present in a provided document, about matters genuinely unknown — and the response models a clear statement of uncertainty, the student learns that abstention is an acceptable output. Building such examples well requires care. The unanswerable questions must be genuinely unanswerable, not merely hard; a model trained to refuse hard questions becomes unhelpful. The abstention responses must be calibrated to the student's actual knowledge, which differs from the teacher's. And the proportion must be tuned: too few, and the student does not learn to abstain; too many, and it abstains when it should not. Several published approaches build abstention data by testing which questions the student itself answers incorrectly and then training it to express uncertainty on those questions specifically, which directly connects the abstention signal to the student's own knowledge boundaries. Filtering harmful content Conventional harmful content is the most mature filtering problem, with established classifiers and well-understood trade-offs. Classifiers such as Google Jigsaw's Perspective API and a range of open models trained on toxicity datasets score text for insults, threats, identity attacks, and related categories. Safety classifiers developed by model providers assess content against broader policies covering violence, self-harm, sexual content, and dangerous activities. Two pitfalls deserve emphasis. The first is overfiltering. Toxicity classifiers have well-documented false-positive patterns: they flag text that mentions identity groups even in neutral or positive contexts, and they flag dialects and registers that differ from the standard written English on which they were largely trained. A pipeline that removes everything above a low toxicity threshold may systematically remove examples involving minority groups or non-standard dialects, producing a student that handles those contexts poorly. Thresholds should be tuned on calibration sets that include these cases, and filtered-out examples should be audited for patterns. The second pitfall is that some harmful-seeming content is necessary. A model meant to moderate content needs to see examples of what it will moderate. A model meant to refuse dangerous requests needs to see dangerous requests. A model meant to discuss historical atrocities needs to engage with them. Filtering must therefore be policy-aware: the question is not whether content is harmful in the abstract but whether it is appropriate for the intended training purpose. This usually means filtering the responses more strictly than the prompts. A synthetic example in which a user asks for something harmful and the assistant declines appropriately is valuable; one in which the assistant complies is not. Constitutional AI, introduced by Yuntao Bai and colleagues at Anthropic in 2022, provides a structured approach to the second problem. A set of written principles — a constitution — guides a model in critiquing and revising its own responses, and in judging which of two responses better adheres to the principles. The resulting critiques, revisions, and preference judgements become synthetic training data for making the model less harmful without making it evasive. The method shows that a carefully specified rubric applied by a capable model can serve as a harmful-content verifier for an entire alignment dataset, and that the specification of the rubric — what the principles actually say — becomes the place where human judgement is concentrated. Detecting bias in aggregate Subtle bias cannot be filtered example by example, because no single example is wrong. A story in which the engineer is a man is not biased; a dataset in which ninety-five percent of engineers are men is. Detecting this requires aggregate measurement. The basic technique is to extract the relevant attributes from each synthetic example — the genders, ethnicities, ages, and occupations of characters; the sentiment associated with each group; the roles assigned to each — and compare their distribution with an intended target distribution. Where the target is equality, deviations are measured directly. Where the target is the real-world distribution, it must be obtained from a reliable source. Where the target is deliberately counter-stereotypical, to offset biases the student may have absorbed elsewhere, that intention should be explicit and documented. Correcting aggregate bias is usually done at the generation stage rather than the filtering stage, by adjusting the attribute grid or persona sampling described in Chapter 4. Filtering can rebalance a dataset by downsampling over-represented patterns, but it cannot create examples that were never generated. A pipeline that monitors aggregate statistics continuously and feeds them back into generation parameters is far more effective than one that discovers imbalance only at the end. Deduplication and decontamination Two further filters are essential in every pipeline, though they target redundancy and leakage rather than falsehood. Deduplication removes exact and near-duplicate examples. Synthetic generators produce duplicates readily, especially at low temperatures or with narrow prompts, and duplicates both waste compute and distort the training distribution toward whatever was duplicated. Research by Katherine Lee and colleagues in 2021 showed that deduplicating language model training data reduced memorisation and improved model quality. Near-duplicate detection is usually performed with MinHash or similar locality-sensitive hashing techniques, which estimate the overlap between sets of word sequences efficiently at scale. Semantic deduplication, which uses embedding similarity to catch examples that say the same thing in different words, is a further refinement, though it requires a careful threshold to avoid removing examples that are similar but legitimately distinct. Decontamination removes examples that overlap with evaluation benchmarks. This matters more for synthetic data than for collected data, because generator models have often seen the benchmarks during their own training and may reproduce benchmark problems, or close paraphrases of them, when asked to generate problems in the same domain. A student trained on such data will post inflated benchmark scores. Standard practice is to check every synthetic example for n-gram overlap with every benchmark that will be used for evaluation, removing any example that shares long sequences with a benchmark item. Paraphrase-level contamination is harder to catch, and some developers supplement n-gram checks with embedding similarity or with LLM judges asked to identify whether a synthetic problem is a disguised version of a benchmark problem. The most robust protection is to evaluate on benchmarks created after the generator's training data was collected, or on private held-out sets the generator could never have seen. The residual error rate No filtering pipeline removes every hallucination. Even the best combination of grounding, retrieval, consistency, and cross-model checks will leave some errors in the data. The question is not whether errors remain but how many, of what kinds, and with what consequence. Estimating the residual error rate requires human review of a random sample of the filtered output. Not the rejected examples, which tell you about the filter's false-negative rate, but the accepted ones, which tell you what the student will actually learn. A sample of a few hundred examples, reviewed by people who know the domain, gives a usable estimate of the contamination rate with a meaningful confidence interval. If the rate is unacceptable for the intended use, the filter must be tightened, the generator changed, or the domain narrowed. The acceptable residual rate depends on the stakes. A synthetic dataset for training a casual conversational model can tolerate a few percent of minor factual errors. A synthetic dataset for a clinical decision support model cannot tolerate any systematic error in drug dosing. For high-stakes domains, the right conclusion is sometimes that synthetic generation from an unaided language model is not appropriate at all, and that synthetic data must be generated only from verified sources with grounding checks at every step, or not used. This is the practical meaning of the book's controlling idea. The generator determines what candidates exist. The filters determine which survive. The residual error rate — measured, not assumed — determines whether the result is fit for purpose. A team that cannot state that rate for its synthetic dataset does not know what its model is learning. Chapter 8. Teachers and Students: Distillation Through Synthetic Data The largest language models are expensive to run. Serving a model with hundreds of billions of parameters requires clusters of specialised accelerators, consumes substantial energy per query, and introduces latency that some applications cannot tolerate. Many organisations also cannot send their data to an external provider's model at all, for reasons of confidentiality, regulation, or cost. For these reasons there is enormous demand for small models — a few billion parameters or fewer — that perform well on specific tasks and can be run cheaply, privately, and quickly. Small models trained from scratch on limited data are weak. Small models trained on data generated by large ones can be surprisingly strong. This transfer of capability from a large teacher to a small student, mediated by synthetic data, is the most commercially important use of synthetic data today. It is also one of the most frequently misunderstood, because students can learn to look like their teachers far more easily than they can learn to think like them. From soft labels to sequences The term distillation comes from a 2015 paper by Geoffrey Hinton, Oriol Vinyals, and Jeff Dean, "Distilling the Knowledge in a Neural Network." Their insight concerned classification. A trained classifier does not output only its top prediction; it outputs a probability distribution over all classes. When it classifies an image of a dog, it might assign high probability to "dog," moderate probability to "wolf," small probability to "cat," and almost none to "car." These relative probabilities — what Hinton called dark knowledge — encode the teacher's understanding of how classes relate. A student trained to match the full distribution, rather than just the one-hot correct label, learns this structure and generalises better than a student trained on labels alone. Raising the temperature of the teacher's output softens the distribution and makes the small probabilities more visible to the student. For language models, the classical form of distillation means training the student to match the teacher's probability distribution over the next token at every position. This is powerful but requires access to the teacher's full output distributions, which commercial providers of large models generally do not expose, and it requires running the teacher on every training token, which is expensive. In 2016 Yoon Kim and Alexander Rush introduced sequence-level knowledge distillation for neural machine translation. Instead of matching token-level distributions, the student is trained on complete output sequences generated by the teacher. The teacher translates the training corpus, and the student learns from the teacher's translations rather than from the original human references. Kim and Rush found that this simple approach worked remarkably well, in some cases allowing much smaller students to approach teacher quality, and that the teacher's outputs were often easier for the student to learn than the human references because they were more consistent and less idiosyncratic. Sequence-level distillation is, in modern terms, simply training on synthetic data generated by a teacher. Every instruction-tuning dataset written by a large model and used to fine-tune a small one is an instance of it. The term "distillation" has broadened accordingly, and today it is used for almost any process in which a stronger model's outputs train a weaker one. The 2023 wave and its correction The period immediately after the release of ChatGPT saw an explosion of small open models fine-tuned on outputs from larger proprietary ones. Stanford's Alpaca used text-davinci-003 to generate 52,000 instruction-response pairs. Vicuna, from a group of university researchers, fine-tuned LLaMA on around seventy thousand user conversations with ChatGPT shared publicly through a browser extension. Koala, GPT4All, and many others followed. Their creators reported that the resulting models performed close to their teachers in human or GPT-4-judged comparisons, and the open-source community concluded, for a time, that the capabilities of proprietary models could be copied cheaply. The correction came quickly. In May 2023 Arnav Gudibande and colleagues at Berkeley published "The False Promise of Imitating Proprietary LLMs." They fine-tuned a series of base models of different sizes on increasing amounts of imitation data from ChatGPT and evaluated them both with crowd workers and with targeted benchmarks. Crowd workers rated the imitation models' outputs as competitive with ChatGPT. But on benchmarks measuring factual knowledge, coding, and problem solving, the imitation models closed little of the gap between their base models and ChatGPT, and adding more imitation data did little to help. What did help was a larger or better base model. The authors concluded that imitation was teaching the student ChatGPT's style — its confident tone, its structured formatting, its helpful framing — far more effectively than its underlying knowledge and capability, and that human evaluators were fooled by the style. This finding has held up and is perhaps the single most important caution in the distillation literature. A student fine-tuned on a teacher's outputs learns whatever is easiest to learn from those outputs, and surface form is much easier to learn than the knowledge and reasoning that produced it. Evaluations that rely on judges, human or model, who are themselves influenced by style will systematically overstate how much the student has learned. Capability must be measured with tasks that have verifiable answers and that cannot be passed by stylistic imitation. The Berkeley result also clarified what distillation can and cannot do in a narrow domain. When the goal is a specific, well-defined task, a small model can absorb most of what a teacher knows about that task, because the task's knowledge requirement is small enough to fit in the student's capacity. When the goal is broad general capability, the student's capacity and pretraining knowledge set a ceiling that imitation data cannot raise. Teaching the reasoning, not just the answer A second line of research asked whether students would learn more if teachers showed their working. If the teacher's outputs include not only answers but explanations of how it reached them, the student may learn the reasoning process rather than just the input-output mapping. Microsoft's Orca, published by Subhabrata Mukherjee and colleagues in 2023, applied this idea at scale. Rather than collecting short answers from the teacher, the Orca team prompted GPT-4 and ChatGPT with system instructions such as "explain like I'm five," "think step by step," and "justify your answer," producing millions of responses rich in explanation. They called the approach explanation tuning. The resulting thirteen-billion-parameter student performed substantially better on reasoning-heavy benchmarks than students trained on the same tasks with plain answers. A follow-up, Orca 2, went further by teaching the student to choose among different reasoning strategies depending on the task, using a technique the authors called prompt erasure: the teacher was given detailed strategy instructions when generating data, but those instructions were removed from the student's training inputs, so the student had to learn to select the strategy on its own. Around the same time, Cheng-Yu Hsieh and colleagues at the University of Washington and Google published "Distilling Step-by-Step," which treated teacher-generated rationales as an additional training signal in a multi-task setup. The student was trained both to predict the answer and to generate the rationale, as separate tasks. They reported that a 770-million-parameter T5 student trained this way could outperform the 540-billion-parameter PaLM teacher, used few-shot, on certain benchmarks, while using less labelled data than standard fine-tuning required. The result illustrates how much a narrow student can gain when the teacher's reasoning is made explicit. The most consequential application of rationale distillation came in early 2025. DeepSeek released R1, a reasoning model trained largely through reinforcement learning to produce long chains of thought before answering. Alongside it, the company released a series of much smaller models, from 1.5 billion to 70 billion parameters, based on open Qwen and Llama models and fine-tuned on around 800,000 samples generated by R1. The distilled models showed large gains on mathematics and coding benchmarks relative to their base models, and the developers reported that distillation from the large reasoning model was more effective for small models than applying the same reinforcement learning process to the small models directly. The finding suggested that the reasoning patterns discovered by a large model through expensive reinforcement learning could be transferred to small models through comparatively cheap supervised fine-tuning on synthetic traces. The reasoning-trace approach inherits the verification problem of Chapter 5. Teacher rationales are not guaranteed to be correct, and a rationale that reaches a correct answer may contain flawed steps. The R1 distillation data was filtered for correctness of final answers and, according to the developers, for readability and language consistency, but chains of thought thousands of tokens long contain many steps that no automated check examined. Students trained on such data learn both the valid reasoning patterns and the invalid ones. The strongest results come from pipelines that check final answers rigorously, discard traces with detectable errors, and prefer shorter correct traces to longer ones where possible. Choosing what to transfer Table 4 compares the main variants of teacher-student transfer used in current practice, and the conditions under which each is appropriate. Table 4. Main forms of teacher-student transfer. Method What the student learns from Teacher access needed Strength Main limitation Logit distillation Full next-token distributions Internal probabilities Richest signal per example Rarely available for closed models Response imitation Teacher's final responses Generation only Simple and cheap Transfers style more than capability Explanation or rationale tuning Teacher's step-by-step reasoning Generation only Better transfer of reasoning Flawed steps are learned too Verified-trace distillation Reasoning traces filtered by answer checks Generation plus verifier Higher correctness of kept data Limited to checkable domains On-policy distillation Teacher's corrections of student outputs Generation or scoring on student outputs Targets student's actual errors Costlier; needs repeated teacher calls The last row deserves explanation. In all the other methods, the student learns from examples the teacher produced. But at deployment time, the student generates from its own distribution, which differs from the teacher's. A student that has only ever seen the teacher's flawless outputs never learns what to do after it makes a mistake, because it never saw a mistake. This mismatch between training on teacher outputs and generating from the student's own outputs is sometimes called exposure bias. On-policy distillation addresses it by having the student generate, then having the teacher score or correct the student's outputs, and training the student on the teacher's feedback about its own generations. Methods of this kind, explored under names such as generalised knowledge distillation, have shown gains over pure imitation, particularly for smaller students whose outputs diverge most from the teacher's. The capacity gap One counterintuitive finding complicates the simple picture that a bigger teacher is always better. Several studies have observed that when the gap in capacity between teacher and student is very large, distillation can be less effective than distilling from a moderately larger intermediate teacher. The student may be unable to represent the teacher's complex functions, and the teacher's outputs may rely on knowledge or reasoning steps the student cannot reproduce, so the student learns an approximation that is worse than what it could have learned from a teacher closer to its own level. A 2020 paper by Seyed Iman Mirzadeh and colleagues proposed "teacher assistants" — intermediate models used as bridges — to address this. In language model practice, the effect appears as students that produce teacher-like reasoning traces confidently but incorrectly, imitating the structure of reasoning they cannot actually perform. The practical consequence is that teacher selection should be an empirical question. For a given student and task, it is worth testing whether a moderately strong teacher produces better student results than the strongest available, and whether the teacher's outputs should be simplified — shorter explanations, fewer steps, less specialised vocabulary — to match what the student can absorb. This connects distillation back to curriculum: the best teaching data is pitched at the learner's level, not the teacher's. Licensing, terms of service, and provenance Distillation from proprietary models raises legal questions that practitioners cannot ignore. The terms of service of major commercial model providers have, at various times, prohibited using their outputs to develop models that compete with the provider's own. The precise wording varies between providers and has changed over time, and the enforceability of such terms is not settled law. But an organisation that builds a commercial product on a student distilled from a proprietary teacher in violation of the teacher's terms exposes itself to contractual risk, and possibly to reputational harm if the practice becomes public. Open-weight models with permissive licences offer an alternative, though their licences too may contain conditions, including attribution requirements or restrictions on use above certain scales. Some open model licences have required that derivative models trained on their outputs carry a particular naming convention or licence. The safest practice is to record, for every synthetic dataset, which model generated it, under what licence and terms, and on what date, and to have that record reviewed before the resulting student is deployed commercially. Chapter 11 returns to provenance as part of governance. There is also a quieter provenance question. A student trained on a teacher's outputs inherits the teacher's biases, errors, and value judgements, along with any content the teacher reproduced from its own training data. If the teacher was trained on copyrighted material and reproduces fragments of it, those fragments may appear in the student's training data. If the teacher has a systematic political or cultural slant, the student will acquire it. Choosing a teacher is choosing a set of inherited properties, and those properties should be examined deliberately rather than discovered after deployment. What distillation actually transfers The evidence across these studies supports a clear account of what distillation through synthetic data can achieve. It transfers style reliably and quickly. A few thousand examples are enough to make a student sound like its teacher. It transfers narrow task competence well, provided the task is within the student's capacity and the teacher's outputs are verified. A small student can approach or even exceed a large teacher on a specific, well-defined task, because the student is specialised while the teacher's capacity is spread across everything. It transfers reasoning patterns partially, especially when the teacher's reasoning is made explicit and filtered for correctness. The gains are largest in domains such as mathematics and code where verification is possible. It does not reliably transfer broad knowledge. A student cannot learn facts its capacity cannot hold, and fine-tuning on facts it did not acquire in pretraining may increase its tendency to hallucinate. And it does not transfer anything the teacher does not have. Distillation is a redistribution of capability, not a creation of it. The only way a student exceeds its teacher on a task is by specialisation, by verification filtering out the teacher's mistakes, or by combining multiple teachers whose strengths differ. Each of those routes runs through the verifier. Chapter 9. Bootstrapping a Small Domain Model The previous chapters described the components of a synthetic data system in isolation: generation, curriculum, verification, filtering, and transfer from teacher to student. This chapter assembles them into a single pipeline for the task that most organisations actually face. They have a specific problem, a modest amount of real data, a budget that does not stretch to running a frontier model on every request, and constraints — privacy, latency, cost, or regulatory — that push toward a small model they control. They want to use a large model to teach a small one. To keep the discussion concrete, the chapter follows a single illustrative case throughout. It is a composite, built from the common shape of such projects rather than from any one organisation's experience, and the quantities in it are illustrative rather than reported results. A mid-sized property insurer receives tens of thousands of emails, letters, and web-form submissions from policyholders each month. Each must be read, classified by type (new claim, update to an existing claim, complaint, policy question, cancellation request, and so on), and have key fields extracted: policy number, date of loss, type of damage, estimated value, whether there are injuries, whether the customer is vulnerable in any of the senses the regulator defines. Human handlers currently do this triage. The insurer wants a model to do a first pass, routing routine items automatically and flagging uncertain or sensitive ones for human review. The correspondence contains personal and sometimes medical information, so the insurer's data protection officer will not permit it to be sent to an external model provider. The model must run on the insurer's own infrastructure. Latency must be low enough to process the inbox continuously. A model of a few billion parameters, fine-tuned for the task, is the target. Stage one: define the task and build the evaluation set first The most common mistake in bootstrapping projects is to start by generating data. The first step is to define precisely what the model must do and to build a test set of real examples against which every later decision will be measured. For the insurer, this means writing a specification: the list of categories with definitions and boundary cases, the list of fields with formats and rules for ambiguous situations, and the policy for when the model should defer to a human. Writing the specification usually reveals disagreements among experienced handlers about how particular cases should be treated. Those disagreements must be resolved before any data is generated, because a synthetic pipeline will faithfully reproduce whatever ambiguity the specification contains. Next, a sample of real correspondence is drawn — a few hundred items is often enough to start, chosen to cover the range of categories, channels, and difficulties — and labelled carefully by experienced handlers according to the specification. Items on which two handlers disagree are discussed and resolved. This labelled sample is divided in two. One part, perhaps a fifth, is set aside as a seed set that can inform generation. The rest becomes the held-out evaluation set, which is never shown to the generator, never used for training, and consulted only to measure progress. The evaluation set is the anchor for the entire project. Every claim that a synthetic dataset is good, that a filter helps, or that a student has learned, is a claim about performance on this set. If it is too small, the measurements will be noisy. If it is unrepresentative — drawn only from easy cases or from a single month — the measurements will mislead. If it leaks into training, the measurements will be worthless. It should be stored separately from everything else, with access controlled, and its composition documented. Because the evaluation set is drawn from real, sensitive correspondence, it must be handled under the insurer's normal data protection controls. Using real data for evaluation, within the organisation's secure environment, is generally far less problematic than using it to train a model that may be widely deployed, and it is essential. Synthetic data cannot be validated against synthetic data. Stage two: establish baselines Before any synthetic data is created, two baselines are measured on the evaluation set. The first is the teacher's performance. A capable large model — run within the insurer's environment if an open-weight model is used, or on carefully de-identified examples if a hosted model is permitted for development — is prompted with the specification and a handful of examples and asked to perform the task on each item in the evaluation set. Its accuracy on classification and extraction sets a realistic upper bound for what the student can learn from it. If the teacher itself performs poorly, distillation will not rescue the project, and effort is better spent improving the specification, the teacher prompt, or the choice of teacher. The second baseline is the untrained student: the small base model, prompted the same way, without fine-tuning. This establishes how much the fine-tuning must add. It also reveals the student's specific weaknesses — perhaps it handles classification reasonably but fails badly at extracting dates from free text — which will shape the curriculum. For the insurer, suppose the teacher classifies most items correctly and extracts most fields accurately but struggles with letters that discuss multiple claims and with recognising indicators of customer vulnerability. The base student does considerably worse across the board. The gap between them is what distillation is meant to close, and the teacher's weak spots are where its outputs will need the closest verification. Stage three: generate inputs before outputs A synthetic dataset for this task needs two things: realistic input documents and correct outputs for them. It is tempting to generate both at once — asking the teacher to write a customer email and its correct classification together — but separating them is more robust. Synthetic inputs are generated using the techniques of Chapter 4. An attribute grid is derived from the specification and from close reading of the seed set: claim type, peril (flood, fire, theft, storm, escape of water, subsidence), channel, length, writing proficiency, emotional state, presence of multiple issues, presence of vulnerability indicators, presence of extraneous information, and whether the customer has made a factual error such as quoting the wrong policy number. Personas add realistic variation: an elderly widower writing his first claim, a landlord with several properties, a small business owner whose premises have flooded, a customer whose first language is not English. Real seed examples, with identifying details removed, are included in prompts as style references, so that the synthetic letters capture the texture of real correspondence — the spelling errors, the digressions, the forwarded email chains, the scanned form text with recognition errors. Each synthetic input is generated with its intended attributes recorded. Those attributes are not yet the ground-truth labels. They are what the generator was asked to produce, which may differ from what it actually produced. A letter requested as "a complaint with a vulnerability indicator" may, on reading, contain no clear indicator. Stage four: label with the teacher, verify independently Synthetic inputs are then labelled by the teacher, using the same prompt that produced the teacher baseline. For each input, the teacher outputs a classification, extracted fields, and a confidence assessment. Verification compares the teacher's labels against several independent signals. Consistency with generation attributes: if the input was generated as a flood claim and the teacher labels it a fire claim, either the generator or the teacher erred. Disagreements are flagged. Self-consistency of the teacher: the teacher labels each input several times with sampling enabled. Items where its outputs vary are flagged as uncertain. Rule-based field checks: policy numbers must match the insurer's format; dates must be valid and not in the future; monetary values must be plausible for the claim type. Extracted fields that fail these rules are flagged. Cross-model agreement: a second large model from a different family labels the same inputs. Disagreements are flagged. A judge with a rubric: for the most consequential fields — vulnerability indicators, injury mentions — a judge model is given the specification's definitions and asked whether each label is justified by specific text in the input, citing the text. Items that pass all checks are accepted with their labels. Items that fail one or more are either discarded or routed for human review. Human review is expensive, so it is concentrated where it matters most: on the categories where the teacher was weakest at baseline, and on vulnerability and injury flags, where errors carry regulatory consequences. A sample of accepted items, perhaps a few hundred, is also reviewed by handlers to estimate the residual error rate, as described in Chapter 7. If that rate is too high in some category, the verification for that category is tightened, and the loop runs again. Stage five: shape the curriculum The verified dataset is not used as a single undifferentiated pile. It is organised to match the student's learning needs. Difficulty is estimated empirically, by running the base student on each verified item and recording whether it gets the classification and fields right. Items the base student already handles are kept in modest proportion, to prevent it forgetting them, but are not emphasised. Items it fails are the core of the training set. Items that even the teacher found hard — those that required human review to label — are especially valuable and may be augmented with further variations generated around the same attributes. Rare categories are deliberately oversampled. The insurer's real inbox may contain cancellation requests from bereaved relatives only rarely, but the model must handle them sensitively, so the synthetic set includes many of them. The oversampling is recorded, because it means the student's prior over categories will differ from reality, and its confidence scores may need recalibrating on real data before deployment. Unanswerable and deferral examples are included. Some synthetic inputs are generated to be genuinely ambiguous — a letter that might be a complaint or a new claim, with insufficient information to tell — and their correct label is a deferral to human review. Some are generated with missing fields, and the correct output is to mark those fields as absent rather than inventing them. These examples teach the student when not to answer, which is essential for a triage system whose value depends on routing uncertain cases to humans. Stage six: train, evaluate, and iterate The student is fine-tuned on the curriculum and evaluated on the held-out real set. The evaluation reports overall accuracy, per-category accuracy, per-field extraction accuracy, the rate of appropriate deferrals, and — critically — the rate of confident errors, where the student gives a wrong answer without deferring. For a triage system, a confident error is the most costly outcome, because it bypasses human review. The first round almost always reveals specific failures. Perhaps the student handles letters well but performs poorly on web-form submissions, whose terse, structured format was under-represented in the synthetic inputs. Perhaps it extracts dates accurately when they are written in full but fails on informal references such as "last Tuesday." Perhaps it defers too often on complaints, because the synthetic complaints were all ambiguous in the same way. Each failure is traced to its source. Was the relevant kind of input missing from the synthetic data? Was it present but mislabelled by the teacher and missed by verification? Was it present and correctly labelled but too rare for the student to learn? The answer determines the fix: generate more of the missing kind, tighten verification on the mislabelled kind, or upweight the rare kind. A new round of generation, verification, and training follows. Experienced practitioners find that this loop, run several times, accounts for most of the improvement. The first synthetic dataset is rarely good. The fourth, shaped by three rounds of diagnosis against real data, often is. Stage seven: monitor in deployment A deployed student encounters a distribution that shifts over time. A major storm produces a surge of correspondence about a single peril. A new product line introduces unfamiliar terminology. A change in the claims process alters what customers write about. A synthetic dataset frozen at training time cannot anticipate any of these. Deployment monitoring therefore extends the verification architecture into production. A sample of the student's live decisions is reviewed by handlers regularly. Items the student deferred are labelled by handlers in the normal course of their work, and those labels are collected. The student's confidence distribution and deferral rate are tracked, because sudden changes signal distributional shift. When enough new real examples accumulate, they are added to the evaluation set, and when the evaluation shows degradation, the synthetic pipeline is run again with the new examples as seeds. Over time, the balance between synthetic and real data in the system shifts. Early on, the student is trained mostly on synthetic data, because real labelled data is scarce. As deployment generates real labels through human review of deferred and sampled items, real data becomes more plentiful, and the synthetic data's role narrows to covering rare cases and new situations that real data has not yet reached. This is the healthy trajectory for a bootstrapped model: synthetic data as scaffolding that is gradually replaced by the real structure it was built to support, rather than a permanent substitute for it. Common failure patterns Several failure patterns recur across bootstrapping projects regardless of domain. The synthetic inputs are too clean. Generators produce well-written, well-organised text unless pushed hard not to. Real correspondence is messy. A student trained on clean synthetic inputs fails on messy real ones. The remedy is to use real seed examples as style anchors, to generate deliberate noise such as typos, recognition errors, and forwarded chains, and to check synthetic inputs against real ones for stylistic coverage using the embedding-cluster method of Chapter 4. The teacher's errors are correlated with the student's needs. Teachers make the most mistakes on the hardest cases, which are exactly the cases the student most needs to learn. Verification that is uniform across the dataset will let disproportionate errors through on hard cases. Verification effort must be concentrated where the teacher is weakest. The evaluation set is too easy. If the held-out real set was sampled uniformly, it is dominated by routine items, and overall accuracy will look good even if the student fails on every rare and important case. Stratified evaluation, with explicit sub-scores for rare and high-stakes categories, is essential. Synthetic and real data are evaluated together. If some synthetic examples are inadvertently included in the evaluation set, or if the evaluation set was used to tune generation prompts too directly, scores will be inflated. The evaluation set must be protected from every stage of the pipeline that could adapt to it. The specification drifts. As the project proceeds, handlers refine their understanding of edge cases, but the refinements are not written back into the specification, and different stages of the pipeline use different versions of it. Version control for the specification, as for code, prevents this. The economics of the bootstrap The economic logic of the approach rests on a simple asymmetry. Generating and verifying synthetic data costs money once, during development. Running the teacher on every production request costs money continuously. If the student can match the teacher's performance on the task, the up-front investment in synthetic data is repaid by the lower cost, lower latency, and greater control of running the student. The investment is not trivial. The largest single cost is usually expert time: writing the specification, labelling the evaluation set, reviewing flagged items, and diagnosing failures. Model inference for generation and verification is typically much cheaper than that expertise. This reinforces a theme from Chapter 1. In a synthetic data project, human expertise is most valuable not at the point of producing individual labels but at the points where it shapes the verifier: the specification that defines correctness, the evaluation set that measures it, and the review that calibrates the automated checks. The generator is the cheap part. Chapter 10. Recursion, Collapse, and the Polluted Commons Every technique in this book involves a model learning from the outputs of another model. In the simplest cases, the chain has one link: a teacher generates, a student learns, and the student is deployed. But chains grow. The student becomes the teacher for the next generation. A model generates data that trains an improved version of itself, which generates better data, which trains a further improved version. And beyond any single organisation's pipeline, the open web — the source of most pretraining data — is filling with text written by language models, which future models will scrape and train on whether their developers intend it or not. What happens to models trained on the outputs of models, generation after generation? The question has been studied intensively since 2023, and the answer has become clearer, if not entirely settled. Uncontrolled recursion degrades models in a specific and predictable way, starting at the edges of the distribution and working inward. But the degradation is not inevitable. It depends on what happens to real data in the loop, and on whether something outside the generator decides which synthetic data survives. The findings are a sharp confirmation of the argument that verification, not generation, is the architecture. The collapse result The study that brought the problem to wide attention was published in Nature in July 2024 by Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal, under the title "AI models collapse when trained on recursively generated data." An earlier version had circulated in 2023 under the memorable title "The Curse of Recursion." The authors examined several types of model — Gaussian mixture models, variational autoencoders, and a small language model fine-tuned on a Wikipedia-derived text corpus — in a setting where each generation was trained only on data generated by the previous generation. In every case, they observed a characteristic pattern of degradation they called model collapse. In the early stage, the model loses information about the tails of the distribution: rare events, unusual words, minority patterns. This happens because each generation's training data is a finite sample from the previous model, and finite samples under-represent low-probability regions. Events that the previous model assigned small but non-zero probability may simply not appear in the sample, and the next model, never seeing them, assigns them even lower probability. Over generations, the tails thin and vanish. In the late stage, the distribution converges toward something narrow that bears little resemblance to the original. Variance shrinks. The model produces an increasingly limited range of outputs, and errors in the approximation at each step compound into distortions. In the language model experiments, later generations produced text that drifted toward repetitive phrases and, eventually, sequences unrelated to the original prompts. The authors identified three sources of error that compound across generations. Statistical approximation error arises because each generation sees only a finite sample. Functional expressivity error arises because the model cannot perfectly represent the true distribution. Functional approximation error arises because training procedures do not find the best possible model even within what is expressible. Each source alone would cause drift; together, applied recursively without correction, they drive collapse. Model autophagy A complementary study by Sina Alemohammad and colleagues at Rice University and Stanford, first circulated in 2023 and presented at the International Conference on Learning Representations in 2024, examined the same phenomenon in image generators under the name "Model Autophagy Disorder," borrowing the analogy of mad cow disease, which spread when cattle were fed the remains of other cattle. Their contribution was to distinguish several kinds of self-consuming loop. In a fully synthetic loop, each generation trains only on outputs of the previous one. In a synthetic augmentation loop, each generation trains on a fixed set of real data plus synthetic data from the previous generation. In a fresh data loop, each generation trains on synthetic data plus a new sample of real data that it has not seen before. They found that fully synthetic loops degraded consistently. Synthetic augmentation loops with a fixed real dataset delayed degradation but did not prevent it. Only fresh data loops, with sufficient new real data in each generation, avoided progressive decline. They also identified the effect of sampling bias. When generators are sampled in a way that favours higher-quality outputs — lower temperature, truncation, or cherry-picking — each generation's output looks better, but diversity falls faster. Quality and diversity trade against each other, and a loop that optimises for apparent quality accelerates the loss of variety. The accumulation correction A 2024 paper by Matthias Gerstgrasser and colleagues, titled "Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data," pointed out that the experimental setup in many collapse studies made a specific assumption: that each generation's data replaced the previous generation's. In practice, data is rarely thrown away. Real-world datasets grow by accumulation. The original human data remains available, and synthetic data from each generation is added to it rather than substituting for it. Testing this alternative setup with language models, diffusion models, and other generative models, they found that when data accumulates — so that each generation trains on the original real data plus all synthetic data produced so far — test error remains bounded rather than growing without limit. They supported this with a theoretical analysis of a simplified linear model, showing that under replacement error grows linearly with the number of generations, while under accumulation it is bounded by a constant. The intuition is that the original real data continues to anchor every generation, and each new batch of synthetic data is a diminishing fraction of the whole. This finding reframed the collapse debate. Collapse is not an inevitable consequence of training on synthetic data. It is a consequence of losing contact with real data. As long as real data remains in the training mixture, and synthetic data supplements rather than displaces it, recursive training appears to be stable, at least in the settings tested. Verification as the brake A further line of work asked whether selection could do what accumulation does. In a 2024 paper presented at the International Conference on Learning Representations in 2025, Yunzhen Feng, Elvis Dohmatob, and colleagues studied the effect of verification on recursive training under the title "Beyond Model Collapse: Scaling Up with Synthesized Data Requires Verification." Their question was whether filtering synthetic data through a verifier, even an imperfect one, could prevent the degradation seen in unfiltered loops. They found that it could. When synthetic data was selected by a verifier that preferred correct or higher-quality examples, models trained on it could avoid the collapse that unfiltered training produced. They analysed the effect theoretically in an idealised setting with simple classifiers and verifiers, and tested it in experiments in which transformers learned to compute matrix eigenvalues and language models learned to summarise news, proposing a measurable proxy for verifier quality that tracked downstream performance. The key insight is that the verifier injects information from outside the generator's distribution. Each round of selection corrects some of the errors that would otherwise compound, functioning as a source of external signal much as fresh real data does. This finding unifies the collapse literature with the book's central argument. Recursive training degrades because each generation's errors are passed to the next without correction. Anything that injects correction — fresh real data, accumulated original data, or a verifier that encodes knowledge the generator lacks — can halt or reverse the degradation. What cannot halt it is more generation. Table 5 summarises the main studies and their implications. Table 5. Key studies on recursive training with synthetic data. Study Setting Main finding Practical implication Shumailov et al., Nature, 2024 Each generation trained only on previous generation's output Tails vanish first; distribution narrows and distorts Pure recursion without real data is harmful Alemohammad et al., ICLR 2024 Fully synthetic, fixed-real, and fresh-real loops for image models Only sufficient fresh real data prevents decline; quality-biased sampling speeds diversity loss Keep injecting new real data; watch diversity Gerstgrasser et al., 2024 Accumulating rather than replacing data across generations Error stays bounded when original data is retained Never discard the real anchor Feng et al., ICLR 2025 Synthetic data filtered by a verifier before retraining Verification, even imperfect, can prevent collapse Selection quality governs recursive gains What happens to the tails The detail that collapse begins in the tails deserves emphasis, because it has consequences long before any dramatic degradation is visible. A model trained even partly on synthetic data, without care, may perform well on average while quietly losing competence on rare cases: uncommon languages, minority dialects, unusual medical presentations, rare legal situations, niche technical topics. Average benchmark scores will not reveal this, because averages are dominated by common cases. A related theoretical analysis by Elvis Dohmatob and colleagues in 2024, "A Tale of Tails," modelled the effect as a change in scaling laws. Training on synthetic data that has lost its tails means that adding more data stops improving performance at the rate expected, because the additional data does not contain the rare patterns that further learning would require. The model plateaus, and no quantity of tail-less synthetic data will move it. For practitioners, the implication is that evaluation must deliberately probe the tails. Stratified evaluation sets, with explicit coverage of rare categories, are the only reliable way to detect tail loss before it reaches deployment. This connects directly to the evaluation design of Chapter 9 and the governance practices of Chapter 11. It also connects to fairness. The groups and situations that are rare in a dataset — linguistic minorities, people with uncommon conditions, small communities — are precisely those whose representation is first to erode under recursive training. A synthetic pipeline that is careless about tails is, in effect, a mechanism for progressively forgetting minorities. The polluted commons The collapse studies concern deliberate, controlled loops. A larger and less controllable loop is forming in the open web. Since the public release of capable chat models at the end of 2022, the volume of machine-generated text online has grown rapidly: in marketing copy, product descriptions, search-optimised articles, social media posts, forum answers, and translations. Some is labelled as machine-generated; most is not. Future web crawls will contain a growing share of this material, and models trained on them will be training partly on outputs of earlier models whether or not their developers intend it. The concern is not hypothetical. Researchers have noted that some question-answering and crowdsourcing platforms saw growing proportions of model-written contributions after 2022, and that crowd workers asked to perform annotation tasks sometimes used language models to complete them, contaminating datasets meant to capture human judgement. Several responses are emerging. One is to place greater value on data known to predate widespread generative models. Text collected before late 2022 has been compared, in a widely used analogy, to the "low-background steel" salvaged from ships sunk before atmospheric nuclear testing, valued because it is free of radioactive contamination. Archives of older web crawls, books, and other pre-generative-era sources may become more valuable as a result. A second is detection. Classifiers that attempt to distinguish human from machine text exist, but their reliability is limited, they can be evaded by paraphrasing, and they have been shown to misclassify text by non-native English writers as machine-generated at elevated rates. Detection is a useful signal in aggregate but an unreliable filter for individual documents. A third is provenance at the point of creation. Watermarking schemes embed statistical signals in generated text that can later be detected by someone who knows the key. Google DeepMind has deployed a text watermarking system called SynthID for some of its products, and has described the method publicly. Content provenance standards such as those developed by the Coalition for Content Provenance and Authenticity attach signed metadata to media recording how it was produced. These approaches work only for content from cooperating providers and can be stripped or degraded, but they offer a better foundation than post-hoc detection. A fourth is to treat the web as just another unverified generator. If future web text is a mixture of human and machine content of unknown proportions, then it should be subjected to the same filtering and verification as deliberately generated synthetic data: quality classifiers, deduplication, grounding checks where possible, and evaluation against trusted real data. This reframes the polluted commons not as a new problem but as an extension of the old one. Living with recursion The evidence supports a set of principles for any system in which models learn from model outputs. Never discard the real anchor. Original human data should remain in the training mixture across generations, accumulated rather than replaced. If it must be reduced in proportion, it should not be reduced to zero. Inject fresh real data where possible. New samples of real data, collected after each generation, provide the strongest protection against drift. Verify before reuse. Synthetic data should pass through a verifier before it trains the next generation, and the verifier should encode knowledge the generator lacks. Unverified recursive generation is the configuration in which collapse is best documented. Monitor diversity explicitly. Average quality can rise while diversity falls. Track diversity metrics across generations and treat a decline as a warning, even when headline benchmarks improve. Probe the tails. Evaluate on stratified sets that cover rare cases, and treat degradation on those cases as the leading indicator of collapse. Record provenance. Know which data is real, which is synthetic, and which generation of which model produced it. Without this, none of the other principles can be applied. The lesson of the collapse literature is not that synthetic data is dangerous. It is that synthetic data without an external anchor is dangerous, and that the anchor can take the form of real data, a verifier, or both. Every system that has used synthetic data successfully at scale has had one. The ones that degrade are the ones that forgot it was needed. Chapter 11. Validation and Governance A synthetic dataset is a manufactured artefact, and like any manufactured artefact used in a consequential system, it needs quality assurance, documentation, and accountability. The previous chapters described how to generate and filter synthetic data. This chapter addresses the questions that come after: how to establish that a synthetic dataset actually does what it was meant to do, how to record what was done so that others can understand and reproduce it, and how to govern the pipeline so that its outputs can be trusted over time. These questions are often treated as administrative overhead, attended to after the technical work is done. That is a mistake. Validation determines whether the technical work succeeded, and documentation determines whether anyone can tell. A synthetic data pipeline without rigorous validation is an untested hypothesis. One without documentation is a black box that cannot be audited, debugged, or safely modified. Three levels of validation Validation of a synthetic dataset operates at three levels, each answering a different question. The first level is intrinsic: does the synthetic data have the properties it was designed to have? This includes the checks applied during filtering — correctness, grounding, toxicity, format — but measured on the final dataset rather than applied to individual candidates. It also includes distributional properties: whether the composition across attributes matches the target, whether diversity metrics are within expected ranges, whether duplicates and benchmark contamination have been removed. Intrinsic validation is necessary but not sufficient. A dataset can have every intended property and still fail to train a good model. The second level is comparative: how does the synthetic data relate to the real data it supplements or replaces? For privacy-motivated synthesis, this means the fidelity and privacy measurements described in Chapter 3. For training data, it means comparing the synthetic distribution with real data along the dimensions that matter: topic coverage, style, difficulty, length, the presence of rare cases. The embedding-and-cluster method from Chapter 4 is one tool. Another is to train a classifier to distinguish synthetic from real examples. If the classifier succeeds easily, the features it relies on reveal how the synthetic data differs, and those differences may be ones the student will learn. If the classifier cannot distinguish them, that is reassuring, though not conclusive, since the classifier may not be sensitive to the differences that matter for the downstream task. The third and decisive level is extrinsic: does a model trained on the synthetic data perform well on the real task? This is measured on a held-out real evaluation set, as described in Chapter 9. No intrinsic or comparative measure can substitute for it, because the purpose of training data is to produce a capable model, and the only direct test of capability is performance on real inputs. Ablation: measuring what each component contributes Extrinsic validation tells you whether the final dataset works. It does not tell you why, or which parts of the pipeline are responsible. For that, ablation is needed: training models with and without particular components and comparing their performance. The most basic ablation compares a model trained on synthetic data with one trained on the same quantity of real data, if real data is available in sufficient quantity, and with one trained on real data alone at whatever quantity exists. This establishes whether the synthetic data helps at all, and by how much. Further ablations isolate the effect of each pipeline stage. Training on unfiltered versus filtered synthetic data measures the value of the filter. Training with and without a particular verifier measures that verifier's contribution. Training on synthetic data generated with and without attribute grids or personas measures the value of diversity engineering. Training on curriculum-ordered versus randomly ordered data measures the curriculum effect. Each ablation costs a training run, so small models and limited budgets are often used for ablations, on the assumption that relative effects observed at small scale will hold at larger scale. That assumption usually holds approximately but should be checked at least once at the target scale. Ablations frequently produce surprises. A filter thought to be essential turns out to make no difference. A diversity technique turns out to hurt, because it introduced more errors than variety. Removing half the synthetic data turns out to improve performance, because the removed half was lower quality. Without ablations, these facts remain unknown, and the pipeline accumulates expensive components whose value is assumed rather than demonstrated. A related practice is data attribution: estimating how much each training example, or each subset, contributes to the model's performance on particular evaluation items. Techniques such as influence functions and data models attempt this, though they remain expensive and approximate at the scale of modern language models. Simpler approaches — training on subsets defined by generation attributes and comparing results — give much of the practical value at lower cost, and they are made possible by the attribute metadata recommended in Chapter 4. Evaluation that cannot be gamed Because synthetic data is generated by models that may have seen public benchmarks, and because synthetic pipelines can be tuned, consciously or not, toward whatever the evaluation measures, the integrity of evaluation needs special protection. Several practices help. Private held-out sets, never published and never used for any purpose other than final evaluation, are the strongest protection. Their composition should be documented internally, but their contents should be accessible only to the evaluation process. Benchmarks created after the generator's training cutoff reduce the chance that the generator has seen them. Decontamination, as described in Chapter 7, removes overlaps between synthetic training data and evaluation sets. And evaluating on several independent sets, rather than one, makes it harder for a pipeline to overfit to the quirks of any single set. The style-versus-substance problem from Chapter 8 also bears on evaluation. Evaluations judged by humans or by LLM judges are susceptible to rewarding a student that has learned to sound like its teacher without having learned its capabilities. Evaluations with verifiable answers — task accuracy on real inputs, extraction correctness, code that passes hidden tests — are much harder to fool. A synthetic data project should report results on at least one evaluation of this kind, and should treat judge-based scores as supplementary rather than primary. Documenting synthetic data The machine learning community has developed several documentation standards for datasets and models, and they apply to synthetic data with some extensions. The 2018 proposal "Datasheets for Datasets" by Timnit Gebru and colleagues set out a series of questions that a dataset's creators should answer: why it was created, what it contains, how it was collected, how it was preprocessed, what it should and should not be used for, how it will be maintained. "Model Cards for Model Reporting," proposed by Margaret Mitchell and colleagues in 2019, did the same for trained models, emphasising evaluation across subgroups and intended uses. For synthetic data, a datasheet should additionally record the full generation lineage: which generator model or models were used, with versions; the prompts, templates, and attribute grids; the seed data, if any, and its source; sampling parameters; every filtering and verification stage, with thresholds; the acceptance rate at each stage; the residual error rate estimated by human review, with the sample size and method; and the dates of generation. It should record the licence and terms under which each generator was used. It should record which portion of the dataset, if any, consists of real data, and how real and synthetic portions were combined. And it should record known limitations: categories where the generator was weak, attributes that were deliberately over- or under-sampled, failure modes that the filters are known not to catch. This record serves several purposes. It allows the dataset to be reproduced, or at least approximated, if needed. It allows downstream users to judge whether the dataset is appropriate for their purposes. It allows auditors and regulators to assess compliance. And it allows the creators themselves, months later, to diagnose problems that emerge in deployment by tracing them back to specific generation choices. Lineage and provenance tracking Documentation at the dataset level is necessary but not sufficient for complex pipelines. When synthetic data from several generators is combined, when filtered data from one project is reused in another, and when models trained on synthetic data are used to generate further synthetic data, the lineage becomes a graph rather than a list. Tracking it requires recording provenance at the level of individual examples, or at least of batches. A practical approach attaches metadata to every synthetic example: a unique identifier, the generator and its version, the prompt template and attribute values, the verification results at each stage, and the identifier of the batch it belongs to. This metadata travels with the example through every subsequent use. When a model is trained, the training run records which batches it consumed. When that model generates data, its outputs carry a reference to the training run. The result is a provenance graph in which any example, or any model, can be traced back to its origins. Example-level provenance enables several capabilities that would otherwise be impossible. If a generator is later found to have a systematic flaw — a factual error it consistently makes, a bias, a licensing problem — every example it produced can be located and removed or re-verified. If a deployed model exhibits a harmful behaviour, the training examples most likely to have caused it can be identified and examined. If a regulator asks what proportion of a model's training data was synthetic, or which models generated it, the question can be answered precisely. And the anti-collapse principles of Chapter 10 — retaining real data, monitoring generations — require knowing which data is real and which generation produced each synthetic example. Regulatory context Regulation of AI training data is developing rapidly, and synthetic data occupies an ambiguous position within it. The European Union's AI Act requires providers of high-risk AI systems to apply data governance practices covering design choices, data collection processes and the origin of data, preparation operations such as labelling and cleaning, examination for possible biases, and identification of data gaps. These requirements apply to synthetic data as much as to collected data, and a synthetic pipeline's documentation should be designed to satisfy them. The Act also requires providers of general-purpose AI models to publish a sufficiently detailed summary of the content used for training, and the European Commission published a template for such summaries in 2025. Data protection law applies to synthetic data to the extent that it is personal data, which, as Chapter 3 discussed, depends on whether individuals can be identified from it. A synthetic dataset derived from personal data should be accompanied by an assessment of re-identification risk, ideally with formal privacy guarantees and empirical attack testing, documented in a form that a data protection authority could review. Sector-specific regulators add further requirements. In financial services, model risk management guidance, such as the United States Federal Reserve's SR 11-7 and comparable guidance elsewhere, requires validation of models and their data, including independent review. In healthcare, regulators assessing AI-based medical devices expect evidence about the training data's representativeness and quality. In each case, synthetic data does not exempt a model from scrutiny; it adds questions about how the synthetic data was validated. Organisational practices Beyond documentation and regulation, several organisational practices distinguish teams that use synthetic data well from those that do not. Separate generation from evaluation. The people or processes that generate and filter synthetic data should not be the only ones that evaluate the resulting models. Independent evaluation, by a team with its own held-out data and no stake in the pipeline's success, catches problems that the pipeline's builders are motivated to overlook. This mirrors the separation between development and validation in mature model risk management. Read the data. Automated metrics are indispensable at scale, but they measure only what their designers anticipated. Regular, structured human review of random samples of the synthetic data — not just the flagged examples, and not just the rejected ones — is the most reliable way to discover failure modes nobody thought to measure. Reviews should be scheduled, recorded, and acted on. Version everything. Prompts, templates, attribute grids, filter thresholds, verifier models, specifications, and evaluation sets should all be under version control, like code. A change to any of them can change the resulting dataset and model, and without versioning, the effect of changes cannot be traced. Budget for verification. Teams consistently underestimate the share of effort that verification requires. A reasonable starting assumption is that designing, calibrating, and maintaining verifiers, and reviewing their output, will take more effort than generation. Projects that budget otherwise tend to cut verification when time runs short, with predictable results. Plan for retirement. Synthetic datasets age. The generator that produced them is superseded by better models. The domain shifts. Errors are discovered. A dataset should have an owner responsible for maintaining it, a schedule for re-evaluation, and criteria for retiring or regenerating it. The audit question A useful test of a synthetic data pipeline's governance is to imagine an external auditor asking a series of questions. What proportion of the training data was synthetic? Which models generated it, under what terms? What verifiers were applied, and how were they calibrated? What is the estimated residual error rate, and how was it measured? What real data was the synthetic data validated against, and how was that real data protected from contamination? If a generator flaw were discovered tomorrow, how quickly could every affected example be located? What subgroups or rare categories were evaluated separately, and how did the model perform on them? A team that can answer all of these questions with evidence has a governed pipeline. A team that cannot has a pipeline whose outputs are trusted on faith. Given what the earlier chapters have shown about how synthetic data fails — through hallucinations that look correct, biases invisible at the level of individual examples, tails that vanish silently, style that masquerades as capability — faith is not a sufficient basis for deploying models in consequential settings. Validation and governance are the means by which the verifier's work, done once during construction, remains visible and checkable for as long as the resulting model is in use. Conclusion: Where the Knowledge Comes From Across eleven chapters, one question has recurred in different forms: when a model learns from synthetic data, where does the knowledge come from? The answer, assembled from the evidence, is more precise than the enthusiasm for synthetic data usually allows, and more encouraging than the warnings about collapse usually suggest. Some of the knowledge comes from the generator, but only knowledge the generator already had. A teacher model that knows how to classify insurance correspondence can pass that competence to a student, and a model that has absorbed the content of the web can rewrite it as clear textbook explanations that a small model learns from more efficiently. This is real value. It is redistribution and restructuring, not creation, and it is bounded by what the generator knows and by what the student has the capacity to absorb. The rest of the knowledge comes from outside the generator. It comes from the unit test that rejects a wrong program, the proof checker that rejects an invalid step, the symbolic engine that deduces geometric facts, the physics simulator that computes how a robot hand will move, the source document against which a summary's claims are checked, the human expert who wrote the specification and labelled the evaluation set, and the real data that anchors each generation against drift. Every striking success in synthetic data — AlphaGeometry's olympiad proofs, the reasoning gains of distilled models, the coherent stories of very small language models trained on carefully constrained corpora — rests on one of these external sources. Every documented failure — imitation models that sound capable and are not, recursive loops that forget the tails, privacy-motivated datasets that leak outliers — involves its absence. That is why this book has insisted that the verifier is the architecture. It is not a slogan about the relative importance of pipeline stages. It is a claim about epistemics. A generator, by itself, can only reshape what it already contains. Any genuinely new information that enters a synthetic dataset enters through whatever decides which candidates to keep. What follows for practice Several practical conclusions follow that could not have been drawn without the preceding detail. First, the choice of domain matters more than the choice of generator. Synthetic data delivers its largest and most reliable gains where strong verifiers exist: mathematics with checkable answers, code with executable tests, formal reasoning with proof checkers, structured extraction with validation rules. Where verification is weak — open-ended advice, nuanced judgement, specialised factual knowledge outside any trusted source — synthetic data delivers smaller and less reliable gains, and the residual error rate must be measured with special care. Before starting a synthetic data project, it is worth asking what the verifier will be. If there is no good answer, the project is likely to produce a model that sounds better than it is. Second, effort should be allocated in proportion to where knowledge enters the system. Teams naturally invest in generation, because it is visible and productive. The evidence suggests investing more in verifiers, evaluation sets, and human review of samples, because those are where the system's correctness is determined. A domain expert's time is better spent designing a rubric or labelling a stratified evaluation set than writing seed examples. Third, synthetic data should be designed together with its real-data anchor, not in place of it. The most robust pipelines treat real data as scarce and precious: used to define the evaluation set, to seed and style-anchor generation, to calibrate verifiers, and to remain in every training mixture. Synthetic data multiplies the value of real data. It does not remove the need for it. Fourth, privacy claims must be formal or not made. The label "synthetic" confers no protection by itself. Where synthetic data is used to share or train on sensitive information, differential privacy with a stated and defensible budget, combined with empirical attack testing, is the minimum basis for a claim that individuals are protected. Where that is too costly for the fidelity required, controlled access to real data may be the more honest solution. Fifth, evaluation must look past averages and past style. The failure modes of synthetic data concentrate in rare cases, which averages hide, and in capabilities that style imitates, which judges miss. Stratified evaluation with verifiable answers is the minimum standard for knowing what a model trained on synthetic data can actually do. What remains unsettled Several important questions remain open, and honest practice should acknowledge them. It is not known how far verified synthetic data can extend capability beyond the frontier of human knowledge. In formal domains, systems trained on self-generated, verified data have reached the level of skilled humans, and the logic of verification suggests there is no hard ceiling where verification is exact. Whether similar progress is possible in domains where verification is approximate — scientific reasoning, strategic judgement, open-ended writing — depends on whether approximate verifiers can be made reliable enough to avoid the over-optimisation that Chapter 6 described. The evidence so far is mixed. It is not known precisely how much synthetic data can safely replace real data in general-purpose pretraining. The accumulation results suggest that recursive training is stable when real data is retained, but they were obtained at scales and in settings much smaller than frontier training, and the proportion of machine-generated content on the web is rising in ways that no controlled experiment has replicated. It is not settled how to measure diversity in a way that predicts downstream performance. The metrics in common use catch gross failures but disagree with one another on subtler ones, and none directly measures whether a dataset covers the situations a model will meet in deployment. And it is not settled how the law will treat models distilled from other models, synthetic data derived from personal data, or synthetic data generated by models trained on copyrighted works. These questions are being worked out in courts, regulatory guidance, and licence terms, and practitioners should expect the rules to change. The discipline ahead Synthetic data began as a workaround — a way to get training data when the real thing was scarce, private, or rare. It is becoming something more like a discipline, with its own methods, failure modes, and standards of evidence. The maturation of that discipline will depend less on better generators, which will arrive regardless, than on better verifiers, better evaluation practice, and better habits of documentation. The most important habit is the simplest. For any synthetic dataset, be able to say where its knowledge came from: what the generator contributed, what the verifier contributed, what the real data contributed, and how each contribution was measured. A team that can answer that question has built a synthetic data system. A team that cannot has built a machine for producing plausible text and hoping some of it is true. Glossary Ablation. An experiment that removes or alters one component of a pipeline and measures the effect on the resulting model, used to establish what each component contributes. Attribute grid. An explicit list of the dimensions along which examples should vary, with values for each, used to condition a generator so that the synthetic dataset covers deliberately chosen combinations. Curriculum. A deliberate ordering or selection of training examples by difficulty or type, intended to match the data to what the learner can currently absorb. Decontamination. The removal from a training set of examples that overlap with evaluation benchmarks, so that benchmark scores measure capability rather than memorisation. Differential privacy. A formal guarantee that an algorithm's output changes very little when any single individual's record is added or removed, with the strength of protection set by a parameter called epsilon. Distillation. Training a smaller student model to reproduce the behaviour of a larger teacher, either by matching its output probabilities or, more commonly for language models, by training on text the teacher generated. Domain randomisation. A simulation technique that varies textures, lighting, physics, and other parameters widely so that a model trained in simulation treats the real world as one more variation. Exposure bias. The mismatch that arises when a model is trained only on ideal outputs but must generate from its own, imperfect outputs at deployment, never having learned to recover from its own mistakes. Grounding. The property that every claim in a generated text is supported by a specified source; a grounding failure is the addition of unsupported material. Hallucination. Fluent, confident generated content that is false or unsupported. LLM-as-judge. The use of a large language model, usually given a rubric, to evaluate the outputs of another model. Membership inference. An attack that tries to determine whether a particular individual's record was used to train a model or generator. Model collapse. The progressive degradation of models trained recursively on the outputs of earlier models, beginning with the loss of rare patterns and ending in a narrow, distorted distribution. Outcome verification. Checking only the final result of a solution, such as whether an answer is correct; contrasted with process verification, which checks each intermediate step. Over-optimisation. The degradation that occurs when outputs are selected or trained to maximise an imperfect proxy score, such that the proxy rises while true quality falls. Persona conditioning. Prompting a generator with a description of a person, so that its outputs reflect the perspective, vocabulary, and concerns that person would plausibly have. Reward model. A learned scoring function, usually trained on human comparisons between responses, that estimates how much a response would be preferred. Residual error rate. The proportion of examples in a filtered synthetic dataset that are still wrong or harmful, estimated by human review of a random sample of accepted examples. Verifier. Any procedure that scores, ranks, or accepts and rejects generated candidates, from exact execution checks to learned judges. Further Reading Rubin, D. B. (1993). "Statistical Disclosure Limitation." Journal of Official Statistics, 9(2). The short discussion that proposed releasing fully synthetic data by multiple imputation. Still the clearest statement of why synthetic data must be judged by whether analyses on it reproduce analyses on the real data. Tobin, J., et al. (2017). "Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real World." IROS. The paper that showed crude but heavily randomised simulation could train models that worked on real cameras. A model of how to compensate for an imperfect generator by design. Stadler, T., Oprisanu, B., and Troncoso, C. (2022). "Synthetic Data — Anonymisation Groundhog Day." USENIX Security Symposium. A rigorous empirical evaluation of privacy claims for synthetic data. Essential reading before relying on synthetic data for anonymisation. Wang, Y., et al. (2023). "Self-Instruct: Aligning Language Models with Self-Generated Instructions." ACL. The method that started the wave of model-generated instruction data, with a clear account of the filtering steps that made it work. Eldan, R., and Li, Y. (2023). "TinyStories: How Small Can Language Models Be and Still Speak Coherent English?" arXiv:2305.07759. A careful demonstration of how matching synthetic data to a model's capacity changes what it can learn. Gunasekar, S., et al. (2023). "Textbooks Are All You Need." arXiv:2306.11644. The phi-1 paper, describing a small code model trained substantially on synthetic textbook-style data, and the start of an influential line of small-model work. Zelikman, E., Wu, Y., Mu, J., and Goodman, N. (2022). "STaR: Bootstrapping Reasoning With Reasoning." NeurIPS. A compact, clear example of a self-improving curriculum built on outcome verification. Lightman, H., et al. (2023). "Let's Verify Step by Step." arXiv:2305.20050. The study comparing process and outcome supervision for mathematical reasoning; the best single source on why checking steps matters. Zheng, L., et al. (2023). "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena." NeurIPS Datasets and Benchmarks. Established both the usefulness of language models as judges and the biases that limit them. Gao, L., Schulman, J., and Hilton, J. (2023). "Scaling Laws for Reward Model Overoptimization." ICML. A quantitative treatment of what happens when selection pressure is applied against an imperfect scoring model. Gudibande, A., et al. (2023). "The False Promise of Imitating Proprietary LLMs." arXiv:2305.15717. The key caution on distillation: students learn style far faster than capability, and human raters are fooled by style. Mukherjee, S., et al. (2023). "Orca: Progressive Learning from Complex Explanation Traces of GPT-4." arXiv:2306.02707. The explanation-tuning approach to distillation, with useful detail on prompt design for teacher outputs. Hsieh, C.-Y., et al. (2023). "Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizes." Findings of ACL. Shows how teacher rationales can be used as a separate training signal for small task-specific students. DeepSeek-AI (2025). "DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning." arXiv:2501.12948. Describes both the large reasoning model and the distillation of its reasoning traces into much smaller open models. Trinh, T. H., et al. (2024). "Solving Olympiad Geometry Without Human Demonstrations." Nature, 625. AlphaGeometry: the clearest case of a large synthetic corpus produced entirely by a symbolic generator-verifier. Shumailov, I., et al. (2024). "AI Models Collapse When Trained on Recursively Generated Data." Nature, 631. The central paper on model collapse. Gerstgrasser, M., et al. (2024). "Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data." arXiv:2404.01413. The important corrective showing that retaining real data keeps recursive training stable. Feng, Y., Dohmatob, E., et al. (2025). "Beyond Model Collapse: Scaling Up with Synthesized Data Requires Verification." ICLR. Shows that selecting synthetic data with a verifier can prevent collapse; the most direct experimental support for the argument of this book. Gebru, T., et al. (2021). "Datasheets for Datasets." Communications of the ACM, 64(12). The foundational proposal for dataset documentation, easily extended to synthetic data lineage. Hashtags: #SyntheticData #SyntheticDataArchitecture #SyntheticDataGeneration #SyntheticDataFiltering #SyntheticDataValidation #ArtificialIntelligence #MachineLearning #GenerativeAI #LargeLanguageModels #AITrainingData #DataEngineering #DataQuality #DataValidation #DataAugmentation #InstructionTuning #ModelDistillation #TeacherStudentLearning #CurriculumLearning #AutomatedDataGeneration #DataDiversity #QualityFiltering #AutomatedVerification #LLMAsAJudge #HallucinationDetection #DifferentialPrivacy #PrivacyPreservingAI #ModelCollapse #DatasetGovernance #DataProvenance #ResponsibleAI

Download the Book (PDF): Introduction In June 2017 eight researchers, most of them at Google, posted a paper with a title that sounded more like a slogan than a scientific claim: "Attention Is All You Need." Its proposal was narrow. For the task of translating sentences from English into German and French, it replaced the recurrent neural networks that then dominated the field with a stack of layers built almost entirely from one operation, which the authors called scaled dot-product attention. The model trained faster than its competitors and translated better. On the standard English-to-German benchmark it scored 28.4 BLEU, ahead of every previously published system, including ensembles. Nothing in that result announced a revolution. Translation benchmarks had been broken many times before. What followed was different. Within eighteen months the same architecture, lightly modified, had become the basis of BERT, which reset the state of the art across a broad suite of language-understanding tasks, and of GPT and GPT-2, which showed that a model trained only to predict the next word could produce coherent paragraphs. Within three years it had been applied to images, by cutting them into patches and treating the patches as words. Within five it was folding proteins, transcribing speech, writing code, and serving as the core of conversational systems used by hundreds of millions of people. Today, nearly every large model that attracts public attention, whether it generates text, images, audio, or video, has a transformer, or something designed explicitly as a transformer's successor, at its centre. This booklet explains how that architecture works and why it changed in the ways it did. It is not a history of the companies or a survey of applications. It is an account of one mechanism and the pressures that shaped it. The controlling idea The argument of this booklet can be stated in a sentence. The transformer is best understood as a solution to a problem of information routing, and nearly every important change to it since 2017 has been a negotiation between the expressive power of letting every position consult every other position and the cost, in arithmetic and above all in memory, of doing so. Before the transformer, sequence models moved information along a chain. To get a fact from the first word of a paragraph to the last, a recurrent network had to carry it through every intermediate step, compressed into a fixed-size vector that was overwritten a little at each position. Attention replaced the chain with a switchboard. At every layer, every position can draw directly on every other, with the connections chosen by the content of the positions themselves rather than by their distance apart. That one change is the source of the transformer's strengths: it trains in parallel across a whole sequence, it can relate distant words as easily as adjacent ones, and it scales smoothly as models grow. The same change is also the source of its central weakness. A switchboard that connects every position to every other has a number of connections that grows with the square of the sequence length. Double the context and the attention computation quadruples. More subtly, a model that generates text one token at a time must keep a record, for every past token, of what that token offers to future queries. This record, the key-value cache, grows linearly with context and dominates the memory budget of long-context inference. Much of the architectural history of the past several years, from multi-query attention to FlashAttention to state-space models, makes sense only once you see which of these costs it was trying to reduce, and what it gave up in exchange. A second, quieter thread runs through the same story. Attention, by itself, has no sense of order. It treats its input as a set. The sentence "the dog bit the man" and "the man bit the dog" contain the same words, and pure attention cannot tell them apart. Every transformer therefore needs some way to inject position, and the choice of method turns out to govern whether a model can handle sequences longer than those it was trained on. The progression from fixed sinusoids to learned embeddings to rotary embeddings to the interpolation tricks that stretch a model's context from four thousand tokens to a million is the second half of the long-context story. What the reader will need The booklet assumes curiosity and a willingness to read an equation slowly, not a background in machine learning. The mathematics is mostly linear algebra at the level of matrix multiplication and dot products, plus the softmax function, which is defined when it first appears. Equations are written inline in plain text, such as Attention(Q, K, V) = softmax(QK^T / sqrt(d_k)) V, where the caret marks a transpose and sqrt is the square root. Every equation is also explained in words, and where a calculation matters to the argument, it is worked through with actual numbers. A few conventions recur. The letter n stands for the length of a sequence, measured in tokens; a token is a word or a fragment of a word, and in English text a typical modern tokenizer produces roughly three tokens for every four words. The letter d, often written d_model, stands for the width of the model, the number of components in the vector that represents each token as it passes through the network. The letter L counts layers, and h counts attention heads. Sizes of models are given in parameters, the individual numbers learned during training. The path through the material The chapters build in order. The first describes the problem the transformer solved: the sequential bottleneck of recurrent networks and the earlier form of attention that was invented to patch it. The second derives scaled dot-product attention from first principles, including the reason for the square root that gives it its name. The third assembles the full transformer block, explaining why there are many attention heads rather than one and what the feed-forward layers, residual connections, and normalization are for. The fourth chapter treats position: how a set-processing operation is made to respect order, and why rotary embeddings became the default. The fifth follows the single block as it divided into three families, encoder-only, decoder-only, and encoder-decoder, and explains why the decoder-only design won. The sixth asks what attention heads actually learn, drawing on interpretability research that has identified specific circuits, such as induction heads, inside trained models. The seventh chapter turns to scale: the empirical laws that relate model size, data, and compute to performance, and the mixture-of-experts designs that decouple parameter count from computation. The eighth confronts the quadratic wall directly, counting the floating-point operations and bytes of memory that attention consumes and showing where the true bottleneck lies. The ninth describes the engineering that made exact attention fast enough to survive, including FlashAttention and the progressive shrinking of the key-value cache. The tenth examines the many attempts to approximate attention more cheaply and explains why most of them did not displace the original. The eleventh considers the strongest challengers, state-space models and their relatives, along with the hybrid designs that combine them with attention, and asks what "long context" actually delivers when it is measured carefully. The conclusion draws these threads into an assessment of where the architecture stands and what remains genuinely unresolved. A note on currency The field moves fast, and specific model names and context lengths will date. The underlying arithmetic will not. The cost of attention grows quadratically with sequence length for reasons that follow from its definition. The key-value cache grows linearly for reasons that follow from autoregressive generation. Position must be supplied from outside because attention is permutation-invariant. These facts are the fixed points around which the architecture has moved, and a reader who understands them will be able to make sense of designs that have not yet been published. That, more than any catalogue of current systems, is what this booklet tries to provide. Chapter 1. The Sequential Bottleneck Language arrives in order. A sentence is a sequence of words, a paragraph a sequence of sentences, and meaning depends on that order at every scale. Any machine that processes language must decide how to represent a sequence and how to let information flow along it. The transformer's answer is easiest to appreciate against the answer it replaced, and against the specific failures of that answer that a decade of clever engineering could not fully repair. Reading one word at a time The natural way to build a neural network for sequences is to mimic a human reader who moves left to right, keeping a running summary in mind. This is the recurrent neural network, or RNN. At each position t, the network takes two inputs: the current token, represented as a vector x_t, and its own summary from the previous step, a vector h_(t-1) called the hidden state. It combines them to produce a new hidden state: h_t = tanh(W_h h_(t-1) + W_x x_t + b) Here W_h and W_x are matrices of learned weights, b is a learned bias vector, and tanh is a function that squashes each component into the range from minus one to one. The same weights are used at every position. After the last token, the final hidden state h_n is meant to contain everything the network needs to know about the whole sequence. This design has real elegance. It handles sequences of any length with a fixed number of parameters. It has a built-in notion of order, since the network literally processes tokens in sequence. And it has a plausible story about memory: the hidden state is a working buffer, updated as new evidence arrives. The trouble begins with training. Neural networks learn by gradient descent: the error at the output is propagated backward through every operation that produced it, telling each weight how to change. In a recurrent network, the path from an early token to the final output passes through the recurrence once for every intervening position. The gradient that flows back along that path is multiplied, at each step, by the matrix W_h and by the derivative of tanh. If the relevant quantities are on average a little smaller than one, the product shrinks exponentially with distance; if a little larger, it explodes. Sepp Hochreiter identified this problem in his 1991 diploma thesis, and Yoshua Bengio, Patrice Simard and Paolo Frasconi analysed it formally in 1994. The practical consequence was blunt. A plain RNN could learn dependencies spanning a few steps but struggled with anything spanning dozens. Gates and the long short-term memory The most influential repair was the long short-term memory network, or LSTM, introduced by Hochreiter and Jürgen Schmidhuber in 1997 and refined by others over the following years, notably by the addition of a "forget gate" by Felix Gers and colleagues in 2000. The LSTM adds a second internal vector, the cell state c_t, which is updated additively rather than by repeated matrix multiplication. Three gates, each a vector of numbers between zero and one computed from the current input and previous hidden state, control the flow. The forget gate decides how much of the old cell state to keep. The input gate decides how much new information to write. The output gate decides how much of the cell state to expose as the hidden state. The key equation is the cell update: c_t = f_t c_(t-1) + i_t g_t where f_t is the forget gate, i_t the input gate, g_t a candidate update, and the asterisk means element-wise multiplication. When the forget gate is close to one and the input gate close to zero, the cell state passes through unchanged, and so does its gradient. The LSTM therefore has a protected channel along which information, and the error signal needed to learn it, can travel across long stretches. A closely related simplification, the gated recurrent unit or GRU, was proposed by Kyunghyun Cho and colleagues in 2014 and performs comparably on many tasks. Gated recurrent networks worked. From roughly 2013 to 2017 they were the dominant architecture for speech recognition, handwriting recognition, language modelling and machine translation. Google's production translation system, described in a 2016 paper by Yonghui Wu and colleagues, used a stack of eight LSTM layers in its encoder and eight in its decoder. But the gates mitigated the long-range problem rather than solving it, and they did nothing about a second limitation that would turn out to matter even more. The parallelism problem A recurrent network cannot compute h_t until it has computed h_(t-1). This is true during training as well as during use. Given a training sentence of fifty tokens, the network must perform fifty sequential steps, each waiting on the last, before it can compute the loss and begin backpropagation, which then also runs sequentially in reverse. This matters because of the hardware on which neural networks are trained. A graphics processing unit is built to perform a very large number of identical arithmetic operations simultaneously. Its natural workload is a large matrix multiplication, in which thousands of independent dot products can be computed at once. A recurrent network offers the GPU a long series of small matrix multiplications, each dependent on the previous one. Within a single step there is parallelism across the hidden state's components and across the examples in a batch, but along the sequence there is none. The longer the sequence, the more the GPU waits. Researchers worked around this with large batches, careful kernel engineering, and architectures that limited recurrence to a few layers. But the fundamental constraint remained: the amount of sequential computation grew linearly with sequence length, and no amount of hardware could remove it. When the transformer paper later compared architectures, it singled out this property. A recurrent layer requires a number of sequential operations proportional to n. A self-attention layer requires a constant number, independent of n. That single line in the paper's comparison of layer types turned out to be among the most consequential observations in it. Convolutional sequence models, such as ByteNet and ConvS2S, both published in 2016 and 2017, tackled the parallelism problem from another direction. A convolution looks at a fixed window of neighbouring tokens and can be applied at every position simultaneously. Stacking convolutions widens the window. These models trained much faster than LSTMs and matched or beat them on translation. But relating two tokens far apart still required many layers, a number growing linearly with distance for ordinary convolutions or logarithmically for dilated ones. The path between distant tokens was shorter than in an RNN but still not direct. The encoder-decoder and its fixed-size bottleneck Machine translation exposed a third limitation, and it was the one whose solution became the transformer's central idea. In 2014 two groups independently proposed the sequence-to-sequence framework for translation. Ilya Sutskever, Oriol Vinyals and Quoc Le at Google, and Kyunghyun Cho and colleagues at the University of Montreal, built systems with two recurrent networks. The encoder read the source sentence and produced a final hidden state. The decoder took that state as its starting point and generated the target sentence one word at a time, each step conditioned on its own previous outputs. The design was simple and, with enough data and some tricks, effective. Sutskever and his colleagues found, for instance, that reversing the order of the source sentence improved results, because it placed the first words of the source close to the first words of the target and shortened the path between them. That such a trick helped was itself a diagnostic. The entire meaning of the source sentence, however long, had to pass through a single vector of fixed size, the encoder's final hidden state. A vector of a thousand numbers can hold a great deal, but it cannot hold an arbitrarily long sentence without loss, and Cho's group showed that translation quality fell off sharply as sentence length grew beyond about twenty words. Attention as a patch The fix came from Dzmitry Bahdanau, working with Cho and Bengio, in a paper posted in September 2014 and presented at the 2015 International Conference on Learning Representations. Its title stated the idea: "Neural Machine Translation by Jointly Learning to Align and Translate." Instead of compressing the source sentence into one vector, Bahdanau's encoder kept every hidden state, one per source word. When the decoder was about to produce a target word, it compared its current state against each of those encoder states and computed a score for each. The scores were converted into weights that summed to one, and the decoder received a weighted average of the encoder states, called the context vector. Different target words could thus draw on different parts of the source. When translating a French adjective that follows its noun, the decoder could look back at the English adjective that precedes it. The conversion from scores to weights used the softmax function, which will appear constantly in what follows. Given a list of real numbers s_1 through s_n, softmax returns a list of the same length whose i-th entry is exp(s_i) divided by the sum of exp(s_j) over all j. Every output is positive, the outputs sum to one, and larger inputs get disproportionately larger outputs. Softmax turns arbitrary scores into a probability distribution that concentrates on the highest-scoring items while giving some weight to the rest. In Bahdanau's design the score between decoder state s and encoder state h_j was computed by a small neural network: v^T tanh(W s + U h_j), with v, W and U learned. This is now called additive attention. A year later, Minh-Thang Luong, Hieu Pham and Christopher Manning at Stanford compared several scoring functions and found that a simpler one, the dot product between the decoder state and the encoder state, possibly with a learned matrix in between, worked as well or better and was cheaper to compute. This is multiplicative or dot-product attention, and it is the direct ancestor of the transformer's version. The effect of attention on translation was large. It removed the fixed-size bottleneck, improved quality on long sentences, and produced, as a by-product, alignment weights that could be inspected. Plotting the weight each target word placed on each source word yielded a matrix that, for language pairs with similar word order, lay close to the diagonal, with deviations exactly where the languages reorder words. It was one of the first times a neural translation system offered an interpretable glimpse of what it was doing. From patch to foundation In these systems attention was an addition to a recurrent architecture, not a replacement for it. The encoder and decoder were still LSTMs, still sequential, still subject to the parallelism limit. Attention connected the decoder to the encoder, but within each, information still travelled step by step. Several lines of work in 2016 began to use attention within a single sequence. Jianpeng Cheng, Li Dong and Mirella Lapata proposed an LSTM variant that attended over its own previous states, which they called intra-attention. Ankur Parikh and colleagues at Google built a model for natural-language inference that used attention between two sentences and almost no recurrence at all, and achieved strong results with an order of magnitude fewer parameters than competing systems. Zhouhan Lin and colleagues proposed a "structured self-attentive sentence embedding." The idea that a sequence might attend to itself, and that this might substitute for recurrence, was in the air. The transformer paper's contribution was to take that idea to its conclusion. If attention lets the decoder reach any encoder position directly, and if a sequence can attend to itself, then perhaps recurrence is unnecessary. Every layer could consist of self-attention, in which each position computes a weighted average over all positions in the same sequence, followed by a simple position-wise transformation. Information would travel between any two positions in a single layer. All positions could be computed at once. The path length between distant tokens, which had been the core problem since Hochreiter's thesis, would be constant. The transformer's authors made the comparison explicit with three measures for each layer type: the total computation per layer, the number of operations that must happen sequentially, and the maximum path length between any two positions. For self-attention, computation per layer grows as n squared times d, sequential operations are constant, and maximum path length is one. For a recurrent layer, computation grows as n times d squared, sequential operations grow as n, and path length grows as n. For a convolution with kernel width k, computation grows as k times n times d squared, sequential operations are constant, and the path length grows as the logarithm of n to the base k when dilated convolutions are used. Two features of that comparison set up everything that follows. The first is how decisively self-attention wins on the second and third columns. It is the only layer type that is both fully parallel and gives every pair of positions a direct connection. The second is the quiet presence of n squared in the first column. When sentences were thirty tokens long and the model width was 512, n squared times d was smaller than n times d squared, so self-attention was cheaper than recurrence as well as faster. The authors noted that this held as long as n was smaller than d, "which is most often the case" for the sentence-level tasks of the time. They also suggested that for very long sequences attention could be restricted to a neighbourhood around each position. That caveat was reasonable in 2017. It would become the defining engineering problem of the architecture as context windows grew from hundreds of tokens to hundreds of thousands. Before turning to it, though, we need to understand exactly what the attention computation does, and why its particular form, including a scaling factor that might look like an afterthought, is what it is. Chapter 2. Scaled Dot-Product Attention The heart of the transformer is a single formula: Attention(Q, K, V) = softmax(QK^T / sqrt(d_k)) V It fits on one line and contains four operations: a matrix multiplication, a division, a softmax, and another matrix multiplication. Everything else in the architecture exists to feed this formula good inputs, to make use of its outputs, or to make it cheaper to compute. This chapter takes it apart piece by piece, works through it with numbers, and explains the one detail, the division by sqrt(d_k), that gives it its name. A soft dictionary The easiest way into attention is through an ordinary data structure. A dictionary, or hash map, stores pairs of keys and values. You present a query; the dictionary finds the key that matches it exactly and returns the associated value. If you look up "Paris" in a dictionary of capitals keyed by city, you get "France." If the query matches no key, you get nothing. Attention is a dictionary in which matching is graded rather than exact. Every stored item has a key and a value, both vectors. A query is also a vector. Instead of finding the one key that equals the query, attention measures how similar the query is to every key, converts those similarities into weights that sum to one, and returns the weighted average of all the values. If one key is much more similar to the query than the others, the result is close to that key's value, and attention behaves like an ordinary lookup. If several keys are similar, the result blends their values. The lookup is soft, and because every step is a smooth function, the whole operation can be differentiated and learned by gradient descent. In self-attention, every token in a sequence plays all three roles. Each token emits a query, which expresses what it is looking for. Each token emits a key, which advertises what it contains. Each token emits a value, which is what it will contribute if selected. Each token's query is compared with every token's key, and each token receives a weighted average of every token's value. The output for each position is therefore a mixture of information from the whole sequence, with the mixture chosen by content. Statisticians will recognise the structure. A weighted average of values, with weights determined by a similarity kernel between a query point and stored points, is the Nadaraya-Watson kernel regression estimator from the 1960s. Attention is a kernel smoother whose kernel is the exponential of a scaled dot product, and whose queries, keys and values are all learned projections of the data. Where queries, keys and values come from Suppose a sequence has n tokens, and each has been turned into a vector of d_model numbers. Stack those vectors as the rows of a matrix X, which therefore has n rows and d_model columns. The transformer learns three weight matrices, W_Q, W_K and W_V. Multiplying X by each gives: Q = X W_Q, K = X W_K, V = X W_V If W_Q and W_K have d_model rows and d_k columns, then Q and K have n rows and d_k columns: one query vector and one key vector of length d_k per token. Similarly V has n rows and d_v columns. In the original transformer, d_model was 512, and with eight attention heads, each head had d_k = d_v = 64. The reason for heads comes in the next chapter. For now, consider a single one. The separation into three projections is not decoration. If queries and keys were the same vectors, the similarity between token i and token j would be symmetric: i would attend to j exactly as strongly as j attends to i. Language is not like that. A pronoun needs to find its antecedent, but the antecedent has no particular need to find the pronoun. Separate query and key projections allow asymmetric relationships. The separate value projection lets what a token contributes differ from what it advertises: a token might be found because it is a noun in subject position, but contribute information about its meaning. The four steps With Q, K and V in hand, attention proceeds as follows. First, compute every pairwise similarity at once with the matrix product QK^T. Q has n rows and d_k columns; K^T, the transpose of K, has d_k rows and n columns. Their product is an n-by-n matrix, often called the attention score matrix, whose entry in row i and column j is the dot product of query i with key j. The dot product of two vectors is the sum of the products of their corresponding components; it is large and positive when the vectors point in similar directions, near zero when they are unrelated, and negative when they point in opposite directions. Second, divide every entry by sqrt(d_k). This is the scaling, discussed below. Third, apply softmax to each row separately. Row i holds the scores of query i against all keys; softmax turns it into n positive weights summing to one. The resulting n-by-n matrix is the attention weight matrix, often written A. Its entry A_ij is how much position i attends to position j. Fourth, multiply A by V. Row i of the product is the sum over j of A_ij times value vector j: the weighted average of the values, using query i's weights. The output is an n-by-d_v matrix, one new vector per position. A worked example Numbers make this concrete. Take a sequence of three tokens with d_k = d_v = 2, and suppose the projections have produced: Queries: q1 = (1, 0), q2 = (0, 1), q3 = (1, 1) Keys: k1 = (1, 0), k2 = (0, 1), k3 = (1, 1) Values: v1 = (1, 0), v2 = (0, 2), v3 = (3, 1) Consider the first token. Its query (1, 0) dotted with the three keys gives 1, 0 and 1. Dividing by sqrt(2), approximately 1.414, gives 0.707, 0 and 0.707. Exponentiating gives about 2.028, 1.000 and 2.028, which sum to 5.056. Dividing each by the sum gives weights of 0.401, 0.198 and 0.401. The first token attends equally to itself and to the third token, and about half as much to the second. Its output is 0.401 times (1, 0) plus 0.198 times (0, 2) plus 0.401 times (3, 1). The first component is 0.401 + 0 + 1.203 = 1.604. The second is 0 + 0.396 + 0.401 = 0.797. The new representation of token one is (1.604, 0.797), a blend dominated by the first and third values. The same procedure applied to the third token, whose query (1, 1) gives dot products of 1, 1 and 2, yields scaled scores of 0.707, 0.707 and 1.414, weights of roughly 0.248, 0.248 and 0.503, and an output that leans toward value three. Every token gets its own mixture, and all three mixtures can be computed simultaneously because the whole operation is two matrix products and a row-wise softmax. This example also shows what attention cannot do by itself. Nothing in the computation refers to the order of the tokens. If we swapped tokens one and two, swapping their queries, keys and values together, the outputs would swap in exactly the same way and otherwise be unchanged. Attention is permutation-equivariant: reorder the input and the output is reordered identically. This is why the transformer needs position information injected from outside, the subject of Chapter 4. Why divide by the square root of d_k The scaling factor is the one part of the formula that looks arbitrary, and the transformer paper's explanation of it is a short footnote. The reasoning behind it is worth spelling out, because it is an instance of a pattern that recurs throughout deep learning: keeping the numbers inside a network at a scale where gradients can flow. Suppose the components of a query vector and a key vector are independent random variables, each with mean zero and variance one. This is roughly the situation at the start of training, when weights are random, and something like it persists afterward because of normalization layers. The dot product q · k is a sum of d_k terms, each the product of two independent unit-variance variables. Each such product has mean zero and variance one. A sum of d_k independent terms with variance one has variance d_k, so the dot product has standard deviation sqrt(d_k). With d_k = 64, the typical dot product therefore has magnitude around 8, and in a row of many scores it is common for the largest to exceed the others by 10 or 20. Consider what softmax does to a row of scores 8, 0 and minus 8. The exponentials are about 2981, 1, and 0.000335. The weights are about 0.99966, 0.00034, and 0.0000001. The softmax has become nearly a hard maximum, putting essentially all its weight on one entry. That would be harmless if it reflected a genuine preference the model had learned. The problem is what it does to learning. The derivative of softmax output i with respect to input j is p_i times (1 minus p_i) when i equals j, and minus p_i times p_j otherwise. When one probability is nearly one and the rest nearly zero, every one of these terms is nearly zero. The gradient vanishes. A model whose attention saturates at initialisation cannot learn to adjust it, because the error signal that would tell it how cannot pass back through the softmax. Dividing the scores by sqrt(d_k) restores them to unit variance, regardless of the head dimension. With d_k = 64 the factor is 8, and the scores 8, 0 and minus 8 become 1, 0 and minus 1, which softmax maps to about 0.665, 0.245 and 0.090. The distribution is still peaked toward the highest score but far from saturated, and gradients flow. The authors observed that, without scaling, dot-product attention performed worse than additive attention at large d_k, and attributed this to exactly the saturation effect described here. The scaling can be read another way. Dividing logits by a constant before softmax is equivalent to raising the softmax's temperature, a term borrowed from statistical physics. High temperature flattens a distribution; low temperature sharpens it. The factor 1/sqrt(d_k) sets the temperature so that, at initialisation, attention is neither uniform nor one-hot. The model can then learn to sharpen it where sharpness helps, by growing the norms of particular queries and keys. This choice is a convention, not a law. Some later work has replaced the fixed factor with a learned temperature, or normalised queries and keys to unit length before taking the dot product and then multiplied by a learned scale, a technique called QK-normalisation that has been used to stabilise training of very large models whose attention logits otherwise grow without bound. These variants all address the same concern the square root addresses: controlling the magnitude of the softmax's inputs. Masking Two practical additions complete the operation. Sequences in a batch often differ in length, and shorter ones are padded with placeholder tokens. Attention should ignore these. The standard method is to add a large negative number, conceptually minus infinity, to the scores for padded positions before the softmax. Since exp of minus infinity is zero, those positions receive zero weight. The second form of masking is more fundamental. A language model that generates text predicts each token from the tokens before it. During training, the model is shown a whole sequence and asked to predict every token from its predecessors at once, which is what makes training parallel. But if position i could attend to position i + 1, it could simply copy the answer. The solution is a causal mask: add minus infinity to every score where the key position comes after the query position. In the n-by-n score matrix this blanks out everything above the main diagonal. Row one can attend only to position one; row two to positions one and two; row n to everything. A single matrix computation then produces n correctly causal predictions at once. This trick, which lets a model trained on a document of a thousand tokens learn from a thousand prediction problems in one parallel pass, is a large part of why transformer language models train so efficiently. The shape of the cost The worked example hid the most important property of attention under its small size. The score matrix QK^T is n by n. For three tokens it has nine entries. For a thousand tokens it has a million. For a hundred thousand tokens it has ten billion, per head, per layer. Computing it requires, for each of the n squared entries, a dot product of length d_k, so about n squared times d_k multiply-add operations. Multiplying the weight matrix by V costs about the same. Storing the matrix, if it is materialised in memory, costs n squared numbers. Both grow with the square of the sequence length. By contrast, the projections that produce Q, K and V cost about n times d_model times d_k each: linear in n. So does every other part of the transformer layer. Attention is the only component whose cost grows faster than the sequence. At short lengths this hardly matters, because the linear parts, multiplied by large model widths, dominate. At long lengths the quadratic part takes over. Where the crossover occurs, and why the memory cost of attention has turned out to matter even more than its arithmetic, is the subject of Chapter 8. For now it is enough to see the trade the formula makes. In exchange for an n-by-n matrix, every position gets direct, content-addressed access to every other position, in a computation that is entirely parallel. That trade made the transformer possible, and its price has shaped every revision since. Chapter 3. Many Heads and the Transformer Block A single attention operation gives each position one weighted average over the sequence. That is powerful but restrictive. A word in a sentence typically stands in several relationships at once. In "The engineer who built the bridge retired last spring," the verb "retired" needs to find its subject, "engineer," skipping over the relative clause; it also has a tense relationship with "last spring"; and the model may benefit from knowing what the nearest preceding word is, for reasons of local syntax. One softmax distribution must spread its weight across all of these needs, and a weighted average of three unrelated values is a blur rather than a combination. The transformer's solution is to run several attention operations in parallel, each with its own projections, and concatenate the results. This is multi-head attention. Around it, the transformer builds a block with three more components, each solving a specific problem: a position-wise feed-forward network, residual connections, and layer normalization. Stacking that block is the whole architecture. Multi-head attention Multi-head attention with h heads uses h separate sets of projection matrices: W_Q^i, W_K^i and W_V^i for head i. Each head computes its own queries, keys and values from the same input, and runs scaled dot-product attention independently: head_i = Attention(X W_Q^i, X W_K^i, X W_V^i) The h outputs, each n by d_v, are concatenated side by side into an n by (h times d_v) matrix and multiplied by one more learned matrix, W_O, which maps the result back to width d_model: MultiHead(X) = Concat(head_1, ..., head_h) W_O The trick that makes this affordable is to shrink each head. In the original transformer, d_model was 512 and h was 8, and each head had d_k = d_v = 512 / 8 = 64. The total width of all queries across heads equals d_model, so the projections cost the same as one full-width head. Eight heads of width 64 do roughly the same arithmetic as one head of width 512, but they produce eight independent attention patterns instead of one. What does that buy? Each head computes its own n-by-n weight matrix, so each can attend to a different set of positions for a different reason. Head three might learn to attend from each verb to its subject; head five might attend to the previous token; head seven might spread attention broadly as a kind of summary. Each head works in its own 64-dimensional subspace, so the information it retrieves is drawn from a different projection of the values. The output projection W_O then mixes these retrieved pieces back together. The authors of the original paper tested the choice directly. Holding total computation constant, a single head of width 512 performed noticeably worse on translation than eight heads of width 64. Very many heads also hurt: with 32 heads of width 16, quality fell again, presumably because each head's queries and keys had become too small to express useful similarity. The sweet spot lay in the middle, and nearly every subsequent model has used head dimensions between 64 and 256. Contemporary large language models commonly use 128. There is a subtlety in how multi-head attention should be pictured. It is tempting to see the heads as a committee of independent specialists. Mathematically, the output projection W_O can be split into h horizontal slabs, one per head, so the multi-head output equals the sum over heads of head_i times its slab of W_O. Each head therefore writes its result directly into the full model width, and the heads' contributions are added. This additive view, emphasised by interpretability researchers, turns out to be the more useful one, and it connects to the residual stream described below. Later research has asked whether all those heads are needed. In 2019 Paul Michel, Omer Levy and Graham Neubig showed that, in trained translation and BERT models, a large fraction of heads could be removed at test time with little loss, and that many layers could be reduced to a single head. Elena Voita and colleagues found in the same year that a small number of heads in a translation encoder did most of the identifiable work, attending to positional neighbours, syntactic relations, or rare words, and that the rest could be pruned. These findings do not mean the extra heads are useless during training. Redundancy may make optimisation easier. But they show that the specialisation story is real for some heads and absent for others. The feed-forward network Attention moves information between positions. It does not, by itself, transform that information very much. Its output for each position is a weighted average of value vectors, which are linear projections of the input; the only nonlinearity is the softmax that chooses the weights. A stack of attention layers alone would be a poor function approximator. The second sublayer supplies the missing computation. After attention, each position's vector passes through the same small neural network, independently of every other position: FFN(x) = max(0, x W_1 + b_1) W_2 + b_2 The first matrix W_1 expands the vector from width d_model to a larger inner width d_ff; max(0, ...) is the rectified linear unit, or ReLU, which zeroes negative entries; and W_2 projects back down to d_model. In the original transformer d_ff was 2048, four times d_model, and that four-to-one ratio became a default for years. The feed-forward network looks unremarkable, but it holds most of the model's parameters. In each layer, the four attention projections (queries, keys, values, output) have 4 times d_model squared parameters. The two feed-forward matrices have 2 times d_model times d_ff, which with d_ff = 4 d_model is 8 times d_model squared. Two-thirds of each layer's weights are in the feed-forward network. What do those weights do? A useful picture comes from work by Mor Geva and colleagues, published in 2021, which interpreted feed-forward layers as key-value memories. Each column of W_1 acts as a key, detecting a pattern in the input; the ReLU passes through only those keys that are activated; and the corresponding row of W_2 is a value added to the output. They found individual units that fired on recognisable textual patterns and whose output rows promoted plausible next tokens. Later work by Kevin Meng and colleagues located factual associations, such as the country of a landmark, in mid-layer feed-forward weights, and showed that editing those weights could change the fact the model would report. The division of labour that emerges is suggestive though not absolute: attention routes information between positions, and feed-forward layers store and apply knowledge at each position. Modern models have replaced ReLU with smoother functions. The most widespread variant is the gated linear unit family, popularised for transformers by Noam Shazeer in 2020. In the SwiGLU version, the input is projected twice, once through a gate passed through the Swish (or SiLU) activation and once without, and the two are multiplied element-wise before the down-projection: FFN_SwiGLU(x) = (Swish(x W_1) * (x W_3)) W_2 This uses three matrices instead of two, so to keep parameter count constant the inner width is usually reduced to about two-thirds of four times d_model, roughly 8/3 times d_model. Shazeer reported consistent quality gains, and SwiGLU or close relatives became standard in the LLaMA family, PaLM, and most open models that followed. Residual connections and the residual stream The third component is a shortcut. Each sublayer's output is added to its input rather than replacing it: x = x + Sublayer(x) This is a residual connection, introduced for image recognition by Kaiming He and colleagues in 2015 to train networks with more than a hundred layers. Its first purpose is to help optimisation. Because the identity function passes through untouched, the gradient of the loss flows straight back from the output to every layer along the addition path, avoiding the multiplicative decay that crippled deep plain networks and recurrent networks alike. Its second consequence is conceptual, and has become central to how researchers think about transformers. With residual connections, the vector for each position is a running sum. It starts as the token's embedding plus position information. Every attention sublayer and every feed-forward sublayer reads from it and adds something to it. The final vector, which is used to predict the output, is the original embedding plus the sum of every sublayer's contribution. Researchers at Anthropic, in a 2021 framework for analysing transformer circuits by Nelson Elhage, Neel Nanda, Catherine Olsson and colleagues, named this the residual stream and argued that it is best seen as a shared communication channel. Each layer reads a subspace, computes, and writes to a subspace; later layers can read what earlier layers wrote. Attention heads are the only components that move information between positions' streams. Feed-forward layers act on one stream at a time. This picture explains several otherwise puzzling observations. Removing a single middle layer from a trained transformer often degrades it only mildly, because later layers can still read most of what they need from the stream. Different heads in different layers can compose: a head in layer five can use, as its query or key, information written into the stream by a head in layer two. Chapter 6 shows how this composition produces specific, identifiable algorithms. Layer normalization, and where to put it The fourth component keeps the numbers in a sensible range. Layer normalization, introduced by Jimmy Lei Ba, Jamie Ryan Kiros and Geoffrey Hinton in 2016, takes each position's vector, subtracts its mean, divides by its standard deviation, and then multiplies by a learned scale and adds a learned shift, both per component. The result has controlled magnitude regardless of what the previous layers did. The original transformer applied normalization after each residual addition: x = LayerNorm(x + Sublayer(x)). This is called post-norm. It works, but it is fragile. Post-norm transformers needed a learning-rate warm-up, a period at the start of training when the learning rate is increased gradually from near zero, or they diverged. Ruibin Xiong and colleagues analysed the problem in 2020 and showed that in post-norm models the gradients at the last layers are large at initialisation, which makes early large updates destabilising. The alternative is pre-norm, which normalizes the input to each sublayer but leaves the residual path untouched: x = x + Sublayer(LayerNorm(x)). The residual stream is then a pure sum, and the identity path carries gradients cleanly from output to input. Pre-norm transformers train stably with less careful warm-up and at greater depth, and they became standard after GPT-2 adopted the arrangement in 2019. A final normalization is applied after the last block, before the output projection. A further simplification is RMSNorm, proposed by Biao Zhang and Rico Sennrich in 2019. It skips subtracting the mean and simply divides by the root-mean-square of the components, then applies a learned scale. It is cheaper and, empirically, works as well. LLaMA, Mistral and many other recent models use pre-norm RMSNorm. Assembling the block Putting the pieces together, a modern decoder block, of the kind used in most current language models, computes: h = x + MultiHeadAttention(RMSNorm(x)) y = h + FFN(RMSNorm(h)) with causal masking inside the attention. The full model is an embedding layer that turns tokens into vectors, a stack of L such blocks, a final normalization, and an output layer that maps each position's final vector to scores over the vocabulary, from which a softmax gives the probability of each possible next token. The original 2017 transformer differed in several respects: it was an encoder-decoder (Chapter 5), it used post-norm, ReLU, and sinusoidal positions (Chapter 4). Its two published configurations show how modest the starting point was by later standards, as Table 1 records. Table 1. The two configurations of the original transformer (Vaswani et al., 2017). Setting Base Big Layers (encoder and decoder each) 6 6 Model width d_model 512 1024 Feed-forward width d_ff 2048 4096 Attention heads h 8 16 Head width d_k 64 64 Parameters about 65 million about 213 million Training 100,000 steps, about 12 hours on 8 P100 GPUs 300,000 steps, about 3.5 days on 8 P100 GPUs English-German BLEU 27.3 28.4 The big model's parameter count is smaller than that of many models that now run on mobile phones, and its training budget would be a modest experiment today. Yet the block is recognisably the same one used in models a thousand times larger. That continuity is itself a finding. When researchers scaled the transformer up by several orders of magnitude, the parts they changed were mostly the ones discussed in this chapter's margins: where normalization goes, which activation the feed-forward network uses, how the residual stream is initialised. The core, multi-head scaled dot-product attention feeding a position-wise network on a residual stream, survived. Counting parameters and operations Two rules of thumb follow from the block's structure and will be useful later. Parameters per layer: four attention matrices of d_model by d_model, plus feed-forward matrices totalling 8 d_model squared with the classic four-to-one ratio, for 12 d_model squared in all, ignoring small bias and normalization terms. A model with L layers therefore has about 12 L d_model squared parameters, plus the embedding table. For GPT-3, with L = 96 and d_model = 12,288, this gives 12 times 96 times about 151 million, or about 174 billion, close to its stated 175 billion. Arithmetic per token: each parameter in a matrix multiplication contributes one multiplication and one addition per token, so a forward pass costs about 2 floating-point operations per parameter per token, and training, which needs a backward pass roughly twice as costly as the forward pass, costs about 6. This "6N" rule, where N is the parameter count, underlies the scaling-law calculations of Chapter 7. It omits the attention score computation itself. For a context of n tokens, computing one token's scores against every key and then its weighted sum of values takes two products of about n times d_model multiply-adds each, or roughly 4 times n times d_model floating-point operations per token per layer in the forward pass (causal masking halves this on average). At short contexts that term is small next to the 24 d_model squared operations the layer's weights cost per token; the two become equal when n reaches 6 d_model. For a model with d_model = 4096, that crossover arrives around 25,000 tokens. Beyond it, the quadratic term of the previous chapter starts to dominate the arithmetic, and the argument of the later chapters begins. Chapter 4. Encoding Position Chapter 2 ended with an awkward fact. Self-attention is permutation-equivariant: shuffle the tokens and the outputs are shuffled in the same way, but otherwise identical. The feed-forward layers act on each position separately, so they are equally blind to order. A transformer with nothing added would treat "the dog bit the man" and "the man bit the dog" as the same bag of words, differing only in which output belongs to which token. Order must therefore be supplied from outside, by modifying either the token representations or the attention computation so that positions are distinguishable. This turns out to be one of the most consequential design choices in the architecture. The method chosen determines not only whether the model can tell word order, but how it represents distance, whether it can generalise to sequences longer than those seen in training, and how cheaply its context window can later be extended. This chapter follows the main methods in roughly the order they appeared, ending with the rotary embedding that now dominates and the interpolation techniques built on it. Absolute positions: sinusoids and learned tables The original transformer added a position vector to each token's embedding before the first layer. If the token at position pos has embedding e, the model's input there is e + PE(pos), where PE(pos) is a vector of the same width d_model. The authors chose a fixed, non-learned PE built from sine and cosine waves. For each pair of dimensions 2i and 2i + 1, with i running from 0 to d_model/2 minus 1: PE(pos, 2i) = sin(pos / 10000^(2i / d_model)) PE(pos, 2i + 1) = cos(pos / 10000^(2i / d_model)) Each pair of dimensions is a sine-cosine pair oscillating at its own frequency. The first pair cycles once every 2 pi positions, about 6.3 tokens; the frequencies decrease geometrically across dimensions until the last pair has a wavelength of roughly 10,000 times 2 pi, over sixty thousand positions. The result resembles a binary counter written in smooth waves: low dimensions change rapidly from one position to the next, high dimensions change slowly, and together they give every position a distinct fingerprint. The choice of sines and cosines was deliberate. For any fixed offset k, the encoding of position pos + k is a linear function of the encoding of position pos: each sine-cosine pair at pos + k equals the pair at pos rotated by an angle proportional to k. The authors hypothesised that this would let the model learn to attend by relative position, since "the token three to my left" corresponds to a fixed linear transformation regardless of where one is in the sequence. They also hoped the smooth functional form would let the model handle positions beyond the training length. They compared this with the simpler alternative of learning a separate vector for each position, a lookup table of positional embeddings trained alongside everything else, and found nearly identical results on translation. BERT and the GPT models adopted learned absolute embeddings, with tables of 512 positions for BERT and 1,024 for GPT-2. A learned table is flexible, but it has a hard limit. Position 1,025 simply has no entry. Neither method delivered meaningful extrapolation in practice: models trained on sequences of one length degraded sharply when run on longer ones, because the combinations of position signals and content they encountered were outside anything seen in training. Adding position to the content embedding has a further drawback. Position and meaning are mixed in the same vector from the first layer, and every subsequent layer must disentangle them. When the query and key are computed from a sum e + p, the dot product between positions i and j expands into four terms: content with content, content with position, position with content, and position with position. Only the last, and in a limited way the middle two, carry ordering information, and the model must learn to use them through the same projections it uses for meaning. Relative positions An alternative line of work started from the observation that what usually matters in language is not a word's absolute position, but how far apart two words are. Whether a determiner precedes its noun by one position is the same fact at position 7 and at position 700. In 2018 Peter Shaw, Jakob Uszkoreit and Ashish Vaswani proposed modifying attention so that each query-key score includes a learned term depending only on the clipped distance j minus i between the two positions. Distances beyond some maximum, such as 16 in either direction, were treated as equal. This improved translation slightly and removed absolute positions from the input entirely. Transformer-XL, by Zihang Dai and colleagues in 2019, refined the approach with a sinusoidal relative encoding and separate learned biases for content and position, and combined it with a segment-level recurrence that let a language model attend into a cached previous segment, an early attempt at longer context. The T5 model from Google, described by Colin Raffel and colleagues in 2019, simplified relative position to its bare minimum: a single learned scalar bias, added to the attention score, for each bucket of relative distance. Nearby distances got their own buckets; farther ones were grouped logarithmically, so that 64 to 127 tokens apart might share one bucket. The bias was shared across layers and differed per head. This was cheap and effective, though computing the bias for every pair adds overhead and the bucketing is coarse at long range. In 2021 Ofir Press, Noah Smith and Mike Lewis proposed ALiBi, short for Attention with Linear Biases. ALiBi adds no learned position parameters at all. Instead, to each attention score between query i and key j it adds minus m times (i minus j), a penalty that grows linearly with distance, where m is a fixed slope that differs by head: one head has a steep slope and attends mostly locally, another a shallow slope and attends broadly. Press and his colleagues called their paper "Train Short, Test Long," and their headline result was that a model trained with ALiBi on sequences of 1,024 tokens could be evaluated on 2,048 tokens with no loss in perplexity, which sinusoidal and learned embeddings could not manage. ALiBi was adopted in BLOOM and MPT. Its weakness is the flip side of its strength: by construction it biases every head toward recency. A model penalised linearly for attending far away extrapolates gracefully partly because it largely ignores the distant tokens it was never trained to use. Rotary position embedding The method that won was proposed by Jianlin Su and colleagues in a 2021 paper titled "RoFormer: Enhanced Transformer with Rotary Position Embedding." Rotary embeddings, usually called RoPE, were adopted in GPT-J and GPT-NeoX in 2021, PaLM in 2022, and then LLaMA in 2023, after which they became the default in nearly every open-weight language model. Understanding why requires a short excursion into rotation. Consider a vector with two components, (x, y). Rotating it by an angle theta about the origin gives (x cos theta minus y sin theta, x sin theta plus y cos theta). Rotation changes the vector's direction but not its length. Now take two vectors, rotate the first by angle alpha and the second by angle beta, and take their dot product. Because the dot product depends only on the lengths of the vectors and the angle between them, the result equals the dot product of the original vectors with the first rotated by alpha minus beta. The absolute angles drop out; only their difference survives. RoPE uses exactly this property. It splits each query and key vector of width d_k into d_k/2 pairs of components. For a token at position m, it rotates pair i by an angle m times theta_i, where the frequencies theta_i follow the same geometric schedule as the sinusoidal encoding: theta_i = base^(-2i / d_k), with base originally set to 10,000. A query at position m and a key at position n are each rotated according to their own positions. When their dot product is taken, the rotations combine into a single rotation by (m minus n) times theta_i for each pair. The attention score therefore depends on the content of the query and key and on their relative offset, m minus n, but not on their absolute positions. In symbols: if R(m) denotes the block-diagonal rotation for position m, then the score between query q at position m and key k at position n is (R(m) q) · (R(n) k) = q · (R(n minus m) k), with the sign convention depending on which vector one regards as rotated relative to the other. Whatever the convention, absolute position cancels. This is an attractive combination. Position is injected at every layer, directly into the query-key comparison, rather than once at the input. Content and position are not added together in the residual stream; values are not rotated at all, so what a token contributes is free of positional contamination. The method is relative in effect, but it is applied to each token independently, so it costs only a cheap element-wise operation on queries and keys and does not require computing an n-by-n bias matrix. And because rotation preserves length, it does not distort the magnitude of the scores. The frequencies give RoPE a natural multi-scale structure. The highest-frequency pairs rotate by about one radian per token and complete a full turn every six or seven tokens; they are sensitive to fine positional detail but wrap around quickly, so two tokens 100 apart and 106 apart look similar to them. The lowest-frequency pairs, with base 10,000 and d_k = 128, rotate so slowly that their wavelength is around 54,000 tokens; they change little across a short context and serve almost as position-free channels that heads can use for content-based matching. Su and colleagues also showed that, averaged over content, the RoPE score tends to decay as the relative distance grows, a mild built-in preference for nearby tokens that resembles, in softer form, ALiBi's explicit penalty. Extending the context window RoPE does not by itself extrapolate well. A model trained with RoPE on sequences of 2,048 tokens and run on 4,096 encounters rotation angles in its low-frequency dimensions that it never saw during training, and its perplexity rises sharply. What RoPE offered was not extrapolation but something more useful: a clean, parametric description of position that could be manipulated after training. Between 2023 and 2024 a series of techniques exploited this to stretch context windows by large factors with little additional training. The first was position interpolation, published by Shouyuan Chen and colleagues at Meta in June 2023, and discovered independently around the same time by a hobbyist developer who posted it online. The idea is to squeeze rather than stretch. To run a model trained on 2,048 positions over 8,192, divide every position index by four before computing the rotations. Position 8,000 is rotated as if it were position 2,000. The model never sees an angle outside its training range; it simply sees positions packed more densely. With a short period of fine-tuning, around a thousand steps, Chen's team extended LLaMA models from 2,048 to 32,768 tokens with good results. Interpolation has a cost. Dividing all positions by four also compresses the high-frequency dimensions, which had no extrapolation problem and which the model relies on to distinguish adjacent tokens. Squeezing them blurs local order. A series of refinements addressed this by treating frequencies differently. "NTK-aware" scaling, again first circulated informally in 2023, increases the RoPE base rather than dividing positions, which spreads the adjustment unevenly: low frequencies are slowed substantially while high frequencies are left nearly untouched. YaRN, published by Bowen Peng, Jeffrey Quesnelle, Honglu Fan and Enrico Shippole in 2023, divided the frequency spectrum into bands, leaving the highest frequencies alone, fully interpolating the lowest, and blending in between, and added a small correction to the attention temperature to compensate for the change in score distribution at long range. YaRN extended LLaMA 2 models to 128,000 tokens with modest fine-tuning. Model developers also simply raised the base. Meta's Llama 3, released in 2024, used a RoPE base of 500,000 rather than 10,000, which slows every frequency and makes long wavelengths far longer from the start; Llama 3.1 then applied a frequency-dependent rescaling of the YaRN type to reach a 128,000-token window. Code Llama, a year earlier, had used a base of one million for the same reason. LongRoPE, from Microsoft researchers in 2024, used a search procedure to find a separate rescaling factor for each frequency and reported extending a model's window beyond two million tokens. Each of these is a way of reconciling two demands. The model's positional machinery must assign distinguishable signals to every position in the new, longer window, and those signals must remain close enough to the ones seen in training that the learned weights still apply. RoPE made this reconciliation tractable because position enters through a small number of known frequencies that can be adjusted analytically, rather than through a learned table that has no meaningful value outside its range. Do models need explicit position at all? One last result complicates the story. In 2022 Adi Haviv and colleagues reported that decoder-only language models trained with no position encoding at all, a configuration they called NoPE, achieved perplexity close to that of models with explicit encodings. Amirhossein Kazemnejad and colleagues followed in 2023 with evidence that NoPE could, on some synthetic tasks, generalise to longer sequences better than models with RoPE or ALiBi. How can a model with no position signal know order? The answer is the causal mask. In a decoder, position one can attend only to itself, position two to two tokens, position n to n tokens. A head that attends uniformly over everything it is allowed to see produces an average whose properties, such as how much any single token contributes, depend on how many tokens are visible, and therefore on position. The mask leaks order into the computation, and gradient descent learns to exploit the leak. This does not work for encoder models, which have no causal mask, and NoPE has not displaced RoPE in production models. Some recent architectures do combine the two, interleaving layers with RoPE and layers without any position encoding, on the reasoning that the position-free layers may be better at retrieving information regardless of distance. The broader lesson is that position in a transformer is not a single feature added at the input but a property that can enter through several channels, and the choice among them shapes what the model finds easy and what it finds hard, especially at the edge of its context. Chapter 5. Encoders, Decoders, and the Triumph of Prediction The 2017 transformer was a translation machine with two halves. Within two years, researchers had split it apart and found that each half was useful on its own. Three families emerged: encoder-only models, which read text and produce representations of it; decoder-only models, which generate text one token at a time; and encoder-decoder models, which keep the original pairing. For a few years the three coexisted, each dominant in its niche. Then, as models grew, the decoder-only family absorbed most of the field. Understanding why tells us something about what the transformer is good at, and it also explains why the cost problems of later chapters are framed almost entirely in terms of autoregressive generation. The original pairing In the translation transformer, the encoder is a stack of blocks with unmasked self-attention: every source token can attend to every other source token, in both directions. Its output is a sequence of vectors, one per source token, each enriched with context from the whole sentence. The decoder is a stack of blocks with three sublayers instead of two. The first is masked self-attention over the target tokens generated so far, using the causal mask from Chapter 2. The second is cross-attention, in which queries come from the decoder's own stream while keys and values come from the encoder's final output. This is the direct descendant of Bahdanau's attention: at each target position, the decoder asks which source tokens are relevant. The third is the feed-forward network. During training, the decoder sees the whole correct target sentence, shifted right by one position, and predicts every next token in parallel. During translation, it generates one token at a time, feeding each output back in as the next input. The design separates understanding from production. The encoder can look at the whole input at once, which suits comprehension; the decoder must be causal, because it produces output in order. That asymmetry seemed natural for translation, summarisation, and any task framed as transforming one text into another. Encoder-only: BERT and representation learning In October 2018 Jacob Devlin, Ming-Wei Chang, Kenton Lee and Kristina Toutanova at Google released BERT, for Bidirectional Encoder Representations from Transformers. BERT was the transformer's encoder alone, trained on a large unlabelled corpus of books and English Wikipedia, around 3.3 billion words, and then adapted to specific tasks. The difficulty with training an encoder on unlabelled text is choosing what to predict. A causal language model predicts the next word, but an encoder that sees the whole sentence could simply look at the answer. BERT's solution was masked language modelling. During training, 15 percent of input tokens were selected; most of these were replaced with a special [MASK] symbol, some with a random token, and a few left unchanged. The model had to predict the original tokens from their context on both sides. A second objective, next-sentence prediction, asked whether two segments were consecutive in the original text; later work, notably RoBERTa from Facebook AI in 2019, found it unnecessary and dropped it while training longer on more data. BERT's results were striking. Its large version, with 24 layers, width 1,024, 16 heads and about 340 million parameters, set new records on the GLUE benchmark of language understanding, on the SQuAD question-answering benchmark, and on several others. The method of use was as influential as the scores: take the pre-trained encoder, add a small task-specific output layer, and fine-tune the whole thing for a few epochs on labelled data. Tasks that had each required bespoke architectures now shared one recipe. Encoder-only models remain widely used, though rarely in the headlines. Search engines, recommendation systems, and retrieval components of larger AI systems depend on embedding models, which map a text to a single vector so that similar texts land near each other. Most embedding models are encoders in the BERT lineage. Their bidirectional attention lets every token's representation reflect the full input, which suits tasks where the whole text is available at once and nothing needs to be generated. Decoder-only: GPT and the next token Four months before BERT, in June 2018, Alec Radford and colleagues at OpenAI described a model now known as GPT. It was the transformer's decoder without cross-attention: a stack of masked self-attention and feed-forward blocks trained to predict the next token on a corpus of about seven thousand unpublished books. Like BERT, it was then fine-tuned on specific tasks, and it improved the state of the art on many of them, though BERT's bidirectional encoder soon surpassed it on understanding benchmarks. The difference between the two objectives is worth stating precisely. A causal language model is trained to maximise the probability of each token given all the tokens before it. If the sequence is t_1, t_2, ..., t_n, the training loss is the average over positions of minus log P(t_i | t_1, ..., t_(i-1)). This is an ordinary likelihood objective: the model assigns a probability to every possible text, and training makes the real texts more probable. Because of the causal mask, a single forward pass over a sequence of n tokens yields n predictions, each a full training signal. Every token in the corpus is a target. Masked language modelling, by contrast, provides a learning signal only at the masked positions, about 15 percent of tokens. It also does not define a straightforward probability distribution over whole texts, so a masked model cannot easily generate text. Its advantage is bidirectional context for every representation. The decisive move came with GPT-2 in February 2019. Radford and colleagues trained a 1.5-billion-parameter decoder on WebText, about 40 gigabytes of text from web pages linked from Reddit posts with some minimum level of engagement. They did not fine-tune it. Instead they showed that the pre-trained model could perform tasks if the task was written as text to be continued. Appending "TL;DR:" to an article prompted something like a summary. Presenting an English sentence followed by an equals sign and a French sentence, a few times, and then a new English sentence with an equals sign, prompted a translation. The results were well below task-specific systems, but the principle was established: a model trained only to predict the next token had acquired, as a by-product, some ability to perform tasks it had never been explicitly trained on. OpenAI initially withheld the full model, citing concerns about misuse, and released it in stages over nine months. GPT-3, described by Tom Brown and colleagues in May 2020, scaled the same design to 175 billion parameters and about 300 billion training tokens. The paper's title, "Language Models are Few-Shot Learners," named its finding. With a handful of examples placed in the prompt, and no change to the model's weights, GPT-3 performed competitively on many tasks for which earlier systems had needed fine-tuning. This behaviour, called in-context learning, became the defining capability of large language models, and Chapter 6 discusses a mechanism that partly explains it. Encoder-decoder: T5 and the unification attempt The third family kept both halves. T5, the Text-to-Text Transfer Transformer from Raffel and colleagues at Google, cast every task as converting an input text to an output text: "translate English to German: That is good." becomes "Das ist gut."; "cola sentence: The course is jumping well." becomes "not acceptable." Its pre-training objective was span corruption: replace random spans of the input with sentinel tokens and train the decoder to output the missing spans. The T5 paper was an unusually systematic study. Its authors compared architectures, objectives, data sets and scales, and found that encoder-decoder models with a span-corruption objective were the strongest of the configurations they tested at matched computational cost. Encoder-decoder models remained competitive for several years. BART, from Facebook AI, used the pairing for generation tasks such as summarisation. Google's speech recognition and translation systems, and OpenAI's Whisper speech model, released in 2022, use encoder-decoder transformers, which suit tasks where a fixed input, such as an audio clip, is transformed into an output sequence. Table 2 sets the three families side by side. Table 2. The three transformer families compared. Family Attention pattern Typical pre-training objective Representative models Typical uses Encoder-only Bidirectional self-attention Masked token prediction BERT, RoBERTa, DeBERTa Classification, retrieval, embeddings Decoder-only Causal self-attention Next-token prediction GPT series, PaLM, LLaMA Open-ended generation, chat, code, general assistants Encoder-decoder Bidirectional encoder, causal decoder, cross-attention Span corruption or denoising T5, BART, Whisper Translation, summarisation, speech-to-text Why the decoder won By 2023 almost every frontier language model was decoder-only. Several reasons combined, and none is sufficient alone. The first is simplicity of the objective at scale. Next-token prediction turns every token of raw text into a training example and requires no decisions about masking rates or span lengths. When the bottleneck on progress became the amount of computation and data that could be poured into one model, an objective that used all of the data with no wasted positions and no design choices was attractive. The second is generality of the interface. A decoder can generate text, and once it can generate text, nearly any task can be posed as a prompt and answered as a continuation. Classification becomes generating a label word; retrieval-augmented question answering becomes generating an answer after the retrieved passages; translation becomes generating the target after the source. The encoder-decoder model can do this too, but it must divide the context into an input part and an output part, and the dividing line is not always natural in a multi-turn conversation or an extended document where the model's own previous outputs become input. The third is efficiency of reuse during generation. A decoder-only model generating a response processes the prompt and its own outputs with the same stack, and caches keys and values from every previous token so they need not be recomputed. Chapter 8 discusses this cache at length. In an encoder-decoder model, the encoder runs once on the input, which is efficient, but any new input in a conversation requires either re-encoding or awkward bookkeeping. The fourth is empirical, and it is the most debated. In 2022 Thomas Wang and colleagues ran a controlled comparison of architectures and objectives at a scale of about five billion parameters. They found that encoder-decoder models trained with masked objectives did best after multitask fine-tuning, but that decoder-only models trained with plain next-token prediction did best at zero-shot generalisation, performing tasks straight from a prompt. Since the strategic bet of the large labs was on zero-shot and few-shot use, the decoder was the natural choice. It is not clear that encoder-decoder models are fundamentally worse at large scale; there is simply far less evidence about them, because few groups trained them at the frontier after 2021. Finally, decoder-only models combined naturally with the next phase of training. After pre-training, modern assistants are adapted by supervised fine-tuning on examples of desired behaviour and then by reinforcement learning, from human feedback or from automatically checkable rewards, to follow instructions and produce useful answers. These methods operate on generated text, and fit an architecture whose native operation is generation. The consequence for cost The triumph of the decoder had a direct effect on where the transformer's costs fell. An encoder processes a fixed input in one parallel pass, and its quadratic attention cost is paid once. A decoder generating text pays in two phases with very different profiles. In the first phase, called prefill, the model processes the prompt. All prompt tokens are known, so this proceeds exactly as in training: a fully parallel pass with causal masking, costing quadratic attention arithmetic over the prompt length. The GPU is well used. In the second phase, decode, the model generates one token at a time. Each new token needs a query, which must be compared against the keys of every previous token, and a weighted sum of their values. Recomputing all those keys and values every step would be wasteful, so they are stored, layer by layer and head by head, in the key-value cache. Each step then computes only one new query, key and value per head, appends the new key and value to the cache, and attends over the whole cache. The arithmetic for that step is linear in the context length. But every step must read the entire cache from memory, and generating a thousand tokens means doing so a thousand times. That memory traffic, rather than the arithmetic, is what limits generation speed in practice, and it grows with every token of context. Much of the long-context engineering of Chapters 8 and 9 is an attack on the cache. It is a problem that belongs specifically to autoregressive decoders, and it became central precisely because the decoder won. Chapter 6. What Attention Learns The formula for attention says how information can move. It does not say what information does move in a trained model. The weights that determine queries, keys and values are learned, and what they learn is not written down anywhere. For several years this left a gap between a precise understanding of the mechanism and a vague one of its use. Since about 2019, a body of research has begun to close that gap. It has found that some attention heads implement identifiable, almost algorithmic functions, that these functions compose across layers, and that one of them, the induction head, appears to underlie a central capability of large language models. It has also found that attention weights are a less reliable window into a model than they first appeared. Both findings matter for understanding why the architecture works and what is lost when it is approximated. Reading the attention matrix The most direct way to inspect a head is to look at its weight matrix A for some input: the n-by-n array whose row i shows how much position i attends to each other position. Researchers did this from the beginning. The transformer paper's appendix included examples in which some heads in the encoder of a translation model appeared to resolve the antecedents of pronouns and others to track sentence structure. A systematic study by Kevin Clark, Urvashi Khandelwal, Omer Levy and Christopher Manning in 2019 examined all 144 heads of BERT-base, twelve layers of twelve heads each. They found several recurring patterns. Some heads attended almost entirely to the previous token or the next token. Some attended broadly across the whole sentence. A strikingly large share of attention, in many heads, went to the special separator token [SEP] or to punctuation such as commas and full stops. Most interestingly, specific heads corresponded closely to specific syntactic relations. One head attended from verbs to their direct objects with high accuracy; another from nouns to their determiners; another from possessive pronouns to the nouns they modified; another linked coreferent mentions. No head was a complete parser, but for several standard dependency relations there was a head that recovered it far better than a simple positional baseline. John Hewitt and Christopher Manning, also in 2019, approached the same question from the representations rather than the attention weights. They showed that a linear transformation of BERT's hidden vectors could recover the distances between words in a syntax tree. The model had not been told about grammar. It had learned an internal geometry that encoded it, because doing so helped predict masked words. The trouble with attention as explanation The apparent readability of attention weights led to a common practice of presenting them as explanations: highlight the input words a model attended to, and say that these were the reasons for its prediction. In 2019 Sarthak Jain and Byron Wallace challenged this in a paper titled "Attention is not Explanation." Working with recurrent models with attention on text classification tasks, they showed that attention weights often correlated poorly with other measures of word importance, and that one could often construct quite different attention distributions that yielded the same prediction. Sarah Wiegreffe and Yuval Pinter replied, in "Attention is not not Explanation," that the adversarial distributions were not ones the model would naturally produce and that attention did carry useful information under appropriate tests. The exchange did not end with a clean verdict, but it established a caution that has held up. Transformers make the caution stronger. The value a head retrieves from position j is not token j's original embedding. It is a projection of the residual stream at j, which after a few layers already blends information from many positions. A head in layer ten attending strongly to the word "it" may actually be retrieving information about the noun that "it" refers to, written there by an earlier head. Samira Abnar and Willem Zuidema proposed in 2020 to address this with "attention rollout," multiplying attention matrices across layers to trace flow back to the input, but this too is an approximation that ignores the feed-forward layers and the value contents. A related observation reveals something about how attention is used, not just how it should be read. Many heads place a large share of their weight on the first token of the sequence, or on a delimiter, regardless of content. Kevin Clark and colleagues saw this in BERT; Guangxuan Xiao and colleagues studied it in large decoder models in 2023 and called these positions "attention sinks." The explanation is a quirk of softmax. Its outputs must sum to one, so a head that has nothing useful to retrieve for a given query cannot simply attend to nothing. It needs somewhere harmless to put its weight, and the model learns to use an early, always-visible token whose value contributes little. Xiao's group showed that this had practical consequences: if a long-running generation discarded the earliest tokens from its cache to save memory, quality collapsed, but keeping just the first four tokens alongside a recent window restored it. They called the resulting method StreamingLLM. Other researchers have since experimented with adding an explicit learnable "sink" or allowing the softmax to sum to less than one, to give heads a sanctioned way to abstain. Circuits The most productive approach to understanding attention has been mechanistic: treat a trained transformer as a program to be reverse-engineered, and identify the specific combinations of components, called circuits, that implement particular behaviours. The framework from Anthropic's 2021 paper by Elhage and colleagues, mentioned in Chapter 3, made this tractable by rewriting an attention head as two nearly independent circuits. The query-key circuit, determined by the product of W_Q and W_K^T, decides where each position attends: it is a bilinear form saying how much a token with property a should attend to a token with property b. The output-value circuit, determined by the product of W_V and the head's slice of W_O, decides what information moves once a position is attended to and how it is written into the residual stream. A head can thus be analysed as answering two separate questions: "Which tokens should I look at?" and "What should I copy from them?" The authors studied very small attention-only transformers, with no feed-forward layers, so that every computation could be traced. In a one-layer model, they found heads that implemented skip-trigram patterns: if token A appears somewhere earlier and the current token is B, raise the probability of C. A head might learn that after "keep" and later "in," the token "mind" is likely. These patterns are useful but limited: one layer of attention can look at the current token and at earlier tokens, but cannot condition its search on relationships between earlier tokens. Two layers change this, because a head in the second layer can use, in its query, key or value, information that a first-layer head has written into the stream. The authors called this composition. If a first-layer head writes into each position "the previous token was X," then a second-layer head can use that as its key, and so search for positions whose previous token matches something. Induction heads That composition yields the circuit that has become the best-known finding in transformer interpretability. Consider text in which a pattern repeats: a name like "Mrs Dursley" appears, and later "Mrs" appears again. A good predictor should guess that "Dursley" follows. More generally, if the sequence contains "A B ... A," predict "B." A two-layer transformer can implement this with two heads. In the first layer, a previous-token head at each position attends to the position immediately before it and copies that token's identity into the stream. Now every position carries a note saying which token preceded it. In the second layer, an induction head at the current position, whose token is A, issues a query looking for positions whose "previous token" note says A. It finds the position just after the earlier A, which holds B. Its output-value circuit copies B's identity forward, raising the probability that the model predicts B next. The mechanism is precise: it uses relative position, through the previous-token head, and content matching, through the query-key circuit, to look up what followed the last occurrence of the current token. Catherine Olsson and colleagues at Anthropic, in a 2022 paper titled "In-context Learning and Induction Heads," made a broader argument. They tracked many models, small and large, through training and observed that at a specific point, early in training, these heads formed abruptly. At the same moment, the models' in-context learning ability improved sharply. They measured in-context learning by how much better the model predicted tokens late in a long context than early in it, that is, how much it benefited from having more text to draw on. This improvement appeared in a sudden phase change, visible as a bump in the training loss curve, coinciding with the formation of induction heads. In small attention-only models, where interventions could be precise, removing the induction heads removed most of the in-context learning. In larger models, the authors offered several lines of correlational evidence that the same mechanism, or more abstract generalisations of it, were responsible for a large part of in-context learning. The induction head is a specific, mechanistic link between the architecture and its most celebrated emergent capability. Few-shot prompting, in which a model is shown a handful of input-output examples and then a new input, is a sophisticated version of "A B ... A, predict B." Larger models appear to contain fuzzier induction heads that match not exact tokens but similar meanings, so that the pattern "translation of a word follows the word" can be continued for a word never seen in the prompt. The induction head also makes a point about architecture that matters for later chapters. It depends on the ability of a single position to retrieve a specific token from an arbitrary earlier location in the context, chosen by content. This is exactly what full attention offers and what compressed alternatives, which summarise the past into a fixed-size state, find hardest. When Chapter 11 discusses why state-space models lag transformers at certain recall tasks, the reason is visible here. Other identified mechanisms Induction heads are the clearest case, but not the only one. In 2022 Kevin Wang and colleagues reverse-engineered how GPT-2 small completes sentences of the form "When Mary and John went to the store, John gave a drink to ..." with "Mary." They identified a circuit of 26 heads in several functional classes: heads that detect the duplicated name, heads that suppress it, and "name mover" heads that copy the remaining name to the output. They also found backup name movers that took over when the primary ones were ablated, a vivid example of redundancy in a trained network. Research on factual recall, including the Meng study mentioned in Chapter 3 and follow-up work by Mor Geva and colleagues in 2023, has traced how a model answers "The Eiffel Tower is in the city of": early feed-forward layers at the subject tokens enrich the representation of "Eiffel Tower" with attributes, and later attention heads at the final position extract the relevant attribute, the city, from the subject's position. Attention here acts as a retrieval mechanism over an enriched representation, not as a store of the fact itself. Limits of the circuit picture Two difficulties prevent this approach from yet giving a full account of large models. The first is superposition. Models have far more features they would like to represent than dimensions in their residual stream, and research by Elhage and colleagues in 2022 showed that small networks learn to store more features than they have dimensions, by encoding them as nearly orthogonal directions that interfere slightly. Individual neurons, and individual dimensions, then respond to many unrelated features, which makes them hard to interpret one at a time. Work since 2023 on sparse autoencoders, which attempt to decompose activations into a larger set of sparsely active and more interpretable features, has made progress on this, and in 2024 Anthropic and others reported extracting millions of interpretable features from production-scale models. But mapping features into complete circuits at that scale remains laborious. The second difficulty is scale itself. A model with 80 layers and 64 heads per layer has over five thousand heads, each of which may play several roles depending on context. The successes so far are islands of understanding. They are enough to show that attention heads in trained models do implement legible operations, that those operations compose through the residual stream, and that a key capability of large models can be traced to a specific form of content-addressed retrieval. They are not yet a complete map. What the circuit work establishes for the argument of this booklet is concrete. Full attention's ability to fetch any earlier token by content, at any distance, is not an abstract capacity that models leave unused. Trained transformers rely on it for in-context learning, for copying, for resolving references, and for retrieving facts. Any proposal to make attention cheaper must be judged by whether it preserves that ability, and the record of the next several chapters is largely a record of how hard that is. Chapter 7. Scale, Laws, and Sparse Experts The transformer did not become dominant only because it was better than recurrent networks at a given size. It became dominant because it kept getting better as it grew, smoothly and predictably, across many orders of magnitude. That property turned model building from a craft of architectural invention into something closer to an engineering discipline governed by budgets and forecasts. It also changed the economics of the architecture's costs, because once the main lever of progress was scale, every inefficiency was multiplied by enormous sums. This chapter describes the empirical laws of scaling, the correction that reshaped them, and the mixture-of-experts designs that decouple a model's size from its per-token cost. These belong in an account of attention because they explain why the attention bottlenecks of the following chapters became so pressing: scale made context valuable, and context is where attention is expensive. Smooth power laws In January 2020 Jared Kaplan, Sam McCandlish and colleagues at OpenAI published "Scaling Laws for Neural Language Models." They trained many decoder-only transformers, ranging from under a thousand to over a billion non-embedding parameters, on varying amounts of text, and measured the test loss: the average negative log probability the model assigned to held-out tokens. Lower is better. They found that the loss followed a power law in each of three quantities when the others were not limiting: the number of parameters N, the number of training tokens D, and the amount of compute C used in training. A power law has the form L = (X_0 / X)^alpha: double X and the loss falls by a constant factor. On a plot with logarithmic axes it is a straight line. For parameters, they estimated an exponent of about 0.076; for data, about 0.095; for compute, about 0.050. These are small exponents. Halving the loss attributable to model size would require increasing N by a factor of roughly 2^(1/0.076), more than nine thousand. But the trends held cleanly over six or seven orders of magnitude, with no sign of levelling off within the tested range. Just as notable was what did not matter much. Within broad limits, the shape of the transformer, whether it was deep and narrow or shallow and wide, how many heads it had, and the ratio of feed-forward to model width, had only small effects on loss at a given parameter count. Performance depended mostly on scale. This was a powerful simplification, and also a challenge to architecture research. A new design had to beat not a fixed baseline but a baseline that improved predictably with resources. Kaplan and colleagues drew a practical conclusion about allocation. If a fixed compute budget C can be spent on a larger model trained on fewer tokens or a smaller model trained on more, which is better? Using the 6ND approximation for training compute from Chapter 3, they estimated that as the budget grows, most of the increase should go to model size, with data growing more slowly; specifically, optimal model size should scale roughly as C^0.73. This analysis guided the construction of GPT-3 and other models of 2020 and 2021, which were very large relative to the data they were trained on. GPT-3's 175 billion parameters saw about 300 billion tokens, under two tokens per parameter. The Chinchilla correction In March 2022 Jordan Hoffmann and colleagues at DeepMind published "Training Compute-Optimal Large Language Models," which revised that conclusion. They trained over four hundred models, from 70 million to 16 billion parameters, on 5 to 500 billion tokens, and fitted the loss with three independent methods. All three agreed: model size and training tokens should be scaled in roughly equal proportion. Double the compute, and both N and D should increase by a factor of about the square root of two. The compute-optimal ratio came out at roughly twenty training tokens per parameter. A key reason for the disagreement with the earlier work was the learning-rate schedule. Kaplan's experiments had used a fixed schedule length, so models trained on fewer tokens than the schedule assumed were evaluated before their learning rate had decayed fully, which understated the benefit of more data. To test the conclusion, DeepMind trained Chinchilla, a 70-billion-parameter model, on 1.4 trillion tokens, using about the same compute as its earlier 280-billion-parameter model, Gopher, which had seen 300 billion tokens. Chinchilla outperformed Gopher on almost every benchmark they reported, despite being a quarter of the size. It was also four times cheaper to run. That last point exposed a gap in "compute-optimal." The Chinchilla analysis minimises the cost of training a model to a given loss. But a deployed model is trained once and then run, often billions of times. If inference cost matters, it is worth training a smaller model on far more tokens than the Chinchilla ratio suggests: the extra training compute is paid once, while the smaller model's lower inference cost is collected on every query. After 2022, developers pushed past the Chinchilla ratio by large factors. Meta's LLaMA models of February 2023 trained a 7-billion-parameter model on a trillion tokens. Llama 3, in 2024, trained an 8-billion-parameter model on about 15 trillion tokens, nearly two thousand tokens per parameter, and Meta reported that the models were still improving when training stopped. This trend matters for the argument here. Smaller models trained on more data shift the balance of a model's costs. When the weights are relatively small, the memory and bandwidth consumed by the key-value cache for long contexts becomes a larger fraction of the total cost of serving the model. A trend that made models cheaper per parameter made context relatively more expensive. What the laws do not say Scaling laws describe the average loss on next-token prediction. They do not directly predict specific capabilities, such as solving arithmetic problems or following multi-step instructions. A 2022 study led by Jason Wei catalogued "emergent abilities," tasks on which performance stayed near chance as models grew and then rose sharply above some scale. In 2023 Rylan Schaeffer, Brando Miranda and Sanmi Koyejo argued that many of these apparent discontinuities were artefacts of the metrics chosen: an all-or-nothing score, such as exact-match accuracy on a multi-digit sum, can jump abruptly even when the underlying per-token probabilities improve smoothly. The debate has not entirely settled, but its practical lesson is that smooth loss curves can conceal threshold effects in what users experience. The laws also do not establish that the transformer is the only architecture that scales. They show that it scales reliably, and that matching it requires a design that scales at least as well. Several challengers discussed in Chapter 11 have published their own scaling curves, and the question that matters is whether their lines lie above or below the transformer's at the scales people actually train. Mixture of experts Scaling laws suggest that more parameters help. The 6N rule says that more parameters cost more compute per token. Mixture-of-experts architectures attempt to break that link: give the model many parameters, but use only a fraction of them for any given token. The idea is older than the transformer. Robert Jacobs, Michael Jordan, Steven Nowlan and Geoffrey Hinton described mixtures of experts in 1991. In 2017 Noam Shazeer and colleagues at Google applied a sparsely gated version to large recurrent language models, with thousands of experts, and showed large gains in capacity at modest computational cost. The transformer version replaces the dense feed-forward network in some or all blocks with a set of E expert networks, each an ordinary feed-forward network, and a router. For each token, the router, a small learned linear layer followed by softmax, scores the experts; the token is sent to the top k of them, typically one or two; and their outputs are combined, weighted by the router scores. If a model has 8 experts per layer and routes each token to 2, it holds roughly four times the feed-forward parameters of a dense model with the same per-token computation. Since feed-forward layers hold most of a transformer's parameters, the effect on total size is large. The Switch Transformer, by William Fedus, Barret Zoph and Shazeer in 2021, simplified routing to a single expert per token and scaled to over a trillion parameters. They reported reaching the same quality as a dense T5 baseline up to seven times faster in pre-training time at equal computation per token. Mixtral 8x7B, released by Mistral AI in December 2023, brought the approach to widely used open models. It has eight experts per layer and routes each token to two, giving about 47 billion total parameters but about 13 billion active per token, and it matched or exceeded the dense 70-billion-parameter Llama 2 on most of the benchmarks its developers reported. DeepSeek-V3, released in December 2024, pushed the ratio further, with 671 billion total parameters and 37 billion activated per token, using many small, finely divided experts plus a shared expert that every token uses. Mixture-of-experts models have real difficulties. Routers tend to collapse onto a few favoured experts unless training includes an auxiliary loss or other mechanism that encourages balanced use. Experts on different devices require tokens to be shuffled across the network, adding communication costs. And while computation per token falls, memory does not: all the experts must be held somewhere, so a mixture-of-experts model needs as much memory for its weights as a dense model of the same total size. Where attention fits Notice what mixture of experts changes and what it leaves alone. It makes the feed-forward layers sparse. It does nothing to attention. Every token still attends to every previous token, with the same quadratic score computation and the same key-value cache. Indeed, by making the feed-forward part cheaper per token, mixture of experts increases the share of total computation and memory that attention consumes. This pattern recurs throughout the architecture's evolution. Scale made models more capable, and more capable models made longer contexts worth having: an assistant that can read a whole codebase, a contract, or a book is more useful than one limited to a few pages. Context windows that were 2,048 tokens for GPT-3 in 2020 had become 128,000 tokens or more in widely available models by 2024, and a million tokens or more in some. The feed-forward layers, being position-wise, cost the same per token at any context length. Attention does not. By the time scaling had made models good enough to use long contexts well, attention had become the part of the transformer that most needed fixing. The next chapter measures exactly how much it costs. Chapter 8. The Quadratic Wall and the Memory Wall It is common to say that attention is quadratic in sequence length and leave it there. That statement is true and incomplete. It describes the arithmetic of one phase of computation. It does not describe the cost that actually limits long-context models in use, which is mostly a matter of moving bytes rather than multiplying them, and which grows linearly rather than quadratically. To understand which of the architecture's later changes addressed which problem, one has to count both arithmetic and memory, separately, for each phase. This chapter does that counting with real model dimensions. Two resources: arithmetic and bandwidth A modern accelerator, such as an NVIDIA H100 GPU, has two relevant limits. One is how fast it can do arithmetic. An H100 in its SXM form can perform on the order of a thousand trillion floating-point operations per second on the 16-bit matrix multiplications that dominate neural network computation. The other is how fast it can move data between its main memory, called high-bandwidth memory or HBM, and the compute units. For the same chip, that is about 3.35 terabytes per second. The ratio of these two numbers, roughly 300 operations per byte, determines which limit binds for a given computation. If a computation performs many operations for each byte it reads from memory, it is compute-bound: the arithmetic units are the bottleneck and bandwidth sits partly idle. If it performs few operations per byte, it is memory-bound: the arithmetic units wait for data. The number of operations per byte is called the computation's arithmetic intensity. This framing, formalised as the "roofline model" by Samuel Williams, Andrew Waterman and David Patterson in 2009, is the most useful single tool for reasoning about transformer performance. A large matrix multiplication has high arithmetic intensity. Multiplying two n-by-n matrices reads about 2n squared numbers and performs about 2n cubed operations, so its intensity grows with n. Element-wise operations, such as applying softmax or adding a residual, have low intensity: each number read is used a handful of times. Transformer computation is a mix, and which kind dominates depends on the phase. The chip also has a much smaller, much faster memory on the processor itself, called SRAM, amounting to a few tens of megabytes on an H100, much of it divided into small per-processor slices of a couple of hundred kilobytes each, with bandwidth many times that of HBM. Keeping data in SRAM, rather than writing it out to HBM and reading it back, is the central idea of the most important attention optimisation, described in Chapter 9. Counting the prefill Take a concrete model. Llama 2 70B, released by Meta in 2023, has 80 layers, model width d_model = 8,192, 64 query heads of dimension 128, and 8 key-value heads (an arrangement explained in Chapter 9). Consider a prompt of n tokens processed in a single prefill pass. The weight multiplications cost about 2 times the parameter count per token, about 140 billion operations per token, or 140 billion times n in total. This is linear in n. The attention score computation, per layer, computes QK^T for 64 heads, each an n by 128 matrix times a 128 by n matrix: about 2 times 64 times 128 times n squared, or roughly 16,000 times n squared operations. The weighted sum with V costs the same again. Across 80 layers, the total is about 2.6 million times n squared operations. With causal masking, about half of these can be skipped, giving roughly 1.3 million times n squared. Setting the two equal: 140 billion times n equals 1.3 million times n squared, which gives n of about 100,000. Below a prompt of roughly a hundred thousand tokens, the linear weight multiplications dominate prefill arithmetic for this model. Above it, attention dominates, and grows quadratically. At 4,000 tokens attention is about 4 percent of prefill arithmetic; at 32,000 tokens about a quarter; at a million tokens about 90 percent. The general rule from Chapter 3 gives the same picture: attention arithmetic per token per layer is about 4 times n times d_model, the weights cost about 24 times d_model squared, and the crossover sits near n = 6 d_model, here about 50,000 tokens before accounting for causal masking. Prefill is compute-bound in both regimes, because both the weight multiplications and the attention products are large matrix multiplications. The quadratic term therefore appears directly as wall-clock time. On a node of eight H100s, a million-token prefill for a model of this size takes minutes rather than seconds, and doubling the prompt more than doubles the wait. The memory of naive attention The arithmetic is not the only quadratic cost in prefill. A straightforward implementation computes the full score matrix S = QK^T / sqrt(d_k), writes it to HBM, reads it back to compute the softmax, writes the probabilities P, then reads P back to multiply by V. For one head and n = 32,000 tokens, S has about a billion entries, which at two bytes each is 2 gigabytes. For all heads in one layer simultaneously, it would exceed the memory of any single accelerator. Moreover, every one of those reads and writes is an element-wise pass with low arithmetic intensity. The softmax over an n-by-n matrix performs a few operations per entry and moves every entry in and out of HBM. In 2022, Tri Dao and colleagues measured that in standard implementations of attention for typical sequence lengths, much of the run time was spent not in the two matrix multiplications but in these memory-bound intermediate steps. The quadratic memory traffic of the score matrix, not its quadratic arithmetic, was the practical bottleneck. Chapter 9 explains how FlashAttention removed it without changing the result. Counting the decode Generation is a different story. After prefill, the model produces one token per step. At each step, for each layer, it computes the new token's query, key and value, appends the key and value to the cache, computes the query's scores against all n cached keys, takes a softmax, and forms the weighted sum of the n cached values. The arithmetic per step is modest: the weight multiplications for one token, about 140 billion operations for the 70B model, plus attention over n cached positions, about 4 times n times 8,192 times 80, or 2.6 million times n operations. At n = 100,000, that is about 260 billion operations for attention, comparable to the weights. But consider the memory traffic. To process one token, the model must read every weight from HBM: 70 billion parameters at two bytes each is 140 gigabytes. It must also read the entire key-value cache. The arithmetic intensity of the weight multiplications is about one operation per byte for a single sequence, three hundred times below the H100's balance point. Decode is overwhelmingly memory-bound. Generating one token cannot take less time than reading the weights and cache from memory. This is why serving systems batch many users' requests together. The weights are read once per step and used for every sequence in the batch, multiplying arithmetic intensity by the batch size. A batch of 64 sequences raises the weight multiplications to about 64 operations per byte, still memory-bound but far better. The key-value cache, however, cannot be shared this way. Each sequence has its own cache, and each must be read in full at every step. Batching amortises weights but not the cache. The key-value cache in numbers The size of the cache follows directly from the architecture. For each layer and each key-value head, for each token, it stores one key vector and one value vector of dimension d_head. In bytes: KV cache = 2 × L × h_kv × d_head × n × bytes per number where the leading 2 counts keys and values. Table 3 works this out at 16-bit precision for three published model configurations. Table 3. Key-value cache size per sequence at 16-bit precision, computed from published architecture settings. Model Layers KV heads × head dim Cache per token Cache at 4,096 tokens Cache at 128,000 tokens GPT-3 175B (full multi-head) 96 96 × 128 4.7 MB 19 GB 604 GB Llama 2 70B (grouped-query) 80 8 × 128 0.33 MB 1.3 GB 42 GB Llama 3 8B (grouped-query) 32 8 × 128 0.13 MB 0.5 GB 16.8 GB The configurations are those published by OpenAI for GPT-3 and by Meta for the Llama models; the cache sizes are computed from the formula above. GPT-3 never ran at 128,000 tokens; the column shows what its full multi-head design would have required. Several facts stand out. First, under full multi-head attention, a large model's cache for a single long sequence would exceed the memory of an entire eight-GPU server, which holds 640 gigabytes. Second, the reduction from 96 key-value heads to 8, in otherwise comparable designs, cuts the cache by more than an order of magnitude; Chapter 9 explains how that reduction is achieved without destroying quality. Third, even with that reduction, a 128,000-token context for Llama 2 70B needs 42 gigabytes per sequence, about a third of the model's own weights. Serve thirty such sequences at once and the caches outweigh the model several times over. For the small model the situation is starker. Llama 3 8B's weights occupy about 16 gigabytes at 16-bit precision. Its cache for one 128,000-token sequence is about the same size. In long-context serving, the cache is often the largest single consumer of accelerator memory, and since every byte of it must be read at every decoding step, it is the dominant cost of generation. Where the walls actually stand The analysis yields a clearer statement of the transformer's long-context problem than "attention is quadratic." During training and prefill, attention's arithmetic is quadratic in n. For large models it overtakes the cost of everything else only at contexts of tens of thousands to a hundred thousand tokens, depending on model width. Below that, it is a significant but not dominant cost. Above it, it dominates, and the time to process a long prompt grows with its square. In naive implementations, the memory traffic of materialising the n-by-n score matrix was a separate and more immediate problem, binding at much shorter lengths. This was an implementation problem rather than a mathematical one, and it has largely been solved. During generation, the binding cost is linear, not quadratic: the size of the key-value cache, which must be stored for every active sequence and read in full at every step. It limits how many users a server can handle at once and how fast each one's text appears. Shrinking the cache is therefore the single most valuable thing an architecture can do for long-context serving. These three costs have different remedies. Faster kernels address the second. Changes to the attention heads address the third. Only changes to the attention computation itself, replacing exact all-pairs comparison with something cheaper, address the first. The next chapter describes the first two kinds of remedy, which kept exact attention competitive. The chapter after that describes the third, and explains why it has been so much harder to make work. Chapter 9. Keeping Exact Attention: Kernels, Heads, and Caches Faced with the costs set out in the previous chapter, there are two broad strategies. One is to change what attention computes, replacing the full comparison of every query with every key by something cheaper. The other is to keep the computation, or something very close to it, and change how it is carried out and what it stores. In practice the second strategy has done far more for the long-context transformers in production use. This chapter covers its three main lines: kernels that compute exact attention without materialising the score matrix, changes to the head structure that shrink the key-value cache, and systems techniques that manage, compress, and distribute that cache. FlashAttention In May 2022 Tri Dao, Daniel Fu, Stefano Ermon, Atri Rudra and Christopher Ré posted "FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness." The key word was IO-awareness. Attention's arithmetic was not changed at all. What changed was the order in which it was performed, so as to minimise traffic between the GPU's large, slow HBM and its small, fast SRAM. The obstacle to computing attention in small pieces is the softmax. Each output row requires normalising over all n scores in that row, which seems to require all of them at once. FlashAttention solves this with a technique known as online softmax, described by Maxim Milakov and Natalia Gimelshein at NVIDIA in 2018 and used for attention by Markus Rabe and Charles Staats in 2021. The idea is to process the keys in blocks while maintaining two running statistics for each query: the largest score seen so far, m, and the sum of exponentials of scores seen so far, each measured relative to m, called l. Along with these, keep a running unnormalised output vector o. When a new block of keys and values arrives, compute its scores, find the block's maximum, and update m to the larger of the old and new maxima. Rescale the old l and o by exp(old m minus new m), to express them relative to the new maximum. Add the new block's exponentials to l and their weighted values to o. After the last block, divide o by l. The result is exactly the softmax-weighted average, computed without ever holding a whole row of scores. Subtracting the running maximum keeps every exponential at or below one, so there is no risk of numerical overflow. FlashAttention combines this with tiling. It loads a block of queries into SRAM, then streams blocks of keys and values through, computing scores, updating the running statistics, and accumulating outputs, all within SRAM. Only the final output for that block of queries is written to HBM. The n-by-n score matrix never exists in slow memory. Memory use for attention falls from quadratic to linear in n, and HBM traffic falls by a large factor. For the backward pass, which in a naive implementation reads the stored probability matrix, FlashAttention stores only the per-row statistics m and l and recomputes the scores block by block when gradients are needed. This trades some extra arithmetic for far less memory traffic, a good trade on hardware where arithmetic is cheap and bandwidth is not. The original paper reported speedups of around three times on GPT-2 training at sequence length 1,024 compared with standard implementations, and made it feasible to train with sequence lengths of 16,000 and 64,000 tokens on hardware where standard attention ran out of memory. FlashAttention-2, in 2023, reorganised the parallelism across GPU thread blocks and reduced non-matrix operations, roughly doubling speed again. FlashAttention-3, in 2024, targeted the H100 specifically, overlapping data movement with computation using the chip's asynchronous hardware units and supporting 8-bit floating-point arithmetic, and reached around three-quarters of the chip's theoretical peak in 16-bit precision. The significance of FlashAttention for the argument of this booklet is that it removed one of the three walls identified in Chapter 8, the quadratic memory traffic of the materialised score matrix, entirely, without approximation. Exact attention became fast enough that, for contexts up to tens of thousands of tokens, approximations offered little practical advantage. FlashAttention did not change the quadratic arithmetic of prefill, and it did not shrink the key-value cache. Those problems remained. Fewer keys and values: multi-query and grouped-query attention The cache stores keys and values for every head. If several query heads could share the same keys and values, the cache would shrink proportionally. Noam Shazeer proposed exactly this in a 2019 paper with the self-explanatory title "Fast Transformer Decoding: One Write-Head is All You Need." In multi-query attention, or MQA, the model keeps many query heads but uses a single key head and a single value head shared by all of them. Each query head still computes its own attention pattern, because its query projection differs, but all heads look up the same keys and retrieve from the same values. The cache shrinks by a factor equal to the number of heads, 32 or 64 or more. Shazeer showed that decoding became much faster with only a small loss in quality. PaLM, Google's 540-billion-parameter model of 2022, used MQA. The quality loss was real, though, and some models trained with MQA were less stable. In 2023 Joshua Ainslie and colleagues at Google proposed grouped-query attention, or GQA, as an intermediate. The query heads are divided into G groups, and each group shares one key head and one value head. With 64 query heads and 8 groups, every 8 query heads share a key-value pair, and the cache is 8 times smaller than full multi-head attention. Ainslie's team found GQA with 8 groups recovered nearly all the quality of multi-head attention while keeping most of the speed of MQA. They also showed that an existing multi-head model could be converted to GQA by averaging its key and value heads within each group and continuing training for a small fraction of the original compute. GQA became the standard. Llama 2's 70B model used it, as Table 3 showed; so did all sizes of Llama 3, Mistral, and many others. The reduction from 64 key-value heads to 8 is why a 70-billion-parameter model of 2023 needs fourteen times less cache memory per token than GPT-3 did, a larger gain than most changes to attention's mathematics have achieved. Compressing keys and values: multi-head latent attention DeepSeek-V2, released by DeepSeek-AI in May 2024, introduced a further step called multi-head latent attention, or MLA. Instead of reducing the number of key and value heads, MLA compresses keys and values into a shared low-dimensional latent vector per token. For each token the model computes a single compressed vector c, of dimension much smaller than the total width of all keys and values, and caches only that. At attention time, keys and values for every head are reconstructed from c by learned up-projections. That might seem to require reconstructing full keys and values at each step, which would cost arithmetic. But because the up-projection for keys and the query projection are both linear, they can be multiplied together in advance and absorbed: the query can be projected directly into the latent space and compared with the cached compressed vectors, and the same absorption can be applied on the value side via the output projection. The model attends over compressed vectors without ever expanding them. A complication is RoPE. The rotation depends on position and sits between the query and key projections, so it prevents the absorption trick. DeepSeek's solution was to split each head's query and key into two parts: a larger part with no positional rotation, which goes through the compressed path, and a small additional part that carries RoPE and is cached separately and shared across heads. DeepSeek reported that MLA reduced the cache by about 93 percent relative to the multi-head attention of their earlier 67-billion-parameter model while improving quality on their benchmarks. DeepSeek-V3 retained the design. MLA shows that the head-sharing logic of MQA and GQA, which reduces the cache by restricting how many distinct keys and values there are, can be generalised into a learned compression that adapts to what the model needs. Restricting the window A different way to bound the cache is to stop attending to everything. In sliding-window attention, each position attends only to the previous w tokens. The cache never holds more than w entries per layer, and the arithmetic per token is bounded by w instead of n. The idea goes back to the local attention suggested in the original transformer paper and to models such as Longformer, by Iz Beltagy, Matthew Peters and Arman Cohan in 2020, which combined a sliding window with a few "global" tokens that attended everywhere. A sliding window does not make distant information invisible. Because layers are stacked, information can propagate: a token at position 10,000 in layer two can attend to position 6,000, whose layer-one representation attended to position 2,000. With L layers and window w, the receptive field reaches about L times w. Mistral 7B, released in September 2023, used a window of 4,096 tokens across 32 layers, giving a theoretical reach of about 131,000 tokens. But information passed through many hops is attenuated and compressed, much as in a recurrent network. Precise retrieval of a specific distant token, the kind of operation induction heads perform, becomes unreliable. Recent models have therefore mixed local and global layers. Google's Gemma 2, in 2024, alternated sliding-window layers with a 4,096-token window and full-attention layers. Gemma 3, in 2025, used five local layers for every global one with a window of 1,024 tokens, so that most layers have small caches and only a sixth of the layers need cache proportional to the full context. The global layers preserve exact long-range retrieval; the local layers handle the bulk of the computation cheaply. This is a pragmatic acknowledgement that most of what most layers do is local, while some of what some layers do requires the whole context. Managing the cache as a systems problem Even with smaller caches, serving many users with different, growing context lengths raises problems of allocation. Early serving systems reserved a contiguous block of memory for each sequence's maximum possible length, wasting most of it. In 2023 Woosuk Kwon and colleagues at the University of California, Berkeley, introduced PagedAttention and the vLLM serving system, which borrowed the idea of virtual memory from operating systems. The cache is divided into fixed-size blocks, each holding keys and values for a small number of tokens, and a block table maps each sequence's logical positions to physical blocks, which need not be contiguous. Memory is allocated as sequences grow, fragmentation nearly disappears, and sequences that share a common prefix, such as the same system prompt, can share the physical blocks for it. Kwon's team reported throughput improvements of two to four times over the serving systems they compared against. Prefix sharing has become an economic feature in its own right. Several commercial providers now offer reduced prices for prompts whose beginnings match a previously processed prompt, because the cache for that prefix can be reused instead of recomputed. Other approaches compress what is stored. Keys and values can be quantised from 16 bits to 8 or fewer with modest quality loss. Some methods evict cache entries judged unimportant: the H2O method of Zhenyu Zhang and colleagues in 2023 keeps tokens that have received the most cumulative attention, the "heavy hitters," along with a recent window. StreamingLLM, described in Chapter 6, keeps attention-sink tokens plus a recent window. These eviction schemes trade exactness for memory, and they suffer from a basic difficulty: a token that seems unimportant now may be exactly the one a later query needs. Distributing a single long sequence For contexts of a million tokens or more, even an optimised cache and FlashAttention on a single chip are not enough, because one device's memory cannot hold the activations. Ring Attention, by Hao Liu, Matei Zaharia and Pieter Abbeel in 2023, splits the sequence into blocks across a ring of devices. Each device holds the queries for its block and computes attention against keys and values that are passed around the ring, one block at a time, using the same online-softmax accumulation as FlashAttention. Communication of the next block overlaps with computation on the current one. The maximum context length then scales with the number of devices. Similar techniques, under names such as context parallelism and sequence parallelism, are now standard in training systems for long-context models. What this approach achieved, and what it left Taken together, these techniques explain how context windows grew by roughly two orders of magnitude between 2020 and 2024 while the core attention computation stayed exact. FlashAttention made exact attention efficient in memory traffic and memory footprint. Grouped-query and latent attention cut the cache by factors of eight to more than ten. Sliding-window and hybrid layer schedules cut it further in most layers. Paged memory management and prefix sharing made the remaining cache cheaper to serve. Ring-style parallelism spread the longest contexts across many devices. None of this changed the asymptotic facts. Prefill arithmetic is still quadratic in the prompt length for every layer with full attention. The cache in every such layer still grows linearly with context, and must be read in full at every step of generation. Exact attention survived because engineering pushed back the point at which those facts become intolerable. It did not abolish them. The question of whether attention itself could be replaced by something with better asymptotics was pursued throughout the same period, and its answer is the subject of the next two chapters. Chapter 10. The Search for Cheaper Attention From 2019 onward, a large literature set out to replace attention's n-squared cost with something that grows linearly, or nearly so, in sequence length. The proposals were ingenious and drew on sparse matrices, hashing, low-rank approximation, and random features from kernel theory. Many reported large speedups on long sequences. Very few made it into the leading models. This chapter describes the main families, the mathematics each relies on, and why, in the main, they fell short. The reasons are instructive, because they show what full attention provides that approximations struggle to keep. Sparse patterns The most direct approach is to compute only some of the n-squared scores. If each query attends to a fixed set of keys of size s much smaller than n, the cost falls from n squared to n times s. In 2019 Rewon Child, Scott Gray, Alec Radford and Ilya Sutskever at OpenAI described the Sparse Transformer. It used factorised patterns: one head attends to the previous sqrt(n) positions, another to every sqrt(n)-th position. Any position can reach any other in two hops, and the cost per layer is n times sqrt(n). They used it to model images, audio and text with sequences of tens of thousands of elements. GPT-3 alternated dense layers with locally banded sparse ones, following the same work. Longformer, mentioned in Chapter 9, combined a sliding window with global tokens. BigBird, from Manzil Zaheer and colleagues at Google in 2020, added random connections: each query attended to a local window, a few global tokens, and a few randomly chosen keys. The authors proved that this pattern retained theoretical properties of full attention, including the ability to approximate any sequence-to-sequence function given enough layers, and showed gains on long-document question answering and genomics. Sparse patterns are effective when the important interactions are predictable in advance: mostly local, with a few known hubs. Their weakness is the opposite case. When the token a query needs could be anywhere, and its location depends on content rather than position, a fixed pattern will miss it unless it routes through many hops, and the analysis of Chapter 6 shows that trained models depend on exactly this kind of content-addressed lookup. Content-based sparsity A natural refinement is to choose which keys each query attends to by content. Since softmax concentrates weight on the largest scores, the output is dominated by the keys most similar to the query. If those could be found cheaply, the rest could be ignored. Reformer, by Nikita Kitaev, Łukasz Kaiser and Anselm Levskaya in 2020, used locality-sensitive hashing for this. A hash function of this type maps similar vectors to the same bucket with high probability. Reformer hashed queries and keys, which it tied to be the same vectors, sorted them by bucket, and computed attention only within buckets and neighbouring chunks, giving cost proportional to n log n. The Routing Transformer, by Aurko Roy and colleagues in 2021, used online k-means clustering instead of hashing. These methods were clever but awkward on hardware. Sorting, gathering and scattering tokens by bucket are irregular memory operations that GPUs handle poorly compared with dense matrix multiplication. Hash collisions are probabilistic, so relevant keys sometimes land in the wrong bucket. And at the sequence lengths of practical interest, a well-optimised dense implementation often ran faster than the theoretically cheaper sparse one. Content-based sparsity has returned in recent years in a new form, discussed at the end of this chapter, but its first generation did not displace dense attention. Low-rank projections Another family exploits the observation that attention matrices in trained models are often approximately low-rank. Linformer, by Sinong Wang and colleagues at Facebook AI in 2020, projected the n keys and n values down to a fixed k with learned matrices of size k by n, then computed attention from n queries to k compressed keys. Cost becomes n times k. The authors showed that on BERT-style tasks, k of 128 or 256 sufficed for sequences of several thousand. Linformer's design has a basic incompatibility with causal language models. The projection mixes all n keys, including future ones, into each compressed key, which breaks the causal mask. It also fixes n at training time, since the projection matrix has one column per position. Nyströmformer, in 2021, used a landmark-based approximation from kernel methods with similar strengths and limitations. Low-rank methods suited bidirectional encoders on fixed-length inputs, which was not where the field was heading. Linear attention and the kernel trick The most mathematically consequential family is linear attention, because it connects attention to recurrence and leads directly to the state-space models of Chapter 11. Write attention for a single query q_i, ignoring the scaling, as: output_i = sum over j of sim(q_i, k_j) v_j / sum over j of sim(q_i, k_j) where sim(q, k) = exp(q · k). The difficulty is that exp(q · k) does not factor into a function of q times a function of k, so one must compute it for every pair. Suppose instead that the similarity could be written as a dot product of feature maps, sim(q, k) = phi(q) · phi(k), for some function phi mapping vectors to vectors. Then: output_i = phi(q_i)^T (sum over j of phi(k_j) v_j^T) / phi(q_i)^T (sum over j of phi(k_j)) The sums in brackets do not depend on i. Compute them once, in time linear in n, and every query's output follows from a matrix-vector product. The n-by-n matrix never appears. The cost is n times the square of the feature dimension instead of n squared times d. Angelos Katharopoulos, Apoorv Vyas, Nikolaos Pappas and François Fleuret developed this in a 2020 paper titled "Transformers are RNNs." They used a simple feature map, phi(x) = elu(x) + 1, which keeps features positive. Their title pointed to the second consequence. In the causal case, each position's sums run only over j up to i. Define a state matrix S_i = sum over j ≤ i of phi(k_j) v_j^T, and a normaliser z_i = sum over j ≤ i of phi(k_j). Then: S_i = S_(i-1) + phi(k_i) v_i^T output_i = phi(q_i)^T S_i / phi(q_i)^T z_i This is a recurrent network. The state S has fixed size, independent of sequence length. At each step, the model writes an outer product of the new key and value into the state and reads from it with the query. Generation needs no growing cache: just the fixed-size state, updated once per token. Training can still be done in parallel, because the cumulative sums can be computed with parallel scan algorithms or in chunks. Choromanski and colleagues at Google followed in 2020 with the Performer, which used random features to approximate the exponential kernel itself, so that phi(q) · phi(k) approximates exp(q · k) in expectation. This made linear attention an approximation of softmax attention, rather than a different operation. Random Feature Attention, by Hao Peng and colleagues in 2021, took a similar approach and added a gating mechanism. Why linear attention lagged Linear attention delivered exactly what it promised on cost. On quality, it fell short, particularly on language modelling. Two explanations, one about capacity and one about selection, account for most of the gap. The capacity argument is about the state. Full attention stores every key and value; its memory of the past is lossless and grows with n. Linear attention compresses the whole past into a matrix S of fixed size, d_phi by d_v. It can store about d_phi independent key-value associations before new writes begin to interfere with old ones. Imanol Schlag, Kazuki Irie and Jürgen Schmidhuber made this precise in a 2021 paper, "Linear Transformers Are Secretly Fast Weight Programmers," connecting linear attention to "fast weight" memories studied in the early 1990s. Writing an outer product into S is like storing an association in a linear associative memory, and such memories have finite capacity. Once the number of stored items exceeds the dimension, retrieval becomes noisy. Schlag and colleagues proposed replacing the additive write with a delta-rule update, which first retrieves what the memory currently associates with the key and writes only the correction, reducing interference. The selection argument is about the softmax. Exponentiation makes softmax attention sharp: a query can place almost all its weight on a single matching key among thousands. The feature maps used in linear attention produce much flatter weightings, because a positive feature map with modest dimension cannot replicate the extreme peakiness of exp. A linear-attention model asked to retrieve one specific token from a long context gets a blur. Random-feature approximations can in principle capture the exponential, but need many features to do so with low variance, eroding the cost advantage. Both problems bear directly on the induction-head mechanism. Copying the token that followed an earlier occurrence of the current token requires finding one exact position among many and retrieving it cleanly. A bounded, blurred memory is poorly suited to that. A survey of these methods published in 2020, "Efficient Transformers: A Survey" by Yi Tay, Mostafa Dehghani, Dara Bahri and Donald Metzler, organised the literature into a taxonomy, and a companion benchmark from the same group, Long Range Arena, compared many of the methods on tasks with sequences of 1,000 to 16,000 elements. No method dominated across tasks, and the gains in speed were often smaller in practice than the asymptotic analysis suggested. The benchmark's tasks were themselves later criticised as not reflecting what matters for language modelling. Table 4 summarises the families described in this chapter. Table 4. Main families of efficient attention approximations. Family Representative methods Cost per layer Causal generation Main limitation Fixed sparse patterns Sparse Transformer, Longformer, BigBird n × sqrt(n) or n × w Yes Misses content-dependent distant links Content-based sparsity Reformer, Routing Transformer n × log n Awkward Irregular memory access; hash misses Low-rank projection Linformer, Nyströmformer n × k No (Linformer) Mixes future tokens; fixed length Kernelised linear attention Linear Transformer, Performer n × d squared Yes, with constant state Bounded memory; blurred selection The second wind of linear models The linear-attention line did not end with these results. It changed course. Researchers stopped trying to approximate softmax attention and instead treated the recurrent form as a model class in its own right, to be improved directly. Three ideas proved important. Adding a decay, so that old associations fade at a learned rate, let the state forget what it no longer needed: S_i = gamma S_(i-1) + phi(k_i) v_i^T, with gamma between zero and one. Making that decay depend on the input, a gate computed from the current token, let the model decide what to forget and when. And replacing the additive update with the delta rule reduced interference. RetNet, from Microsoft researchers in 2023, used a fixed decay. Gated Linear Attention, by Songlin Yang and colleagues in 2023, used data-dependent gates and developed hardware-efficient chunked training algorithms. DeltaNet and Gated DeltaNet, from Yang and colleagues in 2024, combined the delta rule with gating. RWKV, an open-source project led by Bo Peng, developed a similar recurrent formulation through several versions from 2021 onward. These models closed much of the gap with transformers on language modelling perplexity at moderate scale. They converge, from the attention side, on the same territory that state-space models reached from the control-theory side, which the next chapter takes up. Learned sparse attention Meanwhile, content-based sparsity returned in a form designed for hardware. The insight is that sparsity should be chosen at the granularity of blocks, not individual tokens, so the selected keys can be processed with dense matrix multiplication. Native Sparse Attention, from DeepSeek researchers in early 2025, combined three branches: attention over compressed summaries of blocks of past tokens, attention over the top-scoring full blocks selected by those summaries, and a sliding window. The selection is learned during pre-training rather than imposed afterwards. The authors reported quality matching full attention on their benchmarks and substantial speedups at a context of 64,000 tokens. DeepSeek later deployed a related mechanism in a production model. Moonshot AI's Mixture of Block Attention, also from 2025, took a similar approach, routing each query to a few relevant key blocks. These designs differ from the first generation of sparse attention in two ways. They are built around the memory hierarchy of GPUs rather than abstract operation counts, and the decision of where to look is made by the model itself, trained end to end. Whether they will become standard is not yet settled. But they reflect what the preceding decade of work taught: the expensive part of attention is the large number of keys that do not matter to a given query, but the model must be able to find, cheaply and reliably, the few that do. Chapter 11. Challengers, Hybrids, and the Meaning of Long Context By 2023 the arguments of the previous chapters had produced a clear picture. Full attention gives every position lossless, content-addressed access to every earlier position, and trained models depend on that access. Its price is quadratic prefill arithmetic and a key-value cache that grows with every token. Recurrent models with a fixed-size state have neither cost, but their bounded memory struggles with precise retrieval. The question was whether a recurrent architecture could be made good enough to match transformers on language, and if not, whether the two could be combined so that each did what it does best. This chapter follows the most serious challenger, the selective state-space model, through to the hybrid designs that have emerged as a working answer, and then asks what long context actually delivers once it is measured carefully. State-space models State-space models come from control theory and signal processing, where they describe a system whose internal state evolves continuously in response to an input. In continuous time: h'(t) = A h(t) + B x(t) y(t) = C h(t) Here x is the input signal, h is a state vector, y is the output, the prime denotes the time derivative, and A, B and C are matrices. To apply this to a sequence of tokens, the equations are discretised with a step size Delta, which gives a linear recurrence of the familiar form: h_t = A_bar h_(t-1) + B_bar x_t y_t = C h_t where A_bar and B_bar are computed from A, B and Delta. This looks like a recurrent network without the nonlinearity, and that absence is the point. Because the recurrence is linear and its matrices are the same at every step, unrolling it shows that the output is a convolution of the input with a fixed kernel whose entries are C A_bar^k B_bar for k = 0, 1, 2, and so on. A linear time-invariant state-space model can therefore be trained in parallel as a long convolution, computed efficiently with the fast Fourier transform, and run at inference as a recurrence with constant memory per step. Albert Gu, Karan Goel and Christopher Ré made this practical in their 2021 paper on S4, "Efficiently Modeling Long Sequences with Structured State Spaces." The main obstacles had been numerical: computing powers of A for long sequences is unstable for a generic matrix, and a poorly chosen A forgets information quickly. S4 initialised A using a construction from Gu's earlier HiPPO work, designed so that the state optimally summarises the history of the input as a set of coefficients for a family of polynomials, and parameterised A in a structured form that made the convolution kernel cheap to compute. S4 achieved strong results on the Long Range Arena benchmark, including a task with sequences of 16,000 elements on which every transformer variant had performed at chance. S4 and its successors were excellent on continuous signals such as audio and on synthetic long-range tasks, but they lagged transformers on language. In 2022 Daniel Fu, Tri Dao and colleagues diagnosed one reason. Studying synthetic tasks, they found that state-space models struggled with associative recall: given a list of key-value pairs and then a key, return its value. This is the induction-head task in another guise. A time-invariant model applies the same dynamics to every token. It cannot decide, based on the content of the current token, that this token is worth remembering and the last fifty were not. Selectivity: Mamba In December 2023 Albert Gu and Tri Dao released Mamba, described in "Mamba: Linear-Time Sequence Modeling with Selective State Spaces." Its central change was to make the state-space parameters functions of the input. The step size Delta, and the matrices B and C, are computed at each position from the current token through small learned projections. A large Delta for a given token means the state is updated strongly toward that token's input and older content decays quickly; a small Delta means the token is largely ignored and the state is preserved. The model can thus choose, token by token, what to write into its memory and what to let pass. Selectivity breaks the convolution trick, since the dynamics now differ at every step. Gu and Dao replaced it with a hardware-aware parallel scan: the recurrence is computed with an associative scan algorithm, with the expanded state kept in fast on-chip SRAM rather than written to HBM, in the same spirit as FlashAttention. The result trains in time linear in sequence length and generates with a fixed-size state and no growing cache. Mamba's reported results were striking. At sizes up to about three billion parameters, trained on 300 billion tokens, Mamba matched or exceeded transformers of the same size, and in some comparisons transformers twice its size, on language modelling and on standard downstream benchmarks. Its inference throughput was several times higher than a transformer of similar size, because it had no cache to read. Mamba-2, by Dao and Gu in May 2024, made a theoretical connection explicit in a paper titled "Transformers are SSMs." They showed that a selective state-space model with a scalar-times-identity structure for A is mathematically equivalent to a form of linear attention with a particular data-dependent decay mask, and that both can be written as multiplication by a structured matrix they called semiseparable. Softmax attention corresponds to a different, full-rank matrix of the same general shape. This "state space duality" unified the gated linear attention models of Chapter 10 and the selective state-space models into a single family. Its practical consequence was a training algorithm that processes the sequence in chunks, using dense matrix multiplication within each chunk and the recurrence between them, which ran substantially faster than Mamba's original scan on modern GPUs. Where recurrent models fall short As selective state-space models and gated linear attention models were scaled and tested more broadly, a consistent pattern emerged. On average perplexity and on many standard benchmarks, they were close to transformers. On tasks requiring precise recall or copying from a long context, they were worse, sometimes much worse. Simran Arora and colleagues, in the 2023 "Zoology" study, measured this systematically. They found that a large majority of the perplexity gap between attention-free models and transformers on natural text was attributable to tokens that could be predicted by recalling an earlier association in the context, such as a name or phrase used earlier in the document. Samy Jelassi, David Brandfonbrener, Sham Kakade and Eran Malach, in a 2024 paper titled "Repeat After Me: Transformers are Better than State Space Models at Copying," proved that a two-layer transformer can copy strings of length exponential in its size, whereas any model with a fixed-size state cannot copy strings longer than its state can hold, and showed experimentally that transformers learned to copy far more efficiently. Gated recurrent models with large states narrow the gap, and the delta-rule variants narrow it further, but the theoretical limit remains: a fixed-size state is a lossy summary, and information that was not chosen for retention when it streamed past cannot be retrieved later. This is the same trade-off seen at the start of this booklet, now at a much higher level of sophistication. Recurrent networks were displaced because they compressed the past into a fixed vector. Selective state-space models are vastly better at deciding what to compress, but they still compress. Attention does not compress, and pays for it. Hybrids The response, by 2024, was to stop treating the question as a contest. If attention is needed for precise retrieval but a recurrent layer handles most other sequence processing more cheaply, a model can be built from both. AI21 Labs released Jamba in March 2024, interleaving Mamba layers with transformer attention layers in a ratio of about seven to one and adding mixture-of-experts feed-forward layers. It supported a context of 256,000 tokens with a cache a fraction of the size an all-attention model of similar scale would need, since only one layer in eight stored keys and values. In June 2024 researchers at NVIDIA, led by Roger Waleffe, published a controlled comparison at the 8-billion-parameter scale, training pure transformers, pure Mamba and Mamba-2 models, and hybrids on the same data. The pure state-space models fell behind on tasks requiring in-context recall and on few-shot learning. A hybrid composed mostly of Mamba-2 layers with a small fraction of attention layers, around 7 percent of all layers, matched or exceeded the pure transformer on the standard tasks they evaluated while promising much faster generation. The pattern has spread. MiniMax-01, released in January 2025, combined a linear-attention variant with standard softmax attention, using one softmax layer for every seven linear ones, and its developers reported handling contexts of up to four million tokens at inference. Alibaba's Qwen3-Next, released later in 2025, interleaved Gated DeltaNet layers with full attention layers in a three-to-one ratio. Google's Gemma 3, described in Chapter 9, applied the same reasoning within the transformer family, using cheap sliding-window attention for most layers and full attention for a few. The logic is the same in each case. Most of a long context's processing is local or summary-like and can be handled by layers with bounded memory. A minority of operations, such as finding a specific earlier name, quotation, function definition or fact, requires lossless access, and a few full-attention layers can supply it. The cache cost of those few layers still grows with context, but it grows at a fraction of the rate of an all-attention model. This combination is the closest thing the field now has to a settled view of the efficient long-context architecture, though the best ratio, the best recurrent component, and the best placement of attention layers remain under active study. What long context actually delivers Architectural progress pushed context windows from a few thousand tokens to hundreds of thousands and beyond. Google's Gemini 1.5, announced in February 2024, offered a million tokens in production and reported research tests up to ten million. Whether models make good use of such windows is a separate question, and the answer has been more qualified than the headline numbers suggest. The first widely used probe was the needle-in-a-haystack test, popularised by Greg Kamradt in late 2023: insert a single out-of-place sentence somewhere in a long document and ask the model to retrieve it. Many models scored near perfectly. But the test is easy in a specific way. The needle is lexically distinct from the surrounding text, so a single query can find it by matching words, which is exactly the operation induction-style heads perform well. Harder tests produced weaker results. Nelson Liu and colleagues, in a 2023 paper titled "Lost in the Middle," gave models a question and a set of documents, only one of which contained the answer, and varied the position of that document. Performance was highest when the relevant document was at the beginning or end of the context and dropped substantially when it was in the middle, producing a U-shaped curve. In some configurations, models did worse with the relevant document in the middle of the context than when given no documents at all. The RULER benchmark from Cheng-Ping Hsieh and colleagues at NVIDIA in 2024 extended needle tests with multiple needles, variable tracking across the context, and aggregation tasks such as counting the most common words. They found that although nearly all models they tested passed simple needle retrieval, most showed large drops on the harder tasks as context grew, and that only about half of the models claiming context sizes of 32,000 tokens or more maintained satisfactory performance at 32,000 tokens. Why should a model with exact attention to every token fail to use a token it can see? Several causes contribute. Training data contains few documents in which the answer to a question depends on information many thousands of tokens away, so models get little practice. Positional schemes stretched by the interpolation methods of Chapter 4 may degrade the precision of attention at long range. Attention weight is a finite resource: softmax distributes a total of one across all visible tokens, and as the number of distractors grows, a relevant token must have a much higher score to win the same share. And tasks that require combining many pieces of scattered information demand many retrieval steps, each a possible point of failure. Long-context evaluation has therefore become a field in its own right, and developers have increasingly trained specifically on long, structured documents and on synthetic retrieval and reasoning tasks spanning long contexts. The general result is that the usable context of a model, the length at which it reliably performs tasks that genuinely depend on the whole input, is often well below its advertised maximum, and depends heavily on the task. Retrieval as an alternative Finally, there is an alternative to long context that sidesteps the architecture altogether. Retrieval-augmented generation, introduced under that name by Patrick Lewis and colleagues in 2020, keeps a large collection of documents outside the model, uses an embedding model of the kind described in Chapter 5 to find the passages most relevant to a query, and places only those in the model's context. Rather than letting attention search a million tokens, an external index searches them and attention handles the few thousand that are retrieved. Retrieval and long context are complements rather than rivals. Retrieval scales to collections far larger than any context window and costs little per query, but it can fail when relevance is not apparent from the query alone, or when a task requires synthesising information spread thinly across a whole document. Long context handles those cases better, at higher cost. Many deployed systems now combine the two: retrieve generously, then let a long-context model read what was retrieved. In architectural terms, retrieval is one more way of solving the problem that runs through this booklet. Attention lets every position consult every other, and when "every other" becomes too many, something must decide in advance which ones are worth consulting. Conclusion The transformer began as a substitution. Recurrence had carried information along a chain, step by step, through a vector that was overwritten at every position. Attention replaced the chain with direct, content-addressed connections between every pair of positions, computed in parallel. The preceding chapters have followed what that substitution made possible and what it cost, and the shape of the architecture's history now looks less like a series of inventions than like a long negotiation over a single exchange rate. What the evidence shows Several conclusions follow from the material, and they are firmer than the usual commentary about the field suggests. First, the transformer's advantage was never only about long-range dependencies. The original comparison with recurrent and convolutional layers counted three things, and the decisive one in practice was the second: a constant number of sequential operations. That made training parallel, which made it possible to use the hardware efficiently, which made scale affordable. The scaling laws of Chapter 7 are, in an important sense, a consequence of the parallelism argument of Chapter 1. An architecture that could not use a thousand GPUs efficiently could not have been tested at the scales where its predictable improvement became visible. Second, full attention is not merely a generous connectivity pattern that models mostly leave unused. The interpretability research of Chapter 6 found specific circuits, induction heads above all, that depend on fetching an exact earlier token chosen by content from an arbitrary distance. The capacity and recall studies of Chapters 10 and 11 found that the main thing models lose when attention is replaced by a fixed-size state is precisely this operation. These are two independent lines of evidence pointing to the same conclusion. Lossless, content-addressed lookup into the past is what makes attention valuable, and it is what is hardest to keep while making attention cheaper. Third, the cost that constrains long-context transformers in practice is not the one usually named. Quadratic arithmetic in prefill is real, and above a hundred thousand tokens or so it dominates. But for most deployments the binding constraint is the key-value cache, which grows linearly, consumes memory that could otherwise serve more users, and must be read in full for every generated token. The most effective interventions of the past several years, grouped-query attention, latent attention, sliding windows interleaved with global layers, and hybrid stacks in which only a few layers hold a full cache, are all attacks on that linear cost. The sustained effort to approximate the quadratic term, surveyed in Chapter 10, produced fewer production successes, in part because it was aimed at the less pressing problem and in part because its approximations damaged exactly the retrieval capability the circuit work identified. Fourth, position turned out to be an engineering lever rather than a fixed feature. The transition to rotary embeddings did not make models extrapolate better by default. It gave a compact, analytic description of position that could be rescaled after training, which turned context extension from a matter of retraining into a matter of fine-tuning. Much of the growth in advertised context windows rests on that property. What remains unsettled Some questions the evidence does not yet answer. The best architecture for long sequences is not known. Hybrids of attention and recurrent layers are the current working consensus among groups trying to reduce serving cost, but the right ratio, the right recurrent component, and the right placement of attention layers are being explored by trial and error. It is possible that learned sparse attention, which keeps the cache but reads only part of it, will prove a better trade than hybrids, which shrink the cache but lose some layers' access to the past. It is also possible that a recurrent layer with a large enough, cleverly enough updated state will close the recall gap for practical purposes, although the copying results of Chapter 11 set a hard limit on how far any fixed-size state can go. The relationship between advertised and usable context remains poorly understood. Models that can attend to a million tokens often perform tasks requiring genuine use of the whole input much less reliably than tasks requiring a single lookup. Whether this is a matter of training data, positional precision, the dilution of softmax over many distractors, or something more basic about how models combine many retrieved pieces, is not yet clear, and the answer will determine whether the next order of magnitude of context is worth its price. The theory of why the architecture works is also incomplete. Scaling laws are empirical regularities without an agreed derivation. The circuits identified so far are islands in models with thousands of heads. Superposition means that the basic units of analysis, features rather than neurons or heads, are only beginning to be extracted at scale. The transformer is in the unusual position of being the most important computational artefact of its decade while remaining only partly understood by the people who build it. What follows for the reader For anyone who designs, deploys or evaluates these systems, the analysis leads to a few practical habits. When a new architecture is announced, ask which cost it reduces. A design that claims linear complexity may be attacking prefill arithmetic, which matters only for very long prompts, or the key-value cache, which matters for nearly all generation. Ask also what it gives up, and specifically whether it retains the ability to retrieve an exact earlier token chosen by content. A model that does well on average perplexity can still fail badly on recall, and the failures will appear in exactly the tasks for which long context was wanted. When a model advertises a context window, treat the number as a ceiling rather than a capability. Test it on the task at hand, with the relevant information placed in the middle of the context and surrounded by plausible distractors, not merely with a single distinctive needle. Expect usable length to depend on the task. When reasoning about cost, count bytes as well as operations. A generation workload is limited by how fast weights and cache can be read from memory, and the cache scales with layers, key-value heads, head dimension, context length and the number of simultaneous users. The formula in Chapter 8 is simple enough to apply on the back of an envelope, and it explains more about the economics of long-context serving than any count of floating-point operations. When choosing between a longer context and an external retrieval system, recognise that they solve the same problem at different points. Retrieval decides in advance which material deserves attention; long context lets the model decide. The first is cheaper and scales further; the second handles cases where relevance cannot be judged before reading. Most robust systems will use both. The equation at the centre of this booklet, Attention(Q, K, V) = softmax(QK^T / sqrt(d_k)) V, has proved remarkably durable. Its form has barely changed since 2017. What has changed is everything around it: how its inputs are positioned, how many distinct keys and values it stores, how its computation is ordered on the chip, how many layers of a model use it, and what is placed into its context in the first place. That pattern is likely to continue. The question for the next generation of architectures is not whether every position should be able to consult every other, since the evidence says that ability is worth a great deal. It is how few positions need to pay for it. Glossary Arithmetic intensity. The number of arithmetic operations a computation performs for each byte it reads from memory. Low intensity means the computation is limited by memory bandwidth rather than by arithmetic speed. Attention head. One independent instance of scaled dot-product attention within a layer, with its own query, key and value projections. Causal mask. A mask that prevents each position from attending to later positions, so that a model can be trained to predict every next token in parallel without seeing the answer. Context window. The maximum number of tokens a model can take as input at once. Decode. The phase of generation in which a model produces one token per step, attending over the cached keys and values of all previous tokens. Feed-forward network. The position-wise sublayer of a transformer block, applying the same small neural network to each position independently. Grouped-query attention (GQA). A variant of multi-head attention in which groups of query heads share a single key head and value head, shrinking the key-value cache. Induction head. An attention head that, together with an earlier previous-token head, finds an earlier occurrence of the current token and copies the token that followed it. Key-value cache. The stored keys and values of all previous tokens, kept during generation so they need not be recomputed at each step. Prefill. The phase in which a model processes the whole prompt in one parallel pass before generating. Residual stream. The running sum of each position's representation to which every sublayer adds its output. Rotary position embedding (RoPE). A method of encoding position by rotating pairs of query and key components through angles proportional to position, so that attention scores depend on relative offset. Softmax. The function that turns a list of real numbers into positive weights summing to one, by exponentiating each and dividing by the total. State-space model. A sequence model whose hidden state evolves through a linear recurrence, trainable in parallel and runnable with fixed memory per step. Token. The unit of text a model processes, typically a word or part of a word. Further Reading Vaswani, A., et al. "Attention Is All You Need." NeurIPS, 2017. The original paper. Short, clearly written, and still the best statement of the comparison between attention, recurrence and convolution that motivated the design. Bahdanau, D., Cho, K., and Bengio, Y. "Neural Machine Translation by Jointly Learning to Align and Translate." ICLR, 2015. The paper that introduced attention to neural translation, and the clearest view of the problem the transformer later generalised. Su, J., et al. "RoFormer: Enhanced Transformer with Rotary Position Embedding." 2021. The derivation of rotary embeddings. Pair it with Chen et al., "Extending Context Window of Large Language Models via Positional Interpolation" (2023), and Peng et al., "YaRN" (2023), for the context-extension methods built on it. Kaplan, J., et al. "Scaling Laws for Neural Language Models." 2020; and Hoffmann, J., et al. "Training Compute-Optimal Large Language Models." 2022. The two empirical studies that shaped how large models are sized. Reading them together shows how a methodological detail changed the conclusion. Elhage, N., et al. "A Mathematical Framework for Transformer Circuits." Anthropic, 2021; and Olsson, C., et al. "In-context Learning and Induction Heads." Anthropic, 2022. The foundations of mechanistic interpretability for transformers, including the residual-stream view and the induction-head mechanism. Dao, T., et al. "FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness." NeurIPS, 2022. The clearest demonstration that attention's practical cost was a matter of memory traffic, and how to remove it without approximation. Ainslie, J., et al. "GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpoints." EMNLP, 2023; and Kwon, W., et al. "Efficient Memory Management for Large Language Model Serving with PagedAttention." SOSP, 2023. Two papers on the key-value cache, one from the architecture side and one from the systems side. Tay, Y., Dehghani, M., Bahri, D., and Metzler, D. "Efficient Transformers: A Survey." ACM Computing Surveys, 2022. A taxonomy of the sparse, low-rank and kernel-based approximations, written at the height of that research programme. Katharopoulos, A., et al. "Transformers are RNNs: Fast Autoregressive Transformers with Linear Attention." ICML, 2020. The bridge between attention and recurrence, and the starting point for the gated linear models that followed. Gu, A., and Dao, T. "Mamba: Linear-Time Sequence Modeling with Selective State Spaces." 2023; and Dao, T., and Gu, A. "Transformers are SSMs." ICML, 2024. The leading attention-free architecture and the theory connecting it to linear attention. Waleffe, R., et al. "An Empirical Study of Mamba-based Language Models." NVIDIA, 2024. A controlled comparison of transformers, state-space models and hybrids at matched scale, and the clearest evidence for the hybrid design. Liu, N. F., et al. "Lost in the Middle: How Language Models Use Long Contexts." TACL, 2024; and Hsieh, C.-P., et al. "RULER: What's the Real Context Size of Your Long-Context Language Models?" 2024. Two careful evaluations showing the gap between advertised and usable context. Phuong, M., and Hutter, M. "Formal Algorithms for Transformers." DeepMind, 2022. Precise pseudocode for every major transformer variant, useful for readers who want to check the mathematics against a single consistent notation. Hashtags: #TransformerRevolution #TransformerArchitecture #AttentionMechanisms #SelfAttention #ScaledDotProductAttention #MultiHeadAttention #ArtificialIntelligence #DeepLearning #MachineLearning #NaturalLanguageProcessing #LargeLanguageModels #NeuralNetworks #AttentionIsAllYouNeed #SequenceModeling #PositionalEncoding #RotaryPositionEmbeddings #RoPE #EncoderDecoderArchitecture #DecoderOnlyTransformers #BERT #GPT #GenerativeAI #FlashAttention #KeyValueCache #LongContextModels #MixtureOfExperts #ScalingLaws #InContextLearning #StateSpaceModels #AIArchitectureEvolution

Download the Book (PDF): Introduction Type a question into a modern search box, a customer-support assistant, or a code navigator, and somewhere behind the interface a small piece of arithmetic happens many millions of times. Your words are turned into a list of a few hundred or a few thousand numbers. That list is compared against lists produced, months or minutes earlier, from every document, image, product, or code fragment the system knows about. The handful of stored lists that sit closest to yours are returned, and whatever the system does next, whether it shows you links, writes you an answer, or recommends a song, rests on that handful being the right one. The lists of numbers are embeddings, and the operation is nearest-neighbour search. Neither idea is new. Information retrieval researchers were representing documents as vectors in the 1960s, and computational geometers have studied nearest-neighbour problems for almost as long. What changed in the last decade is that learned embeddings became good enough to carry meaning, and that the collections people wanted to search became very large. A retailer with a hundred million product images, a web-scale search engine with tens of billions of passages, a code host with billions of functions: these are not hypothetical. At that scale, the naive way of answering a query, comparing it against every stored vector, stops being a design option and becomes an outage. This booklet is about what replaces the naive way. It is an engineering text, written for readers who want to understand the machinery rather than merely configure it: software engineers who have been handed a vector database and want to know what the knobs actually do, architects deciding between products, technical leaders who need to reason about cost and risk, and researchers from adjacent fields who want a coherent account of a literature that is scattered across computer vision, databases, information retrieval, and systems conferences. The controlling idea The argument of the book can be put in one sentence. Every vector index that works at scale is a deliberate bet about where the true nearest neighbours are likely to be, and the craft of vector search consists in choosing which bet to make, sizing it against the memory hierarchy of real machines, and measuring how often it loses. There are, broadly, three kinds of bet. The first is partitioning: divide the collection into regions, and when a query arrives, look only in the regions closest to it. The inverted file index, which carves space into clusters with k-means, is the canonical example. The second is compression: replace each stored vector with a much shorter code that preserves distances approximately, so that far more vectors fit in fast memory and each comparison costs less. Product quantization is the canonical example, and its descendants now include scalar, binary, and randomized schemes. The third is navigation: link each vector to a few of its neighbours, forming a graph, and answer a query by walking greedily through the graph toward the target. Hierarchical navigable small world graphs, universally abbreviated HNSW, are the canonical example, and they have become the default index in most of the systems people actually deploy. Each bet can lose. A partition may place a true neighbour in a cluster the query never visits. A compressed code may rank a slightly farther vector above a slightly nearer one. A greedy walk may get stuck in a local region of the graph and never reach the true answer. The losses are measured as recall: the fraction of the true nearest neighbours that the index actually returns. A system that answers in two hundred microseconds with ninety-five per cent recall has made a different bet from one that answers in two milliseconds with ninety-nine per cent, and neither is wrong in the abstract. What is wrong is not knowing which bet you made. Real systems combine the bets. A billion-scale index will typically partition the collection across machines and within each machine, compress the vectors so that they fit in memory or so that more of them fit in a cache line, navigate a graph or scan a list to find candidates, and then re-rank a short list of candidates using more precise information held further down the memory hierarchy. Understanding such a system means understanding each layer separately and then understanding how their errors compound. Why the details matter It is possible to use a vector database for years without knowing any of this. Most products expose a handful of parameters with sensible defaults, and for collections of a few million vectors on a single machine the defaults are usually fine. The details start to matter at three moments. The first is when cost becomes visible. Raw embeddings are expensive to hold in memory. A billion vectors of 768 dimensions stored as 32-bit floating-point numbers occupy a little over three terabytes before any index structure is added. Holding that in RAM across a fleet of servers is possible, but the bill is large enough that someone will ask whether it is necessary. Answering the question requires knowing what compression costs in recall, and what moving vectors to solid-state storage costs in latency. The second is when quality becomes visible. Retrieval feeds everything downstream. In a retrieval-augmented generation system, a language model can only reason over the passages it is given; if the index silently drops the one passage that contained the answer, the model will either answer from memory or invent something. Teams who see their assistant hallucinate often look first at the prompt or the model. Sometimes the fault is several layers down, in an index configured for speed at a recall the application could not afford, or in a metadata filter that interacts badly with the graph. The third is when the workload changes. Indexes are built for a distribution of data and a distribution of queries. When the data grows by an order of magnitude, when deletions accumulate, when the embedding model is replaced, or when queries start arriving from a different modality than the documents, an index that behaved well can degrade without any error being raised. The degradation is statistical, and it is only visible to people who measure. What the book covers The chapters run in an order designed to build the argument from the ground up. Chapter 1 explains what embeddings are and why semantic similarity becomes a geometric problem, including the choice of distance function and the subtle ways that choice interacts with how embedding models are trained. Chapter 2 explains why exact search fails at scale and what we give up by abandoning it: the curse of dimensionality, the cost of brute force on real hardware, and the definition of recall that the rest of the book relies on. Chapters 3 to 5 treat the three bets in turn. Chapter 3 covers partitioning through inverted file indexes. Chapter 4 covers compression, from product quantization to the binary and randomized schemes that have become prominent in the last few years. Chapter 5 covers graph navigation through HNSW in detail, including the parts of its design that are often misunderstood and the operational problems it creates. Chapter 6 leaves main memory, examining how indexes such as DiskANN and SPANN serve billions of vectors from solid-state drives, and how graphics processors change the economics of both building and querying indexes. Chapter 7 confronts the fact that real queries are rarely pure nearest-neighbour searches: they carry filters, they combine keyword and semantic signals, and they demand diversity. Chapter 8 assembles the pieces into a distributed system, with sharding, replication, ingestion, updates, and the management of tail latency. Chapter 9 is about measurement: how to evaluate an index honestly, why public benchmarks are a starting point rather than an answer, and how to tune a deployed system. Chapter 10 works through the decisions an engineer actually faces, with sizing arithmetic for several realistic scenarios. The book assumes comfort with basic programming concepts and with the idea of a vector as an ordered list of numbers. It does not assume knowledge of linear algebra beyond the dot product, and it explains every technique from first principles before discussing its refinements. Where it refers to specific papers or systems, it does so because they introduced an idea that is still in use, and the further reading at the end points to the primary sources. One phrase in the subtitle deserves a word of caution at the outset. Sub-millisecond queries across billions of embeddings are real, but they are not free and not universal. They are achieved by systems that hold their working set in memory across many machines, that accept a defined recall below one hundred per cent, and that are tuned for a particular query distribution. Read the phrase as a description of what careful engineering makes possible, not as a property that any index delivers by default. The rest of the book explains what the careful engineering consists of. Chapter 1. The Geometry of Meaning An embedding is a function that maps an object, such as a sentence, an image, a user, or a protein, to a point in a space of fixed dimension. The function is learned, usually by a neural network, and the learning objective is arranged so that objects which should be treated as similar end up near one another. Once that is true, a question about meaning ("which documents discuss the same thing as this query?") becomes a question about geometry ("which points lie closest to this point?"). Vector search is the machinery for answering the geometric question quickly. Before examining that machinery, it is worth being precise about what the geometry is and where it comes from, because many problems that surface later as index problems are in fact embedding problems. From words to vectors The idea that meaning can be captured by position has a long history in information retrieval. The vector space model of the 1960s and 1970s, associated with Gerard Salton and the SMART system at Cornell, represented each document as a vector with one dimension per vocabulary term. The value in each dimension was a weight, typically some variant of term frequency multiplied by inverse document frequency, and similarity between a query and a document was the cosine of the angle between their vectors. This representation is sparse: a vocabulary might have hundreds of thousands of terms, but any given document uses only a few hundred of them, so almost every coordinate is zero. Sparse representations are excellent at exact matching and poor at meaning. A query for "automobile repair" shares no terms with a document about "fixing cars", and so their cosine similarity is zero. Decades of work on query expansion, stemming, thesauri, and latent semantic analysis attempted to bridge this vocabulary gap. Latent semantic analysis, introduced at the end of the 1980s, used a truncated singular value decomposition of the term-document matrix to project documents into a few hundred dense dimensions, where words that co-occurred in similar contexts were pulled together. It was the first widely used dense semantic embedding, and it already displayed the property that makes dense vectors useful: similarity in the projected space tracks similarity in meaning better than term overlap does. The modern era began with neural word embeddings. Word2vec, published by Tomas Mikolov and colleagues at Google in 2013, trained a shallow network to predict words from their neighbours and produced vectors in which semantic and syntactic relationships appeared as consistent directions. GloVe followed from Stanford in 2014. These were word-level embeddings; to embed a sentence one had to average or otherwise combine word vectors, which loses order and nuance. Transformer language models changed that. BERT, released in 2018, produced contextual representations for every token, and a series of papers then showed how to train such models specifically to produce a single vector per passage that is good for retrieval. Sentence-BERT in 2019 fine-tuned BERT with a siamese architecture so that semantically similar sentences received nearby vectors. Dense Passage Retrieval, from Facebook AI Research in 2020, trained separate query and passage encoders on question-answer pairs and demonstrated that a purely dense retriever could outperform the classic BM25 keyword ranker on open-domain question answering benchmarks. Since then, general-purpose text embedding models have been trained by many organizations, open and commercial, and evaluated on shared benchmarks such as MTEB, the Massive Text Embedding Benchmark, which aggregates dozens of retrieval, clustering, and classification tasks. Parallel developments happened in other modalities. CLIP, from OpenAI in 2021, trained an image encoder and a text encoder jointly on image-caption pairs so that a photograph and a sentence describing it land near each other in a shared space. That made cross-modal retrieval, searching images with text, a nearest-neighbour problem. Recommendation systems learned embeddings for users and items from interaction logs, so that "items this user might like" became "item vectors near this user vector". Code search, chemistry, audio fingerprinting, and face recognition all followed the same pattern. The common structure is that a model, trained once at considerable expense, defines a space. Everything the system stores is embedded into that space at ingestion time. Every query is embedded at query time. The search system knows nothing about language or images; it sees only points. How similarity is measured Given two vectors, there are three similarity or distance functions that dominate practice. The first is Euclidean distance, often written L2: the square root of the sum of squared differences between coordinates. It is the ordinary straight-line distance familiar from school geometry, extended to many dimensions. Because the square root is monotonic, search systems almost always compare squared L2 distances and skip the root. The second is inner product, also called dot product: the sum of products of corresponding coordinates. Larger is more similar. Inner product is not a distance in the mathematical sense, because a vector is not necessarily most similar to itself; a different vector pointing in the same direction but longer will score higher. Search over inner product is therefore called maximum inner product search, MIPS, to distinguish it from nearest-neighbour search under a true metric. The third is cosine similarity: the inner product of two vectors divided by the product of their lengths. It measures only the angle between them and ignores magnitude entirely. These three are related in a way that matters for engineering. If every vector is normalized to unit length, cosine similarity equals inner product, and squared Euclidean distance equals two minus twice the inner product. All three then produce exactly the same ranking. This is why many embedding models output normalized vectors and why many vector databases quietly normalize on ingestion when asked for cosine similarity: it reduces three problems to one, and it allows indexes designed for Euclidean distance to be used for cosine search. When vectors are not normalized, the choice matters. Some models, particularly in recommendation, deliberately encode information in vector length. An item's vector might be longer if the item is popular or of high quality, so that inner product with a user vector rewards both relevance and quality. Searching such vectors with cosine similarity discards the quality signal. Searching them with Euclidean distance penalizes long vectors, which is the opposite of what was intended. The correct choice is whatever the model was trained with. A frequent and silent error is to index vectors with a distance function different from the one used in training, which produces results that look plausible and are systematically worse. Maximum inner product search has a further wrinkle. Many index structures, including graph indexes and some quantization schemes, rely on the triangle inequality or on the property that a point is its own nearest neighbour, neither of which inner product satisfies. A well-known reduction, described in work by Bachrach and colleagues at Microsoft in 2014 and in related papers, converts MIPS into Euclidean nearest-neighbour search by appending one extra coordinate to each stored vector, chosen so that all augmented vectors have the same length, and appending a zero to the query. After the transformation, the Euclidean nearest neighbour of the augmented query is the maximum inner product match of the original. The cost is one dimension and a change in the data distribution that can make some indexes less efficient, so systems that need MIPS at scale often prefer methods designed for it directly, such as the anisotropic quantization in Google's ScaNN, discussed in Chapter 4. What the dimensions mean, and what they do not Embedding dimensions in current models commonly range from 256 to 4,096, with 384, 768, 1,024, and 1,536 being frequent choices. A natural question is what each dimension represents. The honest answer is that individual dimensions usually have no stable interpretation. The model learns a space in which distances are meaningful, but any rotation of that space would preserve all distances and therefore serve equally well. Meaning lives in the relative positions of points, not in the axes. This has two practical consequences. First, it is generally not safe to truncate an embedding by dropping its last coordinates, because there is no reason the information should be concentrated in the first ones. The exception is models trained specifically to allow truncation. Matryoshka Representation Learning, published by Kusupati and colleagues in 2022, trains a model so that the first 64, 128, 256 dimensions and so on are each usable embeddings on their own, with quality declining gracefully as dimensions are removed. Several commercial and open embedding models now ship with this property, and it gives search engineers a direct lever: store and search short prefixes for speed, and use the full vector to re-rank. Second, because the axes are arbitrary, an index can apply its own rotation without changing the meaning. Several compression methods do exactly this, rotating the space so that information is spread more evenly across coordinates before quantizing them. Chapter 4 returns to this idea. Not all dimensions are equally used, however. Learned embeddings are typically anisotropic: rather than filling the space uniformly, the points cluster in a narrow cone, with a few directions carrying most of the variance. Researchers studying contextual language model representations documented this in 2019 and 2020, observing that randomly chosen sentence embeddings from some models have high cosine similarity with one another. Anisotropy is not necessarily harmful for retrieval, since ranking depends on relative differences, but it affects index behaviour. It means the intrinsic dimension of the data, the number of directions along which points genuinely vary, is often much lower than the nominal dimension. A 768-dimensional embedding collection might behave, for indexing purposes, more like a collection of a few dozen effective dimensions. That is good news, because the difficulty of nearest-neighbour search grows with intrinsic dimension, not nominal dimension. The query is not a document A subtle point that matters a great deal in practice is that queries and documents need not come from the same distribution. In a symmetric task, such as finding duplicate questions, both sides are the same kind of text. In an asymmetric task, such as answering short questions from long passages, the query is a few words and the document is a paragraph. Many retrieval models are trained asymmetrically, sometimes with separate encoders for queries and documents, sometimes with a single encoder and a prefix instruction such as "query:" or "passage:" that tells the model which side it is embedding. The geometric consequence is that query vectors and document vectors may occupy different regions of the space. Cross-modal retrieval makes this extreme: in a CLIP-style model, text embeddings and image embeddings are aligned well enough to rank correctly, but they do not overlap; there is a measurable gap between the region occupied by images and the region occupied by text. This is called the modality gap, and it was characterized in a 2022 paper by Liang and colleagues. Index structures are built from the documents. If queries come from elsewhere, the index is being asked to answer questions about points it was not organized around. The Big-ANN benchmark competition held at NeurIPS in 2021 included a dataset built from text-to-image search at Yandex precisely because this out-of-distribution setting made graph indexes noticeably less efficient than on in-distribution data. Subsequent work, including the RoarGraph index published in 2024, builds graphs using a sample of real queries to correct for the mismatch. The lesson for an engineer is to test an index with real queries, not with held-out documents used as stand-in queries, because the latter will flatter the index. Similarity is not relevance The final point of this chapter is the most important one for anyone building a product on top of vector search. Nearest neighbours in embedding space are the items the model considers most similar. Whether they are the items the user needs is a separate question. Embedding models compress a passage into a single point. That compression discards information, and what it discards is determined by the training data. A general-purpose model trained largely on web text may place two contracts near each other because they share legal boilerplate, even if they differ in the one clause that matters. It may struggle with negation, so that "drugs that do not interact with warfarin" retrieves documents about drugs that do. It may handle rare identifiers, part numbers, and proper names poorly, because these appear too infrequently in training to receive distinctive representations. These are limitations of single-vector dense retrieval, and they are why production systems so often combine dense search with keyword search, apply re-ranking models that read the query and candidate together, or use multi-vector representations such as ColBERT, which keeps one vector per token rather than one per passage. There is also a theoretical ceiling. A single vector of dimension d can represent only so many distinct top-k result sets through inner products; work published in 2025 by researchers at Google DeepMind and Johns Hopkins formalized this in terms of the sign-rank of the relevance matrix and constructed simple retrieval tasks on which embedding models of realistic dimension fail. The practical reading is not that dense retrieval is broken, but that its errors are structural and will not be fixed by a better index. This distinction shapes how the rest of the book should be read. An approximate index that returns ninety-eight per cent of the true nearest neighbours is reproducing the model's judgement almost exactly. If the application is still failing, the remaining two per cent are rarely the cause. Conversely, when an application is succeeding, it is easy to over-invest in recall: going from ninety-five to ninety-nine per cent recall can double or triple query cost, and if the downstream re-ranker or language model is robust to a missing candidate or two, that money buys nothing. Knowing which situation you are in requires measuring both index recall against exact search and end-to-end quality against human judgement, and keeping the two separate. Chapter 9 describes how. With the geometry established, the next question is why we cannot simply compute all the distances and sort them. The answer has two parts: one about mathematics, concerning how distances behave in high dimensions, and one about hardware, concerning how fast real machines can move bytes. Chapter 2. Why Exact Search Fails at Scale The simplest nearest-neighbour algorithm is to compute the distance from the query to every stored vector and keep the k smallest. It is called brute-force or flat search, and it is exact by construction. It is also, surprisingly often, the right answer. For collections of up to a few hundred thousand vectors, a well-implemented flat scan on a modern processor completes in a few milliseconds and requires no index at all. Facebook's Faiss library, the most widely used toolkit in this field, calls its flat index IndexFlat and treats it as the gold standard against which every approximate method is measured. Understanding why flat search eventually fails, and why the obvious alternatives from classical computational geometry do not rescue it, is the foundation for everything that follows. The arithmetic of brute force Consider a collection of N vectors of dimension d, stored as 32-bit floats. A single query requires N distance computations, each of which involves d multiplications and d additions. For N of one billion and d of 768, that is roughly 1.5 trillion floating-point operations per query. A single modern server processor core with wide vector instructions can sustain perhaps tens of billions of such operations per second under ideal conditions, so one core would take on the order of a minute. Spread across a hundred cores the query might take under a second, but that machine would then serve one query per second, and a production search system may need thousands. Arithmetic is not actually the binding constraint, however. Memory bandwidth is. To compare a query against every stored vector, the processor must read every stored vector from memory. One billion vectors at 768 dimensions and four bytes per dimension is about 3.1 terabytes. A server memory system might deliver a few hundred gigabytes per second of bandwidth in aggregate. Reading three terabytes at three hundred gigabytes per second takes ten seconds, regardless of how fast the arithmetic units are. The scan is memory-bound: the processor spends almost all of its time waiting for data. This observation is worth internalizing because it explains the shape of nearly every technique in this book. Approximate methods win not primarily by doing less arithmetic, though they do, but by touching fewer bytes. Partitioning touches fewer vectors. Compression makes each vector fewer bytes. Graph navigation touches a small, query-dependent set of vectors. Re-ranking touches full-precision vectors only for a short candidate list. When evaluating any new technique, the first question to ask is how many bytes it reads per query and from which level of the memory hierarchy. Batching changes the picture somewhat. If many queries arrive together, a flat scan can load each stored vector once and compare it against all queries in the batch, turning a memory-bound operation into a compute-bound matrix multiplication. Graphics processors are extremely good at this, and for offline workloads such as computing nearest neighbours for every item in a catalogue, batched brute force on GPUs is often the fastest exact method available. The 2017 paper by Johnson, Douze, and Jégou that introduced Faiss's GPU implementation demonstrated exactly this kind of large batched computation, building a k-nearest-neighbour graph over a billion vectors on a small number of GPUs. Online serving, where queries arrive one at a time and each must be answered in milliseconds, does not get this benefit. Why trees stop working Computational geometry offers elegant exact data structures for nearest-neighbour search in low dimensions. The k-d tree, introduced by Jon Bentley in 1975, recursively splits space along one coordinate at a time, creating a binary tree whose leaves hold small groups of points. To answer a query, one descends to the leaf containing the query, finds the nearest point there, and then backtracks, visiting other branches only if the region they cover could contain a closer point. In two or three dimensions, this visits a tiny fraction of the data and answers queries in roughly logarithmic time. In high dimensions the backtracking step collapses. The test that prunes a branch asks whether the distance from the query to the splitting boundary exceeds the current best distance. In high dimensions, the current best distance is large relative to the spread of coordinates along any single axis, so almost no branch can be ruled out. A k-d tree over 768-dimensional data ends up visiting most of its leaves and performs worse than a flat scan because of the overhead of traversal. Ball trees, cover trees, vantage-point trees, and R-trees all suffer versions of the same problem. A rule of thumb from the database literature is that these exact tree structures stop beating a linear scan somewhere between ten and twenty dimensions, depending on the data. The underlying cause has a name. The curse of dimensionality The phrase "curse of dimensionality" was coined by Richard Bellman in the context of dynamic programming, but in nearest-neighbour search it refers to a specific and somewhat counterintuitive phenomenon: as dimension grows, distances concentrate. Take a large set of points scattered uniformly at random in a high-dimensional cube, and pick a query point. Compute the distance from the query to every point, and look at the ratio between the largest and the smallest. In two dimensions that ratio is enormous: some points are right next to the query and others are on the far side of the cube. As the dimension increases, the ratio shrinks toward one. Every point ends up at roughly the same distance from the query. A 1999 paper by Beyer, Goldstein, Ramakrishnan, and Shaft, titled "When Is Nearest Neighbor Meaningful?", proved that under fairly general conditions on the data distribution, the relative difference between the nearest and farthest distances goes to zero as dimension grows. If that held for real embeddings, nearest-neighbour search in high dimensions would be not only hard but pointless, because the "nearest" neighbour would be barely nearer than anything else. Two facts rescue the enterprise. First, real data is not uniform. Learned embeddings have low intrinsic dimension, as described in Chapter 1: the points lie close to a lower-dimensional structure within the nominal space, and they are clustered, with semantically related items forming dense regions. Distance concentration is governed by intrinsic dimension, so a 768-dimensional embedding collection with intrinsic dimension in the tens behaves far better than uniform random data in 768 dimensions. Second, even when distances are somewhat concentrated, the ranking can still be meaningful. Retrieval cares about which items are closest, not about whether the gap between closest and farthest is large in absolute terms. A model trained with a contrastive objective is explicitly pushed to separate relevant pairs from irrelevant ones by a margin, and that margin survives even when the bulk of distances cluster together. The curse leaves a mark nonetheless. Concentration means that the nearest neighbour is often only slightly closer than the tenth or hundredth, which makes approximate methods sensitive to small errors: a compressed distance that is off by a few per cent can reorder the top results. It also produces a phenomenon called hubness, documented by Radovanović, Nanopoulos, and Ivanović in 2010, in which a small number of points appear in the nearest-neighbour lists of a disproportionately large number of other points. Hubs are points that happen to lie near the centre of the data distribution. They show up in search results for many unrelated queries, which can look like a relevance bug, and they distort graph indexes by attracting a large share of edges. Approximate nearest neighbours Faced with the failure of exact methods, the field changed the question. Instead of demanding the exact k nearest neighbours, approximate nearest-neighbour search, ANN, asks for a set of k items that are probably among the nearest, or close to the nearest, with the probability or closeness controlled by parameters. The theoretical foundations were laid in the late 1990s. Indyk and Motwani's 1998 paper introduced locality-sensitive hashing, LSH, a family of hash functions with the property that nearby points collide with higher probability than distant ones. Hashing every stored vector with several such functions and looking up only the buckets the query falls into gives a sublinear-time algorithm with provable guarantees for the c-approximate nearest-neighbour problem: return a point within c times the true nearest distance. For cosine similarity, the classic LSH family, due to Charikar in 2002, uses random hyperplanes: each hash bit records which side of a random hyperplane the vector lies on. LSH was a breakthrough in theory and remains useful in streaming and privacy-sensitive settings, but in practice it has been largely displaced for dense embedding search. To reach high recall, LSH needs many hash tables, and each table stores a reference to every vector, so memory grows quickly. Its guarantees are worst-case and data-independent, which is precisely why it is outperformed on real data by methods that learn the data distribution. The partitioning, quantization, and graph methods that dominate today are all data-dependent: they look at the collection and organize themselves around it. They rarely come with worst-case guarantees, but on the data people actually have, they are much faster at a given recall. Recall, the measure of the bet To compare approximate methods we need a measure of how much they lose. The standard measure is recall at k. Run the query against the approximate index and retrieve k results. Run the same query with exact brute-force search and retrieve the true k nearest neighbours. Recall at k is the fraction of the true k that appear in the approximate k. If the index returns eight of the true ten nearest neighbours, recall at ten is 0.8. Averaging over a set of test queries gives the index's recall for that configuration. There are variants. Recall 1@10 asks whether the single true nearest neighbour appears anywhere in the top ten approximate results, a looser criterion used in some older literature, particularly with product quantization. Recall 10@100 asks what fraction of the true top ten appear in the approximate top hundred, which is relevant when the approximate results will be re-ranked. It is important to know which variant a paper or vendor is reporting, because the numbers are not comparable. A claim of "99 per cent recall" means little without the k values attached. The essential property of recall is that it measures fidelity to exact search, not relevance. An index with perfect recall reproduces the embedding model's ranking exactly. Whether that ranking is good is a question about the model. Engineers sometimes conflate the two, reporting retrieval quality metrics such as normalized discounted cumulative gain from an evaluation set and treating changes in them as changes in index quality. Index recall should be measured against brute force on the same embeddings, separately, so that the two sources of error can be attributed correctly. Recall alone is meaningless without cost. Any index can reach recall of one by scanning everything. The meaningful object is a curve: for each setting of the index's search parameters, plot throughput, usually queries per second on a fixed machine, against recall. A better index has a curve that lies above and to the right of a worse one, delivering more queries per second at the same recall. The ANN-Benchmarks project, created by Erik Bernhardsson and described in a 2018 paper by Aumüller, Bernhardsson, and Faithfull, standardized this presentation and made it the common language of the field. Its plots, one per dataset, show dozens of algorithms as recall-throughput curves, and they are the first thing most practitioners look at when comparing libraries. Other costs matter too and are often missing from the headline curve: memory consumption, index build time, the cost of inserting and deleting vectors, and latency percentiles rather than averages. A method that wins on throughput at a given recall but needs three times the memory, or takes a day to build, may be the wrong choice. The billion-scale Big-ANN benchmark competitions, organized at NeurIPS in 2021 and again in 2023 by Harsha Vardhan Simhadri and colleagues, broadened the evaluation by fixing hardware budgets and adding tracks for out-of-core search on solid-state drives, filtered search, streaming updates, and sparse vectors. Their results remain one of the best public sources of evidence about how methods behave at scale. Where the bytes live The final ingredient of this chapter is a model of the machine, because the right index depends on where its data sits. A modern server has a hierarchy of storage, each level larger, cheaper per byte, and slower than the one above. At the top are processor registers and on-chip caches, measured in kilobytes to a few hundred megabytes, with access times of a few nanoseconds. Below them is main memory, DRAM, typically hundreds of gigabytes to a few terabytes per server, with access latency around a hundred nanoseconds and bandwidth in the hundreds of gigabytes per second. Below that are NVMe solid-state drives, often tens of terabytes per server, with random read latency on the order of tens to a hundred microseconds and the ability to sustain hundreds of thousands to over a million random reads per second when many requests are in flight. Below those are networked storage and object stores, effectively unlimited in size, with latencies of milliseconds. Graphics processors have their own hierarchy: high-bandwidth memory on the accelerator, measured in tens of gigabytes per device up to a couple of hundred gigabytes on recent data-centre parts, with bandwidth in the terabytes per second, connected to the host by a link that is much slower than the device memory itself. Each index design in this book can be understood as an answer to the question of which data goes at which level. A pure in-memory HNSW index keeps full-precision vectors and the graph in DRAM; it is fast and expensive. An IVF index with product quantization keeps compact codes in DRAM, perhaps a tenth or a thirtieth of the original size, and scans them with cache-friendly code; it is cheaper and loses some recall to compression. DiskANN keeps compressed codes in DRAM for navigation and full vectors with the graph on SSD for re-ranking; it is cheaper still, and its latency is governed by the number of SSD reads per query. A GPU index keeps codes in accelerator memory and processes thousands of queries in parallel. A recurring and very useful technique combines levels: search with a compact approximate representation held high in the hierarchy, retrieve a candidate list larger than k, then fetch the precise representations of only those candidates from lower in the hierarchy and re-rank them exactly. The approximate stage determines which true neighbours can possibly be found, and the re-ranking stage determines their final order. If the candidate list is large enough to contain the true neighbours, re-ranking restores most of the precision that compression discarded. This two-stage pattern appears in nearly every serious large-scale system, and its parameters, the size of the candidate list and the precision of each stage, are among the most important levers an engineer has. With the problem framed as a series of bets constrained by bytes and measured by recall, the next three chapters examine the three bets in turn, starting with the oldest and conceptually simplest: carving the space into regions. Chapter 3. Partitioning: Inverted File Indexes The first bet is the most intuitive. If the collection is divided into regions, and similar items tend to fall in the same region, then a query need only examine the regions closest to it. The bet loses when a true nearest neighbour falls in a region the query does not visit. The design questions are how to draw the regions, how many to draw, how many to visit, and what to do about points that sit near the boundaries. The structure that implements this bet is called an inverted file index, IVF for short. The name comes from text retrieval, where an inverted index maps each word to the list of documents containing it. In the vector setting, the "words" are cluster centres, and each centre maps to the list of vectors assigned to it. The idea appears in the 2011 product quantization paper by Hervé Jégou, Matthijs Douze, and Cordelia Schmid, where it was paired with compression to form the IVFADC method, and it has remained a workhorse of large-scale search ever since. Faiss, Milvus, and many other systems offer IVF variants, and it is the backbone of several of the disk-based methods discussed in Chapter 6. Building the partition An IVF index is built in two steps. First, a set of cluster centres, called centroids, is learned from the data. Second, every vector in the collection is assigned to its nearest centroid and appended to that centroid's list. The centroids are almost always learned with k-means clustering. K-means starts with some initial set of centres, assigns every training point to its nearest centre, moves each centre to the mean of the points assigned to it, and repeats until the assignments stabilize. The result is a set of centres that roughly minimizes the total squared distance from points to their nearest centre. In the language of signal processing, the set of centres is a vector quantizer: it replaces any vector with the identity of the closest centre, and the quantization error is the distance between the vector and that centre. Because this quantizer only determines which list a vector goes into, and not how it is stored, it is called the coarse quantizer. K-means does not need to see the whole collection. A sample is enough, provided it represents the data distribution. The Faiss documentation recommends training on somewhere between thirty and two hundred and fifty-six times as many points as there are centroids; below that range the centroids are poorly estimated, and above it the extra points add cost without much benefit. For a billion-vector collection with a million centroids, this still means clustering tens or hundreds of millions of points, which is why GPU implementations of k-means became important early in the history of large-scale indexing. The number of centroids, usually written nlist, is the first major parameter. With nlist centroids and N vectors, each list holds on average N divided by nlist vectors. More lists means smaller lists, so each list is cheaper to scan, but it also means more centroids to compare the query against and a finer partition, in which true neighbours are more likely to be split across lists. A common rule of thumb is to set nlist proportional to the square root of N; Faiss's guidelines suggest between four and sixteen times the square root of N. For a hundred million vectors this gives somewhere between forty thousand and a hundred and sixty thousand lists, and Faiss users frequently choose a power of two such as 65,536. Searching the partition A query against an IVF index proceeds in two stages. In the first, the query is compared against all nlist centroids, and the nprobe closest centroids are selected. In the second, the query is compared against every vector in each of the selected lists, and the k closest are returned. The parameter nprobe is the main search-time control. Setting it to one examines a single list, which is fast but frequently misses neighbours that fall just across a boundary. Increasing it widens the search. Recall rises steeply at first and then flattens, approaching one only as nprobe approaches nlist, at which point the index has degenerated into a flat scan with extra overhead. A worked example makes the economics concrete. Suppose a hundred million vectors are partitioned into 65,536 lists, giving an average of about fifteen hundred vectors per list. With nprobe set to 64, a query compares against 65,536 centroids and then scans about 64 times 1,525, roughly ninety-eight thousand vectors. The total work is about a hundred and sixty thousand distance computations, roughly 0.16 per cent of the brute-force cost. If the vectors are stored at full precision in 768 dimensions, the list scan reads about three hundred megabytes, which on a single core is still too slow for a sub-millisecond target. This is why IVF is almost never used alone at that scale: it is paired with compression, so that the scanned lists are tens of times smaller, and with a fast structure for the centroid search, so that comparing against tens of thousands of centroids does not dominate. That centroid search is itself a nearest-neighbour problem, and at large nlist it becomes significant. Comparing a query against a million centroids by brute force costs as much as scanning a million vectors. The standard solution is to index the centroids with a graph. Faiss expresses this in its index factory notation with strings such as IVF1048576_HNSW32, meaning an IVF index with about a million lists whose centroids are found through an HNSW graph with 32 links per node. The graph adds a small approximation error in choosing which lists to probe, which in practice is usually negligible compared with the error from the partition itself. Why boundaries are the problem The recall loss in IVF is concentrated near the edges of the clusters. A query that lands near the middle of a cluster will typically find its nearest neighbours in the same cluster. A query that lands near the boundary between two or more clusters will have neighbours on both sides, and if nprobe is small, some of them will be missed. In high dimensions, almost everything is near a boundary. This follows from the same geometry that produces distance concentration. Each cluster has many neighbouring clusters, and a typical point is not much closer to its own centroid than to several others. Empirically, recall at nprobe of one is often poor on real embedding data, sometimes below fifty per cent, and reaching ninety-five per cent may need dozens or hundreds of probes. How many depends on the data and on nlist. Three families of technique address the boundary problem. The first is simply probing more lists, accepting the cost. Because list scanning with compressed codes is very efficient, this is often the pragmatic answer. The second is redundant assignment, also called spilling: place vectors that sit near a boundary into more than one list. Then a query that probes only one side of the boundary will still find them. The cost is memory, since some vectors are stored twice or more, and slightly larger lists. SPANN, a disk-oriented index from Microsoft published in 2021, uses a rule that assigns a vector to additional clusters when its distance to those centroids is within a small factor of its distance to the nearest one, and it limits the duplication to keep storage bounded. Google's SOAR technique, published in 2023 and integrated into the ScaNN library, makes the secondary assignment smarter. It chooses the spill cluster not merely by proximity but so that the quantization error with respect to the second centroid is as different as possible from the error with respect to the first, with the reasoning that a query poorly served by one assignment will then tend to be well served by the other. The third is to make the partition finer without making the centroid search more expensive. The inverted multi-index, introduced by Artem Babenko and Victor Lempitsky in 2012, splits each vector into two halves and runs k-means separately on each half. A vector's cell is the pair of its two half-centroids, so with K centroids per half the index has K squared cells. With K of 16,384, that is more than a quarter of a billion cells, a far finer partition than a single k-means could produce at reasonable cost. Searching requires enumerating cells in order of their combined distance to the query, which a priority queue does efficiently. The inverted multi-index was influential in the early billion-scale work on the SIFT1B and Deep1B datasets. It is less common in production now, partly because graph-based coarse quantizers made very large single-level nlist practical. Imbalance and its consequences K-means does not produce clusters of equal size. Real embedding collections contain dense regions, such as many near-duplicate product listings or many paraphrases of popular questions, and sparse ones. K-means places more centroids in dense regions but not proportionally enough, so some lists end up much longer than average. The variance in list length matters for two reasons. The first is that query cost becomes uneven. A query that lands in a dense region will probe long lists and take much longer than one that lands in a sparse region. Since dense regions are dense precisely because many items are similar to popular content, they are also where many queries land. The average query cost can therefore be considerably higher than the average list length would suggest, and the tail latency, the cost of the slowest one per cent of queries, can be several times the median. The second is that load across machines becomes uneven when lists are distributed across shards. A shard that holds the lists for a popular region will receive disproportionate traffic. Remedies include balanced k-means variants that penalize cluster size during training, hierarchical clustering that recursively splits oversized clusters, and capping list sizes at build time by reassigning overflow vectors to their second-nearest centroid. SPANN uses a hierarchical balanced clustering for exactly this reason: on disk, the cost of reading a list is proportional to its length, and an oversized list directly becomes a slow query. Each remedy trades some clustering quality for predictability. For a latency-sensitive service, predictability usually wins. Residuals: what the partition gives to compression IVF does more than restrict the search to a subset of vectors. It also provides a useful transformation of the data. Once a vector has been assigned to a centroid, the difference between the vector and its centroid, called the residual, is typically much smaller in magnitude than the vector itself and more uniformly distributed across clusters. Compressing residuals rather than raw vectors is markedly more accurate for the same code size, because the compression scheme only has to describe the local variation within a cluster rather than the vector's absolute position in the whole space. This is the central insight of IVFADC in the original product quantization paper. Vectors are stored in their lists as compressed codes of their residuals. At query time, the query's residual with respect to each probed centroid is computed, and distances are estimated between that query residual and the stored code. The cost is that the query must be re-encoded for each probed list, which adds a per-list overhead; the benefit is a substantial improvement in accuracy that has made residual encoding the default for IVF with product quantization. Where IVF stands today IVF has several practical virtues that keep it relevant despite the dominance of graph indexes in many benchmarks. It is memory-efficient. Apart from the centroids, which are small, the index adds only the storage of vector identifiers to the codes themselves. There is no graph with tens of edges per vector. When combined with aggressive compression, IVF can hold a billion vectors in a few tens of gigabytes of memory, which no graph index with full-precision vectors can approach. It is simple to update. Adding a vector means finding its nearest centroid and appending to a list. Deleting a vector means removing it from a list, or marking it deleted and compacting later. There is no graph connectivity to maintain. Over time, if the data distribution drifts, the centroids become stale and lists become unbalanced, so a periodic retraining and rebuild is needed, but the day-to-day operations are cheap. Its access pattern is friendly to hardware. Scanning a list is a sequential read of contiguous codes, which suits processor caches, wide vector instructions, GPUs, and solid-state drives far better than the random access pattern of a graph traversal. This is why IVF-style partitioning underlies the most successful GPU indexes and several of the best disk-based indexes. Its weakness is the recall-cost curve at high recall in memory. To push recall above ninety-five per cent, IVF needs many probes, and each probe has a fixed overhead plus the cost of scanning a list. Graph indexes, which reach the neighbourhood of the query directly and then explore only locally, typically need far fewer distance computations to reach the same recall. On the standard in-memory benchmarks, graph methods sit above IVF methods on the recall-throughput chart at high recall, often by a wide margin. The two families are therefore not competitors so much as tools for different points in the design space. IVF dominates when memory is the constraint, when updates are frequent, when the hardware favours sequential scanning, or when the partition itself is useful for distributing data across machines. Graph indexes dominate when the working set fits in memory and the priority is the lowest latency at high recall. Many large systems use both: a partition to divide the collection into shards or disk blocks, and a graph either within each partition or over the centroids. What makes IVF truly effective at scale is the thing it was designed to be paired with. A list of fifteen hundred full-precision vectors is expensive to scan; a list of fifteen hundred thirty-two-byte codes fits comfortably in a processor cache and can be scanned in a few microseconds. The next chapter explains how such codes are made, and what they cost. Chapter 4. Compression: Product Quantization and Its Descendants The second bet is that a vector does not need all of its bits to be found. A 768-dimensional embedding stored as 32-bit floats occupies 3,072 bytes. Much of that precision is noise from the point of view of ranking: the embedding model itself is not accurate to seven significant figures, and the ordering of neighbours usually survives a great deal of rounding. If each vector can be represented in 64 or 96 bytes instead of 3,072, then thirty to fifty times as many vectors fit in the same memory, each distance computation reads thirty to fifty times fewer bytes, and a memory-bound scan becomes correspondingly faster. The bet loses when compression reorders neighbours. Because distances in high dimensions are concentrated, the true nearest neighbour is often only slightly closer than the next few, and a small distortion in estimated distance can swap them. The art of vector compression is to make the distortion as small as possible for a given code size, to make distance computation on the compressed codes as fast as possible, and to recover lost precision cheaply by re-ranking. Product quantization The method that defined the field is product quantization, PQ, introduced by Jégou, Douze, and Schmid in a paper published in IEEE Transactions on Pattern Analysis and Machine Intelligence in 2011. Its central trick is to avoid the impossibility of a single enormous codebook. Consider first plain vector quantization: learn a set of K centroids with k-means and represent each vector by the index of its nearest centroid. With K of 256, each vector compresses to a single byte. The problem is accuracy. Two hundred and fifty-six points cannot represent a billion distinct vectors with any fidelity. To get a useful approximation, K would need to be astronomically large, perhaps two to the sixty-fourth power for a 64-bit code, and no one can run k-means with that many centroids or store the result. Product quantization splits each vector into m contiguous sub-vectors of equal length. A 768-dimensional vector with m of 96 is split into 96 sub-vectors of eight dimensions each. A separate k-means is run on each sub-space, typically with 256 centroids, so each sub-vector can be encoded as one byte identifying its nearest sub-centroid. The full vector is represented by m bytes: 96 bytes in this example, a compression ratio of 32 against 32-bit floats. The effective codebook is the Cartesian product of the sub-codebooks. With 96 sub-spaces of 256 centroids each, the number of distinct vectors that can be represented is 256 raised to the 96th power, an unimaginably large number. Yet the storage for the codebooks is only 96 times 256 centroids of eight dimensions, about 786 kilobytes in 32-bit floats. That combination of a vast effective codebook with a tiny actual one is what makes PQ work. The approximation it makes is that the sub-spaces are quantized independently. If the coordinates in different sub-vectors are correlated, independent quantization wastes bits. If some sub-vectors carry far more variance than others, assigning the same eight bits to each is inefficient. These issues motivate the refinements discussed below. Computing distances on codes The second insight of PQ is that distances can be computed between a full-precision query and a compressed database vector without decompressing the vector. This is called asymmetric distance computation, ADC: asymmetric because the query is exact and only the database side is approximated. When a query arrives, it is split into the same m sub-vectors. For each sub-space, the squared distance from the query's sub-vector to each of the 256 sub-centroids is computed and stored in a small table. With m of 96, this produces 96 tables of 256 entries each, about 24,576 numbers. The cost is equivalent to roughly 256 full-dimensional distance computations, and it is paid once per query, or once per probed list when residuals are used. The squared Euclidean distance from the query to any encoded database vector is then approximated by summing m table entries: for each sub-space, look up the entry indexed by the vector's code byte and add it to a running total. No multiplication is needed, only m memory lookups and additions. The tables themselves are small enough to sit in the fastest processor caches. The alternative, symmetric distance computation, quantizes the query as well and looks up precomputed centroid-to-centroid distances. It is slightly faster but noticeably less accurate, and ADC is the norm. Asymmetric distance has a further benefit for inner product search. The inner product of a query with a vector decomposes into a sum over sub-spaces, just as squared distance does, so the same table-lookup procedure works for MIPS with tables of inner products instead of distances. Making PQ fast on real processors A naive implementation of the table lookup is limited by the latency of memory accesses into the tables. In the mid-2010s, Fabien André, Anne-Marie Kermarrec, and Nicolas Le Scouarnec showed that PQ scanning could be made dramatically faster by reorganizing the computation to exploit SIMD instructions. Their key move was to use 16 centroids per sub-space instead of 256, so each code is four bits rather than eight. A table of 16 entries, quantized to 8-bit integers, fits inside a single 128-bit processor register, and the processor's byte shuffle instruction can then perform sixteen table lookups in parallel in one instruction. With wider registers, more lookups proceed at once. Codes are laid out in memory in blocks interleaved so that the shuffle can process many database vectors simultaneously. This approach, often called fast-scan PQ or PQ with 4-bit codes, sacrifices some accuracy per bit, since 16 centroids per sub-space are coarser than 256, but it is several times faster to scan. The usual remedy for the lost accuracy is to scan more codes quickly and re-rank a candidate list with more precise data. Faiss incorporated fast-scan variants of PQ around 2020, and Google's ScaNN uses a similar 4-bit SIMD approach in its scoring. Rotations and learned refinements Optimized product quantization, OPQ, published by Tiezheng Ge, Kaiming He, Qifa Ke, and Jian Sun at CVPR 2013, addresses PQ's dependence on how dimensions are grouped. It learns an orthogonal rotation of the space, applied before splitting into sub-vectors, chosen to minimize quantization error. Intuitively, the rotation spreads variance evenly across sub-spaces and reduces the correlation between them, so that the independent quantizers work closer to their ideal. Because rotation preserves distances, it changes nothing about the search problem except how well it can be compressed. OPQ is cheap at query time, since the query is rotated once with a single matrix multiplication, and in Faiss it appears as a preprocessing step in index strings such as OPQ64,IVF65536,PQ64. Beyond OPQ lies a family of additive quantizers. Instead of splitting the vector into disjoint pieces, these methods represent the vector as a sum of several full-dimensional codewords, one from each of m codebooks. Residual quantization, the oldest of these, encodes a vector with the first codebook, encodes the remaining error with the second, and so on. Additive quantization and local search quantization search more thoroughly for the combination of codewords that best reconstructs each vector. These methods achieve lower reconstruction error than PQ for the same code size, sometimes substantially so, but encoding is much slower and distance computation needs an extra correction term. They tend to be used where compression ratio matters more than ingestion speed. Google's ScaNN, described by Ruiqi Guo and colleagues at ICML 2020, contributed a different kind of refinement: anisotropic vector quantization. The observation is that for maximum inner product search, not all quantization errors are equally harmful. An error in the component of a vector parallel to the vector itself changes its inner product with queries that are similar to it, which are exactly the queries for which the vector might be a top result. An error in the perpendicular direction matters much less for those queries. ScaNN's loss function penalizes parallel error more heavily than perpendicular error, producing codebooks that sacrifice average reconstruction accuracy to protect the ranking of high-scoring items. On inner product benchmarks, this gave ScaNN a leading position when it was released. Scalar quantization Product quantization is powerful but has costs: a training step, a codebook that must match the data distribution, and an encoding step at ingestion. A much simpler alternative is scalar quantization: compress each coordinate independently. The most common form maps each 32-bit float coordinate to an 8-bit integer. For each dimension, the system records a minimum and maximum (or a scale and offset), and linearly maps the range onto the 256 integer values. A 768-dimensional vector becomes 768 bytes, a factor of four smaller. Distance computation proceeds directly on the integers using the processor's integer vector instructions, which on modern hardware are very fast. The loss in recall from 8-bit scalar quantization on typical text embeddings is usually small, often negligible after re-ranking. Halving precision to 16-bit floats is even safer, giving a factor of two with almost no measurable effect. Scalar quantization has become the default compression in many production systems for exactly these reasons. It requires little or no training, it is robust to distribution shift because it does not learn a codebook tied to clusters, it is straightforward to apply inside graph indexes, and its accuracy loss is easy to recover by re-ranking. Lucene, which underlies Elasticsearch and OpenSearch, added scalar quantization of HNSW vectors in 2023, with the quantization ranges computed per segment so that they adapt as data arrives. Intel's Locally-adaptive Vector Quantization, LVQ, published by Cecilia Aguerrebere and colleagues in 2023, refines the idea by computing a separate scale and offset per vector after subtracting the dataset mean, which improves accuracy at four and eight bits per dimension and is used in Intel's Scalable Vector Search library. Binary quantization and its revival At the extreme, each coordinate can be reduced to a single bit: one if positive, zero if negative. A 768-dimensional vector becomes 96 bytes, a factor of 32 smaller, the same size as the PQ example above but with no training at all. Distance between two binary codes is the Hamming distance, the number of differing bits, which modern processors compute with an exclusive-or followed by a population count instruction. This is the cheapest distance computation available: a few instructions per 64 dimensions. Binary codes for similarity search have a long history in the hashing literature, including the random-hyperplane LSH described in Chapter 2. Sign-based binarization of raw embeddings was long considered too lossy for serious use. Two developments changed that view. The first was empirical. As embedding models grew to 1,024 dimensions and beyond, practitioners found that one-bit codes preserved neighbourhoods surprisingly well, particularly when combined with oversampling and re-ranking: retrieve several times more candidates than needed using Hamming distance, then re-score those candidates with full-precision or 8-bit vectors. Several embedding providers began training models with quantization in mind, and some publish models whose binary versions are documented to retain most of their full-precision retrieval quality. The exact retained fraction depends on the model and task, and should be checked on one's own data rather than assumed. The second was theoretical. RaBitQ, published by Jianyang Gao and Cheng Long at SIGMOD 2024, showed how to make binary quantization principled. It applies a random orthogonal rotation to the data, after normalizing vectors relative to a centroid, and then takes one bit per dimension. The random rotation ensures that information is spread evenly across coordinates, so that no single dimension dominates. Crucially, RaBitQ provides an unbiased estimator of the true distance from the binary code plus a small amount of auxiliary information per vector, together with a probabilistic error bound. That bound allows the search to decide, for each candidate, whether its estimated distance is confidently far enough from the current threshold to discard, or uncertain enough to require re-ranking. An extended version supports more than one bit per dimension. RaBitQ has been adopted in several open-source systems and has influenced how others think about compression: as a calibrated estimator with known error, rather than merely a lossy encoding. The economics of compression Table 1 compares the main compression schemes for a 768-dimensional vector. The byte counts follow directly from the definitions and exclude per-index overhead such as identifiers, graph edges, and codebooks; recall effects depend heavily on data and are described qualitatively. Table 1. Storage and distance cost of common compression schemes for a 768-dimensional embedding. Scheme Bytes per vector Ratio vs float32 Distance computation Typical role float32 (none) 3,072 1x Floating-point multiply-add Exact reference and re-ranking float16 / bfloat16 1,536 2x Converted multiply-add Near-lossless storage int8 scalar 768 4x Integer multiply-add Default in-graph compression PQ, 96 sub-spaces, 8-bit 96 32x 96 table lookups IVF list scanning PQ fast-scan, 192 sub-spaces, 4-bit 96 32x SIMD shuffle lookups High-throughput candidate generation Binary, 1 bit per dimension 96 32x XOR and popcount First-pass filtering before re-ranking Three lessons follow from comparing the rows. First, at the same 96 bytes, PQ and binary quantization make very different trade-offs. PQ learns codebooks that capture the data distribution and typically gives more accurate distance estimates for the bytes spent, but requires training and is sensitive to drift. Binary quantization is training-free and its distance computation is cheaper, but it discards magnitude information per coordinate and depends on high dimensionality and on re-ranking to work well. Second, compression ratio translates directly into money. A billion vectors at float32 need about 3.1 terabytes for the vectors alone. At int8 they need about 770 gigabytes, which fits in the memory of a single large server. At 96 bytes they need about 96 gigabytes, which fits in the memory of a modest one or a single high-end GPU. The difference between needing a dozen machines and needing one is the difference that makes some projects economical. Third, compression rarely stands alone; it is nearly always paired with re-ranking. The compressed representation is used to generate a candidate list, typically several times larger than k, and the full-precision vectors of those candidates are fetched, from memory if they fit or from SSD if they do not, and used to compute exact distances. The final top k are taken from the re-ranked list. The recall of the combined system depends on whether the true top k survive into the candidate list, which depends on compression quality and on how large the candidate list is. Doubling the candidate list costs a little more re-ranking work and often recovers most of the recall lost to aggressive compression. This two-stage structure also changes how one should judge a compression scheme. The question is not "how accurate are the compressed distances?" but "how large must the candidate list be for the true neighbours to survive?" A crude scheme with very cheap distances and a large candidate list can beat an accurate scheme with expensive distances and a small one. When compression hurts Compression is not free of risk. Learned codebooks, whether for PQ, OPQ, or additive quantizers, are fitted to the data distribution at training time. If the distribution shifts, for instance because a new product category is added or because the embedding model is upgraded, the codebooks fit the new data poorly, and errors grow. Systems that rely on learned codebooks need a plan for retraining them, which usually means rebuilding the index. Compression interacts badly with near-duplicate detection and with applications that need precise score thresholds. If an application decides relevance by whether a similarity exceeds a fixed value, compressed distances may push borderline items across the line. Re-ranking with exact distances before applying the threshold avoids the problem. Compression also interacts with the choice of index. Graph indexes navigate by comparing the query against neighbours at every step, and if those comparisons use compressed distances, errors can send the walk in the wrong direction early, which is much harder to recover from than an error in a flat scan. Systems that compress inside graphs typically use mild compression, such as int8, for navigation, or use more aggressive compression with a larger search beam and re-ranking at the end. That brings us to graphs, the third bet and the one that dominates in-memory vector search today. Chapter 5. Navigation: Hierarchical Navigable Small World Graphs The third bet is that the collection can be turned into a map, with each vector linked to a few of its neighbours, so that a query can find its nearest neighbours by walking. Start anywhere, look at the neighbours of the current point, move to whichever is closest to the query, and repeat until no neighbour is closer. If the graph is well built, this greedy walk arrives in the right neighbourhood after a modest number of steps, and a slightly broader local exploration then finds the nearest neighbours. The bet loses when the walk gets stuck in a local minimum: a point closer to the query than all of its neighbours, yet not the true nearest. Graph indexes reach high recall with fewer distance computations than any other family on in-memory benchmarks, and the most widely deployed of them, HNSW, has become the default index in a large share of vector databases and search engines. Lucene, and therefore Elasticsearch and OpenSearch, use it. So do pgvector, Qdrant, Weaviate, Milvus among its options, Redis, and many others. Understanding how it works, why it works, and where it struggles is the core technical competence of a vector search engineer. Proximity graphs and greedy search The idea of searching by walking through a graph of neighbours predates HNSW by decades. A proximity graph is any graph in which each data point is a node and edges connect points that are close. The theoretically ideal structure for greedy search in a metric space is the Delaunay graph, in which two points are connected if there is an empty sphere touching both of them. Greedy search on a Delaunay graph always finds the exact nearest neighbour. Unfortunately, in high dimensions the Delaunay graph becomes nearly complete, with almost every point connected to almost every other, so it is useless as an index. Practical graphs approximate it with far fewer edges. The simplest is the k-nearest-neighbour graph, in which each point links to its k closest points. Greedy search on such a graph works reasonably well locally but has two problems. It can be poorly connected globally, since clusters of mutually close points may link only to each other, leaving the graph fragmented. And the walk from a distant starting point to the query's neighbourhood can take many steps, because every edge is short. The second problem points to the key requirement. Efficient navigation needs a mix of short edges, which allow precise local search, and long edges, which allow fast movement across the space. This is the structure of a small-world network, a concept made famous by Duncan Watts and Steven Strogatz in 1998. Jon Kleinberg showed in 2000 that for decentralized greedy routing to work efficiently, the long-range links must follow a specific distribution: the probability of a link between two points should fall off with distance in a particular way, so that at every scale there are links of roughly the right length to make progress. Graphs with this property are called navigable. From NSW to HNSW Yury Malkov and colleagues introduced the navigable small world graph, NSW, in a series of papers culminating in a 2014 article in Information Systems. Their construction was strikingly simple. Insert points one at a time in random order. For each new point, find its approximate nearest neighbours among the points already inserted, using greedy search on the graph built so far, and connect the new point to them with bidirectional edges. The small-world property emerges from the insertion order. Early in construction, when the graph contains few points, the "nearest neighbours" of a new point may be far away in absolute terms, so the edges created are long. Later, when the graph is dense, edges are short. The final graph therefore contains a natural mix of long early edges and short late ones. NSW performed well but its search complexity grew polylogarithmically with collection size, and performance degraded on clustered data and low-dimensional data, where long-range edges were poorly distributed. In 2016, Malkov and Dmitry Yashunin posted a paper, later published in IEEE Transactions on Pattern Analysis and Machine Intelligence, that introduced the hierarchical version. HNSW separates edges by length into explicit layers, borrowing the structure of a skip list, the probabilistic data structure invented by William Pugh in 1990 for ordered search. In a skip list, every element is in the bottom level. A random subset, about half, is also in the level above; a random half of those are in the level above that; and so on. Searching starts at the sparse top level, moves forward as far as possible without overshooting, drops down a level, and repeats. The upper levels provide long jumps; the lower levels provide precision. HNSW applies the same idea to proximity graphs. Every vector is a node in layer zero, the bottom layer. Each vector is also assigned a maximum layer drawn at random from an exponentially decaying distribution, so that most vectors exist only in layer zero, a fraction exist in layer one as well, a smaller fraction in layer two, and a handful at the top. Within each layer, nodes are linked to their neighbours among the nodes present in that layer. Because upper layers are sparse, their edges are long; because layer zero contains everything, its edges are short. How search works A search begins at a single entry point, a node in the top layer. In each upper layer, the algorithm performs greedy search: repeatedly move to whichever neighbour of the current node is closest to the query, until no neighbour is closer. The node where the greedy search stops becomes the entry point for the next layer down. Upper layers thus act as a fast coarse router, moving the search from an arbitrary starting point into the right region of space in a small number of hops. At layer zero the algorithm switches from pure greedy search to a beam search. It maintains two structures: a candidate queue of nodes to explore, ordered by distance to the query, and a result set of the best ef nodes found so far, where ef is a search-time parameter. At each step, it takes the closest unexplored candidate, computes distances to all of that candidate's neighbours that have not been visited, and adds any that are closer than the worst member of the result set to both the candidates and the results, trimming the result set back to ef. The search stops when the closest remaining candidate is farther than the worst member of the result set, meaning no further exploration can improve the results. The top k of the result set are returned. The parameter ef, often called efSearch, is the principal search-time control for recall and speed, in the same way nprobe is for IVF. With ef equal to k, the beam is narrow and the search is fast but more likely to miss neighbours. Increasing ef widens the beam, explores more of the graph, and raises recall at the cost of more distance computations. Because ef can be changed per query without rebuilding the index, applications can trade speed for recall dynamically, for example using a larger ef for a premium tier or for queries whose results will feed a sensitive downstream task. The number of distance computations in an HNSW search is typically a few hundred to a few thousand for collections of millions of vectors at high recall. Compared with a flat scan of millions, this is the source of HNSW's speed. The original paper reported that the number of distance computations grew approximately logarithmically with collection size on the datasets tested, which is the behaviour the skip-list analogy predicts. How construction works Inserting a new vector into HNSW follows the same pattern as search. Draw the vector's maximum layer at random. Starting from the entry point, perform greedy search through the layers above the new vector's maximum layer. Then, for each layer from the vector's maximum layer down to zero, perform a beam search with a construction-time beam width, efConstruction, to find candidate neighbours. From those candidates, select up to M neighbours and connect the new vector to them bidirectionally. If adding the reverse edge pushes an existing node over its maximum number of neighbours, prune that node's neighbour list. Two parameters govern the graph's shape. M is the maximum number of neighbours per node in the upper layers; layer zero typically allows twice as many, 2M, because it carries the bulk of the search work and benefits from denser connectivity. efConstruction is the beam width used to find candidates during insertion; larger values produce better-quality neighbour lists at the cost of slower construction. The level distribution is controlled by a normalization factor, which the paper recommends setting to one over the natural logarithm of M, so that each layer is roughly M times sparser than the one below. The most important detail of construction, and the one most often missed in casual descriptions, is how the M neighbours are chosen from the candidates. The naive approach takes the M closest. HNSW instead uses a heuristic that favours diversity. Candidates are considered in order of distance from the new node. A candidate is accepted only if it is closer to the new node than it is to any neighbour already accepted. Otherwise it is skipped, on the reasoning that an already-accepted neighbour lies between the new node and this candidate and therefore provides a path to it. The effect is that a node's edges point in many different directions rather than clustering toward the densest nearby region. This matters enormously on clustered data. Without the heuristic, a node at the edge of a cluster would link only to other members of its cluster, and the graph would be poorly connected between clusters. With it, the node keeps at least one edge reaching toward the neighbouring cluster, because a member of that other cluster is not closer to any of the node's within-cluster neighbours than it is to the node itself. This pruning rule is related to the relative neighbourhood graph from computational geometry, and closely related rules appear in other graph indexes. The NSG index of Cong Fu and colleagues, published at VLDB in 2019, uses a monotonic search network construction built on the same idea. Vamana, the graph inside DiskANN, generalizes it with a parameter alpha greater than one that relaxes the pruning condition, deliberately keeping some longer edges to reduce the number of hops a search needs. Fewer hops matter greatly when each hop is an SSD read, as Chapter 6 explains. Parameters in practice Table 2 summarizes the effect of the three main HNSW parameters. The directions of effect are well established; the specific values that work best depend on the data, its dimension, and the recall target, and should be found by measurement. Table 2. Effects of the principal HNSW parameters. Parameter Set when Raising it improves Raising it costs Common starting range M Build Recall ceiling, robustness on hard data Memory per vector, build time, per-hop work 16 to 64 efConstruction Build Graph quality, achievable recall Build time, roughly linearly 100 to 500 ef (efSearch) Query Recall at query time Latency and distance computations k up to several hundred Memory deserves a closer look because it is often underestimated. With M of 16, each node at layer zero stores up to 32 neighbour identifiers. At four bytes each, that is 128 bytes per vector for layer zero alone, plus a small expected amount for the sparse upper layers. For 768-dimensional float32 vectors, 128 bytes is modest against 3,072 bytes of vector data. For a 96-byte compressed code, however, the graph is larger than the vector itself. As compression improves, graph overhead becomes the dominant memory cost, which is one reason IVF-based indexes remain competitive when memory is tight. Higher-dimensional and harder datasets benefit from larger M. Data with high intrinsic dimension needs more edges per node to stay navigable, and the HNSW paper and subsequent practice both suggest moving up from M of 16 toward 32, 48, or 64 for such data. Low-dimensional data, conversely, does well with small M. Build time is dominated by the beam searches performed during insertion. Each insertion costs about as much as a search with ef equal to efConstruction, at every layer the node occupies. For a hundred million vectors at efConstruction of 200, construction involves on the order of tens of billions of distance computations; it parallelizes across cores, since insertions can proceed concurrently with fine-grained locking on neighbour lists, but a large index still takes hours on a single machine. Faster construction is an active area. GPU-built graphs, discussed in the next chapter, have reduced build times by an order of magnitude or more in some settings. Why the hierarchy may matter less than it seems The skip-list hierarchy is the feature that gives HNSW its name, and it is natural to assume that it is responsible for its performance. Recent research complicates this picture. Several studies have compared HNSW with a flat navigable graph built using the same neighbour-selection heuristic but without upper layers, starting searches from a fixed or randomly chosen entry point. A 2024 study by Blaise Munyampirwa and colleagues, titled "Down with the Hierarchy: The 'H' in HNSW Stands for 'Hubs'", reported that on high-dimensional datasets the flat graph achieved essentially the same latency and recall as the hierarchical one while using less memory. Their explanation draws on the hubness phenomenon described in Chapter 2: in high dimensions, a small set of hub nodes is well connected to large parts of the graph, and these hubs act as a natural highway, so greedy search from almost any starting point reaches them quickly and then descends into the right region. The hierarchy does still help in low dimensions, where hubness is weak, and in pathological cases where the starting point lies far from the query's region. Because the upper layers are cheap, containing only a small fraction of nodes, there is little reason to remove them in practice. But the finding is a useful corrective to the idea that the hierarchy is what makes graph search work. The decisive ingredients are the diversity-preserving neighbour selection and sufficient edges per node. The operational problems HNSW's search performance is excellent. Its operational characteristics are more demanding, and these are what engineers running it in production tend to spend their time on. Memory and random access. HNSW is designed for main memory. Every hop in a search jumps to a node whose vector and neighbour list are at an essentially random address. A search with a few hundred distance computations incurs a few hundred cache misses, each costing on the order of a hundred nanoseconds. At a few hundred hops, that alone accounts for tens of microseconds. Implementations hide some of this latency by issuing prefetch instructions for the next neighbours' vectors while computing the current distance, and well-tuned code can process millions of distance computations per second per core. But the random access pattern is why HNSW is a poor fit for SSDs, where each random read costs tens of microseconds rather than a hundred nanoseconds, and for GPUs, which prefer large regular memory accesses. Deletion. HNSW was designed for insertion. Removing a node from a graph is difficult because other nodes depend on it for connectivity: it may be the only path from one region to another. The common approach, used in hnswlib, the reference library by Malkov, is to mark deleted nodes with a tombstone. Searches traverse them but exclude them from results. This preserves connectivity but wastes work and memory. As deletions accumulate, a growing fraction of each search is spent on dead nodes, and recall measured against live data can fall. Some implementations allow the slot of a deleted node to be reused for a new insertion, repairing the neighbour lists of affected nodes. Others periodically rebuild the graph. Graph repair after deletion has been studied directly. FreshDiskANN, from Microsoft in 2021, proposed a consolidation procedure that reconnects the in-neighbours of deleted nodes to the deleted nodes' out-neighbours, with pruning. But for many production HNSW deployments, the practical answer remains periodic rebuilds, and the deletion rate is a key input to capacity planning. Unreachable nodes. Even without deletions, pruning during construction can leave some nodes with no incoming edges from the rest of the graph, or reachable only by long detours. Such nodes can never be returned by a search, regardless of ef. The fraction is typically small but not zero, and it grows with aggressive pruning, low M, and frequent updates. Detection requires a reachability analysis over the graph, which some systems perform as part of maintenance. Segment merging. Systems built on log-structured storage, such as Lucene, write data in immutable segments, each with its own HNSW graph, and periodically merge small segments into larger ones. A query must search every segment and merge the results, so many small segments are slow. Merging requires rebuilding a graph over the combined vectors, which is expensive. The interaction of HNSW build cost with segment merging is one of the main performance considerations in Lucene-based vector search, and Lucene has added optimizations that reuse the graph of the largest segment as a starting point during merge rather than building from scratch. Determinism. HNSW construction depends on random level assignment and, in parallel builds, on the order in which concurrent insertions complete. Two builds of the same data can produce different graphs with slightly different recall. This is harmless for most uses but surprises teams who expect identical results from repeated builds, for example in regression testing. Graphs beyond HNSW HNSW is the most deployed graph index, but not the only significant one. NSG, mentioned above, builds a single-layer graph by first constructing an approximate k-nearest-neighbour graph and then refining it, with a fixed entry point at the approximate centre of the dataset. It achieves smaller graphs than HNSW at comparable performance and was used in production at Alibaba's Taobao. Vamana, from DiskANN, builds a single-layer graph with the alpha-relaxed pruning rule and is designed so that searches need few hops, making it suitable for storage where each hop is expensive. CAGRA, from NVIDIA researchers, builds a fixed-degree graph optimized for GPU search. The common thread is that all modern graph indexes use some form of diversity-preserving pruning, and they differ chiefly in how they balance graph size, number of hops, and construction cost against the memory hierarchy they target. Graph indexes in main memory, then, give the best recall for the least computation, at the price of memory, random access, and awkward updates. The question for billion-scale systems is what to do when the collection does not fit in memory at all, or fits only at a cost no one wants to pay. Chapter 6. Beyond Main Memory: Solid-State Drives and Graphics Processors An in-memory HNSW index over a billion 768-dimensional float32 vectors needs roughly 3.1 terabytes for vectors and another hundred-odd gigabytes for the graph. That can be bought. A handful of large-memory servers will hold it, or a few dozen ordinary ones. But memory is the most expensive tier of storage per byte in a data centre, and a billion vectors is no longer an unusual collection. A system that needs many billions, or many separate billion-scale indexes for different customers, cannot assume that everything lives in DRAM. Two developments made billion-scale search practical without proportionally large memory budgets. The first was learning how to search effectively from solid-state drives, which offer ten or more times the capacity per dollar of DRAM and, crucially, can serve large numbers of random reads in parallel. The second was the adoption of graphics processors, which have far less memory than a server's DRAM but far more bandwidth and parallelism, and which changed the economics of both index construction and high-throughput querying. Why naive disk search fails Take an HNSW index and put it on an SSD. Each hop in a search reads one node: its vector and its neighbour list. On DRAM a hop costs around a hundred nanoseconds; on an NVMe SSD a random read costs tens of microseconds to around a hundred, depending on the device and load. A search with three hundred sequential hops would take tens of milliseconds, a hundred times slower than in memory. Moreover, each 3,072-byte vector read pulls in a full 4-kilobyte page from the device, and most of the neighbour vectors read are not useful. The problem is the combination of two things: the number of sequential round trips, since each hop depends on the result of the previous one, and the amount of data read per round trip. A disk-friendly index must reduce both. It should reach the answer in few hops, it should issue many reads in parallel within each hop rather than one at a time, and it should make every byte read from the device useful. DiskANN DiskANN, introduced by Suhas Jayaram Subramanya and colleagues at Microsoft Research India at NeurIPS in 2019, was the first system to show convincingly that billion-scale search with high recall and low-millisecond latency could be served from a single machine with modest memory and an SSD. Its design addresses each of the problems above. The graph is Vamana, a single-layer graph built with the diversity-preserving pruning rule described in Chapter 5, relaxed by a parameter alpha slightly greater than one. The relaxation retains some edges that strict pruning would discard: a candidate is now removed only if an existing neighbour is substantially closer to it, by a factor of alpha, than the node itself. The retained longer edges let the search make larger jumps, reducing the number of hops needed to reach the query's neighbourhood. Vamana graphs use a higher maximum degree than typical HNSW layer-zero graphs, commonly in the range of 64 to 128, which further shortens paths. The layout puts each node's full-precision vector and its neighbour list together in a contiguous block on the SSD, sized to fit in one or a few sectors. One read brings back both the vector, for exact distance computation, and the list of neighbours to explore next. Meanwhile, compressed product-quantization codes for every vector are held in DRAM. These are small, perhaps 32 to 64 bytes each, so a billion of them fit in a few tens of gigabytes. During search, the algorithm uses these in-memory codes to estimate distances to neighbours and decide which nodes to visit next, without touching the SSD. Only the nodes actually chosen for expansion are read from disk. The search uses a beam: at each round, instead of expanding one node, it expands the W most promising unexpanded candidates simultaneously, issuing W SSD reads in parallel. Modern NVMe devices achieve their best throughput with many requests outstanding, so reading four or eight nodes at once costs little more latency than reading one. A beam width of a handful cuts the number of sequential rounds proportionally. Re-ranking comes for free. Every node read from the SSD brings its full-precision vector with it, so exact distances to all expanded nodes are available. The final results are ranked by these exact distances, not the compressed ones, which recovers the precision lost by navigating with PQ codes. Finally, a cache holds the nodes within a few hops of the entry point in DRAM, since every search passes through them. The paper reported that on the SIFT1B dataset, a billion 128-dimensional vectors, DiskANN served queries at high recall with mean latency of a few milliseconds from a workstation with 64 gigabytes of RAM and an inexpensive SSD. That configuration would have required several terabytes of DRAM for an equivalent in-memory graph. The result changed the economics of billion-scale search and has been the reference point for disk-based methods since. Building the index presented its own challenge: constructing a graph over a billion points requires holding the graph in memory, which defeats the purpose. DiskANN partitions the data into overlapping clusters with k-means, assigning each point to two or more nearby clusters, builds a Vamana graph on each cluster in memory, and merges the graphs, using the overlap to stitch them together. The result is a single graph built with memory proportional to one cluster rather than the whole collection. FreshDiskANN, published in 2021, extended the design to support insertions and deletions. New vectors go into a small in-memory graph, deletions are recorded in a list, and a background process periodically merges these changes into the SSD-resident graph, consolidating around deleted nodes as described in Chapter 5. Filtered-DiskANN, published at the Web Conference in 2023, extended it to queries with label constraints, discussed in Chapter 7. The open-source DiskANN codebase and its descendants are used in Microsoft's own services and have been integrated into other databases, including as an index type in Milvus and as the basis of vector indexing in some relational database products. SPANN SPANN, published by Qi Chen and colleagues at Microsoft at NeurIPS in 2021, takes the opposite architectural approach. Rather than a graph on disk with compressed codes in memory, it keeps a partition in memory and posting lists on disk. It is, in essence, an IVF index re-engineered for SSDs. SPANN's centroids are held in memory and indexed by a graph so that the nearest centroids to a query can be found quickly. There are many of them, a significant fraction of the number of vectors, so that each posting list is short. Each posting list, holding the full-precision vectors of its cluster, is stored contiguously on the SSD. A query finds its nearest centroids in memory, reads the corresponding posting lists from disk in parallel, and computes exact distances. The design's success depends on solving the problems with IVF described in Chapter 3. To prevent oversized posting lists, which become slow reads, SPANN uses hierarchical balanced clustering to keep lists of roughly equal size. To handle boundary effects, it assigns vectors near cluster boundaries to multiple posting lists, with a rule that limits duplication. And to avoid reading lists that are unlikely to contain results, it prunes the list of probed centroids dynamically per query: if a centroid is much farther from the query than the nearest centroid, its list is skipped even if it would otherwise be within the probe count. The SPANN paper reported higher recall at lower latency than DiskANN at comparable memory budgets on the billion-scale datasets it tested. Comparisons of this kind depend heavily on configuration, and both designs have been improved since, so the safe conclusion is that both approaches are competitive and suit different workloads. SPANN's access pattern, reading whole lists sequentially, suits SSDs well and makes updates simpler. SPFresh, a follow-up published at SOSP in 2023, supports in-place updates by splitting posting lists that grow too large and reassigning nearby vectors locally, avoiding global rebuilds. Graphics processors Graphics processors approach the problem from the other end of the memory hierarchy. A data-centre GPU has much less memory than a server, from tens of gigabytes to around two hundred on recent parts, but that memory delivers bandwidth in the terabytes per second, several times what a server processor can reach, and the device runs tens of thousands of threads concurrently. The 2017 Faiss GPU paper by Jeff Johnson, Matthijs Douze, and Hervé Jégou established the core techniques: highly optimized brute-force search using matrix multiplication; IVF with product quantization in which list scanning is parallelized across thousands of threads; and an efficient on-GPU k-selection algorithm for picking the top results from large sets of candidate distances, a step that is surprisingly costly when done naively. With IVF-PQ codes, a billion vectors at 32 to 64 bytes each fit across a small number of GPUs, and the paper demonstrated billion-scale k-nearest-neighbour graph construction in a fraction of the time CPU methods needed. Graph search on GPUs is harder, because it is inherently sequential and irregular. Each query's walk depends on its previous step, and different queries diverge, which wastes the GPU's lock-step parallelism. CAGRA, introduced by Hiroyuki Ootomo and colleagues at NVIDIA and published in 2024, designed a graph specifically for the GPU. It builds a fixed-degree graph, starting from an approximate k-nearest-neighbour graph and then optimizing it by pruning redundant edges and adding reverse edges, so that every node has exactly the same number of neighbours, which suits regular memory access. Its search processes many candidate expansions per query in parallel, using a whole group of threads per query, and uses a small hash table for visited nodes in fast on-chip memory. CAGRA reported high throughput at high recall for large batches, and competitive latency even for small batches. The more lasting impact of GPUs may be on construction rather than search. Building a high-quality graph is far more expensive than querying it, and GPU construction is often an order of magnitude or more faster than CPU construction. Because CAGRA graphs can be converted into an HNSW-compatible format, a common pattern has emerged: build the graph on GPUs, then serve it on CPUs. NVIDIA's cuVS library, which grew out of the RAPIDS RAFT project, packages CAGRA, IVF-PQ, and related algorithms, and has been integrated as a backend in Faiss and in several vector databases. GPUs are not a universal answer. Their memory is limited and expensive, so GPU-resident indexes rely on heavy compression or on many devices. They achieve their best efficiency with large query batches, which suits offline jobs and very high-traffic services but not latency-critical services with modest traffic, where a GPU may sit mostly idle. And moving data between host memory and GPU memory over the interconnect is slow relative to on-device bandwidth, so indexes that spill out of GPU memory lose much of their advantage. The cold tier A further tier has become important as vector search moved into multi-tenant cloud services: object storage. Services that host many indexes for many customers, most of which are queried rarely, cannot afford to keep every index in memory or even on local SSD. A design pattern has emerged in which index files, typically partitioned in an IVF-like fashion, are stored in an object store, and caches on local SSD and in memory hold recently used portions. A query against a warm index is served from cache with latency in milliseconds; a query against a cold index must fetch data from object storage first and may take hundreds of milliseconds. Several commercial and open-source systems use variants of this architecture, and in 2025 Amazon announced native vector storage and querying within its S3 object store, aimed at large, infrequently queried collections where cost matters more than latency. The cold tier makes explicit something that is true of all the designs in this chapter: latency is a function of where the data lives, and the right design depends on how often each part of the data is touched. A search service whose traffic is dominated by a few popular indexes can keep those in memory and the rest on disk or in object storage, paying memory prices only for what is hot. Choosing a tier Table 3 summarizes where each major index design keeps its data and the latency regime and update behaviour that follows. The latency regimes are qualitative and assume a single-shard search at high recall on contemporary hardware; actual figures depend heavily on data, configuration, and recall target. Table 3. Index designs by placement in the memory hierarchy. Design In fast memory In slower storage Latency regime Updates HNSW, full precision Vectors and graph Nothing Sub-millisecond Inserts easy; deletes awkward HNSW with int8 or binary Compressed vectors and graph Full vectors, for re-ranking Sub-millisecond to low milliseconds As above IVF-PQ Centroids and codes Optional full vectors Sub-millisecond to low milliseconds Simple; periodic retrain DiskANN PQ codes, hot-node cache Graph and full vectors on SSD Low milliseconds Supported via merge (FreshDiskANN) SPANN Centroids and centroid graph Posting lists on SSD Low milliseconds Supported via local splits (SPFresh) GPU IVF-PQ or CAGRA Codes or graph in GPU memory Host memory or none Best in batches Mostly rebuild Object-store tier Cache of hot partitions Index files in object storage Milliseconds warm, far slower cold Append and compact The pattern in the table is the one this book has been building toward. Each design moves the boundary between what is kept close and what is kept far, and pays for that movement in either recall, latency, or update complexity. None dominates. The right choice depends on collection size, query rate, latency requirement, update rate, and budget, which is the subject of Chapter 10. Before that, there is a complication that every real system must face and that pure nearest-neighbour benchmarks ignore. Users rarely ask for "the nearest vectors". They ask for the nearest vectors that are in stock, in their language, written after last March, and visible to their account. Chapter 7. The Real Query: Filters, Hybrid Retrieval, and Re-ranking Benchmarks ask a clean question: given a query vector, return the k nearest stored vectors. Production systems almost never ask it. A shopper wants similar products that are in stock, under a price, and shippable to their country. An enterprise assistant must retrieve passages only from documents the user is permitted to read. A news search wants semantically relevant articles from the past week. A code search wants functions in a particular repository and language. Each of these is a nearest-neighbour query constrained by a predicate on metadata, and the constraint interacts with the index in ways that can quietly destroy recall. Beyond filters, real retrieval combines signals. Dense embeddings capture meaning but are weak at exact terms, rare identifiers, and names. Keyword search is the reverse. The best systems run both and fuse the results, then often apply a slower, more accurate model to re-rank a short list. This chapter covers how these pieces are built and how they interact with the indexes described so far. Why filters are hard The difficulty of filtered search depends on selectivity: the fraction of the collection that satisfies the predicate. Consider the two extremes. If the filter is very permissive, say it excludes only one per cent of vectors, the obvious approach works. Search the index normally, retrieve somewhat more than k results, and discard the ones that fail the predicate. This is called post-filtering. If ninety-nine per cent of vectors pass, retrieving k plus a small margin yields k valid results almost always. If the filter is very restrictive, say it matches only a thousand vectors out of a hundred million, the obvious approach also works, but it is a different one. Find the thousand matching vectors using an ordinary metadata index, then compute exact distances to all of them by brute force. This is called pre-filtering. A brute-force scan of a thousand vectors costs microseconds, and it is exact. The hard cases lie in between. Suppose the filter matches one per cent of a hundred million vectors: a million candidates. Brute force over a million vectors is slow, too slow for a sub-millisecond target. Post-filtering is also a problem: if one per cent of vectors pass, retrieving k valid results requires retrieving roughly a hundred times k from the unfiltered index, and the index's recall at such large result sizes, and its cost, become unpredictable. Worse, if the filter is correlated with the query, for instance if the user searches for winter coats but filters for products in a summer collection, the nearest neighbours to the query may almost all fail the filter, and the passing vectors may lie far away in the graph. Filtering inside graph traversal The natural compromise for graph indexes is to apply the filter during traversal: walk the graph as usual, but only admit vectors that pass the predicate into the result set. Non-passing nodes can still be traversed, so that they serve as stepping stones, but they never appear in the results. This works well at moderate selectivity, and it is the default in many systems. At low selectivity it degrades in two ways. First, the search must traverse many non-passing nodes for each passing one it finds, so its cost rises roughly in inverse proportion to selectivity. Second, and more seriously, if the implementation refuses to traverse non-passing nodes at all, which some do to save work, the graph restricted to passing nodes may fall apart into disconnected fragments. A search that starts in one fragment can never reach a passing vector in another, and recall collapses without any error being reported. Several techniques address this. The first is a query planner that chooses a strategy by estimated selectivity. Before searching, the system estimates how many vectors pass the filter, using statistics from its metadata indexes. If the count is small, it uses pre-filtering with brute force; if large, it uses in-traversal filtering; in between, it may use a hybrid. Lucene does something of this kind: when the number of documents matching the filter is small enough that exact search would visit fewer vectors than the approximate search is likely to, it switches to exact search. Many vector databases implement similar thresholds, sometimes exposed as configuration. The second is to make the graph robust to filtering. ACORN, published by Liana Patel and colleagues at SIGMOD in 2024, builds a denser HNSW-like graph than usual, with more edges per node and with the standard pruning relaxed, and then, during filtered search, expands not just a node's direct neighbours but its neighbours' neighbours, keeping only those that pass the predicate. The effect is to approximate, on the fly, a well-connected graph over just the passing vectors, for any predicate, without knowing the predicates in advance. The cost is a larger graph and more work per hop. ACORN has been adopted in several systems, including Weaviate, which added it as a filtering strategy in 2024. The third is to build the filter into the graph when the set of possible predicates is known. Filtered-DiskANN, from Microsoft at the Web Conference in 2023, handles queries whose filters are labels, such as categories or tags, by building a graph in which the pruning rule ensures connectivity within each label's subgraph. Each label gets its own entry point, and the search for a label-filtered query starts there and traverses only nodes carrying that label, with the construction guaranteeing that this subgraph is navigable. Qdrant takes a related approach for payload fields that are indexed: it adds extra edges to the graph within groups of points sharing a field value, so that filtered traversals stay connected. The fourth, and the most robust when it applies, is physical partitioning. If a filter is used on almost every query and has a manageable number of values, such as a tenant identifier in a multi-tenant service, the simplest solution is to build a separate index per value. A query for one tenant searches only that tenant's index. No filtering is needed during traversal, and recall is unaffected. The costs are many small indexes, each with fixed overhead, and the inability to search across partitions efficiently. Multi-tenant vector services frequently use this approach for their tenancy boundary, with in-traversal filtering for other attributes. Table 4 summarizes the main strategies. Table 4. Strategies for filtered vector search. Strategy Works best at Recall behaviour Main cost Example Post-filtering High selectivity (most items pass) Falls as filter tightens Oversampling, unpredictable Simple vector stores Pre-filtering with brute force Very low selectivity (few pass) Exact Linear in matching items Query planners at low match counts In-traversal filtering Moderate selectivity Degrades if graph fragments More hops per result Default in many graph indexes Filter-robust graph Wide range, arbitrary predicates Stable across selectivity Larger graph, two-hop expansion ACORN Label-aware graph Known categorical labels Stable per label Build complexity Filtered-DiskANN Partition per value Ubiquitous low-cardinality filter Unaffected Many small indexes Per-tenant indexes IVF indexes handle filtering somewhat differently. Because a query scans whole lists, the filter can be applied during the scan, with no connectivity problem. The difficulty becomes the number of lists that must be probed to find k passing vectors, which again rises as selectivity falls. Some systems store per-list summaries of metadata so that lists containing no passing vectors can be skipped entirely. Range filters, such as date windows or price bands, pose a particular challenge because they are not a fixed set of labels. Research on range-filtered nearest-neighbour search has produced specialized structures, typically organizing vectors by the filtered attribute in a tree and building graphs at each tree level, but in production the most common approach remains a selectivity-aware planner that chooses between brute force and in-traversal filtering. Hybrid retrieval: combining dense and sparse The second departure from pure nearest-neighbour search is the combination of semantic and lexical signals. Chapter 1 described the strengths and weaknesses of each. Dense retrieval handles paraphrase and conceptual similarity; lexical retrieval handles exact terms, identifiers, rare words, and names. A query for an error code, a product SKU, or an uncommon surname is often best served by keyword matching, while a query phrased in natural language benefits from embeddings. Most real query streams contain both kinds. The established lexical ranking function is BM25, developed by Stephen Robertson, Karen Spärck Jones, and colleagues in the probabilistic retrieval framework during the 1980s and 1990s. BM25 scores a document by summing, over query terms, a weight that grows with the term's frequency in the document, saturating so that repeated mentions have diminishing effect, and that grows with the term's rarity across the collection, normalized by document length. It is served from an inverted index mapping terms to the documents that contain them, with mature algorithms such as WAND and block-max WAND for skipping documents that cannot make the top k. A hybrid system runs both a dense vector search and a BM25 search, each returning a ranked list, and combines them. The combination step is called fusion, and two families of method dominate. Score-based fusion normalizes each system's scores to a common range, for instance by min-max scaling within the result list, and takes a weighted sum. It is intuitive but fragile. BM25 scores and cosine similarities have different distributions that vary by query, so a fixed weight that works for one query type may be wrong for another, and min-max normalization is sensitive to outliers in the list. Rank-based fusion ignores scores and uses only positions. Reciprocal rank fusion, introduced by Gordon Cormack, Charles Clarke, and Stefan Büttcher at SIGIR in 2009, assigns each document a score equal to the sum, over the ranked lists in which it appears, of one divided by a constant plus its rank. The constant, sixty in the original paper, damps the influence of the top positions so that a document appearing reasonably high in both lists can outrank one at the top of only one. Reciprocal rank fusion requires no tuning and no score calibration, and it has become the default fusion method in several search engines and vector databases. Its weakness is that it discards information: a document that one system scores as an overwhelming match and another ignores is treated the same as a marginal one. Neither fusion method is universally superior. The right weighting depends on the queries, and where an evaluation set exists, tuning a weighted combination can outperform reciprocal rank fusion. Where none exists, reciprocal rank fusion is a robust default. Learned sparse representations Between classical keyword search and dense embeddings lies a third option: learned sparse retrieval. Models in this family, of which SPLADE, introduced by Thibault Formal and colleagues in 2021, is the best known, use a transformer to produce a sparse vector over the vocabulary for each document and query. Unlike BM25, the weights are learned, and the model can activate terms that do not appear in the text, expanding "car" to include "automobile" and "vehicle". The resulting vectors are sparse enough to serve from an inverted index using the same machinery as BM25, which makes them efficient and interpretable, while capturing some of the semantic generalization of dense models. From the index's point of view, learned sparse vectors pose a distinct nearest-neighbour problem: maximum inner product search over very high-dimensional, very sparse vectors. Inverted-index algorithms handle it, and specialized approximate methods for sparse inner product search have been developed; the 2023 Big-ANN benchmark included a sparse track for this reason. Several vector databases now accept sparse vectors alongside dense ones in the same collection, so that hybrid search can be expressed as a single query. Re-ranking Any first-stage retriever, dense, sparse, or hybrid, is a compromise between quality and speed. Its job is to produce a candidate list that contains the relevant items, not to order them perfectly. A second stage then re-ranks the candidates with a more expensive model. The most common re-ranker is a cross-encoder: a transformer that reads the query and a candidate passage together and outputs a relevance score. Because it attends jointly over both texts, it can detect negation, check whether the passage actually answers the question, and weigh specific details, all things a single-vector embedding cannot do. Cross-encoders are far too slow to apply to a whole collection, since each query-passage pair requires a full model forward pass, but applying one to fifty or a hundred candidates is feasible within interactive latency budgets on suitable hardware. Late-interaction models such as ColBERT, introduced by Omar Khattab and Matei Zaharia at SIGIR in 2020, sit between single-vector retrieval and cross-encoders. ColBERT keeps one embedding per token for every document, and scores a query against a document by matching each query token embedding to its most similar document token embedding and summing these maxima. This captures fine-grained matching while still allowing documents to be encoded in advance. The cost is storage: a passage of a hundred tokens produces a hundred vectors rather than one, so a collection of a hundred million passages becomes ten billion vectors. Making late interaction practical at scale required its own index engineering. PLAID, a 2022 follow-up, clusters token embeddings, stores compressed residuals, and prunes candidates by centroid scores before full scoring, an application of the IVF and quantization ideas from Chapters 3 and 4 to a new problem. The existence of re-ranking changes how first-stage recall should be judged. If a cross-encoder will re-rank the top hundred candidates, what matters is whether the relevant items appear anywhere in that hundred, not their exact order. Index recall at a hundred becomes the relevant metric, which is usually much easier to achieve at a given cost than recall at ten. Teams that tune their vector index for recall at ten while feeding a hundred candidates to a re-ranker may be paying for precision they discard. Diversity, grouping, and thresholds Three further departures from pure nearest-neighbour search come up often enough to mention. Diversity. The nearest neighbours of a query are often near-duplicates of one another: five chunks from the same document, or ten nearly identical product listings. Returning all of them wastes the result list. Maximal marginal relevance, introduced by Jaime Carbonell and Jade Goldstein in 1998, re-ranks candidates by balancing relevance to the query against similarity to results already selected, and it remains the standard technique. It operates on a candidate list after retrieval, which means the first stage must retrieve more candidates than will finally be shown. Grouping. In retrieval-augmented generation, documents are typically split into chunks, each embedded separately. A query may match many chunks of the same document. Applications often want the top documents rather than the top chunks, which requires grouping results by document and taking the best chunk score per group. Like diversity, this requires retrieving more than k chunks to produce k documents, and the required oversampling depends on how clustered the matches are. Thresholds. Some applications want all items within a similarity threshold rather than a fixed k: every near-duplicate of an image, or every passage similar enough to be considered a match. This is range search. Graph and IVF indexes can support it by continuing the search until candidates exceed the threshold, but their recall for range queries is less well characterized than for k-nearest-neighbour queries, and compressed distances near the threshold are unreliable. Re-ranking with exact distances before applying the threshold is advisable. Each of these features adds a requirement on the first stage: retrieve enough candidates, of sufficient quality, for the downstream logic to work. The common lesson is that the parameters of the vector index cannot be chosen in isolation. They depend on what happens to the results afterwards. The next chapter turns from the query to the system that answers it: how to spread an index across many machines, keep it current as data changes, and keep its slowest queries within bounds. Chapter 8. Systems at Billion Scale: Sharding, Freshness, and Tail Latency An index is an algorithm and a data structure. A vector search system is an index plus everything needed to keep it serving: distribution across machines, replication for availability, an ingestion pipeline, a strategy for updates and deletions, a plan for changing the embedding model, monitoring, and capacity management. At small scale most of these concerns are trivial. At billion scale, they dominate engineering effort, and decisions made at the system level can matter more for latency and recall than the choice between HNSW and IVF. Sharding When a collection outgrows one machine, it must be divided into shards, each held by a different server. There are two basic ways to assign vectors to shards, and the choice shapes the whole system. The first is random or hash-based sharding: assign each vector to a shard by hashing its identifier. Each shard holds a statistically representative sample of the collection and builds its own independent index. A query is sent to every shard, each returns its local top k, and a coordinator merges the shard results into a global top k. This pattern is called scatter-gather. Random sharding has important virtues. Load is naturally balanced, since every shard has a similar share of data and receives every query. Adding capacity is simple. And the merge is exact in a useful sense: if each shard returns its true local top k, the global top k is guaranteed to be among the union, so the merge introduces no recall loss beyond that of the shard indexes themselves. The cost is that every query touches every shard. With a hundred shards, every query becomes a hundred sub-queries, and total work per query grows with the number of shards. Each shard's index is smaller than a single global index would be, so each sub-query is somewhat cheaper, but graph search cost grows only slowly with collection size, so a hundred small graphs cost much more in aggregate than one big one would. The second is content-based sharding: assign vectors to shards by their position in the embedding space, typically using a coarse k-means partition, so that each shard holds a set of nearby clusters. A query is routed only to the shards whose regions are nearest to it, much as an IVF index probes only the nearest lists. This is the IVF idea applied at the level of machines. Content-based sharding reduces work per query, because most shards are not consulted. Its costs are those of IVF, magnified. Queries near shard boundaries need several shards, and recall depends on how many are probed. Load is uneven: shards holding popular regions of the space receive more queries and may also hold more data, so hot shards appear and must be split or replicated more heavily. Rebalancing as data grows requires moving clusters between machines. And if the data distribution shifts, the partition becomes stale. Large systems often combine the two. A coarse partition routes queries to a subset of shard groups, and within each group data is distributed randomly. Or a system may use random sharding for its primary path and maintain content-based routing as an optimization that is bypassed when a query lies near many boundaries. The choice depends on query rate, collection size, and how much variance in latency can be tolerated. One subtlety of scatter-gather with approximate shards deserves mention. Each shard runs an approximate search, so each may miss some of its local true neighbours. If each shard independently has recall of ninety-five per cent at k, the global result also has about ninety-five per cent recall, since the misses are spread across shards. But if the coordinator asks each shard for exactly k results and some shards hold none of the global top k, their returned results are wasted, while shards holding several of the global top k needed to be more accurate than average. Asking each shard for somewhat fewer than k results, when shards are numerous and data is random, reduces work without changing recall much, because the probability that any one shard holds many of the global top k is small. Conversely, with content-based sharding, the nearest shard may hold almost all of the global top k and must be searched with high recall. The tail at scale Scatter-gather has a well-known statistical problem, described by Jeffrey Dean and Luiz André Barroso in a 2013 article in Communications of the ACM titled "The Tail at Scale". If a query must wait for responses from a hundred shards, its latency is the latency of the slowest of the hundred. Even if each shard answers within one millisecond ninety-nine per cent of the time, the probability that all hundred do so is only about thirty-seven per cent. The other sixty-three per cent of queries are delayed by at least one slow shard. Occasional slowness from garbage collection, background compaction, a noisy neighbour on shared hardware, or a network retransmission becomes the common case at the system level. This is why the phrase "sub-millisecond queries across billions of embeddings" needs careful reading. A single shard can answer in a fraction of a millisecond. The system as a whole, after network round trips, fan-out, and merge, typically responds in a few milliseconds at the median and more at the high percentiles. Getting close to the per-shard latency at the system level requires deliberate engineering against the tail. The techniques are well established in distributed systems generally. Hedged requests send a duplicate sub-query to a second replica of a shard if the first has not responded within a short delay, typically set near the ninety-fifth percentile latency, and use whichever response arrives first; this adds a few per cent of load and removes much of the tail. Tied requests send to two replicas at once and cancel the slower. Partial results allow the coordinator to return after a deadline with results from the shards that have answered, accepting a small and measurable recall loss for the slowest queries rather than an unbounded delay. Isolation of background work, such as running index builds and compactions on separate machines or in strictly bounded time slices, removes a major source of variance. Index design contributes too. Graph search time varies by query, because some queries land in hard regions of the graph and need more hops. IVF search time varies with the length of the probed lists. Early-termination techniques, which stop a search once the result set has stabilized rather than after a fixed amount of work, reduce average cost but can increase variance. For a tail-sensitive service, an index whose cost per query is predictable may be preferable to one that is faster on average. Replication Shards are replicated for two reasons: availability, so that the loss of a server does not lose data or block queries, and throughput, so that query load can be spread across replicas. The number of replicas is usually set by whichever requirement is larger. For a high-traffic service, throughput dominates, and a shard may have many replicas, each a full copy of the index. Because each replica is a full copy, replication multiplies memory cost. A billion-vector collection at three terabytes in memory, replicated three times, needs nine terabytes. This is a strong incentive for compression and for disk-based indexes: an index that fits in a tenth of the memory reduces the cost of every replica. Replicas need not be identical. A pattern seen in large deployments uses different index configurations for different purposes: a highly compressed index serving the bulk of traffic at moderate recall, and a less compressed one, or one with full-precision re-ranking data, serving requests that need higher recall. Separating storage from compute, so that replicas load index files from a shared store rather than each building their own, simplifies this and makes it fast to add replicas when load rises. Milvus, among others, uses such an architecture, with stateless query nodes loading index segments from object storage. Ingestion and the cost of embedding It is easy to focus on the index and forget that every vector must first be computed. Embedding a document requires a forward pass through a neural network. For a large transformer model, this is expensive, often far more expensive per item than inserting the resulting vector into an index. Embedding a billion passages is a substantial GPU job, measured in thousands of GPU-hours for typical models, and the exact cost depends on model size and passage length. This has three consequences for system design. First, ingestion throughput is frequently limited by embedding, not indexing, so the ingestion pipeline needs its own capacity planning and its own accelerators. Second, re-embedding the whole collection, which is required whenever the embedding model changes, is a major operation, not a routine one. Third, it is worth caching embeddings and storing them durably, separately from the index, so that indexes can be rebuilt without recomputing embeddings. The pipeline itself typically has stages: change capture from the source of truth, chunking of documents into passages, embedding, writing vectors and metadata to durable storage, and indexing. Decoupling these stages with queues allows each to scale independently and absorbs bursts. It also introduces latency between a change in the source and its visibility in search, which brings us to freshness. Freshness and updates A search system over changing data must make new items searchable promptly, make deleted items disappear, and reflect modifications. The index structures from earlier chapters handle these operations unevenly. IVF handles insertions and deletions cheaply. HNSW handles insertions at moderate cost and deletions poorly. Disk-based graphs need batched merges. Learned components, such as IVF centroids and PQ codebooks, become stale as the data distribution changes. The dominant architectural answer, used in some form by most vector databases, borrows from log-structured merge trees in key-value stores. New vectors are written first to a small mutable buffer, which is searched by brute force or with a small, cheaply updated index. When the buffer fills, it is sealed into an immutable segment and an index is built for it in the background. Queries search all segments and the buffer, and merge results. Over time, small segments are compacted into larger ones, rebuilding their indexes; compaction is also when deleted vectors are physically removed and when learned components can be retrained. Deletions in this architecture are recorded as tombstones, typically a bitset per segment marking deleted positions, and applied as a filter during search. This is a form of in-traversal filtering, and it inherits the problems described in Chapter 7: if a large fraction of a segment is deleted, searches waste effort on dead vectors and graph connectivity among live ones may suffer. Compaction policies therefore consider the deleted fraction as well as segment size, compacting segments where deletions exceed a threshold. Updates to an existing vector are implemented as a delete followed by an insert. Updates to metadata only, such as a price change, need not touch the vector index at all if metadata is stored separately, but they do affect filtered search, and the metadata index must be updated consistently with the vectors. The segment architecture introduces a trade-off between freshness and query efficiency. Small, frequent segments make new data visible quickly but multiply the number of indexes each query must search. Large, infrequent segments are efficient to query but delay visibility. The mutable buffer, searched by brute force, bounds the delay, but brute force over a large buffer is slow. Systems tune buffer size, segment size, and compaction frequency together, and the right settings depend on ingestion rate and freshness requirements. Consistency guarantees vary. Many vector databases offer eventual consistency by default: a write is acknowledged once durable but becomes visible to searches after a short delay. Some offer stronger options, such as read-your-writes within a session or bounded staleness, at some cost in latency. Applications should establish what guarantee they need. A recommendation feed can tolerate seconds of staleness; a compliance system that deletes data on request may need confirmation that the data is no longer retrievable, which requires understanding when tombstones take effect across all replicas and caches. Changing the embedding model Embedding models improve quickly, and teams regularly want to upgrade. An upgrade is more disruptive than it appears, because vectors from different models are not comparable. Each model defines its own space, and a query embedded with a new model cannot be meaningfully compared with documents embedded with an old one. The distances are simply meaningless. An upgrade therefore requires re-embedding the entire collection with the new model, building a new index, and switching queries to the new model at the same moment the new index goes live. During the transition, both indexes must exist. For a billion-vector collection, this means temporarily doubling storage and running a large embedding job, which may take days. A careful upgrade runs the new index in shadow mode, receiving copies of production queries without serving results, so that its latency and quality can be compared before the switch. Rollback requires keeping the old index until the new one is proven. Some research has explored aligning embedding spaces across model versions, learning a transformation that maps old vectors into the new space, or training new models to be backward compatible with old ones so that old document vectors can be queried with new query vectors. These approaches can reduce the cost of upgrades but typically sacrifice some of the new model's quality, and full re-embedding remains the standard practice. The practical implication is that the embedding model is part of the schema. Every stored vector should be tagged with the model and version that produced it, and the system should refuse to compare vectors from different versions. Mixing them, which can happen silently if an ingestion pipeline is upgraded before the index is rebuilt, produces degraded results with no errors. Observability The final system concern is knowing whether the system is working. Latency, throughput, error rates, and resource utilization are monitored as for any service. What is specific to vector search is that its most important failure mode, loss of recall, produces no errors at all. The standard technique for monitoring recall in production is to sample a small fraction of live queries and run them, asynchronously and off the critical path, against an exact brute-force search over the same data, or over a sample of it. Comparing the production results with the exact results gives an ongoing estimate of recall. Tracking it over time reveals degradation from accumulating deletions, data drift, configuration changes, or software regressions. Brute force over a billion vectors is expensive even for a small sample of queries, so it is often run on GPUs or against a random subsample of the collection, with recall estimated statistically. Several further signals are worth tracking. The distribution of distances to the top result, by query, shifts when the data or query distribution changes, and a drop may indicate that queries are increasingly out of distribution. The fraction of filtered queries that return fewer than k results indicates filter-selectivity problems. The ratio of deleted to live vectors per segment predicts recall loss from tombstones. List-length or node-degree distributions reveal imbalance. None of this is exotic. It is the vector-search version of the observability that any serious data system requires. But it is frequently missing, because recall does not appear in the default dashboards, and its absence is why many teams learn about recall problems from users rather than from monitoring. The next chapter takes up measurement more broadly: how to evaluate an index before deploying it, how to read benchmarks, and how to tune a running system. Chapter 9. Measuring What Matters: Evaluation and Tuning Every chapter so far has described a bet and the parameters that control it. None of the parameters has a universally correct value. The right nprobe, ef, M, compression level, and candidate list size depend on the data, the queries, the hardware, and what the application needs. They can only be found by measurement. This chapter describes how to measure honestly, how to read the measurements others publish, and how to tune a system once it is running. Building an evaluation set An evaluation of a vector index needs three things: a collection, a set of queries, and the exact nearest neighbours of each query in the collection, called the ground truth. The collection should be the real one, or a representative sample at a realistic scale. Index behaviour changes with size. A graph index tuned on a million vectors will usually need a larger ef to reach the same recall on a hundred million, because paths are longer and the neighbourhood of each query is denser. An IVF index tuned at one size needs different nlist and nprobe at another. Where the full collection is too large to test conveniently, a sample of at least a tenth of the target size gives a more reliable picture than a tiny one, and testing at two or three sizes reveals how parameters must scale. The queries should be real queries from the application, embedded with the production model and the production query-side instructions. This is the most important rule in this chapter and the one most often broken. The common shortcut is to hold out a sample of documents from the collection and use them as queries. Held-out documents are drawn from the same distribution as the indexed data, so they land in well-populated regions of the space, close to many indexed points. Real queries may not. As Chapter 1 explained, queries in asymmetric retrieval tasks are often short and structurally different from documents, and in cross-modal tasks they come from a different region of the space entirely. Indexes evaluated on held-out documents routinely report recall several points higher than they achieve on real queries at the same settings. Where real queries are not yet available because the application is new, synthetic queries generated in the style expected, for instance by asking a language model to write questions that each passage answers, are a better proxy than held-out documents. The ground truth is computed by brute force. For each query, compute the exact distance to every vector in the collection using the production distance function and full-precision vectors, and record the top k for the largest k of interest. For a large collection this is expensive, but it is a one-time cost per evaluation set, it parallelizes trivially, and GPUs make it fast. The ground truth must be recomputed whenever the collection or the embedding model changes. A few thousand queries are usually enough to estimate average recall precisely. Ten thousand is a common benchmark size. More queries help mainly when one wants to study the distribution of per-query recall, discussed below. What to measure For each configuration of the index, five quantities should be recorded. Recall at the k the application actually uses, and if results are re-ranked downstream, recall at the candidate-list size as well. As Chapter 7 noted, recall at a hundred is the right measure for a first stage feeding a re-ranker; recall at ten is the right measure if the ten results are shown directly. Latency, as a distribution rather than an average. The median, the ninety-ninth percentile, and the maximum tell very different stories. A graph index might have a median of three hundred microseconds and a ninety-ninth percentile of two milliseconds because a minority of queries land in hard regions. For a service with a latency objective at the ninety-ninth percentile, the median is nearly irrelevant. Throughput, measured under load. Latency measured with one query at a time on an idle machine is the best case; under concurrent load, queries contend for memory bandwidth, caches, and cores, and latency rises. The useful measurement is latency at a target throughput, or the maximum throughput achievable while keeping the latency percentile within its objective. Load testing should use an open-loop generator, which issues queries at a fixed rate regardless of whether previous ones have completed. A closed-loop generator, which waits for each response before sending the next query, slows down when the system slows down and so systematically understates tail latency, a measurement error known as coordinated omission. Memory, measured as resident memory of the serving process rather than as the size of the vectors. Graph edges, identifier maps, metadata, allocator overhead, and buffers can add substantially to the raw vector size. Build time and update cost: how long it takes to build the index from scratch, how long inserts take, and how recall and latency behave after a realistic volume of inserts and deletes. An index that is excellent when freshly built and degrades after a week of updates should be evaluated after the week. Per-query recall and hard queries Average recall hides a great deal. An index with ninety-five per cent average recall at ten could achieve that with every query getting nine or ten of ten right, or with most queries getting ten of ten and a minority getting five. These are very different systems from a user's point of view. The second will feel unreliable: most searches work and some fail badly. Looking at the distribution of per-query recall reveals which queries are hard, and research has given useful vocabulary for why. Junfeng He, Sanjiv Kumar, and Shih-Fu Chang proposed in 2012 a measure called relative contrast: the ratio of a query's mean distance to the collection to its distance to its nearest neighbour. Queries with low relative contrast, whose nearest neighbours are barely nearer than everything else, are hard for every approximate method. Local intrinsic dimensionality, an estimate of the dimension of the data in the neighbourhood of a query, is another predictor: queries in regions of high local intrinsic dimension are harder. Work by Martin Aumüller and Matteo Ceccarello, among others, has used such measures to construct harder benchmark query sets and to explain why the same index performs differently on different datasets. In practice, hard queries tend to be out-of-distribution queries, queries in sparse regions of the collection, and queries that are ambiguous, sitting between several clusters. Identifying them in an evaluation set lets an engineer ask the right question: whether these queries matter to the application. If they are rare and the application tolerates occasional misses, average recall is the right target. If they are the important queries, such as rare-item lookups in a catalogue where common items are easy to find by other means, the index should be tuned for them specifically, possibly with adaptive search that spends more effort on queries detected as hard. Adaptive early termination is an active research topic. Rather than using a fixed ef or nprobe for every query, the search monitors its own progress and stops when further exploration is unlikely to change the results, or continues when the results are still changing. Learned approaches train a small model to predict, from features gathered during the search, how much more work is needed. These methods can reduce average cost at a fixed recall, but they make cost per query less predictable, which interacts with the tail-latency concerns of Chapter 8. Reading public benchmarks Public benchmarks are valuable and are frequently misread. The most widely cited, ANN-Benchmarks, runs a large number of algorithms on a set of standard datasets on a single machine and publishes recall-throughput curves. Its methodology is careful and its results are reproducible. Its limitations are those of any fixed benchmark. Several of its datasets are old and small. SIFT and GIST, image descriptors from the 2000s, have 128 and 960 dimensions and a million vectors each. GloVe word vectors are a few hundred dimensions and around a million vectors. These are different in character from modern transformer embeddings, which are typically higher-dimensional, more anisotropic, and much more numerous. Newer datasets built from modern text embeddings have been added to benchmarks over time, and results on them should be preferred where available. The default ANN-Benchmarks configuration measures single-threaded throughput with queries issued one at a time. This favours algorithms with low per-query latency and does not reflect behaviour under concurrency or batching. An algorithm that wins under these conditions may lose on a multi-core server under load, or on a GPU with large batches. Benchmarks measure what they measure and nothing else. Most report search performance on a static index. They say little about build time, update behaviour, memory under realistic conditions, filtered search, or behaviour at a hundred times the dataset size. The Big-ANN benchmarks address several of these, with billion-scale datasets, hardware-constrained tracks, and dedicated filtered, streaming, out-of-distribution, and sparse tracks. Vendor-produced benchmarks, such as the VectorDBBench suite released by Zilliz, test full database systems rather than libraries, including ingestion and filtering, which makes them more realistic for system selection, though readers should remember who produced them and check whether competing systems were configured with equal care. The right use of public benchmarks is to narrow the field and to calibrate expectations. They indicate which families of method are competitive for data of a given character and roughly what recall-throughput trade-offs to expect. They cannot substitute for measurement on one's own data, queries, and hardware. Index recall versus end-to-end quality Index recall measures fidelity to exact search. The application cares about something else: whether users find what they need, whether the assistant answers correctly, whether recommendations are engaging. The relationship between the two is the most practically important measurement of all, and it is often not made. Measuring end-to-end quality requires relevance judgements: for a set of queries, which items are actually relevant. These come from human annotation, from user behaviour such as clicks and purchases, or, increasingly, from language models acting as judges, which are cheaper but must themselves be validated against human judgement on a sample. Standard retrieval metrics then summarize quality: recall of relevant items in the top k, precision, mean reciprocal rank, and normalized discounted cumulative gain, which rewards placing highly relevant items near the top. For retrieval-augmented generation, the final measure is answer quality, assessed on a question set with reference answers. With relevance judgements in hand, the key experiment is a sensitivity analysis. Run the end-to-end evaluation with exact brute-force retrieval, then with the index at several recall levels, and observe how end-to-end quality changes. Typically the curve is flat at high index recall and falls off below some point. That point is the recall the application needs. Tuning the index for recall above it buys nothing measurable; tuning it below costs quality. The results are often surprising in both directions. Some applications show no measurable quality loss at index recall of ninety per cent, because the relevant items are well separated from the irrelevant ones and appear in the approximate results even when some near neighbours are missed, or because a re-ranker and a generous candidate list absorb the loss. Others show sharp quality loss at ninety-eight per cent, because the relevant item is frequently a single specific document that is only marginally closer than many near-duplicates. The same experiment should be run with alternatives to index tuning: a better embedding model, hybrid retrieval, a re-ranker, better chunking. Very often, the largest gains in end-to-end quality come from these, not from the index. An honest accounting allocates engineering effort to whichever lever moves end-to-end quality most per unit cost. A tuning sequence With measurement in place, tuning follows a sensible order. The steps below assume an in-memory graph index with optional compression, the most common configuration, and adapt straightforwardly to others. Fix the target first. Decide the recall the application needs, using the sensitivity analysis above if possible, and the latency percentile and throughput the service must meet. Without a target, tuning has no end. Establish the baseline with exact search. Measure brute-force latency on the full collection. If it already meets the latency target, which is the case more often than people expect for collections up to a few million vectors, especially with batching or a GPU, no approximate index is needed. Choose the build parameters with moderate defaults: M around 16 to 32, efConstruction around 200, adjusted upward for high-dimensional or difficult data. Build the index. Sweep the search parameter. Measure recall and latency over a range of ef values. Find the smallest ef that meets the recall target. If even large ef values cannot reach it, the graph quality is insufficient; rebuild with larger M or efConstruction, and sweep again. Add compression if memory is a constraint. Rebuild with int8 scalar quantization and full-precision re-ranking, sweep again, and check whether the recall target is still met at acceptable latency. If more compression is needed, try binary or product quantization with a larger candidate list for re-ranking. Measure memory as well as recall. Test under load, with filters, and after updates. Repeat the key measurements at the target throughput, with the production filter distribution, and after a realistic volume of inserts and deletes. Adjust parameters for whichever condition is binding. Deploy with monitoring. Set up sampled recall measurement as described in Chapter 8. Revisit the configuration whenever the collection grows substantially, the query distribution changes, or the embedding model is replaced. The sequence is unglamorous. Its value lies in its order: each step is measured against a target, each parameter is set by evidence, and the most expensive changes, rebuilding with different structural parameters, are made only when cheaper ones have been exhausted. The final chapter applies this reasoning to the decisions an engineer actually faces when designing a system: which family of index, on which hardware, at what cost. Chapter 10. Choosing an Architecture: Sizing, Trade-offs, and Worked Cases The preceding chapters described the components. This one assembles them into decisions. It begins with the questions that determine an architecture, in the order they should be asked, then works through four realistic scenarios with explicit arithmetic, and closes with the choice between libraries, database extensions, and dedicated vector databases. The arithmetic throughout uses only the definitions given earlier: four bytes per dimension for float32, one for int8, one bit for binary, m bytes for product quantization with m sub-spaces of 8 bits, and four bytes per graph edge. Real systems add overhead for identifiers, metadata, allocator slack, and buffers, so these figures are lower bounds, and a margin of thirty to fifty per cent is prudent in capacity planning. The questions, in order The first question is how many vectors there are, now and in two years, and of what dimension. This determines raw size: N times d times four bytes in float32. Everything else is constrained by it. Growth matters because rebuilding an architecture is expensive, and an index that fits comfortably today may not in a year. The second question is what recall the application needs, ideally established by the sensitivity analysis in Chapter 9. This determines how much approximation is affordable, and therefore how much compression and how aggressive a partition. The third is the latency objective, at a stated percentile, and the query rate. Together these determine whether the working set must be in memory, whether SSD latency is acceptable, and how many replicas are needed for throughput. The fourth is the update pattern: how many inserts, updates, and deletes per second, and how fresh results must be. This constrains the index family, since some handle updates much better than others, and determines the segment and compaction design. The fifth is the query shape: what filters are used, how selective they are, whether hybrid retrieval and re-ranking are involved, and whether there is a tenancy boundary. This affects index choice, partitioning, and the size of candidate lists. The sixth is the budget, which in the end decides among architectures that all meet the technical requirements. Answering these in order narrows the design rapidly. A collection of a few million vectors with a latency objective of tens of milliseconds and modest traffic can be served almost any way, and the decision should be driven by operational simplicity. A collection of billions with a millisecond objective and high traffic admits only a few designs, and the decision is driven by cost. Case one: an internal knowledge assistant An organization builds a retrieval-augmented assistant over its internal documents: wikis, policies, tickets, and reports. After chunking, there are five million passages, embedded with a 1,024-dimensional model. Traffic is modest, a few tens of queries per second at peak. The latency objective for retrieval is fifty milliseconds at the ninety-ninth percentile, since the language model call that follows takes seconds. Documents change daily. Every query carries an access-control filter: users may only retrieve passages from documents they are permitted to read. In float32, five million vectors of 1,024 dimensions occupy about 20.5 gigabytes. In int8, about 5.1 gigabytes. An HNSW graph with M of 16 adds about 128 bytes per vector at layer zero, about 0.64 gigabytes. Everything fits in the memory of a single ordinary server, even uncompressed, and an int8 index with full-precision re-ranking would fit on a small one. Brute force deserves a moment's consideration. Scanning 20.5 gigabytes at a few hundred gigabytes per second of memory bandwidth takes on the order of a hundred milliseconds per query on a CPU, too slow for the objective. On a GPU with a few terabytes per second of bandwidth it would take around ten milliseconds, within the objective, but a GPU for a few tens of queries per second is a poor use of hardware. An approximate index is warranted, and an HNSW index will answer in well under a millisecond at high recall. The hard part of this case is not the index. It is the access-control filter. Permissions in an organization are uneven: some users can see almost everything, others a narrow slice. For a user who can see one per cent of documents, in-traversal filtering on a standard HNSW graph risks the fragmentation described in Chapter 7. The appropriate design is a query planner that estimates the size of the user's permitted set and switches to brute force over that set when it is small enough, perhaps below tens of thousands of passages, where brute force over int8 vectors takes a few milliseconds, and uses in-traversal filtering otherwise. If the system supports a filter-robust graph method, that reduces the risk further. Permissions also change, and the filter must reflect the current state, which argues for storing permission metadata separately from the vector index and evaluating it at query time rather than baking it into the index. Given the scale, the operationally simplest option is likely the best: a vector extension to an existing database, such as pgvector in PostgreSQL, or vector fields in an existing search engine such as Elasticsearch or OpenSearch, which also provides BM25 for hybrid retrieval. Either keeps vectors, metadata, and permissions in one transactional system. A dedicated vector database is not needed at this size, though it would also work. The engineering effort in this case should go into chunking, the embedding model, hybrid retrieval, re-ranking, and evaluation, which together will affect answer quality far more than index parameters. Case two: product search with filters A retailer serves semantic search and visual similarity across two hundred million product listings, each embedded with a 768-dimensional model. Peak traffic is two thousand queries per second, the latency objective for retrieval is twenty milliseconds at the ninety-ninth percentile, and nearly every query carries filters: category, price band, availability, and shipping region. The catalogue changes constantly, with prices and availability updating many times per second and listings added and removed throughout the day. Raw size in float32 is about 614 gigabytes. In int8, about 154 gigabytes. With M of 32 to cope with high-dimensional, clustered product data, layer zero has up to 64 edges per node, about 256 bytes per vector, or about 51 gigabytes for the graph. An int8 HNSW index therefore needs a little over 200 gigabytes in memory, plus full-precision vectors for re-ranking, which can be held on local SSD and read only for candidates. A single large server could hold this, but it could not serve two thousand queries per second with headroom, and it would be a single point of failure. A reasonable design divides the collection into four to eight shards by random assignment, each holding twenty-five to fifty million vectors and roughly 25 to 50 gigabytes of index, and replicates each shard three or more times for throughput and availability. Random sharding is preferred here over content-based sharding because filters make content routing unreliable: the nearest shard by vector may hold none of the products in the requested category. Filters drive the rest of the design. Category is a natural candidate for the label-aware or partitioned approaches of Chapter 7, since there are a manageable number of top-level categories and most queries use one. Price and availability change too often to bake into the index and must be evaluated at query time from a fast metadata store. A query planner chooses between in-traversal filtering and brute force based on estimated selectivity per shard. Updates are split by type. Price and availability changes touch only metadata and need not affect the vector index at all. New and removed listings flow through a segment-based ingestion pipeline with a mutable buffer for freshness and background compaction to remove tombstones, with compaction triggered when deleted fractions grow large. The embedding of new listings, which requires running the image and text models, is a separate pipeline with its own GPU capacity. The tail-latency objective of twenty milliseconds across four to eight shards is achievable with hedged requests and with compaction isolated from serving. A sub-millisecond per-shard search leaves ample room for network, merge, and re-ranking. This is the scale at which a dedicated vector database, or a search engine with mature vector support, earns its keep, because the operational features it provides, sharding, replication, segment management, filtering, and hybrid search, would otherwise have to be built. Case three: web-scale passage retrieval A search engine or large AI provider wants dense retrieval over five billion web passages with 768-dimensional embeddings. Traffic is high, tens of thousands of queries per second. The latency budget for retrieval is around ten milliseconds at the ninety-ninth percentile. The collection is refreshed continuously but tolerates minutes of staleness. Raw size in float32 is about 15.4 terabytes. Holding this in memory, with an HNSW graph adding about 0.64 terabytes at M of 16, and replicated several times for throughput, means tens of terabytes of DRAM. It can be done, and some organizations do it, but the cost is large and every additional replica adds terabytes. Compression changes the picture. Product quantization at 64 bytes per vector reduces the collection to 320 gigabytes. Binary quantization at one bit per dimension gives 96 bytes per vector, 480 gigabytes. Either can be held in memory across a modest number of servers. With either, re-ranking is essential, which requires the full or partially compressed vectors to be accessible somewhere. Two architectures are natural. The first is an IVF index with product quantization in memory, sharded by content using the coarse partition, with full-precision or float16 vectors for re-ranking on local SSD. At a billion vectors per few machines in compressed form, five billion vectors fit in a cluster of tens of servers per replica. Content-based sharding reduces the number of machines each query touches, and the IVF scan is efficient and predictable. Recall depends on nprobe and on the candidate-list size for re-ranking. The second is a DiskANN-style design: compressed codes in memory, perhaps 32 bytes each, totalling 160 gigabytes, and the graph with full-precision vectors on SSD. Each node's on-disk record of about 3,072 bytes of float32 vector plus a neighbour list of 64 edges at four bytes each, 256 bytes, fits in a single four-kilobyte sector, so the on-disk index is about five billion sectors, roughly 20 terabytes across the cluster's SSDs. Storing vectors as float16 would roughly halve the per-node record, though the sector-aligned layout means the saving on disk depends on whether two records can share a sector. Each query costs a few dozen SSD reads in parallel batches and runs in low milliseconds per shard. Both architectures cut memory cost by an order of magnitude or more compared with an in-memory float32 graph, at the price of some latency and engineering complexity. Which is better depends on update rate, SSD capacity and throughput per server, and the recall target, and should be determined by measurement on the actual data. Organizations at this scale frequently run several tiers: a small, hot in-memory index for the most frequently retrieved passages, and a large compressed or disk-based index for the rest. At this scale, GPUs also enter the picture, for building indexes, where GPU-based graph construction and k-means clustering can cut build times from days to hours, and potentially for serving, if query batching can be arranged without breaking the latency objective. Case four: a multi-tenant service A software company offers semantic search as a feature to fifty thousand customer organizations. The total collection is two billion vectors of 1,024 dimensions, but the distribution is extremely skewed: a few hundred large tenants hold most of the data, and tens of thousands hold fewer than a hundred thousand vectors each. Most small tenants query rarely. Strict isolation between tenants is required. Isolation argues strongly for partitioning by tenant: each tenant's data in its own index, so that no query can ever touch another tenant's vectors and no filter selectivity problem arises at the tenancy boundary. But fifty thousand independent HNSW indexes, each kept in memory, would waste enormous amounts of memory on rarely used data. The architecture that has emerged for this pattern is tiered by both size and activity. Small tenants, with fewer than some threshold of vectors, perhaps tens of thousands, need no approximate index at all: brute force over their vectors takes well under a millisecond. Their vectors can be stored compactly and loaded on demand. Medium tenants get approximate indexes built when they cross the size threshold. Large tenants get their own dedicated shards. Indexes of inactive tenants are evicted from memory to SSD or object storage and reloaded on first query, accepting a slower first query after a period of inactivity. This is the cold-tier design described in Chapter 6, and its economics depend entirely on the activity distribution. If a tenth of tenants account for nearly all queries, then memory need only hold their indexes, and the remaining data can live on cheap storage. The engineering challenges are the cost of loading an index on demand, which argues for compact on-disk formats that can be memory-mapped and queried without full deserialization, and the management of many small indexes, which argues for a system designed for multi-tenancy rather than one adapted to it. Summary of the cases Table 5 brings the four cases together. The storage figures are computed from the dimensions and byte sizes stated in the text and exclude system overhead. Table 5. Sizing summary for the four worked cases. Case Vectors and dimension Float32 size Compressed in memory Likely architecture Knowledge assistant 5 million, 1,024 20.5 GB 5.1 GB int8 plus 0.6 GB graph Single node; database extension; planner for filters Product search 200 million, 768 614 GB 154 GB int8 plus 51 GB graph Random shards, replicated; label-aware filters Web-scale passages 5 billion, 768 15.4 TB 160 to 480 GB codes IVF-PQ or DiskANN-style, SSD re-ranking, tiered Multi-tenant service 2 billion, 1,024 8.2 TB Hot tenants only Per-tenant indexes; brute force for small; cold tier The progression in the table shows what this book has argued throughout. As scale increases, the share of the data kept in fast memory shrinks, the reliance on compression and re-ranking grows, and the engineering complexity of the system rises. At small scale the index is nearly irrelevant and everything else matters. At large scale the index design is the system design. Libraries, extensions, and databases The final decision is what to build on. There are three broad categories, and each suits different situations. Libraries provide index algorithms without a system around them. Faiss, from Meta, is the most comprehensive, covering flat, IVF, PQ and its variants, HNSW, and GPU implementations, with an index factory that composes them. hnswlib is the compact reference implementation of HNSW. ScaNN, from Google, offers its anisotropic quantization and partitioning. DiskANN, from Microsoft, offers the Vamana graph and its disk-based search. NVIDIA's cuVS offers GPU-accelerated IVF and CAGRA. Libraries are the right choice for offline jobs, for embedding search inside a larger custom system, and for teams with the expertise to build sharding, persistence, updates, and filtering themselves. They are a poor choice for teams that need a service and lack that expertise. Database extensions add vector indexes to systems that already exist. pgvector adds HNSW and IVF indexes to PostgreSQL. Lucene-based search engines, Elasticsearch and OpenSearch, offer HNSW vector fields alongside their mature full-text search. Several other relational and document databases have added vector types and indexes. The great advantage of extensions is that vectors live alongside the data they describe, with the same transactions, access controls, backups, and operational tooling. Hybrid search is natural in search engines. The disadvantages are that extensions are typically less optimized for vector workloads than dedicated systems, and their scaling characteristics are those of the host system, which may not suit billion-scale vector data. For collections in the millions to low hundreds of millions, extensions are often the best choice. Dedicated vector databases, such as Milvus, Qdrant, Weaviate, Vespa, Pinecone, and others, are built around vector search, with distribution, replication, segment management, filtering, hybrid search, and multi-tenancy designed in. They offer the widest range of index types and the most tuning control, and they scale furthest. Their cost is another system to operate, or another service to pay for, with its own consistency model and its own integration with the source of truth. They are the right choice when vector search is central to the product and its scale or requirements exceed what an extension provides. These categories blur. Dedicated databases are adding full-text search, search engines are improving vector performance, and libraries are gaining persistence features. The useful question is not which category is best but which system meets the requirements established by the six questions at the top of this chapter with the least operational burden. That question, and the measurements needed to answer it, are what an engineer brings to the choice. The specific products will change; the trade-offs they embody will not. Conclusion The argument of this book has been that every scalable vector index is a bet about where the nearest neighbours lie, that there are three basic kinds of bet, partitioning, compression, and navigation, and that the craft consists in choosing among them against the memory hierarchy and measuring how often they lose. Having worked through the pieces, it is possible to say several things that could not have been said at the outset. Recall is a budget, not a virtue The first is that recall should be treated as a budget to be spent, not a virtue to be maximized. Every technique in this book trades recall for something: memory, latency, throughput, update simplicity, or money. The question is never whether an index is accurate enough in the abstract but whether the recall it delivers is the recall the application needs, purchased at the lowest cost. That question has an empirical answer, found by measuring end-to-end quality at several levels of index recall. Most teams never make that measurement. They either accept a default and hope, or chase recall far beyond what their re-ranker and language model can use. Both errors are expensive, one in quality and the other in hardware. A consequence is that the most important number in a vector search system is not its latency or its recall but the recall at which end-to-end quality begins to fall. Knowing that number turns tuning from guesswork into engineering. It also redirects effort. If end-to-end quality is flat across a wide range of index recall, the index is not the bottleneck, and the work belongs in the embedding model, the chunking, the hybrid signals, or the re-ranker. The hierarchy decides The second conclusion is that the memory hierarchy, more than algorithmic ingenuity, determines which designs win. HNSW dominates in memory because random access to DRAM is cheap enough that its small number of distance computations translates into low latency. It loses on SSD because the same random access pattern becomes a sequence of slow reads, which is why DiskANN redesigned the graph to take fewer, larger, parallel steps. IVF survives despite inferior in-memory recall curves because sequential list scans suit caches, SIMD units, GPUs, and SSDs. Product quantization's table lookups work because the tables fit in the fastest caches, and fast-scan PQ works because sixteen-entry tables fit in a register. Binary quantization's revival rests on the population-count instruction. This suggests how to evaluate new techniques as they appear, as they will. Ask where the bytes live and how many of them each query touches at each level. A technique that reduces arithmetic but not bytes read will rarely help. A technique that converts random access into sequential access, or that moves the working set up a level, usually will. Hardware will continue to change. Memory capacity per server grows, high-bandwidth memory spreads beyond accelerators, storage-class memory and memory pooling over new interconnects may blur the line between DRAM and SSD. Each change will move the boundaries between the designs in this book, and the reasoning to follow will be the same. The query is the hard part The third conclusion is that the problems which remain genuinely hard are mostly not about the clean nearest-neighbour query that benchmarks measure. Within that clean problem, progress has been extraordinary: in-memory graph indexes reach high recall with a few hundred distance computations over collections of hundreds of millions, compressed indexes serve billions from modest memory, and disk-based indexes serve billions from a single node in milliseconds. What remains unsettled lies at the edges. Filtered search over arbitrary predicates still lacks a method that is robust across all selectivities without significant overhead, although filter-robust graphs and selectivity-aware planners have narrowed the gap considerably. Out-of-distribution queries, especially across modalities, still degrade indexes built from documents alone, and query-aware construction is young. Updates and deletions in graph indexes still often end in periodic rebuilds. Multi-vector representations, which address real limitations of single-vector retrieval, multiply storage by an order of magnitude or more and demand their own index engineering. The theoretical results on the limits of single-vector embeddings suggest that some retrieval tasks will always need more than one vector per item, or more than one stage, which means that the cost of these richer representations is a problem the field will have to solve rather than avoid. There is also a structural uncertainty about where retrieval is heading. Language models with very long context windows can read more candidate passages directly, which lowers the cost of missing a marginally relevant one and may relax recall requirements for the first stage. Agentic systems that issue many retrieval queries per task, refining as they go, raise the importance of throughput and per-query cost relative to single-query latency. Both trends change the shape of the budget without removing the need for an index. What to do differently For an engineer responsible for a vector search system, the practical consequences can be stated plainly. Measure recall in production, continuously, by comparing sampled live queries against exact search. Its absence is the most common gap in vector search operations, and the failures it would catch, from accumulating deletions, data drift, filter fragmentation, or configuration regressions, produce no errors otherwise. Evaluate with real queries. Held-out documents flatter every index, and the gap is largest in exactly the cases, asymmetric and cross-modal retrieval, where modern systems operate. Treat the embedding model as part of the schema. Tag every vector with the model that produced it, plan upgrades as migrations with shadow evaluation and rollback, and never let vectors from different models share an index. Start simpler than seems necessary. Brute force is exact and fast enough for more collections than people assume. A database extension is sufficient for more workloads than vendors suggest. Add approximation, compression, sharding, and tiers when measurement shows they are needed, and not before. Separate the two kinds of quality. Index recall measures fidelity to the embedding model; relevance measures whether the model was right. Diagnose problems by attributing them to the correct layer, and spend effort where the measured gains are largest. Finally, read the phrase "sub-millisecond search across billions of embeddings" with the precision it deserves. It describes something real: a single in-memory shard answering a well-formed query at a chosen recall. It does not describe a system's ninety-ninth percentile after fan-out, filters, and re-ranking, nor an index that has absorbed a month of deletions without maintenance, nor a query from a modality the index was not built for. The systems that live up to the phrase are the ones whose operators know exactly which bet they made, what it costs, and how often it loses. That knowledge, rather than any particular algorithm, is what this book has tried to provide. Glossary Approximate nearest-neighbour search (ANN). Search that returns items probably among the true nearest neighbours of a query, trading a controlled loss of accuracy for large gains in speed and memory. Asymmetric distance computation (ADC). Computing distances between a full-precision query and compressed database vectors, typically by summing entries from per-query lookup tables. Beam search. A graph search that keeps a bounded set of the best candidates found so far and expands the most promising unexplored one at each step; its width is controlled by ef in HNSW. Brute-force (flat) search. Exact search that computes the distance from the query to every stored vector. Coarse quantizer. The set of centroids, usually learned by k-means, that assigns each vector to a list in an inverted file index. efConstruction / ef (efSearch). HNSW beam widths used during index construction and during search respectively; larger values raise recall at higher cost. Embedding. A fixed-length vector of numbers produced by a learned model so that similar objects map to nearby points. Hubness. The tendency in high-dimensional data for a few points to appear among the nearest neighbours of disproportionately many others. Hybrid retrieval. Combining dense vector search with lexical or learned sparse search, typically through score or rank fusion. Inverted file index (IVF). An index that partitions vectors into lists by nearest centroid and searches only the lists nearest the query. M. The maximum number of neighbours per node in an HNSW layer; layer zero typically allows twice as many. Maximum inner product search (MIPS). Finding stored vectors with the largest dot product with the query, a problem related to but distinct from nearest-neighbour search under a metric. nlist / nprobe. The number of lists in an IVF index and the number of lists probed per query. Product quantization (PQ). Compression that splits a vector into sub-vectors and encodes each by the index of its nearest centroid in a per-sub-space codebook. Recall at k. The fraction of the true k nearest neighbours that an approximate search returns among its k results. Re-ranking. Recomputing scores for a candidate list with a more precise representation or model before selecting final results. Residual. The difference between a vector and its assigned centroid; encoding residuals improves compression accuracy in IVF. Scalar quantization. Compression that maps each coordinate independently to a lower-precision value, such as an 8-bit integer. Selectivity. The fraction of the collection that satisfies a query's metadata filter. Tombstone. A marker recording that a vector has been deleted, applied as a filter until the vector is physically removed during compaction. Further Reading Hervé Jégou, Matthijs Douze, and Cordelia Schmid, "Product Quantization for Nearest Neighbor Search," IEEE Transactions on Pattern Analysis and Machine Intelligence, 2011. The paper that introduced product quantization, asymmetric distance computation, and the IVFADC index. Still the clearest account of why compressed-domain search works. Yury Malkov and Dmitry Yashunin, "Efficient and Robust Approximate Nearest Neighbor Search Using Hierarchical Navigable Small World Graphs," IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020 (preprint 2016). The original description of HNSW, including the neighbour-selection heuristic that is often omitted from secondary accounts. Suhas Jayaram Subramanya and colleagues, "DiskANN: Fast Accurate Billion-point Nearest Neighbor Search on a Single Node," NeurIPS 2019. Introduces the Vamana graph and the design that made SSD-resident billion-scale search practical. Qi Chen and colleagues, "SPANN: Highly-efficient Billion-scale Approximate Nearest Neighbor Search," NeurIPS 2021. The partition-based alternative to DiskANN, with balanced clustering and boundary duplication for SSDs. Jeff Johnson, Matthijs Douze, and Hervé Jégou, "Billion-scale Similarity Search with GPUs," IEEE Transactions on Big Data, 2019 (preprint 2017). The GPU foundations of Faiss: brute force, IVF-PQ, and k-selection on graphics processors. Matthijs Douze and colleagues, "The Faiss Library," 2024 preprint. A survey of the library's design space by its authors, and a compact reference to most of the index types discussed in this book. Ruiqi Guo and colleagues, "Accelerating Large-Scale Inference with Anisotropic Vector Quantization," ICML 2020. The ScaNN paper, showing why quantization loss should be shaped for inner product search. Jianyang Gao and Cheng Long, "RaBitQ: Quantizing High-Dimensional Vectors with a Theoretical Error Bound for Approximate Nearest Neighbor Search," SIGMOD 2024. Binary quantization with random rotation and a calibrated distance estimator. Liana Patel and colleagues, "ACORN: Performant and Predicate-Agnostic Search Over Vector Embeddings and Structured Data," SIGMOD 2024. The most influential recent approach to filtered graph search. Martin Aumüller, Erik Bernhardsson, and Alexander Faithfull, "ANN-Benchmarks: A Benchmarking Tool for Approximate Nearest Neighbor Algorithms," Information Systems, 2020. The methodology behind the recall-throughput comparisons that the field uses as a common language; the companion website publishes current results. Harsha Vardhan Simhadri and colleagues, "Results of the NeurIPS'21 Challenge on Billion-Scale Approximate Nearest Neighbor Search," PMLR, 2022, and the 2023 follow-up report. The best public evidence on how methods behave at billion scale, with filtered, streaming, out-of-distribution, and sparse tracks. Jeffrey Dean and Luiz André Barroso, "The Tail at Scale," Communications of the ACM, 2013. Not about vectors, but essential for anyone designing a sharded search service. Omar Khattab and Matei Zaharia, "ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT," SIGIR 2020. The starting point for multi-vector retrieval and its indexing problems. Hashtags: #VectorSearch #VectorSearchAtScale #SemanticSearch #SemanticRetrieval #VectorDatabases #VectorIndexing #VectorEmbeddings #ApproximateNearestNeighbor #ANN #SimilaritySearch #NearestNeighborSearch #HighDimensionalData #HNSW #HierarchicalNavigableSmallWorld #InvertedFileIndex #ProductQuantization #VectorCompression #ScalarQuantization #BinaryQuantization #DiskANN #FAISS #ScaNN #HybridSearch #DenseRetrieval #RetrievalAugmentedGeneration #RAG #InformationRetrieval #DistributedSearch #SearchOptimization #ScalableAI

Download the Book (PDF): Introduction A language model that answers in under a second on a phone, without a network connection, without sending a word of the user's data to anyone, is no longer a research demonstration. In 2026 it is a product requirement. Apple ships a roughly three-billion-parameter model inside its operating systems and exposes it to developers. Google ships Gemma models built to run on phones and single-board computers, and an on-device Gemini Nano through Android. Qualcomm, MediaTek, Intel, AMD and Apple all sell chips with dedicated neural accelerators, and every one of them markets its ability to run language models locally. Open-weight families from Alibaba's Qwen team, Google, Microsoft, Hugging Face, Liquid AI and others now include models at one, two, four and nine billion parameters that are useful enough to build on. Yet the gap between a model that exists and a model that runs well on a particular device is large, and most teams discover it the hard way. A four-billion-parameter model stored in the 16-bit format in which it was trained occupies about eight gigabytes. A mid-range phone may have eight gigabytes of memory in total, shared with the operating system, the camera pipeline, the browser and every other app the user has open. Even when the model fits, the speed at which it can produce text is governed less by how many arithmetic operations the chip can perform than by how quickly it can drag the model's weights out of memory, once for every token it generates. And the battery, the thermal envelope and the user's patience all set limits that a data-centre deployment never meets. Compression is how that gap is closed. Quantization stores each weight in fewer bits. Pruning removes weights, neurons, attention heads or whole layers. Distillation trains a small model to imitate a large one. Low-rank adaptation lets a compressed model be specialised, or repaired, by training a tiny fraction of its parameters. Each of these has a literature of its own, a toolchain of its own and a set of folk beliefs that are only partly true. The argument of this book This book argues one thing: compressing a language model for the edge is a budgeting problem, and it goes well only when it is treated as one. There are two budgets. The first is the device budget: bytes of memory, bytes per second of memory bandwidth, operations per second, joules per token, and milliseconds the user will tolerate. The second is the quality budget: how much of the original model's behaviour on your tasks you are prepared to lose. Every compression technique is a way of spending one budget to save the other, and each spends it at a different price, paid in a different currency: calibration data, GPU hours, training tokens, engineering effort, or hardware support. Treated this way, the field becomes much easier to navigate. The order of operations stops being mysterious. You choose a base model whose architecture already respects the device budget. You remove bytes in the cheapest places first, which almost always means weight quantization to about four bits with a calibration-aware method. You spend training compute — distillation, quantization-aware training, low-rank recovery — only when cheap methods have hit their limit and only on the capability you need. You choose pruning when the hardware can actually exploit what you remove, which is less often than the papers suggest. And you measure quality on the tasks the product depends on, because the most common way to fail is to ship a model whose perplexity looks fine and whose behaviour on a long, structured, multilingual or tool-calling task has quietly collapsed. A second, less obvious claim runs alongside the first. The bottleneck at the edge is almost never arithmetic. It is memory: its capacity, which decides whether the model loads at all, and its bandwidth, which decides how fast the model speaks. That single fact explains why four-bit weights roughly double generation speed over eight-bit weights on the same chip, why unstructured sparsity so rarely makes a model faster on a phone, why the key–value cache becomes the dominant cost in long conversations, and why the neural processing units that dominate marketing material often matter less for chat-style generation than the humble width of the memory bus. Readers who keep that fact in view will make fewer expensive mistakes than readers who memorise the names of a dozen algorithms. Who this is for The reader this book has in mind is technically literate but not necessarily a specialist in model compression: an engineer asked to make a model run on a product, a technical lead deciding whether to build on an on-device model or a cloud API, a researcher in an adjacent field who needs a working map, or a product manager who wants to understand why the team keeps saying "it fits but it's too slow." Familiarity with what a neural network is, and roughly how a transformer works, will help. Nothing beyond that is assumed. Every technical term is defined when it first appears, and a glossary at the end collects the ones that recur. The book is practical without being a manual. Tools change month by month, and any book that tried to be a command reference would be stale before it was printed. What changes much more slowly is the reasoning: why a particular method works, what it costs, where it breaks, and how to tell whether it has broken. Where specific tools matter — llama.cpp and its GGUF format, Apple's MLX and Core ML, PyTorch's ExecuTorch, Google's LiteRT, Microsoft's ONNX Runtime, the quantization libraries built around GPTQ and AWQ — they are described as they stood in late 2026, with an eye to the design decisions that will outlast any particular version. How the book is arranged The chapters build in the order a practitioner actually meets the problems. The first establishes the arithmetic of the edge: where the bytes and the milliseconds go when a transformer generates text on a phone or laptop, and why memory bandwidth dominates. The second covers the choice of starting point, because the cheapest compression is the one you avoid by picking a model whose architecture was designed for small devices. Four chapters then take quantization apart. The first lays out the fundamentals: number formats, scales, granularity, and the outlier problem that makes language models harder to quantize than the vision networks that preceded them. The next covers post-training quantization of weights — GPTQ, AWQ, the k-quant and importance-matrix approach of llama.cpp, and the vector and lattice methods that push below four bits. Another turns to activations, the key–value cache, rotation methods and the new four-bit floating-point formats. A later chapter covers quantization-aware training and the sub-four-bit frontier, including ternary models. Pruning, distillation and low-rank adaptation each receive a chapter, and each is treated as a tool with a specific price rather than a magic word. The runtime and hardware chapter matches formats to chips, which is where many good compression results go to die. The evaluation chapter explains how to measure what compression has cost, using signals that are more sensitive than the benchmarks on a model card. The final chapter assembles everything into a blueprint: a sequence of decisions, with the questions to ask at each, for taking a model from a checkpoint to a device. A note on numbers. Compression research reports a great many results, and the benchmarks on which they are reported shift constantly. Where this book gives a figure, it is because the figure comes from a specific, named source or follows directly from arithmetic the reader can check. It does not reproduce leaderboard scores for particular models, which are often measured under incomparable conditions and are superseded within months. The reader who needs a current number for a decision should measure it on their own task, on their own device; the evaluation chapter explains how. The goal is that, by the end, the reader can look at a device and a task and reason, from first principles, about which model to start from, which bytes to remove first, what that will cost in quality, how to recover what was lost, and how to know whether the result is good enough to ship. Chapter 1. The Arithmetic of the Edge Before choosing a compression method it helps to know what, precisely, is being compressed and why. A language model running on a device consumes four resources: memory capacity, memory bandwidth, arithmetic throughput and energy. They are not equally scarce, and they are not consumed evenly across the life of a request. Most of the confusion in edge deployment comes from treating "the model is too big" as a single problem when it is really several, each with a different cure. Where the bytes live A transformer language model at inference time holds three kinds of data in memory. The first is its weights: the matrices that define the model. For a dense model the weight memory is simply the number of parameters multiplied by the bytes used to store each one. A model with four billion parameters stored in 16-bit floating point, the format in which most models are released, needs eight billion bytes, or about eight gigabytes. Stored at eight bits per weight it needs about four gigabytes; at four bits, about two; at two bits, about one. Real formats add a few percent of overhead for the scale factors that accompany quantized weights, which is why a "four-bit" file is usually closer to 4.5 bits per weight when measured honestly. The second is the key–value cache, usually shortened to KV cache. A transformer's attention mechanism lets each new token look back at every earlier token in the context. To avoid recomputing the representations of earlier tokens at every step, the runtime stores, for each layer, a key vector and a value vector for every token processed so far. The size of this cache grows linearly with the length of the context. It can be calculated exactly: two (for keys and values) multiplied by the number of layers, the number of key–value heads, the dimension of each head, the number of tokens, and the bytes per element. Take a concrete case shaped like many current small models: 28 layers, 8 key–value heads, a head dimension of 128, stored in 16-bit precision. Each token then costs 2 × 28 × 8 × 128 × 2 bytes, which is 114,688 bytes, or a little over 112 kilobytes. A conversation of 4,000 tokens therefore needs roughly 460 megabytes of cache; 32,000 tokens needs about 3.7 gigabytes. For a model whose quantized weights occupy two gigabytes, the cache for a long document can easily exceed the model itself. This is the first counterintuitive fact of edge deployment: for long contexts, compressing the weights further buys less than compressing, shrinking or bounding the cache. The third is activations and working buffers: the intermediate results of each layer, scratch space for matrix multiplications, and the logits over the vocabulary at the output. During token-by-token generation these are small, because only one token is processed at a time. During the initial processing of a long prompt they can be substantial, because the runtime processes many tokens together. Runtimes typically allocate these buffers once, sized to the maximum batch of prompt tokens they will handle. Add an operating system, a user interface and whatever else is running, and the practical memory budget for a model on a phone with eight gigabytes of RAM is perhaps two to three gigabytes before the system starts killing background apps or the model itself. On a twelve- or sixteen-gigabyte flagship it is more comfortable, but the model still competes with everything else. On a laptop with sixteen gigabytes of unified memory, a model of eight billion parameters at four bits is routine; at thirty-two gigabytes, much larger models become possible. Embedded boards and microcontrollers live in a different universe altogether, where hundreds of megabytes is a luxury. Table 1 sets out the weight memory for some common model sizes at common precisions. The figures are straightforward arithmetic — parameters multiplied by bits per weight, divided by eight — and they ignore the small overhead of scale factors, the KV cache and runtime buffers, all of which must be added on top. Table 1. Approximate weight memory by model size and storage precision (parameters × bits ÷ 8; excludes scales, KV cache and buffers). Parameters 16-bit 8-bit 4.5-bit (typical "4-bit" file) 2-bit 0.5 billion 1.0 GB 0.5 GB 0.28 GB 0.13 GB 1 billion 2.0 GB 1.0 GB 0.56 GB 0.25 GB 3 billion 6.0 GB 3.0 GB 1.7 GB 0.75 GB 4 billion 8.0 GB 4.0 GB 2.3 GB 1.0 GB 8 billion 16.0 GB 8.0 GB 4.5 GB 2.0 GB Two lessons follow. First, for phones, the useful range of models at four bits runs from well under one billion parameters up to about four billion, with eight billion feasible only on devices with generous memory and little else running. Second, the difference between eight and four bits is the difference between a three-billion-parameter model fitting comfortably on a mid-range phone and not fitting at all. Precision is the largest single lever on capacity. Why speed is a bandwidth problem Capacity decides whether a model loads. Bandwidth decides how fast it talks. Generation in a transformer proceeds in two phases. In the prefill phase the model reads the entire prompt — the system instructions, the user's message, any retrieved documents, the conversation so far — and computes the KV cache for all of it. Because all prompt tokens are available at once, the runtime can process them together as large matrix multiplications. Each weight fetched from memory is used for hundreds or thousands of tokens, so the work is dominated by arithmetic. Prefill is compute-bound. In the decode phase the model produces one token at a time. To produce each token it must run the entire network for that single token, and that means reading essentially every weight from memory — once per token. Each weight is fetched, multiplied by a single vector, and discarded until the next token. The arithmetic per byte fetched is tiny. Decode is memory-bandwidth-bound. This gives a simple, surprisingly accurate upper bound on generation speed. If a device can move B bytes per second from memory to its compute units, and the model's weights occupy W bytes, the model cannot produce more than about B ÷ W tokens per second, however powerful the processor. A phone memory system using LPDDR5X on a 64-bit bus at 8,533 million transfers per second has a theoretical peak of about 68 gigabytes per second; real sustained bandwidth for a single workload is lower. A two-gigabyte model on such a device therefore has a hard ceiling somewhere around thirty tokens per second, and achieved speeds below that ceiling are normal. A Raspberry Pi 5, with a 32-bit LPDDR4X interface at 4,267 million transfers per second, has a theoretical peak around 17 gigabytes per second; the same two-gigabyte model could not exceed about eight tokens per second there. Apple's own engineering notes on its M5 chip make the split explicit. When Apple's machine learning research team compared the M5 with the M4 using its MLX framework, it reported that time to first token — a prefill measurement — improved by between roughly three and four times, thanks to new matrix units in the GPU, while generation speed improved by about 19 to 27 percent, which it attributed to the M5's memory bandwidth rising from 120 to 153 gigabytes per second. The arithmetic units became several times faster; generation followed the memory bus. The consequences for compression are direct: • Halving the bytes per weight roughly doubles the decode ceiling. Moving from 8-bit to 4-bit weights does not just save memory; on bandwidth-bound hardware it is the most reliable speed-up available. • Arithmetic savings help prefill, not decode. Techniques that reduce the number of operations without reducing bytes fetched — including most forms of unstructured sparsity, discussed in the pruning chapter — rarely speed up generation on edge devices. • Dequantization overhead can matter. Because weights must be unpacked from their compressed form into numbers the hardware can multiply, an exotic format that saves bytes but requires expensive decoding can lose its advantage. A large part of the art of practical quantization is designing formats whose decoding is cheap enough that the bandwidth saving survives. • The KV cache is also read on every step. During decode, attention reads the cache for every previous token. For long contexts this read can rival the weight read in volume, which is why cache compression speeds up long-context generation as well as saving memory. A useful habit is to compute the bandwidth ceiling before measuring anything. If a runtime achieves 70 percent of the ceiling, further work on kernels has limited upside, and the only way to go faster is to move fewer bytes. If it achieves 20 percent, the problem is software — poor kernels, unfortunate memory layout, contention with other processes — and compressing the model further may not help. Latency the user feels Users do not experience tokens per second. They experience how long they wait before anything appears and how fast text arrives once it does. Time to first token is dominated by prefill. A conversational assistant with a long system prompt, a retrieval-augmented application that stuffs several documents into the context, and an agent that receives a long list of tool definitions all pay this cost before the first word appears. On a phone, prefilling a few thousand tokens on the CPU can take several seconds; moved to a GPU or NPU that can run dense matrix multiplications efficiently, it can fall well below a second. Because prefill is compute-bound, this is where neural accelerators earn their keep. It is also where caching helps: a system prompt that never changes can have its KV cache computed once and reused, which many runtimes support. Decode speed is perceived relative to reading speed. A rate above roughly ten tokens per second keeps up with most readers when text streams onto the screen. For tasks where the output is consumed by software rather than read — structured extraction, classification, tool calls — what matters is the total time to the final token, and both phases count. There is also sustained performance. A phone can run its processors at full power for a short burst before heat forces it to slow down. A benchmark that measures the first thirty seconds of generation may report numbers that a real user session, running for minutes with the screen on and the radio active, never sees. Edge deployment must be measured over realistic durations, at realistic ambient temperatures, on battery as well as on charger. Energy and the cost of moving data Energy follows the same logic as speed. Moving a byte from off-chip memory costs far more energy than performing an arithmetic operation on it once it has arrived; the precise ratio depends on the process technology and memory type, but the gap is large and well established in computer architecture research. A model that fetches half as many bytes per token therefore uses substantially less energy per token, not merely less time. For a battery-powered device this changes priorities. A cloud deployment can sometimes trade energy for latency by running larger batches; a phone serves one user and pays for every byte fetched. Formats that reduce memory traffic, runtimes that keep data in on-chip memory where possible, and accelerators that achieve high efficiency at low precision all compound into battery life. Hardware vendors now advertise performance per watt for their neural units precisely because sustained on-device inference has become a design target. The two budgets With this arithmetic in hand the problem can be stated cleanly. For a given device and application there is a device budget: a ceiling on weight memory (set by capacity minus everything else running), a ceiling on KV cache (set by the longest context the product must support), a floor on decode speed (set by user experience), a ceiling on time to first token, and an energy envelope. And there is a quality budget: a floor on how well the model must perform on the tasks the product depends on. Every compression technique in this book is a way of moving the model inside the device budget while staying above the quality floor. They differ in which part of the device budget they relieve and in what they cost. • Weight quantization relieves capacity and decode speed directly. It costs calibration data and some quality, increasing sharply below about four bits. • KV-cache quantization and architectural choices such as grouped-query attention relieve long-context memory and long-context decode speed. • Activation quantization relieves prefill compute on hardware with fast low-precision arithmetic, and is often required to use integer-only accelerators at all. • Structured pruning relieves everything at once — fewer parameters means fewer bytes, fewer operations and a smaller cache if attention heads or layers are removed — but costs quality that usually has to be recovered with training. • Unstructured pruning relieves capacity only if the runtime stores sparse weights compactly, and speed only on hardware that skips zeros, which most edge hardware does not. • Distillation produces a smaller model of a chosen architecture that is better than the same architecture trained from scratch; its cost is training compute and data. • Low-rank adaptation does not compress in itself, but it makes specialisation and quality recovery cheap enough to be practical on compressed models. The order in which to apply these is the subject of the last chapter. But the shape of the answer is already visible: methods that move fewest bytes for least quality, at the lowest engineering cost, come first. That almost always means choosing a well-designed small model and quantizing its weights to around four bits with a calibration-aware method. Everything after that is spending more to gain less, and must be justified by a specific gap between what the device budget demands and what the cheap methods deliver. What the arithmetic leaves out Three caveats keep this framework honest. First, mixture-of-experts models change the arithmetic. In such a model only a few "expert" sub-networks are activated for each token, so the bytes fetched per token reflect the active parameters while the memory required reflects all parameters. A model with tens of billions of total parameters but only three or four billion active per token can decode at the speed of a small dense model — if it fits. On a laptop with ample unified memory this is an attractive trade; on a phone, where capacity is the binding constraint, it usually is not. Some designs, such as Google's Gemma 4 "effective" models, place part of their parameters in large per-layer embedding tables that need only be looked up rather than multiplied, blurring the line between total and active size in a different way. When reading a model card, it pays to ask which number determines memory and which determines speed. Second, batching changes the arithmetic. If a device serves several requests at once — a laptop running background agents alongside a chat, or a gateway box serving several users — each weight fetched can be reused across the batch, and decode moves toward the compute-bound regime. Most phone deployments serve one request at a time, but speculative decoding, discussed in the runtime chapter, creates an internal batch of draft tokens to exploit exactly this effect. Third, the quality budget is not a single number. Compression degrades capabilities unevenly. Arithmetic, long-context retrieval, rare languages, strict output formats and multi-step tool use typically suffer before general conversational fluency does. A model can lose almost nothing on a broad knowledge benchmark while losing a great deal on the narrow behaviour a product depends on. The evaluation chapter returns to this at length, because it is where most compressed deployments that fail in the field actually fail. Chapter 2. Choosing the Starting Point The cheapest compression is the one you never have to perform. A model whose architecture was designed with small devices in mind, trained on enough data to make every parameter count, will usually beat a larger model hammered down to the same size. This chapter is about choosing that starting point well: what makes a small model good, what architectural features matter for edge deployment, and how to read the claims made for the many small open-weight models now available. Why small models got good For several years the default assumption was that capability came from scale: more parameters, more data, more compute. The 2022 "Chinchilla" study from DeepMind refined that assumption by showing that, for a fixed training budget, many large models of the time were undertrained — they would have been better as smaller models trained on more tokens. Chinchilla's recommendation, roughly twenty training tokens per parameter, was a recipe for minimising the cost of training a model of given quality. Edge deployment cares about something different: the cost of running the model, every time, on every device. If a model will be used billions of times, it is worth spending far more on training to make it smaller at inference. This logic, sometimes described as training "past Chinchilla-optimal," has driven the design of nearly every capable small model since. Meta's Llama 3 8B, released in 2024, was trained on more than fifteen trillion tokens — nearly two thousand tokens per parameter, a hundred times the Chinchilla ratio. Small models in the families that followed have continued the pattern. The result is that a model of three or four billion parameters in 2026 is typically far more capable than a model of the same size from three years earlier, and often more capable than much larger models from that period. Three other forces have contributed. Data quality has become a central research topic: Microsoft's Phi series, beginning with the 2023 paper "Textbooks Are All You Need," argued that carefully filtered and synthetic "textbook-quality" data lets small models punch above their weight. Distillation from larger teacher models, discussed in its own chapter, has become standard: Google described its Gemma 2 small models as trained with knowledge distillation, and Meta built its Llama 3.2 1B and 3B models by pruning the 8B model and then training with logits from the 8B and 70B models as targets. And post-training — instruction tuning, preference optimisation, reinforcement learning on verifiable tasks — has become far more effective, with reasoning abilities increasingly transferred into small models through distillation of long chains of thought from large reasoning models, as DeepSeek did when it released distilled versions of its R1 model in early 2025. The practical consequence is that a team building for the edge in late 2026 has an unusually rich menu. Alibaba's Qwen team released a Qwen3.5 small series in early 2026 at 0.8, 2, 4 and 9 billion parameters under the Apache 2.0 licence, with native vision input and a hybrid architecture discussed below. Google released Gemma 4 in April 2026, including E2B and E4B models aimed at phones and small boards, also under Apache 2.0. Microsoft's Phi-4-mini sits at 3.8 billion parameters. Hugging Face's SmolLM line publishes not just weights but training recipes and data. Liquid AI's LFM2 and LFM2.5 families target on-device use with non-transformer components and sizes around one to three billion parameters, and Liquid AI reported its LFM2.5 1.2B instruct model generating dozens of tokens per second on a current Samsung phone. Meta's Llama 3.2 1B and 3B remain widely deployed, and Apple's own on-device model — not openly downloadable, but available to developers through Apple's Foundation Models framework — is a roughly three-billion-parameter model built for its silicon. This menu will have changed by the time this book is read. The principles for choosing from it will not. Architecture features that matter on a device Two models with the same parameter count can differ substantially in how well they run at the edge. The differences lie in a handful of design decisions. Grouped-query attention. In the original transformer, each attention head has its own key and value projections, so the KV cache scales with the number of heads. Multi-query attention, proposed by Noam Shazeer in 2019, shares a single key and value head across all query heads; grouped-query attention, introduced by Ainslie and colleagues in 2023, shares each key–value head across a group of query heads. A model with 32 query heads and 8 key–value heads has a KV cache a quarter the size of the same model with full multi-head attention. Nearly every recent small model uses grouped-query attention, but the ratio varies, and it determines how much context fits in a given memory budget. When comparing models for long-context use, compute the per-token cache cost from the configuration file rather than trusting a headline context length. Hybrid and linear attention. Standard attention's cost grows with context length in both compute and cache. A number of recent designs replace most attention layers with recurrent or linear-attention layers whose state is a fixed size regardless of how many tokens have been processed, keeping only a few full-attention layers for precise retrieval. Qwen3.5's small models use this approach: their published configuration alternates three Gated DeltaNet linear-attention blocks with one full gated-attention block, so only a quarter of the layers maintain a growing KV cache. Liquid AI's models combine short convolutions with a minority of attention layers. For edge deployment this is valuable — a long conversation costs far less cache — but it carries a tooling cost: runtimes and NPU compilers must support the new layer types, and quantization methods tuned on standard transformer layers may not transfer cleanly to recurrent state updates. Always confirm that your target runtime supports the architecture efficiently before committing to it. Sliding-window attention. Another way to bound the cache is to let most layers attend only to a recent window of tokens, with a few global layers attending to everything. Google's Gemma models have used interleaved local and global attention for this reason. The effect on memory is similar to hybrid designs, and support in runtimes is now common. Depth versus width. At a fixed parameter budget, a model can be wide and shallow or narrow and deep. Meta's MobileLLM work, presented at ICML 2024, argued that for sub-billion-parameter models, depth matters more than conventional scaling laws suggested — that "deep and thin" architectures with weight sharing and grouped-query attention outperform wider ones of the same size. Depth has a cost at inference, because layers execute sequentially and each layer carries fixed overheads, but for very small models the quality gain usually dominates. Embedding and vocabulary size. Modern multilingual tokenisers have vocabularies of 150,000 to more than 250,000 tokens. The embedding matrix that maps tokens to vectors, and the output matrix that maps the final hidden state back to token probabilities, each have one row per vocabulary entry. For a model with a hidden size of 2,048 and a vocabulary of 256,000, each such matrix holds over half a billion parameters. In a one-billion-parameter model the embeddings can therefore be a large fraction of the total. Several design responses exist: tying the input and output embeddings so the same matrix serves both (common in small models), quantizing embeddings separately (Apple reports quantizing its on-device model's embedding table to 4 bits while its other weights are at 2), and keeping embeddings in slower storage since only one row per token needs to be read on input. Gemma 4's E-series models use per-layer embedding tables that hold a substantial share of their parameters; Google describes the E2B model as having about 2.3 billion "effective" parameters doing the expensive multiplication work. The vocabulary also affects compression in a subtle way: the output projection is often the most quantization-sensitive matrix in the model, and many quantization recipes keep it at higher precision. Native multimodality. Many small models now accept images, and some accept audio. Vision encoders add parameters and, more importantly, add tokens: a single image can become hundreds of tokens in the context, raising both prefill cost and cache size. Encoder weights often quantize differently from language-model weights. If the product needs only text, a text-only variant or a runtime that skips loading the encoder saves memory. Licences and provenance The legal terms attached to open-weight models vary more than their marketing suggests. Apache 2.0 and MIT licences impose few restrictions. Other licences add acceptable-use policies, restrictions on very large deployments, attribution requirements, or terms on using the model's outputs to train other models. Google moved Gemma 4 to Apache 2.0 after earlier Gemma versions shipped under a custom licence; Meta's Llama models carry Meta's own community licence. Before building a product, read the licence of the specific checkpoint, and note that derived works — quantized, pruned, fine-tuned — usually inherit it. Distillation from a teacher model raises its own question: some licences restrict using outputs to train competing models, which may matter if the plan is to distil from a proprietary model. Provenance matters for another reason. Quantized checkpoints on public model hubs are often produced by third parties. Most are made in good faith with standard tools, but they vary in method, calibration data and care. A quantized file whose creator used a poor calibration set or an outdated tool can be measurably worse than one produced carefully from the same base. For anything that ships, produce your own quantized artefacts from official weights, or at least verify third-party ones against your own evaluation. Reading a model card honestly Model cards report scores on public benchmarks. These numbers are useful for a rough ranking and dangerous for anything finer. Several cautions apply. Benchmarks are measured under different conditions — number of examples in the prompt, whether "thinking" mode is enabled, which answer-extraction script is used — and small differences in these settings can move scores by several points. Comparisons across model cards from different vendors are rarely apples to apples. Public benchmarks also leak: their questions appear on the web and can end up in training data, inflating scores in ways that do not transfer to new tasks. And benchmark scores are almost always reported for the unquantized model. The compressed model you will ship may behave differently, and different architectures tolerate compression differently. The model card is therefore a shortlist generator, not a decision. The decision comes from running two or three candidate models, compressed the way you intend to ship them, on an evaluation set drawn from your own product, on your target device. Building that evaluation is the subject of a later chapter, and it is worth doing before choosing a base model, not after. A selection procedure Combining the device arithmetic of the previous chapter with these considerations gives a practical procedure. Start from the device budget. Subtract the operating system and the rest of your application from available memory to obtain a ceiling for model weights plus cache. Decide the longest context the product must support and compute the cache cost per token for each candidate from its configuration. Decide the minimum acceptable decode speed and divide the device's sustained bandwidth by it to obtain a ceiling on bytes read per token. From these, derive a ceiling on parameters at roughly 4.5 bits per weight. That is the size class to shop in. Resist the temptation to pick the largest model that might fit at three or two bits; the quality loss below four bits rises steeply for post-training methods, and a smaller model at four bits is usually the better bet unless you are prepared to invest in quantization-aware training. Within the size class, prefer models that use grouped-query attention with a generous query-to-key ratio, or a hybrid design if your runtime supports it; that have a licence compatible with your product; that offer an instruction-tuned version close to your use case; and that have strong support in your target runtime. Check whether the vendor publishes quantization-aware-trained checkpoints — Google released quantization-aware-trained Gemma 3 checkpoints in 2025, and Meta released quantized Llama 3.2 1B and 3B variants trained with quantization-aware training plus low-rank adapters, and with the SpinQuant rotation method, in late 2024. Such checkpoints often beat anything you can produce with post-training methods. Then evaluate. Quantize each candidate the way you intend to ship it and measure on your own tasks. Very often the ranking changes: a model that led on its card loses more under quantization than its rival, or handles your output format worse, or proves weaker in a language your users need. When to compress a larger model instead There are circumstances in which starting from a larger model and compressing aggressively is the right choice. One is when the target capability is simply absent in available small models — a specialist domain, a rare language, a reasoning skill — and present in a larger model. Then structured pruning and distillation from the larger model to a custom small architecture may be the only route. NVIDIA's Minitron work, published in 2024, showed that pruning a fifteen-billion-parameter model to eight and four billion parameters and retraining with distillation could produce models competitive with similarly sized models trained from scratch, using a small fraction of the training tokens. That is an option for organisations with training infrastructure; it is not a weekend project. Another is when the device is not really an edge device in the phone sense: a workstation-class laptop with 64 or 128 gigabytes of unified memory, or an industrial box with a large GPU. There, a mixture-of-experts model with a large total size but a small active size may be the best trade, and aggressive quantization of the expert weights becomes the main lever. A third is when the vendor already did the compression for you, as with quantization-aware-trained checkpoints of a larger model that fit your budget. That is often the best of both worlds. For everyone else, the advice is simple. Choose the best model you can find in the size class your device budget allows, and spend your effort on quantizing it well, measuring it honestly and specialising it to your task. The following chapters explain how. Chapter 3. Quantization from First Principles Quantization is the workhorse of edge deployment. Almost every model that runs on a phone or laptop today is quantized, and for most deployments quantization is the only compression applied. It is also the technique most often applied carelessly, because the tools make it look like a single command. This chapter builds the ideas from the ground up — number formats, scales, granularity, and the peculiar statistics of language-model activations — so that the methods in the following chapters can be understood as answers to specific problems rather than as recipes. Numbers with fewer bits A trained model's weights are stored, by default, as 16-bit floating-point numbers, usually in the bfloat16 format, which keeps the eight exponent bits of a standard 32-bit float but only seven bits of mantissa. A floating-point number spends its bits on a sign, an exponent that sets its order of magnitude, and a mantissa that sets its precise value within that order of magnitude. This gives a huge dynamic range: bfloat16 can represent numbers from about 10⁻³⁸ to 10³⁸. Neural network weights do not need that range. Within a single weight matrix, values typically cluster around zero in a roughly bell-shaped distribution, with a spread spanning a few orders of magnitude at most. Quantization exploits this by mapping the weights onto a much smaller set of representable values. The simplest scheme is uniform integer quantization. Choose a number of bits, say four, giving sixteen possible integer codes. Choose a scale s, a real number. A weight w is stored as the integer q = round(w ÷ s), clipped to the representable range, and recovered approximately as w' = q × s. With symmetric quantization the integer range is centred on zero (for example −8 to 7 for four bits). With asymmetric quantization a zero-point z is added, so w' = (q − z) × s, allowing the grid to cover a range that is not centred on zero — useful when values are skewed, as activations after some nonlinearities are. The error introduced is the difference between w and w'. For uniform quantization it is at most half a step, s ÷ 2, for values inside the range, and potentially large for values clipped at the edges. Everything else in this chapter is about choosing s, z and the set of representable values so that the errors that matter are small. Floating-point formats with few bits are an alternative. An 8-bit float, in the E4M3 variant with four exponent bits and three mantissa bits, or the E5M2 variant with five and two, spaces its representable values logarithmically, densely near zero and sparsely far from it. That matches bell-shaped distributions better than an even grid does, and FP8 has become standard for training and inference on data-centre GPUs since NVIDIA's Hopper generation. At four bits, the E2M1 layout — one sign bit, two exponent bits, one mantissa bit — has only eight magnitudes, ranging from 0 to 6: 0, 0.5, 1, 1.5, 2, 3, 4 and 6. On its own that is far too coarse to represent a weight matrix, which is why four-bit floating-point formats always come paired with per-block scales, discussed below. Non-uniform codebooks go further. Instead of a fixed grid, store a small table of, say, sixteen representative values chosen to fit the actual distribution, and store each weight as an index into the table. The NF4 ("4-bit NormalFloat") format introduced with QLoRA in 2023 uses a fixed codebook whose sixteen values are spaced according to the quantiles of a normal distribution, on the theory that normalised weights are roughly normally distributed. Vector quantization, discussed in the next chapter, stores indices into a codebook of short vectors rather than single values. Scales and granularity The single most consequential choice in quantization is how many weights share one scale. With per-tensor quantization, one scale covers an entire weight matrix. It is cheap — one number per matrix — but disastrous at low bit-widths, because a single large value forces a large scale, and then the many small values all round to the same few codes. With per-channel quantization, each output row of a weight matrix gets its own scale. This was the standard for 8-bit integer inference on mobile hardware in the convolutional-network era and works well at eight bits. With group-wise or block-wise quantization, each contiguous block of weights — typically 32, 64 or 128 values along the input dimension — gets its own scale, and sometimes its own zero-point or offset. Group-wise quantization is what makes four-bit weight storage work for language models. The cost is overhead: a 16-bit scale for every 32 weights adds half a bit per weight, which is why "four-bit" formats usually land between 4.25 and 5 bits per weight in practice. The llama.cpp project's "k-quant" formats reduce this overhead with a two-level scheme in which blocks of weights are grouped into larger super-blocks, and the block scales are themselves quantized relative to a super-block scale. The four-bit floating-point formats standardised in 2023–2025 make granularity explicit in their names. The MXFP4 format, part of the Open Compute Project's Microscaling specification, stores blocks of 32 E2M1 values sharing one 8-bit power-of-two scale (an E8M0 value, which is all exponent and no mantissa). NVIDIA's NVFP4, introduced with its Blackwell GPUs, uses smaller blocks of 16 values with an FP8 E4M3 scale per block, plus a 32-bit floating-point scale per tensor. The smaller blocks and finer-grained scale make NVFP4 more accurate than MXFP4 at a slightly higher overhead. OpenAI released its gpt-oss models in 2025 with mixture-of-experts weights stored in MXFP4, which helped make the format a practical target for open runtimes. The general principle is that finer granularity reduces error at the cost of overhead bits and, sometimes, slower decoding. Most production formats settle on blocks of 16 to 128 weights. What makes language models hard Quantizing convolutional networks for mobile was largely a solved problem by 2020: eight-bit integers for weights and activations, per-channel weight scales, a little calibration, and accuracy losses of a fraction of a percent. Large language models broke this recipe, and understanding why is the key to everything that follows. The problem is activation outliers. In 2022, Tim Dettmers and colleagues, in the paper introducing the LLM.int8() method, reported that once transformer language models grow past roughly 6.7 billion parameters, a small number of hidden-state dimensions begin to carry values far larger than the rest — tens of times larger — and that these "emergent outlier features" appear systematically across most layers and most tokens. The outliers are few, a handful of dimensions out of thousands, but they are essential: zeroing them out destroys the model's performance. Outliers are fatal to naive activation quantization. If one dimension of the input to a matrix multiplication can reach a hundred while the rest stay below one, a per-tensor scale for that input must accommodate the hundred, and the small values — which carry most of the information — collapse to zero. LLM.int8() handled this by splitting the computation: the few outlier dimensions were multiplied in 16-bit precision and everything else in 8-bit. It worked, but the mixed-precision decomposition was slow. Later research added detail. Some outliers are tied to specific tokens, such as the beginning-of-sequence token or punctuation, and appear to function as "attention sinks" — places where attention heads park probability mass when they have nothing useful to attend to. A 2024 paper by Sun and colleagues described "massive activations" of this kind, values thousands of times larger than typical ones, concentrated in a few dimensions and positions. Weights have outliers too, though milder: a small fraction of weights have an outsized effect on output, and destroying them hurts disproportionately. Small models are not immune. Although the Dettmers paper located the emergence of systematic outliers at the multi-billion scale, models trained far past Chinchilla-optimal ratios, as small models now routinely are, often show quantization sensitivity that their size alone would not predict. A 2024 study by Kumar and colleagues on scaling laws for precision found that models trained on more data become harder to quantize after training — the more information is packed into each parameter, the more each rounding error costs. This is one reason why the best small models of 2026 are frequently shipped with vendor-produced quantization-aware checkpoints rather than left to post-training methods. Weights only, or weights and activations The outlier problem divides quantization into two families with different purposes. Weight-only quantization stores weights in a low-bit format and converts them back to 16-bit (or 8-bit) floating point just before multiplication; activations stay in higher precision. This saves memory and memory bandwidth — exactly what decode needs — without touching activation outliers. It is the dominant approach for edge generation, and it is what llama.cpp's GGUF formats, Apple's MLX quantization, and the GPTQ and AWQ methods primarily do. Weight-only quantization is described with notation such as W4A16: four-bit weights, sixteen-bit activations. Weight-and-activation quantization quantizes both inputs to each matrix multiplication, so the multiplication itself can run on low-precision integer or floating-point units: W8A8, W4A8 or W4A4. This speeds up compute-bound work — prefill and batched serving — and is often necessary to use neural processing units at all, since many NPUs have very fast integer pipelines and much slower floating-point ones. It requires dealing with activation outliers, which is the job of methods such as SmoothQuant and the rotation methods covered in a later chapter. A third target, the KV cache, has its own outlier structure — keys in particular tend to have outlier channels — and its own methods, also covered later. The edge practitioner therefore has to ask which resource is binding. For chat on a phone with a CPU or GPU, weight-only quantization addresses the bottleneck directly. For long-prompt applications where time to first token matters, or for deployment on an NPU, activation quantization becomes necessary too. Calibration and what to minimise The simplest way to quantize a weight matrix is round-to-nearest: compute a scale for each group from the group's minimum and maximum values, and round each weight to the nearest code. Round-to-nearest at eight bits is nearly lossless for most models. At four bits with small groups it is acceptable for many models but measurably worse than better methods. At three bits and below it usually fails. Better methods share an insight: the goal is not to make the quantized weights close to the original weights, but to make the quantized layer's outputs close to the original layer's outputs on realistic inputs. Two weights with the same rounding error can have very different effects, depending on how large the inputs that multiply them typically are. A weight attached to an input channel that is usually near zero can be rounded crudely; a weight attached to an outlier channel cannot. That requires knowing what realistic inputs look like, which is the role of calibration data: a small set of example texts — typically a few hundred sequences of a few thousand tokens — that are passed through the model to record activation statistics. Calibration is not training; no gradients flow through the model's weights. It is measurement. The choice of calibration data matters more than many practitioners expect. Older papers routinely calibrated on random excerpts from a web-text corpus or Wikipedia. For a chat model that will be used for code, or for a language other than English, or for a specific structured task, calibration on generic English prose under-represents the activation patterns that matter. The llama.cpp community's practice of building "importance matrices" from diverse calibration text, the use of instruction-formatted calibration data for chat models, and the inclusion of the target languages and domains all reflect this. A useful rule: calibration data should look like what the model will see in production, including its chat template, and should be diverse enough to activate the capabilities you care about. Two warnings about calibration. The first is overfitting: methods that optimise heavily against a small calibration set can produce a model that performs well on text like the calibration set and worse elsewhere. Evaluate on held-out data that differs from it. The second is that calibration statistics are only as good as their coverage of rare but important behaviours: if no calibration example exercises a tool-calling format, nothing in the quantization procedure protects the weights that implement it. Mixed precision Not all layers are equally sensitive. Across many models, the embedding and output projection matrices, the first and last few transformer blocks, and some attention projections are more sensitive than the large feed-forward matrices in the middle of the network. Practical recipes therefore mix precisions: llama.cpp's "Q4_K_M" format, for example, keeps certain tensors — parts of the attention value projections and feed-forward down projections in some layers — at higher precision than the nominal four bits, which is why it lands around 4.8 bits per weight on average for many models. Apple's on-device model keeps its embedding table at a different bit-width from its transformer weights. Sensitivity can be measured directly: quantize one layer at a time and observe the change in a quality signal such as perplexity on held-out text or divergence from the original model's output distribution. Some tools automate this, assigning more bits to sensitive layers within a fixed total budget. The gains are real but modest at four bits; at three bits and below, mixed precision becomes essential. A mental model of error It helps to think of quantization error as noise injected into each layer. Each matrix multiplication produces outputs equal to the true outputs plus an error term. Normalisation layers and residual connections dampen some of this noise, but errors accumulate across dozens of layers, and generation compounds them, because each generated token becomes input to the next step. A small per-layer error that barely moves a single-token benchmark can, over hundreds of generated tokens, steer the model into a different trajectory: a lost thread in a long answer, a broken JSON bracket, a slip into the wrong language. This explains a pattern familiar to anyone who has evaluated quantized models. Single-step metrics — perplexity, multiple-choice accuracy — degrade smoothly and modestly down to about four bits and then fall off a cliff. Multi-step behaviours — long-form generation, reasoning chains, agentic tool use — begin degrading earlier and less predictably. The rest of the quantization chapters are about reducing per-layer error in increasingly sophisticated ways; the evaluation chapter is about detecting the cumulative effects that per-layer metrics miss. Chapter 4. Post-Training Weight Quantization Post-training quantization (PTQ) compresses a trained model without further training. It needs only the model, a small calibration set and, for the better methods, a GPU for minutes to a few hours. Because it is cheap, it is the first thing to try and, for most edge deployments, the last thing needed. This chapter covers the main methods for quantizing weights after training: what each does, why it works, where it breaks, and how the practical file formats of the edge ecosystem relate to the research methods behind them. The baseline: round-to-nearest with groups Every method should be compared against the simplest one. Group-wise round-to-nearest (RTN) divides each weight row into groups of, say, 32 or 128 values, computes a scale (and possibly an offset) from each group's range, and rounds. It needs no calibration data and runs in seconds. At 8 bits, RTN is effectively lossless for nearly all language models, and 8-bit weight files, such as llama.cpp's Q8_0, are a sensible default when memory permits. At 6 and 5 bits with small groups it remains close to lossless. At 4 bits it works acceptably for many models but leaves quality on the table compared with calibrated methods, and the gap widens for small, heavily trained models. At 3 bits, RTN usually produces visibly degraded output; at 2 bits, gibberish. The methods below exist to push the "acceptable" boundary down by one or two bits. They do this by using information RTN ignores: how the inputs to each layer are distributed, and how errors in one weight can be compensated by adjustments to others. GPTQ: compensating errors as you go GPTQ, published by Elias Frantar, Saleh Ashkboos, Torsten Hoefler and Dan Alistarh in 2022 and presented at ICLR 2023, was the method that first made 4-bit and 3-bit weight quantization of very large language models practical. The authors reported quantizing models with 175 billion parameters in roughly four GPU hours. Its core idea comes from an older line of work on network pruning, the "Optimal Brain Surgeon" framework of the early 1990s, which asked: if I remove or perturb one weight, how should I adjust the remaining weights to minimise the change in the layer's output? For a linear layer and a squared-error objective, the answer depends on the second-order statistics of the layer's inputs, summarised in a matrix often called the Hessian, computed from calibration data as the sum of outer products of input vectors. GPTQ applies this one column at a time. It quantizes the first column of a weight matrix, measures the error introduced, and then updates all not-yet-quantized columns to compensate for that error, using the inverse Hessian to decide how much each should move. Then it quantizes the next column, and so on. Errors from early columns are absorbed by later ones. The algorithmic contributions of the paper were the engineering that made this tractable for billions of weights: processing columns in a fixed order shared across rows, batching updates in blocks for GPU efficiency, and a Cholesky-based reformulation for numerical stability. In practice GPTQ is used with group-wise scales (often groups of 128) and sometimes with "act-order," which quantizes columns in order of decreasing activation magnitude so that the most important columns are handled first, while later columns absorb their errors. GPTQ quantizes a small model in minutes on a single GPU. GPTQ's weakness is a tendency to overfit its calibration set. Because it actively adjusts weights to minimise error on the calibration inputs, a calibration set unrepresentative of real use can produce a model that is well tuned to the wrong distribution. Diverse, task-representative calibration data matters more for GPTQ than for methods that only choose scales. AWQ: protect the salient channels AWQ (Activation-aware Weight Quantization), from Ji Lin, Song Han and colleagues at MIT, was published in 2023 and received a best paper award at MLSys 2024. It starts from an observation: not all weights are equally important, and the important ones can be identified not by looking at the weights themselves but at the activations they multiply. Weights in input channels that typically see large activations matter far more to the output than weights in channels that see small ones. The authors reported that keeping roughly one percent of these salient weight channels in higher precision recovered much of the loss from 4-bit quantization. Mixed-precision storage is awkward for hardware, so AWQ instead uses a mathematical trick. Multiplying a weight channel by a factor greater than one and dividing the corresponding input activation by the same factor leaves the layer's output unchanged in exact arithmetic. But after quantization, the scaled-up weights occupy more of the quantization grid, so their relative rounding error falls. AWQ searches, per layer, for scaling factors that minimise output error on calibration data, folds the inverse scaling into the preceding operation (often a normalisation layer), and then quantizes with ordinary group-wise RTN. Because AWQ only chooses per-channel scales rather than rewriting individual weights, it is less prone to overfitting the calibration set than GPTQ and tends to generalise well across domains, including to instruction-tuned and multimodal models. It is also fast. AWQ and GPTQ are often combined or compared directly; the honest summary of the literature is that at 4 bits with group size 128 both are good, the winner varies by model, and both are better than RTN at the same bit-width. HQQ and calibration-free methods Sometimes calibration data is unavailable or calibration is undesirable — for example, when quantizing on the fly at load time. Half-Quadratic Quantization (HQQ), published by Mobius Labs in 2023, optimises scales and zero-points per group to minimise weight-reconstruction error under a robust loss, without any calibration data, and runs in seconds to minutes. It is better than plain RTN and competitive with calibrated methods at 4 bits for some models, though it lacks the activation awareness that makes AWQ and GPTQ stronger at lower bit-widths. The general lesson is that calibration-free methods are fine at 4 bits and above for robust models; below that, information about the input distribution becomes indispensable. The llama.cpp family: k-quants and importance matrices The most widely used quantized format at the edge is not a research paper's output but the GGUF file format of the llama.cpp project, created by Georgi Gerganov and maintained by a large open community. GGUF is a single-file container that stores the model's weights in a variety of quantized types along with its tokenizer, configuration and chat template. It is the native format of llama.cpp and of the tools built on it, such as Ollama and LM Studio. GGUF's quantization types fall into three generations. The legacy types, such as Q4_0 and Q8_0, are block-wise RTN with blocks of 32 weights and a 16-bit scale per block (Q4_1 adds an offset). Q8_0 remains a good near-lossless baseline. Q4_0 is coarse but has the advantage of very simple decoding, which has made it a favoured target for hardware-specific kernels on ARM CPUs and for some accelerator backends. The k-quants, contributed by Iwan Kawrakow in 2023, use super-blocks of 256 weights subdivided into smaller blocks, with block scales and minimums themselves quantized to a few bits. The types run from Q2_K through Q6_K, with suffixes S, M and L indicating mixes in which more sensitive tensors receive higher-precision types. Q4_K_M has become the community's default "good 4-bit" choice, averaging somewhat under 5 bits per weight once its mixed tensors are counted; Q5_K_M and Q6_K are near-lossless for most models. The i-quants (IQ1 through IQ4 types, also largely Kawrakow's work) bring ideas from the research frontier — lattice-based codebooks, discussed below — into the format, making 2- and 3-bit files usable for larger models. IQ4_XS, at about 4.25 bits per weight, often matches or beats Q4_K_M in quality at a smaller size, at the cost of somewhat more expensive decoding on some hardware. What lifts these formats above RTN is the importance matrix (imatrix). Running the model over a calibration text, llama.cpp records, for every weight matrix, the average squared magnitude of the activations reaching each input channel. During quantization, the rounding and scale selection for each block minimise an error weighted by these importances, so that weights in channels that see large activations are reproduced more faithfully. This is the same insight as AWQ, implemented as a weighted rounding objective rather than a scaling transform, and it makes a large difference at low bit-widths; the community's guidance is that the i-quants in particular should not be used without one. Two practical points follow. First, imatrix files vary in quality with their calibration text, and the community has iterated on diverse calibration sets that mix prose, code, multiple languages and chat-formatted data. Second, because GGUF quantizations are cheap to produce, model hubs host many variants of every popular model, produced by different people with different calibration data. They are not interchangeable, and a quality difference between two files with the same type name is entirely possible. Other ecosystems Different runtimes use different formats, and the methods above appear in several guises. MLX, Apple's array framework for its silicon, quantizes weights with group-wise affine quantization (scales and biases per group, commonly groups of 64) at 2 to 8 bits, and has added further types since; the MLX community publishes converted models on Hugging Face. MLX quantization has historically been closest to RTN, though calibrated methods such as AWQ-style scaling and learned rounding have been added to its tooling. Core ML, Apple's deployment framework, supports palettization (non-uniform codebooks of 1 to 8 bits, optionally per-group), linear quantization, and pruning, through its coremltools optimisation API. Palettization suits Apple's Neural Engine, which handles lookup-table weights efficiently. GPU-serving formats built around GPTQ and AWQ — produced with tools such as vLLM's llm-compressor and GPTQModel — target Linux machines with NVIDIA or AMD GPUs and are relevant at the edge mainly on workstation-class or embedded GPU boards such as NVIDIA's Jetson line. ExLlama's EXL2 and EXL3 formats allow fractional average bit-widths with per-layer mixing, popular among enthusiasts with consumer GPUs. Mobile and NPU toolchains — ExecuTorch with its backends, Google's LiteRT and its LLM runtime, Qualcomm's AI Engine tools, ONNX Runtime and its GenAI extension — generally implement group-wise integer weight quantization with calibrated methods, plus 8-bit or 16-bit activations where an accelerator requires them. The chapter on runtimes discusses how to match these. Below four bits: vectors and lattices At 4 bits, scalar methods with good calibration are nearly lossless for many models. Below about 3.5 bits, scalar quantization runs into a geometric limit: with only four or eight levels per weight, the grid is too coarse no matter how cleverly scales are chosen. Two ideas break through. The first is incoherence processing. QuIP, published by Chee, Cai, Kuleshov and De Sa in 2023, observed that quantization is easier when weights have no outliers and are spread evenly — "incoherent" in their terminology. It is possible to make them so by multiplying the weight matrix on both sides by random orthogonal matrices, which preserves the layer's function (the inverse rotation is applied to inputs and outputs) while spreading any large values across all entries. QuIP# (Tseng, Chee, Sun, Kuleshov and De Sa, ICML 2024) made this efficient using randomised Hadamard transforms, which can be applied quickly, and combined it with the second idea. The second is vector quantization. Instead of rounding each weight independently, group weights into short vectors — say, eight at a time — and replace each vector with the nearest entry in a codebook of representative vectors, storing only the index. At 2 bits per weight, an 8-dimensional vector needs a 16-bit index, so the codebook has 65,536 entries. Because the codebook can be shaped to the joint distribution of weights, vector quantization achieves lower error than scalar quantization at the same bit rate. QuIP# uses a codebook derived from the E8 lattice, a highly symmetric arrangement of points in eight dimensions known to give exceptionally dense sphere packings, which can be decoded quickly without storing the whole codebook. AQLM (Egiazarian and colleagues, ICML 2024) uses learned additive codebooks, representing each vector as a sum of entries from several codebooks, and fine-tunes them. QTIP, from the same Cornell group, uses trellis-coded quantization to go further still. These methods made 2-bit quantization of large models produce coherent, useful text for the first time, and they inspired the llama.cpp i-quants. For small models on edge devices their practical value is more limited, for two reasons. Decoding codebook-quantized weights is more expensive than unpacking scalar ones, which matters when the device is bandwidth-bound but has modest compute. And small models have less redundancy to begin with: a 2-bit eight-billion-parameter model and a 4-bit four-billion-parameter model occupy similar memory, and the evidence from the community's experience is that the larger model at 2 bits is not reliably better, while it is reliably more fragile on multi-step tasks. Where 2- and 3-bit weights are needed on phones, quantization-aware training, covered in a later chapter, is usually the stronger route, as Apple's 2-bit on-device model illustrates. Choosing among methods Table 2 summarises the main weight-only PTQ approaches along the dimensions that matter for an edge decision. The entries are qualitative and reflect the published descriptions of each method and common practice rather than a controlled benchmark. Table 2. Weight-only post-training quantization methods compared (qualitative, from the methods' original papers and common practice). Method Needs calibration Core mechanism Typical sweet spot Main caution Group-wise RTN No Round each group to its own scale 8–5 bits; acceptable at 4 Degrades fast below 4 bits HQQ No Optimise scales and zero-points per group 4 bits, quick at load time Lacks activation awareness GPTQ Yes Second-order error compensation across columns 4 and 3 bits Can overfit calibration data AWQ Yes Activation-aware per-channel scaling, then RTN 4 bits Gains shrink at very low bits llama.cpp k-quants with imatrix Yes (imatrix) Super-block scales, importance-weighted rounding Q4_K_M to Q6_K Variant quality depends on producer QuIP#, AQLM, QTIP, i-quants Yes Rotations plus vector or lattice codebooks 2 to 3 bits Decode cost; fragile on small models For most edge projects the decision collapses to a short rule. Start at 4-bit group-wise weights with a calibrated method native to your runtime — an imatrix-calibrated Q4_K_M or IQ4_XS for llama.cpp, AWQ or GPTQ for GPU runtimes, the vendor toolchain's calibrated mode for NPU targets. Evaluate. If quality is adequate and the model fits, stop. If memory is still too tight, first consider a smaller base model at 4 bits; only then consider 3 bits with mixed precision and careful calibration, and treat 2 bits as territory for quantization-aware training. If quality at 4 bits is inadequate, try 5 or 6 bits for the most sensitive layers, try a better calibration set, and consider low-rank recovery, covered in its own chapter. Above all, judge every quantized artefact by evaluation on your own tasks rather than by its type name. Two "Q4" files of the same model can differ more than a Q4 and a Q5 file, and the difference shows up first where your product is most demanding. Chapter 5. Activations, the KV Cache and Rotations Weight-only quantization addresses the decode bottleneck, but it leaves two costs untouched. The first is compute during prefill, which matters whenever prompts are long and time to first token is visible to users; it also matters whenever the target hardware is a neural processing unit whose fast pipelines operate on low-precision integers. The second is the key–value cache, which for long contexts can dwarf the weights in both memory and per-token traffic. Both problems run into the activation outliers described in the fundamentals chapter. This chapter covers the methods that tame them: smoothing, rotation, specialised cache quantization, and the new four-bit floating-point formats that hardware now supports directly. Why activations resist quantization Recall the structure of the problem. A linear layer computes Y = XW, where X is a matrix of activations (one row per token) and W is the weight matrix. To run this on integer hardware, both X and W must be quantized. Weights are fixed and can be quantized offline with care. Activations change with every input and must be quantized on the fly, usually with a scale computed from a calibration set (static quantization) or from the actual values at runtime (dynamic quantization). The trouble is that activations in language models have a few input channels with enormous values. With per-tensor or per-token activation scales — the granularities that keep integer matrix multiplication efficient — those channels set the scale, and everything else is crushed. Per-channel activation scales would solve the problem, but they cannot be factored out of the matrix multiplication, because the scale varies along the dimension that the multiplication sums over. The integer hardware would have to rescale each product individually, defeating the purpose. So the outliers have to be dealt with before quantization. There are three broad strategies: keep them in higher precision (as LLM.int8() did, at the cost of speed); shift them into the weights, where offline quantization can cope; or spread them out so that no channel stands out. SmoothQuant: moving the difficulty SmoothQuant, by Guangxuan Xiao, Ji Lin, Song Han and colleagues, presented at ICML 2023, takes the second route. It uses the same mathematical identity as AWQ: dividing an activation channel by a factor and multiplying the corresponding weight row by the same factor leaves the product unchanged. If a channel's activations are a hundred times larger than typical, dividing them by, say, ten and multiplying the weights by ten makes both tensors moderately hard to quantize instead of one being impossibly hard. The factor per channel is chosen by a "migration strength" parameter, usually written α, which balances how much difficulty is transferred: the scale is the activation's maximum magnitude raised to α, divided by the weight's maximum magnitude raised to 1 − α. The paper found α around 0.5 worked for many models, with some needing more. The scaling is folded offline into the preceding normalisation layer's parameters, so it costs nothing at inference time. SmoothQuant made W8A8 inference — 8-bit weights and 8-bit activations with integer matrix multiplication — accurate for large language models, roughly halving memory and speeding up compute on hardware with fast INT8 units. It became a standard component in data-centre inference stacks and in vendor toolchains for NPUs. Its limitation is the bit-width: at 4-bit activations, smoothing alone is not enough, because the remaining spread in both tensors exceeds what sixteen levels can represent. Rotations: spreading the outliers The third strategy — spread the outliers out — is where most of the progress since 2024 has come from. The idea, introduced for weights by QuIP and extended to activations by later work, is to multiply activations by an orthogonal matrix before quantization. An orthogonal transformation preserves lengths and angles; it can be undone exactly by multiplying by its transpose. If a vector has one huge entry and many small ones, a well-chosen rotation turns it into a vector whose entries are all of moderate size — the energy of the outlier is spread across every dimension. A vector with no outliers quantizes well. Crucially, in a transformer many such rotations can be absorbed into the weights. Consider a sequence of linear layers with a residual stream between them. If the residual stream is rotated by an orthogonal matrix Q, every weight matrix that reads from the stream can be pre-multiplied by Q's transpose and every matrix that writes to it post-multiplied by Q, and the network computes exactly the same function — provided the normalisation layers commute with the rotation, which RMSNorm (used in most modern models) does after a small adjustment that folds its scaling parameters into adjacent weights. The rotation then costs nothing at runtime. A few rotations cannot be absorbed — for example, inside the attention computation or before the feed-forward down projection — and must be applied online, but Hadamard matrices, which contain only +1 and −1 entries (scaled), can be applied with a fast transform costing a small fraction of a matrix multiplication. QuaRot, by Ashkboos and colleagues (2024), used randomised Hadamard rotations in this way to remove outliers from the residual stream, the attention inputs and the KV cache, and reported end-to-end 4-bit quantization of weights, activations and cache for Llama 2 models with modest quality loss. SpinQuant, from Meta researchers Zechun Liu and colleagues (2024, presented at ICLR 2025), showed that random rotations vary considerably in quality and that rotations can instead be learned, optimising them on calibration data on a mathematical surface that keeps them orthogonal. Meta subsequently used SpinQuant to produce one of its official quantized Llama 3.2 1B and 3B variants for mobile deployment, alongside a quantization-aware-trained variant. Rotation methods have three practical implications for edge work. First, they are compatible with weight-only methods: one can rotate and then apply GPTQ to the rotated weights, and this combination is among the strongest post-training recipes at 4 bits and below. Second, they make 4-bit activations — and therefore 4-bit integer or floating-point matrix multiplication — feasible, which matters on hardware with fast 4-bit units. Third, they need runtime support for the online rotations, which not every edge runtime provides; check before choosing a rotation-based checkpoint. Quantizing the KV cache The KV cache deserves its own treatment, because its statistics differ from those of weights and of other activations, and because for long contexts it is often the dominant cost. The key observation, documented in work such as KIVI (Zirui Liu and colleagues, ICML 2024) and KVQuant (Coleman Hooper and colleagues, NeurIPS 2024), is that keys and values have different outlier structures. Keys tend to have a few channels with consistently large magnitudes across tokens; values do not, but vary more from token to token. KIVI therefore quantizes keys per-channel and values per-token, and reported usable 2-bit caches with careful handling of the most recent tokens, which are kept in full precision until a group fills up. KVQuant added further refinements: quantizing keys before the rotary position embedding is applied (because rotary embeddings mix channels and smear the outliers in a way that hurts quantization), using non-uniform per-layer codebooks, and storing a small number of outlier values separately in sparse form. In mainstream edge runtimes, the practical options are more conservative. llama.cpp supports storing the cache in 8-bit (q8_0) and 4-bit types, configurable separately for keys and values. Apple reports quantizing its on-device model's KV cache to 8 bits. For most deployments, an 8-bit cache roughly halves cache memory with negligible quality loss; a 4-bit cache halves it again and is usually acceptable for values but riskier for keys, particularly at long context lengths, where small errors in attention scores across thousands of positions accumulate into misdirected attention. As always, test on long-context tasks specifically; a short-prompt benchmark will not reveal a cache-quantization problem. Quantization is not the only way to shrink the cache. Architectural measures — grouped-query attention, sliding-window layers, hybrid linear-attention designs, and the cross-layer KV sharing used in Apple's on-device model, in which a later block of layers reuses the cache produced by an earlier block — reduce the cache by design and were discussed in the chapter on choosing a model. Apple's 2025 technical report describes splitting its roughly three-billion-parameter on-device model into two blocks, with the second block, containing 37.5 percent of the layers, having its key and value projections removed and reading the first block's cache, cutting cache memory by 37.5 percent. Eviction methods keep only a subset of past tokens. The StreamingLLM work of Xiao and colleagues (2023) found that keeping the first few tokens — the attention sinks — plus a sliding window of recent tokens allowed models to run stably over very long streams, though it does not let the model recall information from evicted tokens. Methods such as H2O and SnapKV choose which tokens to keep based on accumulated attention scores. Eviction trades recall for memory and is risky for tasks that require retrieving a specific fact from a long document, which is precisely when long contexts are most needed. The right combination depends on the product. A chat assistant with conversations of a few thousand tokens can use an 8-bit cache and stop worrying. A document-question-answering app processing tens of thousands of tokens on a phone needs a model with an efficient attention architecture, a quantized cache, and careful testing of retrieval accuracy at the far end of the context. Four-bit floating point in hardware Until recently, low-precision inference on most hardware meant integers: INT8 everywhere, INT4 on some accelerators. Since 2024 the hardware landscape has shifted toward small floating-point formats with block scales, and this has changed what is practical. The microscaling formats introduced in the fundamentals chapter — MXFP8, MXFP6 and MXFP4 under the Open Compute Project specification, and NVIDIA's NVFP4 — store blocks of low-precision floating-point values with a shared scale per block. NVIDIA's Blackwell GPUs execute FP4 matrix multiplications natively, as do AMD's MI355X data-centre accelerators for MXFP4. The edge relevance comes through two routes. One is workstation and embedded GPUs: NVIDIA's consumer and embedded Blackwell parts support FP4 tensor operations, and the llama.cpp project merged NVFP4 support across several backends in the spring of 2026. The other is models released natively in these formats: OpenAI's gpt-oss models, released in August 2025, shipped their expert weights in MXFP4, making the smaller of them, with about 21 billion total parameters, runnable on machines with around 16 gigabytes of memory. Block-scaled FP4 has two advantages over INT4 for activations. The logarithmic spacing of floating-point values fits bell-shaped distributions better than a uniform grid. And the small blocks — 16 or 32 values — mean that an outlier only affects the scale of its own block rather than a whole row. Research from NVIDIA and others has shown NVFP4 retaining accuracy on large models at 4-bit weights and activations with appropriate calibration, and some groups have trained models directly in FP4 precision. On phones and NPUs the picture is more varied. Mobile NPUs have generally offered fast INT8 and INT4 (and in some cases INT16 and FP16) paths; support for micro-scaled floating-point formats is arriving but uneven, and each vendor's toolchain dictates which formats compile efficiently. Here, more than anywhere, the practical rule is to start from what the hardware accelerates and choose the quantization method to fit, rather than the other way around. Putting activation quantization to work For the edge practitioner, the decision whether to quantize activations reduces to three questions. Is prefill time a problem? If the application has short prompts and the main complaint is decode speed, weight-only quantization addresses the bottleneck and activation quantization adds risk for little gain. If prompts are long — retrieval-augmented generation, document processing, agents with large tool schemas — and time to first token is unacceptable, activation quantization on a compute-capable accelerator is the lever. Does the target accelerator require it? Many NPUs execute integer arithmetic far faster than floating point, and some execute only quantized integer graphs efficiently. Deploying to such an NPU means producing a W8A8, W8A16 or W4A8-style model in the vendor's format, with calibrated activation scales. The vendor toolchains — Qualcomm's AI Engine Direct and AI Hub, MediaTek's NeuroPilot, Apple's Core ML tools, Intel's OpenVINO, AMD's Ryzen AI software — each implement calibration routines, often including SmoothQuant-style smoothing, and each has its own list of supported patterns. How long are the contexts? If they are long, cache quantization and cache-efficient architecture move from optional to essential, and long-context evaluation must be part of the test plan. A common, robust configuration for phones in 2026 is 4-bit group-wise weights, 8- or 16-bit activations, and an 8-bit KV cache, with the most sensitive layers kept at higher precision. More aggressive settings — 4-bit activations with rotations, 4-bit or lower caches — can pay off, but each step down should be justified by a measured bottleneck and verified by an evaluation that would catch its specific failure mode. Chapter 6. Quantization-Aware Training and the Sub-Four-Bit Frontier Post-training methods ask the model to put up with quantization. Quantization-aware training (QAT) teaches the model to expect it. The model is trained, or fine-tuned, with quantization simulated in its forward pass, so that its weights settle into values that survive rounding. The cost is training compute and data; the reward is accuracy at bit-widths where post-training methods break down, and markedly better 4-bit models than post-training methods can deliver for the most heavily trained small models. This chapter explains how QAT works, how it has been used in shipped products, and what lies at the far end of the spectrum — models trained from the start with ternary weights. How simulated quantization trains The central difficulty is that rounding has no useful gradient. The function round(x) is flat almost everywhere, with jumps at the half-integers; its derivative is zero or undefined. If a training loop computes the loss through quantized weights, back-propagation reports that small changes to the underlying weights have no effect, and nothing learns. The standard workaround is the straight-through estimator (STE), described by Yoshua Bengio, Nicholas Léonard and Aaron Courville in 2013. In the forward pass the model uses quantized weights: each full-precision "shadow" weight is scaled, rounded, clipped and rescaled, a procedure often called fake quantization because the values are still stored in floating point but restricted to the quantization grid. In the backward pass the rounding is treated as if it were the identity, passing the gradient straight through to the shadow weight (usually with the gradient zeroed for values clipped outside the range). The shadow weights accumulate small updates; occasionally an update pushes a weight across a rounding boundary and its quantized value changes. Over many steps, the network finds a configuration whose quantized version performs well. The scales can be learned too. LSQ (Learned Step Size Quantization, Esser and colleagues, 2019) treats each quantizer's step size as a trainable parameter with its own gradient estimate, and variants of this idea are standard. Some methods learn rounding decisions directly: AdaRound (Nagel and colleagues, 2020) learns, for each weight, whether to round up or down by optimising a layer-wise reconstruction objective, sitting between pure post-training methods and full QAT. OmniQuant (Shao and colleagues, 2023) learns clipping ranges and equivalent transformations block by block on calibration data. Such "learned PTQ" methods use gradients but only a small calibration set and a few GPU hours, and they occupy a useful middle ground. The quality of QAT depends heavily on what the model is trained toward. Fine-tuning on raw text with the ordinary next-token loss can drift the model away from its instruction-tuned behaviour, especially if the QAT data differs from the original post-training data. The better practice, now widespread, is self-distillation: train the quantized model to match the output probability distribution of the original full-precision model on a broad set of inputs. The unquantized model is the teacher, its own quantized self the student. Because the teacher provides a full distribution over the vocabulary at every position rather than a single correct token, each training example carries far more signal, and the student is pulled toward preserving the teacher's behaviour rather than learning anything new. When Google released QAT checkpoints of its Gemma 3 models in April 2025, it described running QAT for about 5,000 steps using the probabilities from the non-quantized checkpoint as targets, and reported that this reduced the perplexity drop from quantizing to llama.cpp's Q4_0 format by 54 percent. The 4-bit Gemma 3 4B model's weights fell from 8 gigabytes in bfloat16 to 2.6 gigabytes. QAT in shipped products QAT has moved from research into the standard practice of model vendors, and several published cases show how it is used. Apple's on-device model. Apple's 2025 technical report on its foundation models describes compressing its approximately three-billion-parameter on-device model to 2 bits per weight using quantization-aware training, with the embedding table quantized to 4 bits through joint training with the base weights during QAT, and the KV cache stored at 8 bits. Apple further describes training low-rank adapters to recover quality lost during compression — a pattern discussed in the low-rank chapter. The decision to go to 2 bits reflects the device budget: a 3-billion-parameter model at 2 bits occupies well under a gigabyte for its transformer weights, which leaves room on an iPhone for everything else and roughly halves the bytes read per token relative to a 4-bit version. Meta's quantized Llama 3.2. In October 2024 Meta released quantized versions of its Llama 3.2 1B and 3B models intended for mobile deployment through ExecuTorch. One variant used QAT combined with low-rank adapters ("QLoRA" in Meta's description), trained in Meta's own post-training pipeline; the other used SpinQuant, a post-training rotation method. Both used a 4-bit group-wise scheme for transformer weights, 8-bit per-channel weights for the embedding and output layers, and 8-bit dynamic activation quantization. Meta reported that the QAT variant retained quality closer to the original than the post-training variant, consistent with the general pattern, while the SpinQuant variant offered a route for developers who wanted to quantize their own fine-tuned models without access to Meta's training data. Google's Gemma line. Beyond the Gemma 3 QAT checkpoints, Google's mobile-oriented releases have increasingly been accompanied by quantized checkpoints prepared by the vendor, and Gemma 4's small models were published with formats targeting phone deployment through LiteRT and Android's AICore. Reported memory figures for the smallest Gemma 4 model at 2-bit quantization on a Raspberry Pi 5 put it under 1.5 gigabytes. The pattern across vendors is consistent. Where the vendor controls the training pipeline and cares about the deployed quality, it uses QAT with self-distillation. Where it wants to give developers a recipe they can apply to their own fine-tunes, it offers a post-training method. Developers should take vendor QAT checkpoints when they exist and fit the target format, because reproducing them requires data and compute that most teams lack. Doing QAT yourself For teams that need a bit-width or format no vendor provides, or that have fine-tuned a model and want to quantize the result well, QAT is feasible with modest resources for small models. The essential ingredients are: A teacher: the full-precision model you want to preserve, typically your fine-tuned checkpoint. A data mix representative of the model's intended use: instruction-formatted conversations, the languages and domains of the product, examples of structured output and tool calling if those matter. The data need not be labelled; the teacher supplies targets. Several hundred million tokens is a typical scale reported for small models, but meaningful gains often appear far earlier, and the right amount is found by monitoring evaluation metrics. A quantization scheme that exactly matches the deployment format. This point is easy to get wrong and expensive when wrong. If the model will be deployed in a format with groups of 32 and a particular rounding and scale encoding, the fake quantization during training must reproduce that scheme exactly, including which tensors stay at higher precision; otherwise, the model learns to tolerate a different noise from the one it will meet. PyTorch's torchao library provides QAT tooling designed to export to ExecuTorch formats, and vendor toolchains provide their own. A training configuration with a low learning rate, since the goal is to nudge rather than retrain: typical setups use learning rates an order of magnitude below those of the original fine-tuning, and many recipes freeze some components, such as normalisation parameters. Some teams start with a few hundred steps of training with quantization disabled to settle the pipeline, then switch it on. Evaluating periodically on the product's own evaluation set is essential, both to decide when to stop and to catch regressions in capabilities not represented in the training mix. The cost is a few GPU-days for a model of a few billion parameters at 4 bits — more at lower bit-widths — which is a small fraction of the original training cost and well within reach of a serious product team. An alternative for teams with less compute is to combine post-training quantization with a short low-rank recovery fine-tune: quantize with GPTQ or AWQ, freeze the quantized weights, and train low-rank adapters in higher precision to absorb the quantization error, again distilling from the original model. The low-rank chapter treats this in detail. It is cheaper than full QAT and recovers much of the same quality, at the cost of carrying adapter weights at inference or merging them back (which re-quantizes and partly undoes the recovery unless done carefully). Below two bits: ternary and binary models At the far end of the spectrum lie models whose weights take only three values, −1, 0 and +1, or only two. Post-training methods cannot reach this point for useful language models; the weights must be trained in this form from the beginning, or nearly so. Microsoft Research's BitNet line has pursued this most visibly. The original BitNet paper (2023) trained transformers with binary weights. "The Era of 1-bit LLMs" (Shuming Ma and colleagues, 2024) introduced BitNet b1.58, so named because a ternary weight carries log₂ 3 ≈ 1.58 bits of information, and argued that ternary models trained from scratch could match full-precision models of the same size once the models were large enough. In April 2025 Microsoft released BitNet b1.58 2B4T, a 2-billion-parameter ternary model trained on 4 trillion tokens, with open weights, describing it as the first open-source native 1-bit language model at that scale and reporting performance on par with full-precision open-weight models of similar size. Its activations are quantized to 8 bits. Microsoft also released bitnet.cpp, an inference framework with CPU kernels designed for ternary weights. Ternary weights are attractive at the edge for two reasons beyond size. Multiplying by −1, 0 or +1 requires no multiplier: matrix multiplication becomes addition and subtraction, which can be done with very cheap logic and, in principle, very low energy. And memory per weight falls below 2 bits, giving a large reduction in bandwidth. The practical limitations are equally clear. Ternary models must be trained from scratch (or at least from an early checkpoint) with the ternary constraint in place, so a team cannot take an existing strong model and convert it; it depends on someone with substantial pre-training resources choosing to train one. The open ternary models available as of 2026 are few and small compared with the abundance of conventional small models. And the hardware advantage is largely theoretical on current devices: mainstream CPUs, GPUs and NPUs have no native ternary arithmetic, so runtimes implement ternary matrix multiplication with lookup tables or packed integer tricks. These can be efficient — bitnet.cpp's kernels exploit exactly such tricks — but the dramatic energy savings that ternary arithmetic promises require purpose-built silicon that does not yet exist in consumer devices. The ternary approach is therefore best seen as an important research direction and a signal of where hardware might go, rather than a default choice. For a product being built today, a well-trained conventional small model with 4-bit QAT, or 2-bit QAT where the vendor has done it, is more likely to deliver. Scaling laws for precision A question that runs underneath this whole chapter is whether it is better to have a larger model at lower precision or a smaller model at higher precision, for the same number of bytes. The answer has shifted as models have changed. Early studies in 2022 and 2023, working with models trained near Chinchilla-optimal ratios, generally found that for a fixed memory budget, 4-bit quantization of a larger model beat 8-bit or 16-bit storage of a smaller one, and Dettmers and Zettlemoyer's study of "k-bit inference scaling laws" (2023) concluded that 4 bits was close to optimal for zero-shot accuracy per bit across many model families. That finding underpinned the community's settling on 4-bit as the default. Later work complicated the picture. The 2024 "Scaling Laws for Precision" paper by Tanishq Kumar and colleagues modelled how both training and inference precision interact with model size and data, and reported that post-training quantization degrades models more the more data they were trained on — to the point where, past some amount of training data, additional pre-training data can make the quantized model worse. The authors' interpretation was that heavily trained models pack more information into each weight, leaving less slack for rounding. Since small edge models are among the most heavily overtrained models in existence, this is directly relevant: it predicts that small modern models will be more sensitive to aggressive post-training quantization than older or larger models, and that QAT — which lets the model adapt to its precision — becomes more valuable as training data grows. The practical upshot is consistent with what vendors actually do. Four bits remains the natural default for post-training quantization. Going lower with post-training methods is increasingly risky for the best small models. Going lower with QAT is viable, and is how the most aggressive on-device deployments — such as Apple's 2-bit model — have been built. Choosing a larger model at very low post-training precision over a smaller model at 4 bits is a bet that should be tested rather than assumed. Choosing between PTQ and QAT The decision can be framed in terms of the two budgets. If a calibrated 4-bit post-training quantization of a suitable model meets both the device budget and the quality floor, stop there; QAT is an expense without a reason. If the device budget demands fewer bits than post-training methods can deliver at acceptable quality — typically 3 bits or below — QAT, or a vendor's QAT checkpoint, is the route. If 4-bit post-training quantization fits the device budget but falls just short of the quality floor on the capabilities the product needs, there are three options in rough order of cost: improve the calibration data and keep sensitive layers at higher precision; train low-rank recovery adapters with self-distillation; or run full QAT. And if the model has been fine-tuned for the product, as most deployed models are, the quantization step should be planned as part of fine-tuning rather than bolted on after it, because the cheapest time to make a model robust to quantization is while it is already being trained. Chapter 7. Pruning: What Removal Actually Buys Pruning is the oldest idea in neural network compression and the one most often misunderstood at the edge. The idea is simple: many weights in a trained network contribute little, so remove them. Papers routinely report that half the weights of a large language model can be removed with modest loss of quality. Yet the number of edge deployments that ship an unstructured-pruned language model is tiny. The reason is the arithmetic of the first chapter: a removed weight saves something only if the storage format and the hardware can turn its absence into fewer bytes moved or fewer operations performed. This chapter separates the kinds of pruning by what they actually buy, explains the main methods, and identifies the cases where pruning genuinely belongs in an edge pipeline. Three kinds of removal Unstructured pruning sets individual weights to zero wherever they fall. It offers the most flexibility — the algorithm can remove exactly the least important weights — and therefore the least quality loss for a given fraction removed. But the zeros are scattered. A dense matrix with half its entries zero still occupies the same memory and takes the same time to multiply unless the runtime uses a sparse storage format (storing only non-zero values and their positions) and sparse kernels. Sparse formats carry index overhead: at 50 percent sparsity, the bytes saved on values are partly spent on indices, and the irregular memory access patterns of sparse multiplication run poorly on CPUs, GPUs and NPUs designed for dense blocks. In practice, unstructured sparsity below roughly 70 to 80 percent rarely speeds up inference on general-purpose edge hardware, and language models cannot usually be pruned that far without severe damage. Semi-structured pruning, most commonly the 2:4 pattern, requires that in every contiguous group of four weights, at least two be zero. NVIDIA introduced hardware support for this pattern with its Ampere GPUs in 2020: sparse tensor cores store only the two non-zero values per group plus a small 2-bit index for each, and execute the multiplication at up to twice the throughput of the dense equivalent. The pattern is a compromise — less flexible than unstructured pruning, so it costs more quality at the same 50 percent sparsity, but genuinely accelerated on supporting hardware. The catch for edge work is that support is concentrated in NVIDIA GPUs, including the embedded Jetson line; mainstream phone NPUs and CPUs have historically not accelerated 2:4 sparsity, although some vendors' newer accelerators advertise sparsity support of various kinds, which should be verified for the specific chip and toolchain. Structured pruning removes whole units: entire neurons in the feed-forward layers (rows and columns of the weight matrices), entire attention heads, entire channels of the hidden dimension, or entire transformer layers. The result is simply a smaller dense model, which every runtime and every accelerator runs efficiently. Structured pruning saves memory, bandwidth, compute and — if attention heads or layers are removed — KV-cache size, all at once. Its weakness is coarseness: removing a whole neuron removes good weights along with bad ones, so the immediate quality loss is much larger than for unstructured pruning at the same parameter count. Structured pruning nearly always requires retraining afterwards, usually with distillation, to recover. Table 4 sets the three side by side in terms of what each actually saves on a typical edge device. The entries summarise the hardware behaviour described above rather than any single benchmark. Table 4. What each kind of pruning saves on typical edge hardware (qualitative). Kind of pruning Memory saved Decode speed-up Hardware needed Recovery training Unstructured Only with sparse storage; index overhead Rarely, below very high sparsity Sparse kernels; uncommon at the edge Optional at moderate sparsity Semi-structured 2:4 Roughly a third to a half of weight storage Yes, on supporting GPUs NVIDIA sparse tensor cores, including Jetson Short fine-tune recommended Structured (width or depth) Proportional to units removed, plus KV cache if heads or layers go Yes, everywhere None beyond a dense runtime Substantial, usually with distillation The short version: unstructured pruning is a research tool and a component of some compression pipelines, semi-structured pruning is a deployment tool on specific hardware, and structured pruning is a way of manufacturing a smaller dense model. One-shot unstructured pruning: SparseGPT and Wanda The classic approach to pruning — magnitude pruning, removing the weights with the smallest absolute value, then retraining, repeated over several rounds — becomes prohibitively expensive for language models with billions of parameters. Two methods published in 2023 showed that large language models can be pruned in one shot, without retraining, with surprisingly small loss. SparseGPT, by Elias Frantar and Dan Alistarh (ICML 2023), applies the same second-order reasoning as GPTQ, from the same group, to pruning. Removing a weight is a perturbation; given the Hessian of the layer's reconstruction error, computed from calibration data, the remaining weights can be adjusted to compensate. SparseGPT processes columns in order, decides which weights to remove using an importance score that accounts for the Hessian, and updates the remaining weights to absorb the error. The paper reported pruning the largest open models of the time, with 175 billion parameters, to 50 to 60 percent unstructured sparsity in a few hours with little increase in perplexity, and showed that the method extends to 2:4 and 4:8 patterns and combines with quantization. Wanda ("Pruning by Weights and activations"), by Mingjie Sun, Zhuang Liu, Anna Bair and J. Zico Kolter (presented at ICLR 2024), asked whether the weight updates were necessary at all. Its importance score is simply the absolute value of each weight multiplied by the norm of the corresponding input activation across calibration data — the same activation-awareness that underlies AWQ — and weights are compared within each output row rather than across the whole layer. Wanda removes the lowest-scoring weights and performs no reconstruction. The authors reported results close to SparseGPT at 50 percent sparsity with much less computation, which made Wanda a common baseline. Both methods highlighted the same phenomenon as the quantization literature: the importance of a weight depends on the activations it meets, and the outlier channels that make activations hard to quantize also make their weights important to keep. The limitations matter for edge practitioners. Results reported for very large models are more forgiving than results for small ones; small, heavily trained models have less redundancy, and the same sparsity costs them more. Perplexity, the usual headline metric, understates damage to harder capabilities, and subsequent evaluations found that one-shot-pruned models lost more on knowledge-intensive and reasoning tasks than perplexity suggested. And 50 percent unstructured sparsity, as already discussed, does not translate into a faster model on a phone. The main practical uses of these methods at the edge are as the 2:4 variant on hardware that accelerates it, as a component in a combined sparse-and-quantized pipeline on a runtime with sparse kernels, or as a step in research. Structured pruning of width and depth If unstructured pruning buys little at the edge, structured pruning buys a great deal — at a price. Several lines of work have mapped that price. Width pruning removes neurons from feed-forward layers, heads from attention layers, or channels from the hidden dimension. LLM-Pruner (Xinyin Ma, Gongfan Fang and Xinchao Wang, NeurIPS 2023) identified groups of coupled structures — a neuron's row in one matrix and the matching column in the next must be removed together — scored them with gradient-based importance estimates, removed the least important, and recovered quality with a short low-rank fine-tune. SliceGPT (Ashkboos and colleagues, ICLR 2024) used the rotation invariance described in the activations chapter: rotate the residual stream with principal component analysis so that information concentrates in a subset of dimensions, then delete the remaining rows and columns, shrinking the hidden dimension. Sheared LLaMA (Mengzhou Xia and colleagues, ICLR 2024) learned pruning masks toward a specified target architecture and then continued pre-training, producing 1.3- and 2.7-billion-parameter models from a 7-billion-parameter one with far less compute than training from scratch. Depth pruning removes entire layers. Several studies in 2024 — among them "ShortGPT" by Men and colleagues and "The Unreasonable Ineffectiveness of the Deeper Layers" by Gromov and colleagues — found that many middle and late layers in large language models change the residual stream only slightly, as measured by the similarity between a layer's input and output, and that a substantial fraction of layers can be removed with surprisingly little loss on some benchmarks, especially after a brief recovery fine-tune. Layer removal is attractive at the edge because it reduces latency directly: fewer sequential steps per token, fewer weights to fetch, a smaller KV cache. But the same studies, and later evaluations, found that the losses concentrate in capabilities that need deep computation — multi-step reasoning, some kinds of knowledge recall — and that benchmarks dominated by easy multiple-choice questions can hide them. NVIDIA's Minitron work ("Compact Language Models via Pruning and Knowledge Distillation," Muralidharan and colleagues, 2024) is the most complete practical recipe published for structured pruning, and it is worth describing in some detail because it shows what a serious pipeline looks like. Starting from a trained model, it estimates the importance of each attention head, feed-forward neuron, embedding channel and layer from activation statistics on a small calibration set. It then prunes along one or more axes to a target size, evaluates candidate architectures briefly, and retrains the chosen one using knowledge distillation from the original model as teacher. The authors compared width pruning with depth pruning and reported that, after retraining, width pruning generally retained more quality, while depth pruning gave larger speed-ups for the same parameter count. They reported that their pruned-and-distilled models required many times fewer training tokens than training equivalent models from scratch, and the resulting Llama-3.1-Minitron and Mistral-NeMo-Minitron models were released openly. Meta's Llama 3.2 1B and 3B models were themselves produced, according to Meta, by structured pruning of Llama 3.1 8B followed by distillation from larger Llama models. The pattern across all of these is clear. Structured pruning is not a cheap post-processing step but the first half of a two-step process whose second half is substantial retraining with distillation. It is a way to manufacture a custom-sized model from a larger one more cheaply than training from scratch. It is the right tool when no available model fits the device budget with acceptable quality and the organisation has the training resources to retrain; it is the wrong tool for a team hoping to shave 20 percent off an existing small model in an afternoon. Pruning the parts nobody else prunes Some structured pruning targets are especially effective for small edge models and are often overlooked. The vocabulary. As discussed in the chapter on choosing a model, embedding and output matrices with vocabularies of 150,000 to 260,000 entries can be a large fraction of a small model's parameters. If a product serves only a few languages, many vocabulary entries — tokens for scripts and languages it will never see — are dead weight. Trimming the vocabulary to the tokens that appear in a large sample of the product's expected text, and remapping the tokenizer accordingly, can shrink the embedding and output matrices substantially and speed up the final projection, which for small models is a noticeable share of per-token compute. This must be done carefully: the tokenizer's merge rules must remain consistent, rare but legitimate inputs must degrade gracefully rather than crash, and the change makes the model incompatible with standard tooling that expects the original tokenizer. It is most appropriate for single-purpose, single-language deployments. Experts in a mixture-of-experts model. In a mixture-of-experts model, some experts are rarely selected for the product's inputs. Expert pruning removes them, or merges similar ones, reducing total memory while leaving the per-token active size unchanged. Several research groups have reported that a significant fraction of experts can be dropped for domain-specific deployments with limited loss. For edge devices where mixture-of-experts models are attractive because of their low active size but too large in total, expert pruning is one of the few ways to fit them. Modalities and encoders. A multimodal small model used only for text can drop its vision and audio encoders entirely, which many runtimes support simply by not loading them. This is the cheapest pruning there is. Combining pruning with quantization Pruning and quantization are complementary in principle: one reduces the number of weights, the other the bits per weight. In practice the combination behaves differently for different kinds of pruning. Structured pruning composes cleanly with quantization. The pruned, retrained model is an ordinary dense model, and it can be quantized with any method in this book. The only caution is that a pruned-and-distilled model has, by construction, less redundancy than its parent, and may be somewhat more sensitive to quantization; it should be evaluated after both steps, not just after pruning. Unstructured and semi-structured sparsity compose less cleanly. Both pruning and quantization introduce error in the same layers, and their errors add. SparseGPT and later work showed that joint pruning and quantization can be performed in a single pass with error compensation, and some runtimes — notably those targeting NVIDIA hardware with 2:4 support — can execute sparse 4-bit kernels. On phones and laptops without such support, sparse weights in a quantized model typically save nothing. A decision rule Pruning earns a place in an edge pipeline under three conditions. The first is when the hardware accelerates the sparsity pattern, as with 2:4 sparsity on NVIDIA GPUs, including embedded boards, and the throughput gain is needed. Then 2:4 pruning with SparseGPT or a similar method, followed by a short recovery fine-tune, is a legitimate optimisation. The second is when the model must be smaller in every dimension than any available model of acceptable quality, and the organisation can afford retraining. Then structured pruning plus distillation, in the Minitron style, is a sound way to create the needed model. The third is when there are obvious unused components — languages outside the product's scope, experts never selected, encoders for unused modalities — whose removal is cheap and whose loss is easily tested. Outside these conditions, the effort is better spent on choosing a smaller base model, quantizing it well and specialising it to the task. A pruning result that reports a high sparsity percentage with modest perplexity loss should prompt two questions before anyone acts on it: will this run faster or smaller on my device, and what happened to the capabilities my product depends on? Chapter 8. Distillation: Teaching Small Models to Think Like Large Ones Quantization and pruning take an existing model and make it cheaper. Distillation is different in kind: it trains a new, smaller model — or retrains a compressed one — to imitate a larger "teacher." It is the most expensive technique in this book, and also the one with the greatest power to change what a small model can do. Almost every capable small model released since 2024 has been shaped by distillation somewhere in its training. This chapter explains why imitation works better than learning from scratch, the main variants and their failure modes, how distillation is used to transfer reasoning into small models, and when a product team should do it themselves. Why soft targets carry more information The modern form of distillation was set out by Geoffrey Hinton, Oriol Vinyals and Jeff Dean in their 2015 paper "Distilling the Knowledge in a Neural Network." Their insight was that a trained model's output is richer than its top prediction. When a language model predicts the next token after "The capital of France is," its distribution places most probability on "Paris," but the remaining probability is not random: it favours other city names, other ways of beginning the answer, and plausible continuations, and disfavours nonsense. This "dark knowledge," in Hinton's phrase, encodes the teacher's understanding of how tokens relate. A student trained to match the full distribution learns these relations from every example, whereas a student trained only on the correct next token learns one fact per position. Hinton and colleagues also introduced a temperature parameter that softens both distributions before comparing them, making small probabilities more visible to the loss. The usual training objective is the Kullback–Leibler (KL) divergence between teacher and student distributions, often mixed with the ordinary cross-entropy loss on the true next token. The effect on data efficiency is substantial. In language modelling, a student trained on teacher distributions learns more from each token than one trained on raw text, which is why distillation became central to the economics of small models. Google described its Gemma 2 2B and 9B models (2024) as trained with knowledge distillation from a larger model rather than with next-token prediction, and argued that this let them train on more effective signal than their token count alone would provide. Meta used logits from Llama 3.1 8B and 70B as targets when building Llama 3.2 1B and 3B. NVIDIA's Minitron recipe, described in the pruning chapter, depends on distillation to recover quality after pruning. Variants of the objective Several design choices distinguish distillation methods, and each has consequences. Logit distillation versus sequence-level distillation. Logit distillation requires access to the teacher's full output distribution at every position, which means running the teacher alongside the student during training (or storing its top-k probabilities, which saves memory at some loss of signal). Sequence-level distillation, proposed by Yoon Kim and Alexander Rush in 2016, instead has the teacher generate complete outputs and trains the student on them as ordinary text. It needs only the teacher's generated text, not its probabilities — which makes it possible to distil from models accessible only through an API — but it discards the dark knowledge in each distribution. Most "synthetic data" pipelines, in which a large model writes training examples for a small one, are sequence-level distillation under another name. Forward versus reverse KL. The standard objective, forward KL from teacher to student, penalises the student for assigning low probability anywhere the teacher assigns high probability. A small student that cannot represent everything the teacher knows responds by spreading its probability thinly to cover all the teacher's modes, which can produce bland or incoherent generations. MiniLLM (Yuxian Gu and colleagues, ICLR 2024) argued for reverse KL, which penalises the student for placing probability where the teacher places little; this encourages the student to concentrate on the teacher's main modes and, the authors reported, produced more precise and better-calibrated generations from small students. Generalised objectives that interpolate between the two are now common. Off-policy versus on-policy. A subtle problem arises in generation. During training, the student is shown teacher-generated or human-written sequences and learns to predict the next token. At inference it conditions on its own previous outputs, which contain its own mistakes; it has never been trained on how to continue from those mistakes. This mismatch between training and inference distributions — known as exposure bias — compounds over long generations. Generalized Knowledge Distillation (GKD), from Rishabh Agarwal and colleagues at Google (ICLR 2024), addressed this by training the student partly on its own generated sequences, with the teacher providing token-level targets on those sequences. This on-policy distillation teaches the student how the teacher would continue from where the student actually goes. It has since become a standard ingredient in post-training small models, including for reasoning. Feature distillation. Rather than matching only outputs, the student can be trained to match the teacher's internal representations — hidden states or attention patterns at chosen layers — through learned projections where dimensions differ. DistilBERT (Victor Sanh and colleagues, 2019), which reduced BERT's size by 40 percent while retaining most of its language-understanding performance, combined output distillation with a hidden-state alignment loss and initialised the student from alternate layers of the teacher. Feature distillation helps most when the student's architecture is derived from the teacher's, as after structured pruning, because the correspondence between layers is natural. Distilling reasoning The largest change in small-model capability between 2024 and 2026 came from distilling reasoning. Models trained with reinforcement learning to produce long chains of thought before answering — OpenAI's o-series, DeepSeek-R1 and their successors — showed large gains on mathematics, coding and multi-step problems. The question was whether small models could share them. DeepSeek's January 2025 release of R1 gave a clear answer. Alongside the large model, DeepSeek released six smaller "distilled" models, built on Qwen 2.5 and Llama 3 base models from 1.5 to 70 billion parameters, which it had fine-tuned on about 800,000 samples generated by R1. DeepSeek reported that this simple supervised distillation produced small models with substantially stronger reasoning than their bases, and that, for the smaller models in its experiments, distilling from the large reasoning model worked better than applying reinforcement learning directly to the small model. The finding was widely replicated, and distilled reasoning became a standard part of small-model post-training. Small models in several families released since then offer "thinking" modes that produce a reasoning trace before the answer. For edge deployment, distilled reasoning creates a new trade-off. A reasoning trace may run to hundreds or thousands of tokens before the answer appears. On a device generating twenty tokens per second, a thousand-token trace is fifty seconds of waiting. Reasoning modes are therefore valuable where the task genuinely needs them and the latency is tolerable — a coding assistant, a planning step in an agent — and wasteful for simple requests. Many small models now let the application switch thinking on and off, and some products route only hard requests to thinking mode. Reasoning traces also stress compression in a specific way: they are long, multi-step generations in which small per-step errors compound, precisely the regime the fundamentals chapter identified as most sensitive to quantization. A model that quantizes well on short answers can fall apart in thinking mode, and evaluation must test both. Distillation for a specific task Most product teams will not distil a general model from scratch. The more common and more valuable use is task-specific distillation: making a small model nearly as good as a large one on one narrow job. The pattern is straightforward. Collect inputs representative of the product — real user requests where privacy permits, synthetic ones otherwise. Run a strong teacher on them to produce outputs, ideally with the teacher's probabilities if the teacher is an open model you can run, otherwise its text. Filter the outputs for correctness, using automated checks where the task allows (does the JSON parse, does the code pass its tests, does the extracted field match the source document) and human review where it does not. Fine-tune the small model on the result, usually with low-rank adaptation, described in the next chapter. Evaluate on held-out inputs. The economics are compelling. A small model distilled for a narrow task — classifying support tickets, extracting fields from invoices, rewriting text in a house style, routing requests to tools — often matches a much larger general model on that task, because the narrow task needs only a sliver of the large model's knowledge. The literature on this goes back years; "Distilling Step-by-Step" (Cheng-Yu Hsieh and colleagues, 2023) showed that training small models on both the labels and the rationales produced by a large model let them match or exceed much larger models on several benchmarks while using less training data than standard fine-tuning. The pattern has become routine in industry. Three cautions apply. First, the teacher's licence and terms of service may restrict using its outputs to train other models; check before building a pipeline. Second, the student inherits the teacher's errors and biases along with its skills, and filtering is the only defence. Third, task-specific distillation narrows the model. Training heavily on one task can erode general abilities the product still relies on — following instructions outside the task, refusing inappropriate requests, handling unexpected inputs gracefully. Mixing in general instruction data, keeping the training short, and using low-rank adaptation rather than full fine-tuning all limit this erosion, and the evaluation set should include general-behaviour checks as well as task metrics. Distillation as the repair step Distillation's third role at the edge is as the repair step after other compression. Every technique in the preceding chapters — aggressive quantization, structured pruning, layer removal, vocabulary trimming — damages the model, and the most effective way to repair that damage is to train the compressed model to match the original. This is self-distillation: teacher and student start as the same model, and the student is the damaged one. This framing unifies much of what has been described. Google's Gemma 3 QAT used the unquantized checkpoint's probabilities as targets. Minitron retrains pruned models by distilling from the unpruned parent. Apple trains low-rank adapters to recover quality lost in compression. In each case the original model provides a dense, task-agnostic training signal that pulls the compressed model back toward its original behaviour without requiring any labelled data. The practical advantage is that self-distillation needs only unlabelled inputs that resemble real use and enough compute to run the teacher and train the student. It is far cheaper than repeating the original post-training, and it preserves the alignment and instruction-following properties instilled by that training, which fine-tuning on raw text tends to erode. Practical constraints Distillation is constrained by three resources. Teacher inference. Logit distillation needs the teacher's distribution at every training position. For a large teacher this dominates the cost: every training token requires a forward pass through the teacher. Storing only the top few dozen probabilities per position, computed once offline, reduces this but sacrifices some signal and requires substantial storage. Sequence-level distillation from generated text is cheaper but weaker. Tokenizer compatibility. Logit distillation compares distributions over the same vocabulary. If teacher and student use different tokenizers — common when distilling across model families — the distributions cannot be compared directly. Research methods for cross-tokenizer distillation exist, but the simplest path is to choose a student and teacher from the same family, which is one reason vendors distil within their own model lines. Capacity gap. A student that is much smaller than its teacher may not be able to absorb the teacher's distribution, and several studies have reported that an intermediate-sized "teaching assistant" model or a less capable teacher sometimes produces a better small student than the largest available teacher. The right teacher is not always the strongest one; it is the one whose behaviour the student can learn to approximate. For a product team, the decision usually comes down to this. If a general small model, quantized well, is good enough, distillation is unnecessary. If the product depends on one or a few narrow capabilities that a larger model handles and the small model does not, task-specific distillation is likely the highest-value investment in the whole pipeline. If aggressive compression has damaged the model, self-distillation is the most reliable repair. And if no model of the required size exists at all, structured pruning followed by distillation is the route — but that is a training project, and should be planned as one. Chapter 9. Low-Rank Adaptation on Compressed Models Low-rank adaptation is not, strictly, a compression technique. It does not make a model smaller. But it has become indispensable to edge deployment for three reasons: it makes specialising a small model to a task cheap enough to do routinely; it can repair the damage done by quantization; and it lets a single compressed base model on a device serve many tasks by swapping small adapter files rather than whole models. This chapter explains how low-rank adaptation works, why QLoRA made fine-tuning compressed models practical, how adapters interact with quantization, and how they are used on devices. The low-rank idea Fine-tuning a model updates its weights: each weight matrix W becomes W + ΔW. Full fine-tuning learns ΔW in its entirety, which for a model with billions of parameters means storing gradients and optimiser state for every parameter — several times the model's own memory — and producing a full-sized copy of the model for every task. LoRA (Low-Rank Adaptation), introduced by Edward Hu and colleagues at Microsoft in 2021, rests on the observation that the update ΔW needed to adapt a pre-trained model to a new task tends to have low "intrinsic rank": it can be well approximated by the product of two thin matrices. LoRA freezes W and learns ΔW = BA, where, for a weight matrix with d_out rows and d_in columns, B has d_out rows and r columns and A has r rows and d_in columns, with the rank r typically between 4 and 64. For a 4,096 × 4,096 matrix and r = 16, the adapter holds 2 × 4,096 × 16 = 131,072 parameters instead of nearly seventeen million — less than one percent. B is initialised to zero, so training starts from the unmodified model, and a scaling factor (conventionally α divided by r) controls the magnitude of the update. The paper reported that LoRA matched full fine-tuning quality on a range of tasks while reducing the number of trainable parameters by orders of magnitude and the memory needed for training substantially. After training, the adapter can be kept separate, applied at inference by computing the low-rank product alongside the frozen weight, or merged into the weight (W + BA) so that inference costs nothing extra. Many variants have followed. DoRA (Shih-Yang Liu and colleagues, ICML 2024) decomposes each weight into a magnitude and a direction and applies the low-rank update to the direction only, reporting closer agreement with full fine-tuning. Initialisation schemes such as PiSSA start the adapter from the principal components of the original weight rather than from zero. Methods such as LoRA+ use different learning rates for A and B. None changes the basic economics; all are refinements worth trying when a standard LoRA falls slightly short. Two things are worth understanding about what LoRA can and cannot do. It is very good at teaching a model a format, a style, a narrow skill, or a domain's vocabulary — adaptations that redirect existing capabilities. It is less good at injecting large amounts of new factual knowledge; a 2024 study by Biderman and colleagues, "LoRA Learns Less and Forgets Less," found that LoRA underperformed full fine-tuning on substantial new-domain learning such as code and mathematics continued pre-training, but also preserved the base model's other abilities better. For edge products, which usually need specialisation rather than new knowledge, that trade is usually favourable. QLoRA: fine-tuning a quantized model LoRA reduced the memory needed for optimiser state but still required the frozen base weights in 16-bit precision. QLoRA, by Tim Dettmers, Artidoro Pagnoni, Ari Holtzman and Luke Zettlemoyer (NeurIPS 2023), removed that requirement by freezing the base model in 4-bit form and training 16-bit LoRA adapters on top. Gradients flow through the dequantized 4-bit weights into the adapters; the base weights never change. QLoRA introduced three components. NF4, the 4-bit NormalFloat data type mentioned in the fundamentals chapter, uses a codebook spaced according to normal-distribution quantiles, designed to be information-theoretically well suited to normally distributed weights. Double quantization quantizes the per-block scale factors themselves, saving roughly a third of a bit per parameter. Paged optimisers use unified memory to move optimiser state between GPU and CPU memory, smoothing over memory spikes during training. The paper reported fine-tuning a 65-billion-parameter model on a single 48-gigabyte GPU while preserving 16-bit fine-tuning performance on its evaluations. For edge practitioners QLoRA has two meanings. The first is practical: fine-tuning a small model of one to nine billion parameters becomes possible on a single consumer GPU or a cloud instance costing little, and a team can iterate on task-specific adapters quickly. Tooling such as Hugging Face's PEFT library, Unsloth, Axolotl and TRL has made the workflow routine, and MLX supports LoRA and QLoRA training directly on Apple silicon laptops. The second is subtler and more important for deployment. An adapter trained with QLoRA was trained on top of a specific quantized base: NF4 weights with particular block sizes. If the model is deployed with a different quantization — say, merged into 16-bit and then re-quantized to a GGUF Q4_K_M or to a vendor's NPU format — the base weights the adapter sees at inference differ from the base weights it was trained against. The adapter learned to correct for NF4's specific errors; it may now be correcting for errors that are not there and ignoring ones that are. Usually the effect is small, but on sensitive tasks it can be noticeable. The safest practice is to train the adapter against the same quantized weights that will ship, or to evaluate carefully after re-quantization. Adapters as quantization repair The QLoRA arrangement — frozen quantized base, trainable high-precision adapter — suggests a further use: train the adapter not for a new task but to undo the quantization error itself. LoftQ (Yixiao Li and colleagues, ICLR 2024) made this explicit. Rather than initialising the adapter at zero, LoftQ chooses the quantized weights Q and the low-rank initialisation BA jointly so that Q + BA approximates the original 16-bit weight as closely as possible, alternating between quantizing the residual and computing a low-rank fit of what quantization lost. Fine-tuning then starts from a model much closer to the original. The authors reported particular gains at 2 and 3 bits, where the gap between the quantized and original model is largest. Apple's on-device model uses the same principle at production scale. Apple's technical reports describe training low-rank adapters to recover quality lost when its on-device model is compressed to low bit-widths, and they expose LoRA adapter fine-tuning to developers through the Foundation Models framework, so that third-party specialisations sit on top of the same compressed base. Meta's quantization-aware-trained Llama 3.2 variants likewise combined QAT with low-rank adapters. The general recipe for a team that has quantized a model and found it slightly short of the quality floor is: freeze the quantized weights in exactly their deployment format; attach LoRA adapters to the linear layers (all of them, or at least the attention and feed-forward projections); train with self-distillation from the original model on representative unlabelled data; evaluate. A rank of 16 to 64 is a common starting point. The adapter adds a small amount of memory and computation at inference — for a three-billion-parameter model, rank-16 adapters on all linear layers add on the order of tens of millions of parameters, which in 16-bit precision is tens of megabytes. If memory is very tight, the adapter can be merged into the base weights and the result re-quantized, but merging re-introduces rounding error: the merged weight W_q + BA must be quantized again, and the carefully learned correction is partly lost to the new rounding. Keeping the adapter separate, in higher precision, preserves the repair. Many tasks on one base The most distinctive edge use of adapters is multiplexing. A device has room for one compressed base model; a product may need several specialisations — summarisation, reply suggestions, extraction, a domain assistant. Shipping several full models is impossible. Shipping one base with several small adapters is easy: each adapter is tens of megabytes, can be downloaded and updated independently, and can be swapped in a fraction of a second. Apple's platform is built around this design. Its 2024 description of Apple Intelligence explained that its on-device foundation model is specialised for different features by small adapters loaded and swapped dynamically, giving the model the ability to specialise "on the fly" for the task at hand while sharing the base weights in memory. The same pattern is available on other platforms: llama.cpp supports loading LoRA adapters at runtime and applying them without merging, ExecuTorch and other mobile runtimes have added adapter support, and server frameworks can apply different adapters per request. Multiplexing adapters raises engineering questions that do not arise with a single model. The adapters must all be trained against the identical quantized base; any change to the base — a new quantization, a model update — invalidates them all, so base updates become coordinated releases. Applying an adapter without merging adds per-token compute that is small but not zero, especially on NPUs, where the extra low-rank multiplications may run on a different unit from the main graph. Some NPU toolchains require adapters to be compiled into the graph ahead of time, which limits how dynamically they can be swapped. And evaluation multiplies: each adapter on the compressed base needs its own test set. Practical guidance for training adapters Some lessons recur across teams that train adapters for edge models. Target the right layers. Early LoRA work often adapted only the attention query and value projections. Later experience, including the QLoRA paper's findings, favours adapting all linear layers, including the feed-forward projections, at a modest rank. This generally improves quality for little additional cost. Match the chat template exactly. Instruction-tuned models depend on a specific prompt format. Training an adapter with a slightly different template — a missing system-prompt token, different whitespace — teaches the model a format it will never see in production, or worse, degrades its behaviour on the real format. Keep data diverse enough to avoid collapse. A narrow training set teaches the narrow task but can erode general behaviours. Mixing in a fraction of general instruction data, stopping early, and checking general-behaviour metrics prevent the adapter from teaching the model to answer every question as if it were an invoice. Distil where possible. Adapter training benefits from the same soft-target signal as any other distillation. When a larger teacher in the same family is available, training on its distributions rather than only on target text tends to give better adapters from less data. Train against the shipped base. The adapter should see, during training, the same quantized base weights it will see at inference. This is the single most common source of unexplained quality differences between a model evaluated in a training environment and the same model on a device. The place of adapters in the blueprint Low-rank adaptation fills a specific position in an edge compression pipeline. It comes after the base model has been chosen and quantized, and it serves one of three purposes: specialising the model to the product's tasks, which is almost always worthwhile; repairing quality lost to quantization, when cheaper fixes have failed; and letting one base serve many features. It does not reduce the model's size, and it adds a small cost at inference if kept separate. But it is the cheapest form of training available, and it turns a compressed general model into a compressed specialist — which is, in the end, what most edge products need. Chapter 10. Runtimes, Formats and Silicon A compressed model is only as good as the software that runs it and the chip underneath. Many promising compression results fail at this stage: a format the runtime cannot execute efficiently, an operator the neural processing unit does not support, a quantization scheme that saves bytes on paper but forces the runtime to fall back to slow code. This chapter surveys the hardware that runs language models at the edge as of late 2026, the runtimes that connect models to it, and the techniques — speculative decoding chief among them — that runtimes use to get more out of the same hardware. Its argument is simple: choose the format to fit the runtime and the runtime to fit the chip, not the other way round. The processors in an edge device A modern phone or laptop system-on-chip contains three kinds of processor that can run a language model, all sharing the same pool of memory. The CPU is the most flexible and most widely supported target. Modern ARM cores include vector instructions (NEON, and on newer designs the Scalable Vector and Scalable Matrix Extensions) with dot-product and matrix-multiply instructions for 8-bit integers, and x86 laptop chips have their own vector extensions. Because decode is bandwidth-bound, a CPU with good kernels can approach the memory-bandwidth ceiling for token generation on small models; its weakness is prefill, where its arithmetic throughput falls well short of the GPU's or NPU's. Arm's KleidiAI library provides optimised low-precision kernels that frameworks including llama.cpp, ExecuTorch and MediaPipe have integrated. The GPU offers far more arithmetic throughput than the CPU, which makes it the usual target for prefill and for larger models on laptops. On Apple silicon, the GPU is the main engine for open-model inference through Metal; Apple's M5 generation added matrix-multiplication units to the GPU cores — which Apple calls Neural Accelerators — and Apple's own measurements with MLX attributed a three- to four-fold improvement in time to first token over the M4 to them. On Android, the GPU is reachable through OpenCL or Vulkan, and runtimes such as llama.cpp, MLC LLM and LiteRT have GPU paths of varying maturity across Qualcomm Adreno, ARM Mali and other GPUs. The NPU, or neural processing unit, is a dedicated accelerator for tensor operations, usually optimised for low-precision integer arithmetic and very high energy efficiency. Every major mobile and laptop chip now has one: Apple's Neural Engine, Qualcomm's Hexagon NPU, MediaTek's APU, Google's TPU in its Tensor chips, Samsung's NPU in Exynos, Intel's NPU in Core Ultra processors and AMD's XDNA NPU in Ryzen AI processors. Microsoft's Copilot+ PC specification, introduced in 2024, required an NPU capable of more than 40 trillion operations per second, and vendors have competed on that figure since. Qualcomm described the Hexagon NPU in its Snapdragon 8 Elite Gen 5, announced in September 2025, as 37 percent faster than its predecessor. Headline NPU figures, measured in TOPS (trillions of operations per second, usually at INT8 or INT4), measure peak arithmetic — the resource that matters for prefill. For decode, the NPU reads weights from the same memory as the CPU and GPU, at the same bandwidth. An NPU does not make decode faster than the memory bus allows; it can make decode more energy-efficient, and it can free the CPU and GPU for other work. This is why NPU marketing and practitioner experience often diverge: the NPU may halve time to first token while leaving tokens per second roughly where the CPU had them. NPUs also impose constraints that CPUs and GPUs do not. Most compile a static graph ahead of time, with fixed tensor shapes, which sits uneasily with the dynamic shapes of language-model inference (growing context, varying prompt lengths); runtimes work around this by compiling several graph variants for different sequence lengths, or by splitting prefill and decode into separate graphs. Supported operator sets are narrower, so unusual layer types — new attention variants, linear-attention recurrences, custom activation functions — may fall back to the CPU, with expensive data transfers at each boundary. And the supported number formats are specific: a given NPU might execute 8-bit activations with 4-bit weights efficiently, but not 16-bit floating point, or not the particular block-scaled format a model was quantized in. Each vendor's toolchain — Qualcomm's AI Engine Direct and AI Hub, MediaTek's NeuroPilot, Apple's Core ML, Intel's OpenVINO, AMD's Ryzen AI software — defines what is possible on its silicon. The runtime landscape The runtimes that run small language models at the edge fall into three groups. Cross-platform open runtimes prioritise breadth. llama.cpp, with its GGUF format, runs on almost anything with a CPU and has backends for Metal, CUDA, Vulkan, SYCL, OpenCL and others; it added a backend for Qualcomm's Hexagon NPU in late 2025. It is the engine behind Ollama, LM Studio and many applications, and its quantization formats, discussed in the post-training chapter, are the de facto standard for local models on laptops and desktops. MLC LLM, from the team behind Apache TVM, compiles models to many GPU backends, including mobile GPUs, and has strong Android and iOS support. ONNX Runtime, with its GenAI extension, runs models exported to the ONNX format across CPUs, GPUs and NPUs through execution providers, and underpins Microsoft's Windows AI platform. Platform runtimes are built by OS and framework vendors. Apple offers MLX, an array framework for its silicon that has become the most popular way to run and fine-tune open models on Macs, and Core ML, the deployment framework that can target the Neural Engine. Apple's Foundation Models framework, introduced in 2025, gives developers direct access to Apple's own on-device model with guided generation and tool calling, without shipping a model at all. Google offers LiteRT (formerly TensorFlow Lite) and LiteRT-LM, a runtime for language models used in Google's own products and supporting Gemma models on CPU, GPU and, increasingly, NPU, along with MediaPipe's LLM inference API and Android's AICore system service, which hosts Gemini Nano and has offered developer previews of Gemma models. PyTorch's ExecuTorch, which reached version 1.0 in October 2025, exports PyTorch models directly to an on-device runtime with backends including XNNPACK with Arm KleidiAI on CPU, Core ML, Qualcomm's AI Engine, Arm Ethos-U, Vulkan, MediaTek and Samsung's Exynos; Meta reported using it for on-device AI features across Instagram, WhatsApp, Messenger and Facebook. Vendor stacks expose each silicon maker's hardware most directly: Qualcomm's AI Engine Direct SDK and its Genie runtime for generative models, MediaTek's NeuroPilot, Intel's OpenVINO GenAI, AMD's Ryzen AI software with ONNX Runtime, and NVIDIA's TensorRT-LLM and TensorRT Edge-LLM for Jetson devices. They often deliver the best performance on their own chips and the worst portability. Table 3 matches the main runtimes to their typical formats and targets. It is a starting map, not a guarantee; support changes month by month, and each entry should be checked against the current release. Table 3. Edge runtimes, their usual model formats and primary hardware targets (as of late 2026; verify against current documentation). Runtime Typical model format Primary targets Notable strength llama.cpp GGUF (k-quants, i-quants, Q4_0, Q8_0) CPU, Apple Metal, CUDA, Vulkan; Hexagon backend Breadth, community quantizations MLX MLX safetensors, group-wise 2–8 bit Apple silicon GPU Fast iteration and fine-tuning on Mac Core ML mlpackage with palettized or linear weights Apple Neural Engine, GPU, CPU Neural Engine access on Apple devices ExecuTorch PTE program, torchao quantization Mobile CPU, Core ML, Qualcomm, MediaTek, Arm NPUs PyTorch-native export, many backends LiteRT / LiteRT-LM LiteRT model files with int4/int8 weights Android CPU, GPU, NPU Google's production mobile path ONNX Runtime GenAI ONNX with int4 weights Windows CPU, GPU, NPUs Windows integration, many providers Speculative decoding: borrowing compute to beat bandwidth Decode is bandwidth-bound: each step reads all the weights to produce one token, leaving the arithmetic units mostly idle. Speculative decoding turns that idle compute into speed. The technique, published independently in 2022 and 2023 by Yaniv Leviathan, Matan Kalman and Yossi Matias at Google and by Charlie Chen and colleagues at DeepMind, uses a small, fast draft model to propose several tokens ahead. The large target model then verifies all the proposed tokens in a single forward pass — which costs nearly the same as generating one token, because the weights are read once and applied to several positions at once. The target model accepts the longest prefix of the draft that matches what it would have produced (using a rejection-sampling rule that guarantees the output distribution is exactly the target model's), and generates one corrected token at the first disagreement. If the draft model is usually right, several tokens are produced for the bandwidth cost of one. At the edge this is attractive and subtle. It is attractive because the conditions it exploits — bandwidth-bound decode, spare compute — are exactly the conditions on phones and laptops. It is subtle because the draft model also consumes memory and bandwidth, and on a device with little headroom a separate draft model may not fit. Several variants avoid a separate draft model. Medusa (Tianle Cai and colleagues, 2024) adds extra prediction heads to the target model to guess several future tokens. EAGLE (Yuhui Li and colleagues, 2024) and its successors train a small one-layer draft network that operates on the target model's hidden features, which tends to give high acceptance rates at very low cost. Prompt lookup or n-gram decoding uses no model at all, drafting by copying spans from the prompt, which works remarkably well for tasks such as editing, summarisation and code modification where the output repeats much of the input. Some model families now ship with multi-token prediction heads trained in, which runtimes can use for self-speculation. The gain from speculative decoding depends on the acceptance rate, which depends on the task: predictable outputs (code, structured data, edits) accept many draft tokens; creative text accepts fewer. Typical reported speed-ups in the literature range from about one-and-a-half to three times, but on edge hardware the result should be measured, because the extra verification compute and draft memory can erase the gain on a heavily constrained device. Other runtime techniques worth knowing Several further techniques determine how well a given format performs. Prompt caching stores the KV cache for a fixed prefix — a system prompt, tool definitions, a document being discussed — and reuses it across requests, eliminating repeated prefill. For agentic applications with long, stable preambles it can cut time to first token dramatically. Constrained decoding restricts generation to tokens that keep the output valid according to a grammar or JSON schema. llama.cpp supports grammars natively; Apple's Foundation Models framework provides guided generation into Swift types; libraries such as Outlines and XGrammar implement constrained decoding for other runtimes. For small, compressed models, constrained decoding is not just a convenience: it guarantees structural validity that a quantized model might otherwise break, rescuing exactly the kind of multi-step formatting errors that compression tends to introduce. Memory mapping lets a runtime map model weights from storage into memory on demand rather than loading them up front, so a model starts quickly and the operating system can reclaim pages under pressure. llama.cpp uses memory mapping by default. On phones, aggressive memory management by the operating system can then cause weights to be evicted and re-read from flash mid-generation, which is dramatically slower; locking critical weights in memory, where the platform allows it, avoids this. Heterogeneous scheduling runs different parts of the workload on different processors — prefill on the NPU or GPU, decode on the CPU, or the embedding lookup on the CPU while the transformer runs on the NPU. Runtimes are increasingly doing this automatically, but the boundaries between processors cost time, and a naive split can be slower than running everything on one unit. Matching format to silicon The practical consequence of all this is a matching exercise, to be done before compression rather than after. Start from the device and its intended runtime. If the product targets Apple platforms and can use Apple's own model, the Foundation Models framework removes the compression problem entirely, at the cost of using Apple's model and its adapter mechanism. If it ships its own model on Apple devices, MLX on the GPU is the fastest route to a working prototype on Macs, and Core ML or ExecuTorch with the Core ML backend is the route to the Neural Engine on iPhones. If it targets Android broadly, LiteRT-LM, ExecuTorch, MLC LLM and llama.cpp are the main options; for NPU access on specific chipsets, the vendor toolchains or ExecuTorch's vendor backends are needed. If it targets Windows laptops, ONNX Runtime and the Windows AI stack reach NPUs from Qualcomm, Intel and AMD; llama.cpp covers CPUs and GPUs broadly. If it targets embedded Linux boards, llama.cpp on CPU is the universal fallback, and NVIDIA's stack is the choice on Jetson. Then ask what formats that runtime executes fast on that silicon. On CPU-based llama.cpp, the k-quants and i-quants are well optimised, and some simpler formats such as Q4_0 enjoy special ARM-specific repacking that can make them faster than nominally better formats. On NPUs, the vendor's supported integer formats dictate the scheme, usually 4- or 8-bit weights with 8- or 16-bit activations and per-channel or per-group scales. On GPUs, group-wise 4-bit formats with fast dequantization kernels are the norm. Only then choose the compression method that produces the best model in that format: AWQ or GPTQ for integer weight formats, imatrix-calibrated quantization for GGUF, SmoothQuant-style calibration and possibly rotations for NPU activation quantization, QAT if the vendor has published a checkpoint in the target format. A brilliant 3-bit vector-quantized model that the target runtime cannot execute is worth less than a plain 4-bit model that runs at the bandwidth ceiling. Finally, measure on the device itself — not on a development laptop, not in a simulator, and not in a thirty-second burst. Measure time to first token at realistic prompt lengths, decode speed over realistic generation lengths, sustained performance over several minutes of use, peak memory including the KV cache at the longest supported context, and energy where the platform exposes it. Compare the decode speed with the bandwidth ceiling computed from the model's size. The gap between the two tells you whether the next improvement should come from the model or from the software. Chapter 11. Measuring What Compression Costs The description of this book promises methods "that preserve downstream benchmark performance." That phrase deserves scrutiny, because preserving benchmark scores and preserving the behaviour a product depends on are not the same thing. A compressed model can match its parent on a widely reported benchmark to within a point and still fail at the specific task it was deployed for. This chapter is about measuring compression honestly: which signals are sensitive, which are misleading, how to build an evaluation that would catch the failures that matter, and how to decide whether a compressed model is good enough to ship. Why aggregate benchmarks mislead The standard way to report a compression result is a table of scores on public benchmarks — knowledge and reasoning multiple-choice tests, commonsense tests, mathematics word problems — plus perplexity on a text corpus, for the original and the compressed model. If the numbers are close, the compression is declared nearly lossless. There are four problems with this. Accuracy hides flips. A 2024 study by Abhinav Dutta and colleagues at Microsoft Research, "Accuracy is Not All You Need," compared compressed models with their originals and found that even when aggregate accuracy was nearly unchanged, a substantial fraction of individual answers changed — some from correct to incorrect and others from incorrect to correct, cancelling out in the total. They proposed measuring the proportion of such "flips" and the divergence between the two models' output distributions as more faithful indicators of how much the model had changed. The implication for edge deployment is direct: if a product depends on consistent behaviour, a stable aggregate score is not evidence that behaviour is stable. Easy benchmarks are insensitive. Multiple-choice benchmarks measure the model's ranking of a handful of options at a single position. Compression error can perturb the probabilities substantially without changing which option ranks highest. Tasks that require generating long, exact outputs — code, mathematics with worked steps, structured data, multi-turn tool use — accumulate error over many steps and degrade earlier and more sharply. Several systematic evaluations of quantized models since 2023 have reported exactly this pattern: knowledge benchmarks hold up well down to about 4 bits, while generation-heavy and reasoning tasks show losses sooner. Benchmarks miss what the product does. Public benchmarks are mostly in English, mostly short-context, mostly free of the system prompts, chat templates, tools and output schemas that real deployments use. Compression damages capabilities unevenly, and the capabilities most likely to be damaged — less common languages, long-context retrieval, strict formatting, rare skills — are those least represented in public suites. Perplexity is a blunt instrument. Perplexity — the exponential of the average negative log-likelihood on held-out text — is cheap, sensitive and useful for comparing quantizations of the same model on the same text. But it averages over every token, and most tokens in ordinary text are easy. A model can retain near-identical perplexity while losing the ability to produce the few hard tokens that matter in a reasoning chain. It is also sensitive to the text it is measured on, and a calibration set that overlaps the perplexity corpus produces optimistic numbers. None of this means public benchmarks are useless. They are good for detecting gross breakage, for comparing methods under controlled conditions, and for relating a result to the literature. They are not sufficient for deciding whether a compressed model is fit for a product. More sensitive signals Better signals compare the compressed model directly with its parent, token by token, rather than comparing both with a ground truth. KL divergence. The Kullback–Leibler divergence between the original and compressed models' next-token distributions, averaged over a representative set of texts, measures how much the compressed model's predictions have moved, at every position and across the whole vocabulary. It is far more sensitive than accuracy and does not depend on having correct answers. The llama.cpp project's perplexity tool can compute KL divergence between a quantized model and a reference, reporting the mean and the tails of the distribution, and this has become a standard way for the community to compare quantization types. The tails matter: a quantization whose mean divergence is small but whose 99th-percentile divergence is large has a few positions where it behaves very differently, and those positions are where generation goes off course. Top-token agreement. The fraction of positions at which the compressed model's most likely token matches the original's is an intuitive complement to KL divergence. For greedy decoding it predicts directly how often the two models will diverge. Flip rate. On a task with defined answers, the fraction of examples whose correctness changes between the original and compressed model, in either direction, measures behavioural instability that net accuracy hides. Divergence over generations. Generate long outputs from the same prompts with both models at temperature zero and measure where they first diverge, and whether the divergence matters. For structured tasks this can be automated; for open-ended tasks it needs judging. These signals share one property: they measure how far the compressed model has drifted from the original, which is exactly what compression should minimise. They do not tell you whether the original was good enough, which is a separate question answered by task evaluation. Building a product evaluation The evaluation that decides whether to ship should be built from the product's own tasks, and it should be built before compression begins, so that every compression decision can be tested against it. A useful product evaluation has several layers. Task accuracy on representative inputs. Several hundred examples drawn from real or realistic use, with defined correct outputs or clear grading criteria. For classification and extraction tasks, exact metrics are straightforward. For generative tasks, graded rubrics applied by a strong model acting as judge, with periodic human spot-checks of the judge's reliability, are now standard practice. Format and protocol compliance. The rate at which outputs parse as valid JSON, call tools with valid arguments, follow the required schema, stop at the right place and respect length limits. These are among the first properties to break under compression and among the most damaging when they break, because downstream software fails outright. If the product uses constrained decoding, test both with and without it, to know how much the constraint is carrying. Long-context behaviour. If the product uses long contexts, test retrieval and reasoning at the full length the product supports — not only short prompts. Tests that hide a specific fact deep in a long document and ask for it are crude but effective at catching KV-cache quantization damage and attention problems. Multilingual and domain coverage. Test every language and domain the product serves, with examples weighted by usage but never omitting low-volume languages entirely, because compression damage concentrates there. Multi-turn and agentic behaviour. If the product has conversations or tool loops, test complete trajectories, not single turns. Errors that are rare per turn become common over ten turns. Safety and refusal behaviour. Compression and fine-tuning can both shift a model's handling of harmful or out-of-scope requests. Include a set of prompts the model should decline or handle carefully, and check that compressed variants behave as the original does. Research on quantized models has reported that safety behaviours can degrade under aggressive quantization in ways that general benchmarks do not show, which makes this a necessary check rather than an optional one. Thinking modes. If the model has a reasoning mode that the product uses, evaluate it separately. Long reasoning traces amplify compression error, and a model can pass in direct-answer mode while failing in thinking mode. The evaluation should report both absolute task scores and drift signals relative to the uncompressed model, so that a regression can be attributed to compression rather than to the base model's own limitations. On-device measurement Quality is half the decision; the other half is whether the compressed model meets the device budget, and that can only be measured on the device. Measure peak memory during the most demanding realistic session: longest context, largest prompt, any adapters loaded, alongside the rest of the application. Measure time to first token at realistic prompt lengths, including the system prompt and any retrieved content. Measure decode speed over realistic output lengths, and compare it with the bandwidth ceiling computed from the model's size and the device's memory bandwidth. Measure sustained performance over several minutes, on battery and on charge, at a warm room temperature, because thermal throttling changes the numbers. Measure energy per request where the platform provides counters. Measure on the lowest-specification device the product supports, not only the developer's flagship. Run these measurements as part of an automated pipeline. Edge models are updated — new base versions, new adapters, new runtime releases, operating system updates that change memory management — and each change can shift the numbers. A team that measured once at launch will discover regressions from user complaints. Deciding what is good enough The final decision is a judgement about two budgets, and it helps to make it explicit. For quality, define, before compressing, the minimum acceptable score on each layer of the product evaluation, and the maximum acceptable drift relative to the original model. Some properties — format compliance, safety behaviour — warrant near-zero tolerance. Others — the stylistic quality of open-ended text — can tolerate more. Write these down; otherwise, the threshold drifts toward whatever the latest compressed model achieves. For the device, define the memory ceiling, time-to-first-token ceiling, decode-speed floor and energy envelope on the lowest supported device. Then evaluate candidates against both sets of thresholds. A compressed model that meets every threshold ships. One that misses on the device side needs more compression or a smaller base. One that misses on the quality side needs a gentler compression, a better method, a recovery step — adapters, QAT, distillation — or a stronger base. One that misses on both is a sign that the size class is wrong. It is also worth keeping, through the life of the product, a small set of "canary" prompts — examples that previously exposed compression damage — and running them on every new artefact. Compression failures tend to recur in the same places, and the cheapest way to catch them is to remember where they happened before. Chapter 12. A Blueprint for Shipping The preceding chapters described techniques one at a time. A real project uses several of them, in sequence, under deadlines, with incomplete information. This chapter assembles them into a blueprint: an ordered set of decisions, each with the questions to answer and the evidence to collect before moving on. It then walks through three worked scenarios — a phone assistant, a laptop document tool and an embedded device — to show how the same blueprint produces different pipelines when the budgets differ. The scenarios are illustrative composites, not reports of particular companies; the findings attributed to each team are the kind of findings the blueprint is designed to surface, and any real project must measure its own. The ordering principle is the one stated at the start of the book. Remove bytes in the cheapest places first; spend training compute only when cheap methods have run out; choose techniques the hardware can actually exploit; and judge every step by measurement against the product's own evaluation. Step 1: Write down both budgets Before touching a model, write down the device budget and the quality budget. The device budget comes from the lowest-specification device you will support. Record total memory and an honest estimate of what the operating system and the rest of the application leave free; sustained memory bandwidth, from published specifications or a simple measurement; the processors available and the runtimes that reach them; the longest context the product needs; the minimum acceptable decode speed and maximum acceptable time to first token; and any energy constraint. From these, derive three ceilings: bytes of weights, bytes of KV cache at maximum context, and bytes read per generated token (bandwidth divided by required tokens per second). The quality budget comes from the product. Build the evaluation described in the previous chapter — task accuracy, format compliance, long-context, languages, multi-turn, safety, thinking mode if used — and set thresholds for each layer. Teams that skip this step end up compressing toward a moving target. Teams that take it seriously frequently discover that one budget makes the other impossible — a context length that cannot fit, a quality bar no model of the feasible size meets — and that discovery is far cheaper at the start than at the end. Step 2: Choose the base model and runtime together Using the weight ceiling and the assumption of roughly 4.5 bits per weight, identify the size class. Shortlist two or three models in that class whose licence fits, whose architecture suits the context requirement (grouped-query attention with a favourable ratio, or a hybrid design), and whose instruction-tuned behaviour is close to the product's needs. In parallel, choose the runtime for each target platform, and confirm that each shortlisted architecture runs efficiently on it — including any NPU you intend to use. Check whether the model vendor publishes quantized or quantization-aware-trained checkpoints in a format the runtime supports. If it does, those are usually the best starting artefacts. Run the product evaluation on each shortlisted model at full precision. This establishes the ceiling of what each model can achieve and catches models that are unsuitable before any compression effort is spent. Step 3: Quantize weights with a calibrated method Quantize each remaining candidate's weights to about 4 bits using the best calibrated method native to the chosen runtime: an imatrix-calibrated k-quant or i-quant for llama.cpp, AWQ or GPTQ for GPU runtimes, the vendor's calibrated flow for NPU targets, or the vendor's QAT checkpoint. Build calibration data from the product's own distribution, formatted with the model's chat template, covering every language and task type. Keep the embedding and output layers, and any layers that sensitivity analysis flags, at higher precision if the format allows. Quantize the KV cache to 8 bits unless measurement shows a problem. Evaluate: product evaluation plus drift signals (KL divergence, flips) against the full-precision model. Measure on the device. Very often this is the end of the compression work. If the model meets both budgets, go to step 7. Step 4: If the device budget is still exceeded If the 4-bit model does not fit or is too slow, the options, in order of preference, are: First, a smaller base model at 4 bits. This is usually better than pushing a larger model below 4 bits with post-training methods. Second, architecture-level savings that do not touch weight precision: a shorter maximum context, a more cache-efficient model, prompt caching for fixed prefixes, dropping unused encoders, trimming the vocabulary for single-language products. Third, lower bit-widths for the least sensitive layers, keeping sensitive ones at 4 bits or above. Mixed 3- and 4-bit configurations, carefully calibrated, can save meaningful memory with tolerable loss on robust models. Fourth, quantization-aware training to 3 or 2 bits, with self-distillation. This is a training project, but it is the path that the most aggressive shipped deployments have taken. Fifth, for speed specifically, speculative decoding, provided memory headroom allows it, and activation quantization on an NPU or GPU for prefill-heavy workloads. Structured pruning plus distillation, to manufacture a custom-sized model, belongs here only if no available model of the needed size meets the quality bar and the organisation can afford to retrain. Step 5: If the quality budget is missed If the 4-bit model fits but falls short on some layer of the evaluation, diagnose first. Compare the compressed model with its full-precision parent on the failing cases. If the parent also fails, the problem is the base model, not compression; specialisation (step 6) or a stronger base is needed. If the parent passes and the compressed model fails, compression is the cause. For compression-caused failures, try, in order: better calibration data that covers the failing behaviour; higher precision for sensitive layers, or a 5- or 6-bit format overall if the device budget allows; low-rank recovery adapters trained with self-distillation against the exact shipped weights; full QAT. Step 6: Specialise with adapters Most products benefit from specialising the compressed model to their tasks. Train LoRA adapters on the shipped quantized base, using task data distilled from a stronger teacher where possible, mixed with general instruction data to protect general behaviour, in the exact chat template the product uses. Evaluate the adapted model on the full product evaluation, including general-behaviour and safety layers, not only on the target task. If the product has several features, consider one adapter per feature on a shared base, with the engineering implications discussed in the low-rank chapter: all adapters trained on the identical base, coordinated updates, and per-adapter evaluation. Step 7: Harden and monitor Before shipping, add the runtime protections that compensate for compressed-model fragility: constrained decoding for every structured output, sensible limits on generation length, fallbacks for malformed outputs, and, where a cloud path exists, a policy for routing requests the on-device model cannot handle. After shipping, keep the evaluation and on-device measurements in an automated pipeline, run them on every new artefact and runtime release, and maintain canary prompts drawn from past failures. Scenario one: a private assistant on mid-range phones A team is building a messaging assistant that summarises conversations and drafts replies entirely on-device, for Android phones with 8 gigabytes of memory and above, in English, Spanish and Portuguese. The device budget, on the lowest-tier phone, leaves perhaps 2.5 gigabytes for the model and cache. Conversations to summarise can run to 6,000 tokens. Users expect replies to start within about two seconds and stream faster than reading speed. Applying the blueprint: at about 4.5 bits per weight, a model of three to four billion parameters would occupy around 2 gigabytes, leaving too little room for a 6,000-token cache in 16-bit precision; a model of one to two billion parameters leaves comfortable room. The team shortlists small models around 1 to 2 billion parameters with grouped-query attention or hybrid attention, permissive licences and good multilingual support, and confirms that its chosen runtime supports them on CPU and on the target NPUs. It quantizes weights to 4 bits with a calibrated method, using calibration data built from synthetic conversations in all three languages formatted with the model's chat template, keeps the output layer at 8 bits, and quantizes the cache to 8 bits. Evaluation shows good summaries in English and Spanish and noticeably weaker Portuguese, in both the compressed and full-precision models. The base model is the limitation. The team distils summaries and replies from a larger open teacher in all three languages, filters them, and trains a LoRA adapter on the quantized base. Portuguese quality reaches the threshold. Format compliance for the structured summary is near perfect with constrained decoding and imperfect without it, so constrained decoding ships. Time to first token on the CPU for 6,000-token conversations is too slow; moving prefill to the NPU through the vendor backend brings it within budget, while decode stays on the CPU, near the bandwidth ceiling. Nothing exotic was needed. The decisive choices were the size class, the calibration data, a task adapter, constrained decoding and putting prefill on the right processor. Scenario two: a document tool on laptops A team is building a desktop application for lawyers that answers questions about long contracts locally, on laptops with 16 to 32 gigabytes of unified memory, including Apple silicon Macs and Windows Copilot+ PCs. Here memory is less constrained, but contexts are long — contracts plus retrieved precedents can exceed 30,000 tokens — and accuracy on precise retrieval is non-negotiable. The blueprint points to a larger model: at 4.5 bits, a model of eight or nine billion parameters occupies around 5 gigabytes, leaving room for a large cache. The team prefers a model with an efficient attention design, because a 32,000-token cache for a conventional 8-billion-parameter model with grouped-query attention would itself run to several gigabytes. It quantizes weights to 4 bits with calibration on legal text and the model's chat template, and tests KV-cache quantization carefully: an 8-bit cache passes long-context retrieval tests; a 4-bit key cache measurably reduces retrieval accuracy at the far end of long documents, so keys stay at 8 bits. Time to first token is the dominant complaint, because every question involves a long prefill. The team uses prompt caching for the contract text, so that follow-up questions reuse the cached prefix, and runs prefill on the GPU — on Apple silicon through MLX, on Windows through a GPU or NPU provider. Speculative decoding using prompt lookup proves effective because answers often quote the contract verbatim. The decisive choices were cache precision tested against the product's own retrieval task, prompt caching, and a speculative method matched to the task's tendency to quote. Scenario three: an offline voice assistant on an embedded board A manufacturer wants an offline voice command interpreter for industrial equipment, running on an ARM single-board computer with 4 gigabytes of memory and modest bandwidth. Inputs are short transcribed commands; outputs are structured function calls from a fixed set of about forty operations. The device budget is tight on bandwidth: a board of this class may sustain well under twenty gigabytes per second, so a 1-gigabyte model can generate at most around fifteen to twenty tokens per second, and probably less. But the task is narrow, the context short and the output a small JSON object. The blueprint points to a very small model — a few hundred million to one billion parameters — specialised by distillation. The team generates tens of thousands of synthetic commands with paraphrases and noise resembling speech-recognition errors, labels them with a large teacher, verifies the labels against the function schema, and fine-tunes a small model with LoRA, then merges and quantizes to 4 bits with calibration on the same command distribution. Constrained decoding against the function-call grammar guarantees valid output. The resulting model, a fraction of a gigabyte, runs within the latency budget on the board's CPU with llama.cpp. The decisive choices were recognising that a narrow task needs a tiny specialised model rather than a compressed general one, and letting distillation and constrained decoding do the work that a larger model would otherwise have done. What the scenarios share In none of the three scenarios did the team need 2-bit quantization, unstructured pruning or a novel algorithm. Each succeeded by getting the budgets right at the start, choosing a base model sized to them, quantizing carefully with representative calibration data, measuring with an evaluation built around the product, and spending training compute — distillation and adapters — exactly where the evaluation showed a gap. The exotic techniques in this book are real and occasionally decisive. The ordinary ones, done well, ship most products. Conclusion The techniques in this book can be listed in a sentence — quantize, prune, distil, adapt — and the list is what most people take away from a survey of model compression. It is the least useful thing to take away. What the preceding chapters show is that the techniques are not alternatives on a menu but prices in a market, and that the market is set by two budgets that most teams never write down. Once the budgets are explicit, several things that look like open questions turn out to have answers. Should we use the larger model at 2 bits or the smaller one at 4? The device arithmetic says both read about the same number of bytes per token, so they will decode at similar speeds. The precision-scaling evidence says that heavily trained models — which small modern models are — lose more under aggressive post-training quantization than older models did. The evaluation chapter says the loss will show up first in long, multi-step, structured behaviour, which is what most products depend on. Unless someone has done quantization-aware training to 2 bits, the smaller model at 4 bits is the better bet, and the place to spend effort is in specialising it. Should we prune? Ask what the hardware does with a zero. On almost every phone and laptop the answer is nothing, so unstructured sparsity saves nothing that matters. Structured pruning saves everything, but it is a training project. For most teams the right "pruning" is cheaper and more mundane: drop the vision encoder you do not use, cap the context you do not need, and pick a model whose attention design does not waste cache. Will the NPU make it faster? It will make prefill faster and decode more efficient. It will not make decode faster than the memory bus allows, because nothing will. The question to ask of any accelerator is which phase of generation it speeds up and whether that phase is the one users complain about. Is the compressed model as good as the original? Not if the only evidence is that its benchmark score moved by less than a point. Ask how many answers flipped, how far its distributions diverged, and what happened on the long, formatted, multilingual, multi-turn tasks that the product actually performs. What the field has settled Some things are now well established. Weight-only quantization to about 4 bits, with a calibration-aware method and calibration data that resembles real use, is close to free for most models and should be the default. Activation outliers are the central obstacle to quantizing language models more aggressively, and the effective answers are to move them into the weights (smoothing), spread them out (rotations), or train the model to live with them (QAT). Distillation from a stronger model is the most effective way to give a small model capabilities it lacks, and self-distillation from the original model is the most effective way to repair compression damage. Low-rank adapters make specialisation cheap enough to be routine and let one compressed base serve many tasks. And speed at the edge is governed by bytes moved per token, which ties every one of these techniques back to the same measurement. The tools have matured around these conclusions. A model can be taken from an official checkpoint to a calibrated 4-bit file in minutes, fine-tuned with adapters on a laptop, and deployed through runtimes that span phones, PCs and embedded boards. Vendors increasingly do the hardest step — quantization-aware training — themselves and publish the result. What remains unsettled Other questions remain genuinely open, and a practitioner should hold views on them loosely. How low can precision go? Apple's 2-bit on-device model shows that quantization-aware training at very low bit-widths can ship in a consumer product. Ternary models such as BitNet b1.58 show that models trained from the start at under 2 bits can be competitive at small scale. Whether these approaches will become the norm depends on whether vendors choose to pay for quantization-aware or native low-bit training of their best models, and on whether hardware arrives that turns the theoretical efficiency of ternary arithmetic into real energy savings. What will the next architectures demand? Hybrid models that replace most attention with linear recurrences, mixture-of-experts models small enough for laptops, and multimodal models with large embedding tables each change which bytes dominate and which methods apply. Quantization methods tuned on standard transformer layers will need adjusting for recurrent state, and NPU compilers must learn new operators. The budgeting discipline transfers; the specific recipes may not. How should compressed models be evaluated? The field has better drift metrics than it had a few years ago, but there is still no standard, widely adopted evaluation that captures what compression does to long-horizon, agentic and safety-relevant behaviour. Until there is, every team must build its own, and published claims of "lossless" compression should be read as claims about the benchmarks reported, not about behaviour in general. Where is the boundary between device and cloud? As on-device models improve, the set of tasks that must leave the device shrinks, but it does not vanish. Hybrid systems that route requests between a local model and a remote one — as several platform vendors now do — raise their own questions of privacy, consistency and evaluation that compression alone does not answer. What to do differently For a reader about to start an edge project, the practical conclusions are short. Write down both budgets before choosing anything, and derive the size class from the memory and bandwidth arithmetic rather than from model-card scores. Build the product evaluation first, including drift metrics against the uncompressed model, and run it on every artefact. Choose the base model and runtime together, and confirm that the architecture runs well on the target silicon before compressing anything. Quantize to about 4 bits with a calibrated method and representative calibration data; take a vendor's QAT checkpoint whenever one fits. Spend training compute — adapters, distillation, QAT — only where the evaluation shows a specific gap, and train against the exact weights you will ship. Use the runtime's protections, especially constrained decoding, to cover the fragility that compression introduces. Measure on the slowest device you support, for longer than feels necessary. None of this is glamorous. It is, however, the difference between a compressed model that looks good in a table and one that works in a user's hand. Compression for the edge rewards discipline more than cleverness: the cleverest method in this book will not rescue a project whose budgets were never written down, and the plainest methods, applied in the right order and measured honestly, are enough to ship most of what people want to build. Glossary Activation. An intermediate value computed inside the network for a particular input, such as the input to a linear layer. Unlike weights, activations change with every input. Calibration data. A small set of representative inputs passed through a model to collect statistics used by a quantization or pruning method. No training takes place. Decode. The phase of generation in which the model produces one token at a time. It is usually limited by memory bandwidth. Distillation. Training a student model to imitate a teacher model, typically by matching the teacher's output probability distributions rather than only the correct tokens. Group-wise quantization. Quantization in which each small block of weights, commonly 32 to 128 values, has its own scale factor. Grouped-query attention. An attention design in which several query heads share each key and value head, reducing the size of the KV cache. KV cache. The stored keys and values for every processed token at every layer. It lets the model attend to earlier tokens without recomputing them, and it grows with context length. KL divergence. A measure of how much one probability distribution differs from another. In this book it is used to measure how far a compressed model's predictions have drifted from the original model's. LoRA. Low-rank adaptation. A model is fine-tuned by learning a small update expressed as the product of two thin matrices while the original weights stay frozen. NPU. Neural processing unit. A dedicated accelerator for tensor operations, usually optimised for low-precision integer arithmetic. Outlier. An activation or weight value far larger than typical values in its tensor. Outliers make low-precision quantization difficult. Prefill. The phase of generation in which the model processes the whole prompt at once and builds the KV cache. It is usually limited by compute. Post-training quantization (PTQ). Quantizing a trained model without further training, sometimes with calibration data. Quantization-aware training (QAT). Training or fine-tuning with quantization simulated in the forward pass, so that the model learns weights that survive rounding. Rotation. Multiplying weights and activations by an orthogonal matrix, often a Hadamard matrix, to spread outlier values evenly before quantization without changing the network's function. Speculative decoding. A technique in which a cheap draft proposes several tokens and the main model verifies them in one pass. It produces several tokens for roughly the memory cost of one. Structured pruning. Removing whole neurons, attention heads, channels or layers, so that the result is a smaller dense model. Time to first token. The delay between submitting a request and receiving the first generated token. It is dominated by prefill. Further Reading Foundations of quantization for language models Tim Dettmers, Mike Lewis, Younes Belkada and Luke Zettlemoyer, "LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scale" (2022). The paper that documented emergent activation outliers and why they break naive quantization. Elias Frantar, Saleh Ashkboos, Torsten Hoefler and Dan Alistarh, "GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers" (ICLR 2023). Second-order error compensation that made 4-bit and 3-bit weights practical. Ji Lin, Jiaming Tang, Haotian Tang, Shang Yang, Wei-Ming Chen, Wei-Chen Wang, Guangxuan Xiao, Xingyu Dang, Chuang Gan and Song Han, "AWQ: Activation-aware Weight Quantization for LLM Compression and Acceleration" (MLSys 2024). The clearest statement of why activation statistics decide which weights matter. Guangxuan Xiao, Ji Lin, Mickael Seznec, Hao Wu, Julien Demouth and Song Han, "SmoothQuant: Accurate and Efficient Post-Training Quantization for Large Language Models" (ICML 2023). Migrating activation difficulty into weights for W8A8 inference. Saleh Ashkboos and colleagues, "QuaRot: Outlier-Free 4-Bit Inference in Rotated LLMs" (2024), and Zechun Liu and colleagues, "SpinQuant: LLM Quantization with Learned Rotations" (ICLR 2025). The two key papers on rotation-based quantization. Albert Tseng, Jerry Chee, Qingyao Sun, Volodymyr Kuleshov and Christopher De Sa, "QuIP#: Even Better LLM Quantization with Hadamard Incoherence and Lattice Codebooks" (ICML 2024). The route below 3 bits. Tanishq Kumar and colleagues, "Scaling Laws for Precision" (2024). Why heavily trained models are harder to quantize after training. Cache, pruning and distillation Zirui Liu and colleagues, "KIVI: A Tuning-Free Asymmetric 2bit Quantization for KV Cache" (ICML 2024), and Coleman Hooper and colleagues, "KVQuant" (NeurIPS 2024). How keys and values differ and how to quantize each. Elias Frantar and Dan Alistarh, "SparseGPT: Massive Language Models Can Be Accurately Pruned in One-Shot" (ICML 2023), and Mingjie Sun, Zhuang Liu, Anna Bair and J. Zico Kolter, "A Simple and Effective Pruning Approach for Large Language Models" (Wanda, ICLR 2024). Saurav Muralidharan and colleagues, "Compact Language Models via Pruning and Knowledge Distillation" (NVIDIA, 2024). The Minitron recipe, the most complete published account of structured pruning followed by distillation. Geoffrey Hinton, Oriol Vinyals and Jeff Dean, "Distilling the Knowledge in a Neural Network" (2015), and Rishabh Agarwal and colleagues, "On-Policy Distillation of Language Models: Learning from Self-Generated Mistakes" (GKD, ICLR 2024). DeepSeek-AI, "DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning" (2025). Includes the distilled small reasoning models and the comparison with applying reinforcement learning directly to small models. Adaptation Edward Hu and colleagues, "LoRA: Low-Rank Adaptation of Large Language Models" (2021), and Tim Dettmers, Artidoro Pagnoni, Ari Holtzman and Luke Zettlemoyer, "QLoRA: Efficient Finetuning of Quantized LLMs" (NeurIPS 2023). Yixiao Li and colleagues, "LoftQ: LoRA-Fine-Tuning-Aware Quantization for Large Language Models" (ICLR 2024). Using adapters to absorb quantization error. Shipped systems and evaluation Apple, "Apple Intelligence Foundation Language Models Tech Report 2025" (arXiv 2507.13575). Describes 2-bit quantization-aware training, 4-bit embeddings, an 8-bit KV cache, KV-cache sharing and quality-recovery adapters for the on-device model. Shuming Ma and colleagues, "BitNet b1.58 2B4T Technical Report" (Microsoft Research, 2025). The first open native ternary model at 2 billion parameters. Abhinav Dutta and colleagues, "Accuracy is Not All You Need" (Microsoft Research, 2024). Why aggregate accuracy hides behavioural change in compressed models, and the case for flip and divergence metrics. Yaniv Leviathan, Matan Kalman and Yossi Matias, "Fast Inference from Transformers via Speculative Decoding" (ICML 2023). The original account of speculative decoding. Tools The llama.cpp repository and its documentation on quantization types, importance matrices and the perplexity and KL-divergence tools; the documentation for MLX, ExecuTorch, LiteRT-LM and ONNX Runtime GenAI; and the Hugging Face PEFT library. Each changes quickly, and the current documentation is a better guide than any snapshot. Hashtags: #SmallLanguageModels #SLM #ArtificialIntelligence #MachineLearning #DeepLearning #EdgeIntelligence #EdgeAI #OnDeviceAI #ModelCompression #NeuralNetworkPruning #ModelPruning #Quantization #ModelQuantization #PostTrainingQuantization #QuantizationAwareTraining #LowBitInference #FourBitQuantization #KnowledgeDistillation #TeacherStudentLearning #LowRankAdaptation #LoRA #EfficientAI #LightweightLanguageModels #MemoryOptimization #KVCacheOptimization #InferenceOptimization #MobileAI #EmbeddedAI #LocalLLM #PrivacyPreservingAI

Download the Book (PDF): Introduction It is 2:40 on a Tuesday morning in late October. A sophomore resident assistant is sitting on the floor of a hallway outside a bathroom, waiting for campus police and an ambulance to arrive for a first-year student who has had far too much to drink. She has done everything her training told her to do. She called the professional staff member on duty, she stayed with the student, she turned him on his side, she kept the gathering crowd back. In six hours she has an organic chemistry midterm. In two days she has a floor program due. By Thursday, three different residents will have knocked on her door wanting to talk about what they saw, and one of them will mention, almost in passing, that she has not been eating. Two buildings away, a junior who serves as president of a two-hundred-member cultural association is awake for different reasons. The organization's biggest event of the year is in eleven days. The treasurer has gone quiet, the venue contract still needs a signature from the student activities office, and a group chat of forty people is pinging with questions that only he seems able to answer. He started the semester with a plan to protect his grades. He has now missed two lectures in a row to handle catering, and he has told himself, several times, that he will catch up after the event. Neither of these students is failing. By most measures they are succeeding: trusted, capable, visible, the people others go to when something needs doing or someone needs help. That is exactly why they are at risk. Student leadership positions reward the very traits that make burnout likely: conscientiousness, responsiveness, a strong sense of responsibility, and an unwillingness to let people down. The student who says yes, who picks up the phone, who stays late, becomes the student to whom more is given, until the role quietly consumes the person who holds it. This book is for those students: resident assistants and community advisors, presidents and officers of clubs, captains, peer mentors, orientation leaders, and anyone else who has taken on responsibility for other students while still being a student. It is also for the people who support them: residence life professionals, student activities advisors, faculty mentors, and parents who have watched a son or daughter sound more exhausted each time they call home. Why the question matters now Student leaders are serving at a moment when the demand for support among their peers is high. The Healthy Minds Study, one of the largest ongoing surveys of college student mental health in the United States, gathered responses from more than 84,000 students at 135 institutions in the 2024 to 2025 academic year. It found that 37 percent screened positive for moderate to severe depression, 32 percent for moderate to severe anxiety, and 11 percent reported suicidal thoughts in the past year. Those figures were an improvement on the peak of 2022, when the equivalent numbers were 44, 37 and 15 percent, and the researchers were cautiously encouraged that the decline had held for three years running. But even the improved figures mean that on a residence hall floor of forty students, it is ordinary rather than exceptional for several to be struggling seriously at any given time. The first person those students tell is frequently not a counselor. It is a roommate, a friend, a teammate, or the student leader whose door is open at the end of the hall. RAs in particular have become a front line of the campus mental health system without ever being designed as one. When reporters in California spoke with resident assistants trying to unionize across the Cal State system in 2025, one described the role this way: "Sometimes we are (students') therapists... Sometimes we're their doctors. We're sitting there calling 911 for them." Another said simply, "There's just no clear distinction in what our role is." Institutions have started to notice. Some universities have split the traditional RA role into separate community-building and crisis-response positions; others have placed graduate social work interns or counseling trainees in residence halls so that undergraduates are not the only people on hand when something goes wrong. RAs at Boston University unionized in 2023 and struck for four days in April 2024, raising workload, training and compensation as central issues. These are signs that the problem is real and structural. They are not yet a solution for the student sitting in the hallway at 2:40 a.m. What this book argues The argument of this book is simple to state and harder to live: student leader burnout is less a personal weakness than the predictable result of roles that have no edges, and the leader's most important protective work is to build those edges deliberately. The edges are of four kinds. The first is an emotional edge. Leaders who care about people will feel their pain, and that is not the problem. The problem is a specific way of feeling it, which researchers call empathic distress, that drains the helper and eventually makes them less helpful. There is a different way of staying with someone's suffering, rooted in compassion rather than shared distress, that is both more sustainable and more useful, and it can be learned. The second is an edge of scope. An RA is not a therapist, a club president is not a crisis counselor, and a peer is not a physician. Knowing where your role ends, and knowing exactly whom to hand a situation to, is not a failure of care. It is what care looks like from someone in your position. The third is an edge of labor. A club that depends on one person is fragile, and a leader who does everything is teaching everyone else to do nothing. Delegation and succession planning are the practical tools that turn a personality-dependent organization into one that can survive its president graduating, getting sick, or simply taking a weekend off. The fourth is an edge of time and body. Sleep, meals, classes and exams are not what you get to once the organization's needs are met. They are the foundation that makes meeting those needs possible, and for a student they are also the reason you are on campus in the first place. Running through all four is a claim that some readers will resist: prioritizing your own health over organizational demands is not selfish. It is a leadership duty. A depleted leader makes worse decisions, misses warning signs, snaps at the people they serve, and models for everyone watching that the way to be good at this is to disappear into it. The leader who protects their sleep, refers appropriately, delegates well and says no when necessary is doing the job better, not worse. How the book is organized The first chapter describes why student leadership roles burn people out, drawing on what occupational research has learned about burnout and applying it to the particular shape of RA and officer positions. The second looks closely at crisis exposure: what it does to helpers over time, why terms such as vicarious trauma and secondary traumatic stress exist, and what the research specifically on resident assistants has found. The third chapter explains the distinction between empathic distress and compassion developed by the neuroscientists Tania Singer and Olga Klimecki, and turns it into something a tired student can use. The fourth chapter is about role boundaries and referral, including what to say, whom to call, and how to understand the limits of confidentiality in your position. The fifth and sixth turn to organizations: how to delegate without losing quality, and how to plan for succession so that the next leader inherits a working system rather than a crisis. The seventh chapter covers the interpersonal skills that make boundaries hold in practice, including saying no and working with supervisors and advisors. The eighth addresses sleep, academics and physical health, the parts of self-care that most directly determine whether everything else is possible, and ends with guidance on recognizing when you yourself need help. The conclusion draws these threads together into an argument about what student leaders owe the people who come after them. Throughout, you will meet students in illustrative scenarios. They are composites drawn from common situations, not real individuals, and they are there to make ideas concrete. Wherever the book states a fact or a finding, the source is given in the notes. A note on safety and scope This book offers general information and practical guidance. It does not replace individual advice from a physician, counselor or other qualified professional, and it does not replace the training and protocols of your own institution, which always take precedence where they are more specific. If you, or someone you are supporting, is in immediate danger, call 911 or your campus emergency number. In the United States, you can call or text 988 to reach the 988 Suicide and Crisis Lifeline at any hour, or chat through 988lifeline.org. Those resources are for you as much as for the students you serve. Student leadership can be one of the most meaningful experiences of college. People who held these roles often describe them years later as the place where they learned how to manage people, stay calm in a crisis, and understand how institutions work. None of that requires sacrificing your health. The rest of this book is about how to keep the meaning and lose the damage. Chapter 1: The Job With No Edges Most student leaders do not burn out because they are weak, disorganized or bad at their jobs. They burn out because they are good at their jobs in roles that have no natural stopping point. A shift at a coffee shop ends when the shift ends. A lab section ends when the lab closes. A resident assistant role, or the presidency of an active club, ends only when you decide it does, and there is almost always one more message, one more resident, one more task that seems to justify not deciding yet. To understand how to protect yourself, it helps to understand what burnout actually is, why these particular positions produce it so reliably, and why the students most likely to take them on are also the students most likely to be harmed by them. What burnout is, and what it is not The word burnout is used so loosely that it can mean anything from a bad week to a major depressive episode. It helps to be precise. In 2019 the World Health Organization included burnout in the eleventh revision of the International Classification of Diseases, not as a medical condition but as an "occupational phenomenon." The WHO defines it as a syndrome resulting from chronic workplace stress that has not been successfully managed, and describes three dimensions: feelings of energy depletion or exhaustion; increased mental distance from one's job, or feelings of negativism or cynicism about it; and reduced professional efficacy. The WHO is explicit that the term refers to the occupational context and should not be applied to experiences in other areas of life. That last point matters for student leaders, because it raises a fair question: is an RA position or a club presidency really a job? For RAs the answer is plainly yes. They are hired, supervised, evaluated, compensated (usually with housing and sometimes meals), and can be fired. Club presidents are usually unpaid, but the structure of their experience closely resembles work: responsibilities to others, deadlines, budgets, accountability to an institution, and performance that is judged. The burnout research applies to them because the conditions that produce burnout are present, whether or not a paycheck is attached. The psychologist Christina Maslach, whose work shaped the modern understanding of burnout, and her colleague Michael Leiter have argued that burnout is best understood not as a trait of individuals but as a mismatch between a person and their working conditions. Their model identifies six areas of work life in which such mismatches occur: workload, control, reward, community, fairness and values. The more of these areas are out of alignment, the more likely burnout becomes. The practical implication is important. If burnout grows out of the fit between a person and a role, then it cannot be fixed only by making the person tougher. Something about the role, or about how the person inhabits it, has to change. Burnout is also different from depression, although the two overlap and can occur together. Burnout, in the WHO's sense, is tied to a specific domain: the exhausted RA may still feel fine on a weekend trip home. Depression tends to spread across the whole of life, affecting appetite, sleep, interest in things once enjoyed, and sense of self-worth everywhere, not only at work. If what you feel has stopped being about the role and has become about everything, that is a signal to talk with a health professional rather than simply to reorganize your schedule. Chapter 8 returns to this in more detail. Six mismatches in student leadership Maslach and Leiter's six areas map onto student leadership with uncomfortable precision. Workload. The official description of an RA position might list a certain number of programs, duty nights and floor meetings. The real workload includes everything that happens between those events: the roommate conflict that surfaces at 11 p.m., the resident who wants to talk after a breakup, the incident report that takes an hour to write, the maintenance request that has to be followed up three times. A 2025 study in the Journal of College and University Student Housing by Chris Heasley, Katie Boone and Kevin Conn analyzed 426 RA job descriptions from 234 institutions and found that every one of twenty professional competencies used to describe entry-level housing work appeared in more than a quarter of those descriptions. RAs, in other words, are routinely asked to be competent at almost everything a full-time housing professional does. In focus groups, the RAs described feeling overwhelmed, and one observed that crisis response follows a "90/10 rule," in which a small number of incidents consume an outsized share of time and energy. The authors' summary of the problem is memorable: superheroes have one superpower, not twenty. For club presidents, workload expands through a different mechanism. Many student organizations have an officer structure on paper and a single functioning leader in practice. The vice president handles one event a semester, the treasurer processes reimbursements slowly, and everything that falls between the cracks lands on the president because the president is the one who notices. Control. Burnout is more likely when people are responsible for outcomes they cannot control. RAs are responsible for the wellbeing of residents whose choices are their own. A resident who drinks dangerously, stops going to class, or refuses help is not under the RA's control, yet it is easy for the RA to feel accountable for what happens. Club presidents face a quieter version of this: the success of an event depends on venue offices, funding boards, vendors and volunteers, most of whom the president has no authority over. Reward. Student leaders are often compensated in ways that do not track effort. An RA receives the same housing whether the semester includes two crises or twenty. A club president may receive a line on a résumé and the gratitude of members, which is real but unevenly distributed. When effort rises and reward does not, the gap is felt as exhaustion and, eventually, resentment. The labor organizing among RAs at several universities is partly an attempt to close this gap; at Boston University, for instance, the union argued that free housing alone did not adequately compensate for round-the-clock on-call responsibilities. Community. Supportive relationships at work are among the strongest protections against burnout. Student leaders can be surprisingly isolated. An RA may be friendly with everyone on the floor and close to no one, because the role requires a certain distance: you cannot fully be one of the group when you may have to document a policy violation by one of them. A club president may find that friendships inside the organization become complicated by authority. Isolation removes the ordinary outlet of talking things through with people who understand. Fairness. Perceptions of unfairness, such as being given a harder floor than a peer for the same compensation, or doing the work of three officers while receiving the same title, erode motivation quickly. Students are especially attuned to fairness, and unfairness that goes unaddressed tends to harden into cynicism, which is one of burnout's defining features. Values. Finally, burnout is more likely when the work conflicts with what a person believes in. The RA who took the job to build community and finds that most of the role is enforcing policy and writing reports may feel a slow erosion of meaning. The president who founded a club to celebrate a culture and now spends every week on spreadsheets and room reservations may wonder what happened to the reason they started. Demands, resources and the drift toward depletion A second useful framework comes from the Job Demands-Resources model developed by the organizational psychologists Arnold Bakker and Evangelia Demerouti. It sorts the features of any role into two categories. Demands are the aspects of a job that require sustained effort and therefore carry physical or psychological costs: time pressure, emotional intensity, difficult interactions, unpredictable hours. Resources are the aspects that help people achieve goals, reduce the cost of demands, or stimulate growth: supportive supervisors, clear expectations, autonomy, feedback, skilled colleagues and training. The model's central insight is that high demands alone do not necessarily produce burnout. High demands combined with low resources do. A student leader with a heavy role but a responsive supervisor, a capable team, clear protocols and time to recover can remain engaged for years. The same student in the same role with an absent advisor, no functioning officers, vague expectations and no recovery time will deplete quickly. This gives you a practical way to think about your own situation. When you feel yourself sliding, ask two questions rather than one. Not only, "How can I reduce what is being asked of me?" but also, "What resources am I missing that would make these demands manageable?" Sometimes the answer is fewer duties. Just as often it is a clearer protocol, a supervisor who returns messages, a co-officer who actually shares the load, or training you never received. Resources can often be requested, and later chapters give specific ways to request them. It is also worth noticing how demands tend to drift upward over a year while resources stay flat. The first month of an RA role involves intensive training, a cohort of fellow RAs going through the same thing, and supervisors who check in often. By midterms, training is over, the cohort is scattered across buildings, supervisors are managing their own crises, and the floor has had time to develop problems. The demands have risen just as the resources have fallen away. The same pattern holds for clubs, where early-semester enthusiasm and a full officer team give way, by the middle of the term, to a smaller group of people doing most of the work. Knowing that this drift is typical lets you plan for it rather than being surprised by it. Why good leaders are the most exposed There is an uncomfortable pattern in who burns out. It is rarely the student who does the minimum. It is the student who notices the resident eating alone, who answers messages within minutes, who re-does the flyer because the first version was not quite right, who stays after the meeting to help clean up. These are the qualities that got them selected. They are also the qualities that remove every natural brake on overwork. Organizational researchers have documented versions of this pattern in workplaces. Rob Cross, Reb Rebele and Adam Grant, writing in the Harvard Business Review in 2016, reported that in most of the organizations they studied, 20 to 35 percent of value-added collaborations came from only 3 to 5 percent of employees. Those highly sought-after helpers became bottlenecks, their own work suffered, and burnout and turnover became real risks. The better someone is at helping, the more requests they attract, until helping becomes all they do. A related line of research by Mark Bolino and colleagues, published in the Journal of Applied Psychology in 2015, introduced the idea of "citizenship fatigue": a state of feeling worn out, tired or on edge that can follow from repeatedly going beyond the formal requirements of a role. People experience it most when they feel pressure to keep going the extra mile and have little support for doing so. Student leaders, whose roles are built almost entirely out of discretionary effort, are an obvious population for it. Consider an illustrative case. A junior named Priya becomes president of her campus's pre-health society. She is organized and generous, and in her first month she answers every member question personally, drafts every email, and attends every committee meeting to make sure things go well. Members quickly learn that Priya is the fastest route to an answer, so they stop asking committee chairs. The committee chairs, finding themselves bypassed, stop taking initiative. By November, Priya is doing the work of the whole executive board, and when she tries to hand something back, no one knows how to do it. Nothing Priya did was wrong in isolation. Her helpfulness simply taught the organization to depend on her, and dependence is a demand that grows. The student part of student leader One more feature distinguishes student leadership from ordinary employment: the leader is also a full-time student, and their academic work is the reason they are in college at all. That creates a structural conflict. Leadership demands are urgent and visible; someone is at the door, an event is on Saturday, a message is waiting. Academic demands are mostly deferred and private; the reading can be done tomorrow, the problem set is due next week, and no one notices when you skip a lecture. Urgent and visible demands reliably win over deferred and private ones, even when the private ones matter more. The result is a pattern many student leaders will recognize: steadily declining academic effort through the middle of a semester, masked by a belief that it can be recovered after the busy period. Sometimes it can. Often the busy period never ends, because a new one begins as soon as the last one closes. For RAs, academic standing is usually also a condition of employment, which means that neglecting classes can eventually cost the role itself. Sleep is the hidden variable in this conflict. Leadership work tends to happen in the evenings and at night, when residents are home and members are free. Academic work is then pushed later, and sleep is what gives. Chapter 8 examines the evidence on sleep and academic performance in detail. For now it is enough to note that the three dimensions of burnout, exhaustion, cynicism and reduced effectiveness, are also recognizable effects of chronic sleep loss, and that in student leaders the two often feed each other. For RAs there is an additional twist that no ordinary job imposes: you live at your workplace. The hallway you walk down to brush your teeth is the hallway you are responsible for. The noise through the wall is potentially something you will have to address. Residents see you in pajamas, in the dining hall, at a party, and each of those encounters carries the possibility of becoming work. Psychologists who study recovery from work stress describe "psychological detachment," the experience of mentally switching off from work during non-work time, as one of the most reliable predictors of feeling restored. Detachment is hard for anyone who takes work home. It is harder still when home is work. An RA who never leaves the building may never, in a meaningful sense, go off duty, even on nights when they are not formally on call. This is one reason the most effective RAs tend to cultivate a place, and a group of people, that have nothing to do with the role: a library carrel in another building, a team, a religious community, friends from a major or a job elsewhere on campus. These are not escapes from responsibility. They are the conditions under which responsibility can be sustained. Recognizing the early drift Burnout seldom arrives suddenly. It creeps in through small changes that are easy to explain away. Some early signs are worth watching for in yourself: · Dread before routine tasks you once found meaningful, such as floor rounds or weekly meetings. · Irritation at the people you serve, especially at ordinary requests. The resident who knocks with a simple question starts to feel like an imposition. · A private tone of cynicism: thinking of residents or members as problems, or thinking that nothing you do makes a difference. · Checking messages compulsively while also avoiding opening them. · Academic slippage that you keep promising to fix next week. · Sleep that is shorter, later or more broken than it was at the start of the term. · Withdrawal from friends outside the role, because there is no time or because you have nothing left. None of these alone means you are burning out. Together, and persisting for weeks, they suggest that the demands of the role have outrun the resources you have to meet them. The rest of this book is about correcting that balance, beginning with the most emotionally costly part of the work: what happens to a helper who is repeatedly exposed to other people's crises. Chapter 2: What Crisis Duty Does to the Helper Every RA training program covers what to do in a crisis. Far fewer spend much time on what the crisis does to the RA. The emphasis is understandable: when a resident is in danger, the resident's safety comes first. But the helper does not simply walk away unchanged. A student who has sat with a peer after a sexual assault, found a resident unresponsive, talked someone through a panic attack at 3 a.m., or called emergency services for a student expressing suicidal intent carries some of that experience forward. One incident may pass with little lasting effect. Several over a semester, layered on top of academic pressure and broken sleep, can add up to something that deserves a name and a plan. Club leaders are not exempt. Officers of identity-based organizations often become confidants for members facing discrimination or family rejection. Leaders of service clubs may work directly with people in hardship. Team captains may be the first to hear about an eating disorder or an abusive relationship. Any student who is known as someone who cares will, sooner or later, be told things that are heavy to carry. This chapter describes the ways repeated exposure to other people's distress can affect helpers, what the research specifically on resident assistants shows, and what practical steps reduce the harm. A vocabulary for helper strain Several overlapping terms describe the effects of helping people who are suffering. They come from different research traditions, are sometimes used interchangeably, and are worth distinguishing because they point toward different remedies. Burnout, as described in Chapter 1, is the broadest. It is exhaustion, cynicism and reduced effectiveness resulting from chronic stress in a role. It can occur in any demanding job, whether or not the work involves trauma. An RA can burn out from paperwork and duty rotations alone. Secondary traumatic stress refers to symptoms resembling those of post-traumatic stress that arise from indirect exposure to trauma, through hearing about or witnessing the aftermath of what happened to someone else. It can include intrusive images or thoughts about the event, avoidance of reminders, feeling on edge, and changes in mood. It can come on relatively quickly, sometimes after a single intense exposure. Vicarious traumatization, a term introduced by the psychologists Lisa McCann and Laurie Anne Pearlman in a 1990 article in the Journal of Traumatic Stress, describes something slower and deeper. Working with the experiences of trauma survivors over time can gradually shift the helper's fundamental beliefs about safety, trust, control and other people. The world begins to feel more dangerous; people begin to seem less trustworthy. An RA who has handled several assaults may notice, months later, that they now assume the worst about strangers at parties or feel uneasy walking alone in places that never bothered them before. The change is cumulative and can be hard to see from the inside. Compassion fatigue was popularized by the traumatologist Charles Figley in the 1990s to describe the emotional exhaustion that caregivers experience from repeated exposure to the suffering of those they help. It remains the most widely used popular term. As the next chapter explains, some researchers now argue that it is a misnomer, and that what drains helpers is not compassion itself but a specific form of shared distress. For a student leader, the precise label matters less than recognizing that these experiences are normal consequences of helping work and not signs of personal fragility. Nurses, emergency physicians, social workers, crisis counselors and police officers all experience them, and those professions have built routines, supervision structures and training to manage them. Student leaders do the same kind of work, often with far less preparation and support. What research on RAs has found The research literature on resident assistants is smaller than the literature on professional helpers, but it points in a consistent direction. In a study published in the Journal of American College Health, Katherine McCarthy of the Indiana University School of Social Work surveyed 155 RAs at three public universities in the Midwest in the spring of 2016. The survey measured compassion satisfaction, burnout and secondary traumatic stress, and asked whether RAs had encountered residents struggling with nonsuicidal self-injury, such as cutting. RAs who had encountered resident self-injury showed significantly higher levels of both burnout and secondary traumatic stress than RAs who had not. McCarthy concluded that residence life departments and counseling centers should provide training, support and supervision that specifically addresses the distress RAs experience. R. Jason Lynch, writing in the Journal of College and University Student Housing in 2017, went further and developed a scale specifically for measuring secondary trauma in resident assistants. The fact that such an instrument was considered necessary is itself telling: it reflects a growing recognition in the student housing profession that RAs are exposed to traumatic material often enough for its effects to warrant systematic measurement. Lynch's work drew explicitly on the literature about secondary trauma in helping professions, applying it to a population of undergraduates. Neither study proves that every RA will be harmed, and neither suggests that RAs should avoid helping residents in distress. What they establish is that exposure has measurable effects, that those effects are larger for more intense kinds of exposure, and that the institutions employing RAs have a responsibility to account for them. That responsibility is shared. Institutions should provide support; RAs should know how to use it and when to ask for more. The anatomy of a hard night It helps to look closely at what actually happens to the body and mind during and after a crisis response, because understanding the sequence makes it easier to manage. During the event, the stress response is useful. Heart rate and alertness rise, attention narrows, and many people report feeling unusually calm and clear. Students are sometimes surprised by how competent they felt in the moment. That competence is real, and it is partly the product of a physiological state designed for short-term emergencies. After the event, the state has to come down, and that is often where the difficulty begins. An RA may return to their room still flooded with adrenaline, unable to sleep, replaying the scene. Some people feel shaky, nauseated, or unexpectedly tearful. Others feel numb and flat, as if nothing happened, and then find the experience surfacing days later in an intrusive image or a sudden wave of feeling during an unrelated moment. All of these are common reactions to abnormal events. In the days that follow, the RA usually faces an additional demand that professional responders do not: they must go on living alongside the people involved. The resident who was hospitalized may return to the floor. Other residents who witnessed part of the event will have questions, rumors will circulate, and the RA will be asked, directly and indirectly, what happened. They may be bound by confidentiality and unable to say. They may also be dealing with their own complicated feelings, including the thought that they should have seen something coming. Consider an illustrative example. Marcus, a junior RA, responds on a Friday night to a resident having a severe panic attack that initially looks like a medical emergency. Emergency services come, the resident is fine, and the event is over within an hour. Marcus writes his report and goes to bed. He sleeps badly. On Saturday he feels irritable and cancels plans with friends. On Monday, during a lecture, he realizes he has not taken in a word for twenty minutes because he has been replaying the moment he first saw the resident's face. By Wednesday he is fine. Marcus's week is a normal response to an intense event, and it resolved on its own. The pattern would be more worrying if the intrusive replay continued for weeks, if he began avoiding the resident's hallway, or if a second and third event piled on before the first had settled. What reduces the harm Research on helper strain in professional settings, and the practical experience of residence life staff, point to a set of measures that make a real difference. They work best when they are routine rather than reserved for disasters. Debrief with a professional after significant incidents. Most residence life departments have a process by which a professional staff member checks in with an RA after a serious incident. Use it, and if your department does not offer it, ask for it. A good debrief is not an interrogation about whether you followed protocol. It is a chance to say what happened, how it felt, and what is still on your mind, with someone who has seen many such incidents and can tell you what is normal. If your supervisor does not initiate a conversation within a day or two of a serious event, initiate it yourself. A simple message works: "I've been thinking a lot about Friday night. Could we find twenty minutes this week to talk it through?" Know that counseling services exist for you, too. Campus counseling centers serve RAs and student leaders as students. There is nothing unusual or disqualifying about an RA seeking counseling after a difficult semester, and it is far better to do so early than to wait until symptoms interfere with classes or the role. Some residence life departments have established arrangements with counseling centers specifically for staff support; ask whether yours does. Protect recovery after a hard night. The hours immediately after a crisis are not the time to start an all-night study session or a long social obligation. The body needs to come down. Physical activity such as a brisk walk can help discharge some of the arousal. Eating something, drinking water, and doing something ordinary and absorbing, such as a familiar show or a conversation with a friend about something unrelated, all help signal to the nervous system that the emergency is over. Alcohol and other substances may seem to take the edge off but tend to disrupt sleep and delay recovery. Tell your professors when you need to. If you have been up most of the night handling an emergency and have a test in the morning, contact your professor, the dean of students office, or your supervisor about whether an accommodation is possible. Many institutions have processes for this, and supervisors can sometimes verify that you were responding to an incident without disclosing details. You do not have to share what happened to ask for help with its academic consequences. Limit re-exposure where you can. You may not be able to avoid the people involved, but you can avoid unnecessary retelling. Answering the same questions from ten residents means reliving the event ten times. A consistent, brief script, such as "I can't talk about what happened, but the student is getting support, and if you're shaken up, here's who you can talk to," protects both confidentiality and your own recovery. Watch for accumulation. A single hard incident usually settles within days to a couple of weeks. The warning signs are persistence and accumulation: intrusive memories that do not fade, avoidance of places or people that remind you of what happened, a growing sense that the world is unsafe, feeling cut off from friends, being unable to concentrate on schoolwork, or sleep problems that continue long after the event. If any of these last beyond two to four weeks, or if they are getting worse rather than better, that is the point at which to see a counselor rather than to push through. When the crisis touches your own history Many students who are drawn to helping roles have been through something difficult themselves. That is often part of what makes them good at the work: they know what it is like to struggle, and they want to be the person they needed at the time. It also means that certain situations will land differently for them. A student who once lost a friend to suicide may find that a resident's passing comment about "not wanting to be here anymore" produces a surge of alarm far beyond what the moment calls for, followed by days of unsettled memories. A student who has experienced sexual violence may handle a resident's disclosure with great skill and then find, alone afterward, that their own memories have been stirred in ways they did not expect. A student who grew up caring for a parent with addiction may find that responding to an intoxicated resident brings back a familiar, exhausting sense of being the only responsible person in the room. None of this disqualifies anyone from leadership. It does call for a particular kind of self-knowledge. It is worth asking yourself, ideally before a crisis rather than during one, which kinds of situations are likely to be hardest for you. You do not owe anyone an explanation of why, but you may want your supervisor to know that a certain kind of incident is especially difficult, so that they can check in more carefully if you respond to one, or arrange for someone else to take the lead when that is possible. Professionals in helping fields do this routinely. A therapist whose own history makes certain cases painful discusses it with a supervisor; an emergency physician who has just lost a parent may be kept off certain shifts. Student leaders deserve the same consideration. If a situation at work reopens something from your past, that is also a good reason to see a counselor for yourself. The purpose is not to be fixed so that you can get back on duty. It is that an old wound which has been reopened deserves care in its own right. The club leader's version Crisis exposure among club leaders is less formal than among RAs, and in some ways harder to manage because there is no protocol, no on-call supervisor, and no incident report. The president of a student organization who learns that a member is being harassed, is in an abusive relationship, or has stopped eating does not have a duty phone to call. Often they have not been trained at all. Consider an illustrative example. Dani is president of a small campus theater group. Over a single month, one member confides that she is being stalked by an ex-partner, another stops coming to rehearsals and then messages Dani late at night saying he feels hopeless, and a third has a panic attack backstage on opening night. Dani handles each moment with warmth. But she has no one to hand any of it to, she does not know what she is allowed to share or with whom, and by the end of the month she is sleeping badly, checking her phone compulsively for messages from the member who felt hopeless, and dreading rehearsals she used to love. What Dani needed was not more personal resilience. She needed the same structures that RAs have: a clear sense of which situations must go to a professional, the phone numbers to route them, an advisor she could debrief with, and permission to stop being the only person holding each story. The next chapters provide those structures. For now, if you lead a club, it is worth finding out who on your campus is the right person to call when a member is in trouble, whether that is your organization's faculty or staff advisor, the dean of students office, or a care or behavioral intervention team, and saving that contact before you need it. Meaning as well as cost It would be incomplete to describe crisis exposure only as a hazard. The research traditions that study secondary traumatic stress also study compassion satisfaction, the sense of fulfillment that comes from helping others well. Many helpers experience both at once. An RA may be shaken by a night in the emergency room and also deeply glad to have been the one who noticed and acted. That gladness is not naïve; it is an accurate recognition that the work mattered. The goal of self-care is not to eliminate every trace of the difficult parts, which would require not caring at all. It is to keep the costs from accumulating to the point where they crowd out the meaning. Helpers who stay in the work over the long term tend to be those who have found ways to let hard experiences move through them rather than lodge in them: talking about them with trusted people, taking recovery seriously, and keeping a life that is larger than the role. There is also a way of engaging with other people's pain, in the moment, that makes the cost itself smaller. That is the subject of the next chapter, and it rests on a distinction that changes how many helpers understand their own exhaustion. Chapter 3: Empathy Is Not the Problem Student leaders who feel drained by other people's pain often draw a troubling conclusion: that they care too much, and that the solution is to care less. Some try to harden themselves, keeping residents or members at arm's length. Others decide they are simply too sensitive for the role. Both conclusions rest on a misunderstanding, and a body of research in social neuroscience offers a better account of what is going on. The core idea is that there is more than one way to respond to someone else's suffering. One of those ways is genuinely depleting. Another is not only sustainable but, in some respects, restorative. The difference is not how much you care. It is where your attention goes and what your caring does. Three responses to someone else's pain The neuroscientists Tania Singer and Olga Klimecki, working at the Max Planck Institute for Human Cognitive and Brain Sciences in Leipzig and the University of Geneva, set out the key distinctions in a widely cited 2014 article in Current Biology. They separate several responses that everyday language tends to blur together. Empathy, in their usage, is the capacity to share the feelings of another person: to resonate with their emotions, positive or negative. When a resident describes a devastating phone call from home and you feel a heaviness in your own chest, that is empathy. Importantly, in empathy you still know that the feeling belongs to the other person. You feel with them without confusing yourself with them. Empathy is a foundation for connection and for understanding what others need. It is not something to eliminate. From empathy, Singer and Klimecki argue, two quite different responses can develop. The first is empathic distress. Here the shared negative feeling becomes, in effect, your own problem. The experience is self-oriented and aversive: you feel overwhelmed, anxious or helpless, and the dominant motivation, often below conscious awareness, is to make your own distress stop. That can lead to withdrawal from the person who is suffering, to avoidance, or to rushed and poorly judged attempts to fix things so that the discomfort ends. Over time, repeated empathic distress is associated with negative feelings, poorer health and burnout. The second is compassion. Compassion is defined as feeling for rather than with the other person. It involves warmth, concern and care, together with a motivation to improve the other's wellbeing. Crucially, compassion is characterized by positive feelings such as warmth and love, even in the presence of someone else's suffering. It is other-oriented and approach-oriented: it moves toward the person rather than away. Singer and Klimecki drew an important conclusion from this. The phenomenon popularly called "compassion fatigue," they suggested, might be more accurately described as empathic distress fatigue. What wears helpers down is not compassion, which appears to be protective, but the chronic sharing of distress without the shift into a caring, other-oriented stance. This distinction echoes older findings in social psychology. In the 1980s, C. Daniel Batson and his colleagues distinguished between two vicarious emotions that arise when we see someone suffer: personal distress, a self-focused feeling of alarm or upset, and empathic concern, an other-focused feeling of sympathy and tenderness. In their experiments, people dominated by personal distress were more likely to help only when escaping the situation was difficult; when it was easy to leave, they often left. People dominated by empathic concern tended to help whether or not escape was easy. The motivation behind distress is to feel better yourself. The motivation behind concern is for the other person to be better. Table 1 sets out the practical differences between these responses as they tend to show up in a student leader's experience. Table 1. Empathic distress and compassion in practice. Feature Empathic distress Compassion Focus of attention My own upset The other person's needs Dominant feeling Anxiety, dread, helplessness Warmth, concern, steadiness Pull Escape or fix fast Stay and respond well After the encounter Drained, replaying it Tired but settled Long-term risk Burnout, avoidance More sustainable helping What the training studies found The most striking part of this research is that the two responses appear to be trainable, and that training them has different effects. In a study published in Cerebral Cortex, Klimecki, Singer and colleagues showed participants short video clips depicting people in distress and measured both their self-reported feelings and their brain activity. Before any training, participants tended to respond with negative feelings, along with activity in brain regions, particularly the anterior insula and the anterior midcingulate cortex, that earlier research had linked to empathy for pain. Participants then received compassion training, based on contemplative practices that cultivate feelings of warmth and goodwill toward oneself and others. After training, compared with a control group that had received memory training, participants reported more positive feelings even while watching others suffer, and showed activity in a different network of regions previously associated with positive emotion and affiliation, including the medial orbitofrontal cortex and parts of the striatum. A follow-up study, published in Social Cognitive and Affective Neuroscience, examined what happens when people are trained first in empathy and then in compassion. Empathy training, which asked participants to resonate more deeply with others' feelings, increased negative feelings and activity in the regions associated with empathy for pain. Subsequent compassion training reversed the increase in negative feelings and increased positive feelings. The researchers concluded that training compassion may offer a new coping strategy for overcoming empathic distress and strengthening resilience. In a 2015 review in Social Neuroscience, Klimecki summarized a further point: beyond how they feel, compassion and empathic distress lead to different behaviors. Compassion is associated with helping and forgiveness, whereas empathic distress not only tends to reduce helping but has been associated with increased aggressive behavior. That last finding may surprise people, but it matches something many exhausted helpers recognize in themselves: the irritability, short temper and flashes of resentment toward the very people they are trying to help. These studies were conducted in laboratory settings, with adult volunteers and specific training protocols, and their findings should not be stretched too far. They do not show that a few minutes of practice will protect an RA from every effect of a traumatic night, and brain imaging results describe associations rather than a simple switch. What they do offer is a well-supported and practically useful claim: the way you engage with suffering can shift, with practice, from a pattern that drains you toward one that is more sustainable, without requiring you to care less. Recognizing which mode you are in The first practical step is simply noticing which response is dominant in a given moment. The signs are often physical and behavioral before they are conscious. Empathic distress tends to feel like being swept into someone else's emotional state. Your breathing becomes shallow, your stomach tightens, and your thoughts race toward catastrophe or toward what you could possibly say to make this better. You may notice an urge to talk too much, to offer solutions before you understand the problem, or to end the conversation. Afterward, you replay it, and it stays with you as if it happened to you. Compassion tends to feel steadier. You are clearly aware of the other person's pain, and you may feel sad, but there is also a sense of groundedness and warmth. Your attention stays on them: what they are saying, what they seem to need, what would actually help. You can tolerate silence. Afterward, you may be tired, but you are not carrying their story as if it were your own. Consider an illustrative example. A resident comes to Jordan, a second-year RA, in tears because she has just learned her parents are divorcing. Jordan's own parents separated when he was in high school, and within a minute he is flooded with his own memories. He starts talking quickly about how he knows exactly what she is going through, offers a series of suggestions, and ends the conversation feeling shaky and sad. That evening he cannot concentrate. Jordan's response was well-intended, but it was dominated by distress, and a good part of it was really about Jordan. A month later, a different resident comes with a similar situation. This time Jordan notices the familiar tightening in his chest, takes a slow breath, and quietly reminds himself: this is her experience, not mine. He lets her talk, asks what has been hardest, and asks whether she has people at home or on campus she can lean on. He mentions the counseling center as an option, without pushing. When she leaves, he feels sad for her, but he also feels that he was useful, and he can get on with his evening. What changed was not how much Jordan cared. It was where his attention went. Practices that shift the balance Several practices, drawn from the traditions that informed the compassion training studies and from the experience of professional helpers, can help move from distress toward compassion. None requires much time. Anchor the self-other distinction. Empathy becomes distress when the boundary between your feelings and theirs blurs. A brief internal statement can restore it: "This is their pain. I can be with it without it being mine." Some helpers find it useful to feel their feet on the floor or their back against a chair, a physical reminder that they are here, separate, and steady. Shift the question. Distress asks, "How do I make this feeling stop?" Compassion asks, "What does this person need right now?" Deliberately turning your attention to the second question often changes your internal state. The answer is frequently simpler than you expect: to be listened to, to know what their options are, to not be alone for the next hour. Let go of fixing. Much empathic distress comes from the belief that you must solve the other person's problem. In most situations a student leader cannot and should not solve it. Your task is to listen well, to help the person feel less alone, and to connect them with people who have the expertise to help further. Releasing the need to fix is not giving up. It is recognizing what your role actually is, which Chapter 4 discusses in detail. Practice warmth deliberately, when nothing is at stake. The compassion training in the Singer and Klimecki studies involved regular practice of cultivating goodwill, typically by silently repeating phrases wishing wellbeing, first toward someone you love, then toward yourself, then toward others, including strangers and people you find difficult. The point of practicing in calm moments is that the capacity is then more available in hard ones. A few minutes a day, perhaps during a walk to class, is a reasonable start. If this kind of practice does not appeal to you, the underlying skill, deliberately generating care rather than alarm, can be developed in other ways, such as reflecting briefly each evening on a moment when you helped someone and what you wished for them. Include yourself. Compassion that extends to everyone except the helper is not sustainable. The psychologist Kristin Neff, whose research focuses on self-compassion, describes it as treating yourself with the same kindness you would offer a friend: recognizing that suffering and imperfection are part of shared human experience, and noticing painful feelings without either suppressing them or being consumed by them. An RA who handled a situation imperfectly, or a president who let a member down, benefits more from this than from self-criticism, which tends to deepen distress. Resetting between encounters Much of the harm of empathic distress comes not from a single conversation but from carrying one into the next. An RA who hears a difficult disclosure at 9 p.m., mediates a roommate conflict at 10, and answers a resident's question about laundry at 10:30 may be bringing the residue of the first encounter to each of the others, and responding to the laundry question with an irritability that has nothing to do with laundry. Professional helpers often build small transitions between encounters for exactly this reason. A counselor may take a few breaths and write a brief note before the next client; a nurse may wash their hands with deliberate attention. Student leaders can borrow the same principle. After a hard conversation, before doing anything else, take two or three minutes. Stand up, move, get a glass of water. Notice what you are feeling and name it silently: sad, worried, angry, shaken. Ask yourself whether anything needs to be done tonight, such as a report, a call to your supervisor, or a follow-up, and if so, do it or write it down. Then consciously close the encounter, with a phrase as simple as "That's done for now." The purpose is not to push the feelings away. It is to put them somewhere deliberate, rather than letting them leak into everything that follows. At the end of a day that included something difficult, a similar closing ritual can help. Some leaders write a few lines in a notebook: what happened, what they did, what they are still holding. Others talk briefly with a friend or partner, without breaching confidentiality, in terms such as "I had a hard conversation with a resident today and I'm still a bit shaken." What matters is that the day has an ending. Compassion at the scale of a community Club presidents and RAs sometimes face suffering that belongs not to one person but to a whole group: the death of a student, an act of violence on or near campus, a hateful incident targeting a community, a national event that lands hard on particular members. In those moments leaders often feel they must absorb and hold everyone's grief at once, and the distress can become overwhelming. The same distinction applies. Empathic distress at the scale of a community looks like trying to feel everything everyone is feeling, answering every message personally, and becoming the container for the group's collective pain. Compassion at that scale looks more like stewardship: making sure the group has a place to gather, that people know where professional support is available, that the leader's own grief is acknowledged, and that the organization's routine demands are paused or lightened for a while. A president who announces, "We're canceling this week's meeting. Counseling staff will hold a drop-in session on Thursday, and the officers will be at the usual room on Friday for anyone who wants company," is being deeply compassionate, and is not trying to personally carry each member through the week. Campus counseling centers and student affairs offices usually have staff whose job includes supporting communities after difficult events. Asking them to come to your organization is not an admission that you cannot handle it. It is exactly what a leader should do. What this does not mean A few misunderstandings are worth heading off. Shifting from distress to compassion does not mean feeling nothing. Sadness, concern and even grief in response to someone else's pain are appropriate. The aim is not emotional flatness, which would itself be a warning sign of burnout. It does not mean that if you feel drained, you are doing it wrong. Even the most skilled compassionate helpers become tired, and some situations are distressing no matter how you approach them. Compassion is a way of reducing the cost of helping, not eliminating it. You will still need rest, debriefing and a life outside the role. And it does not mean that the solution to structural problems is individual technique. If you are being asked to handle far more crises than your role was designed for, with too little support, the answer is not only to become better at compassion. It is also to name the problem and ask for change, which Chapter 7 addresses. The practices in this chapter help you do hard work more sustainably. They are not a reason to accept an unreasonable amount of it. With that caveat, the insight at the center of this chapter is liberating for many student leaders. You do not have to choose between caring and surviving. You can care in a way that leaves you standing, and people you help will generally be better served by a leader who is steady than by one who is overwhelmed alongside them. Chapter 4: You Are Not the Counselor Every RA has heard some version of the phrase "you are not a counselor" in training. Most nod, agree, and then, three weeks into the semester, find themselves in hour-long nightly conversations with a resident who is clearly struggling, feeling that they are the only thing standing between that resident and disaster. Club leaders, who usually receive no training at all, drift into the same place even more easily. The drift happens because the pull to help is strong, because the student in front of you may prefer talking to you over talking to a stranger, and because referral can feel like rejection: as if saying "I think a counselor could help with this" means "I don't want to deal with you." This chapter argues the opposite. Knowing where your role ends, and connecting people with those who are equipped to go further, is one of the most caring things a student leader can do. It is also one of the most important protections against burnout. Why the boundary exists The boundary between peer support and professional care is not an arbitrary rule designed to limit student leaders. It exists for several good reasons, and understanding them makes it easier to hold. The first reason is competence. Counselors, psychologists and physicians spend years learning to assess risk, recognize conditions that look alike on the surface, and deliver treatments that work. A student leader, however perceptive, does not have that training. The resident whose low mood seems like homesickness may have a depression that warrants treatment. The member whose eating seems merely picky may have a serious eating disorder with medical risks. The friend whose anxiety seems situational may be having panic attacks that respond well to therapy. Well-meant peer support can delay access to effective care by making things feel manageable for a while. The second reason is continuity. A counselor has appointments, notes, supervision and colleagues. A student leader has a semester, a class schedule and a finite role. When your term ends or your own life gets hard, the student who depended on you may be left without support at the worst moment. The third reason is your own wellbeing. The research on helper strain described in Chapter 2 applies with special force to people who take on professional-level emotional work without professional-level training, supervision or boundaries. A peer who becomes someone's primary source of emotional support takes on a load that trained therapists, who see clients for defined sessions and then go home, are specifically structured to avoid. The fourth reason is fairness to the student you are helping. They deserve the best care available. Keeping them in a relationship with you, when better help exists, is not ultimately in their interest. What your role actually is If you are not a counselor, what are you? Most peer-support frameworks used on campuses reduce the answer to a sequence that can be summarized in three words: notice, respond, connect. Notice. Student leaders often see things professionals cannot: the resident who has stopped leaving their room, the member whose mood has changed, the offhand comment that suggests something is wrong. Your proximity is a genuine asset. Noticing well means paying attention to changes in behavior, mood, hygiene, attendance and social connection, and taking them seriously rather than explaining them away. Respond. When you notice something, you reach out. That might be a simple check-in: "Hey, I've noticed you haven't been at meetings lately, and I wanted to see how you're doing." It means listening without judgment, taking what you hear seriously, and resisting the urge to fix, minimize, or immediately redirect. Good responding sounds like: "That sounds really hard. Tell me more about what's been going on." It does not sound like: "You'll be fine, everyone feels that way," or "Have you tried going for a run?" Connect. Having listened, you help the student reach the right resources. This might be the counseling center, health services, the dean of students, academic advising, a disability services office, a financial aid office, a faith leader, or, in an emergency, emergency services. Connecting well is more than naming a resource; it is making it easier to use. The key insight is that your value lies mainly in the first two steps and in making the third one happen. You are a bridge, not a destination. A bridge is enormously important. Without it, many students would never reach help at all. But a bridge that tries to become the destination fails at both jobs. How to refer so that it lands Referral is a skill, and it can be done well or badly. A referral that sounds like dismissal, delivered too fast, or given as a card with a phone number and nothing more, is often ignored. A good referral has several features. It is framed as care rather than as a handoff. Compare "You should probably talk to a counselor about that" with "I really care about how you're doing, and I think you deserve more support than I can give on my own. The counselors here are really good at exactly this. Would you be open to talking with one?" It normalizes help-seeking. Many students worry that seeing a counselor means something is seriously wrong with them. It can help to mention how common it is, or, if you are comfortable doing so, that you have used campus services yourself. It addresses practical barriers. Students often do not know how to make an appointment, whether there is a cost, what the first session involves, or whether their parents will be told. If you know the answers, share them. If you don't, offer to find out together. It is warm rather than cold when possible. A "warm handoff," in which you help the student make contact rather than just telling them to, is much more effective. You might sit with them while they call or fill out an online form, or offer to walk with them to the counseling center. Many centers offer same-day or crisis appointments, and some have processes by which staff can consult with an RA about a student of concern. It follows up. A day or two later, a brief check-in, such as "Were you able to get that appointment?", shows that you meant it and gives the student a chance to tell you if something got in the way. Table 2 offers a general guide to common situations and where they typically belong. Your own institution's protocols take precedence and may be more specific. Table 2. Common situations and where they usually go. Situation Your part Route to Immediate danger to life Call for help, stay if safe 911 or campus emergency line Talk of suicide, not immediate Ask directly, stay calm On-call staff, counseling, 988 Ongoing low mood or anxiety Listen, encourage help Counseling center Sexual assault or harassment Listen, explain options Your policy's reporting office, advocates Medical worry, eating concern Express concern Health services Academic crisis Listen, suggest options Advisor, dean of students Talking about suicide Many student leaders are most afraid of a conversation about suicide. They worry about saying the wrong thing, or that asking directly might put the idea in someone's head. The evidence on that second worry is reassuring. A review published in Psychological Medicine in 2014 by Tamara Dazzi and colleagues examined studies on whether asking about suicide increases suicidal thinking and concluded that it does not; if anything, asking may reduce distress and increase the chance of the person getting help. If you are worried that someone may be thinking about suicide, it is appropriate to ask clearly: "Sometimes when people are feeling this way, they think about suicide. Are you thinking about killing yourself?" A direct question communicates that you can handle the answer and that the topic is not forbidden. If the answer is yes, your task is not to talk them out of it by yourself or to promise secrecy. It is to stay calm, stay with them if they may be in immediate danger, and connect them with help right away. For RAs, that almost always means contacting your on-call supervisor according to your institution's protocol. For anyone, it can mean calling or texting 988, the Suicide and Crisis Lifeline, together with the person, or calling 911 or campus emergency services if the danger is immediate, for example if the person has a plan and the means to carry it out, or has already taken action. If you have not been trained in this kind of conversation, consider asking for training. Many campuses offer programs such as QPR (Question, Persuade, Refer) or Mental Health First Aid, which teach students and staff to recognize warning signs and respond. These trainings do not make you a counselor. They make you a better bridge. Confidentiality and its limits One of the most common mistakes student leaders make is promising confidentiality they cannot keep. A resident says, "Can I tell you something if you promise not to tell anyone?" and the RA, wanting to be trusted, says yes. Then the resident discloses something the RA is required, by policy or by basic safety, to report. RAs are employees of their institutions and usually have obligations that limit confidentiality. Most institutions require RAs to report concerns involving risk of harm to self or others. Many designate RAs as employees who must share information about sexual misconduct with a Title IX or equivalent office, although the specifics vary by institution and have shifted over time with changes in federal regulation. Some also require reporting of certain policy violations. Club officers usually have fewer formal obligations, but may still be covered by institutional policies, particularly if they hold paid or appointed positions, and they have the same ethical responsibility to act when someone's safety is at risk. The honest and protective approach is to explain your limits before someone discloses, not after. If a student asks you to promise secrecy, you might say: "I want you to be able to talk to me, and I'll keep most things private. But if you tell me something that means you or someone else might not be safe, or certain other things my role requires me to pass on, I'll need to involve someone who can help. I'd always tell you first. If you want to talk to someone who can keep things completely confidential, the counselors at the counseling center can." This lets the student decide what to share, and it avoids the painful situation of breaking a promise. It is worth knowing which campus resources are fully confidential. Typically these include licensed counselors, medical providers and, at many institutions, designated advocates for survivors of sexual violence and clergy in their pastoral role. Being able to point students to confidential options respects their autonomy while making sure they have somewhere to go. When the student says no Sometimes a student will decline a referral. They do not want to see a counselor, do not want to report an assault, do not want anyone else involved. Respecting that choice is often the right thing to do. Adults have the right to decide about their own care, and pressuring someone can damage trust and make them less likely to seek help later. The exception is safety. If there is a risk to life, whether the student's own or someone else's, your obligation to act overrides their preference. In those situations you contact your supervisor or emergency services even if the student objects, and you tell them you are doing so. In the large middle ground between these, where the student is struggling but not in danger and declines referral, the best approach is usually to respect their decision, leave the door open, and consult. RAs should talk with their supervisors about students they are worried about; this is what supervisors are for, and it is not a breach of trust. Many campuses also have care teams or behavioral intervention teams that accept reports of concern about a student and can reach out through professional channels. Using them moves the weight of responsibility from your shoulders to people whose job it is to carry it. Boundaries of time and availability Role boundaries are not only about what kinds of problems you take on. They are also about when and how you are available. A student leader who answers every message within minutes at every hour teaches the people around them that immediate access is normal, and then finds it impossible to step away. It helps to separate genuine emergencies from everything else and to make the distinction clear to the people you serve. RAs have an advantage here, because emergencies already have a formal route: the duty phone, the on-call staff member, campus police. Outside of your duty hours, it is entirely appropriate for residents to use those routes rather than your personal phone. Many RAs find it useful to say this explicitly at the first floor meeting: "If it's an emergency, call the duty phone or 911, day or night. For everything else, knock on my door or message me, and I'll get back to you when I can, usually the same day." Saying it early and warmly makes it a norm rather than a rejection. Club leaders can do the same. A president who tells members, "I check the group chat twice a day, around lunch and around dinner. If something is urgent, text me directly," has not become less accessible in any way that matters. They have made their availability predictable, which is often more useful to members than constant availability, and far easier to sustain. Within a conversation, it is also acceptable to name a time limit. "I've got about twenty minutes before I need to get to class, and I want to really hear you. Let's talk now, and if we need more time, we can find it later this week" is honest and caring. It prevents the open-ended late-night conversation that leaves both people drained and nothing resolved. If a student repeatedly needs more time than you can give, that pattern is itself useful information: it usually means they need more support than a peer can provide, and it is time to have the referral conversation. The pull to be the one It is worth ending with an honest look at why boundaries are hard to hold. Being the person someone turns to is deeply rewarding. It feels good to be trusted, to be needed, to be the one who understands. For students who have always been the caretaker in their families or friend groups, the role can feel like home. These are not bad motives, but they can quietly shape decisions. A student leader who feels, even slightly, that a resident's reliance on them is evidence of their own worth may find referral harder than it should be. It can be useful to ask yourself, when you notice resistance to referring someone: "Is keeping this student close to me serving them, or serving me?" Asking that question is not an accusation. It is a check, the same kind professional helpers use in supervision. Consider an illustrative example. Sam, an RA, has been meeting with a first-year resident several nights a week for a month. The resident has disclosed a history of depression and says Sam is the only person who understands. Sam has suggested counseling twice; the resident said no, and Sam dropped it, partly because the conversations feel meaningful. Sam is also exhausted, falling behind in two classes, and waking at night worried about the resident. When Sam finally raises the situation with a supervisor, the supervisor helps Sam see that the resident's dependence is not good for either of them, and together they plan how Sam can gently shift the relationship: continuing to be friendly and caring as an RA, while clearly encouraging professional support, and asking the campus care team to reach out. Within a few weeks the resident is seeing a counselor. Sam, relieved of a weight that was never Sam's to carry alone, begins to sleep again. Boundaries do not make you less caring. They make your care sustainable, and they make sure the people who need more than you can offer actually get it. Chapter 5: The Myth of the Indispensable President Almost every overworked club president has said some version of the same sentence: "It's faster if I just do it myself." In the short run, it is usually true. Explaining a task, waiting for someone else to do it, and then checking the result can take longer than doing it yourself. The task gets done well, on time, and the way you wanted. In the long run, the sentence describes a trap. Every task a leader does alone is a task that no one else learns to do, a piece of ownership no one else holds, and a demand that returns next week and the week after that. A leader who does everything is not only exhausting themselves. They are building an organization that cannot function without them, which is to say, a fragile one. This chapter is mainly about clubs and student organizations, where the president has real authority to distribute work. But the principles apply to RAs as well, who can share work with hall councils and co-RAs and pass certain tasks up to professional staff, and to any student leader who has become the default person for everything. Why leaders hold on It helps to be honest about why delegation is hard, because the obstacles are mostly psychological rather than practical. Speed. Delegating requires an upfront investment of time: explaining, answering questions, checking in. When a leader is already stretched, that investment feels unaffordable, even though it is precisely what would relieve the stretch. Quality. Leaders often have high standards, which is part of why they were chosen. They worry, sometimes correctly, that someone else will do the task less well. What they underestimate is how much quality is learned, and how rarely the difference between their version and a capable officer's version matters to anyone else. Guilt. Many student leaders feel uncomfortable asking volunteers, who are also busy students, to do more. They would rather absorb the work than impose it. This feels generous, but it deprives other members of the chance to contribute meaningfully, and it often breeds quiet resentment on both sides. Control and visibility. Some leaders fear that if others do the work, things will happen that they do not know about or cannot fix. For a president who feels personally accountable for everything, loss of visibility can feel like loss of safety. Identity. For some, being the person who holds everything together has become part of who they are. Letting go of tasks can feel like letting go of their importance to the group. None of these are character flaws. They are understandable responses to responsibility. But each one, left unexamined, leads the leader toward the pattern described in Chapter 1, in which a small number of highly capable helpers absorb a disproportionate share of an organization's work until their own performance and wellbeing suffer. What non-delegation costs the organization The case for delegation is often made in terms of the leader's wellbeing, which is important. But the stronger argument is that non-delegation harms the organization itself. It creates a bottleneck. When every decision and task passes through one person, the organization moves at the speed of that person's available time. Members wait for answers. Opportunities are missed. The group's ambitions are limited to what one student can personally manage. It disengages everyone else. Officers who are never given real responsibility stop taking initiative, and eventually stop showing up. Members who are never asked to contribute conclude that the organization does not need them. The leader then interprets this disengagement as evidence that no one else can be trusted, and takes on even more. It concentrates risk. If the president falls ill, faces a family emergency, or simply needs to focus on exams, an organization built around one person stalls. For clubs whose presidents graduate every year or two, the risk is not hypothetical. It is certain, and the next chapter examines it in detail. It stunts development. Student organizations exist in part to give students experience in leadership, planning and teamwork. When one person does all of it, the organization fails at one of its central purposes. Some of the most valuable things a president can give members are the chance to run something real and the chance to learn from doing it imperfectly. Start with an audit Before you can delegate well, you need to know what you are actually doing. Most overloaded leaders underestimate the number and variety of tasks they have absorbed. A simple exercise helps. For two weeks, keep a running list of every task you do for your organization: every email, message thread, meeting, form, purchase, conversation, errand and decision. At the end of the two weeks, go through the list and sort each item into one of four categories. The first category holds tasks that genuinely require you, because of your role, authority or specific relationships: signing documents that require the president's signature, representing the organization in certain meetings, making final calls on sensitive matters. This list is usually shorter than leaders expect. The second holds tasks that someone else could do with some guidance: drafting announcements, booking rooms, managing social media, coordinating volunteers, tracking attendance, ordering supplies. The third holds tasks that someone else could do right now with no guidance at all, which you do only because you got there first. The fourth holds tasks that do not need doing by anyone: reports no one reads, meetings that could be messages, over-polished materials, answers to questions that are already addressed elsewhere. The fourth category deserves particular attention, because it is the only one where work disappears rather than moves. Leaders often maintain practices out of habit or inherited expectation long after they have stopped serving any purpose. Dropping them is the most efficient form of delegation there is. Levels of delegation Delegation is not one thing. It ranges from handing someone a specific task with detailed instructions to giving them full ownership of an area of work. Being clear about which level you intend avoids a common source of frustration, in which a leader thinks they have given someone authority and the other person thinks they are just following orders, or the reverse. Table 3 describes five levels that are useful to distinguish. As a general rule, new or untested members start at the lower levels and move up as trust and skill develop. The goal for officers should usually be the higher levels, where the leader is informed but not involved in every decision. Table 3. Levels of delegation for student organizations. Level What you say Who decides Good for 1. Do as instructed "Please do exactly this." You New members, routine tasks 2. Research and report "Look into options and tell me." You Building judgment 3. Recommend "Tell me what you'd do and why." You, usually agreeing Developing officers 4. Decide and inform "Handle it and let me know." Them Trusted officers 5. Own the area "This is yours." Them Committee chairs, successors How to delegate well Good delegation is a learnable skill with a small number of reliable elements. Define the outcome, not the method. Tell the person what success looks like, not how to achieve it step by step, unless the task genuinely requires a specific procedure. "We need a venue for the spring showcase that fits around two hundred people, costs under our budget, and is booked by the end of February" gives the person room to use their own judgment. "Call the student center, ask for the ballroom, and if that's taken try the auditorium" makes them an errand-runner. Match authority to responsibility. One of the most demoralizing experiences for a volunteer is being responsible for an outcome without the authority to make the decisions it requires. If a committee chair is responsible for an event, they need to be able to spend within a budget, make vendor choices, and direct volunteers without asking permission each time. Share the context. People make better decisions when they know why a task matters, what has been tried before, and what constraints exist. Five minutes of context often saves hours of rework. Agree on check-ins. Rather than hovering or disappearing, agree in advance on when you will touch base: "Can we check in next Thursday to see where things stand?" This gives you visibility without taking over, and gives them a clear point at which to raise problems. Make it safe to ask for help. Tell people explicitly that coming to you with a problem is expected and welcome, and that you would rather hear about a difficulty early than discover it late. Accept different. The person you delegate to will not do things exactly as you would. Unless the difference actually matters, let it go. A flyer in a different font, a meeting run in a different style, or a social event with a different theme is not a failure. It is evidence that someone else has made the work their own. Don't take it back. The single most damaging thing a leader can do is delegate a task and then, when it is going slowly or differently than they would like, quietly take it over. This tells the person that they were never really trusted, and it guarantees they will be reluctant to take ownership next time. If something is going genuinely wrong, talk with the person about it and work out a plan together. Recognize the work. Publicly credit people who take on responsibility. Recognition is one of the few rewards student organizations can reliably offer, and it costs nothing. A worked example Consider an illustrative case. Aisha is president of a student environmental group with about sixty active members and five officers. Her audit reveals that in two weeks she has written every newsletter, managed the group's social media, booked every room, met personally with three campus offices, handled all volunteer scheduling for a park cleanup, answered around a hundred messages, and drafted the organization's budget request. She sorts the list. Only a few items truly require her: the meetings with campus offices, which involve relationships she has built, and final approval of the budget request. The newsletter and social media could go to the communications officer, who has been underused. Room booking and volunteer scheduling could go to the vice president, with a short guide. The budget draft could go to the treasurer, with Aisha reviewing it. And a surprising number of the messages she answers are questions already covered in the organization's shared documents, if only members knew where to find them. Aisha meets with each officer individually. With the communications officer she agrees on level five for social media ("This is yours; just keep it consistent with our values and loop me in on anything sensitive") and level four for the newsletter ("Draft and send it; I'll read it when it goes out"). With the vice president she starts at level three for room booking and volunteer scheduling, meaning the vice president handles the logistics and runs plans past Aisha, with a plan to move to level four after the first month. She works with the treasurer at level three on the budget. She also posts a pinned message in the group chat directing members to a shared document of frequently asked questions and names which officer handles which kinds of questions. The first month is bumpy. The newsletter goes out a day later than Aisha would have liked, and a room booking falls through and has to be redone. Aisha resists the urge to take things back. By the second month, her task list has shrunk by more than half, two of the officers have started proposing ideas of their own, and members are directing their questions to the right people. Aisha has time for her classes, and the organization is doing more than it did when she was running everything. Delegation for RAs RAs have less formal authority to delegate than club presidents, but they have more options than they often use. Many residence halls have hall councils or house governments. Where these exist, RAs can support residents in planning and running events rather than doing all the planning themselves. This builds community, which is the purpose of programming in the first place, and it lightens the RA's load. A floor event designed and run by residents with RA support is often better attended and more meaningful than one the RA produced alone. RAs working in teams can share tasks deliberately, with one RA taking the lead on building-wide programs while another handles bulletin boards, rather than each duplicating the work. Co-RAs on the same floor or building can divide responsibilities by strength and interest. And RAs can, and should, pass certain work up. When a situation exceeds the RA's role, whether an ongoing roommate conflict that mediation has not resolved, a student of concern, or a facilities issue that repeated reports have not fixed, the right move is to escalate to professional staff. This is not failure. It is the system working as designed. Professional staff exist precisely to handle what goes beyond a student employee's scope, and RAs who carry these situations alone for too long are doing work that belongs to someone else. When there is no one to delegate to Some leaders read advice about delegation and think, reasonably: that assumes I have people. In a small or struggling organization, the officer positions may be empty, the few active members may already be stretched, and the honest answer to "who could do this?" may be "no one." In that situation, the answer is not to do everything yourself indefinitely. It is to change the size of the problem. There are three main ways to do this. The first is to shrink the ambition. An organization with six active members cannot run the same calendar as one with sixty, and trying to do so is a recipe for burning out whoever is left. Choose the one or two activities that matter most to the group's purpose, do them well, and let the rest go for now. A small club that meets reliably and runs one good event a semester is healthier than one that promises a full program and delivers it through one exhausted student. The second is to recruit specifically rather than generally. General appeals for help ("We need more people to get involved!") rarely work. Specific, bounded requests often do: "Would you be willing to handle room booking for our three spring meetings?" is much easier to say yes to than an open-ended officer role. People who succeed at a small, defined task are more likely to take on a larger one later. The third is to collaborate. Other organizations with overlapping interests may be willing to co-host events, share resources, or even merge. The student activities office can often suggest partners and may have staff or programs designed to support small organizations. Asking for help from the institution is itself a form of delegation, and it is one that leaders of small groups routinely underuse. Delegation can also include the emotional work of leadership. In organizations whose members often bring personal struggles to the leader, it can help to spread that role deliberately, for example by making sure several officers know the campus referral routes described in Chapter 4, so that the president is not the sole person to whom everyone brings everything. The leader's real job Underneath all of this is a shift in how leaders understand their role. In a small or new organization, the leader often is the organization, doing whatever needs doing. As the group grows, that model stops working. The leader's job becomes less about doing the work and more about making sure the work gets done: finding the right people, giving them what they need, removing obstacles, and keeping the organization aligned with its purpose. This is harder in some ways than doing everything yourself. It requires patience, tolerance for imperfection, and trust in others. But it is the only model that scales, the only one that develops other leaders, and the only one that is sustainable for a person who is also trying to pass their classes and sleep at night. The final test of that model comes when the leader leaves, which is the subject of the next chapter. Chapter 6: Building an Organization That Doesn't Need You Student organizations face a problem that almost no other kind of organization faces to the same degree: their entire leadership turns over every year or two, on a schedule set by graduation. A company might lose a senior manager and replace them over several months. A student organization loses its president, treasurer and half its officers every spring, and the new team often starts in the fall knowing little more than the name of the group and the password to its social media account, if they are lucky enough to have that. The consequences are familiar to anyone who has been involved in student life. Organizations that thrived under one leader collapse under the next. Hard-won relationships with campus offices are lost. Funding deadlines are missed because no one knew they existed. New leaders spend their first semester rediscovering how to do things their predecessors had already figured out, and burn out in the process. Succession planning is usually presented as a service to the organization and to the next leader, and it is. This chapter argues that it is also one of the most important forms of self-care available to a current leader. An organization that could survive without you is one you can step back from when you need to, whether for a week of exams, a family emergency, an illness, or simply the end of your term. The two-week test A useful way to assess an organization's fragility is to ask a simple question: if you were suddenly unavailable for two weeks, with no phone and no email, what would happen? For many student organizations, the honest answer is alarming. Meetings would not be scheduled because only the president books rooms. Messages from campus offices would go unanswered because they come to the president's personal email. Reimbursements would stall because only the president knows how the process works. A scheduled event might fall apart because the plans exist only in the president's head. If this describes your organization, you are not only facing a succession problem at the end of the year. You are facing a vulnerability right now, and it is also a burden on you. A leader whose absence would cause collapse cannot really rest, cannot really get sick, and cannot really focus on anything else during a crisis. The anxiety of being indispensable is itself a source of strain. The goal of succession planning, understood properly, is to make the answer to the two-week test boring: things would keep running, perhaps a little less smoothly, until you came back. Where organizational knowledge lives The central challenge of succession is that much of what a leader knows is never written down. It lives in their head, their inbox, their phone and their personal relationships. When they leave, it leaves with them. A few categories of knowledge are especially important to capture. Accounts and access. Every account the organization uses, including email, social media, file storage, the campus organization portal, any payment or ticketing platforms, and bank or budget accounts, should be owned by an organization-controlled address rather than by an individual's personal account, and the access information should be stored in a way that more than one officer can reach. A remarkable number of student organizations lose their social media presence or files every few years because they were tied to a graduate's personal login. Recurring deadlines. Student organizations operate on institutional calendars: registration or re-registration deadlines, funding application windows, room reservation openings, training requirements for officers, event approval lead times. These deadlines often come around only once a year, which means that each new leader has never seen them before. A single shared calendar of recurring deadlines, with a note on what each requires, is one of the most valuable documents an organization can have. Relationships. Presidents build relationships with advisors, campus office staff, partner organizations, vendors and alumni. These relationships are hard to transfer, but introductions help enormously. A brief message, such as "I'm graduating in May, and Jordan will be taking over as president; I wanted to introduce you two," can save the next leader months of cold outreach. Procedures. How do you book a room? How do you request a reimbursement? How do you get an event approved? What forms are required for off-campus trips? These processes are often confusing, and every leader learns them through trial and error. Writing them down once, briefly, spares every future leader that experience. History and reasoning. Why does the organization do things the way it does? What has been tried and failed? What went wrong at last year's major event? Institutional memory of this kind helps new leaders avoid repeating mistakes and understand which traditions matter. The organization handbook The practical tool for capturing this knowledge is a handbook: a living document, or a small set of documents in a shared folder, that describes how the organization works. It does not need to be long or polished. A handbook that is ten pages of plain notes, updated regularly, is far more useful than an elaborate one that was written once and never touched again. A good student organization handbook typically includes the organization's purpose and constitution, a description of each officer role and its responsibilities, the calendar of recurring deadlines, step-by-step notes on common procedures, a list of key contacts with a sentence on each, a list of accounts and where access information is kept, notes on major annual events, including what worked and what did not, and a brief history. The most effective way to build a handbook is incrementally, not in a single heroic effort at the end of a term. Each time an officer completes a process for the first time, such as a room booking, a funding request or an event approval, they add a short note on how they did it. Each time something goes wrong, someone adds a line about what to do differently. Over a year, the handbook assembles itself. Assigning ownership helps. Each officer can be responsible for keeping their own section current, and the organization can build a brief handbook review into its end-of-term routine. This also has a delegation benefit: officers who write down how their role works tend to understand it better and own it more fully. Developing successors, not just choosing them Handbooks help, but no document replaces experience. The most resilient organizations develop their future leaders deliberately, well before those leaders are elected. In practice this means giving promising members real responsibility early. A sophomore who has chaired a committee, run an event, or served as a deputy to an officer will step into a leadership role far better prepared than one who was elected from general membership with no prior responsibility. Committee chair positions, event leads and deputy or assistant roles are all ways to build this pipeline. They also connect directly to delegation: the tasks a current leader hands off are the training ground for the next one. Timing matters too. Many organizations hold elections at the very end of the academic year, which leaves no overlap between outgoing and incoming leaders. Holding elections earlier, several weeks or even a couple of months before the end of the spring term, allows a transition period in which the new leaders can shadow the outgoing ones, attend meetings with campus offices together, and ask questions while the people who know the answers are still around. Table 4 outlines a transition timeline that many organizations could adapt. The timing will vary with each institution's calendar, but the principle of overlap is what matters. Table 4. A sample leadership transition timeline. When Outgoing leaders Incoming leaders Together Fall and early spring Delegate real tasks Chair committees, lead events Build the handbook 6-8 weeks before term ends Hold elections Begin shadowing Plan transition meetings 4-6 weeks before Introduce contacts Attend key meetings Review handbook, deadlines Final 2-3 weeks Transfer accounts Take the lead, with backup Formal transition meeting Summer and early fall Available for questions Run the organization Occasional check-in The transition meeting At the heart of a good handover is a dedicated transition meeting, or a short series of them, between each outgoing officer and their successor. It is worth structuring rather than leaving as a casual conversation. A useful structure covers four questions. What are the recurring responsibilities of this role, and when do they happen? What is currently in progress, and what is the status of each item? Who are the key people this role works with, and what should the successor know about each relationship? And what does the outgoing leader wish they had known when they started? That last question often produces the most valuable answers. Outgoing leaders know where the hidden difficulties are: the office that takes three weeks to process a form, the tradition that members care about more than it appears, the annual event that always runs over budget, the personal dynamic among officers that needs gentle handling. It is also a chance for outgoing leaders to be honest about the strain of the role. A president who tells a successor, "This job can swallow your whole semester if you let it; here's what I wish I'd delegated sooner," is giving them something no handbook can. Letting go The final element of succession is the hardest for many leaders: actually stepping away. Outgoing presidents often remain deeply attached to organizations they have shaped. They may continue to attend every meeting, weigh in on every decision, or quietly correct the new leader's choices. However well-intentioned, this undermines the successor's authority and often prevents them from growing into the role. It can also keep the outgoing leader from moving on to the next stage of their own life, whether that is a final semester focused on academics, a job search, or simply rest. A healthy approach is to make yourself available without being present. Tell your successor you are happy to answer questions, then wait for them to ask. Attend the occasional event as a member or alumnus, not as a shadow president. If you see them making a choice you would not make, ask yourself whether it actually matters before saying anything. Most of the time, it does not. Consider an illustrative case. Tomás has led a campus music collective for two years and built it from a dozen members to over eighty. He is proud of it, and anxious about what will happen when he graduates. In his final year he creates deputy roles for two sophomores, gives each of them a major event to run, and spends much of the fall building a handbook with the other officers. Elections are held in March. Through April the new president attends every meeting Tomás has with campus offices, and in late April they hold a long transition meeting. In May Tomás hands over the accounts. In the fall, he gets a few questions by text and answers them. He resists the urge to offer advice that was not requested. The collective has a rocky first month and then a strong year, run in ways Tomás would not have chosen and that suit the new leadership well. What Tomás gained was not only a healthy organization. It was a final year in which he could focus on his senior project, knowing the collective would survive without him, and the rare satisfaction of having built something that outlasted his own involvement. Stepping back before the term ends Not every transition happens on schedule. Sometimes a leader needs to step back partway through the year because of illness, a mental health crisis, a family emergency, academic probation, or the plain recognition that the role is doing them serious harm. Student leaders often treat this possibility as unthinkable, a betrayal of the people who elected or hired them. It is better understood as one of the situations that succession planning exists to handle. For club leaders, stepping back can take several forms. A temporary leave, in which the vice president acts as president for a few weeks, is often the simplest; most constitutions allow for it explicitly or implicitly. A reduction in scope, in which the president keeps the title but hands major areas to other officers, can work when the problem is load rather than capacity. Resignation is the right choice when the role is no longer compatible with the leader's health or academic survival. In each case, the process is easier if the organization already has capable officers, a working handbook and shared access to accounts. That is the practical payoff of the preparation described earlier in this chapter. For RAs, stepping back is governed by employment policies. Some departments allow temporary relief from duty during a medical or family crisis; others handle it through resignation, which may also affect housing. If you are considering stepping back, speak with your supervisor early, before the situation becomes an emergency, and ask plainly what options exist. It is also worth consulting the dean of students office, which can help with academic arrangements during a difficult period, and, if housing is tied to the role, asking what arrangements are possible so that you are not left without somewhere to live. Consider an illustrative case. Mei, the treasurer of a large student association, is diagnosed with a condition that requires treatment during the spring semester. Her first instinct is to keep going quietly. Instead, after a conversation with her advisor, she tells the president she needs to step back for six weeks. Because Mei has kept clear records and another officer had shadowed her on reimbursements in the fall, the handover takes a single afternoon. The association continues without disruption, and Mei returns in April to finish the term. What made this possible was not her toughness. It was preparation done months earlier, for an entirely different reason. Stepping back is not failure. A leader who recognizes that they need to step back, and does it in a way that protects the organization, is exercising exactly the judgment that leadership requires. Succession for RAs Resident assistants do not usually choose their successors, and residence life departments manage hiring and training centrally. But the principles of succession still apply in smaller ways. Returning RAs are an important source of institutional knowledge for new ones. Departments that pair experienced RAs with new staff as informal mentors help new RAs learn the unwritten parts of the job, including how to protect their own time and when to ask for help. If you are a returning RA, offering that mentorship, and being honest about the hard parts, is one of the most useful things you can do for the next cohort. RAs can also help their departments improve the role over time. End-of-year feedback surveys and exit conversations are opportunities to describe what made the work unsustainable and what helped. The changes some institutions have made to the RA role, such as splitting crisis response from community building or adding professional staff in residence halls, came partly from listening to what RAs said about their experience. Leaving honest feedback is a form of succession planning: it shapes the role your successors will inherit. And RAs, like club presidents, benefit from letting go. The end of an RA contract can bring a surprising sense of loss as well as relief. The floor community you built belongs now to someone else. Recognizing that, and allowing yourself to step fully into the next part of your college life, is part of finishing well. Building for your own absence The deepest point of this chapter is that building an organization that doesn't need you is not a threat to your importance. It is the fullest expression of good leadership. It is also a direct protection for your own wellbeing throughout your term, not only at its end. A leader who has built redundancy, documentation and capable deputies can get sick without catastrophe, can put their exams first without guilt, and can say no to a request because someone else is able to say yes. The next chapter turns to that act of saying no, and to the relationships with supervisors and advisors that make it possible. Chapter 7: Saying No and Managing Up Every boundary described so far in this book, whether emotional, professional or organizational, eventually comes down to a moment in which someone asks for something and the leader must decide how to answer. A resident asks for one more late-night conversation. A member asks the president to take on one more event. A supervisor asks an RA to cover one more duty shift. A campus office asks the club to co-sponsor one more program. Each request is reasonable on its own. Together, they are how roles lose their edges. This chapter is about the two interpersonal skills that make boundaries hold in practice: saying no, or some useful version of it, and building the kind of relationship with supervisors and advisors that allows a leader to raise problems before they become crises. Why no is so hard Student leaders tend to find refusal harder than most people, and for understandable reasons. Many were selected precisely because they are reliable, responsive and willing. Saying yes has been rewarded throughout their lives, from school to family to past leadership roles. Refusing a request can feel like violating the qualities that make them who they are. Leadership roles also create a sense of obligation that goes beyond any single request. An RA may feel that caring for residents means being available to them. A president may feel that the organization's success depends on their willingness to do whatever is needed. In that frame, every no feels like a small abandonment. There is also a social dimension. Student leaders live among the people they serve. The resident whose request is declined will be in the hallway tomorrow. The member who is disappointed will be at the next meeting. Leaders worry, often more than the situation warrants, about being seen as unhelpful or uncaring. And there is the problem that every individual yes seems cheap. The request to cover one duty shift, attend one extra meeting, or read one more draft takes only an hour or two. It is hard to see how that hour could matter. It matters because hours are finite and yeses accumulate. The cost of saying yes is not the time the task takes. It is everything else that time could have been used for: sleep, study, friends, rest, or a more important commitment done well. The real question behind every request A useful reframing is that every yes is also a no to something else. When you say yes to covering an extra duty shift during midterms, you are saying no to an evening of study. When you say yes to organizing another event, you are saying no to doing the existing events well, or to sleep. The no is there whether or not you name it; the only question is whether you choose it deliberately. This suggests a simple discipline. Before agreeing to anything significant, ask what it will displace. If you cannot identify what you will stop doing, or do less of, to make room for it, then the likely answer is sleep, academics or your own wellbeing, because those are the things that give way silently when everything else has a deadline. It also suggests the value of clear priorities. A leader who has decided, at the start of a semester, that grades and sleep come first, that the organization's two major events matter most, and that everything else is optional, has a basis for decisions that does not require agonizing over each request. The writer Greg McKeown, in his book Essentialism, argues that people who do not prioritize their own lives will find that others prioritize it for them. For student leaders, surrounded by people with legitimate needs, this is almost literally true. Four kinds of no Refusal does not have to be absolute. There are several ways to decline a request, and choosing the right one makes it easier to say and easier to hear. No. Sometimes a clear, simple refusal is best, especially when the request is outside your role or would significantly harm your priorities. A plain no, delivered warmly, does not require elaborate justification: "I'm not able to take that on this semester, but thank you for thinking of me." Not now. Many requests are reasonable but badly timed. Offering a different time preserves the relationship and your priorities at once: "I can't cover that shift during finals week, but I'd be glad to swap with someone for a shift in early May." Not me. Often the request is legitimate, but you are not the right person to fulfill it. Redirecting is not evasion; it is getting the request to where it belongs. For RAs, this includes referral, as described in Chapter 4. For presidents, it includes directing questions to the officer who owns that area. "That's a great idea for an event. Priya chairs our programming committee; can you bring it to her?" Not like this. Sometimes the answer is a partial yes: agreeing to part of the request, or to a smaller version of it. "I can't help run the whole fundraiser, but I can spend an hour setting up on the day." Partial yeses let you contribute without being consumed. Two practical habits make all four kinds of no easier to use. The first is to create a pause. Most overcommitment happens in the moment of being asked, when the social pressure to agree is strongest. A standard response such as "Let me check my calendar and get back to you by tomorrow" gives you time to think about what the request would displace, and it is far easier to decline by message later than face to face in the moment. The second is to prepare phrases in advance. Refusal is easier when you are not inventing the words on the spot. Having a few ready sentences, adapted to your own voice, removes much of the friction. For example: · "I want to do this well, and I can't give it the time it deserves right now." · "I'm protecting my study time this week, so I'll need to pass." · "I'm at capacity, but here's who might be able to help." · "That's outside what I can do as an RA, but I can connect you with someone who can." Saying no to the people you serve Declining requests from residents or members has its own sensitivities, because the relationship is ongoing and the power dynamics are real. With residents, the key is distinguishing between the RA role and the RA as a person. The role has defined responsibilities: responding to emergencies, building community, enforcing policies, connecting residents to resources. It does not include being available at every hour, serving as someone's primary emotional support, or solving problems that belong to other offices. Declining requests outside the role is not unkind; it is keeping the role sustainable so that you can fulfill it for everyone on the floor, not just the residents who ask most. With members, the key is remembering that your authority as a leader includes the authority to decline. A president who says, "We're not going to add another event this semester; we want to do the ones we have well," is exercising leadership, not failing at it. Members generally respect a leader who is clear about priorities more than one who agrees to everything and then struggles to deliver. In both cases, how you decline matters. Acknowledge the request, explain briefly if appropriate, and where possible offer an alternative. The goal is for the person to leave feeling heard, even if their request was not met. Managing up For RAs in particular, the most important relationship for preventing burnout may be the one with their supervisor, typically a hall director, area coordinator or similar professional staff member. For club leaders, the equivalent is the organization's faculty or staff advisor, and sometimes staff in the student activities office. These relationships are often underused. Student leaders may see supervisors mainly as evaluators, and hesitate to reveal struggles for fear it will reflect badly on them. They may assume supervisors are too busy to be bothered, or that raising a problem will be seen as complaining. In fact, most supervisors want to know when their student staff are struggling, both because they care about their students and because an overwhelmed RA or president creates risks for everyone. Supervisors cannot help with problems they do not know about. "Managing up" is a term from workplace psychology for the practice of actively shaping your relationship with those above you, rather than waiting passively for them to direct you. For student leaders, it involves a few concrete habits. Use regular meetings well. Most RAs have scheduled one-on-one meetings with supervisors. These are often treated as routine check-ins in which the RA reports that everything is fine. Instead, come with a short agenda: what is going well, what is hard, what you need. Raising small concerns early is much easier than raising large ones later. Be specific about workload. "I'm overwhelmed" is hard for a supervisor to act on. "I've responded to four serious incidents in the last three weeks, I've had to miss two classes to finish reports, and I have two exams next week" gives them something concrete to work with. Specificity also makes it clear that you are describing a situation, not complaining about the job in general. Ask for what you need. Supervisors can often do more than student leaders realize: adjust duty schedules around exams, reassign particular responsibilities, provide additional training, arrange a debrief with counseling staff, or advocate for you with other offices. Ask directly. "Would it be possible for me to swap my duty night on the fourteenth? I have a major exam the next morning" is a reasonable request that most supervisors will try to accommodate. Report concerns about the role itself. If aspects of the role seem genuinely unsustainable, such as a floor with an unusually high number of students in crisis, an on-call schedule that leaves no recovery time, or responsibilities that exceed your training, say so. Supervisors often pass such feedback to department leadership, and it is one of the ways institutions learn what needs to change. Keep a record. For your own clarity, and occasionally for your protection, it helps to keep brief notes of significant incidents, requests you have made, and responses you have received. This is not about building a case against anyone. It is about being able to describe your situation accurately when you need to. Club leaders can apply the same principles with their advisors. Many advisors are minimally involved by default and would be willing to do more if asked. An advisor who knows that the president is overwhelmed can help redistribute work among officers, connect the organization with campus resources, or help the president think through priorities. A conversation in practice Consider an illustrative case. Keisha is an RA on a first-year floor that has had an unusually hard fall: a hospitalization for alcohol poisoning, two students who have left for mental health reasons, and a long-running roommate conflict that has required repeated mediation. She is behind in two classes and has started dreading her one-on-one meetings, where she usually says things are "fine." Before her next meeting she writes down three things. First, a factual summary: the incidents she has responded to since September, the approximate hours spent on the roommate conflict, and the classes she has fallen behind in. Second, what she is feeling, in one sentence: "I'm worried I'm running on empty, and I don't want it to affect how I respond to the next emergency." Third, what she is asking for: a swap of her two duty nights during the week of her exams, a debrief with a counselor about the hospitalization, which still keeps her up at night, and help moving the roommate conflict to professional staff. The meeting takes twenty minutes. Her supervisor thanks her for being specific, arranges the duty swaps with another RA, contacts the counseling center about a staff debrief, and takes over the roommate mediation. The supervisor also mentions that two other RAs on the team have raised similar concerns, and that she is bringing the pattern to the department's leadership. None of this would have happened if Keisha had said, once again, that things were fine. Not every supervisor will respond this well. But a specific, calm and constructive conversation gives any supervisor the best chance of helping, and it gives you a clear record of having asked. When the supervisor is the problem Not every supervisory relationship is supportive. Some supervisors are overwhelmed themselves, some are inexperienced, and a few are dismissive of student staff concerns. If you have raised issues clearly with your direct supervisor and nothing has changed, you have options. Most residence life departments have a chain of supervision above the hall director level. Raising a concern with an assistant director or associate director is appropriate if your direct supervisor has not responded. Many institutions also have an ombudsperson, a neutral and confidential resource for students and employees facing workplace difficulties. The dean of students office can be a resource for students whose leadership roles are affecting their academic progress or wellbeing. There is also strength in collective voice. RAs in the same building or department often share the same concerns. Raising issues together, through staff meetings, feedback surveys or a joint request to leadership, is more likely to be heard than isolated individual complaints. In recent years this collective voice has in some places taken the form of unionization. RAs at Boston University voted to unionize in 2023 and held a four-day strike in April 2024, with workload, compensation and training among their central concerns. More than 1,400 RAs across the California State University system have sought union representation. Whatever one's view of unionization, these developments reflect a widespread recognition that the conditions of the RA role are not merely individual problems to be solved by individual coping. What institutions can change Student leaders should not have to carry the full burden of preventing their own burnout. Institutions shape the conditions of these roles, and some are changing them. Binghamton University, beginning in fall 2023, split the traditional RA position into separate roles, with community assistants focused on community building and without on-call duties, and student support assistants who handle crisis response, conflict resolution and duty. The university had also placed social work graduate interns in residential communities. According to reporting in Inside Higher Ed, the share of student staff planning to return the following year rose to 62 percent, from about 50 percent previously. Clemson University renamed its RAs and shifted desk duties to separate positions. Other universities have placed counseling or social work graduate students in residence halls so that undergraduate staff are not the only people on hand when residents are in distress. These redesigns reflect the same logic that runs through this book: roles with clearer edges are more sustainable. Student leaders who experience the strain of edgeless roles are well placed to advocate for such changes through feedback, through student government, and through conversations with the staff who design their positions. Doing so is not ingratitude. It is an investment in the people who will hold the role next. The skill that makes the others possible Saying no and managing up can feel like a departure from the caring, generous spirit that draws people to leadership. In practice they are what allow that spirit to last. A leader who cannot decline anything will eventually be forced to decline everything, when exhaustion, illness or academic crisis makes the decision for them. A leader who never tells a supervisor what is wrong will eventually have a much harder conversation about why things fell apart. Saying no, and speaking up, keep the choices in your hands. Chapter 8: Sleep, Grades and the Body That Carries the Role It is tempting to treat the physical side of self-care as the easy part, the familiar advice about sleep, food and exercise that everyone already knows. In practice, for student leaders, it is often the hardest part to protect, because the demands of the role arrive precisely in the hours that sleep and study need. And it is the part on which everything else depends. The emotional skills of Chapter 3, the judgment required for referral in Chapter 4, the patience that delegation demands in Chapter 5, and the steadiness to say no in Chapter 7 all deteriorate when a person is chronically short of sleep. This chapter makes the case for treating sleep and academics as the foundation of a leadership role rather than as what gets whatever time is left over. It also addresses the question every student leader should be able to answer about themselves: how would I know if I needed help, and where would I go? The sleep problem College students as a group sleep poorly. In a review published in Nature and Science of Sleep in 2014, the sleep researchers Shelley Hershner and Ronald Chervin reported that around 50 percent of college students report daytime sleepiness and about 70 percent get insufficient sleep. They connected sleep deprivation and sleepiness among students with lower grade point averages, increased risk of academic failure, compromised learning, impaired mood, and a higher risk of motor vehicle accidents. The consensus recommendation for adults, issued jointly in 2015 by the American Academy of Sleep Medicine and the Sleep Research Society, is at least seven hours of sleep per night on a regular basis. Many student leaders fall well short of that, and RAs face a particular problem: on-call duty nights, when sleep may be interrupted by calls, incidents or noise, and after which it can be difficult to fall back asleep because the stress response described in Chapter 2 is still running. The evidence connecting sleep to academic performance is not only a matter of self-report. In a study published in 2019 in npj Science of Learning, researchers at the Massachusetts Institute of Technology gave wearable activity trackers to students in an introductory chemistry course and followed 88 of them through the semester. Students with better sleep quality, longer sleep duration, and more consistent sleep schedules earned better grades. One finding is especially relevant to student leaders: sleep on the single night before an exam was not related to exam performance. What mattered was sleep over the preceding week and month. Sleep measures, taken together, accounted for nearly a quarter of the variation in students' academic performance. This finding undercuts a common student strategy: sacrificing sleep all semester and then trying to catch up before exams. The benefit of sleep for learning appears to accumulate over time, as memories from lectures and study sessions are consolidated. A leader who routinely gets five hours during the busy middle of the semester is not simply tired. They are likely learning less from every class they attend. Protecting sleep in a role that runs at night For RAs and club leaders, the challenge is not knowing that sleep matters. It is protecting it when the role pulls against it. Several strategies help. Anchor your wake time. The single most useful habit for sleep consistency is waking at roughly the same time every day, including weekends. It stabilizes the body's internal clock and makes falling asleep at a reasonable hour easier. Consistency was one of the three sleep features linked to better grades in the MIT study. Put the phone out of reach. A phone on the pillow means that every notification is a potential wake-up and every sleepless moment is an invitation to check messages. If you are an RA on duty, keep the duty phone within reach and put your personal phone elsewhere. Off duty, use your phone's sleep or do-not-disturb settings, with exceptions only for the people and numbers that genuinely need to reach you in an emergency. Club leaders should almost never need to be reachable by the organization's group chat at 2 a.m. Build a wind-down after late incidents. After an incident on a duty night, do not expect to fall asleep immediately. Give yourself twenty or thirty minutes of something calming and low-stimulation, such as reading, gentle stretching, or writing down what happened so it is out of your head, before trying to sleep. If you lie awake for a long time, getting up briefly and doing something quiet in dim light is generally better than lying in bed feeling frustrated. Plan for the day after duty. If you know a duty night is likely to be disruptive, avoid scheduling your hardest academic work for the following morning where possible. Hershner and Chervin note that naps can be an effective countermeasure to sleepiness; a short nap earlier in the afternoon after a broken night can help without disrupting the next night's sleep much. Be careful with caffeine. Caffeine is useful, but its effects last for hours. Heavy caffeine use in the afternoon and evening to power through leadership work will often cost you sleep that night, which creates more need for caffeine the next day. Negotiate duty around exams. As Chapter 7 discussed, asking to swap duty nights before major exams is a reasonable request. Build it into your planning at the start of each semester, when you know your exam dates, rather than scrambling the week before. Academics come first Most student leaders would say, if asked, that their academic work comes first. Their calendars often say something else. The structural reason, discussed in Chapter 1, is that leadership demands are urgent and visible while academic demands are deferred and private. The remedy is to make academic work as concrete and visible in your schedule as leadership work. In practice, that means scheduling study time the way you schedule meetings: specific blocks, on your calendar, treated as commitments. When a request comes in that would conflict with a study block, the answer is the same as if it conflicted with a class: "I have something at that time; could we do another time?" You do not need to explain that the something is a problem set. It also means knowing the academic conditions attached to your role. Most RA positions require a minimum grade point average and good academic standing. Many campuses have similar requirements for officers of registered student organizations. Falling below those thresholds can cost you the role, and for RAs, potentially your housing. Knowing where the line is, and watching your grades well before you approach it, is basic self-protection. And it means using academic support early. Tutoring centers, writing centers, professors' office hours and academic advisors are available to student leaders, who are often reluctant to use them because they are used to being the ones who help. If you have missed classes because of a crisis, contact the professor promptly. If you are falling behind across several courses, talk with an academic advisor or the dean of students office. The earlier the conversation, the more options there are. It can also help to be selective about when you take on the heaviest leadership commitments. Students who know that one semester will carry an unusually demanding course load, a thesis, or a major exam such as a professional school admissions test can plan their leadership involvement around it: agreeing to run the big event in the lighter term, or letting a co-officer lead during the heavier one. Leadership and academics are not always in conflict, but they are always drawing on the same limited hours, and deciding in advance how to divide those hours is far easier than negotiating them in the middle of a crisis. Food, movement and the basics Student leaders often let the other physical basics slide along with sleep. Meals are skipped because a meeting ran long or eaten standing up between commitments. Exercise drops away because there is no time. These are small losses individually and large ones together. The goal is not an ideal health regime. It is a floor below which you do not let things fall. For most student leaders a reasonable floor includes eating at regular times rather than grazing irregularly or skipping meals entirely, some form of physical activity most days, even if it is only a brisk walk across campus, and some daylight exposure, particularly in the morning, which also helps regulate sleep. Movement deserves particular emphasis for leaders who handle stressful situations. Physical activity is one of the most accessible ways to discharge the physiological arousal that builds up during a crisis or a difficult conversation. A walk after a hard incident, or a regular exercise routine through a stressful semester, is not a luxury. It is part of how the body recovers. Rest that actually restores Not all time away from the role is restful. An RA who spends a free evening scrolling through a group chat about floor drama, or a president who takes a day off but spends it worrying about next week's event, has technically stopped working without recovering. The organizational psychologists Sabine Sonnentag and Charlotte Fritz, in research on how people recover from work stress, identified four kinds of experience that tend to restore people during time off. The first is psychological detachment: mentally switching off from work, not just physically leaving it. The second is relaxation: activities that lower physical and mental arousal, such as a quiet walk, music or a long meal. The third is mastery: challenging, absorbing experiences outside work that build skills or give a sense of accomplishment, such as learning an instrument, playing a sport or cooking something new. The fourth is control: the sense of deciding for yourself how to spend your free time. This framework is useful for student leaders because it explains why some free time leaves you more tired than before. Time spent half-attending to the role provides no detachment. Time filled with obligations you did not choose, even social ones, provides little sense of control. The most restorative time off usually involves a place, activity or group of people with no connection to the role, as Chapter 1 suggested, and a clear decision not to check messages for a while. A redesigned week Consider an illustrative case. Ben is a junior who is both an RA and the treasurer of a student business club. At the start of a spring semester he sits down with his syllabi, his duty schedule and the club's calendar and makes a plan. He puts his classes on the calendar first, then fixed study blocks, including two long ones on weekend mornings. He sets a wake time of 7:30 on weekdays and 8:30 on weekends and keeps to it within half an hour. He looks up his exam dates and immediately asks his supervisor to swap the two duty nights that fall before his biggest exams. He blocks one evening a week, Thursday, as time entirely away from both roles, which he spends playing in an intramural basketball league with friends from his major. He tells the club's president that he will process reimbursements on Mondays and Wednesdays only, and sets up a simple form so members stop messaging him individually. He puts his personal phone on do-not-disturb from 11:30 p.m., with exceptions for his family and his supervisor. Ben's semester is not stress-free. There is a hard duty night in March, a reimbursement mix-up in April, and a week near finals when he sleeps less than he intends. But he ends the semester with his grades intact, his roles fulfilled, and enough energy left to want to do it again. The difference between Ben's semester and the one described at the start of this book is not that Ben is more resilient. It is that he built the edges before he needed them. Recognizing when you need help The strategies in this book are designed to prevent burnout and reduce the strain of helping. They are not a substitute for professional help when that is needed. Student leaders, who spend so much time noticing warning signs in others, are often slow to notice them in themselves. Table 5 summarizes some warning signs and suggested responses. It is not a diagnostic tool, and if you are uncertain about what you are experiencing, a conversation with a counselor or physician is the best way to find out. Table 5. Warning signs in yourself and what to do. What you notice How long What it may suggest What to do Tired, irritable, dreading the role A few weeks Early burnout Adjust load, talk to supervisor Intrusive memories of an incident Beyond 2-4 weeks Secondary traumatic stress See a counselor Low mood, loss of interest everywhere Two weeks or more Possible depression See a counselor or physician Sleep problems not linked to duty Several weeks Stress, anxiety or depression Talk to health services Heavier drinking or drug use to cope Any Coping under strain Talk to a counselor Thoughts of suicide or self-harm Any Crisis Call or text 988 now A few of these warrant emphasis. If your low mood, loss of interest, hopelessness or fatigue has spread beyond the role into the rest of your life, and has lasted two weeks or more, that is a reason to see a counselor or physician rather than simply to adjust your schedule. Burnout and depression can overlap, and depression is treatable. If you notice you are relying more heavily on alcohol, cannabis or other substances to get through the week or to sleep, that is also worth raising with a professional before it becomes a pattern. Campus counseling centers serve student leaders exactly as they serve other students. Many have same-day appointments for urgent concerns and after-hours phone lines. Student health services can address sleep problems and physical symptoms, and can refer you to counseling. If your institution has an employee assistance program that covers student staff, that may be another option; ask your supervisor. Using any of these is not a sign that you are unfit for your role. It is exactly what you would advise a resident or member to do. If you are in crisis If at any point you are having thoughts of suicide, of harming yourself, or feel unable to keep yourself safe, reach out immediately. · In an emergency, call 911 or your campus emergency number. · Call or text 988 to reach the 988 Suicide and Crisis Lifeline in the United States, available at any hour. You can also chat online at 988lifeline.org. Veterans and service members can dial 988 and press 1 for the Veterans Crisis Line. · Text HOME to 741741 to reach the Crisis Text Line. · LGBTQ+ young people can reach The Trevor Project at 1-866-488-7386, or through its website. · Your campus counseling center's after-hours line, if it has one, is another option. It is worth saving that number in your phone now. These resources exist for student leaders as much as for anyone else. The people who staff them will not ask you to justify why you are calling, and you do not need to be at a breaking point to use them. It is enough to be struggling and to want to talk to someone. The foundation, not the reward The deepest mistake student leaders make about their physical health is treating it as a reward for finishing their responsibilities: sleep once the reports are written, study once the event is over, rest once the semester ends. The responsibilities never finish. The reward never arrives. Sleep, academics and physical health belong at the bottom of the structure, not the top. They are what make it possible to respond well at 2:40 in the morning, to notice the resident who is struggling, to run the meeting with patience, and to make the hard call about referral with a clear head. A leader who protects them is not choosing themselves over the people they serve. They are making sure that the person those people rely on is actually able to show up. Conclusion Self-care is usually described as something private: a bath, a run, an early night, a weekend away. For student leaders, the chapters of this book point toward a different conclusion. The most important forms of self-care available to an RA or club president are not private at all. They are changes to the role itself, and to the way the role is lived in front of other people. That is why they matter beyond the individual leader, and why they are worth the discomfort they sometimes involve. The edges hold each other up Looked at separately, the four edges described in this book, emotional, professional, organizational and physical, can seem like a list of independent tasks. In practice they depend on one another, and the dependencies run in every direction. The shift from empathic distress toward compassion described in Chapter 3 is much harder for someone who is chronically short of sleep, because exhaustion makes it harder to regulate emotion and easier to be swept into someone else's distress. Protecting sleep, as Chapter 8 urged, is therefore not only about grades. It is part of what makes compassionate helping possible. Referral, the subject of Chapter 4, becomes much easier when a leader is no longer in empathic distress, because distress breeds the belief that you alone must fix things, while compassion leaves room to ask what the person actually needs, which is often someone else. And the time a leader stops spending on emotional work that belongs to counselors is time that can go back to study and sleep. Delegation and succession, discussed in Chapters 5 and 6, are what make saying no possible. A president with capable officers can decline a request because someone else can accept it. A president without them faces an impossible choice between overwork and letting the organization fail. In turn, saying no and speaking up to supervisors, as Chapter 7 described, are what protect the time needed to develop other people. This interdependence explains why burnout so often seems to arrive all at once. When one edge gives way, the others come under strain. A few weeks of short sleep make empathic distress more likely, which makes referral harder, which increases the emotional load, which takes more time, which cuts further into sleep. It also explains why recovery can be faster than people expect. Strengthening one edge relieves pressure on the others. A leader who begins by protecting sleep may find that compassion comes more easily. One who begins by delegating may find time to sleep. There is no single correct place to start. The important thing is to start somewhere and to understand that each small change supports the others. The leader sets the norm The second conclusion concerns what other people learn from watching you. Student leaders are highly visible. Residents notice when their RA is awake at 3 a.m. answering messages. Members notice when their president never misses a meeting, even when sick, and apologizes for taking a weekend off. Officers notice whether the president delegates or hoards, whether they speak honestly about strain or insist everything is fine. The next generation of leaders, the sophomores and juniors who will take over, are watching most closely of all, forming their understanding of what the role requires. That means a leader's approach to their own health is never only personal. A president who works to exhaustion is teaching everyone around them that exhaustion is what commitment looks like. An RA who never refers a resident and carries everything alone is modeling a version of the role that the next RA will feel obliged to imitate. The culture of a student organization or a residence hall staff is built largely out of these examples. The reverse is also true. A president who says openly at a meeting, "I'm stepping back from the group chat this week because I have two exams," gives every member permission to protect their own time. An RA who tells new staff during training, "I saw a counselor after a hard incident last year, and it helped," makes it easier for someone else to do the same when they need to. A leader who delegates real responsibility shows the next generation that leadership means developing others rather than doing everything alone. These choices reshape what the role is understood to be. This is why the argument of this book is not only that student leaders are permitted to prioritize their health over organizational demands. It is that doing so, visibly and without apology, is part of their responsibility as leaders. The student who burns out quietly in the service of their organization may be admired, but they leave behind a role that will burn out the next person too. Leaving the role better than you found it The final conclusion is about time. Student leadership roles are short. An RA may hold the position for a year or two; a club president for a year, sometimes less. The leaders who hold them will pass through and move on, but the roles remain, shaped by what each holder did with them. Some of that shaping is formal. The handbook a president writes, the officer roles they define, the transition timeline they establish, and the feedback an RA gives on an exit survey all become part of the structure the next holder inherits. The institutional changes described in Chapter 7, such as universities splitting the RA role or placing counseling trainees in residence halls, came in part from student staff describing what the work was doing to them. Some of the shaping is cultural. The expectations members hold about how quickly the president will respond, whether officers actually share work, whether it is normal to step back during exams, whether referral is seen as care or abandonment: these are built out of what previous leaders did. Each leader either reinforces the existing expectations or shifts them slightly. It is possible, then, to think of self-care for student leaders as something larger than protecting one's own health, although it certainly includes that. It is a form of stewardship. The leader who builds edges into their role, who delegates and documents and refers and sleeps, and who says so openly, leaves behind a role that is more humane for the person who holds it next. That may be the most lasting thing a student leader does: not any single event or program, not any particular crisis handled well, but a role that the next person can hold without being consumed by it. For those who support student leaders A brief word to the professional staff, advisors, faculty and parents who read this book. Student leaders will not build these edges alone, and they should not have to. Supervisors who ask specific questions about workload, who make debriefing routine after serious incidents, who adjust duty around exams without being asked, and who treat a student's request for help as good judgment rather than weakness, make every strategy in this book easier to use. Advisors who take an active interest in how the work is distributed within an organization can prevent a president from quietly absorbing everything. Parents who ask not only "How is the job going?" but "Are you sleeping? Are your classes okay? Who do you talk to when it's hard?" give their student a reason to notice what they might otherwise ignore. Institutions, finally, can design roles with edges from the start: clearer scopes, realistic ratios, crisis support that does not rest on undergraduates alone, and compensation that reflects the work. The student leaders who hold these roles have chosen to take responsibility for other people. The least the institutions around them can do is take responsibility for them. The student in the hallway Return, for a moment, to the RA sitting in the hallway at 2:40 in the morning with an organic chemistry midterm six hours away. Nothing in this book would have prevented that night. Emergencies will happen, and student leaders will sometimes be the first people there. What this book offers is a different set of days around that night. A supervisor who is told the next morning and arranges a debrief. A professor contacted about the exam. A floor script that protects both confidentiality and the RA's own recovery. A way of staying with the next resident's distress that does not require absorbing it. A clear sense of which parts of the aftermath are hers and which belong to professionals. A duty schedule that keeps her scheduled nights on call away from major exams, because she asked for the swaps in September. And a life outside the building, with people and activities that have nothing to do with the role, to return to when the night is over. None of that makes her care less. All of it makes it possible for her to keep caring, this year and the next, and to hand the role on in better shape than she found it. Notes Sources are listed by chapter in the order in which they are drawn upon. Illustrative scenarios in the text are composites and are not based on identifiable individuals. Introduction 1. Healthy Minds Network. The Healthy Minds Study: 2024-2025 Data Report. Figures on depression, anxiety and suicidal ideation, sample size and comparison with 2022 as summarized in University of Michigan School of Public Health, "Healthy Minds Study: College student depression, anxiety decline for third consecutive year," 2025. https://sph.umich.edu/news/2025posts/college-student-mental-health-third-consecutive-year-improvement.html 1. Quotations from Cal State RAs: EdSource, "Ice cream socials, fights and vomit: Why Cal State resident assistants want to unionize," April 11, 2025. https://edsource.org/2025/ice-cream-socials-fights-and-vomit-why-cal-state-resident-assistants-want-to-unionize/730063 2. Redesign of RA roles: Inside Higher Ed, "To reduce RA burnout, universities are redefining the role," January 16, 2024. https://www.insidehighered.com/news/students/residential-life/2024/01/16/reduce-ra-burnout-universities-are-redefining-role 3. Boston University RA union and strike: BU Today, "BU RAs Authorize Four-Day Strike over Contract Negotiations," April 2024. https://www.bu.edu/articles/2024/residence-life-union-strike/ 4. Substance Abuse and Mental Health Services Administration. 988 Suicide and Crisis Lifeline. https://www.samhsa.gov/mental-health/988 Chapter 1: The Job With No Edges 1. World Health Organization. "Burn-out an 'occupational phenomenon': International Classification of Diseases." May 28, 2019. https://www.who.int/news/item/28-05-2019-burn-out-an-occupational-phenomenon-international-classification-of-diseases 2. Maslach, C., and Leiter, M. P. "Understanding the burnout experience: Recent research and its implications for psychiatry." World Psychiatry 15, no. 2 (2016): 103-111. Source for the six areas of work life. 3. Heasley, C., Boone, K., and Conn, K. "Sometimes Superheroes Can't Save Everyone: Rethinking the Resident Assistant Role." Journal of College and University Student Housing 51, no. 2 (2025). 4. BU Today, April 2024, as in Introduction note 4, for the union's position on compensation and on-call responsibilities. 5. Bakker, A. B., and Demerouti, E. "The Job Demands-Resources model: State of the art." Journal of Managerial Psychology 22, no. 3 (2007): 309-328. 6. Cross, R., Rebele, R., and Grant, A. "Collaborative Overload." Harvard Business Review, January-February 2016. 7. Bolino, M. C., Hsiung, H.-H., Harvey, J., and LePine, J. A. "'Well, I'm tired of tryin'!' Organizational citizenship behavior and citizenship fatigue." Journal of Applied Psychology 100, no. 1 (2015): 56-74. 8. Sonnentag, S., and Fritz, C. "The Recovery Experience Questionnaire: Development and validation of a measure for assessing recuperation and unwinding from work." Journal of Occupational Health Psychology 12, no. 3 (2007): 204-221. Source for psychological detachment. Chapter 2: What Crisis Duty Does to the Helper 1. McCann, I. L., and Pearlman, L. A. "Vicarious traumatization: A framework for understanding the psychological effects of working with victims." Journal of Traumatic Stress 3, no. 1 (1990): 131-149. 2. Figley, C. R., ed. Compassion Fatigue: Coping with Secondary Traumatic Stress Disorder in Those Who Treat the Traumatized. New York: Brunner/Mazel, 1995. 3. McCarthy, K. "Resident assistant secondary trauma and burnout associated with student nonsuicidal self-injury." Journal of American College Health 68, no. 7 (2020): 673-677. Published online March 2019. https://doi.org/10.1080/07448481.2019.1590374 4. Lynch, R. J. "The Development and Validation of the Secondary Trauma in Resident Assistants Scale." Journal of College and University Student Housing 44, no. 1 (2017): 10-29. Chapter 3: Empathy Is Not the Problem 1. Singer, T., and Klimecki, O. M. "Empathy and compassion." Current Biology 24, no. 18 (2014): R875-R878. https://doi.org/10.1016/j.cub.2014.06.054 2. Batson, C. D., Fultz, J., and Schoenrade, P. A. "Distress and empathy: Two qualitatively distinct vicarious emotions with different motivational consequences." Journal of Personality 55, no. 1 (1987): 19-39. 3. Klimecki, O. M., Leiberg, S., Lamm, C., and Singer, T. "Functional neural plasticity and associated changes in positive affect after compassion training." Cerebral Cortex 23, no. 7 (2013): 1552-1561. https://doi.org/10.1093/cercor/bhs142 4. Klimecki, O. M., Leiberg, S., Ricard, M., and Singer, T. "Differential pattern of functional brain plasticity after compassion and empathy training." Social Cognitive and Affective Neuroscience 9, no. 6 (2014): 873-879. https://doi.org/10.1093/scan/nst060 5. Klimecki, O. M. "The plasticity of social emotions." Social Neuroscience 10, no. 5 (2015): 466-473. https://doi.org/10.1080/17470919.2015.1087427 6. Neff, K. Self-Compassion: The Proven Power of Being Kind to Yourself. New York: William Morrow, 2011. Chapter 4: You Are Not the Counselor 1. Dazzi, T., Gribble, R., Wessely, S., and Fear, N. T. "Does asking about suicide and related behaviours induce suicidal ideation? What is the evidence?" Psychological Medicine 44, no. 16 (2014): 3361-3363. https://doi.org/10.1017/S0033291714001299 2. 988 Suicide and Crisis Lifeline, as in Introduction note 5. Chapter 5: The Myth of the Indispensable President 1. Cross, Rebele and Grant (2016), as in Chapter 1 note 6. 2. Bolino and colleagues (2015), as in Chapter 1 note 7. Chapter 6: Building an Organization That Doesn't Need You 1. Inside Higher Ed (2024), as in Introduction note 3, for changes to RA roles following staff feedback. Chapter 7: Saying No and Managing Up 1. McKeown, G. Essentialism: The Disciplined Pursuit of Less. New York: Crown Business, 2014. 2. BU Today, April 2024, as in Introduction note 4. 3. EdSource, April 2025, as in Introduction note 2, for the Cal State RA union effort. 4. Inside Higher Ed (2024), as in Introduction note 3, for the Binghamton, Clemson and other redesigns and the Binghamton return rate. Chapter 8: Sleep, Grades and the Body That Carries the Role 1. Hershner, S. D., and Chervin, R. D. "Causes and consequences of sleepiness among college students." Nature and Science of Sleep 6 (2014): 73-84. https://doi.org/10.2147/NSS.S62907 2. Watson, N. F., et al. "Recommended amount of sleep for a healthy adult: A joint consensus statement of the American Academy of Sleep Medicine and Sleep Research Society." Sleep 38, no. 6 (2015): 843-844. 3. Okano, K., Kaczmarzyk, J. R., Dave, N., Gabrieli, J. D. E., and Grossman, J. C. "Sleep quality, duration, and consistency are associated with better academic performance in college students." npj Science of Learning 4 (2019): 16. https://doi.org/10.1038/s41539-019-0055-z 4. Sonnentag and Fritz (2007), as in Chapter 1 note 8, for the four recovery experiences. 5. Crisis resources: 988 Suicide and Crisis Lifeline (988lifeline.org); Crisis Text Line (crisistextline.org); The Trevor Project (thetrevorproject.org). Further Reading Christina Maslach and Michael P. Leiter, The Burnout Challenge: Managing People's Relationships with Their Jobs (Harvard University Press, 2022).** The two most influential burnout researchers explain why burnout is best understood as a mismatch between people and their working conditions. Written for organizations, but directly useful to anyone designing or holding a student leadership role. Laura van Dernoot Lipsky with Connie Burk, Trauma Stewardship: An Everyday Guide to Caring for Self While Caring for Others (Berrett-Koehler, 2009).** A humane and practical book about the cumulative toll of helping work, written for people in social services, activism and caregiving. Its discussion of warning signs will be familiar to many RAs. Kristin Neff, Self-Compassion: The Proven Power of Being Kind to Yourself (William Morrow, 2011).** An accessible introduction to research and practice on self-compassion by one of the psychologists who developed the field. A good companion to the practices in Chapter 3. Emily Nagoski and Amelia Nagoski, Burnout: The Secret to Unlocking the Stress Cycle (Ballantine, 2019).** A readable account of how stress builds up in the body and how to complete the stress response, with particular attention to the pressures on people expected to be endlessly giving. Adam Grant, Give and Take: Why Helping Others Drives Our Success (Viking, 2013).** Explores why some generous people thrive while others burn out, and how to help others without being depleted. Especially relevant to leaders who find it hard to say no. Greg McKeown, Essentialism: The Disciplined Pursuit of Less (Crown Business, 2014).** A short, direct argument for deciding what matters most and declining the rest. Useful for leaders who struggle with the discipline described in Chapter 7. 988 Suicide and Crisis Lifeline (988lifeline.org). Call or text 988 in the United States at any hour. The website also has guidance on how to help someone you are worried about. The Jed Foundation (jedfoundation.org). A nonprofit focused on emotional health and suicide prevention for teens and young adults, with practical resources for students supporting friends and for campus staff. Mental Health First Aid (mentalhealthfirstaid.org). Information about a widely used training program that teaches people to recognize and respond to signs of mental health and substance use challenges. Many campuses offer versions for students and staff. Hashtags: #SelfCareForStudentLeaders #StudentLeadership #BurnoutPrevention #StudentLeaderWellbeing #ResidentAssistants #ClubPresidents #CampusLeadership #CollegeLife #StudentMentalHealth #LeadershipWellness #StressManagement #EmotionalResilience #HealthyBoundaries #WorkLifeBalance #AcademicLifeBalance #CompassionFatigue #EmpathicDistress #SecondaryTraumaticStress #VicariousTrauma #SelfCompassion #PeerSupport #CrisisResponse #MentalHealthAwareness #CampusSupportServices #LeadershipDelegation #TeamManagement #SuccessionPlanning #TimeManagement #HealthyLeadership #SustainableLeadership

Download the Book (PDF): Introduction Two days before Slovakia's parliamentary election in September 2023, an audio clip began moving through Facebook and Telegram. It appeared to capture Michal Šimečka, leader of the liberal Progressive Slovakia party, talking with a journalist about buying votes from the country's Roma minority and rigging the count. A second clip had him musing about doubling the price of beer. Both recordings were synthetic. Fact-checkers flagged the telltale flatness of the voice and the oddly clipped exchanges, and the journalist involved denied the conversation had ever taken place. But the clips arrived inside Slovakia's pre-election moratorium, the forty-eight hours in which media and politicians are expected to stay quiet, which left the targets with little room to respond through ordinary channels. Progressive Slovakia, which had been neck-and-neck with Robert Fico's Smer in the polls, finished second. Nobody can show that the clips changed the result. Nobody can show that they did not. That uncertainty is the subject of this book. Deepfakes, meaning images, video and audio fabricated or altered by machine learning so that they appear to record real people doing or saying things they never did, have passed in under a decade from a curiosity on a Reddit forum to an ordinary instrument of fraud, harassment and political manipulation. The technical barrier that once confined convincing forgery to film studios and intelligence services has largely gone. A voice can be imitated from a short sample. A face can be animated from a single photograph. Entire scenes, with no source footage at all, can be generated from a sentence of text. The public conversation about this has tended to fix on one question: can we tell what is fake? It is a reasonable question, and much of what follows takes it seriously. There is a real science of media forensics, with methods that find the seams left by a face-swapping pipeline, the statistical fingerprints of a generative network, or the physical impossibilities in a synthetic scene. Those methods work, often impressively, under the conditions they were designed for. But the argument of this book is that the detection question, on its own, is the wrong frame. Detection is necessary and will remain so. It is also structurally on the losing side of an arms race, for reasons that are not about the cleverness of any particular detector but about the shape of the contest itself. Each generation of forensic method describes an imperfection; each generation of generative model removes the imperfections that matter. Detectors trained on one family of forgeries falter on the next. Compression, cropping and re-recording, which happen to every piece of media that travels through social networks, wipe out much of the evidence a detector depends on. And even a detector that is right ninety-nine times in a hundred produces, at the scale of a platform handling billions of uploads, an unmanageable flood of false alarms and a steady leak of forgeries. The durable response therefore runs in a different direction. Instead of asking only "is this fake?", societies are learning to ask "can this be shown to be real?" That shift, from detecting forgery to proving authenticity, underpins the most important technical work of the past few years: cryptographically signed provenance records that travel with an image from the camera sensor to the reader's screen, invisible watermarks stamped into the output of generative systems, and the regulatory obligations, now in force in the European Union and elsewhere, that require synthetic content to be labelled at the point of creation. None of these is a complete answer. Together they change the default from a world in which every recording must be interrogated to one in which authentic recordings can carry their own evidence. The second strand of the argument concerns what deepfakes actually do to democratic life. The fear that dominated commentary before 2024, the year in which roughly half the world's population lived in countries holding national elections, was of a decisive late-breaking fake: a fabricated confession or slur released on the eve of a vote, too fast to debunk, swinging the outcome. That fear was not baseless; Slovakia came close to illustrating it. Yet the systematic studies of 2024 found that synthetic media, while abundant, rarely changed minds. Researchers at the Alan Turing Institute counted only sixteen confirmed viral cases of AI-generated disinformation during the United Kingdom's general election that summer, and only eleven across the French and European Parliament elections combined, and found no evidence that they had meaningfully altered results. The more serious damage is quieter. The existence of convincing fakes gives every politician caught on tape a ready defence: it was AI. Legal scholars Robert Chesney and Danielle Citron named this the "liar's dividend" in 2019, and it has since been claimed in courtrooms, campaigns and press conferences around the world. A society in which any recording can be dismissed as synthetic loses one of the main ways in which the powerful are held to account. The threat to elections, in other words, lies less in the fake that is believed than in the genuine recording that is not. These two strands meet. If the risk is the erosion of trust in authentic evidence, then the remedy cannot be better lie detection alone. It has to include ways of making truth verifiable, and institutions sturdy enough that no single clip, real or forged, can decide a contested question. That is where this book ends up. How the book is organised The first three chapters explain the technology. Chapter 1 places deepfakes in the long history of manipulated media, from Stalin's retouched photographs to the slowed-down video of a stammering politician, and sets out what is genuinely new. Chapter 2 explains the two architectures that made modern face-swapping possible, the autoencoder and the generative adversarial network, at the level of ideas rather than recipes; the aim is to understand why these systems work and where their weaknesses lie, which is exactly what a defender needs. Chapter 3 follows the technology beyond GANs into diffusion models, voice cloning and real-time synthesis, the developments that moved deepfakes from laborious to effortless. The middle three chapters turn to defence. Chapter 4 surveys the forensic methods that detect synthetic media: the boundary artifacts of face-swapping, the frequency-domain fingerprints of generative networks, the physiological signals that synthetic faces fail to reproduce, and the mismatches between what a mouth does and what a voice says. Chapter 5 explains why detection, however good, cannot carry the load alone. Chapter 6 examines the provenance and watermarking systems that are emerging to complement it, including the Content Credentials standard and the regulatory regimes that now require labelling. The last three chapters turn to society. Chapter 7 examines the record of deepfakes in elections, from Gabon and Ukraine to Slovakia, New Hampshire, India, Ireland and the 2026 American midterms, and argues that the liar's dividend is the larger danger. Chapter 8 widens the lens to fraud and sexual abuse, which together account for most of the real harm deepfakes do, and to the laws that have begun to address them. Chapter 9 sets out what newsrooms, election officials, platforms, campaigns and ordinary citizens can do now. One boundary should be stated plainly. This book explains how synthetic media systems work so that readers can understand, detect and govern them. It does not provide instructions for producing deceptive forgeries of real people, and nothing in it should be read that way. The concepts that make a forgery possible are, for the most part, the same concepts that make it detectable; it is the concepts that matter here. Chapter 1: A Long History of Doctored Evidence The camera has never been a neutral witness. Within a few decades of the invention of photography, practitioners had learned to combine negatives, paint out unwanted figures and stage scenes that never happened. Alexander Gardner's celebrated photograph of a dead Confederate sharpshooter at Gettysburg in 1863 is now generally believed to show a body that was dragged into position for a more dramatic composition. Spirit photographers of the late nineteenth century sold grieving families double-exposed images of their departed relatives, and some of their customers went to court convinced the images were genuine. The idea that a photograph is a mechanical, and therefore truthful, trace of the world coexisted from the start with a thriving practice of making photographs lie. The twentieth century industrialised the lie. Under Stalin, the Soviet state maintained a laborious practice of erasing purged officials from the photographic record. The best known case is Nikolai Yezhov, head of the secret police during the Great Terror, who was photographed walking beside Stalin along the Moscow-Volga canal; after Yezhov was arrested and shot in 1940, he vanished from the picture, the water closing over the space where he had stood. The historian David King spent decades assembling such before-and-after pairs, and his collection shows how much skill, time and institutional backing each erasure required. Retouchers worked with airbrushes, scalpels and gouache. Their work was good enough to deceive casual viewers but rarely survived examination by someone holding the original. That last point matters for everything that follows. For most of the history of manipulated media, forgery was expensive, slow and detectable by anyone with access to the source. It required skilled labour, and its products bore physical evidence of tampering. The authority of the photograph, and later of film and audio tape, rested not on the impossibility of forgery but on its cost. A recording was trusted because faking it convincingly was hard enough that most people, most of the time, would not bother. From darkroom to desktop Digital editing lowered that cost long before machine learning arrived. Adobe released Photoshop in 1990, and within a decade the phrase "it's been photoshopped" had entered ordinary speech. Magazines were caught slimming models and lightening skin. In 2004 a composite image purporting to show John Kerry sharing a stage with Jane Fonda at an anti-war rally circulated during the American presidential campaign; the two source photographs had been taken years apart. In 2008 Iran's state media released an image of four missiles launching in a test, one of which had been cloned from the others to conceal a failed launch. These cases were exposed because digital forgeries, like analogue ones, left traces: duplicated regions, inconsistent shadows, mismatched noise patterns. A field of digital image forensics grew up to find them, led by researchers such as Hany Farid at Dartmouth and later Berkeley, whose work on lighting inconsistencies and resampling traces became the basis of courtroom testimony. Video and audio remained harder. Editing film to show a person saying something they had not said required either an impersonator or extraordinary effort in a visual effects studio. Hollywood could resurrect an actor for a few minutes of screen time, as it did with Peter Cushing in Rogue One in 2016, but the cost ran to many millions and the results were still, to many viewers, faintly uncanny. For the ordinary political operator or fraudster, convincing fabricated video was out of reach. What was within reach, and remains extremely effective, is what researchers now call the "cheapfake" or "shallowfake": authentic media manipulated through simple editing. In May 2019 a video of Nancy Pelosi, then Speaker of the United States House of Representatives, was slowed to roughly three-quarters speed with its pitch adjusted, making her appear drunk or impaired. It was viewed millions of times. In November 2018 the White House shared a clip of a confrontation between the CNN correspondent Jim Acosta and a White House intern that critics said had been altered, through speed changes or frame duplication, to make his arm movement look more aggressive. Neither required machine learning. Both exploited the same thing deepfakes exploit: the viewer's assumption that moving pictures show what happened. The persistence of the cheapfake is worth keeping in mind throughout this book. Britt Paris and Joan Donovan, in their 2019 report for the Data & Society research institute, argued that the line between sophisticated and crude manipulation matters less than the social context in which media is used. A crude edit shown to an audience predisposed to believe it does more damage than a flawless forgery shown to a sceptical one. Some of the most consequential cases of manipulated media in recent elections have involved no artificial intelligence at all: an authentic photograph given a false caption, an old video recirculated as new, a quotation stripped of its context. The arrival of the deepfake The word itself has a precise origin. In late 2017 a Reddit user calling himself "deepfakes" began posting pornographic videos in which the faces of female celebrities had been swapped onto the bodies of adult performers. He used open-source machine learning libraries and a technique that, as Chapter 2 explains, trained a neural network to translate one person's face into another's. Within weeks other users had joined a dedicated forum, and in January 2018 a free desktop application, FakeApp, packaged the technique for people with no programming skills. Reddit banned the forum in February 2018, but by then the code had spread to open-source repositories, where successors such as DeepFaceLab and faceswap were developed and maintained by volunteer communities. The origin matters. The first mass use of the technology was the sexual humiliation of women who had not consented, and that remains its most common use. A 2019 report by the Dutch company Deeptrace (later renamed Sensity) counted 14,678 deepfake videos online and found that 96 per cent were non-consensual pornography, almost all of it targeting women. The political deepfake, which attracts most public attention, was for years the rare exception. This proportion has shifted as tools have spread, but the gendered character of the harm has not. Political uses followed, slowly at first. In 2018 the filmmaker Jordan Peele and BuzzFeed released a video in which Barack Obama appeared to call Donald Trump "a total and complete dipshit" before the frame split to reveal Peele performing the voice; the video was a public service warning, and it worked as one. In the same year, a New Year's address by Gabon's president Ali Bongo, who had been out of public view for months after a stroke, struck many viewers as so odd that his opponents claimed it was a deepfake. A week later, junior army officers attempted a coup, citing the president's condition. Later forensic analysis did not establish that the video was synthetic; it may simply have shown a man recovering from a stroke. The Gabon episode is therefore an early case not of a deepfake but of the suspicion of one, a theme Chapter 7 returns to. In March 2022, three weeks into Russia's full-scale invasion, a video appeared on a hacked Ukrainian news website and then on social media in which President Volodymyr Zelensky seemed to tell Ukrainian soldiers to lay down their arms. The forgery was poor: the head was oddly proportioned against the body, the voice was wrong, and the lighting did not match. Zelensky quickly posted a genuine video rejecting it, and platforms removed the fake. It is often cited as proof that deepfakes are less dangerous than feared. It may equally show how dangerous they can be once the quality improves, because the attempt was made at a moment of maximum stakes. What is actually new If manipulation is as old as the camera, what justifies treating deepfakes as a distinct problem? Four things have changed, and they compound one another. The first is cost. A convincing face swap in 2017 required a capable graphics card, hours or days of training, and several hundred images of each face. Within a few years, tools appeared that could animate a face from a single photograph. By the mid-2020s commercial services offered voice cloning from short samples for a few dollars a month, and general-purpose video generators could produce photorealistic footage from text prompts. The labour that once made forgery rare has been automated. The second is scale. Because forgery is cheap, it can be produced in volume and tailored to audiences. A single operator can generate thousands of variants of an image or clip, test which ones spread, and personalise messages to particular communities or even individuals. The robocall impersonating Joe Biden in New Hampshire in January 2024, discussed in Chapter 7, was produced, by the account of the street magician who made the recording, in a matter of minutes and for almost no money. The third is modality. Earlier digital forgery was mostly a matter of still images. Machine learning extended convincing fabrication to the media people trust most instinctively: the moving face and the human voice. Psychologists have long observed that people treat audiovisual evidence as more credible than text, and the phrase "seeing is believing" captures something real about how perception feeds belief. Audio is in some ways the most dangerous modality of all, because it lacks the visual cues that help viewers spot anomalies and because it travels through channels, such as phone calls and voice messages, where verification is especially hard. The fourth is interactivity. Recorded forgeries can be examined after the fact. Real-time synthesis, in which a face or voice is transformed live during a video call, removes even that opportunity. A target speaking to what appears to be a colleague cannot pause the conversation to run forensic software. Chapter 8 discusses cases in which this capability has been used to steal tens of millions of dollars. A vocabulary for synthetic media The term "deepfake" is now used loosely for any AI-generated media, and some precision helps. Researchers distinguish several kinds of manipulation that differ in what they change and in what traces they leave. Face swapping replaces the face of one person with the face of another while keeping the original body, background and, usually, expressions. It is the technique that gave deepfakes their name. Face reenactment, sometimes called puppeteering, keeps the target's identity but transfers expressions and head movements from a source performer, so the target appears to move as the performer moves. Lip-sync manipulation changes only the mouth region to match a new audio track, making a person appear to say words they never said while the rest of the footage remains authentic. Attribute editing alters properties such as age, hair or expression without changing identity. Fully synthetic generation creates an image, video or voice from nothing, with no source recording at all; the faces on the website "This Person Does Not Exist", launched in 2019, were early examples. Voice cloning produces speech in a particular person's voice, either by converting one speaker's recording into another's voice or by generating speech directly from text. These categories matter for detection because each leaves different evidence. A face swap leaves a boundary where the inserted face meets the original head. A lip-sync forgery leaves a mouth region whose statistics differ from the rest of the frame and whose movements may not quite match the phonemes in the audio. A fully synthetic image has no boundary at all but may carry the statistical fingerprint of the network that made it. A cloned voice may lack the micro-variations of breathing and room acoustics that real recordings contain. They also matter for policy. A lip-sync alteration of authentic footage of a real politician is a different act, with different harms, from a fully synthetic image of an imaginary person used to illustrate a news story, or from a film studio de-ageing an actor with her consent. Much confusion in public debate comes from treating these as one thing. "Synthetic media" is the broader and more neutral term, covering the whole range of AI-generated and AI-altered content, legitimate and otherwise; "deepfake" is best reserved for synthetic media that depicts real, identifiable people in ways they did not consent to and that is likely to deceive. That distinction carries a further point. Most synthetic media is not deceptive. Dubbing films into other languages with the original actors' lip movements, restoring the voices of people who have lost the ability to speak, creating training data for medical imaging, producing accessible educational material: these are real uses with real value. The technology that produced the Slovak audio clips is, in its core components, the same technology that allows a person with motor neurone disease to speak in a recreation of their own voice. Several well-known cases show where the line between acceptable and unacceptable use actually falls. In 2019 the footballer David Beckham appeared in a campaign for the charity Malaria No More in which synthetic video made him appear to speak nine languages; he had agreed to it, the purpose was disclosed, and nobody was misled about anything that mattered. In Top Gun: Maverick, released in 2022, the actor Val Kilmer, who had lost much of his speaking voice to throat cancer, appeared in a scene supported by a synthetic model of his voice built by the company Sonantic from his archival recordings, with his participation. In 2024 the American congresswoman Jennifer Wexton, whose speech had been impaired by a neurological disease, addressed the House of Representatives using an AI recreation of her former voice. Each of these uses involved a real person's likeness, and each was welcomed, because the person consented and the audience was not deceived. Contrast the 2021 documentary Roadrunner, about the chef Anthony Bourdain, who had died in 2018. Its director revealed after release that three lines of narration, words Bourdain had written but never spoken aloud, had been rendered in a synthetic version of his voice without any indication to viewers. The reaction was sharply negative, and it is instructive that the objection was not to synthesis itself but to the absence of disclosure and the uncertainty about consent. Viewers felt that something had been put over on them, and that a dead man had been made to perform. The episode suggests that public intuitions about synthetic media are already reasonably clear: consent from the person depicted and honesty with the audience are what separate legitimate uses from abuse. The harder questions arise where those two tests pull apart, as in satire, where the audience is meant to recognise the fabrication but the subject has not agreed to it, or in the resurrection of dead public figures for political campaigns, a practice that Chapter 7 shows became common in several Asian elections in 2024. Why moving pictures persuade It is worth asking why audiovisual forgery should be more dangerous than the written lie, which has always been cheap. Part of the answer is psychological. People process images and sounds faster and with less effort than text, and information that is processed fluently tends to feel true. Recordings also carry what philosophers of evidence call a causal connection to their subject: a photograph is produced by light that actually came from the scene, which is why people treat it less like testimony, which can lie, and more like a trace, which cannot. The philosopher Regina Rini argued in 2020 that recordings have served societies as an "epistemic backstop", a way of checking testimony against something less corruptible, and that the main danger of deepfakes is the loss of that backstop rather than any individual deception. A second part of the answer is social. A rumour spread in words invites the question "who says so?" A recording seems to bypass that question, because the viewer appears to witness the event directly. That is precisely what makes deepfakes efficient as propaganda: they borrow the authority of direct witness while concealing the fact that someone, somewhere, is still saying so. The problem this book addresses is not synthetic media as such but its use to deceive about real people and real events, and the corrosive effect that such deception has on the shared evidentiary ground that public life depends on. The next chapter turns to how these systems work, beginning with the two architectures that made the first deepfakes possible. Chapter 2: Teaching Machines to Forge: Autoencoders and GANs A forger working by hand has to understand a face: how light falls across a cheekbone, how skin creases when someone smiles, how the eyes move together. The breakthrough behind deepfakes was the discovery that a machine could acquire something like that understanding without anyone writing it down, simply by being shown enough examples and being told, in a precise mathematical sense, how wrong its attempts were. This chapter explains the two architectures that turned that discovery into forged faces. The aim is conceptual. A defender needs to know why these systems work, what they learn, and what they characteristically fail to learn, because those failures are where detection begins. Learning a compressed idea of a face A neural network, at its simplest, is a long chain of mathematical operations whose behaviour is governed by millions of adjustable numbers called parameters. Training a network means showing it examples, measuring how far its output is from what was wanted, and nudging every parameter slightly in the direction that would have reduced the error. Repeated across many examples, this process, known as gradient descent, gradually shapes the network into something that performs the task. Networks that process images typically use convolutional layers, which look at small patches of the image at a time and build up, layer by layer, from edges and textures to parts such as eyes and mouths and finally to whole faces. An autoencoder is a network trained to reproduce its own input. That sounds pointless until one notices the constraint built into it. The network has two halves. The first half, the encoder, squeezes the image down into a small set of numbers, far fewer than the pixels in the original. The second half, the decoder, has to rebuild the full image from that compressed summary. Because the bottleneck in the middle is too narrow to hold every pixel, the network cannot simply copy. It is forced to discover a compact description that captures what matters about the image and discards what does not. The compressed summary is called the latent representation, and the space of all such summaries is called the latent space. When an autoencoder is trained on thousands of photographs of faces, the latent representation comes to encode the things that vary between face images: the angle of the head, the direction of gaze, whether the mouth is open, the expression, the lighting. These are the properties a decoder needs to know in order to redraw the face. The network has never been told about head pose or expression. It discovers them because they are the most economical way to describe the variation in its training data. The variational autoencoder, introduced by Diederik Kingma and Max Welling in 2013, adds a refinement: it encourages the latent space to be smooth and continuous, so that nearby points correspond to similar faces and a decoder can produce plausible images from points it was never explicitly trained on. That property, a smooth space from which new examples can be sampled, is the common thread connecting autoencoders to every later generative model in this book. The original face-swap idea The architecture behind the first Reddit deepfakes exploited the structure of the latent space in a simple and clever way. Imagine training two autoencoders, one on images of person A and one on images of person B, but with a twist: the two share a single encoder while each has its own decoder. The shared encoder must learn a latent description that works for both people. Since it is shared, the description it settles on tends to capture the things the two sets of images have in common, such as pose, expression, gaze and lighting, rather than the things that distinguish one identity from the other. Each decoder, meanwhile, learns to take that shared description and paint it in the face of its own person. The swap happens by crossing the wires. Feed a frame of person A into the shared encoder, which extracts the pose and expression; then hand that description to the decoder that was trained on person B. The decoder does the only thing it knows how to do, which is to render person B's face, but it does so with A's pose and expression. The generated face is then placed back into the original frame, aligned with the head and blended at the edges. Understanding this architecture explains almost everything about how early deepfakes looked and how they were caught. The decoder only ever draws a cropped face, usually a square region from eyebrows to chin, so the final video always contains a seam where the generated face meets the original head, hair and neck. The decoder works at a fixed, modest resolution, so the face is often slightly blurrier than its surroundings, especially in high-definition footage. The decoder can only render poses and expressions it has seen in its training data, so if the training photographs of person B were mostly frontal, side profiles come out distorted. Early researchers noticed that synthetic faces rarely blinked, because publicly available photographs of celebrities, which supplied much of the training data, almost never show closed eyes. Teeth were often rendered as an undifferentiated white band, because the fine structure of individual teeth varies too much between frames to be captured in a compressed representation. Each of these weaknesses became, briefly, a detection method, and each was then corrected by better training data or architecture, a pattern Chapter 5 examines. The adversarial game Autoencoders learn to reproduce images by minimising a pixel-by-pixel error. That objective has a known side effect: when the network is uncertain, it averages, and averaged images look blurry. A sharper approach came from a different idea entirely, one that Ian Goodfellow and colleagues published in 2014 under the name generative adversarial networks, or GANs. A GAN sets two networks against each other. The generator takes random numbers as input and tries to produce an image that looks like it came from the training data. The discriminator is shown a mixture of real training images and the generator's outputs and tries to tell them apart. The two are trained together. The discriminator is rewarded for catching fakes; the generator is rewarded for fooling the discriminator. Crucially, the generator learns not from a fixed rule about what images should look like but from the discriminator's judgements. Every time the discriminator finds a reliable way of telling fake from real, that information flows back to the generator in the form of an error signal pointing towards the change that would have made the fake more convincing. Goodfellow and his co-authors described the arrangement with an analogy that has become standard: a team of counterfeiters trying to produce fake currency and a team of police trying to detect it, each improving in response to the other until the counterfeits are indistinguishable from the genuine article. In the idealised mathematical picture, the contest reaches an equilibrium in which the generator's outputs follow exactly the same statistical distribution as the real data, and the discriminator can do no better than guess. The analogy contains a lesson that defenders should not miss. A GAN has a detector built into it. The discriminator is a forensic classifier, and the generator is trained specifically to defeat it. Any detection method that can be expressed as a differentiable function, which includes nearly every neural-network detector, can in principle be dropped into the discriminator's role, at which point the generator will learn to evade it. This is not a hypothetical concern. Researchers have repeatedly shown that adding a published detector to a generator's training objective reduces that detector's accuracy dramatically. The adversarial structure of the arms race described in Chapter 5 is not merely a metaphor; it is the training procedure. In practice GANs were notoriously difficult to train. The two networks can fall out of balance, with a discriminator so strong that the generator receives no useful signal or a generator that discovers a few outputs that reliably fool the discriminator and produces nothing else, a failure called mode collapse. Much of the research from 2014 to 2019 consisted of finding ways to stabilise the game. From blurry thumbnails to photographs The trajectory of GAN image quality over five years is one of the most striking in modern computing. The faces in the original 2014 paper were small, grey and smeared. By 2017 a team at NVIDIA led by Tero Karras had introduced progressive growing, a technique that trains the networks first on tiny images and then gradually adds layers to handle higher resolutions, producing convincing celebrity faces at 1024 by 1024 pixels. In 2019 the same group released StyleGAN, which restructured the generator so that the random input passes through a mapping network into an intermediate "style" space and is then injected at every layer, with coarse layers controlling pose and face shape and fine layers controlling skin texture and hair. StyleGAN's faces, trained on a new high-quality dataset of faces drawn from Flickr, were good enough to launch the website This Person Does Not Exist, which displayed a new synthetic face on every visit. StyleGAN is also instructive for what came next. Its outputs carried a characteristic artifact, a small blob or "water droplet" that appeared in many images, caused by the way the network normalised its internal signals. Its successor, StyleGAN2, released in 2020, redesigned that normalisation and the artifact disappeared. StyleGAN3, in 2021, addressed a subtler problem: details such as hair and beard texture appeared to be glued to fixed pixel positions rather than moving with the face, a symptom of a technical issue known as aliasing. Each fix removed a visible clue that forensic analysts had been using. In 2022 the psychologist Sophie Nightingale and Hany Farid published a study in the Proceedings of the National Academy of Sciences in which participants were asked to distinguish StyleGAN2 faces from real photographs. Their accuracy was 48.2 per cent, slightly worse than chance. Even after training on common artifacts, accuracy rose only to about 59 per cent. A third group, asked to rate trustworthiness, judged the synthetic faces as slightly more trustworthy than the real ones, perhaps because GAN faces tend towards the average, and averaged faces are perceived as more trustworthy. The practical consequence is visible on every social network: synthetic profile photographs are now a staple of fake accounts, influence operations and romance scams. Conditioning the generator A plain GAN generates random examples. Making it useful for manipulation requires control: the ability to say what the output should depict. Conditional GANs supply that control by feeding the generator, along with its random input, some additional information that the output must respect. In the image-to-image translation work of Phillip Isola and colleagues in 2017, known as pix2pix, the condition was an entire image, such as a sketch or a map, and the generator learned to translate it into a photograph or satellite view. CycleGAN, published later that year by Jun-Yan Zhu and colleagues, removed the need for paired training examples by requiring that a translation from one domain to another and back again should return the original, a constraint that let it learn, for example, to turn horses into zebras from unpaired photographs of each. These ideas fed directly into face manipulation. Face reenactment systems condition a generator on facial landmarks or motion information extracted from a driving video, so that the output shows the target identity performing the driver's movements. Some, such as the First Order Motion Model published by Aliaksandr Siarohin and colleagues in 2019, could animate a face from a single still photograph by learning, from many videos, how faces move in general, and then applying the motion of one face to the appearance of another. Lip-sync systems condition the generator on audio, learning which mouth shapes correspond to which sounds; a model called Wav2Lip, published by K. R. Prajwal and colleagues in 2020, used a separately trained "lip-sync expert" network as a kind of discriminator, judging whether mouth movements matched the speech. Identity as a number A further idea removed the original face swap's greatest practical constraint, the need to train a dedicated model on hundreds of images of both people. It came from an unexpected direction: face recognition. Modern face recognition systems, such as Google's FaceNet, published in 2015, work by training a network to map any photograph of a face to a short list of numbers, an embedding, such that photographs of the same person land close together and photographs of different people land far apart, regardless of pose, lighting or expression. The embedding is, in effect, a numerical summary of identity with everything else stripped away. That is exactly the separation the original face swap had tried to achieve indirectly through its shared encoder, where pose and expression were meant to pass through while identity was left to the decoders. Researchers soon realised that a pretrained recognition network could supply the identity directly. In systems such as FaceShifter and SimSwap, both published in 2020, a generator receives two inputs: the target frame, which supplies pose, expression, lighting and background, and an identity embedding computed from a single photograph of the source person. The generator is trained, across many thousands of different people, to produce a face that the recognition network judges to have the source identity while preserving everything else about the target frame. Because it has learned the general task of transplanting identity rather than the particular task of turning one named person into another, it can perform swaps between people it has never seen, from one image each. This shift from person-specific to general models is the single most important reason why deepfakes moved from celebrities, whose images were abundant, to ordinary people, whose images are not. It has an interesting forensic counterpart. If a recognition network can be used to impose an identity, it can also be used to check one. Detection methods such as ID-Reveal, proposed by Davide Cozzolino and colleagues in 2021, learn how a particular person's face moves over time and test whether a video's facial dynamics are consistent with the identity it claims to show. A face swap may fool a recognition network frame by frame while failing to reproduce the way that person actually talks, because the motion comes from someone else. Data, consent and the training set One more feature of these systems deserves attention because it bears on governance. Every generative model is a compression of its training data. StyleGAN's faces were learned from the Flickr-Faces-HQ dataset, some seventy thousand photographs of real people collected from the photo-sharing site Flickr under permissive licences, almost certainly without most of the people depicted being aware of it. Face recognition models used in later face-swapping systems were trained on datasets assembled by scraping millions of images of celebrities and ordinary people from the web. Several such datasets, including Microsoft's MS-Celeb-1M and Duke University's DukeMTMC, were withdrawn in 2019 after journalists and researchers questioned how they had been assembled, but copies continued to circulate. The point is not merely historical. The capabilities that make deepfakes possible were built from the unconsented faces of millions of people, and the question of whether individuals have any claim over the use of their likeness in training data, separate from its use in a specific forgery, has become a live legal and political issue, discussed in Chapter 8. For now it is enough to note that the line between the technology and its abuse begins further upstream than is usually recognised. The lesson for defenders The lip-sync expert in Wav2Lip, like the recognition network in identity-based swapping, illustrates a general principle. Wherever a manipulation system needs to get something right, its designers tend to train a specialised network to judge that quality and then use it to teach the generator. Every such judge is, in effect, a detector that the forger has already built and already defeated. Forensic researchers have learned to look instead for properties the generator was never told to care about: the physics of light in the scene, the consistency of identity across a long video, the subtle colour changes of skin as blood pulses beneath it, the alignment between a mouth's shape and the precise phoneme being spoken. Chapter 4 explains how those properties are measured. First, Chapter 3 follows the technology past the GAN era, into the architectures that made synthetic media cheap, general and fast. Chapter 3: After the GAN: Diffusion, Voice and Real-Time Synthesis Until about 2021, producing a convincing deepfake still required effort. Face-swapping autoencoders needed hours of training on hundreds of images of each person. GANs produced superb faces but were narrow: a StyleGAN trained on faces generated faces and nothing else, and steering it to depict a specific real person doing a specific thing was difficult. The forgeries that circulated were mostly short clips of famous people, for whom training data was plentiful. Three developments between 2020 and 2025 removed most of those constraints. Diffusion models made it possible to generate almost any image, and then any video, from a text description. Neural speech synthesis made it possible to clone a voice from seconds of audio. And improvements in efficiency made both kinds of synthesis fast enough to run live, during a phone or video call. Together they turned the deepfake from a specialist product into a general capability. Learning to remove noise Diffusion models start from an idea that seems, at first, perverse. Take a training image and gradually add random noise to it, a little at a time, over hundreds of steps, until nothing remains but static. That destruction process is easy and requires no learning. Now train a neural network to perform a single step of the reverse: given a slightly noisy image, predict the noise that was added, so that it can be subtracted. If the network can undo one small step of corruption, then by chaining those steps it can start from pure static and gradually sculpt an image out of it. The approach was introduced by Jascha Sohl-Dickstein and colleagues in 2015, drawing on ideas from thermodynamics, and made practical by Jonathan Ho, Ajay Jain and Pieter Abbeel in 2020 under the name denoising diffusion probabilistic models. It turned out to have decisive advantages over GANs. There is no adversarial game, so training is stable. The network learns to model the full variety of its training data rather than collapsing onto a few convincing outputs. And the step-by-step process offers natural points at which to steer the result. Steering is where text comes in. In 2021 OpenAI released CLIP, a model trained on hundreds of millions of image-caption pairs to place images and descriptions of them close together in a shared representation. A diffusion model can be conditioned on such a text representation, so that at every denoising step it is nudged towards an image matching the description. A further efficiency gain came from latent diffusion, published by Robin Rombach and colleagues in 2022, which runs the diffusion process not on pixels but in the compressed latent space of an autoencoder, the same kind of compression described in Chapter 2. That made generation cheap enough to run on consumer hardware. When Stability AI released Stable Diffusion, built on that approach, with openly downloadable weights in August 2022, high-quality text-to-image generation became available to anyone with a gaming computer, beyond the reach of any company's content policy. The consequences arrived quickly. In March 2023 an image of Pope Francis in a white puffer jacket, made with the commercial generator Midjourney, circulated widely and was believed by many who saw it. In the same month the investigative journalist Eliot Higgins, founder of Bellingcat, posted Midjourney images depicting Donald Trump being arrested, explicitly labelled as fabrications; stripped of their labels, they spread as real. In May 2023 an image purporting to show an explosion near the Pentagon spread on social media from accounts bearing paid verification badges and was followed by a brief dip in American stock markets before officials confirmed nothing had happened. None of these images was technically perfect. Each would have failed close inspection. Each was nonetheless good enough for the speed and scale at which people consume images online. Personalisation and editing A general text-to-image model knows what famous people look like if their images were abundant in the training data, but it does not know what an ordinary private individual looks like. Research published in 2022 showed how to close that gap. Techniques such as DreamBooth, from Nataniel Ruiz and colleagues at Google, and the low-rank adaptation method known as LoRA, originally developed for language models, allow a large pretrained generator to be fine-tuned on a small number of images of a particular subject, after which it can depict that subject in any scene the user describes. The original purpose was benign: putting a pet or a product into new settings. But the same method applies to people. This is the technical root of the most widespread contemporary harm of synthetic media, discussed in Chapter 8: the production of sexual imagery of real people, including children, from a handful of ordinary photographs taken from social media. The ecosystem around open-weight models amplified this. Because Stable Diffusion and its successors could be downloaded and modified, a community grew up that shared fine-tuned add-on models, many of them small LoRA files designed to reproduce a particular style, character or person. The largest marketplace for such files, Civitai, hosted thousands of models trained to reproduce the likenesses of specific real people, from film stars to minor social media personalities. Reporting by the technology outlet 404 Media documented how these were combined with sexually explicit models to generate non-consensual imagery. In May 2025 Civitai banned models designed to reproduce real people's likenesses, citing pressure from payment processors and new legislation in the United States and Europe. The models did not disappear; they migrated to other sites. But the episode showed where leverage lies in an open ecosystem: not over the code, which cannot be recalled once released, but over the commercial infrastructure, such as payments, hosting and app distribution, through which it is monetised and spread. Diffusion models also excel at editing. Inpainting, in which the user masks part of an image and the model fills it in consistently with the rest, makes it straightforward to change what a person is holding, wearing or doing in an authentic photograph while leaving everything else untouched. From a forensic point of view this is significant. A fully synthetic image is entirely the product of a generator and may carry its fingerprint throughout. An inpainted photograph is mostly authentic, with a small synthetic region embedded in it, and the authentic majority can mask the evidence of the manipulated minority. From images to video Video is far harder than still images because the frames must be consistent with one another: a face must keep its identity, objects must persist, motion must obey something like physics. Early text-to-video systems produced short, flickering clips. The step change came in February 2024, when OpenAI previewed Sora, which generated clips of up to a minute with considerable coherence by treating video as a sequence of compressed spacetime patches and applying a transformer-based diffusion model to them. Google's Veo models followed; Veo 3, released in May 2025, generated synchronised sound and speech along with the picture, removing the need to assemble a forgery from separate visual and audio components. OpenAI's Sora 2, released at the end of September 2025 with a consumer app, added a feature allowing users to insert a verified likeness of themselves, and of consenting friends, into generated scenes. Within days the app's feed was full of realistic clips of public figures and copyrighted characters, and OpenAI tightened its rules on the depiction of deceased historical figures after complaints from their families. The significance of these systems for the deepfake problem is not mainly that they produce better face swaps. It is that they produce whole scenes. A fabricated video of a ballot box being stuffed, a riot outside a polling station, a candidate collapsing at a rally or soldiers committing an atrocity no longer requires any source footage to manipulate. It requires a description. And because commercial video generators embed safeguards, such as refusing to depict named real people or adding visible watermarks, much of the misuse has migrated to open-weight models whose safeguards can be removed, or to workarounds that exploit the gaps between policy and enforcement. Synthetic presenters A quieter but commercially enormous branch of the technology produces talking avatars: synthetic presenters who read any script in any of dozens of languages, with matching lip movements. Companies such as Synthesia, founded in London in 2017, and HeyGen sell these services to businesses for training videos, marketing and internal communications, usually using either stock avatars modelled on paid actors who consented to the use of their likeness or a customer's own consenting staff. The output is not intended to deceive anyone about who is speaking, and for most customers it does not. The same products have nonetheless shown up in influence operations. In February 2023 the research firm Graphika reported that a pro-Chinese network it had been tracking, known as Spamouflage, had distributed videos from a fictitious outlet called Wolf News in which two apparently human presenters delivered news segments favourable to Beijing. The presenters were stock avatars from Synthesia's catalogue. Around the same time, videos from a supposedly international English-language channel, some of them shown on Venezuelan state television, presented upbeat reports on the country's economy; their presenters were likewise synthetic avatars. In both cases the videos were stilted and attracted little genuine engagement, and Synthesia banned the accounts involved. Their significance lay elsewhere: they showed state-linked actors experimenting with synthetic media as a low-cost way to manufacture the appearance of independent journalism, and they showed that the misuse of consensual, commercially licensed avatars is a different problem from the forgery of real people, requiring different safeguards, such as vetting customers and restricting political content. Cloning the voice Synthetic speech has a longer history than synthetic video, but for decades it sounded unmistakably mechanical. Neural methods changed that. DeepMind's WaveNet, published in 2016, generated audio one sample at a time with a neural network and produced speech far more natural than earlier systems. Google's Tacotron models, from 2017, learned to map text directly to the acoustic features of speech. These systems needed many hours of recordings of a single speaker to produce that speaker's voice. The decisive change was the move to zero-shot or few-shot cloning, in which a model trained on tens of thousands of hours of many speakers learns a general representation of how voices differ, and can then imitate a new voice from a short reference sample. In January 2023 Microsoft researchers described VALL-E, a model that treated speech as a sequence of discrete tokens produced by a neural audio codec and generated those tokens with a language model, conditioned on a three-second sample of the target speaker. They did not release it, citing the risk of misuse. In the same month, the startup ElevenLabs opened a public beta of its voice synthesis service, and within days users on the 4chan message board had used it to produce clips of celebrities appearing to make racist and violent statements. The company responded by restricting voice cloning to paid, identity-linked accounts and releasing a classifier for its own outputs. In March 2024 OpenAI described a model it called Voice Engine, which could clone a voice from a fifteen-second sample, and announced that it was withholding broad release because of the risks. Alongside text-to-speech, voice conversion systems take a recording of one person speaking and transform it so that it sounds like another, preserving the original's timing, emphasis and emotion. Open-source voice conversion tools became popular in 2023 for producing "AI covers" of songs in the voices of famous singers, and the same tools are used to impersonate people in real time. Audio forgery deserves particular attention because it is, in practical terms, the most dangerous modality. It is cheap: a short sample of almost anyone's voice can be found in a voicemail greeting, a social media video or a recorded public meeting. It is hard for listeners to judge: people are poor at recognising cloned voices, especially over phone lines that compress audio and remove the high frequencies where artifacts often appear. And it reaches people through channels that have no verification at all. The Slovak election clips and the New Hampshire robocall were both audio. So are most of the "family emergency" scams in which a caller imitating a relative pleads for money. Forgery in real time The last barrier was time. Most of the systems described so far produce output after the fact, which means a forged recording can, at least in principle, be inspected before anyone acts on it. Real-time synthesis removes that window. Open-source tools appeared in 2021 and 2022 that could swap a face in a live webcam feed with a delay of a fraction of a second, feeding the result into ordinary videoconferencing software as if it came from a camera. Real-time voice conversion followed the same path. The first public warnings came from law enforcement. In June 2022 the American FBI's Internet Crime Complaint Center reported complaints about people using deepfaked video and stolen identities to apply for remote technology jobs, noting that the lip movements of interviewees sometimes failed to match their speech. American authorities have since described schemes in which workers acting for North Korea used stolen identities and, in some cases, real-time face alteration to obtain remote employment at Western companies, sending their wages back to the regime. The most expensive known case, the 2024 videoconference fraud against the engineering firm Arup in Hong Kong, is examined in Chapter 8. Real-time systems are usually less polished than offline ones. They struggle with extreme head turns, with hands passing in front of the face, with glasses and with abrupt lighting changes. Those limits are the basis of some simple and effective defences, discussed in Chapter 9. But they are limits of current engineering, not of principle, and they narrow with each generation. The families compared The generations of synthetic media technology differ in what they need as input, what they produce, and what kinds of evidence they leave behind, and Table 1 sets these differences side by side. The point to draw from it is that no single forensic method addresses all of them. A detector built around the blending boundary of a face swap has nothing to look for in a fully generated scene; a detector tuned to GAN fingerprints may miss diffusion outputs; a visual detector is useless against a phone call. Table 1. Main families of synthetic media technology. Family Typical output Input needed Characteristic traces Autoencoder face swap Face replaced in existing video Many images of both faces; source video Blending seam; resolution mismatch; pose limits GAN synthesis Still faces or objects Large training set of one domain Spectral fingerprints; symmetry and background errors Conditional reenactment and lip-sync Target moved or speaking new words One or few images; driving video or audio Mouth-region inconsistency; phoneme mismatch Diffusion text-to-image and video Whole images or scenes Text prompt; optional reference images Physics and lighting errors; decoder fingerprints Neural voice cloning Speech in a target voice Seconds to minutes of target audio Missing breath and room acoustics; codec artifacts These categories increasingly blur. Modern systems combine a diffusion backbone with face-specific conditioning, generate audio and video together, and pass their output through post-processing designed to look like an ordinary phone recording. The forensic task, which the next chapter takes up, has therefore become less about recognising a particular tool and more about recognising the ways in which any synthetic process departs from the physics, biology and statistics of genuine capture. Chapter 4: Reading the Seams: How Forensic Detection Works A forger and a forensic analyst look at the same image with different questions. The forger asks whether it looks right. The analyst asks whether it could have been produced the way it claims to have been produced: by light from a particular scene, passing through a particular lens, landing on a particular sensor, processed by a particular camera and compressed by a particular platform. Every genuine recording is the end of a long physical and computational chain, and every link in the chain leaves traces. A synthetic image is produced by a different chain, and the art of detection lies in finding where the traces of that different origin show through. Forensic methods for synthetic media fall broadly into two families. Passive methods examine the content itself and look for evidence of manipulation, with no help from whoever created it. Active methods, discussed in Chapter 6, rely on information deliberately embedded at the moment of creation, such as watermarks or signed metadata. This chapter is about the passive family, which is what people usually mean when they speak of deepfake detection. Signals, physics and biology The most fundamental passive methods look at the signal: the raw statistics of pixels and audio samples. Real cameras leave characteristic patterns. Their sensors have tiny manufacturing imperfections that produce a faint, consistent noise pattern unique to each device, known as photo-response non-uniformity, which forensic examiners have used for years to link photographs to particular cameras. Colour images from most cameras are produced by interpolating between neighbouring sensor elements that each record only one colour, and that interpolation leaves regular correlations between adjacent pixels. Compression into formats such as JPEG imposes its own block-based structure. A region pasted in from elsewhere, or generated by a neural network, tends to lack these patterns or to carry them inconsistently with the rest of the image. Generative networks also leave patterns of their own. A generator builds a full-resolution image from a small internal representation by repeatedly enlarging it, a step called upsampling. Several research groups, including Joel Frank and colleagues at Ruhr University Bochum in 2020, showed that upsampling leaves periodic artifacts that are nearly invisible in the image itself but stand out sharply when the image is transformed into the frequency domain, which describes an image in terms of the repeating patterns it contains rather than its individual pixels. In the frequency spectrum of many GAN images, regular grid-like peaks appear that genuine photographs do not have. Francesco Marra and colleagues at the University of Naples asked in a 2019 paper whether GANs leave artificial fingerprints, and found that they do: each trained network leaves a faint, consistent residual pattern, so that images can sometimes be attributed not only to "a GAN" but to a specific model. A second level of analysis is physical. Real scenes obey optics. Light comes from identifiable sources, shadows fall consistently, reflections in shiny surfaces correspond to what is around them, and the perspective of parallel lines converges to consistent vanishing points. Generative models learn what scenes look like, not why they look that way, and they often get the physics subtly wrong. Hany Farid and his students developed methods to estimate the direction of lighting on different objects in a photograph and to test whether shadows all point back to a single light source. Researchers at the University at Buffalo, led by Siwei Lyu, showed in 2021 that the small specular highlights in a person's two corneas, which in a genuine photograph reflect the same light sources and should therefore match in shape and position, frequently disagree in GAN-generated faces. Diffusion-generated scenes commonly contain shadows that point in incompatible directions, reflections that do not correspond to the objects reflected, and text that dissolves into illegible shapes on signs and documents. A third level is biological. Genuine people do things that generators were never trained to reproduce because those things are barely visible. In 2018 Lyu's group published one of the first deepfake detection papers, observing that synthetic faces of that era blinked far less often than real people, for the reason described in Chapter 2: the training photographs rarely showed closed eyes. More durably, a beating heart pumps blood that changes the colour of the skin very slightly with each pulse. This signal, invisible to the naked eye, can be recovered from ordinary video by a technique called remote photoplethysmography, and it is consistent across different parts of a real face. Umur Aybars Çiftçi, İlke Demir and Lijun Yin showed in 2020 that synthetic faces lack coherent pulse signals, and Intel commercialised a detector based on the idea under the name FakeCatcher. Head pose offers another check: the orientation of the head estimated from the central face, which a face swap replaces, should agree with the orientation estimated from the outline, which it does not. Behaviour, speech and identity A fourth level concerns behaviour. Every person has habits of movement that accompany their speech: the way their head tilts when they emphasise a point, the way their eyebrows rise, the timing of their nods. Shruti Agarwal, Hany Farid and colleagues argued in a 2019 paper titled "Protecting World Leaders Against Deep Fakes" that these patterns form a kind of soft biometric. By training a model on many hours of authentic footage of a particular public figure, it becomes possible to ask whether a new clip shows that person's characteristic correlations between facial movement and speech. A face swap, which transplants one person's identity onto another person's performance, carries the wrong person's mannerisms. The method is not general, since it requires a large archive of authentic footage of the individual, but for heads of state and prominent candidates, the people most worth forging, such archives exist. The same group showed in 2020 that lip-sync forgeries can be caught by examining specific sounds. When a person says a word containing "m", "b" or "p", the lips must close completely. Synthesis systems that generate mouth shapes from audio often fail to close the mouth fully for those sounds, producing a mismatch between what is heard and what is seen. More generally, audio-visual detectors trained on genuine speech learn the tight synchrony between lip motion and sound and flag clips where that synchrony is subtly off. Audio forgery has its own forensic tradition, developed largely in the context of speaker verification, where banks and call centres need to know whether a voice on the phone belongs to the account holder. A series of international challenges known as ASVspoof, running since 2015, has assembled datasets of genuine and synthetic speech and benchmarked detection methods against them. Synthetic speech often lacks the irregularities of natural voices: the small catches of breath, the noise of lips and tongue, the reverberation of a real room, the unevenness of energy across frequencies. Vocoders, the components that turn a model's internal representation into audible waveforms, leave characteristic traces in parts of the spectrum that listeners cannot hear. As with images, detectors trained on these traces perform well on the kinds of synthesis they were trained on and less well on new ones. Learning to detect Each of the methods above is hand-designed: a researcher identifies a specific property and builds a test for it. Since 2018 most detection research has instead used the same tools as the generators, training deep neural networks on large collections of real and fake media and letting them discover whatever distinguishes the two. The field depends on benchmark datasets. FaceForensics++, published in 2019 by Andreas Rössler and colleagues at the Technical University of Munich, took a thousand YouTube videos and manipulated each with four different methods, two based on learning and two on traditional computer graphics, yielding a standard testbed at several compression levels. Celeb-DF, released in 2020 by Lyu's group, offered higher-quality face swaps of celebrities with fewer visible artifacts. In 2019 and 2020 Facebook, together with Microsoft, Amazon, the Partnership on AI and a group of universities, ran the Deepfake Detection Challenge, building a dataset of more than 100,000 clips featuring thousands of paid actors who had consented to the use of their likenesses, and inviting the world's machine learning community to compete. Learned detectors developed several clever ideas. Face X-ray, from Lingzhi Li and colleagues at Microsoft Research in 2020, sidestepped the problem of chasing particular generators by focusing on the one step common to nearly all face swaps: blending a new face into an existing image. It trained a network to locate blending boundaries using only real images that had been artificially blended with one another, so that it learned the general signature of compositing rather than the fingerprint of any one forgery tool. Sheng-Yu Wang and colleagues at Berkeley and Adobe reported in 2020 that a classifier trained on images from a single GAN could detect images from many others, provided the training used heavy augmentation such as blurring and compression, though they titled their paper "CNN-generated images are surprisingly easy to spot... for now", and the qualification has proved prescient. In 2023 Utkarsh Ojha and colleagues proposed building detectors on top of the general-purpose image representations learned by large models such as CLIP, which generalised better to unseen generators than networks trained from scratch. Riccardo Corvi and colleagues showed the same year that detectors trained on GAN images often failed on diffusion images and vice versa, and that each architecture family left distinctive spectral traces of its own. The various approaches differ in what they look for and in the conditions under which they fail, as Table 2 summarises. In practice the strongest systems combine several, because a forgery that evades one kind of check may still trip another. Table 2. Principal approaches to passive deepfake detection. Approach What it examines Main strength Main weakness Signal and frequency analysis Sensor noise; upsampling and compression traces Works without semantic understanding Fragile under recompression and resizing Physical consistency Lighting, shadows, reflections, perspective Hard for generators to learn Needs suitable scene content; slow Physiological signals Blinking, pulse, head pose Grounded in biology Needs good video quality; can be imitated Behavioural and identity models Personal mannerisms; lip-phoneme sync Strong for well-documented people Needs archive of authentic footage Learned classifiers Whatever distinguishes training sets Fast; scalable; high benchmark accuracy Poor generalisation to new generators Detecting whole scenes Most of the methods described so far were developed for manipulated faces, which dominated the first generation of deepfakes. Fully synthetic scenes produced by diffusion models pose a different challenge. There is no blending boundary to find, no swapped identity to check, often no face at all. Detection here relies on two broad strategies. The first exploits the way diffusion models construct images. Because they typically operate in the compressed latent space of an autoencoder, their outputs pass through that autoencoder's decoder on the way to becoming pixels, and decoders, like the upsampling layers of GANs, leave characteristic statistical traces. A related idea, proposed in 2023 by Zhendong Wang and colleagues under the name DIRE, observes that an image produced by a diffusion model can be reconstructed by running it backwards and forwards through a similar model with much smaller error than a genuine photograph can. A real photograph contains detail that lies, in a sense, outside the model's vocabulary; a generated image does not. The size of the reconstruction error therefore becomes a clue to origin. Such methods work well when the detector has access to a model similar to the one that produced the image, and less well otherwise, which once again ties their reliability to knowledge of the generator. The second strategy returns to the physical and semantic checks described earlier, applied to the whole scene rather than to a face. Does the geometry of the room hold together? Do reflections in windows correspond to what is in front of them? Is the text on signs legible and consistent? Do the shadows of different objects agree on where the sun is? Are the number of fingers, the structure of ears, the pattern of a brick wall and the fall of fabric plausible? Diffusion models have improved dramatically on many of these points since 2022, but physical consistency across a whole scene, and especially across the frames of a video, remains harder for them than surface realism. Studies of early text-to-video systems documented objects that appeared and disappeared, people who merged with one another, and liquids that flowed in impossible ways. Each generation reduces such errors without eliminating them, and the residue is where analysts look. Forensics in the courtroom Detection methods eventually face their most demanding audience in court, where the question is not only whether a method is accurate but whether its conclusion can be explained, tested and challenged. A neural network detector that outputs a probability with no account of why is difficult to present as expert evidence, and opposing counsel can reasonably ask how it performs on material like the item in dispute, which may differ from anything in its training data. Methods grounded in physics or biology, such as inconsistent lighting or the absence of a pulse signal, are easier to explain to a judge or jury, which is one reason forensic experts continue to favour them even where learned classifiers score better on benchmarks. Legal systems have begun to adjust. In the United States, the advisory committee responsible for the Federal Rules of Evidence spent 2024 and 2025 considering whether existing rules on authenticating evidence were adequate for an era of convincing fakes. It published for public comment in 2025 a proposed rule subjecting machine-generated evidence to reliability standards similar to those applied to expert testimony, and it studied a separate draft that would have shifted a heavier burden of proving authenticity onto the party offering evidence once a credible claim of fabrication was raised. In May 2026 it declined to advance either proposal for the time being, judging that courts could still manage such disputes under existing procedures while the questions were studied further. The debate captures the double-edged problem that runs through this book. Courts must guard against fabricated evidence being admitted, but they must equally guard against genuine evidence being excluded or discounted merely because a party asserts, without proof, that it might be fake. Detection in practice Outside the laboratory, detection is rarely a matter of running a clip through a single classifier and reading off a verdict. Professional verification, as practised by newsroom teams, fact-checking organisations and open-source investigators, is a layered process in which technical forensics is only one input. Investigators begin with context. Where did the item first appear, and who posted it? Does an earlier version exist, perhaps in higher resolution or without a misleading caption, that a reverse image search can find? Can the location be confirmed by matching buildings, terrain and signage against satellite imagery, and the time by shadows or weather records? Do the people shown appear elsewhere at that moment? Does the claimed source exist, and does it confirm or deny? Tools such as the InVID-WeVerify browser plugin, developed with European Union funding, package keyframe extraction, reverse search and metadata inspection into a workflow that journalists can learn in an afternoon. Many deepfakes are exposed this way, without any machine-learning detector at all: the Zelensky surrender video was refuted within hours by Zelensky himself, and the Pentagon explosion image by the simple fact that nobody in Arlington had seen or heard an explosion. Technical detection then serves as corroboration. Several commercial services offer detection to newsrooms, governments and platforms, and their outputs are typically probability scores accompanied by heat maps showing which regions of a frame drove the decision. Experienced analysts treat those scores with care. A high fake score on a heavily compressed clip may reflect the compression rather than manipulation; a low score on a novel kind of forgery may reflect only that the detector has never seen its like. The most reliable conclusions come when independent lines of evidence, contextual, physical and statistical, point the same way. This layered practice works well for a small number of high-profile items examined carefully by experts. It does not scale to the volume of material passing through social platforms every minute, and it depends on detectors whose accuracy, measured in the laboratory, looks very different once they meet the open world. The reasons for that gap, and why closing it is harder than it looks, are the subject of the next chapter. Chapter 5: Why Detection Alone Cannot Win In June 2020 Facebook announced the results of the Deepfake Detection Challenge. More than two thousand participants had submitted models. The winner, a machine learning engineer named Selim Seferbekov, achieved an accuracy of about 82 per cent on the public test set that competitors had been able to evaluate against during the contest. On a separate black-box test set, composed of videos the competitors had never seen and including clips designed to resemble material found in the wild, the same model's accuracy fell to about 65 per cent. No entry did better. Facebook's own summary was candid in acknowledging that deepfake detection remained an unsolved problem. That result is often recalled as evidence of how hard detection is. It deserves to be read more precisely, because the gap between the two numbers, rather than either number alone, is the story. A model that had learned to perform superbly on one distribution of forgeries lost much of its ability when the distribution shifted. Every subsequent year of research has confirmed that pattern, and the reasons for it go to the structure of the problem rather than the skill of the researchers. This chapter sets out five of them. The generalisation gap The first reason is that detectors learn the forgeries they are shown, not forgery in general. A neural network trained to distinguish real faces from those made by a particular set of manipulation methods will exploit whatever reliable differences exist in its training data. Some of those differences may reflect deep properties of synthesis. Many reflect accidents of a particular tool: its resolution, its blending mask, its colour handling, the frequency signature of its upsampling layers. When a new generator appears that does not share those accidents, the detector's cues disappear. The pattern holds across every modality. Detectors trained on GAN images falter on diffusion images, and vice versa, as Corvi and colleagues showed in 2023. Audio detectors that perform well on the ASVspoof benchmarks degrade on speech from newer synthesis systems. Each new family of generators resets part of the board. The most telling recent evidence comes from Deepfake-Eval-2024, a benchmark assembled by researchers associated with the nonprofit TrueMedia.org and published in 2025. Instead of generating forgeries in the laboratory, they collected material that had actually circulated in 2024 and that users of TrueMedia's detection service had submitted for checking: some 45 hours of video, 56.5 hours of audio and nearly two thousand images, gathered from 88 websites and in 52 languages. When established open-source detectors were tested on this real-world material, their performance, measured by the standard area-under-the-curve metric, fell by about half compared with the academic benchmarks on which they had been developed: 50 per cent for video, 48 per cent for audio and 45 per cent for images. Commercial detectors and models fine-tuned on the new data did better, but the authors reported that none of the automated systems matched trained human forensic analysts. The laboratory had been measuring something other than the problem. Laundering The second reason is that the ordinary life of media online destroys evidence. A video posted to a social network is typically re-encoded, resized and compressed, sometimes several times as it is downloaded and re-uploaded across platforms. Each step discards fine detail, and fine detail is precisely where many forensic traces live. The frequency fingerprints of an upsampling layer, the subtle sensor noise of a genuine camera, the faint colour pulse of blood in the skin: all are attenuated or obliterated by aggressive compression. A detector that works on pristine files may be guessing on a clip that has passed through three messaging apps. Forgers need not even rely on accident. Simple post-processing, such as adding a little noise, blurring slightly, changing the colour balance, or cropping, can disrupt detectors that have not been trained to withstand it. The crudest and most effective laundering technique of all is to display a forgery on one screen and film it with a phone, or to play forged audio through a speaker and record it over a phone line. This re-capture, sometimes called the analogue hole, replaces the digital traces of synthesis with the genuine traces of a real camera and microphone recording a real, if artificial, scene. What remains for the detector is only the content itself, and whatever physical or behavioural implausibility it contains. Laundering also shapes the evidence on which defenders train. Datasets assembled from clean, high-resolution forgeries teach detectors cues that will not exist in the field. Datasets built from field material are messier and harder to label. The Deepfake-Eval-2024 results are partly a measurement of this gap. The adversary in the loop The third reason is that detection faces an adversary who adapts, and who in many cases has a detector built into the training process already. Chapter 2 explained that a GAN's discriminator is itself a forgery detector. A published detector can be added to a generator's training objective as an extra judge, and the generator will learn to satisfy it. Even without retraining a generator, detectors based on neural networks are vulnerable to adversarial examples: tiny, carefully computed perturbations that leave an image visually unchanged but flip a classifier's decision. Nicholas Carlini and Hany Farid demonstrated the scale of the problem in 2020. They took a detector that achieved an area-under-the-curve score of 0.95, very strong performance, across images from many generators. When they had full knowledge of the detector, flipping the lowest bit of each pixel, a change no human could see, reduced that score to 0.0005. Perturbing just 1 per cent of the image reduced it to 0.08. Even without access to the detector's internals, a black-box attack brought it down to 0.22. A score of 0.5 is chance; scores below it mean the detector was not merely confused but systematically wrong. This creates an uncomfortable dilemma for defenders. Publishing a detector, or offering it as a public service, helps journalists and citizens, but it also gives forgers a target to test against. Keeping detectors secret preserves their value for longer but limits who can use them and prevents independent scrutiny of their accuracy. Several detection providers now restrict access to vetted users for exactly this reason. The dilemma has no clean solution; it is a permanent feature of a field in which the thing being detected is produced by an intelligent opponent. The arithmetic of rare events The fourth reason is statistical, and it applies even if every technical problem above were solved. Consider a platform that receives a million uploads of video in some period, of which one in ten thousand, a hundred videos, are harmful deepfakes. Suppose it deploys a detector that is 99 per cent accurate in both directions: it correctly flags 99 per cent of fakes and correctly passes 99 per cent of genuine videos. That would be an exceptional detector, far better than anything demonstrated in the wild. It would catch 99 of the 100 fakes. It would also wrongly flag 1 per cent of the 999,900 genuine videos, which is 9,999 of them. Of the roughly 10,098 videos flagged, fewer than one in a hundred would be a deepfake. Human reviewers checking the flags would spend nearly all their time clearing genuine videos, and any automatic action taken on the flags, such as removal or a warning label, would fall overwhelmingly on innocent material. At the scale of a large platform, where uploads number in the hundreds of millions daily, the absolute numbers become unmanageable. This is the base-rate problem familiar from medical screening, and it means that detection is most useful not as a universal filter but as a tool applied to items already suspected for other reasons: a clip that is spreading fast, that concerns an election or an emergency, that has been reported by users, or whose source is dubious. That is a valuable role. It is not the role public debate often imagines, of a machine that sorts all media into real and fake. When the detector is wrong The arithmetic above assumes a careful operator who understands the limits of the tool. In practice, detectors are often used by people who do not, and their errors can do as much damage as the forgeries they are meant to catch. A painful illustration came in October 2023, in the first days of the war between Israel and Hamas. Israel's government shared a photograph of what it said was the charred body of an infant killed in the Hamas attack of 7 October. Social media users ran the image through a free online AI-image detector, which labelled it as AI-generated, and the verdict spread widely as proof that Israel was fabricating atrocities. Forensic experts, including Hany Farid, examined the image and found no evidence of synthesis; the shadows and structural details were consistent with a genuine photograph, and the detector's verdict appeared to be a false positive, possibly triggered by compression or editing. By then the claim of fabrication had reached millions of people, and the damage to trust in a genuine record of atrocity could not easily be undone. In the same conflict, genuine images of suffering in Gaza were also dismissed by partisans as fakes. The detector had become an instrument of the liar's dividend. A related cautionary tale comes from the detection of AI-generated text. In January 2023 OpenAI released a classifier intended to distinguish text written by its models from human writing. It correctly identified only about a quarter of AI-written text and wrongly flagged some human writing, and in July 2023 the company withdrew it, citing its low rate of accuracy. Commercial text detectors used by schools and universities have since been widely criticised for false accusations, including research suggesting that they disproportionately flag writing by non-native speakers of English. Detectors of images, audio and video face the same structural problems, and the same risk that a confident-looking number on a screen will be taken as a verdict. Commercial claims deserve scrutiny for the same reason. Detection vendors often advertise accuracy figures above 95 or even 99 per cent. Such figures are usually measured on test sets drawn from the same distribution as the vendor's training data, and the Deepfake-Eval-2024 results show how much performance can fall on material from the wild. A responsible buyer asks on what data the figure was measured, how recently, against which generators, at what compression levels, and with what false positive rate. A responsible user reports a detector's output as one piece of evidence, with its uncertainty, rather than as a finding. Humans are not a backstop The fifth reason is that the obvious fallback, human judgement, is weak and getting weaker. The study by Nightingale and Farid described in Chapter 2 found people at chance on synthetic faces. Nils Köbis, Barbora Doležalová and Ivan Soraperra reported in 2021 that participants shown a mix of real and deepfake videos could not reliably tell them apart, were overconfident in their judgements, and leaned towards accepting videos as authentic; financial incentives to be accurate did not help. For speech, Kimberly Mai and colleagues at University College London found in 2023 that listeners identified synthetic speech correctly only about 73 per cent of the time, in English and Mandarin alike, and that training improved this only slightly. There are some encouraging findings. Matthew Groh and colleagues at MIT reported in 2022 that ordinary people viewing videos from the Deepfake Detection Challenge performed, as a crowd, about as well as the leading model, and that they were good at catching particular kinds of forgery, such as those involving political figures, where they could draw on knowledge of how the person usually behaves. Combining human and machine judgements improved accuracy, though people also sometimes deferred to a machine that was wrong. Context and prior knowledge, it seems, help people more than visual scrutiny does. But the general trajectory is clear. Each generation of synthesis removes the visual cues that people were taught to look for, from unblinking eyes to mangled hands to garbled text in the background. Media literacy campaigns built around spotting artifacts risk teaching yesterday's tells, and they carry a hidden cost: people taught to distrust media that looks slightly odd may become more suspicious of authentic material, much of which also looks slightly odd, because real recordings are often blurry, badly lit and compressed. What detection is for None of this means detection is futile. It means its role must be understood correctly. Detection works best when it is applied selectively, to high-stakes items, by trained analysts who combine several methods with contextual investigation. In that setting, as the Deepfake-Eval-2024 authors found, human forensic experts with good tools can still outperform any single automated system. Detection also plays an essential role in attribution: identifying which tool or model produced a forgery can lead investigators to its source and support legal action. It matters in courtrooms, where expert testimony about manipulation, or its absence, can decide cases. And it serves a purpose that is easy to overlook: confirming that authentic material is authentic. When a politician claims that a damaging genuine recording is a deepfake, forensic analysis showing no sign of manipulation is one of the few tools available for calling the bluff. The deeper problem is that detection is asymmetric in a way that always favours the forger. The forger needs one forgery to get through once, at the right moment; the defender must catch every forgery that matters, every time. The forger chooses the tool, the target, the timing and the laundering; the defender must anticipate all of them. The forger can test against public detectors; the defender cannot test against unreleased generators. And even a successful detection usually comes after a forgery has spread, when correction reaches only a fraction of those who saw the original. That last point deserves emphasis, because it describes a problem that no improvement in detection accuracy can fix. Research on corrections has found that they typically reach far fewer people than the false claims they address, and that the people who see a correction are often not the same people who saw the original. The Slovak audio clips were identified as likely fakes within hours by fact-checkers, but the identification reached mainly those who already followed fact-checkers. A detector that works perfectly but too late shares the fate of every correction: it improves the record without repairing the damage. Detection measured in hours is adequate for a forgery whose harm unfolds over weeks; it is useless against one designed to do its work in the forty-eight hours before a vote, or in the ten minutes of a fraudulent video call. A defensive strategy built entirely on detection therefore resembles a security system that consists only of trying to recognise burglars. It is better to have it than not. But the better systems also lock the doors, and find ways for the legitimate occupants to prove they belong. In the world of synthetic media, the equivalent is provenance: building into media itself the means to prove where it came from. That is the subject of the next chapter. Chapter 6: Proving What Is Real: Provenance and Watermarking The web faced a version of the deepfake problem in the 1990s. Anyone could build a website that looked exactly like a bank's login page, and users had no reliable way of telling the real site from the imitation by looking at it. The solution that emerged was not a better detector of fake websites, although those were built too. It was a system that allowed genuine sites to prove their identity: digital certificates issued by trusted authorities, cryptographic protocols that verified them automatically, and a small padlock in the browser that told users the connection was authentic. The approach did not end phishing. It changed the default, so that a bank's website could carry verifiable evidence of being the bank's website, and a missing padlock became a reason for suspicion. The provenance movement in synthetic media attempts the same move. Instead of asking only whether a piece of content shows signs of manipulation, it asks whether the content can demonstrate where it came from and what has been done to it. Two technical families serve this aim. Signed provenance metadata attaches a verifiable record of origin and history to a file. Watermarking embeds an invisible, machine-readable signal in the content itself, usually to mark it as AI-generated. A third, older technique, fingerprinting, identifies specific known items by their perceptual content. Each has strengths that cover others' weaknesses, and each has limits that must be understood if provenance is not to become a source of false confidence. Content Credentials The leading provenance standard comes from the Coalition for Content Provenance and Authenticity, known as C2PA, formed in February 2021 by Adobe, Arm, the BBC, Intel, Microsoft and the image verification company Truepic. It merged two earlier efforts: Adobe's Content Authenticity Initiative, launched in 2019, and Project Origin, a collaboration among Microsoft, the BBC, CBC/Radio-Canada and The New York Times aimed at authenticating news media. The coalition, which operates under the Linux Foundation's Joint Development Foundation, now includes most of the major technology, camera and media companies, and its specification has gone through several versions; version 2.4 was published in April 2026. The consumer-facing name for the system is Content Credentials, represented by a small "CR" icon. The mechanism is conceptually straightforward. When a piece of content is created, by a camera, an editing application or a generative AI system, the software creates a manifest: a structured record of assertions about the content. Assertions can include what device or software produced it, when, whether generative AI was involved, what edits were made, and, optionally, who the creator is. The manifest is then digitally signed using a certificate, in the same way that websites and software updates are signed, so that anyone can verify that it was issued by the claimed signer and has not been altered since. The manifest is bound to the content by a cryptographic hash, a short digital summary of the file that changes completely if even a single pixel changes. If the content is altered after signing, the hash no longer matches and the credential is shown as invalid. The system is designed to record history, not just origin. When a photographer edits a signed image in compliant software, the editor creates a new manifest that lists the original as an "ingredient" and records what was done, cropping, colour correction or the replacement of a region with AI-generated content. A viewer can then inspect the whole chain, from capture to publication. Generative AI services that adopt the standard label their outputs as AI-generated in the manifest, so that the same mechanism that attests to a genuine photograph can also disclose a synthetic one. Adoption has moved from pilot to infrastructure over the past three years. Leica's M11-P, released in 2023, was the first commercial camera to sign images at capture. Sony and Nikon followed with professional models. Google's Pixel 10 phones, launched in August 2025, began attaching Content Credentials to every photograph taken with the built-in camera app, the first mass-market device to do so by default, and Google's Photos app displays the credentials. Adobe's tools, Microsoft's and OpenAI's image generators, and many others attach manifests to their outputs. LinkedIn, TikTok and YouTube read credentials and display labels, and in May 2026 Google announced that Content Credentials verification would come natively to Search and the Chrome browser. The weak points of provenance Provenance has three structural weaknesses, and honesty about them is essential. The first is that metadata can be stripped. A C2PA manifest typically travels inside the file, and most social platforms, messaging apps and screenshots remove embedded metadata, either deliberately for privacy or incidentally during re-encoding. A forger who wants to pass off an AI-generated image need only strip its manifest. The standard addresses this with what it calls soft binding: the manifest can be stored in an online repository and linked to the content through an invisible watermark or a perceptual fingerprint, so that even if the embedded metadata is lost, the credential can be recovered. This works only where the watermark or fingerprint survives and the repository is reachable. The consequence is that the absence of credentials proves nothing. For the foreseeable future, most authentic media will carry no provenance record, because it was captured on older devices or passed through platforms that strip metadata. Provenance can therefore raise confidence in content that has it but cannot by itself cast doubt on content that lacks it. Its value grows as adoption grows, and the hope of its designers is that in particular high-stakes domains, such as news photography, official government communications and campaign material, signed content will become normal enough that unsigned content attracts scrutiny. The second weakness is that a signature proves who signed, not what is true. A credential shows that a particular device or organisation produced a file and that the file has not changed since. It does not show that the scene depicted was real. A genuine camera pointed at a screen displaying a deepfake will produce a genuinely signed photograph of a fake. A compromised device, or a flaw in a manufacturer's implementation, can produce valid signatures on manipulated content. In 2025 a vulnerability was found in the Content Credentials implementation of Nikon's Z6III camera that allowed inauthentic images to carry valid signatures, and Nikon had to revoke the affected certificates. The episode showed both the risk and the system's capacity to respond to it: revocation is part of the design, as it is for website certificates. Trust in provenance therefore depends on a well-governed system of certificates, on secure hardware, and on decisions about which signers to trust, all of which are institutional as much as technical questions. The third weakness concerns privacy and power. A provenance record that identifies a photographer could endanger a human rights documenter filming abuses or a citizen journalist in an authoritarian state. The C2PA standard makes identity assertions optional and allows redaction, and the human rights organisation WITNESS, which has been involved in the standard's development, has pressed for designs that protect vulnerable creators. But there is a real tension between provenance strong enough to be trusted and anonymity strong enough to be safe, and a world in which only signed media is believed would disadvantage those who cannot or dare not sign. Watermarking synthetic output Provenance metadata sits beside the content. Watermarking puts a signal inside it. A watermark for synthetic media is an imperceptible pattern embedded in the pixels of an image, the samples of an audio track or the frames of a video at the moment of generation, designed to be detectable by a matching algorithm even after common transformations such as compression, cropping and filtering. The most widely deployed system is SynthID, developed by Google DeepMind and introduced for images in August 2023, later extended to audio, video and text. Google reported in May 2026 that more than 100 billion images, videos and audio files had been watermarked with it since launch, and that month OpenAI announced that it would embed SynthID in images produced by its own products, a notable instance of competitors converging on shared infrastructure. Meta has published its own open watermarking methods for audio and video. Research systems such as Stable Signature, from Pierre Fernandez and colleagues at Meta and Inria in 2023, embed the watermark into the generator itself by fine-tuning the decoder, so that every image it produces carries the mark without a separate step. Watermarks complement metadata because they survive many of the transformations that strip it: a screenshot of a watermarked image usually retains the watermark. But they have limits of their own. Researchers have repeatedly shown that invisible watermarks can be removed. A 2023 study by Xuandong Zhao and colleagues argued that low-perturbation image watermarks are, in their phrase, provably removable using generative AI: adding noise to an image and then using a diffusion model to clean it up regenerates the content while washing out the embedded signal. Mehrdad Saberi and colleagues at the University of Maryland showed the same year that such purification attacks defeat many watermarking schemes and that attackers can also forge watermarks onto genuine images, making authentic content appear AI-generated. There is a trade-off between robustness and imperceptibility: a stronger watermark is harder to remove but more likely to degrade quality. The most fundamental limit is coverage. A watermark is present only if the generator's operator chose to put it there. Commercial services operated by large companies can be required, by regulation or reputation, to watermark their outputs. Open-weight models, which anyone can download and run, cannot be compelled; even if released with watermarking built in, the relevant code can be removed. Since many malicious uses of synthetic media rely precisely on open models whose safeguards have been stripped, watermarking catches the cooperative majority of synthetic content while missing much of the harmful minority. That is still useful. Labelling the vast volume of legitimate synthetic content reduces confusion and helps platforms and researchers, and every forger forced to use less capable tools is a forger producing less convincing forgeries. But watermarking is not a dragnet. Fingerprints for known items A third technique, perceptual hashing, addresses a narrower but important problem: recognising a specific known item when it reappears. A perceptual hash is a compact summary of an image or video that changes little when the content is resized, compressed or slightly altered, unlike a cryptographic hash, which changes completely. Microsoft's PhotoDNA, developed with Hany Farid in 2009, has long been used to detect known child sexual abuse imagery. The StopNCII service, operated by the British charity SWGfL, allows people who fear that intimate images of them will be shared to generate hashes on their own device and submit only the hashes to participating platforms, which then block matching uploads. Hash-sharing databases operated by industry groups such as the Global Internet Forum to Counter Terrorism work the same way for terrorist content. Fingerprinting cannot detect a new deepfake. It can stop a known one from spreading after the first report, which for non-consensual intimate imagery, where the harm comes from repeated circulation, is often what matters most. The three active techniques and passive detection differ in what they can establish and in how they fail, as Table 3 summarises. The essential point is that they are complements. Signed provenance establishes the history of authentic and labelled content; watermarking marks synthetic content in a way that survives metadata loss; fingerprinting tracks known harmful items; detection examines what none of the others covers. Table 3. Technical approaches to establishing media authenticity. Approach What it can establish Survives stripping and re-encoding Key limitation Signed provenance (C2PA) Origin and edit history of signed content No, unless soft-bound Absence proves nothing; signer not truth Invisible watermark Content came from a cooperating generator Partly Removable; absent from open models Perceptual fingerprint Item matches a known catalogued item Largely Cannot recognise new content Passive detection Signs of manipulation in unknown content Weakened Poor generalisation; adversarial evasion A credential's journey It helps to follow a single photograph through a provenance-aware system. A news photographer covering a protest takes a picture on a camera that signs images at capture. The signature, created with a key held in secure hardware inside the camera, binds the image to a manifest recording the device, the time and, if the photographer chooses, the location and her identity. Back at the office, a picture editor crops and adjusts the exposure in editing software that supports the standard; the software records those changes in a new manifest, lists the original as its ingredient, and signs the result with the news organisation's certificate. The image is published on the organisation's website with its credential intact, and a reader who clicks the small icon beside it can see that it was captured by a camera at a particular time, edited in particular ways and published by that organisation. The same image is then shared to a social platform. If the platform supports the standard, it reads the credential, perhaps displays a label indicating that the image was captured by a camera, and preserves the manifest or stores it for later retrieval. If the platform does not, the metadata is stripped and the credential is lost, unless a watermark embedded at publication allows it to be looked up again. Someone screenshots the image and posts it to a messaging app with a false caption claiming that it shows a different protest in a different country. Provenance cannot prevent this. But a journalist or fact-checker who encounters the screenshot can, by matching it to the signed original, establish when and where the picture was actually taken, which is often exactly what is needed to expose a miscaptioned image. Provenance, in other words, is useful not only against synthetic media but against the cheapfakes described in Chapter 1, which remain far more common. Provenance beyond pictures The same logic is being applied to other channels, and one older example shows both its promise and its limits. Robocalls with forged caller identification were a plague in the United States long before AI voices, and in 2021 the Federal Communications Commission required major telephone carriers to implement a framework known as STIR/SHAKEN, under which the originating carrier cryptographically signs a call's caller ID with a level of attestation indicating how confident it is that the caller is entitled to use that number. The receiving carrier verifies the signature and can flag or block calls that fail. The New Hampshire robocalls of January 2024 passed through this system. The carrier that transmitted them, Lingo Telecom, applied the highest level of attestation to calls whose caller ID had been spoofed to show the number of a local political figure, and the FCC's subsequent penalty against Lingo turned in part on that failure. The episode shows that provenance systems are only as good as the diligence of the parties who sign, and that regulators can hold signers accountable when they attest to what they have not verified. That principle, accountability for attestations, is likely to become central to media provenance as well. A camera manufacturer whose keys are compromised, or a platform that labels content as authentic without adequate checks, will need to bear consequences if the system is to retain trust. From voluntary to mandatory For most of their history, these systems were voluntary industry initiatives. That changed between 2023 and 2026, as governments began writing labelling into law. China moved first. Its Provisions on the Administration of Deep Synthesis of Internet Information Services, in force from January 2023, required providers to label synthetic content that could mislead the public. Measures for labelling AI-generated synthetic content, which took effect in September 2025, specified both explicit labels visible to users and implicit labels embedded in file metadata, and placed obligations on platforms to check for them. The European Union's AI Act, adopted in 2024, contains in its Article 50 a set of transparency obligations that began to apply on 2 August 2026. Providers of generative AI systems must ensure that their outputs are marked in a machine-readable format and detectable as artificially generated. Deployers who use AI to produce deepfakes, defined as content resembling real people, places or events that would falsely appear authentic, must disclose that the content has been artificially generated or manipulated, with lighter requirements for evidently artistic, satirical or fictional works. To make these obligations concrete, the European Commission facilitated a Code of Practice on the transparency of AI-generated content, which it confirmed in 2026 as an adequate means of demonstrating compliance. The code envisages a layered approach combining signed metadata with imperceptible watermarking, on the reasoning that no single technique is robust enough alone, and a common visual label for deepfakes. Under amendments agreed in 2026, systems already on the market before August received until December 2026 to implement marking. The United States has no comparable federal labelling law. In 2023 the White House secured voluntary commitments from leading AI companies to develop watermarking and provenance tools, and several states have legislated. California's AI Transparency Act requires large generative AI providers to embed provenance disclosures in their outputs and to offer free tools for detecting them. Regulation solves the coordination problem that held provenance back: no single company wants to bear the cost of labelling while competitors do not, and no platform can display credentials that nobody creates. It does not solve the structural limits described above. A law can oblige a European company to watermark its outputs; it cannot oblige an anonymous developer to keep watermarking in an open-weight model, or a foreign influence operation to label its forgeries. Provenance and watermarking, like detection, are partial defences. What they add, and what detection cannot, is a way for honest actors to make their honesty verifiable. The value of that depends on the stakes of the context in which it is used, and few contexts have higher stakes than elections, to which the next chapter turns. Chapter 7: The Ballot and the Forgery At the start of 2024 the World Economic Forum's annual Global Risks Report, which surveys more than a thousand experts from business, government and academia, ranked misinformation and disinformation as the most severe global risk over the following two years, ahead of extreme weather and armed conflict. The reasoning was explicit: 2024 was the largest election year in history, with national votes in countries containing about half the world's population, including India, Indonesia, Mexico, South Africa, the United Kingdom, the United States and the twenty-seven member states of the European Union, and generative AI had just become cheap and widely available. In February 2024, at the Munich Security Conference, more than twenty technology companies, including Google, Meta, Microsoft, OpenAI and TikTok, signed an accord pledging to detect and counter deceptive AI election content. The fear was of a decisive forgery, released at the last moment, that would swing an election before anyone could debunk it. What actually happened is more interesting, and more troubling in a different way, than that fear anticipated. The record so far The history of deepfakes in elections can be told through a handful of cases, each illuminating a different mechanism. Table 4 gathers the most instructive of them. Table 4. Selected incidents involving synthetic media in elections and political crises. Year Country Incident Significance 2019 Gabon President's address claimed to be a deepfake Suspicion alone fed a coup attempt 2022 Ukraine Fake Zelensky surrender video Crude; rapidly refuted by the target 2023 Slovakia Fake audio of opposition leader Released during pre-vote silence period 2024 United States Cloned Biden voice in primary robocalls Voter suppression; $6m FCC fine 2024 India Authorised AI avatars and resurrected leaders Mass use by campaigns themselves 2025 Ireland Fake broadcast of candidate withdrawing Imitated a trusted news brand Gabon and Ukraine have already been described in Chapter 1. The Slovak case, recounted in the Introduction, illustrated the most feared pattern: forged audio released at a moment chosen to make rebuttal difficult, in a close race. It also showed why audio is the forger's preferred medium. The clips did not need to show a face. They needed only a voice that sounded close enough on a phone speaker, and a plausible scenario. The New Hampshire robocall of January 2024 showed a different pattern: suppression rather than persuasion. Two days before the state's Democratic primary, thousands of voters received calls in which a voice resembling Joe Biden's, using one of his characteristic phrases, urged them to "save" their vote for November rather than participate in the primary. The calls were spoofed to appear to come from a former state Democratic Party chair. Investigators traced them to Steve Kramer, a political consultant who had been working for a rival candidate, and who said he had commissioned the recording from a New Orleans street magician to demonstrate the dangers of AI. The Federal Communications Commission ruled in February 2024 that AI-generated voices count as "artificial" voices under the Telephone Consumer Protection Act, making unsolicited robocalls using them illegal, and in September fined Kramer $6 million; Lingo Telecom, the carrier that transmitted the calls, agreed to pay $1 million. Kramer was also charged under New Hampshire law with voter suppression and candidate impersonation. In June 2025 a jury acquitted him on all counts. The episode demonstrated that regulators can act quickly against synthetic voice calls, but also that existing criminal law, written before the technology existed, may not fit the conduct well. India's general election in spring 2024 showed a third pattern, in which the most prolific users of synthetic media were the campaigns themselves, often openly. Parties produced AI-generated personalised voice messages in which candidates addressed individual voters by name in local languages. The Dravida Munnetra Kazhagam party in Tamil Nadu used a synthetic recreation of its late leader M. Karunanidhi, who had died in 2018, to endorse its candidates. In Indonesia, earlier that year, a video using AI to bring back the late dictator Suharto, urging support for the Golkar party, was viewed millions of times. In Pakistan, the imprisoned former prime minister Imran Khan's party used an AI-generated rendition of his voice, built from his notes, to deliver speeches to rallies he could not attend. These uses were not necessarily deceptive, since audiences were often told what they were seeing, but they normalised synthetic representations of politicians and blurred the line between campaigning and impersonation. India also saw deceptive uses, including fake videos of Bollywood actors appearing to criticise the prime minister, which the actors publicly disowned. Ireland's presidential election in October 2025 brought a refinement. Days before the vote, a fabricated video circulated in the format of a news bulletin from RTÉ, the national broadcaster, in which the left-wing independent candidate Catherine Connolly appeared to announce her withdrawal from the race, followed by fabricated segments claiming the election had been cancelled. The video's power came less from the realism of Connolly's face than from its borrowing of a trusted institution's identity. Connolly condemned it, her campaign reported it to platforms and the Electoral Commission, and she went on to win the election comfortably. The 2026 American midterm campaigns have extended the pattern further. AI-generated imagery and video have become routine in political advertising and in candidates' own social media, much of it openly satirical, some of it not, and the dividing line between the two is increasingly contested. Twenty-nine states had laws on election deepfakes in effect by mid-2026, mostly requiring disclosure in political advertising, with some prohibiting deceptive deepfakes of candidates during a period before an election. Courts struck down California's and Hawaii's laws on First Amendment grounds, a reminder that in the United States, regulating political speech, even false speech, faces high constitutional barriers. No federal standard for election deepfakes exists. Campaigns, parody and the blurred line Several of the most visible uses of synthetic media in elections have come not from foreign adversaries or anonymous trolls but from candidates and their supporters, often presented as humour. Argentina's presidential election in 2023 was described by some commentators as the first AI election because both leading campaigns used generative imagery openly. Supporters of the Peronist candidate Sergio Massa produced images portraying him as a heroic figure in the style of film posters and depicting his opponent Javier Milei as a menacing character from A Clockwork Orange; Milei's camp responded in kind. Few viewers can have mistaken these images for photographs. They were propaganda posters made with new tools. In the United States in 2024, the boundary was tested repeatedly. In April 2023 the Republican National Committee had released an advertisement composed entirely of AI-generated images depicting a dystopian future after a Biden re-election, with a small disclosure in the corner. In July 2024 Elon Musk shared, without its original parody label, a video using a cloned voice of Kamala Harris to have her describe herself in derogatory terms; it was viewed well over a hundred million times. In August 2024 Donald Trump posted a collection of images, several AI-generated, suggesting that Taylor Swift and her fans endorsed him; Swift later cited the episode when she endorsed Harris. None of these was a decisive deception, and their defenders described them as satire. But they illustrate why regulating political deepfakes is difficult. A parody label that travels with a video on one platform disappears when the clip is re-shared elsewhere; content that is plainly satirical to one audience is plausible to another; and the people best placed to set norms of restraint, candidates and their most prominent supporters, have strong incentives not to. Amplification matters more than realism The case that most clearly demonstrates what actually decides the influence of manipulated content involved, by most accounts, little deepfake material at all. In November 2024 Călin Georgescu, a previously marginal far-right candidate, won the first round of Romania's presidential election after a surge of support driven largely by TikTok. Declassified Romanian intelligence documents described a coordinated campaign using networks of accounts, paid influencers and undeclared funding to boost his content. In December the Constitutional Court annulled the first round, an unprecedented step in the European Union, and the election was rerun in 2025. The Romanian case matters for this book because it locates the real threat where the misinformation research predicts it will be: not in the realism of any single piece of content but in the infrastructure of amplification, the accounts, algorithms, influencers and money that determine what millions of people see. A mediocre deepfake pushed by a well-funded network to receptive audiences will reach more people than a flawless one posted by an isolated account. Defences that concentrate on the content itself, through detection or labelling, address only part of the problem. The rest lies in platform transparency, the detection of coordinated inauthentic behaviour, campaign finance enforcement and the resilience of the information sources voters rely on. Why the flood did not swamp the vote Against the fears of 2024, the systematic evidence is, on its face, reassuring. The Centre for Emerging Technology and Security at the Alan Turing Institute examined the British general election, the French legislative elections and the European Parliament elections of 2024 and found only sixteen confirmed viral cases of AI-enabled disinformation in the British campaign and eleven across the two others combined. It concluded that there was no evidence that such content had meaningfully affected the results, though it noted that AI content had amplified existing harmful narratives and been used to harass candidates. In December 2024, Meta reported that AI-generated content had made up less than one per cent of the election-related misinformation identified by its fact-checkers during the year's major elections. Why did the flood not swamp the vote? Researchers who study misinformation had predicted the answer. In a 2023 essay, Felix Simon, Sacha Altay and Hugo Mercier argued that fears about generative AI's effect on misinformation were overblown, because the constraint on misinformation's influence was never the supply of convincing falsehoods. It was demand. Misinformation mostly reaches and persuades people who are already disposed to believe it; the marginal effect of making it more realistic is small when cruder material was already sufficient for receptive audiences, and when sceptical audiences are not reached at all. Persuasion in election campaigns is notoriously hard, and most voters' choices are anchored by partisanship, identity and the economy rather than by any single piece of content. This argument is persuasive as far as it goes, but three cautions apply. First, it concerns persuasion. Suppression and confusion operate differently: a forged message telling voters that polls have moved, that an election is cancelled, or that a candidate has withdrawn need not change anyone's opinions to change who turns up. Second, averages conceal tails. Most elections are not close, and in most of those that are, no well-timed forgery appears. But in a tight race, a single forgery released at the right moment to a specific community could matter, and Slovakia showed what that looks like even if its effect cannot be measured. Third, the absence of measurable effects on vote totals does not mean the absence of harm. Women candidates have been disproportionately targeted with sexualised deepfakes, which may deter them from standing; election officials have been targeted with forged statements; and the cumulative effect of an information environment saturated with synthetic material is harder to count than viral incidents. The liar's dividend That cumulative effect is the more serious danger, and it has a name. In a 2019 article in the California Law Review, Robert Chesney and Danielle Citron warned that as the public becomes aware that audio and video can be convincingly faked, people caught on genuine recordings will find it easier to claim that the recordings are fake. They called this the liar's dividend. It does not require any deepfake to exist. It requires only that deepfakes be possible and widely known to be possible. The dividend has been claimed repeatedly. In 2023 the finance minister of the Indian state of Tamil Nadu, Palanivel Thiaga Rajan, dismissed leaked audio clips in which he appeared to criticise senior figures in his own party as machine-generated; independent analysts disagreed on whether they were authentic. In the same year, lawyers for Tesla in a wrongful death lawsuit suggested that recordings of Elon Musk's past public statements about the safety of the company's driver-assistance system might be deepfakes, an argument the judge rejected as deeply troubling, warning that it would let famous people avoid responsibility for what they had actually said. Defendants charged over the 6 January 2021 attack on the United States Capitol tried similar arguments about video evidence. In the Gabon case, the suspicion of a deepfake was itself the political weapon. There is now experimental evidence on whether the strategy works. In a study published in the American Political Science Review in 2025, Kaylyn Jackson Schiff, Daniel Schiff and Natália Bueno ran five survey experiments with more than fifteen thousand American adults, presenting them with news of a scandal involving a politician and then with the politician's response. Politicians who falsely claimed that the story was fake news or a deepfake gained support relative to those who stayed silent or apologised, across partisan groups. But the effect was concentrated on scandals reported in text; false claims of fabrication were largely ineffective against video evidence. In other words, as of the mid-2020s, video still retained much of its evidential authority with ordinary citizens. That is the asset the liar's dividend threatens to spend down, and every advance in the realism and familiarity of synthetic video makes the denial more plausible. An earlier study by Cristian Vaccari and Andrew Chadwick, published in 2020, pointed to a related mechanism. They showed British participants a deepfake of Barack Obama and found that relatively few were outright deceived by it. But exposure increased uncertainty about what was real, and that uncertainty was associated with reduced trust in news on social media. The damage was not belief in a lie. It was doubt about the truth. This is the sense in which the electoral threat of deepfakes has been misunderstood. The question most often asked, whether a fake can swing an election, has so far mostly been answered no, though not with enough certainty for complacency. The more important question is what happens to accountability when every damaging recording can be waved away. Elections depend not only on the act of voting but on the information that voters use to judge incumbents and candidates. A great deal of that information, from the 1972 Watergate tapes to the 2012 recording of Mitt Romney's remarks about the "47 per cent" to the 2016 Access Hollywood tape, has come in the form of recordings that their subjects would have preferred to disown. A politics in which such recordings can be credibly dismissed is a politics in which the powerful face one fewer constraint. The implication for defence is significant. If the main risk were the persuasive fake, the main remedy would be detection and removal. If the main risk is the corrosion of trust in authentic evidence, then the remedy must include ways for authentic evidence to defend itself: provenance that lets a news organisation demonstrate that its recording came from its own camera and has not been altered, forensic capacity able to confirm authenticity as well as detect forgery, and institutions trusted enough that their verification counts. Chapter 9 returns to those remedies. First, the next chapter turns to the larger and more immediate harms that deepfakes do outside politics. Chapter 8: Beyond the Ballot: Fraud, Abuse and the Law Political deepfakes attract the headlines, but they are a small share of the harm. Measured by the number of people hurt and the money lost, the damage done by synthetic media falls overwhelmingly in two other places: the sexual abuse of individuals, mostly women and girls, and fraud. Both were present from the beginning. The first deepfakes were pornographic, and the first widely reported deepfake fraud, in 2019, involved a cloned voice. Both have grown as the tools have become easier to use. And both have driven the first serious wave of legislation aimed at synthetic media, which in turn reveals how difficult it is to regulate a capability rather than an act. Sexual abuse at scale The term "deepfake pornography" is misleading in one important respect: it suggests a genre, when what it describes is a form of abuse. The images and videos are made without the consent of the people they depict, they are used to humiliate, intimidate, extort and silence, and the harm they do does not depend on anyone believing them to be real. A woman whose face has been placed on sexual imagery suffers the violation whether or not viewers know it is synthetic. Legal scholars such as Danielle Citron have described this as an invasion of sexual privacy, and survivors consistently report effects similar to those of the non-consensual sharing of genuine intimate images: shame, fear, damage to relationships and careers, and the knowledge that the material may resurface indefinitely. The 2019 Deeptrace report that found 96 per cent of deepfake videos online to be non-consensual pornography also found that the top dedicated websites had accumulated hundreds of millions of views. At that stage the victims were mostly celebrities, because the technology required large numbers of training images. The developments described in Chapter 3, fine-tuning from a handful of photographs and diffusion-based inpainting, changed the target population. So-called "nudify" applications, which take an ordinary clothed photograph and generate a synthetic nude version, spread through app stores, websites and messaging bots, making anyone with a public photograph a potential victim. Schools became a recurring setting. In September 2023 parents in Almendralejo, a small town in south-western Spain, discovered that synthetic nude images of more than twenty girls, some as young as eleven, had been created from their social media photographs and circulated among classmates. Similar cases followed at schools in the United States, Australia and elsewhere. In South Korea in 2024, journalists uncovered networks of chat rooms on the Telegram messaging service in which users shared sexual deepfakes of acquaintances, including classmates, teachers and female soldiers, with some rooms organised around particular schools and universities. The scandal prompted mass protests and, within weeks, legislation making it a crime in South Korea not only to make or distribute such material but to possess or view it. High-profile cases have repeatedly forced platforms to act. In January 2024 sexually explicit AI-generated images of Taylor Swift spread on X, one reportedly viewed tens of millions of times before removal, and the platform temporarily blocked searches for her name. In late December 2025 and early January 2026, users discovered that X's own AI assistant, Grok, would edit photographs of real people, including children, to depict them in revealing clothing or sexualised poses when asked in public replies. The Center for Countering Digital Hate estimated that Grok produced around three million sexualised images in eleven days. Indonesia and Malaysia temporarily blocked access to Grok, Britain's communications regulator Ofcom opened a formal investigation under the Online Safety Act, and authorities in France, Australia and elsewhere took action. The episode was significant because it involved not an obscure open-source tool but a mainstream product built into a major social network, demonstrating that safeguards are a choice and that their absence can be industrial in scale. Children, extortion and the training data problem The gravest form of this abuse involves children. In October 2023 the Internet Watch Foundation, the British charity that works to remove child sexual abuse material from the internet, reported that it had found more than twenty thousand AI-generated images posted to a single dark-web forum dedicated to such material in one month, thousands of which it assessed as criminal under British law. Some depicted real children whose images had been used to fine-tune generators; some depicted known victims of past abuse in new scenarios; some depicted children who did not exist. The charity's subsequent reports documented a growing volume of realistic AI-generated abuse video. Law enforcement agencies have warned that synthetic material wastes investigators' time, since every image potentially depicting a real child in danger must be assessed, and that it normalises abuse among offenders. The problem reached into the foundations of the field. In December 2023 researchers at the Stanford Internet Observatory, led by David Thiel, reported that LAION-5B, a dataset of several billion image-text pairs scraped from the web and used to train Stable Diffusion and other widely used models, contained links to more than a thousand images of suspected child sexual abuse. The dataset's maintainers withdrew it and later released a cleaned version. The finding showed that the risks of generative models are shaped not only by how they are used but by what they were built from, and that indiscriminate web scraping can embed abuse in the very systems later used to produce more of it. Synthetic imagery has also transformed sextortion, in which criminals threaten to release sexual images of a victim unless paid. Traditionally this required first tricking the victim into sending real images. In June 2023 the FBI warned that criminals were instead taking ordinary photographs from victims' social media accounts, including those of minors, generating explicit fakes, and using them for extortion. Because the victim knows the images are fake, the threat might seem empty; in practice the fear that others will believe them, or the humiliation of their circulation regardless of belief, is enough. Several teenage suicides in the United States have been linked to sextortion schemes, and child protection organisations have reported sharp increases in reports involving synthetic images. Fraud: when seeing and hearing are not believing The first widely reported case of deepfake fraud came in 2019, when the chief executive of a British energy company received a phone call from what he believed was the head of his German parent company, asking for an urgent transfer of €220,000 to a Hungarian supplier. The caller's voice, including its slight German accent and its cadence, was convincing. The money was moved onward quickly and not recovered. The company's insurer, Euler Hermes, told The Wall Street Journal that it believed the voice had been generated by AI. The case that changed corporate security thinking came in January 2024. An employee in the Hong Kong office of Arup, the British engineering firm, received a message purporting to come from the company's chief financial officer in London, requesting a confidential transaction. The employee was suspicious until invited to a video conference in which the CFO and several other colleagues appeared and spoke. All of them, according to the Hong Kong police, were synthetic, apparently constructed from publicly available video and audio of the real executives. The employee made fifteen transfers totalling HK$200 million, roughly US$25 million, before checking with head office and discovering the fraud. Arup confirmed it was the victim in May 2024. The case demonstrated that a video call, once regarded as a reliable way to verify identity, could no longer be treated as one. Other attempts have failed, and the failures are instructive. In May 2024 criminals set up a meeting on Microsoft Teams with an executive of the advertising group WPP, using a fake WhatsApp account bearing the image of the company's chief executive, Mark Read, together with a voice clone and YouTube footage. Staff were suspicious and the attempt failed. In July 2024 an executive at Ferrari received WhatsApp messages and then a call from someone imitating the voice of the chief executive, Benedetto Vigna, and his southern Italian accent, about a supposedly confidential acquisition. Sensing something wrong, the executive asked the caller to name a book Vigna had recommended to him a few days earlier. The caller hung up. That simple question, drawing on shared knowledge that no public recording could supply, is the essence of a defence discussed in the next chapter. At the level of individuals, voice cloning has given new life to an old scam. In the "grandparent" or "family emergency" fraud, a caller pretends to be a relative in trouble, arrested, injured or kidnapped, and pleads for money. Cloned voices, built from snippets on social media, make the impersonation far more convincing. American regulators, including the Federal Trade Commission, issued warnings about the practice from 2023 onwards, and banks in several countries have reported growing numbers of cases. Synthetic media also threatens the identity-verification systems that financial services rely on. Opening a bank account or cryptocurrency exchange account remotely now often requires a selfie video or a live "liveness" check in which the applicant turns their head or follows instructions. Fraudsters respond with face-swapping and with injection attacks, in which synthetic video is fed directly into the verification software, bypassing the camera altogether. Voice authentication used by banks has proved vulnerable too: in 2023 a journalist at the technology publication Vice demonstrated that he could access his own bank account through its telephone voice-recognition system using a cloned voice. In each case, the system had assumed that producing a live, matching face or voice was hard. That assumption is now false. The emerging law Lawmakers have responded more quickly to these harms than to political deepfakes, partly because the conduct is easier to define and partly because the constitutional obstacles are lower. Table 5 summarises several of the most significant measures. Table 5. Selected laws addressing deepfake harms. Jurisdiction Instrument Year Main effect United States TAKE IT DOWN Act 2025 Crime to publish intimate deepfakes; 48-hour platform removal United Kingdom Online Safety Act; Data (Use and Access) Act 2023; 2025 Crimes of sharing, then of creating, intimate deepfakes European Union Directive on combating violence against women 2024 Member states must criminalise intimate deepfakes South Korea Sexual violence law amendments 2024 Crime to possess or view sexual deepfakes China Deep synthesis and labelling rules 2023; 2025 Consent, labelling and platform duties The American TAKE IT DOWN Act, signed in May 2025 after passing Congress with near-unanimous support, makes it a federal crime to knowingly publish non-consensual intimate imagery, including AI-generated "digital forgeries", or to threaten to do so, with heavier penalties where minors are depicted. It also requires covered online platforms to establish a process through which victims can request removal and to take down reported material within forty-eight hours. The platform obligations took effect in May 2026, enforced by the Federal Trade Commission. Civil liberties groups criticised the removal provisions for lacking safeguards against false or abusive takedown requests, a concern that will be tested as enforcement proceeds. The United Kingdom made sharing intimate deepfakes without consent a criminal offence through the Online Safety Act 2023. Because that left creation itself untouched, Parliament added an offence of intentionally creating, or requesting the creation of, a purported sexual image of a person without consent, through the Data (Use and Access) Act 2025; the offence came into force in February 2026. The European Union's 2024 directive on combating violence against women requires member states to criminalise the production and distribution of non-consensual intimate deepfakes by 2027. Australia passed legislation in 2024 creating offences for sharing sexual deepfakes. Denmark has proposed a different route, amending copyright law to give individuals rights over the use of their own face, body and voice, so that removal of a deepfake could be demanded on property-like grounds. A broader movement seeks to protect likeness itself, beyond sexual imagery. In the United States the main legal tool has been the right of publicity, a patchwork of state laws that let people control commercial use of their name and image. Tennessee extended its version in March 2024 with the ELVIS Act, explicitly covering the unauthorised simulation of a person's voice, a response to concern in the state's music industry about AI-generated imitations of singers. In May 2024 the actor Scarlett Johansson objected that a voice offered by OpenAI's ChatGPT, called Sky, sounded strikingly like her own, after she had declined the company's invitation to voice the product; OpenAI denied imitating her but withdrew the voice. Federal legislation known as the NO FAKES Act, which would create a national right to control digital replicas of one's voice and likeness, has been introduced in Congress in successive versions with support from performers' unions, record labels and several technology companies; a revised bill was approved by the Senate Judiciary Committee in June 2026 but had not become law by the autumn. The Hollywood actors' strike of 2023 ended with a contract requiring studios to obtain informed consent and pay compensation for digital replicas of performers, a private-law model that may prove as influential as legislation. These measures share a premise: that a person's face and voice belong, in some meaningful sense, to that person, and that copying them without permission is a wrong in itself, whether or not anyone is deceived. That premise is attractive, but it raises hard questions at the edges, about parody, about commentary on public figures, about historical and documentary work, and about the use of likenesses in training data rather than in specific outputs. How courts and legislatures resolve those questions will shape the boundaries of acceptable synthetic media for years. For fraud, existing law is largely adequate on paper. Obtaining money by deception is already a crime whether the deception uses a forged letter, a lie on the phone or a cloned voice. The difficulty is enforcement: fraudsters typically operate across borders, use mule accounts and cryptocurrency to move funds, and are rarely identified. The legal response to deepfake fraud has therefore focused less on new crimes and more on obligations for intermediaries, such as the FCC's 2024 ruling on AI voices in robocalls and requirements for banks to strengthen authentication. The limits of law Three limits recur across jurisdictions. The first is reach. Laws bind those within a state's jurisdiction. The creators of nudify apps, the operators of the sites that host deepfake pornography and the gangs that run voice-cloning scams are often elsewhere. Laws that place duties on platforms, app stores and payment providers, which are within reach and which the abusers depend on, have proved more effective than laws aimed at anonymous individuals. In 2024 and 2025 several payment processors and app stores began cutting off nudify services, and advocacy groups and journalists who exposed the services' reliance on mainstream payment and advertising infrastructure contributed to that pressure. The second is definition. A law against deceptive synthetic media must distinguish it from satire, parody, art, journalism and legitimate commercial uses, and from ordinary editing. Drawn too broadly, such laws chill protected expression; drawn too narrowly, they are easily evaded. The American courts that struck down California's election deepfake law did so largely because it reached satire and political commentary. Laws focused on sexual imagery face fewer such problems, which is one reason they have advanced faster. The third is timing. Law operates after the fact. By the time a victim of sexual deepfakes has obtained removal, the material may have been copied many times; by the time a fraud has been reported, the money is usually gone. Legal deterrence matters, but the harms of synthetic media are fast, cheap and widely dispersed, and law is slow, expensive and concentrated. That is why the response to deepfakes cannot be legal alone. It must include the technical systems described in Chapter 6, and the practical habits and institutional arrangements to which the final chapter turns. Chapter 9: Building Resilience The preceding chapters lead to an uncomfortable conclusion. Detection is essential but cannot keep pace with generation. Provenance and watermarking help honest actors prove their honesty but cannot compel dishonest ones to label their work. Law can punish and deter but arrives after the harm. No single measure will make the problem go away, and anyone selling one should be treated with suspicion. What remains is resilience: arranging institutions, organisations and habits so that a convincing forgery, when it arrives, does less damage, and so that authentic evidence keeps its force. Resilience does not depend on winning the technical contest. It depends on a principle that predates digital media: important claims should be verified through channels that the forger does not control. This chapter applies that principle to the people and institutions most exposed. Verify the channel, not the content The single most useful defensive habit against deepfakes is also the oldest. When a request or claim matters, do not try to judge whether the voice, face or document is genuine. Instead, confirm it through a separate channel established in advance. The Ferrari executive who asked the impersonator about a book recommendation did this. So does the finance clerk who, on receiving an urgent payment request on a video call, hangs up and phones the requester on a number from the company directory. Security professionals call this out-of-band verification, and its power comes from the fact that it does not require anyone to detect the forgery. A cloned voice may be indistinguishable from the real one; it cannot answer a call placed to the real person's phone. Synthetic video of an executive may pass every visual inspection; it cannot know a fact shared privately last week. The defence shifts the burden from perception, where synthetic media is strong, to knowledge and infrastructure, where it is weak. For organisations, this means building verification into processes rather than leaving it to individual judgement. Payments above a threshold should require approval by more than one person and confirmation through a pre-registered channel, regardless of who appears to be asking. Changes to supplier bank details should never be accepted on the strength of a call or message alone. Staff should be told explicitly, and repeatedly, that senior executives will never be offended by verification and that urgency and secrecy, the two pressures every impersonation scam applies, are themselves warning signs. The Arup fraud succeeded because the employee's initial suspicion was overcome by what appeared to be a meeting of familiar colleagues. A rule requiring call-back verification for any large transfer would have stopped it without anyone needing to spot the deepfake. Identity verification systems need the same rethinking. A bank that authenticates customers by their voice alone is now relying on something an attacker can copy from a podcast. A remote onboarding process that accepts a selfie video as proof of identity must assume that the video may be synthetic or injected directly into the software. Stronger systems combine several factors, such as a device the customer holds, a cryptographic key and a biometric check, so that defeating any one is insufficient, and they test their liveness checks against current synthesis tools rather than those of three years ago. Remote hiring deserves its own attention, given the cases of synthetic applicants described in Chapter 3. Organisations that hire for remote roles can reduce exposure without treating every candidate as a suspect: by verifying identity documents through established providers rather than by inspecting a video feed, by asking candidates in live interviews to perform simple actions that strain real-time face-swapping, such as turning the head fully to one side or passing a hand across the face, by checking that references and employment history are reachable through independently obtained contact details, and by watching for warning signs after hiring, such as requests to ship equipment to an address other than the employee's own, which American authorities have identified as a feature of the North Korean schemes. None of these measures depends on spotting the deepfake directly; each checks the claim through some channel the impostor does not control. For families, the equivalent is a code word: a phrase agreed in person, never posted online, that a relative in genuine trouble can be asked for. It sounds old-fashioned. It is effective for the same reason the Ferrari question was. A family that has discussed in advance the possibility of a fake emergency call is also far less likely to panic when one arrives, and panic is what the scam depends on. Elections: prepare before the forgery Election officials and campaigns face a harder problem, because the audience for a political forgery is the public, not a single employee who can be trained. Their defences must therefore be prepared in advance and directed at the public. The most effective is prebunking: telling voters before an election what forgeries they might see and how to recognise legitimate information. If an electoral authority announces publicly, repeatedly and well ahead of time that it will never communicate changes to voting dates, locations or procedures by robocall or social media video, and that the only authoritative source is its own website, then a forged message claiming the election has been postponed meets a public that has already been told how to check. Research by Sander van der Linden, Jon Roozenbeek and colleagues at the University of Cambridge has shown that exposing people in advance to weakened forms of manipulation techniques, through short videos or games, modestly improves their ability to recognise those techniques later. Google's Jigsaw unit ran prebunking campaigns on YouTube in several European countries in 2022 and 2023 based on this research. Election officials can also rehearse. Several American states ran tabletop exercises before the 2024 elections in which officials practised responding to synthetic media incidents, in Arizona's case including deepfakes of the secretary of state himself. Rehearsal establishes who will verify a suspicious item, who will speak publicly, through which channels, and how quickly, so that the response to a real incident takes hours rather than days. Speed matters because the Slovak case showed how a forgery released at the right moment can exploit the gap between release and rebuttal. Campaigns and candidates have particular interests in provenance. A candidate who signs official videos and statements with Content Credentials, and who publishes them through verified channels, makes it easier for journalists and platforms to distinguish authentic material from forgeries. A campaign that maintains an archive of authentic footage of its candidate also supports the behavioural forensic methods described in Chapter 4, which need such material to work. And candidates should consider making their own commitments about the use of synthetic media in their campaigns, both because such commitments limit the normalisation of deceptive content and because a candidate who has forsworn deceptive synthetic material is better placed to condemn it when it is used against them. Most important is that candidates and officials do not themselves draw on the liar's dividend. The temptation to dismiss a damaging genuine recording as a deepfake is strong, and Chapter 7 showed that, for text at least, it can work. Every politician who succumbs to it makes the next denial more plausible and accountability harder for everyone. Newsrooms and platforms Journalists sit at the junction between forgery and the public, and their practices determine much of how a deepfake incident unfolds. Many large news organisations now maintain specialist verification teams; BBC Verify, launched in 2023, is one prominent example. Their task is not only to expose forgeries but to establish and communicate what is known, with appropriate precision. The verdict "this is a deepfake" should be reserved for cases where the evidence supports it; often the honest conclusion is that a clip's origin cannot be established, or that it shows signs of manipulation that do not amount to proof. Overconfident debunking that later turns out to be wrong damages trust in verification itself. Newsrooms must also avoid amplifying the forgeries they cover. A report that leads with a striking fake image and appends a correction at the end may spread the image further than the forger could have. Practitioners recommend placing the accurate information first, describing the false claim briefly, and returning to the accurate information at the end, and showing forged media only where necessary, clearly labelled and preferably in degraded or annotated form. News organisations have their own provenance interests. A newsroom that signs its photographs and video at capture, and preserves the signed originals, can prove what it published if a politician claims that its recording was fabricated. That is the most direct technical answer to the liar's dividend, and its value depends on adoption before a dispute arises, not after. Platforms hold the largest levers. They can read Content Credentials and watermarks and display labels; add friction, such as a prompt to read before sharing or a reduction in algorithmic amplification, to content that is unverified and spreading fast during an election period; enforce policies against non-consensual intimate imagery and impersonation; participate in hash-sharing systems such as StopNCII; and cut off services, such as nudify apps, that exist chiefly to cause harm. Companies that build generators have their own responsibilities: refusing to depict real people in sexual or deceptive contexts, building watermarking into their outputs, and testing safeguards against misuse before release. The Grok episode of early 2026 demonstrated what happens when those safeguards are absent, and the regulatory response it provoked suggests that the period in which such choices are left entirely to companies is ending. Supporting the people targeted Much of the discussion of deepfake defence concerns preventing deception. For the largest group of victims, those targeted with sexual imagery, deception is not the point, and the priority is limiting the spread of the material and supporting the person harmed. Practical steps exist, and organisations that encounter victims, schools, employers, police forces, should know them. The first is preservation and reporting. Victims, or those helping them, should record where the material appears, with links, screenshots and dates, before requesting removal, because evidence is needed for legal action and platforms' records may not be retained. The second is removal. In the United States, covered platforms must now act on valid requests within forty-eight hours under the TAKE IT DOWN Act, and the Federal Trade Commission accepts complaints about platforms that fail to do so. Most major platforms have reporting routes for non-consensual intimate imagery, including synthetic imagery, whatever the jurisdiction. The third is prevention of re-upload: the StopNCII hashing service, described in Chapter 6, lets adults create digital fingerprints of images on their own devices and share only those fingerprints with participating platforms, and the American National Center for Missing and Exploited Children operates a similar service, Take It Down, for images of people under eighteen. The fourth is support. Helplines run by organisations such as the Revenge Porn Helpline in the United Kingdom and the Cyber Civil Rights Initiative in the United States provide guidance and emotional support, and many victims report that the most damaging aspect of their experience was the dismissive response of people in authority who told them that since the images were fake, no real harm had been done. Schools need particular preparation, because so many cases now involve pupils creating images of classmates. The cases from Spain, the United States, Australia and South Korea suggest that schools are most effective when they treat the creation of sexual deepfakes as a serious form of sexual harassment rather than a prank, involve the police where the law requires it, protect the identities of those targeted, and include the subject in teaching about consent and online behaviour before an incident rather than after. What citizens can do Individual media literacy is often offered as the answer to deepfakes. It is part of the answer, but the advice usually given needs revising. Teaching people to look for visual artifacts, unnatural blinking, strange hands, mismatched earrings or warped backgrounds, has a short shelf life, because each generation of tools removes the artifacts the previous generation of advice described. Worse, it can lead people to distrust authentic but imperfect media. More durable is the habit that professional fact-checkers use, which researchers at Stanford University led by Sam Wineburg called lateral reading. Instead of studying a piece of content closely to decide whether it is genuine, fact-checkers leave it almost immediately and look at what other sources say about it and its origin. Has a reputable news organisation reported this event? Does the account that posted it have a history? Is there an original version? Does the person depicted confirm or deny it? Wineburg's group found that this approach, rather than close reading, distinguished expert fact-checkers from historians and students who were otherwise highly educated. It works for deepfakes for the same reason out-of-band verification does: it does not depend on detecting the forgery, only on checking the claim against sources the forger does not control. A few further habits help. Treat strong emotional reactions, especially outrage or alarm, as a reason to pause before sharing. Be particularly wary of audio, which is easiest to fake and hardest to judge. Look for provenance information where platforms display it, while remembering that its absence proves nothing. And be as careful about dismissing authentic material as about accepting fake material, because a public that reflexively calls everything inconvenient a deepfake is giving liars exactly the dividend they want. None of these measures is dramatic, and none will stop a determined, well-resourced forger. Together they change the environment in which forgeries operate, so that a fake voice cannot move money without a call-back, a fake election announcement meets a public that knows where to check, a fake news bulletin meets a newsroom that can prove what it actually broadcast, and a genuine recording of misconduct meets a public still willing to believe its own eyes. Conclusion For about a century and a half, recordings enjoyed an authority they had never fully earned. Photographs, films and tapes could always be faked, but faking them well was expensive, slow and usually detectable, and so societies adopted a working presumption: a recording is what it appears to be unless there is a specific reason to doubt it. That presumption underpinned journalism, courts, insurance claims, police accountability and the exposure of political misconduct. It was never a law of nature. It was a bet on the economics of forgery. The argument of this book is that machine learning has broken the economics, and that the presumption must now be rebuilt on a different foundation. The old foundation was cost: recordings were trusted because forgery was hard. The new one has to be verifiability: recordings will be trusted because their origin can be checked. Every serious response described in the preceding chapters is a piece of that reconstruction. Signed provenance lets a camera, a newsroom or a government attach checkable evidence of origin. Watermarking lets cooperating generators declare their output. Out-of-band verification lets an organisation confirm a request without judging the voice that made it. Lateral reading lets a citizen check a claim against sources the forger does not control. Detection, which cannot carry the load alone, remains the instrument for examining what falls outside these systems and for defending genuine recordings when they are falsely denied. Three consequences follow from this argument that are not obvious from any single chapter. The first is that the dangerous period is the transition. In a world where forgery is expensive, the old presumption works. In a world where verification infrastructure is mature and widely adopted, a new presumption can work: signed material from accountable sources is trusted, and unsigned material of uncertain origin is treated with proportionate caution. The danger lies between, which is where we are now. Forgery is cheap, but most authentic media still carries no proof of origin, most platforms still strip what proof there is, and most people still judge recordings by how they look. In that gap, the forger and the liar both prosper: the forger because fakes cannot be distinguished from unsigned authentic material, the liar because authentic material cannot prove itself. The practical task of the next several years is to shorten the transition, by accelerating adoption of provenance in the domains where trust matters most, news, elections, courts and official communications, rather than waiting for it to spread evenly everywhere. The second is that verification infrastructure is power, and needs governing as such. If authentic media increasingly means media signed by recognised devices and organisations, then whoever decides which signers are recognised, which credentials platforms display and which content search engines and browsers mark as verified will hold considerable influence over what counts as real. Today those decisions are made mostly by a consortium of large technology and media companies, with regulators in Europe and China beginning to set requirements. That arrangement has worked tolerably in its early stages, but its risks are visible. A citizen filming abuses on an old phone, a small news outlet in a poor country, a whistleblower who cannot safely identify herself: all could find their genuine evidence discounted in a system built around the credentials of large institutions. The design choices that protect such people, optional identity, redaction, open standards, independent verification tools, and the principle that the absence of credentials is not evidence of falsity, should be treated as core requirements rather than accommodations. Forensic detection capacity, similarly, should not exist only as a commercial service sold to those who can afford it. Courts, election authorities and public-interest newsrooms need access to it as a matter of course. The third is that the strength of a democracy against synthetic media lies mainly in its institutions, not its technology. The elections of 2024 and 2025 suggest that deepfakes rarely changed votes, and the reasons were social rather than technical: partisanship anchors opinion, persuasion is hard, and audiences inclined to believe a fake were usually inclined to believe its claim anyway. Where forgeries were defused, it was usually because the target responded quickly through trusted channels, because journalists did their jobs, or because voters knew where authoritative information came from. Where forgeries came closest to mattering, as in Slovakia, it was because the timing exploited a gap in those institutions. The liar's dividend, likewise, is a claim made to a public; its success depends on whether that public still has trusted sources able to say, credibly, that a recording is genuine. A society with strong public broadcasters, competent electoral authorities, independent courts and a press that verifies before it publishes will absorb synthetic media far better than one without them, whatever detectors either possesses. Investment in those institutions is deepfake defence, even when it is not labelled as such. Several questions remain unsettled. Open-weight generative models will continue to improve, and no regime of watermarking or labelling will reach those who strip safeguards from them; how much harm that residual capacity does will depend partly on whether the services that distribute its output, from app stores to payment processors to hosting providers, can be held to account. Real-time synthesis will make interactive impersonation more convincing, putting more weight on verification by channel. The law of political deepfakes remains contested, particularly in the United States, where the First Amendment sharply limits regulation of false political speech. And the long-term effect on public trust is unknown: it is possible that citizens will adapt, as they adapted to photo editing, by learning to trust sources rather than images; it is also possible that a generation raised amid synthetic media will simply cease to regard recordings as evidence of anything. That last possibility is the one most worth guarding against. A world in which deepfakes deceive people some of the time is dangerous but manageable. A world in which nobody believes any recording at all would be a world in which the powerful could no longer be caught on tape, and in which every dispute about what happened became a contest of partisan assertion. The choice between those futures will not be made by any single detector or law. It will be made by the slow work of rebuilding trust on foundations that forgery cannot cheaply reach. Notes Introduction 1. Alan Turing Institute, Centre for Emerging Technology and Security (CETaS), research on AI-enabled influence operations in the 2024 UK, French and European Parliament elections (2024). 2. Robert Chesney and Danielle Keats Citron, "Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security," California Law Review 107 (2019): 1753–1820. Chapter 1 1. David King, The Commissar Vanishes: The Falsification of Photographs and Art in Stalin's Russia (Metropolitan Books, 1997). 2. Britt Paris and Joan Donovan, Deepfakes and Cheap Fakes: The Manipulation of Audio and Visual Evidence (Data & Society, 2019). 3. Henry Ajder, Giorgio Patrini, Francesco Cavalli and Laurence Cullen, The State of Deepfakes: Landscape, Threats, and Impact (Deeptrace, 2019). 4. Regina Rini, "Deepfakes and the Epistemic Backstop," Philosophers' Imprint 20, no. 24 (2020). Chapter 2 1. Diederik P. Kingma and Max Welling, "Auto-Encoding Variational Bayes," arXiv:1312.6114 (2013). 2. Ian Goodfellow et al., "Generative Adversarial Nets," Advances in Neural Information Processing Systems 27 (2014). 3. Tero Karras, Samuli Laine and Timo Aila, "A Style-Based Generator Architecture for Generative Adversarial Networks," CVPR (2019); Tero Karras et al., "Analyzing and Improving the Image Quality of StyleGAN," CVPR (2020). 4. Sophie J. Nightingale and Hany Farid, "AI-Synthesized Faces Are Indistinguishable from Real Faces and More Trustworthy," PNAS 119, no. 8 (2022). 5. Phillip Isola et al., "Image-to-Image Translation with Conditional Adversarial Networks," CVPR (2017); Jun-Yan Zhu et al., "Unpaired Image-to-Image Translation Using Cycle-Consistent Adversarial Networks," ICCV (2017). 6. Aliaksandr Siarohin et al., "First Order Motion Model for Image Animation," NeurIPS (2019); K. R. Prajwal et al., "A Lip Sync Expert Is All You Need for Speech to Lip Generation in the Wild," ACM Multimedia (2020). 7. Davide Cozzolino et al., "ID-Reveal: Identity-Aware DeepFake Video Detection," ICCV (2021). Chapter 3 1. Jonathan Ho, Ajay Jain and Pieter Abbeel, "Denoising Diffusion Probabilistic Models," NeurIPS (2020). 2. Robin Rombach et al., "High-Resolution Image Synthesis with Latent Diffusion Models," CVPR (2022). 3. Nataniel Ruiz et al., "DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation," CVPR (2023). 4. Chengyi Wang et al., "Neural Codec Language Models Are Zero-Shot Text to Speech Synthesizers" (VALL-E), arXiv:2301.02111 (2023). 5. Graphika, Deepfake It Till You Make It: Pro-Chinese Actors Promote AI-Generated Video Footage of Fictitious People (February 2023). 6. FBI Internet Crime Complaint Center, public service announcement on deepfakes in remote job interviews (June 2022). Chapter 4 1. Joel Frank et al., "Leveraging Frequency Analysis for Deep Fake Image Recognition," ICML (2020); Francesco Marra et al., "Do GANs Leave Artificial Fingerprints?" IEEE MIPR (2019). 2. Yuezun Li, Ming-Ching Chang and Siwei Lyu, "In Ictu Oculi: Exposing AI Created Fake Videos by Detecting Eye Blinking," IEEE WIFS (2018). 3. Umur Aybars Çiftçi, İlke Demir and Lijun Yin, "FakeCatcher: Detection of Synthetic Portrait Videos Using Biological Signals," IEEE TPAMI (2020). 4. Shruti Agarwal et al., "Protecting World Leaders Against Deep Fakes," CVPR Workshops (2019). 5. Andreas Rössler et al., "FaceForensics++: Learning to Detect Manipulated Facial Images," ICCV (2019); Brian Dolhansky et al., "The DeepFake Detection Challenge (DFDC) Dataset," arXiv:2006.07397 (2020). 6. Lingzhi Li et al., "Face X-Ray for More General Face Forgery Detection," CVPR (2020); Sheng-Yu Wang et al., "CNN-Generated Images Are Surprisingly Easy to Spot... for Now," CVPR (2020). 7. Utkarsh Ojha, Yuheng Li and Yong Jae Lee, "Towards Universal Fake Image Detectors That Generalize Across Generative Models," CVPR (2023); Riccardo Corvi et al., "On the Detection of Synthetic Images Generated by Diffusion Models," ICASSP (2023). 8. Zhendong Wang et al., "DIRE for Diffusion-Generated Image Detection," ICCV (2023). Chapter 5 1. Nuria Alina Chandra et al., "Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024," arXiv:2503.02857 (2025). 2. Nicholas Carlini and Hany Farid, "Evading Deepfake-Image Detectors with White- and Black-Box Attacks," CVPR Workshops (2020). 3. Nils C. Köbis, Barbora Doležalová and Ivan Soraperra, "Fooled Twice: People Cannot Detect Deepfakes but Think They Can," iScience 24, no. 11 (2021). 4. Kimberly T. Mai et al., "Warning: Humans Cannot Reliably Detect Speech Deepfakes," PLOS ONE 18, no. 8 (2023). 5. Matthew Groh et al., "Deepfake Detection by Human Crowds, Machines, and Machine-Informed Crowds," PNAS 119, no. 1 (2022). Chapter 6 1. Coalition for Content Provenance and Authenticity, C2PA Technical Specification, version 2.4 (2026). 2. Pierre Fernandez et al., "The Stable Signature: Rooting Watermarks in Latent Diffusion Models," ICCV (2023). 3. Xuandong Zhao et al., "Invisible Image Watermarks Are Provably Removable Using Generative AI," arXiv:2306.01953 (2023); Mehrdad Saberi et al., "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks," arXiv:2310.00076 (2023). 4. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 50; European Commission, Code of Practice on Transparency of AI-Generated Content (2026). Chapter 7 1. World Economic Forum, Global Risks Report 2024. 2. Federal Communications Commission, Declaratory Ruling on AI-generated voices under the Telephone Consumer Protection Act (February 2024), and forfeiture order against Steve Kramer (September 2024). 3. Felix M. Simon, Sacha Altay and Hugo Mercier, "Misinformation Reloaded? Fears About the Impact of Generative AI on Misinformation Are Overblown," Harvard Kennedy School Misinformation Review 4, no. 5 (2023). 4. Kaylyn Jackson Schiff, Daniel S. Schiff and Natália S. Bueno, "The Liar's Dividend: Can Politicians Claim Misinformation to Evade Accountability?" American Political Science Review (2025). 5. Cristian Vaccari and Andrew Chadwick, "Deepfakes and Disinformation: Exploring the Impact of Synthetic Political Video on Deception, Uncertainty, and Trust in News," Social Media + Society 6, no. 1 (2020). Chapter 8 1. Internet Watch Foundation, How AI Is Being Abused to Create Child Sexual Abuse Imagery (October 2023). 2. David Thiel, Identifying and Eliminating CSAM in Generative ML Training Data and Models (Stanford Internet Observatory, December 2023). 3. Center for Countering Digital Hate, research on sexualised images generated by Grok (January 2026). 4. TAKE IT DOWN Act, Public Law 119-12 (2025); Data (Use and Access) Act 2025, section 138; Directive (EU) 2024/1385 on combating violence against women and domestic violence. Chapter 9 1. Jon Roozenbeek, Sander van der Linden et al., "Psychological Inoculation Improves Resilience Against Misinformation on Social Media," Science Advances 8, no. 34 (2022). 2. Sam Wineburg and Sarah McGrew, "Lateral Reading and the Nature of Expertise: Reading Less and Learning More When Evaluating Digital Information," Teachers College Record 121, no. 11 (2019). Further Reading Robert Chesney and Danielle Keats Citron, "Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security," California Law Review (2019).** The foundational legal analysis, which introduced the liar's dividend and remains the best map of the harms and the limits of legal remedies. Britt Paris and Joan Donovan, Deepfakes and Cheap Fakes (Data & Society, 2019).** A short report arguing that the social context of manipulation matters more than its technical sophistication. A useful corrective to technology-centred accounts. Nina Schick, Deepfakes: The Coming Infocalypse (Twelve, 2020).** An accessible early account of synthetic media as a geopolitical problem, written before diffusion models arrived; read it for its framing of the information environment. Danielle Keats Citron, The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age (W. W. Norton, 2022).** Places sexual deepfakes within a wider argument about intimate privacy as a civil right. Hany Farid, Fake Photos (MIT Press, 2019).** A brief, practical introduction to image forensics by one of the field's founders, covering metadata, lighting, geometry and other techniques that remain relevant to synthetic images. Andreas Rössler et al., "FaceForensics++" (2019), and Nuria Alina Chandra et al., "Deepfake-Eval-2024" (2025). Read together, these two benchmark papers show how detection research is conducted and how far laboratory performance can fall in the wild. Coalition for Content Provenance and Authenticity, C2PA Explainer and technical specification (c2pa.org).** The primary documentation for Content Credentials, with an explainer written for non-specialists. WITNESS, Ticks or It Didn't Happen: Confronting Key Dilemmas in Authenticity Infrastructure for Multimedia (2019).** A human rights organisation's assessment of the risks provenance systems pose for vulnerable creators, still the clearest treatment of that tension. Kaylyn Jackson Schiff, Daniel S. Schiff and Natália S. Bueno, "The Liar's Dividend" (American Political Science Review, 2025). The strongest experimental evidence on whether false claims of fabrication help politicians escape scandal. Hashtags: #Deepfakes #SyntheticMedia #DeepfakeTechnology #DeepfakeDetection #ArtificialIntelligence #GenerativeAI #MachineLearning #DeepLearning #DigitalMediaForensics #MediaAuthentication #ContentAuthenticity #DigitalProvenance #ContentCredentials #C2PA #DigitalWatermarking #AIContentDetection #FaceSwapping #VoiceCloning #SyntheticVideo #DiffusionModels #GenerativeAdversarialNetworks #MediaManipulation #Misinformation #Disinformation #PoliticalDeepfakes #LiarDividend #DigitalTrust #AIRegulation #OnlineSafety #ResponsibleAI

Download the Book (PDF): Introduction Consider what happens when a twenty-three-year-old buys a bottle of wine in a shop. She hands the cashier a driving licence. The cashier glances at the photograph, glances at her face, finds the date of birth, does a little arithmetic, and hands the card back. The transaction needs one fact: that she is over the legal drinking age. To get it, she has shown a stranger her full name, her exact birth date, her home address, her licence number, her height, and sometimes her organ donor status. The cashier forgets most of it within a minute. Nothing is copied, nothing is stored, and the issuing authority never learns that she bought wine, or where, or when. Now consider the same check online. A website that sells wine, or hosts adult content, or runs a social network with a minimum age, must decide whether the person at the keyboard is old enough. The options have long been poor. The site can ask her to type a birth date, which proves nothing. It can ask her to upload a photograph of the licence, in which case a full copy of the document now sits on a server she knows nothing about, waiting for the breach that will eventually come. It can ask a third-party verification company to check her against a credit bureau, which then learns which sites she visits. Or it can let her "Sign in with Google" and trust whatever the account says, which adds one more entry to the record a single advertising company holds about her life. The physical check is crude, but it has three properties the digital check lacks. The evidence is in the holder's hands. The person checking can verify it without calling anyone. And the issuer is not told that the check happened. This booklet is about the attempt to give digital identity those same three properties, and to improve on the physical original by letting the holder reveal only the fact that matters. That attempt goes by several names: decentralized identity, self-sovereign identity, verifiable credentials, digital identity wallets. Behind the names sits one idea. The controlling idea The idea is this. Identity on the internet should not be an account that someone else holds about you. It should be a collection of signed statements, issued by whoever is genuinely authoritative for each fact, that you keep yourself and present as needed, disclosing no more than each situation requires, to a verifier who can check the signature without consulting the issuer. Your government is authoritative about your citizenship and your age. Your university is authoritative about your degree. Your employer is authoritative about your job. None of them needs to be told each time you prove one of these things to someone else, and none of them needs to sit in the middle of the conversation. The cryptography that makes this possible is not speculative. Digital signatures are decades old. The techniques for selective disclosure, which let a holder reveal one field of a signed document while keeping the rest hidden and still prove the signature is genuine, have been understood since the 1980s and 1990s and are now standardised. Zero-knowledge proofs that can demonstrate "over eighteen" without revealing a birth date have moved from academic papers to open-source libraries maintained by large technology companies. The World Wide Web Consortium published version 2.0 of its Verifiable Credentials Data Model as a Recommendation in 2025. The European Union has legislated that every member state must offer its citizens a digital identity wallet by the end of 2026. Phones from Apple and Google already carry government identity documents that travellers present at American airport checkpoints. So the argument of this booklet is not that the technology is coming. It has largely arrived. The argument is that the technology is the easy part, and that whether decentralized identity delivers what its advocates promised depends on a set of governance choices that are being made now, often quietly, in standards meetings, procurement contracts, and implementing regulations. Who is allowed to issue credentials that verifiers will trust? Who decides which verifiers may ask for which facts? Who builds the wallet, and can the wallet maker see what the holder does with it? Does the verifier ever have to contact the issuer, and if so, does the issuer learn where the credential was used? What happens to the person who loses a phone, or never owned one? The same cryptographic building blocks can produce a system that gives individuals more control over their information than they have ever had, or one that makes every identity check machine-readable, logged, and linkable in ways paper never allowed. The difference lies in design decisions that a non-specialist can understand, and should. What "self-sovereign" means and does not mean The phrase self-sovereign identity was popularised by the technologist Christopher Allen in a 2016 essay, "The Path to Self-Sovereign Identity", which set out ten principles: existence, control, access, transparency, persistence, portability, interoperability, consent, minimalisation, and protection. The phrase has done useful work and caused some confusion. It does not mean that you can declare yourself to be anyone you like and have the world accept it. A credential is only as good as its issuer, and the issuer of a passport is still a state. What self-sovereignty properly refers to is the position of the individual in the flow of information: the holder, not a platform, stands between issuer and verifier, and nothing moves without the holder's action. The word decentralized deserves similar care. Early enthusiasts assumed that decentralized identity required a blockchain, and a generation of projects anchored identifiers on public or permissioned ledgers. Most of the systems now reaching ordinary people use no blockchain at all. What is decentralized is not the storage of identity data, which for the most part stays on the holder's device, but the act of verification: there is no central database that must be queried every time someone proves who they are. That distinction runs through the whole of this booklet, and it explains why several of the best-known early projects have faded while the underlying approach has spread. How the booklet proceeds The first chapter explains how online identity came to be organised around accounts, and why the arrangement that made "Sign in with Google" so convenient also concentrated a remarkable amount of knowledge and power in a few companies. It introduces the principles Kim Cameron of Microsoft set out in 2005 as the "Laws of Identity", which still provide the cleanest test for any identity system. The second chapter deals with decentralized identifiers, or DIDs, the addressing layer that lets a party publish public keys without registering with a central authority. It covers what a DID is, how it is resolved, why there are so many competing "methods", and why the blockchain-based ones have largely given way to simpler alternatives. The third chapter explains verifiable credentials: the three-party model of issuer, holder and verifier, what is actually signed, the competing formats, and how a credential can be revoked without the issuer learning where it is used. The fourth chapter is the technical heart of the booklet. It explains selective disclosure and zero-knowledge proofs in plain terms, and shows why the obvious method of hiding fields leaves a subtler privacy problem, linkability, that only more sophisticated cryptography solves. The fifth chapter turns to the wallet, the software and hardware that holds credentials and keys, and to the hard practical questions of device loss, recovery, delegation and the commercial position of the companies that make phones. The sixth chapter addresses trust: how a verifier knows that an issuer is legitimate, why every working system relies on some form of registry or trust list, and what that means for the claim of decentralization. The seventh chapter surveys the deployments that matter as of late 2026, from the European Digital Identity Wallet to mobile driving licences in the United States, age assurance regimes in the United Kingdom and Australia, and credentials for education and business. The eighth chapter examines how these systems fail: over-asking verifiers, surveillance through revocation checks, wallet gatekeeping, exclusion, coercion, and the political backlash that greets any proposal resembling a national identity card. The conclusion argues what follows from all of this for policymakers, builders and citizens. Readers do not need a background in cryptography or computer science. Where a mechanism matters, it is explained from the ground up with concrete examples. Where a claim depends on a specific standard, regulation or deployment, the source is named. The aim throughout is to equip the reader to ask the right questions of any digital identity scheme put in front of them, because a great many such schemes are about to be. Chapter 1: The Account Problem In 1993 The New Yorker published a cartoon by Peter Steiner in which one dog, seated at a computer, tells another: "On the Internet, nobody knows you're a dog." The joke became the most reproduced cartoon in the magazine's history because it captured a design fact. The internet's core protocols move packets between machines. They say nothing about the people operating those machines. Identity was left out of the architecture, and every service that needed to know who it was dealing with had to invent its own answer. The answer nearly every service chose was the account. You arrive, you pick a username, you choose a password, and the service creates a record. From then on, you are whoever that record says you are. The account is a remarkably flexible structure, and it carried the commercial internet for thirty years. It is also the root of most of what is wrong with online identity today, and understanding why is the first step to understanding what decentralized identity tries to change. Identity as something held about you An account has three properties worth naming. First, it is held by the service, not by you. The record lives in the service's database, and you interact with it only through the service's interfaces. Second, it is local. Your account with a bank says nothing to your account with a retailer, and neither can vouch for anything to a third party except by building a bespoke data-sharing arrangement. Third, it accumulates. Every action you take while logged in can be attached to the record, and the record persists for as long as the service chooses to keep it. The first property means that identity is something done to you rather than something you possess. If the service closes your account, by error or policy, you lose not just access but the history and reputation attached to it. People locked out of long-held email or social media accounts often discover that there is no human to appeal to and no way to take their identity elsewhere, because it was never theirs to take. The second property, locality, produced the password problem. A typical internet user holds dozens or hundreds of accounts, each with its own credential. People reuse passwords because they cannot remember a hundred random strings, and attackers exploit that reuse through "credential stuffing", trying usernames and passwords leaked from one site against many others. Password managers and, more recently, passkeys built on the FIDO2 standards have made genuine progress here. A passkey replaces the shared secret with a key pair held on the user's device, so there is nothing reusable for a server to leak. But passkeys solve authentication, the question of whether this is the same person who created the account. They do not solve the harder question of what is true about that person: how old she is, where she lives, whether she holds a licence or a degree. The third property, accumulation, is what made identity a business. Every account is a container into which behavioural data can be poured. Combined with locality, it also produced an incentive to verify facts expensively and repeatedly. Each bank you join runs its own know-your-customer checks. Each landlord asks for the same documents. Each employer checks the same qualifications. And each of them keeps a copy. Follow one ordinary life event to see what this means in practice. A young doctor moves to a new city for a hospital post. She opens a bank account, and the bank asks for a passport and a utility bill, photographs them, and runs her details through a credit reference agency. She rents a flat, and the letting agent asks for the same passport, payslips, an employer's reference and the bank statements she has just begun to accumulate. The hospital asks for her passport again, her medical degree, her registration with the medical regulator, and a criminal records check. She signs up with a local doctor's surgery, a gym, a mobile phone contract and a car-sharing service, each of which asks for some subset of the same facts and each of which, if it checks them at all, does so by taking a copy. By the end of her first month, images of her passport sit on perhaps half a dozen servers belonging to organisations she will never think about again, alongside her address, her salary and her date of birth. Each of those copies is a liability for the organisation that holds it and a risk for her. None of them is needed after the moment of checking. The letting agent needed to know that she had a right to rent and could pay; it did not need to keep a passport scan for six years. But the account model has no way to express "I checked this and confirmed it" except by keeping the evidence, because the evidence is the only thing the agent can show an auditor or a regulator later. A signed confirmation from the issuer, which the agent could verify and retain in place of the document, would serve the auditor equally well. That possibility did not exist in a form ordinary organisations could use. The cost of keeping copies is measured in breaches. The 2017 compromise of the American credit bureau Equifax exposed personal information, including Social Security numbers and birth dates, of roughly 147 million people. Equifax was not a service most of those people had chosen to do business with; it held their data because the credit system needed someone to. The lesson of breaches on this scale is not that one company was careless, although it was. It is that a system in which every verifier must hold its own copy of identity documents guarantees that those documents will leak, because the number of places they are stored grows with every transaction. The federated compromise The industry's first serious response to account sprawl was federation. Instead of every site holding its own password, a small number of "identity providers" would authenticate users and vouch for them to other sites, the "relying parties". The standards that made this practical at internet scale were OAuth 2.0, published by the Internet Engineering Task Force in 2012, and OpenID Connect, a layer on top of OAuth finalised by the OpenID Foundation in 2014. When you click "Sign in with Google", "Continue with Facebook" or "Sign in with Apple", you are using these protocols. The user experience is good. One click replaces a registration form. The relying party gets a verified email address and perhaps a name and profile picture. The identity provider takes on the burden of securing passwords and detecting fraud, which large providers do better than small sites. For millions of services, federation was a sensible trade. But look at the information flow. When you sign into a news site with Google, your browser is redirected to Google, Google authenticates you, and Google sends a signed token back to the news site. Google is in the middle of the transaction. It knows that you, specifically, logged into that news site at that moment. Multiply that across every site where you use the same login and the identity provider holds a log of a large part of your online life. The major providers have published privacy policies describing what they do and do not do with this information, and Apple made "Sign in with Apple" partly a privacy pitch, offering relay email addresses that hide the user's real one. The structural point remains: in federated identity, the issuer of the identity is present at every use of it. The second problem is that federated providers vouch for very little. Google can tell a relying party that this person controls a particular Gmail address. It generally cannot tell the relying party that this person is a citizen of France, holds a valid driving licence, or is over eighteen, because Google is not authoritative for any of those facts. Social logins thus combine maximum observability with minimum assurance. They are excellent at saying "this is the same person who was here last week" and poor at saying anything a bank, a pharmacy or an alcohol retailer actually needs. The third problem became public in 2018, when it emerged that the political consultancy Cambridge Analytica had obtained data from up to 87 million Facebook users, most of whom had never interacted with the app that collected it. The mechanism was Facebook's platform interface, the same family of permissions by which apps using Facebook Login asked for access to profile data and, at the time, to data about users' friends. Facebook tightened those permissions substantially afterwards. The episode nonetheless demonstrated how consent screens presented during a login flow can authorise data transfers that users neither read nor understood. There is a fourth problem, which rarely makes headlines but affects many people: dependency. When a person uses one social login for dozens of services, the identity provider's account becomes a single point of failure for all of them. If it is suspended, because an automated system flags it, because its owner forgot a recovery phone number, or because of a dispute over content, access to every connected service goes with it. The relying parties typically have no independent way to re-establish who the person is, because they never knew; they knew only that the identity provider vouched for her. Losing the account means losing a slice of one's digital life, with little recourse, decided by a company that was never authoritative for the person's identity in the first place. The age verification problem shows how poorly federation handles facts about people. Online services increasingly face legal duties to keep children away from certain content. A social login cannot help much, because the age a user typed when creating a Google or Facebook account years ago is unverified. So a parallel industry grew up to verify ages and identities: companies that take a photograph of an identity document and a selfie, compare them, check the document for signs of forgery, and report a result to the service. They perform a real function, and the better ones delete images promptly. But the model requires the holder to hand a full image of her identity document to a company she did not choose, on the instruction of a service she may be using for a few minutes, and to trust that both will treat it properly. The cashier at the wine shop asked for less. Federation, in short, solved the password problem by creating a few large intermediaries, and those intermediaries became the default answer to "who are you online" despite being authoritative for almost nothing except their own accounts. Cameron's laws The clearest diagnosis of these problems came early, from inside one of the companies that had tried and failed to fix them. In the late 1990s and early 2000s Microsoft promoted Passport, a single sign-on service intended to become the login for the whole web. It drew sharp criticism from privacy advocates and regulators for placing Microsoft at the centre of every transaction, and it never achieved broad adoption outside Microsoft's own properties. Kim Cameron, Microsoft's chief identity architect, drew the lessons in a 2005 paper called "The Laws of Identity". Cameron argued that any identity system that violated certain principles would eventually fail, either because users rejected it or because it produced harms that forced its abandonment. He listed seven: 1. User control and consent. Systems must reveal information identifying a user only with the user's consent. 1. Minimal disclosure for a constrained use. The solution that discloses the least identifying information and best limits its use is the most stable long-term solution. 2. Justifiable parties. Identity information should be disclosed only to parties having a necessary and justifiable place in a given identity relationship. 3. Directed identity. A system should support both public identifiers, for entities that want to be found, and private, unidirectional identifiers, so that a user's different relationships cannot be correlated. 4. Pluralism of operators and technologies. A universal system must allow multiple identity technologies run by multiple providers to work together. 5. Human integration. The human user must be treated as a component of the system, with unambiguous communication protecting against attack. 6. Consistent experience across contexts. Users should see a simple, consistent way of choosing among identities while the technical details differ underneath. Twenty years later, the laws remain the best checklist available. Federated social login violates the third law directly: the identity provider has no justifiable place in a transaction between a user and a news site, yet it is present every time. Uploading a photograph of a passport to prove age violates the second. A single national identifier used across health, tax, banking and travel violates the fourth, because it makes every one of those relationships trivially linkable. Cameron's own attempt to build a system honouring the laws, a desktop component called CardSpace that presented identities as "information cards", shipped with Windows Vista in 2007 and was discontinued in 2011. It failed for familiar reasons: too few relying parties adopted it, the user experience was confusing, and the web was moving to mobile devices that CardSpace did not serve. The laws outlived the product. Much of what follows in this booklet can be read as a second attempt to build what Cameron described, with better cryptography and a different distribution channel, the smartphone. What a better arrangement requires Put the failures side by side and the requirements for something better almost write themselves. The holder, not an intermediary, should carry the evidence of her identity, so that no third party is present at each use. The evidence should come from whoever is authoritative for each fact, not from whichever company happens to run her email. A verifier should be able to check the evidence without asking the issuer, so that the issuer cannot compile a log of where the holder goes. The holder should be able to reveal only the specific facts needed, rather than a whole document. And different verifiers should not be able to compare notes and discover that they are dealing with the same person, unless that is the purpose of the interaction. A paper driving licence already satisfies the first three. The holder carries it; the state is authoritative for it; the cashier checks it without phoning the licensing authority. It fails the fourth and fifth, because it shows every field and carries a unique number. A digital equivalent can, in principle, satisfy all five. That is the design target. The building blocks are a way for each party to have a cryptographic key that others can find and trust, a way for issuers to sign statements about holders, a way for holders to keep those statements and present them, and a way for verifiers to check them. The next chapter begins with the first of these: how a party, whether an issuer, a holder or a verifier, can publish a public key without registering it with a central authority. That is the job of the decentralized identifier. Before moving on, one point needs stressing because it is often lost in enthusiasm. Nothing in the critique above argues against institutions. Governments, universities, banks and employers remain the sources of nearly every fact worth proving. Decentralized identity does not route around them. It changes their position in the flow of information, from intermediaries consulted at every transaction to issuers who sign once and then step aside. Whether that change actually happens in a given deployment, or whether the issuer quietly reinserts itself through revocation checks, analytics or mandatory online verification, is the question to keep asking through every chapter that follows. Chapter 2: Identifiers Without Registrars Every system of signed statements rests on one question: how does the person checking a signature know which public key to use? A signature is produced with a private key that only the signer holds and checked with a matching public key that anyone can hold. If a verifier uses the wrong public key, a forger can sign anything. So the practical problem of digital identity begins with key distribution: binding a name to a key in a way others can rely on. The web already has an answer to this problem, and it is worth understanding before looking at the alternative. When your browser connects to your bank, the bank presents a certificate that binds its domain name to a public key. That certificate is signed by a certificate authority, whose own key is signed by a root authority, whose key ships inside your browser or operating system. The system, known as public key infrastructure or PKI, works well enough to secure trillions of dollars of commerce. But it is hierarchical by design. To get a certificate you must control a domain name, which you rent from a registrar operating under rules set by ICANN, and you must satisfy a certificate authority that the browser vendors have chosen to trust. Individuals rarely hold such certificates, and nothing in the system gives a person a key-backed identifier that they control independently of a registrar. Decentralized identifiers were designed to fill that gap. What a DID is A decentralized identifier, or DID, is a text string that looks like this: did:example:123456789abcdefghi It has three parts. The prefix did says what kind of identifier it is, in the same way that https or mailto begins a web address or an email link. The middle part, here example, names the DID method, the rules by which this particular kind of DID is created, looked up, updated and deactivated. The final part is a method-specific identifier, unique within that method. The point of a DID is that it can be resolved to a small document, the DID document, which contains public keys and, optionally, addresses of services associated with the identifier. A verifier that receives a statement signed by did:example:123... resolves the DID, reads the public keys in the document, and uses the appropriate one to check the signature. The DID document also says which keys may be used for which purposes: one key might be authorised for authentication, another for signing credentials, another for key agreement in encrypted messaging. The specification that defines this structure, Decentralized Identifiers (DIDs) v1.0, became a W3C Recommendation in July 2022. Its approval was contested. Google, Apple and Mozilla raised formal objections, arguing among other things that the specification allowed a proliferation of incompatible methods without defining which ones implementations should support, and that some methods relied on blockchains with environmental and governance problems. The W3C Director overruled the objections and the specification proceeded, but the disagreement foreshadowed a real weakness. A DID on its own tells you almost nothing about interoperability, because everything depends on the method. What distinguishes a DID from an ordinary identifier is control. Whoever holds the private key associated with a DID can prove control of it, and, depending on the method, can update its document, rotate its keys or deactivate it, without asking a registrar's permission. No one issues you a DID. You generate one. That is the sense in which DIDs are decentralized, and it is also why they are attractive as the identifiers of the parties in a credential system: an issuer can publish keys under a DID, and so, if needed, can a holder. A tour of methods The DID method is where the abstractions meet engineering, and where most of the arguments happen. The W3C maintains a registry of method names, and well over a hundred have been registered. Most will never be used at scale. A handful matter, and they fall into a few families that illustrate the design trade-offs clearly. Self-contained methods. The simplest, did:key, encodes a public key directly into the identifier. To resolve it, a verifier decodes the string and constructs the DID document mechanically; no network lookup is needed. This is cheap, private and instant. It is also static. Because the identifier is the key, there is no way to rotate the key without changing the identifier, and no way to deactivate it. did:key suits short-lived uses, such as a fresh identifier a holder's wallet generates for a single interaction, and testing. A related method, did:jwk, does the same with a different encoding. Web-anchored methods. did:web maps a DID onto an ordinary web domain. The identifier did:web:example.com resolves to a DID document fetched over HTTPS from a well-known path on example.com. This method concedes the main point of decentralization, since control of the identifier depends on control of the domain, which depends on the domain registrar and the certificate authority system. In exchange it is trivial to deploy, uses infrastructure every organisation already understands, and lets keys be rotated by editing a file. For institutional issuers, a university, a government agency or a company, this is often exactly the right trade. Their authority is already expressed through their domain, and a credential signed by a key published at their domain inherits that authority. did:web has a weakness: the history of a document is not preserved, so a verifier checking an old signature after a key rotation may not be able to tell which key was valid at the time unless the issuer keeps careful records. Newer methods such as did:webvh (originally proposed as "did:tdw", for trust DID web) add a verifiable history log to address this. Ledger-anchored methods. The early decentralized identity movement assumed that identifiers needed a shared, tamper-evident registry that no single party controlled, and blockchains seemed to provide one. Methods such as did:sov (on the Sovrin network, built on Hyperledger Indy), did:ion (on Bitcoin, via a layer called Sidetree developed largely by Microsoft), did:ethr (on Ethereum) and did:cheqd (on a Cosmos-based network) anchor DID documents or their update histories in a ledger. Resolution then means reading the ledger. The benefits are a public, ordered history of key changes and independence from domain names. The costs are dependence on the ledger's continued operation, transaction fees or governance tokens, latency, and the burden of running or trusting a node. A worked example makes the web-anchored case concrete. Suppose a university's registrar's office decides to issue digital degree credentials and publishes its identifier as did:web:registrar.example-university.edu. Under the method's rules, a verifier resolves this by converting it into a web address, https://registrar.example-university.edu/.well-known/did.json, and fetching that file. The file is a short JSON document. It repeats the DID as its id. It lists one or more verification methods, each with its own identifier such as #key-2026, a type naming the algorithm, and the public key itself. It then says which of those keys may be used for which purposes, listing #key-2026 under assertionMethod, the relationship that covers signing credentials. When a graduate later presents a degree credential, its proof names did:web:registrar.example-university.edu#key-2026 as the signing key. The verifier fetches the document, finds the key, checks that it is authorised for assertions, and verifies the signature. Now suppose the university rotates its key at the start of 2027, as good practice requires, and publishes #key-2027 while removing #key-2026. A graduate presenting a degree signed in 2026 now has a problem: the verifier fetches the current document, does not find the old key, and cannot verify the signature. The university can avoid this by leaving old keys in the document with a note of when they were retired, or by using a method that preserves history. This is not an exotic edge case. It is the normal lifecycle of any signing key, and every credential system has to handle it. Paper diplomas never faced it, because a seal does not expire. The engineering of identifiers is largely the engineering of change over time. Peer methods. did:peer is designed for identifiers that only two parties, or a small group, ever need to resolve. The DID document is exchanged directly between the parties when their relationship begins and never published. This honours Cameron's fourth law, directed identity: a person can use a different did:peer with every counterpart, and no outside observer can link them. The retreat from the ledger The story of ledger-anchored identifiers is instructive because it shows how the field learned what decentralization actually needed to mean. Sovrin was the flagship of the first wave. Launched in 2017 as a public permissioned network run by a non-profit foundation, with nodes operated by volunteer "stewards" around the world, it was designed specifically for self-sovereign identity, and the Hyperledger Indy codebase on which it ran became the foundation of many early pilots. Yet the network struggled to find a sustainable model. In October 2024 the foundation announced that the MainNet ledger would likely shut down, citing declining use, regulatory uncertainty, strained resources and thin participation from its stewards; the foundation was dissolved by the State of Utah in May 2025, and the ledger survives as a read-only archive maintained by the company Trinsic. Microsoft's trajectory was similar. Its ION network anchored DID operations into Bitcoin transactions, and early versions of its verifiable credentials service, now called Microsoft Entra Verified ID, used did:ion identifiers. From mid-2022 new customers defaulted to did:web, and in December 2023 Microsoft removed the option of did:ion entirely, leaving did:web as the only supported method. These were not failures of cryptography. They reflected a growing recognition that the problem a ledger solves is mostly not the problem identity systems have. Ledgers provide global ordering and censorship resistance for state that many mutually distrustful parties must agree on, such as who owns which coins. But the DID documents of issuers are not like that. A university's signing key needs to be discoverable and authentic, and the university is the only party entitled to change it. A website it controls does this adequately, and the trust that verifiers place in the university's credentials comes from knowing that it is a real university, which no ledger can tell them. The DID documents of individuals, meanwhile, mostly do not need to be published anywhere at all, and publishing them on an immutable public ledger creates a permanent correlation handle, which is the opposite of what privacy requires. Personal data on a blockchain is also awkward to reconcile with the right to erasure under the European Union's General Data Protection Regulation. The field's practice has therefore converged on a division of labour. Institutional issuers use web-anchored identifiers, X.509 certificates of the traditional PKI kind, or both. Holders use ephemeral or pairwise keys that are never published. Ledger-based methods persist in particular communities, and some ledger operators have reorganised around commercial services, but they are no longer the default. The large government programmes described later in this booklet, including the European wallet and American mobile driving licences, rely on conventional certificate hierarchies for issuer keys. Do we need DIDs at all? That convergence raises a fair question. If issuers use web domains and certificates, and holders use one-time keys, what work is the DID standard doing? Part of the answer is that DIDs provide a uniform way to refer to a key, whatever infrastructure stands behind it. A verifier that understands DID resolution can handle an issuer whose keys are published at a domain, one whose keys are on a ledger, and a holder whose key is embedded in the identifier itself, all through the same interface. That uniformity has value in ecosystems with many kinds of participant, such as education, where thousands of institutions with very different technical capabilities issue credentials. Part of the answer is also that the DID standard pushed the field to separate three things that PKI tends to bundle: the identifier, the keys, and the authority. A DID says "here is a stable name and here are the keys currently associated with it". It does not say "and this name belongs to a legitimate bank". That last statement, about authority, has to come from somewhere else, and Chapter 6 deals with where. Keeping it separate means that the identifier layer can be decentralized while the authority layer remains as centralized, federated or plural as the use case requires. But it is also true that some of the most important deployments use no DIDs at all. The ISO standard for mobile driving licences, the basis for digital IDs in Apple and Google wallets, relies on X.509 certificates for issuers and device keys for holders, and does not mention DIDs. The European wallet's architecture permits DIDs in some contexts but anchors trust in certificates and trusted lists. In practice, then, "decentralized identity" increasingly describes an approach rather than a specific technology: holder-held, issuer-signed, verifier-checked credentials, with identifiers chosen to fit the situation. The DID is one tool for that approach, best suited where many independent parties need a common way to name keys without a common certificate authority. There is one more consideration that bears on the holder rather than the issuer. Early descriptions of self-sovereign identity imagined each person with a single, lifelong DID, published on a ledger, to which every credential would be issued. It is easy to see the appeal: one identifier, owned by the person, portable across every institution. It is also easy to see the danger, once the matter is put in Cameron's terms. A single identifier attached to every credential and presented to every verifier is a universal correlation key, more powerful than a national identity number because it is cryptographically verifiable. Anyone who saw it in two places would know they had seen the same person. The field has moved decisively away from that picture. In current designs the holder's key is generated per credential, or per batch of credentials, inside the wallet, and is never published. Where a holder needs a persistent relationship with a particular party, such as a bank she returns to repeatedly, she can use a pairwise identifier unique to that relationship. The identifier that the bank recognises means nothing to anyone else. This is Cameron's directed identity implemented in key management, and it suggests a better way to describe the holder's side of decentralized identity: it is about keys rather than identifiers. The person is not reduced to a string. She is the party able to prove control of whichever key a given relationship requires. What matters for the reader is a simple test. When a system claims to be decentralized, ask what must be consulted when a credential is verified. If the answer is "a public key the verifier already trusts, or can fetch from the issuer's domain without revealing which holder it is checking", the system is decentralized in the sense that protects privacy. If the answer is "a central service that receives the holder's identifier", it is not, whatever its identifiers look like. The next chapter turns to what those keys are used to sign. Chapter 3: Claims That Carry Their Own Proof A university degree certificate is a piece of heavy paper with a crest, a signature, perhaps an embossed seal. Its value lies in being hard to forge and in the fact that employers recognise the university's name. When a hiring manager doubts it, the remedy is to contact the university's registry and ask, which takes days and involves a human on each end. Degree fraud persists because that check is tedious enough that many employers skip it. A verifiable credential is the same kind of statement, made checkable by machine in milliseconds, without contacting the issuer. It is the central object in decentralized identity, and its structure is simple once the vocabulary is set aside. Issuer, holder, verifier Every credential system involves three roles. The issuer makes a statement about a subject: this person holds a Bachelor of Science; this person was born on 14 March 2001; this company is registered under number 12345. The holder receives the signed statement and keeps it, usually in software called a wallet. The verifier asks the holder for proof of some fact, receives a presentation derived from the credential, and checks it. The arrangement is often drawn as a triangle, but the important feature is the absence of one edge. Information flows from issuer to holder once, at issuance, and from holder to verifier at each presentation. In the ideal design nothing flows from verifier to issuer. The verifier does not need to tell the issuer what it is checking, because the signature on the credential, checked against the issuer's public key, establishes its authenticity on its own. A credential has four parts in almost every format. There is metadata: who issued it, when, when it expires, what type of credential it is. There are claims: the actual statements about the subject, such as a name, a birth date, a degree title. There is a proof: the issuer's digital signature over the metadata and claims, which allows any alteration to be detected. And there is usually some form of holder binding: a link between the credential and a key that only the legitimate holder controls. Holder binding deserves attention because it is the feature that makes a credential more than a signed document. A signed PDF of a degree can be copied and forwarded by anyone. If it were the only proof, a stolen copy would be as good as the original. A credential with holder binding contains, among its signed contents, a public key belonging to the holder, typically generated inside the holder's phone. When the holder presents the credential, the wallet also signs a fresh challenge from the verifier with the corresponding private key. The verifier checks two signatures: the issuer's signature on the credential, proving it is genuine, and the holder's signature on the challenge, proving that whoever is presenting it controls the key it was issued to. A copied credential without the private key is useless. The challenge, which the verifier generates freshly for each request, prevents an eavesdropper from replaying an old presentation. The private key in a well-built wallet never leaves a dedicated security chip, the secure enclave or secure element present in modern phones. Cloning the credential therefore requires stealing the phone and defeating its lock, not merely copying a file. This is a significant improvement on photographs of identity documents, which, once uploaded, can be reused by anyone who obtains them. It helps to see the shape of an actual credential, stripped of encoding details. Imagine a government issues a person-identification credential to a citizen. Its contents might read, in plain terms: · Type: person identification data · Issuer: the national identity authority, identified by a key published through a government trust list · Issued: 2 February 2026; valid until 2 February 2031 · Subject's given name, family name, date of birth, place of birth, nationality · Derived claims: age over 16, age over 18, age over 21 · Holder key: a public key generated in the citizen's phone · Status reference: position 48,211 in a published revocation list · Signature by the issuer over all of the above Two features of this sketch reveal the influence of privacy thinking. The derived age claims exist so that a verifier who needs only "over eighteen" can be given that claim alone, without the birth date. And the status reference points into a large list rather than to an individual record, for reasons explained below. Both features are design choices, and a credential lacking them would still be a credential. It would simply leak more. Three formats, one idea The idea of a verifiable credential is simple. Its standardisation has been anything but, and anyone encountering the field quickly meets a confusing set of acronyms. They resolve into three main families, plus one historically important outlier. Table 1 summarises them. Table 1. Principal verifiable credential formats as of 2026. Format Encoding Selective disclosure Standards body Main deployments W3C VC Data Model 2.0 JSON-LD, secured by Data Integrity or JOSE/COSE Via add-on cryptosuites (e.g. BBS, ECDSA-SD) W3C Education, supply chain, some public sector SD-JWT VC JSON Web Token with salted digests Built in (salted hashes) IETF EU wallet (alongside mdoc), enterprise ISO mdoc (mDL) CBOR with COSE signatures Built in (salted hashes) ISO/IEC 18013-5 and -7 Mobile driving licences, Apple and Google wallets, EU wallet AnonCreds JSON with CL signatures Built in, with unlinkability Hyperledger open-source community Early SSI pilots (Indy/Aries ecosystem) The W3C Verifiable Credentials Data Model is the oldest of the general-purpose formats. Version 1.0 became a W3C Recommendation in 2019 and version 2.0 in May 2025, alongside companion specifications for how credentials are secured. The data model uses JSON-LD, a way of writing JSON in which every term is linked to a published vocabulary, so that a "degree" in one university's credential means the same thing as a "degree" in another's. That semantic precision is valuable in fields like education and supply chains, where credentials from thousands of issuers need to be compared. It is also a source of complexity, since processing JSON-LD correctly requires fetching or caching the vocabularies, and early implementations stumbled over subtle canonicalisation issues. Version 2.0 allows credentials to be secured either with "Data Integrity" proofs embedded in the JSON or with the JOSE and COSE envelope formats used elsewhere on the web. SD-JWT comes from the IETF's OAuth working group and builds on the JSON Web Token, a compact signed token format that most web developers already handle daily in login systems. Its core specification, Selective Disclosure for JSON Web Tokens, was published as RFC 9901 in November 2025. A companion specification, SD-JWT VC, defines how to use the format for verifiable credentials. Its appeal is familiarity: the tools and libraries exist, and the mechanism for selective disclosure, described in the next chapter, is simple to implement. ISO mdoc began as the format for mobile driving licences. ISO/IEC 18013-5, published in 2021, specified how a licence on a phone could be presented in person, over Bluetooth or NFC, to a reader at a traffic stop or a security checkpoint. A later part, 18013-7, extended it to presentation over the internet. The format uses CBOR, a compact binary encoding, and the COSE signature format. Because it was designed by and for driver licensing authorities, mdoc has the strongest government backing of any format. It is the basis for the identity documents in Apple Wallet and Google Wallet, and the European wallet requires support for it alongside SD-JWT VC. Despite its origins, the format is general: a "document type" can be defined for any credential, not only licences. AnonCreds, the outlier, was the credential format of the Hyperledger Indy ecosystem. It used Camenisch-Lysyanskaya signatures, a scheme that supports not only selective disclosure but genuine unlinkability and proofs about values, such as "over eighteen", without revealing them. It was cryptographically the most sophisticated of the early formats and remains in use, but its dependence on a ledger for publishing schemas and keys, and its reliance on cryptography not approved by bodies like NIST, kept it out of the large government programmes. What unites the formats is more important than what divides them. All bind claims to an issuer's signature. All support holder binding. All provide, or can be extended to provide, selective disclosure. The differences lie in encoding, in which institutions back them, and in how far their privacy properties go. The practical result is that wallets and verifiers increasingly support several formats, and the protocol layer, discussed in Chapter 5, negotiates which one to use. A credential format is only half of what verifiers need. The other half is shared meaning. If one university's credential calls a field degreeName and another's calls it qualificationTitle, or one encodes classification as "2:1" and another as "Upper Second", a verifier processing thousands of credentials must map them all. The W3C approach puts this mapping into published vocabularies; mdoc and SD-JWT VC rely on credential types defined by communities of issuers, such as the driving licence authorities who defined the mDL data elements, or the European Commission's definition of person identification data for the EU wallet. Either way, interoperability depends on issuers agreeing on what they are saying, not just on how they sign it. In practice, sector-by-sector agreements on credential types, such as the education community's work on standard achievement and degree formats, have mattered as much to adoption as any cryptographic standard. To see the whole sequence in one case, follow a degree credential from issuance to use. A graduate finishes her course. The university's student records system generates a credential stating her name, the degree awarded, the date of conferral and the classification, and signs it with the registrar's key. She receives it in her wallet by scanning a QR code on the university portal after logging in with her student account; the wallet generates a holder key and the credential is bound to it. Two years later, she applies for a job abroad. The employer's applicant tracking system asks for proof of a degree in a relevant discipline. Her wallet shows her the request; she approves sharing the degree title, the institution and the conferral date, but not her classification, which the employer did not ask for. The employer's system checks the university's signature against a key it finds through the national register of accredited institutions, checks the status list to confirm the degree has not been rescinded, and records the result. No one at the university is contacted, no transcript is posted, no fee is paid, and no copy of a paper certificate is scanned and stored. Verification that used to take days takes seconds, and the employer ends up holding less data than it would have under the paper process. Revocation without surveillance A paper credential, once issued, cannot be recalled except by physically confiscating it. A digital credential should be revocable: a licence can be suspended, an employee can leave, a phone can be stolen. But revocation sits awkwardly with the promise that verifiers need not contact issuers. If a verifier must ask "is credential 48,211 still valid?", the issuer learns that credential 48,211 is being used, and by whom. There are three main approaches, each with a different balance of freshness and privacy. The first is short-lived credentials. Instead of a five-year credential that might need revoking, the issuer provides credentials valid for days or weeks and the wallet refreshes them automatically. If the underlying right is withdrawn, the issuer simply stops refreshing. Verifiers check the expiry date and nothing else. The cost is that the wallet must contact the issuer periodically, which reveals that the holder is still active but not where the credential is used. The second is status lists. The issuer publishes a long list of bits, one per credential, where a set bit means "revoked" or "suspended". Each credential carries its own position in the list. A verifier downloads the entire list, which compresses to a small file because nearly all the bits are zero, and checks the relevant position locally. Because every verifier downloads the same list, the issuer cannot tell which credential any particular verifier is interested in. Herd privacy depends on the list being large and on credentials being assigned to positions randomly, so that a list position reveals nothing about issuance order. The W3C published a Bitstring Status List specification as a Recommendation in 2025, and the IETF has a parallel Token Status List design used with SD-JWT and mdoc credentials. The third approach is the one to watch for: online status checks, in which the verifier queries the issuer, or a service on the issuer's behalf, about a specific credential. This is the most current method and the worst for privacy, because it reinstates the issuer as an observer of every use. Some deployments of mobile driving licences have included "server retrieval" modes in which the verifier fetches data directly from the issuer, and civil liberties organisations, including the American Civil Liberties Union, have warned that such modes could turn a licence into a tracking device. Whether a system uses status lists or online lookups is one of the most consequential and least visible choices a deployment makes. Revocation also raises a quieter issue. A status list must be hosted somewhere, and its host sees the network addresses of everyone who downloads it. Verifiers can cache lists and fetch them on a schedule rather than at each check, which breaks the connection between a download and a particular presentation. Careful designs specify such caching. Careless ones do not. What credentials do not solve A verifiable credential proves that an issuer said something and that the presenter is the person the issuer said it to. It does not prove that the issuer was right. A credential issued on the basis of a forged birth certificate carries a valid signature over a false claim. The quality of identity proofing at issuance, how carefully the issuer established who the applicant was before signing, remains a human and institutional matter, and the cryptography cannot improve it. For high-stakes credentials such as government identity documents, issuers typically require the applicant to scan the chip in a passport or identity card and match a live selfie against its photograph, or to appear in person. Nor does a credential tell a verifier whether the issuer should be trusted. A signature from "Department of Motor Vehicles, State of Somewhere" is only meaningful if the verifier can confirm that the key belongs to a real licensing authority. That is the trust problem, and it is the subject of Chapter 6. First, though, there is the question that gives credentials their most distinctive capability: how to show only part of one. Chapter 4: Saying Less In 1985 the cryptographer David Chaum published a paper in Communications of the ACM with a title that reads today like a manifesto: "Security Without Identification: Transaction Systems to Make Big Brother Obsolete". Chaum argued that computerisation was about to give organisations unprecedented ability to link records about individuals, and that cryptography could prevent it. People could hold credentials issued by one organisation and show them to another in a form that proved what needed proving and nothing more, and that could not be linked back to the issuance or to other showings. The tools to do this efficiently took decades to mature. They are the subject of this chapter, because they are what distinguishes a privacy-respecting identity system from a merely digital one. Two separate goals are involved, and the distinction between them is the most important idea in the chapter. Selective disclosure means the holder can reveal some claims from a credential and withhold others. Unlinkability means that separate presentations of the same credential cannot be connected to each other, or to the issuance, by matching any value they share. A system can achieve the first without the second, and most deployed systems do. The salted-hash method The simplest way to make a signed document partially revealable is to sign not the claims themselves but fingerprints of them. A cryptographic hash function turns any input into a fixed-length string, its digest, in a way that cannot be reversed and where any change to the input produces an unrelated output. If the issuer signs a list of digests, one per claim, the holder can later reveal any claim along with the information needed to recompute its digest. The verifier recomputes the digest, finds it in the signed list, and knows the claim is authentic. Unrevealed claims remain as opaque digests. There is one catch. Many claims have very few possible values. A birth date is one of about thirty-six thousand days in a century; a nationality is one of a couple of hundred countries; "over eighteen" is true or false. A verifier who sees the digest of an unrevealed birth date could simply hash every possible date until one matches. So each claim is combined with a random value, a salt, before hashing. The salt is known only to the issuer and the holder, and without it the digest reveals nothing. When the holder discloses a claim, she reveals its salt too. Walk through an example. An identity credential contains, among other claims, a given name, a family name, a birth date, and a boolean "age over 18". The issuer generates a separate random salt for each, computes four salted digests, and signs the list of digests along with metadata and the holder's public key. The holder's wallet stores the credential and the four salt-and-value pairs. When an online wine shop asks for proof of age, the wallet shows the holder the request, she approves it, and the wallet sends the signed digest list, the salt and value for "age over 18" only, and a fresh signature with the holder's key over the shop's challenge. The shop verifies the issuer's signature on the list, recomputes the digest of the disclosed claim, finds it present, and checks the holder's signature. It learns that a credential issued by a recognised authority says this person is over eighteen. It learns nothing about name or birth date. This is exactly how SD-JWT and ISO mdoc achieve selective disclosure. In mdoc, the signed list of digests is called the Mobile Security Object. In SD-JWT, the digests are embedded in the token and the revealed claims travel alongside as "disclosures". The method is simple, fast, and uses only standard, well-approved cryptography: ordinary hash functions and ordinary signature algorithms such as ECDSA. That last point is why governments chose it. Security certification regimes for government systems, in Europe and the United States alike, generally require algorithms approved by bodies such as NIST or national cybersecurity agencies, and hash-and-sign constructions meet that bar without argument. The method also explains why credentials include derived claims such as "age over 18" alongside the birth date. Salted hashes can hide or reveal a claim, but they cannot prove a statement about a hidden claim. If the credential contains only a birth date, the holder must reveal the full date to prove her age. Issuers therefore precompute the predicates verifiers are likely to want and include them as separate claims. The ISO mdoc standard defines a family of "age over NN" elements for this purpose. The approach works but is rigid: a verifier who needs "over 25" when the issuer only provided 18 and 21 must ask for the birth date. The linkability problem Now look at what the wine shop received. It got the issuer's signature, the full list of digests, the holder's public key, and the salt for one claim. Those values are identical every time the holder presents this credential, to anyone. If the wine shop and an online casino compare their records, they find the same signature and the same public key, and know they served the same person. If either shares data with the issuer, the issuer can match the signature to the citizen it was issued to. The holder revealed only "over eighteen", but she left a unique fingerprint behind. This is not a hypothetical concern. Data brokers exist to perform exactly this kind of matching across services, and a stable cryptographic identifier attached to every age check would be a far better matching key than the email addresses and device fingerprints they currently rely on. Cameron's fourth law, directed identity, is violated as surely as if the holder had shown a national identity number. The pragmatic fix used in the large government deployments is batch issuance. Instead of one credential, the issuer provides the wallet with many copies, each with fresh salts, a fresh holder key and therefore a fresh signature. The wallet uses each copy once, or once per verifier, and requests more as they run out. Because no two presentations share a value, verifiers cannot link them by comparing notes. The European wallet's Architecture and Reference Framework adopts this approach, and the American mobile driving licence ecosystem uses a similar practice of rotating short-lived security objects. Batch issuance works against verifiers colluding with each other. It does not work against the issuer. The issuer generated every copy and can record every signature it produced. If a verifier hands a presentation to the issuer, or if the issuer can compel verifiers to report, it can identify the holder. Whether that matters depends on who the issuer is and what law constrains it. For a government that already knows who its citizens are, the risk is not that it learns identity but that it learns where the credential was used, which is precisely the information the absence of an issuer-verifier edge was meant to protect. Batch issuance also has costs: the wallet must store and refresh many credentials, and the issuer must generate and sign them, which multiplies the load of an already large system. Stronger cryptography The more elegant solution is a signature scheme whose signatures can be changed by the holder into new, unrelated-looking proofs that still verify against the issuer's public key. The holder takes a credential and, for each presentation, derives a fresh proof that reveals chosen claims and demonstrates, in zero knowledge, that she holds a valid issuer signature over those claims and others she is not revealing. No value in the proof is constant from one presentation to the next. Neither colluding verifiers nor the issuer can link presentations, even with full access to every record. Such schemes have existed for some time. Stefan Brands developed one in the 1990s, later commercialised as U-Prove and acquired by Microsoft in 2008. Jan Camenisch and Anna Lysyanskaya published another in 2001, which became the basis of IBM's Idemix and later of the AnonCreds format. Both proved the concept but never reached mass deployment, held back by computational cost, complexity, and the absence of standards that certification bodies would accept. The scheme now closest to broad standardisation is BBS, named after Dan Boneh, Xavier Boyen and Hovav Shacham, who described the underlying signature in 2004. A BBS signature covers a list of messages, and the holder can derive a proof that discloses any subset of them, with each derived proof unlinkable to the others. The IETF's Crypto Forum Research Group has been standardising the BBS signature scheme, and the W3C has a corresponding cryptosuite for Data Integrity proofs. As of mid-2026 the W3C cryptosuite was at Candidate Recommendation stage, awaiting completion of the underlying IETF work. BBS relies on pairing-friendly elliptic curves, a family of cryptography that has not been approved by NIST for government use, and that is the main obstacle to its adoption in official identity systems. A second obstacle is that it requires issuers to generate new kinds of keys. Every existing driving licence authority and passport office signs with ECDSA or RSA in hardware security modules certified for those algorithms. Switching is not quick. A third approach has emerged that avoids the need for issuers to change anything. Rather than asking issuers to adopt new signature schemes, the holder's wallet constructs a general-purpose zero-knowledge proof about a credential signed with ordinary ECDSA. The proof says, in effect: "I hold a document, signed by a key on the government's trust list, in which the birth date is more than eighteen years before today, and I hold the private key bound to that document." The verifier checks the proof and learns that statement, nothing else. The issuer's signature, the digests, the holder's key and the birth date are all hidden inside the proof. This was long considered too slow for phones. General-purpose zero-knowledge proof systems that handle the arithmetic of ECDSA and SHA-256 inside a circuit used to take minutes or worse. Work by Matteo Frigo and abhi shelat, published in 2024 as "Anonymous Credentials from ECDSA", showed that proofs for realistic identity documents could be generated in well under a second on a modern phone. Google built on this work and in July 2025 open-sourced its implementation, called Longfellow ZK, describing its use for age assurance with existing mdoc credentials in Google Wallet. Because the approach works with credentials that governments already issue, it sidesteps the slow process of changing issuer infrastructure. The proof systems involved still need independent review and, for official contexts, some form of certification, and the European framework has been examining whether and how to admit them. Zero-knowledge proofs over standard credentials also solve the rigidity of precomputed predicates. A proof can show "over 25" or "born before a given date" or "resident in one of these five regions" from the underlying claims, so issuers do not have to anticipate every question. That flexibility has a cost: a verifier could ask a long series of carefully chosen predicate questions and narrow down the hidden value. Wallets and policy frameworks need to limit what kinds of predicates a given verifier may request, which brings the discussion back to governance. A small worked example shows how real the risk of narrowing is. Suppose a verifier is allowed to ask arbitrary questions of the form "were you born before date D?" Each answer halves the range of possible birth dates. A century contains roughly thirty-six thousand days, and two raised to the fifteenth power is about thirty-three thousand, so around fifteen or sixteen well-chosen yes-or-no questions would pin down an exact birth date, the very value the proof was meant to protect. A website could ask them across several visits, or several cooperating websites could ask one or two each. The defence is not cryptographic; every individual proof is perfectly zero-knowledge about everything except its own yes or no. The defence is a rule, enforced by the wallet, that only certain predicates may be asked, perhaps a fixed set of legal age thresholds, and that the same verifier may not ask a series of different ones. There is a further practical constraint on all of these advanced techniques, which explains much about the pace of adoption. Government identity systems run under security certification regimes, such as the Common Criteria evaluations used across Europe and the FIPS validations used by American federal agencies. Those regimes certify specific algorithms implemented in specific products. A new signature scheme, however well analysed in the academic literature, must pass through standardisation, then implementation in certified hardware and software, then evaluation, before a national authority can use it to sign identity documents. That process takes years. It is also, broadly, a good thing: identity infrastructure is a bad place to deploy fashionable cryptography that turns out to have a flaw. The tension between the privacy that new techniques offer and the assurance that old ones provide is genuine, and neither side of it is foolish. Table 2 compares the approaches. Table 2. Disclosure techniques and their privacy properties. Technique What the verifier sees Linkable across verifiers? Linkable by issuer? Issuer changes needed Whole credential (e.g. document photo) Every field Yes Yes None Salted hashes, single credential Chosen fields plus constant signature and key Yes Yes Moderate Salted hashes, batch issuance Chosen fields plus one-time signature and key No Yes Moderate, plus volume BBS or CL signatures Chosen fields plus fresh proof No No New key types and algorithms ZK proof over ECDSA credential Proven statement only No No None Unlinkability is necessary but not sufficient It would be easy to conclude that the strongest cryptography settles the privacy question. It does not. Presentations travel over networks, and network addresses, browser fingerprints and timing can link a holder across services regardless of how unlinkable the credential proof is. A verifier that asks for a name has identified the holder no matter what cryptography carried the name. And a holder can be pressured, by dark patterns in an interface or by an unequal relationship, into disclosing more than the purpose requires. Unlinkability can also go too far for some purposes. A service that bans abusive users wants to know if the same person returns under a new account. An online vote, a petition or a one-per-person benefit needs to detect duplicates. Perfect unlinkability would make all of these impossible, since every presentation would look like a stranger. The answer that cryptographers have developed is the scope-exclusive pseudonym: a value derived from the holder's secret and the verifier's identity, so that it is always the same when the holder returns to the same verifier, and unrelated across different verifiers. Germany's electronic identity card has offered a version of this, called restricted identification, for well over a decade, giving each service provider a stable identifier for a cardholder that no other provider can match. Extensions to BBS add the same capability to modern credentials. Pseudonyms of this kind are a good illustration of how far the field has come from the binary of "identified" and "anonymous": the cryptography can now express exactly the degree of recognition a relationship needs. Cryptography sets the lower bound on what a verifier must learn. It does nothing about what a verifier chooses to ask for, or what a holder is induced to approve. A system in which every website requests a full name, address and birth date "for security" will leak just as much as photograph uploads did, even if every field travels inside an impeccable selective disclosure proof. That is why the European regulation requires relying parties to register what they intend to request, and why wallets increasingly display the verifier's registered purpose alongside its request. Those are institutional controls on top of cryptographic ones, and the chapters on trust and failure modes return to them. The point for a reader evaluating a scheme is to ask three questions in order. Can the holder reveal only what is needed? Can separate uses be linked by the verifiers? Can they be linked by the issuer? A scheme that answers yes, no and no is technically sound. Whether it is also socially sound depends on who decides what verifiers may ask for, which is a question of power, not mathematics. Chapter 5: The Wallet Everything described so far assumes that the holder has somewhere to keep credentials and keys, and some way to decide what to present. That place is the wallet. The word suggests a passive container, but a digital identity wallet is the most active participant in the system. It generates and guards the holder's keys, receives credentials from issuers, interprets verifiers' requests, shows the holder what is being asked and by whom, computes the presentation, and keeps a record of what was shared. It is also the point where the abstract principle of holder control meets the concrete fact that most people's wallets will be made by a handful of companies and governments. The wallet is where self-sovereign identity either becomes real or becomes a slogan. What a wallet does in a single transaction Follow one presentation from start to finish. A woman wants to open an account with an online bank that is required by anti-money-laundering rules to verify customers' identities. On the bank's website she clicks "Verify with digital ID". The website constructs a request. Under the OpenID for Verifiable Presentations protocol, which the OpenID Foundation approved as a final specification in July 2025, the request names the credential types acceptable, the specific claims wanted, and a fresh random challenge. In a well-governed ecosystem it also carries proof of who the verifier is, typically a certificate showing that the bank is registered to make this kind of request. The browser passes the request to the operating system through the Digital Credentials API, a browser interface that Chrome enabled by default from version 141 in October 2025 and that Apple supports in Safari 26. The operating system shows the woman a list of wallets on her phone that hold matching credentials. She picks one. The wallet parses the request. It checks the verifier's certificate and displays, in plain language, who is asking and for what: the bank's registered name, the claims requested (given name, family name, date of birth, address, nationality), and perhaps the purpose the bank declared when it registered. She confirms, usually by unlocking the phone with a face scan or fingerprint, which also unlocks the holder key in the phone's secure hardware. The wallet builds a presentation containing only the requested claims, signs the bank's challenge with the holder key, and returns the result through the browser. The bank verifies the issuer's signature against its list of trusted identity authorities, checks the holder signature and the challenge, checks the credential's status, and opens the account. The whole exchange takes a few seconds. If she is at a physical counter instead, the protocol differs but the shape is the same. Under ISO/IEC 18013-5, the reader displays or scans a QR code, or the phone is tapped against it, to establish a secure channel over NFC or Bluetooth, and the request and response travel over that channel. Many travellers in the United States now do exactly this at Transportation Security Administration checkpoints, holding a phone near a reader instead of handing over a plastic card. Issuance runs through a parallel protocol. OpenID for Verifiable Credential Issuance, approved as a final specification in September 2025, defines how a wallet obtains a credential from an issuer: the holder authenticates to the issuer, often by scanning the chip in a passport or national identity card and taking a selfie, the wallet generates a fresh holder key and proves possession of it, and the issuer signs a credential bound to that key. A companion profile, the High Assurance Interoperability Profile, narrows the many options in these protocols to a set that government-grade deployments can all support. A third configuration is common and deserves attention because it carries a specific risk. The woman may be applying on a laptop while her wallet is on her phone. In that case the website displays a QR code, she scans it with the phone, and the request travels to the wallet through an intermediary channel. Cross-device flows of this kind are convenient, and they are also where phishing returns. An attacker can set up a fake bank site, obtain a genuine request from the real bank, display its QR code to the victim, and wait for her to approve a presentation that goes to the real bank on the attacker's behalf. The defences are layered. The browser-mediated cross-device flow in the Digital Credentials API uses a Bluetooth proximity check, as passkeys do, to confirm that the phone is physically near the computer displaying the request. The wallet shows the verifier's registered identity prominently, which a careful user will notice does not match the page she thinks she is on. And the presentation is bound to the verifier's challenge and origin, so it cannot be redirected to a different site. None of these is perfect, but together they make relay attacks considerably harder than stealing a password. Two observations follow from this walk-through. First, the protocols are now standardised and the browser and operating system integration has shipped. The plumbing that held back earlier attempts like CardSpace no longer stands in the way. Second, the wallet carries enormous responsibility for the holder's understanding. The clarity of the consent screen, the accuracy with which it identifies the verifier, and the ease of refusing a request determine whether "user control" means anything. Cameron's sixth law, human integration, lives or dies here. Keys, devices and the problem of loss A credential bound to a key in a phone's secure hardware is hard to steal. It is also hard to move. The private key cannot be exported, by design, and so it cannot be backed up. When the phone is lost, broken, or replaced, the credential is gone, and it must be reissued to a new key on the new device. For low-stakes credentials this is merely annoying. For government identity, it is a real design problem. A person who loses her phone abroad may find that she has lost, at the same moment, her means of communication, payment, and identification. Physical documents remain the fallback in every major deployment, and no serious programme proposes to abolish them, but the convenience of a digital credential encourages people to carry the physical document less often. Wallets handle loss in several ways. Re-issuance can be fast if the holder can re-authenticate easily, for instance by tapping the passport against the new phone. Issuers can be notified of loss so that they revoke the old credential, which matters because a stolen, unlocked phone could present it. Some designs separate the holder key from the device, keeping it in a remote hardware security module that the wallet accesses after the holder authenticates, which survives device loss but reintroduces a server that sees every use. The European framework allows for remote secure elements of this kind, subject to certification, partly because not every phone has adequate secure hardware. A related concern is wallet attestation. An issuer of a high-assurance credential wants to know that the key it is binding the credential to really lives in secure hardware and that the wallet software is genuine, not a modified app that will hand the credential to a fraudster. So wallets provide attestations, signed statements from the wallet provider or the device maker, vouching for themselves. The European architecture requires such attestations for wallets that receive person identification data. Attestation is sensible security, and it is also a gate. Only wallets that a recognised body has certified can obtain the credential. A citizen who wants to use an independent open-source wallet, or a phone whose maker is not recognised, may be unable to. The tension between assurance and openness runs through all of the large deployments. Who makes the wallet The question that matters most for the long-term character of these systems is who builds the wallet and what they can see. There are three broad models. In the first, the state wallet, a government publishes its own wallet application, as several European member states are doing for the EU Digital Identity Wallet. The government is both issuer and wallet provider. That is not inherently a privacy problem if the wallet is designed so that the provider learns nothing about presentations, but it concentrates trust in one body, and the regulation's requirement that wallets be published as open-source software is an important check on it. In the second, the platform wallet, the maker of the phone's operating system provides the wallet. Apple Wallet and Google Wallet both store government identity credentials, beginning with Apple's launch of Arizona driving licences in 2022, with Google following and both expanding state by state since; in November 2025 Apple added a "Digital ID" created from a United States passport, initially accepted at TSA checkpoints. Platform wallets have obvious advantages: they come preinstalled, they use the device's secure hardware directly, and they inherit the polished interface conventions of their makers. Apple states that it does not see when or where users present their identity. The risk lies not in what the platform currently does but in its structural position. A company that controls the operating system, the wallet, the browser, and the app store can decide which other wallets may access the secure hardware, which verifiers may make requests, and on what commercial terms. Apple's long resistance to opening the iPhone's NFC chip to third-party payment apps, relaxed in 2024 after pressure from the European Commission, shows how that power can be used. In the third, the independent wallet, a company or open-source project unrelated to the issuer or the platform provides the wallet. This is closest to the self-sovereign ideal: the holder chooses a wallet she trusts, and can switch. But independent wallets depend on platform cooperation for access to secure hardware and browser integration, and on certification for access to high-assurance credentials. Their room to operate is defined by the other two. A fourth model, the cloud wallet, deserves mention because it is attractive to enterprises and to some service providers. Here the credentials and keys sit on a server operated by the wallet provider, and the holder accesses them through an app or website. Cloud wallets solve device loss neatly and can serve people who share phones or use basic devices. They also put a provider in a position to see every presentation, which is exactly the position the architecture was designed to eliminate. A cloud wallet can be built so that the provider cannot read the holder's data, with keys protected by hardware the provider cannot access and presentations encrypted end to end, but the holder must take that on trust. For low-stakes credentials, such as an employee badge or a loyalty programme, the trade may be reasonable. For government identity it shifts the question from "what can the verifier learn" to "what can the wallet provider learn", and the answer depends entirely on design and oversight. The Digital Credentials API was designed partly with this plurality in mind. When a website asks for a credential, the operating system's credential manager presents all wallets holding a matching credential, rather than routing the request to the platform's own wallet. Whether that neutrality holds as commercial interests grow will be one of the significant questions of the next decade. Delegation, exclusion and the wallet's memory The wallet model assumes a single competent adult with a personal smartphone. Many people do not fit. Children need credentials, for travel or school or health care, but cannot manage keys and should not be asked to consent to disclosures alone. Adults with cognitive impairments may have legal guardians. Elderly people may rely on family members to manage their affairs. Small businesses need employees to act on the company's behalf. Refugees may have no recognised documents at all. Each of these situations requires some form of delegation: one person presenting a credential, or acting on authority, for another. Paper systems handle delegation clumsily but flexibly, through powers of attorney, parental consent forms, and the discretion of the person at the counter. Digital systems tend to handle it rigidly or not at all. Work on representation and mandates, credentials that express "this person may act for that person in these matters", is under way in the European framework and elsewhere, but it is far less mature than the core holder-to-verifier flow. Consider a concrete case. A father travelling with his ten-year-old daughter needs to prove at a hotel desk or a border that he is her parent or has authority to travel with her. On paper, he carries her passport and perhaps a birth certificate or a consent letter from the other parent. In a wallet, the daughter's credential could sit on his phone, bound to his key rather than hers, alongside a credential from the civil registry attesting the parent-child relationship. That arrangement works until the parents separate, a court order changes custody, or the child turns sixteen and should control her own credentials. Each transition requires the issuer to revoke one binding and create another, and each depends on legal facts that the wallet cannot know. Paper copes because a human examines the documents and makes a judgement. Digital systems must model those judgements explicitly, and the models are still being written. Shared devices pose a further problem. In many households worldwide, a phone is shared among family members. A wallet bound to one device's secure hardware, unlocked by one person's biometrics, assumes a one-to-one relationship between person and phone that is not universal. Any system that makes a personal smartphone a precondition for full participation in public life excludes those who lack one. The major programmes acknowledge this and maintain physical alternatives, but alternatives that are slower, less convenient or less widely accepted become a second tier. Finally, a wallet can do one thing that a paper document never could: keep a log. A well-designed wallet records every presentation, to whom, what was disclosed and when, and shows the holder that history. The European regulation requires wallets to offer this, and to let the holder ask a relying party to delete data she shared, or report a relying party to the data protection authority, directly from the wallet. This turns the information asymmetry of the account model upside down. Under accounts, the service knows everything about the user's interactions with it and the user knows little. Under wallets, the holder has a complete record of whom she has told what. It is a modest feature, easily overlooked in discussions of cryptography, and it may turn out to be one of the most consequential, because it gives individuals evidence with which to enforce rights that data protection law already grants them. The log, of course, must stay on the device or be encrypted so that only the holder can read it. A wallet that uploads presentation logs to its provider's servers, for analytics or backup, would recreate in one place the very record the architecture was designed never to compile. The wallet, then, is where the holder's control is exercised and where it can be quietly eroded. Its behaviour is constrained by the trust framework around it: who certifies wallets, who registers verifiers, which issuers count. That framework is the subject of the next chapter. Chapter 6: Trust Without a Centre A signature proves that a particular key signed a particular statement. It does not prove that the key belongs to anyone who should be believed. Anyone can generate a key pair, publish it under a DID, and issue credentials declaring that the bearer holds a medical licence from "the State Medical Board". The signatures will verify perfectly. The question every verifier must answer, before any of the cryptography in the previous chapters means anything, is: which issuers count? This is the trust problem, and it is where the word "decentralized" meets its limits. Every functioning credential system answers the question with some form of list, maintained by someone. The useful debate is not whether such lists should exist but who maintains them, how many there are, what they cover, and what they are allowed to know. The lesson of the web of trust The purest decentralized answer to the trust problem was tried in the 1990s. Pretty Good Privacy, the email encryption program Phil Zimmermann released in 1991, let users sign each other's public keys to vouch that they belonged to the named person. Trust would propagate through a "web of trust": if you trusted Alice, and Alice had signed Bob's key, you might trust Bob's key too. No central authority was required. Enthusiasts held key-signing parties at conferences, checking each other's passports and exchanging fingerprints. The web of trust never scaled beyond technically sophisticated communities. Ordinary users could not reason about transitive trust; the graph of signatures was sparse; and the act of signing someone's key revealed social connections publicly. More fundamentally, the web of trust conflated two different questions. "Is this key really Bob's?" can be answered by people who know Bob. "Is Bob really a doctor?" can only be answered by the body that licenses doctors. Peer vouching works for the first question and is useless for the second. Credentials are almost entirely about the second kind of question. A verifier needs to know that a driving licence was issued by a real licensing authority, that a degree came from an accredited university, that a professional licence came from the competent regulator. These are statements of institutional authority, and institutional authority is, by its nature, conferred by other institutions. A university is a university because an accreditor or a ministry recognises it. A licensing authority is one because a statute created it. Any trust architecture for credentials must reflect those existing structures, or it will be either useless or a vector for fraud. Lists, hierarchies and registries Existing systems answer the trust question in a few recognisable ways. The oldest large-scale example is the electronic passport. Since the mid-2000s, passports in most countries have contained a chip holding the holder's data and photograph, signed by the issuing state. Each state runs a Country Signing Certificate Authority, whose certificates are exchanged among states bilaterally and published through the International Civil Aviation Organization's Public Key Directory. A border officer's reader trusts a passport chip because its signature chains to a country signing certificate the reader has been configured to accept. There is no single global authority; there is a list of national authorities, maintained cooperatively. This is the model on which most government digital identity now builds, and the passport chip is itself a common starting point for issuing digital credentials, since a wallet can read it, verify it, and use it to prove identity to a new issuer. Mobile driving licences in the United States follow the same pattern at state level. Each state's licensing authority signs mdoc credentials with its own keys. The American Association of Motor Vehicle Administrators operates a Digital Trust Service that collects the states' issuing certificates and publishes them in a signed list, the Verified Issuer Certificate Authority List. A verifier, whether a TSA reader or a retailer's age check app, downloads that list and accepts any credential whose issuer certificate appears on it. The list is centralised in the sense that one association maintains it, but verification itself is local and the association never sees individual presentations. The European Union uses trusted lists, a mechanism inherited from the original eIDAS regulation of 2014, which established legal recognition for electronic signatures and trust services. Each member state publishes a list of qualified trust service providers it supervises, and the Commission publishes a list of those lists. The revised regulation, eIDAS 2.0, extends this machinery to identity wallets: providers of person identification data, wallet providers, and providers of qualified electronic attestations of attributes all appear on lists that verifiers can consult. A bank in Portugal verifying a credential from a German citizen's wallet checks that the issuer appears on the German list, which appears on the Commission's list. The European framework also distinguishes between grades of attestation, and the distinction shows how legal trust and technical trust interlock. Person identification data, the core identity credential, comes only from bodies designated by member states. Beyond that, the regulation recognises qualified electronic attestations of attributes, issued by trust service providers that are supervised and audited and that check claims against authentic public sources such as civil registers or professional registers, and ordinary electronic attestations of attributes, which any party may issue but which carry no special legal presumption. A qualified attestation that a person holds a medical licence enjoys the same legal effect as a lawfully issued paper certificate; an ordinary attestation from a private company is evidence whose weight a court would assess case by case. Public bodies responsible for authentic sources can issue attestations directly as well. The verifier's software can see from the trust list which category an issuer belongs to and apply its own policy: a bank might accept only qualified attestations for anti-money-laundering purposes, while an online retailer might accept ordinary ones for loyalty status. Consider how this works in a single cross-border case. A German citizen wants to open an account with a bank in Lisbon, entirely online. She presents her person identification data from a German wallet and an attestation of her address. The bank's verification system receives the presentation and finds that the person identification data is signed by a key in a certificate chain belonging to the German provider. It checks Germany's entry in the Commission's list of trusted lists, follows it to the German list, and confirms that the provider is notified for person identification data at the required assurance level. It confirms that the wallet's attestation comes from a certified wallet solution. It checks that the address attestation comes from a provider on a trusted list, qualified for that kind of attestation. Throughout, no German authority learns that a Portuguese bank checked anything. The bank, for its part, has a verification that is legally recognised across the Union, which is something no photograph of a German identity card uploaded to a Portuguese website could provide. In domains without a natural government hierarchy, trust registries fill the role. A registry is a queryable service, or a published file, that answers questions of the form "is this DID authorised to issue this type of credential under this governance framework?" The education sector offers good examples: a registry might list the institutions accredited to issue degree credentials within a country, maintained by the ministry or accreditor that already performs that function on paper. The European Blockchain Services Infrastructure, a Commission-backed project, operates trusted issuer registries for diplomas and other attestations, one of the places where a ledger is used for the registry rather than for individual identifiers. The Trust over IP Foundation has worked on standard interfaces for querying registries of this kind, and the OpenID Foundation's OpenID Federation specification offers a way for organisations to publish signed statements about each other's roles, building chains of trust without a single root. Trust lists also have borders, and crossing them is a diplomatic act as much as a technical one. An American mobile driving licence and a European person identification credential may use the same mdoc format, but a verifier in Europe has no legal basis for treating an American state as a trusted issuer of identity unless some agreement says so, and the same holds in reverse. The electronic passport shows how this can work: states exchange country signing certificates because they have agreed, through ICAO, on a common framework and a common interest in border control. Digital identity credentials have no equivalent global framework yet. The European regulation provides for recognising third-country schemes through international agreements, and work on mutual recognition among like-minded jurisdictions is under way, but for now a traveller's digital identity is most useful inside the jurisdiction that issued it. The format travels; the trust does not, at least not automatically. This is a reminder that the hardest parts of identity are not the parts that cryptography addresses. What these mechanisms share is that they are governance frameworks given technical form. Someone decides the rules for inclusion on a list, someone checks applicants against them, someone handles complaints and removals. The cryptography makes the result of those decisions machine-checkable. It does not make the decisions. Trust in the other direction Most writing on credentials focuses on how verifiers trust issuers. The reverse question matters as much for privacy: how does a holder know whether to trust a verifier? In the physical world, context does much of the work. You hand your licence to a police officer at a traffic stop, a cashier at a bar, a clerk at a car rental desk, and you know roughly what each is entitled to see. Online, context collapses. A website that asks for your full identity credential may be a regulated bank required by law to collect it, or a quiz site harvesting data. The wallet's consent screen can show a name, but a name is easy to fake. The European framework addresses this with relying party registration. Any organisation that wants to request data from EU wallets must register with a national authority, declaring who it is and what attributes it intends to request. It then receives a certificate that the wallet checks when processing its requests. The wallet can warn the holder, or refuse, if a verifier asks for attributes beyond its registered scope. This is a powerful control against over-asking. A social network registered to verify age should never be able to obtain a name and address through the wallet, whatever its consent screen says. Registration has its own risks. It creates a gatekeeper deciding who may ask for identity data, and that gatekeeper could exclude legitimate small businesses through cost or bureaucracy, or be pressured to deny registration to disfavoured services. It also creates a list of everyone who verifies identity, which is useful oversight in a democracy and a tool of control in an autocracy. The design choice is a reasonable one for the European context, where data protection authorities already supervise data processors and the registration is meant to be light. It is not a neutral one, and other jurisdictions may make different choices. Self-sovereignty reconsidered The trust problem forces a more precise statement of what "self-sovereign" can honestly mean. It cannot mean that individuals are independent of institutions. Every credential worth having derives its value from an institution that issued it and from a framework that tells verifiers to accept it. The holder is sovereign over the flow of her information, not over its validity. She decides whether and what to present. She does not decide whether a verifier will believe it. Nor can it mean that there is no centre anywhere. There are many centres: each issuer is a centre for its own credentials, each trust list is a centre for its domain, each wallet certification body is a centre for the wallets it approves. What the decentralized model eliminates is the transactional centre, the single party consulted on every use, which the account and federation models made unavoidable. A centre that maintains a list, published once and downloaded by everyone, learns nothing about individual transactions. A centre that answers a query per verification learns everything. That distinction, between infrastructure that publishes and infrastructure that is consulted, is the real dividing line between decentralized and centralized identity, and it cuts across the question of whether a blockchain is involved. The claim of decentralization should also be tested against pluralism, Cameron's fifth law. Can a verifier accept credentials from issuers under several different trust frameworks? Can a holder use more than one wallet? Can a new issuer, wallet or framework enter the market without the permission of an incumbent? A system with one wallet, one trust list and one registration authority may avoid transactional centralisation and still concentrate power dangerously, because whoever controls those three things controls who can participate in digital life. The systems described in the next chapter vary a great deal on these dimensions, and the variation is as much political as technical. In real deployments, verifiers face a patchwork. An online retailer selling age-restricted goods across Europe and North America may need to accept EU wallet credentials checked against EU trusted lists, American mDLs checked against the AAMVA list, perhaps national schemes from the United Kingdom or Australia under their own frameworks, and commercial age estimation services that are not credentials at all. Each comes with its own legal regime, liability rules and technical profile. The industry's answer has been the verification intermediary, a company that accepts all these inputs and returns a simple yes or no to the retailer. Intermediaries are useful, and they are also an obvious place for the transactional centre to reappear. An intermediary that processes age checks for thousands of websites sees which websites each holder visits, unless the protocol prevents it. Careful designs keep the intermediary as a software library running on the verifier's own systems, or ensure that it receives only the cryptographic proof without any holder identifier. Careless ones recreate the credit bureau problem under a new name. The lesson is that trust architecture does not stay fixed once the standards are written. Market pressures push toward aggregation, because aggregation is convenient for verifiers and profitable for aggregators. Keeping the transactional centre out requires deliberate rules, which brings the discussion from principles to the deployments where those rules are being written. Chapter 7: Where It Is Being Built For most of its first decade, decentralized identity lived in pilots. Consortia announced proofs of concept for refugee identification, supply chain certificates, vaccination records and university diplomas; most never left the pilot stage. That has changed. By late 2026 hundreds of millions of people either hold, or are about to be offered, a government-issued digital credential on their phone, and laws in several jurisdictions now require online services to verify facts about their users that only such credentials can supply cheaply and privately. This chapter surveys the deployments that matter, with attention to the choices each has made on the questions raised in earlier chapters. Table 3 summarises the main programmes. Table 3. Major digital identity credential programmes, status as of autumn 2026. Programme Jurisdiction Credential formats Legal basis Status EU Digital Identity Wallet 27 EU member states ISO mdoc and SD-JWT VC Regulation (EU) 2024/1183 (eIDAS 2.0) Member states must offer a wallet by end of 2026; readiness uneven Mobile driving licences and state IDs US states ISO mdoc (18013-5/-7) State law; TSA acceptance rules Live in many states via Apple, Google, Samsung and state apps Apple Digital ID (from US passport) United States ISO mdoc Federal acceptance at TSA Launched November 2025, TSA checkpoints first GOV.UK Wallet and certified digital ID providers United Kingdom Mixed, under UK trust framework Data (Use and Access) Act 2025; Online Safety Act 2023 Wallet rolling out; national digital ID scheme under consultation Australian Government Digital ID System Australia Accredited providers (e.g. myID) Digital ID Act 2024 Live; age assurance rules in force from December 2025 Europe: legislating the wallet The European Union has gone further than any other jurisdiction, by making wallets a legal obligation. Regulation (EU) 2024/1183, known as eIDAS 2.0, entered into force in May 2024. It requires every member state to provide at least one European Digital Identity Wallet to its citizens and residents, free of charge to individuals, within twenty-four months of the adoption of the technical implementing acts. The first of those acts were adopted at the end of 2024, which put the deadline at the end of 2026. From the end of 2027, public bodies, regulated private sectors such as banking, and very large online platforms that require users to authenticate must accept the wallet when a user offers it. The regulation embeds several of the principles discussed in this booklet directly into law. Wallets must support selective disclosure. Wallet providers may not collect information about how the wallet is used beyond what is needed to provide the service. Wallet software must be published under an open-source licence, with limited exceptions. Relying parties must register and declare the attributes they intend to request. Holders get a dashboard of their transactions and a direct route to request deletion or complain to a data protection authority. Use of the wallet must remain voluntary, and people who decline it must not be disadvantaged in accessing public or private services. Few technology regulations have been so specific about privacy architecture. The technical work has proceeded through an Architecture and Reference Framework, maintained in public by the Commission and member state experts, and through four large-scale pilots that ran from 2023 into 2025, testing use cases from opening bank accounts and registering SIM cards to presenting driving licences, diplomas, social security entitlements and electronic prescriptions across borders. The framework settled on ISO mdoc and SD-JWT VC as the mandatory credential formats, on the OpenID protocols for remote issuance and presentation, and on ISO 18013-5 for proximity use. It adopted batch issuance and one-time credentials as the near-term answer to linkability while studying zero-knowledge approaches for later. Its critics, including a group of cryptographers who wrote publicly during the drafting, argued that it should have required unlinkability from issuers as well as verifiers. The defenders' answer was that the cryptography capable of that was not yet certified for government use. That disagreement remains open. Implementation is uneven. Some member states already ran national identity apps that they are adapting; others are building from scratch. Reports through 2026 indicated that a minority of states were fully on track, and Germany, among others, signalled that its state wallet would arrive at the turn of 2027. A regulation can set a deadline, but it cannot make twenty-seven public procurement systems move in step. Alongside the full wallet, the Commission published in July 2025 a "blueprint" for an age verification app, a narrower tool that lets a user obtain a proof of being over eighteen from a trusted source and present it to websites without revealing anything else. It was piloted first with Denmark, France, Greece, Italy and Spain. The blueprint responded to pressure under the Digital Services Act for platforms to protect minors, and was designed to be absorbed into the full wallets as they arrive. In late 2025 the Commission also proposed a European Business Wallet, extending the same approach to companies and their representatives, which was under negotiation through 2026. The United States: licences first The United States has no national identity card and no federal mandate for digital identity, so its deployments have grown from the one credential every state already issues: the driving licence. Mobile driving licences built on ISO 18013-5 have spread state by state. Some states issue them through their own apps; many make them available in Apple Wallet, Google Wallet or Samsung Wallet. The Transportation Security Administration accepts them at a growing number of airport checkpoints, and the arrival of REAL ID enforcement in May 2025, which required travellers to carry a compliant identity document for domestic flights, made the question of what counts as acceptable identification more visible to ordinary travellers. The most significant recent step was Apple's November 2025 launch of a Digital ID created from a United States passport. A user scans the passport's chip with the iPhone, takes a selfie and performs head movements to confirm liveness, and receives a credential in Apple Wallet. This gives residents of states without mobile licence programmes a digital identity credential for the first time, and it does so through a platform company rather than a state. Trust is coordinated by the American Association of Motor Vehicle Administrators, whose Digital Trust Service publishes the list of state issuing certificates, as described in the previous chapter. Privacy protections vary by state. Some state laws restrict how verifiers may use data from mobile licences; others are silent. Civil liberties groups have pressed for rules forbidding issuers from learning where credentials are presented and preventing police from requiring a person to hand over an unlocked phone to show a licence. Online use is growing fastest where the law demands it. More than twenty American states have passed laws requiring age verification for websites with substantial pornographic content, and in June 2025 the Supreme Court, in Free Speech Coalition v. Paxton, upheld Texas's version of such a law. Several states have also passed laws on minors' use of social media. Many of these laws were written before privacy-preserving digital credentials were widely available, and they often allow, or effectively encourage, verification by document upload or third-party database checks. Whether verifiers move to selective disclosure from mobile licences, now possible through the Digital Credentials API in mainstream browsers, will determine whether the age verification wave expands surveillance or contains it. The United Kingdom and Australia: age assurance as the driver In the United Kingdom, the duties under the Online Safety Act 2023 requiring services that host pornography and certain other harmful content to use "highly effective age assurance" came into force on 25 July 2025. The regulator, Ofcom, listed acceptable methods including facial age estimation, photo identification matching, credit card checks, open banking, mobile network operator checks and digital identity services. The immediate effect was a surge in selfie and document checks run by commercial providers, a sharp rise in the use of virtual private networks to evade them, and public argument about privacy. It illustrated what happens when a legal requirement to verify arrives before privacy-preserving infrastructure is in widespread use. The UK has been building that infrastructure in parallel. A Digital Identity and Attributes Trust Framework certifies private providers of identity services, and the Data (Use and Access) Act 2025 placed it on a statutory footing. The government's GOV.UK Wallet began carrying government-issued credentials, starting with a veteran card, with a digital driving licence promised to follow. In September 2025 the government announced a national digital identity scheme, initially to be mandatory for right-to-work checks. The proposal met strong opposition, and in January 2026 the government dropped the mandatory element; a public consultation on the scheme's design followed in the spring. The episode showed that in a country that abolished its last identity card scheme in 2010, the political legitimacy of digital identity depends heavily on whether it is optional. Australia combined statute and age restriction even more directly. The Digital ID Act 2024 created an accreditation regime and a government Digital ID System, through which the government's myID and accredited private providers can verify identity to services. The Online Safety Amendment (Social Media Minimum Age) Act required major social media platforms to take reasonable steps to prevent users under sixteen from holding accounts, with obligations in force from 10 December 2025. Before that date, the government commissioned an Age Assurance Technology Trial, whose final report in September 2025 found that age assurance could be done privately and effectively in many contexts but that no single method suited every case. The law notably prohibits platforms from requiring government identification as the only option, a protection against making identity documents the price of social participation. Other models, other credentials It is worth setting these programmes beside the national digital identity systems that already work well on a different model, because they are the benchmark any wallet must beat. In Sweden and Norway, BankID, operated by consortia of banks, has for years been the ordinary way to log into public services, sign contracts and confirm payments. Singapore's Singpass gives residents a single government login accepted by public agencies and many private firms. Estonia's chip-based identity card, introduced in 2002, underpins digital signatures and access to nearly all public services. These systems are convenient, trusted and heavily used. Architecturally, most of them are federated: the identity provider authenticates the user at each transaction and passes data to the service, which means it sits in the middle of every use, exactly as social login does. Estonia's card is a partial exception, since signatures are made locally with keys on the card, though authentication typically involves online certificate checks. That these systems work so well is a reminder that the account and federation models are not failures everywhere. Where the identity provider is a well-regulated institution operating under strong data protection law and enjoying public trust, its presence in each transaction may be an acceptable price for convenience. The case for the wallet model rests on two things these systems lack: the ability to disclose less than a full identity, and the absence of a single party that observes all uses. Whether citizens of countries with excellent federated systems will value those properties enough to switch is an open question, and the European regulation's requirement that member states offer wallets will test it. Government credentials attract the most attention, but some of the most mature uses of verifiable credentials lie elsewhere. Education was an early adopter because its problem is so clear: diplomas are forged, transcripts are slow to obtain, and graduates move across borders. MIT's Media Lab released Blockcerts, an open standard for blockchain-anchored certificates, in 2016, and MIT later convened the Digital Credentials Consortium of universities to develop standards for digital academic records. The 1EdTech consortium's Open Badges 3.0 specification aligned the widely used badge format with the W3C Verifiable Credentials Data Model, so that badges issued under it for courses and skills, a format already familiar to many institutions and employers, can be verified as credentials. The European Union's Europass Digital Credentials infrastructure lets institutions issue signed diplomas and certificates that verify across member states. Business registration is another natural fit. The government of British Columbia built OrgBook BC, which publishes verifiable credentials for registered organisations so that other agencies and companies can confirm a business's registration and permits without paper. Work on global legal entity identifiers, through GLEIF's verifiable Legal Entity Identifier (vLEI), extends the same idea to the authority of individuals to act for companies. Workforce and professional credentials are growing more slowly, held back less by technology than by the number of issuers that must participate before verifiers bother to accept them. Health credentials had their moment during the COVID-19 pandemic, when the EU Digital COVID Certificate demonstrated that signed, offline-verifiable health attestations could be deployed to hundreds of millions of people in months. That system used signed QR codes rather than wallets, and carried every field to every verifier, but it proved that the issuer-holder-verifier model could work at continental scale. Looked at together, the deployments show three patterns. First, adoption follows legal obligation. The EU wallet exists because a regulation requires it. Online age verification is spreading because statutes in the UK, Australia, the EU and American states require it. Voluntary market adoption, which the early self-sovereign identity movement expected, has been slow, because verifiers had no reason to accept credentials until law gave them one, and holders had no reason to obtain credentials that no verifier accepted. Second, the formats and protocols have converged. Despite years of competing approaches, the large programmes now use ISO mdoc and SD-JWT VC, OpenID protocols and the browser Digital Credentials API. That convergence makes cross-border and cross-platform use possible in a way that seemed distant five years ago. Third, privacy properties vary far more than technology does. The same mdoc format can be presented with selective disclosure to a verifier who learns only "over eighteen", or in full to a verifier who stores every field. The same wallet can be designed to log transactions only on the device or to send analytics to its provider. Whether a deployment honours the principles in this booklet is decided by regulation, procurement and verifier behaviour, not by the choice of format. The next chapter considers what happens when those decisions go wrong. Chapter 8: How It Fails Every technology of identification has been used, at some point, for purposes its designers did not intend. Population registers compiled for taxation and public health became instruments of persecution. Identity cards introduced for wartime rationing in Britain were kept for years after the war ended, until a motorist named Clarence Willcock refused to show his to a police officer in 1950 and the case reached the High Court, whose judges criticised the routine demands for cards, a criticism that helped lead to their abolition in 1952. The lesson of that history is not that identification is wrong. It is that the uses of an identity system expand to fill the capabilities it provides, and that safeguards must be designed for the system's worst plausible user, not its intended one. Decentralized identity is often presented as a privacy technology, and it can be. It can also fail in ways that leave people worse off than they were with paper. This chapter examines the main failure modes, why they arise, and what designs and rules counter them. Table 4 summarises them at the end of the chapter. The cheapness of asking The first failure is the most counterintuitive. Making identity verification private and convenient also makes it cheap, and cheap verification gets used more. Today, many online services do not verify age or identity because doing so is costly and drives away users. A forum, a game, a retailer of mildly restricted goods asks for nothing more than a checkbox. If proving age becomes a single tap with a face scan, the cost to the service falls close to zero, and the reasons not to ask disappear. Legislators who were reluctant to impose verification requirements when they meant document uploads may be more willing when a privacy-preserving option exists. The result could be an internet in which far more activities require a credential than do today, each check individually private, the aggregate a significant change in how people move through digital life. This dynamic has already been visible. Age verification laws in the United Kingdom, Australia and many American states expanded the categories of service that must check users, and the availability of cheaper methods was part of the argument for doing so. Selective disclosure limits what each check reveals. It does nothing to limit how many checks there are. The recent past offers a clear instance of how a credential designed for one purpose spreads to others. The EU Digital COVID Certificate was created in 2021 to restore free movement across European borders during the pandemic. Within months, many member states were using the same certificates domestically, as a condition of entry to restaurants, cinemas, gyms and in some places workplaces. Whatever one thinks of those public health policies, the technical sequence is instructive: once a verifiable credential existed and verification apps were freely available, extending its use to new settings required only a decision, not new infrastructure. The certificate carried name and date of birth to every verifier, so each café check was also an identity check. Credentials built for identity rather than health will be subject to the same pull, and the ease of extension is a feature their designers should treat as a risk. A related problem is over-asking. A verifier that is permitted to request an attribute will often request it whether or not it needs it, because data has option value and asking costs nothing. An online shop might ask for a full name and address alongside an age proof, "for fraud prevention". The holder, faced with a consent screen and a purchase she wants to complete, approves. Studies of cookie consent banners have shown how rarely people decline requests that stand between them and what they want. If wallet consent becomes another click-through, the protections of selective disclosure will be nominal. The countermeasures are institutional. Relying party registration with declared attributes, as in the European scheme, lets wallets refuse requests beyond a verifier's registered scope. Data protection law's principle of data minimisation, which already forbids collecting more than necessary, becomes enforceable when a wallet logs exactly what each verifier asked for. Statutes that require age checks can specify that only the age attribute may be requested. And laws can preserve the right to use a service without identification where identification is not essential, a principle the European regulation partly encodes by forbidding discrimination against people who do not use the wallet. Surveillance and concentration The second failure is the return of the transactional centre. The architecture's privacy rests on the issuer not being told when and where credentials are used. There are many ways for that to be undone. Online status checks, discussed in Chapter 3, are the most direct: if verifiers query the issuer about each credential, the issuer learns each use. Server retrieval modes, in which the verifier fetches attributes from the issuer rather than from the holder's device, do the same. Wallets that send telemetry to their providers, even for benign reasons such as crash reporting or usage analytics, may disclose which verifiers the holder interacts with. Verification intermediaries that serve many websites can see the pattern of a holder's visits unless the protocol prevents it. Legal compulsion can require verifiers to retain presentations and hand them to authorities on demand, at which point the issuer, if it is the state, can link those presentations back to the person through its issuance records unless the credential was unlinkable. None of these failures requires bad intent. Each arises from a reasonable local decision, a desire for fresh revocation information, a need to debug, a compliance requirement. That is why they need to be addressed in standards and law rather than left to implementers' judgement. The European regulation's prohibition on wallet providers collecting usage data, and the guidance from groups such as the American Civil Liberties Union and the Electronic Frontier Foundation against "phone home" designs in mobile licence deployments, are examples. Unlinkable credentials, as discussed in Chapter 4, provide a stronger technical backstop, because even an issuer that obtains verifier records cannot then match them to a person. The third failure is concentration. A system designed to remove intermediaries from identity transactions can create new ones with more power than the old. The obvious candidates are the makers of phone operating systems. If most people hold their government identity in a wallet controlled by Apple or Google, those companies decide which verifiers can reach those credentials, which other wallets can access the phone's secure hardware, and what terms apply. They can change those terms. They can be pressured by governments to change them. They can integrate identity with payments, messaging and advertising in ways that make leaving their ecosystems costlier. None of this has to happen for the structural power to matter. Certification creates a second kind of gatekeeper. High-assurance credentials go only to certified wallets on attested devices. That excludes modified phones, some older and cheaper devices, and independent open-source operating systems whose users are often the most privacy-conscious. It also gives certification bodies influence over which wallet features are permitted. Security justifies some of this. But a system in which participation in public life requires a device from a short list of approved manufacturers running approved software is not what the phrase "self-sovereign" suggested. The countermeasures are competition rules and openness requirements. The European Union's Digital Markets Act, which obliges designated gatekeepers to allow interoperability with hardware features, is directly relevant. The eIDAS requirement that wallets be open source helps. So does the design of the Digital Credentials API, which presents all eligible wallets rather than routing requests to the platform's own. Keeping physical documents valid and widely accepted is the ultimate check, because it ensures no one is forced into any particular wallet. Exclusion and coercion The fourth failure is exclusion, and it falls on people the system does not fit. Digital credentials assume a smartphone with secure hardware, a working camera and biometric sensor, a stable phone number, enough literacy to navigate consent screens, and a valid foundational document such as a passport or national identity card to start from. Many people lack one or more. Experience elsewhere shows how exclusion compounds. India's Aadhaar programme enrolled over a billion residents in a centralised biometric identity system, a very different architecture from the one in this booklet, but the lesson transfers. When welfare distribution was made conditional on biometric authentication, researchers and journalists documented cases in which people were denied subsidised food because fingerprint authentication failed, often for manual labourers or elderly people whose fingerprints had worn. The failure lay not in the identity technology alone but in making it a hard precondition for an essential service, with weak fallbacks. A decentralized system can replicate this if digital credentials become the only practical way to access services. The risk is greatest not where law mandates digital identity, which tends to provoke scrutiny, but where the physical alternatives quietly degrade: offices close, phone lines shorten, staff are trained only on the digital path. Voluntariness in law means little if it is not voluntary in practice. Delegation, discussed in Chapter 5, is part of the answer, as are assisted channels where trained staff can help people obtain and use credentials. The more fundamental safeguard is a legal requirement that services remain accessible without the wallet on equivalent terms, actively monitored and enforced. The fifth failure concerns power. Selective disclosure gives the holder a choice about what to reveal. That choice is meaningful only if refusing is possible. An employer can demand that applicants present a full identity credential. A landlord can ask for more than is needed. An abusive partner can demand to see a person's wallet history. A border officer can require a traveller to unlock a phone. A police officer at a traffic stop who is handed a phone to read a licence has, at least physically, the whole device. In each case the cryptography works perfectly and the holder's control is nonetheless absent, because the relationship is unequal. Paper offers some protection here simply through its limitations: a licence card does not contain a transaction history, and handing it over exposes nothing else. Digital designs should preserve those limitations deliberately. Proximity presentation under ISO 18013-5 is designed so that the holder never has to hand over the phone, and civil liberties groups in the United States have argued that laws should state plainly that presenting a digital licence is not consent to a search of the device. Wallets can allow holders to hide or delete their presentation history. Laws can prohibit verifiers from requesting attributes beyond those legally required for a given transaction, so that the holder's refusal has legal backing. Breakage and legitimacy The sixth failure is the ordinary one: something breaks. Identity systems are high-value targets, and the consequences of a flaw scale with the number of credentials affected. Estonia, often cited as the most successful digital identity nation, had a sharp lesson in 2017. Researchers at Masaryk University in the Czech Republic discovered a flaw, which they named ROCA, in the way a widely used chip from Infineon generated RSA keys, making it feasible to compute private keys from public ones. About three-quarters of a million Estonian identity cards were affected. The government suspended the vulnerable certificates and organised remote updates for cardholders. Estonia's response was widely praised, and the episode showed both that hardware considered secure can harbour systemic flaws and that a well-run system can recover from them. Credential systems face several such risks. An issuer's signing key can be compromised, allowing forged credentials that verify correctly until the key is revoked. Wallet apps can contain bugs or be impersonated by malware. Phishing can move from passwords to presentations: a fake website constructs a request that looks legitimate and persuades the holder to present a credential, which the attacker then relays to a real verifier in real time. Verifier registration and request signing help against this, and binding presentations to the origin of the requesting website, as the browser API does, helps more. The cryptographic horizon matters too. The signature algorithms in today's credentials, ECDSA and RSA, would be broken by a sufficiently large quantum computer. Credentials with lifetimes of five or ten years issued now may still be in circulation when post-quantum migration becomes urgent. Standards bodies are working on post-quantum signature options, but the migration of national identity infrastructure is measured in years. Table 4. Principal failure modes and their countermeasures. Failure mode How it arises Countermeasure Over-asking and verification creep Cheap checks; consent fatigue Registered verifier scopes; data minimisation enforced via wallet logs Issuer surveillance Online status checks; server retrieval; wallet telemetry Status lists; no-phone-home rules; unlinkable credentials Gatekeeping Platform control of devices; wallet certification Interoperability law; open-source wallets; neutral browser API Exclusion No smartphone; weak documents; degraded fallbacks Enforced non-digital alternatives; delegation; assisted channels Coercion Unequal relationships; physical access to phone Proximity presentation; legal limits on requests and device searches Security breaks Key compromise; chip flaws; phishing relays Key rotation; origin binding; revocation; post-quantum planning The final failure is political. Identity systems need public trust, and proposals that look like national identity cards provoke resistance in countries with a tradition of opposing them. The United Kingdom's experience is instructive: an identity card scheme legislated in 2006 was abolished in 2010 after a change of government, and the national digital ID announced in 2025 lost its mandatory element within months. Decentralized architecture can strengthen the case for digital identity, because it is genuinely more private than the alternatives. But the public does not evaluate cryptography. It evaluates institutions. A technically excellent scheme introduced by a distrusted government, or tied to immigration enforcement, or perceived as compulsory, will be resisted on those grounds. Trust has to be earned through governance, independent oversight, transparent rules and real voluntariness, before the technology can deliver its benefits. Each of these failure modes can be designed against. None will be avoided by default. The question for any deployment is whether its sponsors have thought about the worst plausible user of the system and built accordingly. Conclusion The question this booklet set out to answer was whether identity on the internet can work the way a driving licence works at a shop counter, with the evidence in the holder's hands, checkable without calling the issuer, and revealing only what the moment requires. The answer is yes, and the infrastructure to do it now exists. Standard formats carry signed claims. Selective disclosure lets a holder show one field and hide the rest. Batch issuance and zero-knowledge proofs prevent verifiers from linking one use to the next. Wallets on hundreds of millions of phones can hold government credentials, and the browsers on those phones can ask for them. Legislation in Europe obliges governments to offer such wallets and large services to accept them. What follows from that is not a forecast that privacy will improve. It is a claim about where the decisive choices now lie. Through the 2010s the main obstacles to better digital identity were technical and commercial: the cryptography was immature, the standards were fragmented, the platforms were uninterested, and verifiers had no reason to accept credentials no one held. Those obstacles have largely fallen. The remaining ones are institutional. That shift has four consequences that anyone with a stake in these systems should take seriously. The verifier's request is now the main privacy control When selective disclosure was impossible, the privacy of an identity check depended on what the document contained. Now it depends on what the verifier asks for. The cryptography will faithfully disclose whatever is requested and approved. So the rules governing requests, which verifiers may ask for which attributes for which purposes, have become the most important privacy instrument in the system. Those rules must be specific and enforceable. A general principle of data minimisation, applied after the fact by an overworked regulator, will not stop millions of small over-requests. Registration of verifiers with declared attribute scopes, enforced by the wallet at the moment of the request, can. Statutes that require identity or age checks should name the attribute permitted, not merely the outcome to be achieved. A law that says "verify the user is over sixteen" invites document uploads; a law that says "obtain a proof that the user is over sixteen and no other attribute" invites the architecture this booklet describes. Legislators writing verification mandates are, whether they realise it or not, writing privacy architecture. The cheapness problem identified in Chapter 8 follows directly. Because good credentials make checks easy, the decision about whether to require a check carries more weight than before. Any proposed requirement should be weighed as if each check were costly, because in aggregate the social cost of ubiquitous identification is real even when each individual check is private. Unlinkability against the issuer should become the standard The present generation of government deployments protects holders against colluding verifiers through batch issuance but leaves issuers able, in principle, to link presentations they obtain. That was a defensible compromise when unlinkable cryptography was uncertified and slow. It is becoming harder to defend. Proofs over standard ECDSA credentials now run in well under a second on phones and require no change to issuer infrastructure. BBS is nearing standardisation. The direction should be explicit. Regulators and certification bodies should set a path for admitting these techniques, with independent review of the proof systems and the libraries that implement them, and should make issuer-unlinkability a requirement for the most sensitive uses, such as age assurance for access to lawful content, by a defined date. The reason is not distrust of any particular government. It is that an identity infrastructure built today will outlast the governments that built it, and its safeguards should not depend on the good faith of every future administration. Openness must be defended, not assumed The architecture's promise of holder control depends on plurality: more than one wallet, more than one issuer framework, more than one path to participation. Market forces push in the other direction. Platform wallets are preinstalled and convenient. Certification favours large providers. Verification intermediaries aggregate demand. Left alone, these forces will produce a system in which identity is held in two or three wallets controlled by companies that already dominate mobile computing, and in which the transactional centre reappears in the intermediaries that verifiers rely on. This is preventable but not automatic. Competition law that requires access to device security hardware, browser interfaces that present every eligible wallet neutrally, open-source requirements for state wallets, and certification processes accessible to small and non-profit developers all keep the system plural. Verifiers should be wary of integrations that route every check through a single aggregator's servers. Citizens and civil society organisations should ask, of any scheme, whether they could use a wallet from a different provider and what that provider would learn. Voluntariness must be real The final consequence concerns the people the system does not fit, and the people who choose not to use it. A digital identity scheme earns legitimacy partly by being optional. That legitimacy is lost if the alternatives decay. The European regulation's prohibition on disadvantaging non-users is the right principle, and it needs monitoring: service by service, measuring whether the non-digital path is as fast, as available and as widely accepted as the digital one. The United Kingdom's experience with a mandatory proposal, withdrawn within months, shows how quickly compulsion destroys public consent. Australia's choice to forbid platforms from requiring government identification as the only age assurance method shows a way of building verification requirements that do not force identity documents on everyone. Both point to the same conclusion. The benefits of decentralized identity, which are substantial, will be realised only where people trust that they can decline it. What builders and verifiers owe Much of the preceding argument is addressed to legislators and regulators, but the same logic binds the organisations that build and use these systems. A wallet maker that collects usage analytics "to improve the product" has rebuilt the observer the architecture was meant to remove, whatever its privacy policy says. A verifier that requests a full identity credential where an age proof would do is collecting data it will one day have to defend in a breach notice. An issuer that chooses online status checks over status lists because they are simpler to operate has chosen to learn where its credentials are used. Each of these is a small engineering decision, taken for local reasons, and each moves the system back toward the account model it was meant to replace. The practical discipline is to design for the least each party needs to know. The issuer needs to know whom it is issuing to, and nothing about later use. The verifier needs the specific fact the transaction depends on, and a way to show an auditor it checked. The wallet provider needs to keep the software working, and nothing about where it is used. Organisations that adopt that discipline will hold less data, face smaller breaches and make simpler compliance arguments. The privacy case and the risk-management case point the same way, which is the best reason to expect at least some verifiers to choose well without being forced. The shape of the answer Kim Cameron wrote his laws because Microsoft had built a system that violated them, and he saw that such systems fail. The systems now being built have the technical means to honour every one of his laws: user control, minimal disclosure, justifiable parties, directed identity, pluralism, human integration and consistent experience. Whether they do will be decided by verifier rules, certification regimes, competition policy and the protection of alternatives. Those decisions are being made now, in the implementing acts, procurement contracts and statutory instruments of 2026 and 2027. The account model made identity something held about people. The decentralized model can make it something people hold. The technology settles nothing by itself. It gives institutions the means to build identity systems that respect people, and removes the old excuse that the technology could not do it. Notes 1. Peter Steiner, "On the Internet, nobody knows you're a dog", cartoon, The New Yorker, 5 July 1993. 1. Christopher Allen, "The Path to Self-Sovereign Identity", Life With Alacrity (blog), April 2016. 1. Kim Cameron, "The Laws of Identity", Microsoft Corporation, May 2005. 1. D. Hardt (ed.), "The OAuth 2.0 Authorization Framework", IETF RFC 6749, October 2012; N. Sakimura et al., "OpenID Connect Core 1.0", OpenID Foundation, 2014. 1. United States Government Accountability Office, Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach, GAO-18-559, August 2018. 1. Facebook (Meta), "An Update on Our Plans to Restrict Data Access on Facebook", company statement by Mike Schroepfer, 4 April 2018, giving the estimate of up to 87 million affected users. 1. World Wide Web Consortium, Decentralized Identifiers (DIDs) v1.0, W3C Recommendation, 19 July 2022. 1. Sovrin Foundation, "Sovrin Foundation MainNet Ledger Shutdown Likely on or before March 31, 2025", announcement, October 2024; and "The Sovrin Foundation Has Been Dissolved — but Sovrin MainNet Remains", 2025. 1. Microsoft, "What's new in Microsoft Entra Verified ID", Microsoft Learn documentation (entries for June 2022 and December 2023 on did:web and did:ion). 1. World Wide Web Consortium, Verifiable Credentials Data Model v2.0, W3C Recommendation, May 2025; and Verifiable Credentials Overview, W3C Group Note, 2025-2026, listing the status of the companion specifications (Data Integrity, Bitstring Status List, VC-JOSE-COSE, BBS cryptosuite). 1. D. Fett, K. Yasuda and B. Campbell, "Selective Disclosure for JSON Web Tokens", IETF RFC 9901, November 2025. 1. ISO/IEC 18013-5:2021, Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application; ISO/IEC 18013-7, Part 7: Mobile driving licence (mDL) add-on functions (online presentation). 1. David Chaum, "Security Without Identification: Transaction Systems to Make Big Brother Obsolete", Communications of the ACM 28, no. 10 (1985): 1030-1044. 1. Jan Camenisch and Anna Lysyanskaya, "An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation", Advances in Cryptology — EUROCRYPT 2001, Springer, 2001. 1. Dan Boneh, Xavier Boyen and Hovav Shacham, "Short Group Signatures", Advances in Cryptology — CRYPTO 2004, Springer, 2004. 1. Matteo Frigo and abhi shelat, "Anonymous Credentials from ECDSA", IACR Cryptology ePrint Archive, Paper 2024/2010. 1. Google, "Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance", The Keyword (Google blog), 3 July 2025. 1. OpenID Foundation, OpenID for Verifiable Presentations 1.0, final specification, July 2025; OpenID for Verifiable Credential Issuance 1.0, final specification, September 2025. 1. Google Chrome Developers, "Digital Credentials API: Secure and private identity on the web", blog post announcing default availability in Chrome 141, 2025. 1. Apple, "Apple introduces Digital ID, a new way to create and present an ID in Apple Wallet", Apple Newsroom, 12 November 2025. 1. Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, Official Journal of the European Union, 30 April 2024. 1. European Commission, "Commission makes available an age verification blueprint", Shaping Europe's Digital Future, 14 July 2025. 1. Free Speech Coalition, Inc. v. Paxton, 606 U.S. ___ (2025), decided 27 June 2025. 1. Ofcom, Guidance on highly effective age assurance, under the Online Safety Act 2023, effective 25 July 2025. 1. Australian Government, Department of Infrastructure, Transport, Regional Development, Communications and the Arts, Age Assurance Technology Trial: Final Report, September 2025; Online Safety Amendment (Social Media Minimum Age) Act 2024. 1. The Register, "UK backtracks on digital ID requirement for right to work", 14 January 2026. 1. Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec and Vashek Matyas, "The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017). 1. Willcock v Muckle [1951] 2 KB 844. Further Reading Kim Cameron, "The Laws of Identity" (2005). A short paper that remains the clearest statement of what any identity system must respect. Read it first, and test every scheme against it. Christopher Allen, "The Path to Self-Sovereign Identity" (2016). The essay that named the movement, with a concise history of online identity and ten principles that are still widely cited. Alex Preukschat and Drummond Reed, Self-Sovereign Identity: Decentralized Digital Identity and Verifiable Credentials (Manning, 2021).** The most complete book-length treatment of the field from its practitioners, covering architecture, governance and early deployments. Some of its technology choices have since been overtaken, but the conceptual chapters hold up. Philip J. Windley, Learning Digital Identity: Design, Deploy, and Manage Identity Architectures (O'Reilly, 2023).** A broad and readable account of digital identity, from authentication and federation through to verifiable credentials, by a long-time practitioner. David Chaum, "Security Without Identification: Transaction Systems to Make Big Brother Obsolete" (1985). The founding vision of privacy-preserving credentials, still striking in its foresight. Stefan Brands, Rethinking Public Key Infrastructures and Digital Certificates: Building in Privacy (MIT Press, 2000).** A rigorous treatment of selective disclosure and unlinkable certificates, written long before deployment was practical. W3C, Verifiable Credentials Overview (Group Note, current edition).** The official map of the W3C credential specifications, with plain explanations of how the data model, securing mechanisms and status lists fit together. European Commission, European Digital Identity Wallet Architecture and Reference Framework. Published openly and updated regularly, it is the most detailed public design document for a national-scale credential system, including its treatment of linkability, wallet attestation and relying party registration. Matteo Frigo and abhi shelat, "Anonymous Credentials from ECDSA" (2024). For readers comfortable with technical material, the paper behind the current generation of zero-knowledge age proofs over existing government credentials. Hashtags: #DecentralizedIdentity #DID #SelfSovereignIdentity #SSI #VerifiableCredentials #DigitalIdentity #DigitalIdentityWallets #DecentralizedIdentifiers #W3CStandards #BlockchainIdentity #IdentityManagement #DigitalTrust #IdentityVerification #CryptographicIdentity #PublicKeyInfrastructure #DigitalSignatures #SelectiveDisclosure #ZeroKnowledgeProofs #PrivacyPreservingIdentity #DataPrivacy #UserDataControl #CredentialIssuance #CredentialVerification #CredentialRevocation #HolderBinding #Unlinkability #Interoperability #EUDIWallet #DigitalCredentials #IdentitySecurity

Download the Book (PDF): Introduction Every deployed machine learning model eventually meets an input it has no business answering. A dermatology classifier trained on clinic photographs is shown a picture taken under the yellow light of a kitchen. A demand forecaster built on three stable years is asked about the week a competitor goes bankrupt. A fraud model trained on card-present transactions is fed a new payment channel the data team did not know existed. In each case the model does exactly what it was built to do: it returns a number. The number is formatted the same way as every other number it has ever returned. It carries the same number of decimal places. Nothing about it signals that this time the model is guessing. That is the problem this book is about. Most of the machine learning that engineers build and ship is deterministic in a specific and limiting sense: given an input, it produces one answer, and the answer arrives without any honest account of how much the model actually knows. Sometimes there is a score attached, a softmax probability or a regression residual, and it is tempting to read that score as confidence. It usually is not. A neural network can assign 99 percent probability to a class for an image of pure noise. A linear regression's residual standard error says nothing about the extra uncertainty of extrapolating far outside the training range. The output looks calibrated because it is a number between zero and one, not because anything in the training process forced it to mean what it appears to mean. Bayesian machine learning starts from a different premise. It treats everything the model does not know, including its own parameters, as a quantity with a probability distribution. Training is not the search for one best setting of the weights; it is the computation of which settings remain plausible after seeing the data, and how plausible each one is. Prediction is not the evaluation of one function; it is an average over all the plausible functions, weighted by how much the data supports each. What comes out the other end is not a point but a distribution, and the width of that distribution is the model telling you, in a precise and checkable way, how sure it is. The argument of this book The controlling claim here is simple to state and demanding to act on: a prediction without a statement of uncertainty is an incomplete prediction, and the Bayesian framework is the most coherent general-purpose way to complete it. The rest follows from taking that claim seriously as an engineer rather than as a philosopher. Taking it seriously means three things. First, you need a way to say what you knew before the data arrived, because the posterior depends on it and pretending otherwise just hides the assumption somewhere less visible. That is the job of the prior. Second, you need a way to actually compute the posterior, which for any interesting model is an integral nobody can solve with a pencil. That is the job of inference algorithms, chiefly Markov chain Monte Carlo and variational methods, and of the probabilistic programming languages that make them usable. Third, you need to do something with the uncertainty once you have it: decide when to abstain, which experiment to run next, how wide a safety margin to leave, or how to tell a user that the answer is shaky. Uncertainty that never changes a decision is decoration. The book follows that arc. It opens with what goes wrong when models report single numbers, and why the errors are not random noise but systematic overconfidence in exactly the situations that matter. It then sets out Bayes' rule as a practical tool, works through the craft of choosing priors, and spends two chapters on how posteriors are actually computed, by sampling and by approximation. A chapter on probabilistic programming shows what the modern tooling looks like and how a working Bayesian modeller structures a project. The last two chapters move to the frontier and to the payoff: how far Bayesian ideas can be pushed into deep learning, and how uncertainty is turned into better decisions in production systems. Who this is for The intended reader builds or maintains models: a machine learning engineer, a data scientist, a software engineer who has inherited a forecasting service, a technical lead who has to decide whether a model is safe to put in front of customers. You should be comfortable with the idea of a loss function, a training set, and a probability distribution. You do not need to have taken a course in Bayesian statistics, and the book defines its terms as it goes. The mathematics is kept to what carries the argument. Where an equation is the clearest way to say something, it appears in plain notation. Where a short piece of code makes the workflow concrete, it is included, written in Python against the libraries most practitioners actually use. The emphasis throughout is on judgment: what to choose, what to check, what to distrust, and what the failure looks like when you get it wrong. What this book does not try to do A short book on a large field has to choose. This one does not survey the long philosophical argument between Bayesian and frequentist schools of statistics, except where the difference changes what an engineer should build. It does not derive the convergence theory of Markov chains or the measure-theoretic foundations of probability. It does not attempt a complete catalogue of Bayesian nonparametric models, and it treats Gaussian processes only as far as they illuminate the main argument. Readers who want any of those will find the right sources listed at the end. Nor does the book pretend that Bayesian methods are always the right answer. They cost compute, they demand modelling decisions that some teams would rather not make explicitly, and in the regime of very large neural networks the full Bayesian posterior is out of reach and the approximations are contested. Several chapters spend real time on those limits and on the non-Bayesian tools, such as ensembles and conformal prediction, that often sit beside Bayesian ones in a well-built system. The aim is not conversion. It is to give an engineer enough understanding of the Bayesian approach to know when it is worth its cost, how to use it competently when it is, and how to recognise when a model's confidence is not to be trusted regardless of how it was produced. A note on the word "uncertainty" The word does a lot of work in this book, so it is worth fixing its meaning early. Uncertainty here is always uncertainty about something, held by a model, and expressible as a probability distribution. When a weather service says there is a 30 percent chance of rain tomorrow, it is stating uncertainty about tomorrow's weather. When a Bayesian regression says the slope coefficient lies between 0.8 and 1.4 with 90 percent probability, it is stating uncertainty about a parameter. When a classifier says a scan shows a tumour with probability 0.62, it is stating uncertainty about a label. In each case the statement can be checked. If the weather service says 30 percent on a hundred days, it should rain on about thirty of them. That property, calibration, is the empirical test that separates honest uncertainty from a number that merely looks like a probability, and it recurs throughout the book. A Bayesian model is not automatically well calibrated. It is calibrated to the extent that its assumptions match the world, and much of the practical skill of Bayesian machine learning is in checking those assumptions and repairing them when they fail. That is the promise and the discipline in one sentence. Bayesian methods give you a principled way to produce uncertainty, and an equally principled way to find out when the uncertainty you produced is wrong. Chapter 1: The Cost of a Single Number In 2015 three researchers, Anh Nguyen, Jason Yosinski and Jeff Clune, published a paper with a title that reads like a provocation: "Deep Neural Networks Are Easily Fooled." They took image classifiers that performed at or near the state of the art on ImageNet and used an evolutionary search to generate images the networks would classify with near-total confidence. Some of the images were static-like noise. Others were bold, repetitive patterns of stripes and colours. To a human they looked like nothing at all. The networks labelled them as specific animals and objects, with confidence above 99 percent. The finding was not that the networks made mistakes. Every model makes mistakes. The finding was that the networks had no way of saying I have never seen anything like this. The architecture and training procedure produced a probability vector for every input, and there was nothing in that process that tied the size of the top probability to how familiar the input was. Confidence and competence had come apart. This chapter is about that separation: why it happens, why it is the norm rather than the exception, and what it costs when a system acts on numbers that look like probabilities but are not. What a point prediction hides Consider the standard recipe for training a supervised model. You choose a model family, a neural network or a gradient-boosted tree or a linear regression. You choose a loss, cross-entropy or squared error. You find the parameter setting that minimises the loss on the training data, perhaps with some regularisation added. You then use that single parameter setting to make every prediction from then on. The single parameter setting is the heart of the issue. With any realistic amount of data, many different settings fit the training set nearly equally well. A network with millions of weights has an enormous space of configurations that achieve low training loss, and they do not all agree on inputs away from the training data. A regression fitted to points that span ages 20 to 60 might be well determined in that range and very poorly determined at age 85, where small changes in the slope produce large changes in the prediction. The optimiser picks one of these settings, partly by the data and partly by accidents of initialisation and the order of minibatches, and the rest are thrown away. What is thrown away is exactly the information you would need to know how much to trust the prediction. If all plausible parameter settings agree on an input, the prediction is robust. If they disagree wildly, the prediction is essentially arbitrary, determined by which setting the optimiser happened to land on. A point estimate cannot distinguish these cases, because it has discarded the alternatives that would reveal the disagreement. Statisticians have names for the two kinds of uncertainty that matter here, and they are worth adopting because they change what you do about each. Aleatoric uncertainty is the irreducible randomness in the thing being predicted. A fair coin is uncertain no matter how many times you have studied it. A customer's next purchase depends on things the model never observes. Collecting more training data does not make aleatoric uncertainty go away; it only lets you estimate its size more precisely. A well-specified regression with a noise term captures this: the noise variance is aleatoric. Epistemic uncertainty is uncertainty about the model itself, arising from limited data. It is large where training data are sparse and small where they are dense. It shrinks as you collect more data. It is the uncertainty that tells you an input is unlike anything seen in training, and it is precisely the uncertainty that point estimates throw away. A softmax output, at best, approximates aleatoric uncertainty: it tries to say how mixed the labels are for inputs like this one. It has no mechanism at all for epistemic uncertainty, because there is only one model. That is why a network can be supremely confident on noise. Its single function extrapolates to some region of the output space, and nothing tells it that the extrapolation rests on nothing. Alex Kendall and Yarin Gal made this distinction central to their 2017 paper "What Uncertainties Do We Need in Bayesian Deep Learning for Computer Vision?", showing on segmentation and depth regression tasks that modelling the two separately improved performance and, more importantly, gave different and useful signals. Aleatoric uncertainty was high at object boundaries and for distant objects, where the labels themselves are ambiguous. Epistemic uncertainty was high for object classes and scenes that were rare in the training set. An engineer who wants to know whether to collect more data needs the second signal; an engineer who wants to know whether the task itself is ambiguous needs the first. Why confidence grows far from the data The fooling images are not an accident of one architecture. There is a structural reason why standard networks become more confident, not less, as inputs move away from anything they were trained on. In 2019 Matthias Hein, Maksym Andriushchenko and Julian Bitterwolf proved it for a large class of models in their paper "Why ReLU Networks Yield High-Confidence Predictions Far Away From the Training Data and How to Mitigate the Problem." A network built from rectified linear units computes a function that is piecewise linear: the input space is carved into many regions, and within each region the network's logits are a linear function of the input. Far enough from the data, along almost any direction, the input stays inside one of the outermost regions, and the logits grow linearly with distance. Push a linear function through a softmax and the largest logit soon dominates the others completely. The predicted probability of one class approaches one. In other words, for these networks, scaling up an input that the model has never seen, an image multiplied by a large constant, for instance, will almost always produce a near-certain prediction. That is the opposite of what a reasonable model of knowledge should do. Far from the data, a model should become less sure, because it has less evidence about what happens there. The trained network becomes more sure, because the geometry of its function forces it to. The point matters because it rules out a comforting hope, that overconfidence is a quirk of training that better optimisation or more data will cure. It is a property of the model family's extrapolation behaviour. To fix it, something has to change about how the model represents what it does not know. Hein and colleagues proposed training-time remedies that penalise confidence on synthetic out-of-distribution inputs. The Bayesian remedy, developed through the rest of this book, is to stop relying on one function's extrapolation and to average over many functions whose extrapolations disagree. Miscalibration is systematic If overconfidence were rare, or confined to adversarial curiosities like evolved noise images, it would be an academic concern. It is neither. In 2017 Chuan Guo, Geoff Pleiss, Yu Sun and Kilian Weinberger published "On Calibration of Modern Neural Networks," which measured something simple: when a classifier says it is 80 percent confident, is it right 80 percent of the time? They found that older, smaller networks such as LeNet from the late 1990s were reasonably well calibrated, but that modern, deeper networks like ResNets were markedly overconfident. Their confidence ran ahead of their accuracy, and the gap grew with depth, width, and the use of techniques like batch normalisation and reduced weight decay. The very changes that had made networks more accurate had made their probabilities less honest. Their proposed repair, temperature scaling, is worth understanding because it shows both how much and how little a quick fix can do. You hold out a validation set, and you learn a single scalar, the temperature, that divides all the network's logits before the softmax. A temperature above one softens the probabilities. Fitting that one number on held-out data dramatically improved calibration on the test set from the same distribution. It remains one of the most cost-effective things an engineer can do to a deployed classifier. But temperature scaling only corrects calibration where the validation set looks like the test set. In 2019 Yaniv Ovadia and colleagues at Google published "Can You Trust Your Model's Uncertainty?", a large benchmark that evaluated uncertainty methods under dataset shift: images with added blur, noise or contrast changes of increasing severity, text from new domains, and entirely out-of-distribution inputs. As shift increased, every method's calibration degraded, and post-hoc temperature scaling degraded badly because the temperature learned on clean data was wrong for shifted data. Methods that represented epistemic uncertainty, chiefly deep ensembles and to a lesser degree some Bayesian approximations, held up better. None were perfect. The lesson is uncomfortable. Calibration measured on a held-out split of your training distribution tells you how the model behaves on data you already understand. It tells you little about how it behaves on the data that will actually cause problems in production, which is almost by definition data that differs from what you trained on. Measuring whether a probability means anything Before going further it helps to be precise about what "calibrated" means and how to check it, because the same tools are used to evaluate every method in this book. For a classifier, the standard diagnostic is a reliability analysis. You group test predictions into bins by their stated confidence, say 0.0 to 0.1, 0.1 to 0.2, and so on. Within each bin you compute the fraction that were actually correct. A perfectly calibrated model has accuracy equal to confidence in every bin. The expected calibration error summarises the gaps as a weighted average of the absolute difference between accuracy and confidence across bins, weighted by how many predictions fall in each. Expected calibration error is popular because it is intuitive, but it has known weaknesses. It depends on the binning scheme, it can be gamed by a model that always predicts the base rate, and it ignores everything except the top predicted class. For these reasons serious evaluations also report proper scoring rules, which reward a forecast for being both accurate and honest about its uncertainty. The two most common are the log score, the negative log probability the model assigned to the outcome that actually happened, and the Brier score, the squared difference between the predicted probability vector and the one-hot outcome. A scoring rule is called proper if a forecaster minimises their expected score by reporting their true beliefs. Under a proper scoring rule there is no advantage to shading probabilities toward confidence or toward caution; honesty is the optimal strategy. That property is why the log score, which is the same quantity as the test-set negative log likelihood, appears in almost every serious uncertainty benchmark. For regression the analogous check is interval coverage. If a model produces 90 percent prediction intervals, then across a test set about 90 percent of true values should fall inside them. Coverage alone is not enough, because an interval from minus infinity to infinity has perfect coverage, so it is paired with interval width: among methods with correct coverage, narrower is better. A continuous version of the log score, and the continuous ranked probability score, which compares the whole predicted distribution against the observed value, play the role that proper scoring rules play for classification. These checks matter because they make uncertainty falsifiable. A model that reports wide intervals is not thereby honest; it is honest if its intervals contain the truth at the stated rate. Throughout this book, a method is judged by whether its uncertainty survives these tests, not by whether it is philosophically appealing. What overconfidence costs The damage done by a single overconfident number depends on what the number is used for, and it is worth being concrete. In medical imaging, a classifier that flags suspicious lesions is typically deployed with a human radiologist in the loop. The value of such a system depends heavily on knowing which cases it can handle and which it should hand back. A model with honest uncertainty can triage: confident negatives are deprioritised, uncertain cases get a closer look. A model with uniformly high confidence offers no triage signal at all, and worse, it can lead clinicians to anchor on a wrong answer. The problem sharpens when a model trained at one hospital is used at another with different scanners, patient populations, and acquisition protocols. That is a dataset shift of exactly the kind the Ovadia benchmark showed degrades calibration. In forecasting for operations, whether demand for a retailer or load for an electricity grid, the decision that matters is usually not the point forecast but how much buffer to hold. Inventory is set to cover a high quantile of demand, not the mean. Reserve generation is scheduled against the risk of a shortfall, not the expected load. A point forecast forces planners to invent the buffer by rule of thumb. A forecast distribution lets them set it to an explicit service level, and lets them see that the buffer should be larger in the weeks where the model knows less, such as around a holiday whose date moved. In autonomous and robotic systems, an overconfident perception module is a direct safety hazard. The canonical failure is a detector that misclassifies an unusual object with high confidence, and a planner downstream that trusts the classification because nothing told it not to. The design pattern that helps is to have perception components report uncertainty and planners that become more conservative as uncertainty rises: slow down, widen margins, or hand control back. That pattern is only as good as the uncertainty estimates feeding it. In experimentation and decision-making more broadly, overconfidence produces a quieter cost: decisions taken too early. An A/B test read off a point estimate of lift encourages shipping a variant that happened to look good on a small sample. A recommender that is confident about a user's tastes after three clicks stops exploring and locks them into a narrow slice of the catalogue. In each case, an honest account of how little was known would have argued for gathering more information before committing. What it would take to do better Suppose you accept the diagnosis. What would a model need in order to report honest uncertainty, especially the epistemic kind? It would need to keep track of more than one hypothesis about its own parameters. Where the data constrain the parameters tightly, the hypotheses would agree and the prediction would be confident. Where the data are silent, the hypotheses would diverge and the prediction would be uncertain. It would need some principled way to weigh the hypotheses against each other, so that settings that explain the data well count for more than ones that explain it poorly. And it would need some starting position, before any data, about which settings are plausible at all, because without one there is no way to say how far apart the hypotheses should spread in regions with no data. That description is, almost word for word, the Bayesian approach. The collection of weighted hypotheses is the posterior distribution. The principled weighting is the likelihood. The starting position is the prior. The prediction that averages over hypotheses is the posterior predictive distribution. The next chapter takes these pieces one at a time and shows that, far from being a philosophical stance, they are an engineering toolkit with well-defined inputs and outputs. It is worth being clear about what this does not promise. Representing uncertainty about parameters is not a guarantee of calibration. A Bayesian model whose assumptions are wrong will produce posterior distributions that are confidently wrong, and a model whose posterior is approximated badly will report uncertainty that bears little relation to the true posterior. Bayesian methods move the problem of honest uncertainty from somewhere invisible, buried in the habits of an optimiser, to somewhere explicit, in a model you can inspect and criticise. That is a large gain. It is not the end of the work. There are also strong non-Bayesian tools for some of the same goals. Deep ensembles, which simply train several networks from different random initialisations and average them, are often the best-performing practical method for uncertainty in large neural networks. Conformal prediction, which wraps any model in a procedure that produces prediction sets with guaranteed coverage under an exchangeability assumption, offers a finite-sample guarantee that Bayesian methods do not. Later chapters treat both directly and show how they relate to Bayesian ideas. The case for learning the Bayesian framework is not that it wins every benchmark. It is that it gives a single coherent language in which priors, data, uncertainty and decisions all fit together, and that this coherence is what lets an engineer reason about a system rather than tune it by trial and error. Chapter 2: Bayes' Rule as an Engineering Tool Bayes' rule is usually introduced through a puzzle about medical tests, and the puzzle is a good one. Suppose a disease affects one person in a thousand, and a test for it has a sensitivity of 99 percent and a false positive rate of 5 percent. A patient tests positive. What is the probability that they have the disease? Most people, including many clinicians when the question has been put to them in studies, say something close to 95 percent. The right answer is under 2 percent. Out of every thousand people tested, about one has the disease and almost certainly tests positive, while about fifty of the 999 healthy people also test positive. A positive result puts you in a group of roughly fifty-one people, only one of whom is sick. The puzzle teaches that base rates matter. But for an engineer its more important lesson is structural. The calculation had three inputs: what you believed before the test (one in a thousand), how the test behaves under each hypothesis (99 percent and 5 percent), and the observed result. It had one output: what you should believe after. That shape, prior plus likelihood plus data gives posterior, is the whole of Bayesian inference. Everything else in this book is a way of applying it to models with more than one unknown and computing the result when the arithmetic gets hard. The four objects Write the unknown quantities as θ (theta). In the medical example θ was a single yes-or-no fact about the patient. In a regression it is the vector of coefficients and the noise level. In a neural network it is every weight. Write the observed data as y. Bayes' rule says: p(θ | y) = p(y | θ) p(θ) / p(y) Each term has a name and a job. The prior, p(θ), is a probability distribution over the unknowns before seeing the data. It encodes what values are plausible: that a conversion rate is somewhere between zero and one and probably below a few percent, that a regression coefficient on a standardised input is unlikely to be larger than about five in magnitude, that a network's weights are mostly small. Chapter 3 is devoted to choosing it. The likelihood, p(y | θ), is the probability of the observed data if the unknowns took a particular value. It is the same object that maximum likelihood estimation maximises, and it is where the model's structural assumptions live: that the noise is Gaussian, that the counts are Poisson, that the label depends on the inputs through a logistic function. Read as a function of θ with y held fixed, it scores each hypothesis by how well it explains what was seen. The posterior, p(θ | y), is the result: a distribution over the unknowns after seeing the data. It is not a single best value but a full account of which values remain plausible and how plausible each is. The evidence or marginal likelihood, p(y), is the probability of the data averaged over all values of θ weighted by the prior. As far as the posterior over θ is concerned it is just a normalising constant, the number that makes the posterior integrate to one. It becomes important in its own right when comparing models, because it measures how well a whole model, prior included, predicted the data. It is also the reason Bayesian computation is hard: computing it requires integrating over every possible value of θ, and for most models that integral has no closed form. Because p(y) does not depend on θ, practitioners often write the rule in proportional form, posterior proportional to likelihood times prior, and leave normalisation to the algorithm. Most of the inference methods in Chapters 4 and 5 work precisely because they can explore the posterior using only this unnormalised product, never computing p(y) directly. A complete worked example: the conversion rate The clearest way to see what the posterior buys you is a model small enough to do by hand. Suppose you run an online shop and launch a new checkout page. In its first day, 40 visitors reach it and 3 complete a purchase. What is the conversion rate? The maximum likelihood answer is 3 out of 40, or 7.5 percent. It is a single number, and it gives you no sense of how much to trust it. Three conversions is a very small count. Had one more or one fewer person bought, the estimate would have moved by more than two percentage points. The Bayesian treatment needs a likelihood and a prior. The likelihood is binomial: each visitor converts independently with probability θ. For the prior, a natural choice for a quantity between zero and one is the beta distribution, which has two parameters that behave like pseudo-counts of prior successes and failures. Suppose your existing checkout converts at about 4 percent and you have no strong reason to think the new page is wildly different. A Beta(2, 48) prior has a mean of 4 percent and is fairly broad: it puts meaningful probability on rates from under 1 percent to around 10 percent. The beta distribution is conjugate to the binomial likelihood, which means the posterior is also a beta distribution and its parameters are found by simple addition. Add the observed successes to the first parameter and the observed failures to the second. The posterior is Beta(2 + 3, 48 + 37), that is Beta(5, 85). Its mean is 5 out of 90, about 5.6 percent. A central 90 percent credible interval runs from roughly 2.2 percent to 10 percent. Three things have happened. First, the estimate has been pulled from the raw 7.5 percent toward the prior mean of 4 percent, because 40 visitors is not much evidence and the prior represented roughly 50 visitors' worth of background belief. Second, you now have an interval with a direct interpretation: given the model and the prior, there is a 90 percent probability that the true rate lies in it. That is a statement about θ, unlike a frequentist confidence interval, whose 90 percent refers to the long-run behaviour of the procedure that generated it. Third, as the data accumulate the prior will matter less and less. After 4,000 visitors with 300 conversions, the posterior is Beta(302, 3,748), with mean about 7.5 percent and an interval less than two percentage points wide. The prior's 50 pseudo-observations are swamped. This last point deserves emphasis because it answers the most common objection to Bayesian methods, that the prior is subjective and therefore contaminates the result. With little data, the prior matters, and it should, because with little data you genuinely do have to rely on background knowledge, and pretending not to is itself a strong and usually unexamined assumption. With much data, the likelihood dominates and reasonable priors lead to nearly identical posteriors. The prior has most influence exactly where the data are least informative. From posterior to prediction The posterior over parameters is rarely the end goal. What an engineer usually needs is a prediction about future data: will the next visitor convert, what will tomorrow's demand be, what label should this image get. The Bayesian answer is the posterior predictive distribution: p(ỹ | y) = ∫ p(ỹ | θ) p(θ | y) dθ In words: for each plausible value of the parameters, compute the predictive distribution that value implies; then average those predictive distributions, weighting each by its posterior probability. This is where the collection of hypotheses described at the end of Chapter 1 becomes a prediction. Hypotheses that agree reinforce each other and the predictive distribution is narrow. Hypotheses that disagree spread the predictive distribution out. For the conversion example, the predictive probability that the next visitor converts is simply the posterior mean, 5.6 percent. More interesting is a question like: of the next 1,000 visitors, how many will convert? The posterior predictive here is a beta-binomial distribution, and it is noticeably wider than a binomial with p fixed at 5.6 percent would be. The extra width is epistemic uncertainty about θ propagated into the prediction. A planner who used the point estimate would underestimate the range of outcomes; one who used the posterior predictive would not. This is the core mechanism for every model in this book. The posterior predictive automatically combines aleatoric uncertainty, the randomness in ỹ given θ, with epistemic uncertainty, the spread of θ itself. As data accumulate, the epistemic part shrinks and the predictive distribution converges to the aleatoric floor. Where data are scarce, the epistemic part dominates. In practice the integral is almost never computed analytically. Instead, the inference algorithm produces a set of samples from the posterior, θ₁ through θₛ, and the posterior predictive is approximated by simulating ỹ once from each. If you have 4,000 posterior samples, you have 4,000 simulated futures, and any summary you want, a mean, a quantile, the probability of exceeding a threshold, is computed by counting. This sample-based representation is one of the great practical strengths of the approach: once you have posterior samples, any question about any derived quantity is answered the same way. Bayesian linear regression The beta-binomial model has one parameter. The step to many parameters is shown most cleanly by linear regression, which also connects Bayesian ideas to techniques most engineers already use. Suppose y = Xβ + ε, where X is a matrix of inputs, β is a vector of coefficients, and ε is Gaussian noise with variance σ². Ordinary least squares finds the β that minimises the sum of squared residuals. Now put a Gaussian prior on β, centred at zero with variance τ² on each coefficient. For known σ, this prior is conjugate: the posterior over β is also Gaussian, with a mean and covariance that can be written in closed form. The posterior mean is exactly the ridge regression estimate, with a ridge penalty equal to σ²/τ². This correspondence is worth absorbing because it reframes something familiar. L2 regularisation, which every practitioner applies to stop models overfitting, is a Gaussian prior on the weights in disguise. Choosing the regularisation strength by cross-validation is choosing the prior variance by an empirical procedure. Likewise L1 regularisation, as in the lasso, corresponds to the mode of the posterior under a Laplace prior. The prior was always there. The Bayesian view makes it explicit and, crucially, keeps the rest of the posterior rather than only its peak. That rest of the posterior is where the uncertainty lives. The posterior covariance of β tells you which coefficients are well determined and which are not, and how they trade off against each other: two correlated inputs will have coefficients whose posterior is stretched along a diagonal, because the data can pin down their sum but not how it is split. The posterior predictive at a new input x is Gaussian with variance equal to σ² plus a term that depends on how far x lies from the bulk of the training inputs, measured in the geometry of the posterior covariance. Inside the training range that second term is small. Far outside it, the term grows, and the predictive interval widens. That widening is the property the overconfident point predictor lacked. It falls straight out of the mathematics with no special mechanism added. What the posterior is not Three misreadings of the posterior are common enough to name. The first is treating the posterior as an estimate of the frequency with which a parameter takes various values. In most applications there is one true parameter; it does not vary. The posterior represents the model's state of knowledge about that fixed value. Its width reflects how much the data and prior pin it down. The second is treating the posterior as automatically correct. It is correct relative to the model. If the likelihood is misspecified, for instance if the noise has heavy tails and the model assumes Gaussian noise, the posterior can be confidently centred on the wrong answer, with intervals that are far too narrow. One of the uncomfortable results of Bayesian theory is that with a misspecified model, the posterior concentrates as data grow, but it concentrates on the parameter value that makes the model closest to the truth in a particular information-theoretic sense, and its width no longer reflects real uncertainty. More data makes such a model more confident, not more right. Checking the model against the data, through techniques covered in Chapter 6, is therefore part of the method, not an optional extra. The third is ignoring the posterior's shape. Reporting only the posterior mean and standard deviation discards information whenever the posterior is skewed, bounded, or has several separate modes. A posterior over a variance parameter is typically right-skewed. A posterior over the parameters of a mixture model can have several symmetric modes corresponding to relabellings of the components. A sample-based representation preserves all of this, which is one reason modern practice prefers samples to summary statistics. Updating in sequence One property of Bayes' rule is so useful in engineering systems that it deserves its own section: today's posterior is tomorrow's prior. If data arrive in batches, you can update on the first batch, take the resulting posterior as the prior for the second, update again, and arrive at exactly the same answer as if you had processed all the data at once, provided the observations are conditionally independent given the parameters. In the conversion example, updating on day one's 40 visitors and then on day two's 60 gives the same Beta posterior as updating on all 100 together. This makes Bayesian models naturally suited to streaming data. The Kalman filter, developed by Rudolf Kálmán around 1960 and used in navigation systems from the Apollo programme to modern phone GPS, is a sequential Bayesian update for linear systems with Gaussian noise. At each time step it predicts where the system will be, with an uncertainty that grows because the system moves unpredictably, then observes a noisy measurement and updates, with an uncertainty that shrinks because the measurement is informative. The filter's state is a posterior distribution, carried forward step by step. Its gain, the weight it gives to each new measurement, is not a tuned constant but a ratio of uncertainties: when the prediction is uncertain and the sensor is precise, it trusts the sensor; when the prediction is confident and the sensor is noisy, it trusts the prediction. The same principle governs the simple bandit algorithms discussed in Chapter 8, which update beta posteriors on click-through rates one impression at a time, and online learning systems that maintain a posterior over the parameters of a model as data flow in. Sequential updating also offers a clean way to think about non-stationarity. If the world changes over time, the parameters from last year are less relevant than those from last week, and a model can represent that by inflating the posterior's uncertainty at each step before updating, which lets old evidence fade gracefully rather than being cut off abruptly. Comparing whole models The evidence term, set aside above as a normalising constant, has a second life that is worth understanding even though later chapters will recommend caution with it. Because p(y) is the probability a model assigned to the observed data before seeing them, averaged over its prior, it can be used to compare models. If one model assigned the data twice the probability another did, the data favour it by a factor of two. The ratio is called the Bayes factor. The evidence embodies an automatic version of Occam's razor, an idea developed clearly by David MacKay in his 2003 book Information Theory, Inference, and Learning Algorithms. A complex model with many parameters can fit many possible datasets, so it must spread its prior probability thinly across all of them. A simple model can fit fewer datasets but concentrates its probability on them. If the observed data are among those the simple model predicts, the simple model wins the evidence comparison, even though the complex model can fit the data equally well. Complexity is penalised not by an added term but by the arithmetic of probability. The idea is elegant and correct, and it explains why Bayesian methods are less prone to overfitting than maximum likelihood. But the evidence is also extremely sensitive to the width of priors on parameters the data determine well, a weakness that matters greatly in practice. Chapter 6 returns to this and describes the predictive alternatives most applied modellers now prefer. Why conjugacy is not enough The examples in this chapter were chosen because they have closed-form posteriors. Conjugate pairs, beta with binomial, Gaussian with Gaussian, gamma with Poisson, Dirichlet with multinomial, are elegant and still useful: they underpin fast online updating in systems like simple bandit algorithms and Kalman filters, and they make excellent building blocks. But the set of models with conjugate posteriors is small. As soon as you put a logistic link between inputs and a binary label, place a non-Gaussian prior on a coefficient, or introduce a hierarchy of unknowns, the posterior no longer has a closed form, and the evidence integral can no longer be computed. A logistic regression with twenty coefficients has a posterior that lives in twenty dimensions with no analytic expression. A neural network's posterior lives in millions. For most of the twentieth century this was the reason Bayesian methods stayed on the margins of applied statistics: the theory was clear and the computation was impossible. What changed, beginning around 1990 with the spread of Markov chain Monte Carlo and accelerating in the 2010s with Hamiltonian Monte Carlo, automatic differentiation and variational inference, is that the computation became routine for a large and growing class of models. Before turning to how that computation works, however, there is the question that most often stops engineers from starting at all: where does the prior come from? Chapter 3: The Craft of Priors Engineers who are new to Bayesian methods tend to hold two contradictory worries about priors at once. The first is that the prior is arbitrary: you can make the posterior say anything by choosing the prior to suit. The second is that the prior is a burden: they do not know anything about the parameters in advance, so they cannot write one down. Both worries dissolve with practice, and the practice is the subject of this chapter. The short version is this. You almost always know more than you think, though usually about the scale of quantities rather than their exact values. The knowledge you have is precisely the kind that prevents absurd inferences in small samples and ill-posed models. And the way to keep priors honest is not to avoid them but to check what they imply, before you see the data and after. Every model already has one The first step is to notice that the choice is never between a prior and no prior. A model fitted by maximum likelihood with no regularisation behaves, at its peak, like a Bayesian model with a flat prior over the parameters. A flat prior over an unbounded parameter is not neutral. It says that a regression coefficient of a million is as plausible as a coefficient of one. In a model with many parameters, flat priors can have bizarre consequences. They put almost all of their mass on extreme values, because in high dimensions there is vastly more volume far from the origin than near it. Regularisation fixes this in practice, and as Chapter 2 showed, regularisation is a prior. A weight decay coefficient chosen by grid search is a prior variance chosen by grid search. Early stopping in neural networks has been shown, under some simplifying assumptions, to behave like an L2 penalty whose strength depends on how many steps you train. Data augmentation encodes a belief that the output should be invariant to the augmentations. Architectural choices like convolution encode a strong prior that nearby pixels matter together and that the same feature detector is useful everywhere in an image. Modern machine learning is soaked in prior knowledge; it just does not usually call it that. The Bayesian contribution is to make the prior an explicit, inspectable part of the model. Once it is explicit you can ask whether it is sensible, and you can see what happens when you change it. A taxonomy that is actually useful Textbooks sometimes classify priors along a spectrum from "informative" to "uninformative," as if the ideal were a prior that says nothing. That framing has largely been abandoned by applied Bayesians, for the reason given above: there is no prior that says nothing, and the ones that try often say something unhelpful. A more useful classification, which owes a great deal to the work of Andrew Gelman and colleagues on the Stan project, sorts priors by what job they do. The main kinds differ in what they encode, when they are appropriate and what goes wrong if they are misused, as Table 1 sets out. Table 1. Kinds of prior and when to use them. Kind What it encodes Typical use Main risk Flat or very vague Nothing beyond the support Rarely; legacy defaults Absurd implications, poor sampling Weakly informative Plausible scale only Default for most parameters Too tight if the scale is misjudged Informative Substantive prior evidence Past studies, physics, expert input Overriding data if wrong Regularising or shrinkage Most effects small, few large Many coefficients, sparse signals Over-shrinking real large effects Hierarchical Groups resemble each other Many related units Misleading if groups differ in kind Weakly informative priors deserve most attention because they are the right default for most parameters most of the time. A weakly informative prior rules out values that are implausible by orders of magnitude while leaving the plausible range nearly flat. For a regression coefficient on a standardised input, where a one-unit change means one standard deviation, a Normal(0, 1) or Normal(0, 2.5) prior is weakly informative for most outcomes measured on a similar scale: it allows effects of a few units comfortably and makes effects of fifty units nearly impossible. For the standard deviation of a noise term, a half-normal or exponential prior with a scale matched to the outcome's variability keeps the noise from collapsing to zero or running away to infinity. The Stan development team maintains a public set of recommendations on prior choice that is the best single practical reference for these defaults. The key move that makes weakly informative priors workable is standardisation. If your inputs and outputs are on wildly different scales, revenue in dollars and page load time in milliseconds, then no single default prior is sensible. If you centre and scale them, defaults become meaningful because "one unit" now means roughly the same thing everywhere. Much of the practical art of writing a Bayesian model is transforming the problem until the defaults are reasonable. Informative priors encode real substantive knowledge: estimates from previous studies, physical constraints, or carefully elicited expert judgment. A pharmacokinetic model can put tight priors on clearance and volume parameters because decades of pharmacology constrain them. An engineer forecasting failures of a component can use the manufacturer's reliability data. The risk is that a confident prior that is wrong will dominate a small dataset, so informative priors should be justified in writing and tested by sensitivity analysis. Shrinkage priors encode the belief that among many parameters, most are near zero and a few may be large. This is the situation in high-dimensional regression, where you have hundreds of candidate predictors and expect only a handful to matter. The horseshoe prior, introduced by Carlos Carvalho, Nicholas Polson and James Scott in 2010, and its regularised variant proposed by Juho Piironen and Aki Vehtari in 2017, are designed to do this well: they pull small coefficients strongly toward zero while leaving large ones nearly unshrunk. The result behaves something like variable selection without the discontinuity of hard thresholding, and it carries honest uncertainty about which variables matter. Hierarchical priors are the subject of their own section below, because they are among the most powerful ideas in applied Bayesian modelling. Thinking in the outcome space A coefficient's prior is hard to reason about directly. You may know nothing about what value β₃ should take. But you probably know a great deal about what the outcome should look like. Daily orders for a mid-sized shop are not going to be negative or in the billions. A patient's blood pressure is not going to be 900. A predicted probability of churn is not going to be pinned at exactly zero for every customer. This observation leads to the single most useful technique for setting priors: the prior predictive check. You simulate parameters from the prior, then simulate data from the likelihood using those parameters, all before looking at the real data. What comes out is the distribution of datasets your model considers plausible before seeing any evidence. Then you look at it. The technique is cheap and it is revealing. Jonah Gabry, Daniel Simpson, Aki Vehtari, Michael Betancourt and Andrew Gelman gave a vivid example in their 2019 paper "Visualization in Bayesian Workflow," modelling global air pollution from satellite data. With vague priors on a hierarchical regression, the prior predictive distribution placed substantial probability on pollution concentrations far beyond anything physically possible, levels that would have been denser than a neutron star. With weakly informative priors, the simulated data looked like plausible air. Neither set of priors would have produced visibly different fits with lots of data, but the vague priors would have caused real problems with sparse regions and with the sampler. The same exercise in a logistic regression often produces a surprise. Put Normal(0, 10) priors on a dozen coefficients, which many people would consider safely vague, and simulate predicted probabilities. The linear predictor will have a huge variance, and once it passes through the logistic function nearly every simulated probability will be indistinguishable from zero or one. The "vague" prior turns out to be a strong prior that every case is certain. A Normal(0, 1) prior, which looks more restrictive on the coefficient scale, produces a much more even spread of probabilities and is the more genuinely uninformative choice on the scale that matters. The lesson generalises. Whether a prior is informative depends on what it implies for the quantities you care about, and the only reliable way to find out is to simulate. Writing priors by staring at parameter symbols is how engineers get into trouble. Partial pooling: the hierarchical idea Consider a company that runs a store chain with 200 locations and wants to estimate the effect of a promotion at each store. Some stores have years of data and thousands of transactions; some opened last month. There are two obvious approaches and both are bad. Complete pooling ignores the store identity and estimates one effect for the whole chain. It uses all the data efficiently, but it assumes every store responds identically, which is surely false. No pooling fits a separate model for each store. It respects differences between stores, but for the new stores the estimates are based on a handful of observations and will be extremely noisy. A new store that happened to have one good promotion day will look like a star. The hierarchical model takes a middle path. Each store has its own effect, but the store effects are themselves drawn from a common distribution, whose mean and spread are also unknown and also estimated from the data. The prior for each store's effect is therefore learned from all the other stores. Where a store has abundant data, its own estimate dominates. Where it has little, its estimate is pulled toward the chain-wide mean, by an amount the model determines from how much stores actually vary. This is partial pooling, and it gives better estimates for nearly every unit than either extreme. The idea is old and its value is well established. In 1975 Bradley Efron and Carl Morris illustrated the related phenomenon of shrinkage with baseball batting averages: estimates of each player's season average from his first 45 at-bats were improved, on average, by shrinking them toward the overall mean of all players, compared with using each player's own early average. The hierarchical Bayesian model generalises that intuition and estimates the right amount of shrinkage from the data rather than fixing it. For machine learning engineers, hierarchical models are the natural answer to a common situation: many related prediction problems, each with too little data on its own. Demand forecasting across thousands of product lines, click-through prediction across advertisers, sensor calibration across devices, treatment effects across hospitals. Hierarchical structure lets small groups borrow strength from large ones while still differing where the data say they differ, and the posterior for each group reports honestly how much of its estimate came from its own data and how much was borrowed. Hierarchical models also have a well-known computational pathology, which will reappear in Chapter 4. When groups have little data and the between-group spread is small, the posterior takes a funnel shape that is very hard for samplers to explore. The standard fix is a reparameterisation, called the non-centred parameterisation, in which each group's effect is written as the group mean plus the group spread times a standard normal variable. It describes exactly the same model, but presents a geometry the sampler can handle. Knowing to reach for it is part of the craft. Priors on structure, not just on numbers So far the priors in this chapter have been distributions over individual numbers: a coefficient, a variance, a group mean. Some of the most consequential prior choices are about structure instead, and they deserve the same scrutiny. In a time series model, the prior on how quickly a trend can change determines whether the model reacts to a sudden jump in sales as a new level or as noise. Facebook's Prophet forecasting library, released in 2017 by Sean Taylor and Benjamin Letham, makes this explicit: the trend is piecewise linear with many potential changepoints, and a sparse Laplace prior on the changes in slope controls how readily the trend bends. A user who raises the prior scale is saying they expect the trend to change often; one who lowers it is saying the trend is stable. The default is a prior, and forecasts can be sensitive to it. In a Gaussian process, discussed in Chapter 7, the kernel is a prior over functions: it says whether they are smooth or rough, periodic or not, and how far apart two inputs must be before their outputs become unrelated. That last quantity, the length scale, is especially important. With very little data a Gaussian process cannot pin down its length scale, and a vague prior can let it collapse to tiny values, producing a function that wiggles through every point, or balloon to huge ones, producing a flat line. Michael Betancourt and others have recommended inverse-gamma priors on length scales that put little mass below the smallest gap between data points or above the span of the data, ruling out length scales the data could not possibly inform. In a mixture or clustering model, the prior on how many components exist, or on how evenly the data are split among them, can dominate the result. A Dirichlet prior with small concentration favours a few large clusters; a large concentration favours many even ones. The general principle is the same as for numerical priors. Ask what the prior implies about data you could observe, simulate it, and look. Structural priors are often hidden behind the default settings of a library, which makes them easier to overlook and more important to check. Eliciting knowledge from experts Sometimes the most valuable prior knowledge lives in the heads of domain experts: engineers who know how a machine tends to fail, clinicians who know plausible ranges for treatment effects, analysts who know how demand behaved in past crises. Turning that knowledge into a probability distribution is called elicitation, and it is harder than simply asking for a number. People are poor at stating variances and good at stating quantiles. So rather than asking "what is the standard deviation of the effect?", a structured elicitation asks questions like "what value would surprise you if the true effect were below it?" and "what value would surprise you if it were above?", then fits a distribution to the answers. Anthony O'Hagan and colleagues developed the Sheffield Elicitation Framework for exactly this purpose, with protocols for eliciting from individuals and reconciling several experts. Even outside a formal protocol, a few principles help. Ask about observable quantities, not abstract parameters. Ask for ranges before central values, to counteract anchoring. Show the expert the implied distribution and let them correct it. And expect overconfidence: experts' stated ranges are routinely too narrow, so a modest widening is usually wise. Checking sensitivity Once a model is fitted, the honest question is: how much do my conclusions depend on the prior? A prior sensitivity analysis answers it by refitting with alternative reasonable priors, perhaps twice as wide and half as wide, or a different family with similar scale, and comparing the posteriors for the quantities that matter to the decision. If the conclusions are stable, the prior is not doing much work and objections to it are moot. If the conclusions change materially, that is important information: the data do not settle the question, and the decision rests partly on prior assumptions that should be stated openly. Refitting can be expensive for large models, and there are tools to make it cheap. Power-scaling sensitivity analysis, developed by Noa Kallioinen, Topi Paananen, Paul-Christian Bürkner and Aki Vehtari and implemented in the R package priorsense, estimates how the posterior would change if the prior or likelihood were raised to a power slightly above or below one, using importance weighting on the existing posterior samples. It flags parameters where the prior and likelihood are in conflict or where the prior dominates, without refitting. The deeper point is cultural. In a deterministic machine learning pipeline, a hundred choices that function as priors are buried in hyperparameters, preprocessing and architecture, and nobody checks how sensitive the results are to most of them. A Bayesian model puts the priors in one visible place, in a notation reviewers can read. That transparency is the strongest answer to the charge of subjectivity. Every model contains assumptions. The Bayesian one tells you where they are and invites you to test them. Chapter 4: Sampling the Posterior The posterior distribution of a realistic model is a surface in many dimensions whose height at each point is known only up to an unknown constant. You can evaluate the product of likelihood and prior at any parameter setting you choose. You cannot integrate it, you cannot draw a picture of it, and you cannot list its peaks. What you want from it, means, intervals, predictive distributions, probabilities of exceeding thresholds, are all integrals over it. Markov chain Monte Carlo is the family of methods that solves this problem by wandering. It constructs a random walk through parameter space designed so that, in the long run, the fraction of time the walk spends in any region is proportional to the posterior probability of that region. Record where the walk goes and you have samples from the posterior. Average a function over the samples and you have its posterior expectation. The idea is simple. Making it work efficiently, and knowing when it has not worked, is where the engineering lies. The idea of a Markov chain sampler The original algorithm, published in 1953 by Nicholas Metropolis, Arianna Rosenbluth, Marshall Rosenbluth, Augusta Teller and Edward Teller to simulate the behaviour of interacting particles, and generalised by W. K. Hastings in 1970, works like this. Start at some parameter value. Propose a move to a nearby value, for instance by adding a small Gaussian perturbation. Compare the unnormalised posterior density at the proposed point with the density at the current point. If the proposal is more probable, accept it. If it is less probable, accept it anyway with probability equal to the ratio of the two densities; otherwise stay where you are and record the current point again. Repeat. The unknown normalising constant cancels in the ratio, which is why the algorithm only ever needs the unnormalised posterior. The occasional acceptance of downhill moves is what makes the walk explore the whole distribution rather than climbing to the nearest peak and stopping. And a property called detailed balance guarantees that the posterior is the stationary distribution of the chain: run it long enough and the samples are distributed correctly, regardless of where you started. The phrase "long enough" carries all the difficulty. Random-walk Metropolis takes small, undirected steps. In a posterior with a few dimensions that are roughly independent and similarly scaled, it does tolerably well. In a posterior with hundreds of dimensions, or with strong correlations between parameters, it becomes hopelessly slow. If the step is large, nearly every proposal lands in a region of low probability and is rejected. If the step is small, proposals are accepted but the chain moves a tiny distance each time and takes an enormous number of iterations to cross the distribution. The theoretical analysis by Gareth Roberts and colleagues in the 1990s showed that the optimal step size shrinks with dimension, and the number of iterations needed to get an independent sample grows roughly in proportion to the dimension. Gibbs sampling, popularised in statistics by Alan Gelfand and Adrian Smith in 1990 and made widely accessible by the BUGS software developed at the MRC Biostatistics Unit in Cambridge, was the workhorse of applied Bayesian statistics for two decades. It updates one parameter or block at a time, drawing each from its exact conditional distribution given all the others. For models built from conjugate pieces this is efficient and requires no tuning. But it also struggles with strongly correlated posteriors, where moving one coordinate at a time produces a slow zigzag along a narrow diagonal ridge. Hamiltonian Monte Carlo The method that changed applied Bayesian computation in the 2010s borrows from physics. Hamiltonian Monte Carlo, introduced in 1987 by Simon Duane, Anthony Kennedy, Brian Pendleton and Duncan Roweth for lattice field theory, and brought into statistics through the work of Radford Neal, treats the negative log posterior as a potential energy surface. The current parameter value is the position of a particle. At each iteration the algorithm gives the particle a random momentum and then simulates its motion across the surface for some time, using the gradient of the log posterior to compute the forces. Where the posterior is high, the energy is low, and the particle naturally spends more time there. The crucial difference from random-walk Metropolis is that the gradient tells the sampler which way is downhill in energy, so the particle follows the shape of the distribution instead of stumbling blindly. In a long, narrow, curved ridge of high posterior density, which defeats random walks, the simulated particle can glide along the ridge and arrive far from where it started in a single iteration. Because the simulation conserves energy approximately, the proposal at the end of the trajectory is very likely to be accepted. The result is that HMC can take large, informed steps with high acceptance rates, and the cost of an effectively independent sample grows much more slowly with dimension than for random-walk methods. Two developments made HMC practical outside specialist hands. The first was automatic differentiation, which computes exact gradients of arbitrary code. HMC needs the gradient of the log posterior at every step of every trajectory, and deriving it by hand for a new model is tedious and error-prone. With automatic differentiation the modeller writes only the log density, and gradients come for free. The second was the No-U-Turn Sampler, or NUTS, published by Matthew Hoffman and Andrew Gelman in 2014. HMC has two tuning parameters, the step size used to simulate the trajectory and the number of steps, and its performance is very sensitive to both. Too few steps and the particle does not travel far; too many and it loops back toward where it started, wasting computation. NUTS builds the trajectory adaptively, extending it in both directions until it detects that further simulation would make the path start to turn back on itself, and adapts the step size during a warm-up phase to hit a target acceptance rate. The practical effect was that a user could write a model and run a high-quality sampler with no hand tuning at all. NUTS became the default sampler in Stan, PyMC, NumPyro and most other modern probabilistic programming systems, and it remains so in 2026. HMC has limits that every user should know. It needs gradients, so it cannot directly handle discrete parameters; those must be marginalised out analytically or handled with other moves. It is sensitive to the geometry of the posterior: regions where curvature changes sharply, such as the neck of the hierarchical funnel described in Chapter 3, force the step size to be tiny and can still produce failures. And each iteration involves many gradient evaluations, each of which touches the whole dataset, so for very large datasets the per-iteration cost can be high. How to tell when sampling has failed A sampler always returns numbers. The essential discipline of using MCMC is checking whether those numbers can be trusted, and modern samplers provide several diagnostics that should be read as routinely as a compiler's warnings. Each diagnostic detects a different failure and calls for a different response, which Table 2 summarises. Table 2. Core MCMC diagnostics. Diagnostic What it detects Rule of thumb Usual remedy R-hat Chains disagree; not converged Below 1.01 Run longer; reparameterise Bulk and tail ESS Too few effective samples Above about 400 Run longer; improve geometry Divergent transitions Sampler missed a region of high curvature Zero Non-centred form; raise target acceptance Max tree depth hits Trajectories too long; poor scaling Rare Rescale parameters E-BFMI Poor exploration of energy levels Above about 0.3 Reparameterise; check heavy tails The thresholds are those recommended by Aki Vehtari, Andrew Gelman, Daniel Simpson, Bob Carpenter and Paul-Christian Bürkner in their 2021 paper revising the R-hat diagnostic, and by the Stan documentation for the HMC-specific checks. Run several chains. The single most important practice is to run at least four independent chains from dispersed starting points. If they have all converged to the posterior, they should look statistically indistinguishable. The R-hat statistic compares the variance within each chain to the variance between chains; if the chains are exploring different regions, between-chain variance is inflated and R-hat exceeds one. The 2021 revision made R-hat more sensitive to problems in the tails and to chains with different variances, and tightened the recommended threshold from the older 1.1 to 1.01. Count effective samples. Successive MCMC draws are correlated, so 4,000 draws are worth fewer than 4,000 independent ones. The effective sample size estimates how many independent draws would carry the same information. It is reported separately for the bulk of the distribution, which matters for means and medians, and for the tails, which matters for extreme quantiles and interval endpoints. If the tail ESS is a few dozen, a reported 95 percent interval is itself highly uncertain. Take divergences seriously. HMC's simulated trajectories are computed with a numerical integrator. In regions of very high curvature the integrator can become unstable and the simulated energy blows up. Modern implementations detect this and report a divergent transition. A divergence is not a harmless numerical glitch. It means the sampler failed to explore part of the posterior, and the region it skipped is often precisely the region that matters, such as the neck of a hierarchical funnel where the between-group spread is small. Michael Betancourt's work has emphasised that even a handful of divergences can signal a biased posterior. The right response is almost never to ignore them, and only rarely to simply reduce the step size; it is usually to reparameterise the model so the geometry is easier. Look at the chains. Trace plots, which show each parameter's sampled value against iteration with one line per chain, remain useful for spotting chains that are stuck, drifting or exploring different modes. Rank plots, recommended in the same 2021 paper, are more sensitive: they show whether each chain's draws are spread uniformly across the pooled ranks, as they should be if the chains agree. There is a principle behind all of this, sometimes called the folk theorem of statistical computing, after Andrew Gelman: when you have computational problems, there is often a problem with your model. Divergences, poor mixing and enormous run times are frequently symptoms of a model that is badly specified, poorly identified, or using priors that allow absurd regions of parameter space. Fixing the model often fixes the computation. A worked case: the eight schools The standard illustration of these ideas in the Bayesian literature is a dataset from a 1981 study by Donald Rubin of coaching programmes for the SAT test in eight American high schools. Each school reports an estimated effect of coaching and a standard error. The estimated effects range from about minus 3 to 28 points, and the standard errors are large, between about 9 and 18 points. The question is how to estimate each school's true effect. The natural model is hierarchical. Each school's true effect is drawn from a population distribution with unknown mean μ and unknown spread τ. Each school's observed estimate is its true effect plus noise with the known standard error. With eight schools and large standard errors, the data are consistent with τ being anywhere from zero, all schools have the same effect, to fairly large. Write this model in the obvious, centred way and run NUTS, and you will typically get divergent transitions. The reason is the funnel. When τ is small, the school effects must all be very close to μ, so the posterior is squeezed into a narrow neck. When τ is large, the school effects can spread widely. A step size that works in the wide mouth of the funnel is far too large for the neck, and the sampler cannot get in. The reported posterior then systematically under-represents small values of τ, overstating how much schools differ. Rewrite the model in non-centred form, with each school's effect expressed as μ plus τ times a standard normal variable, and the divergences typically disappear. The sampler now explores standardised variables whose geometry does not depend on τ, and the funnel is gone. The resulting posterior puts substantial mass on small τ, and each school's estimate is pulled strongly toward the common mean. The eight schools example has become a rite of passage because it packs the whole craft into a dataset small enough to print on one page: hierarchical structure, partial pooling, a pathological geometry, a diagnostic that catches it, and a reparameterisation that fixes it. The same pattern recurs in every hierarchical model with weakly identified group-level variance, which describes a very large fraction of the hierarchical models engineers will actually build. Beyond a single chain: multimodality and sequential Monte Carlo The diagnostics above assume that if four chains agree, they have found the posterior. That assumption fails in one important case: a posterior with several well-separated modes. If every chain happens to start near the same mode, they will all agree and all be wrong. If chains start near different modes and each stays where it started, R-hat will flag the disagreement, but the sampler cannot fix it, because HMC moves along continuous trajectories and has no way to jump across a valley of very low probability. Multimodality arises naturally in mixture models, in models with label-switching symmetries, in some latent variable models and in many neural networks. Sometimes it is harmless: the modes of a mixture model that differ only by relabelling the components are equivalent, and the fix is to break the symmetry, for instance by constraining the component means to be ordered. Sometimes the modes represent genuinely different explanations of the data, and an analysis that reports only one of them is misleading. Sequential Monte Carlo methods offer one response. Rather than running a single long chain, they maintain a population of particles and move it gradually from an easy distribution, typically the prior, to the posterior, through a sequence of intermediate distributions in which the likelihood is raised to a power that increases from zero to one. At each stage, particles are reweighted according to how well they fit the new intermediate distribution, resampled so that good particles are duplicated and poor ones discarded, and then moved by a few MCMC steps. Because the population starts spread across the prior, particles can settle into several modes, and the reweighting assigns each mode its correct share of probability. The method also estimates the evidence as a by-product. PyMC includes an SMC sampler for exactly these reasons, and SMC is the standard approach in sequential filtering problems where data arrive in time order, as in tracking and state-space models. Other strategies for multimodal posteriors include parallel tempering, which runs several chains at different temperatures, with hotter chains exploring a flattened posterior and swapping states with colder ones, and simply running many chains from widely dispersed starting points and examining them individually. None is a universal fix. The honest practice is to think about whether a model is likely to be multimodal before fitting it, and to check for it when it is. What MCMC costs, and when it is worth it MCMC with NUTS is the gold standard for Bayesian computation in models with up to tens of thousands of continuous parameters and datasets that fit in memory. It is asymptotically exact: with enough samples, the error goes to zero, and the diagnostics give a reasonable sense of whether you are there. That makes it the method of choice when the posterior itself is the deliverable: in scientific analyses, in clinical trial design, in pharmacometrics, in carefully built forecasting models, and wherever an engineer needs to trust that the reported uncertainty is not an artefact of the approximation. Its cost is time. Each gradient evaluation passes over the full dataset. A model that takes a second to evaluate and needs a hundred gradient evaluations per iteration and two thousand iterations per chain will take more than two days per chain. Hardware has helped: running chains on GPUs using JAX through NumPyro or BlackJAX, and running many short chains in parallel, have made sampling faster for many models since the early 2020s. But for models with millions of parameters, like neural networks, or with hundreds of millions of observations, full-batch MCMC remains impractical. Two directions open from here. One is to keep sampling but give up full-batch gradients, using stochastic gradients from minibatches, as stochastic gradient Langevin dynamics and its relatives do. Those methods return in Chapter 7. The other is to stop sampling altogether and replace the posterior with an approximation that can be fitted by optimisation. That is variational inference, and it is the subject of the next chapter. Chapter 5: Approximating the Posterior Sampling answers the question "what does the posterior look like?" by visiting it. Variational inference answers a different question: "of all the distributions in some simple family, which one is closest to the posterior?" It turns integration into optimisation. Instead of running a Markov chain until it forgets its starting point, you write down a family of tractable distributions, such as independent Gaussians over every parameter, and adjust their means and variances by gradient descent until they fit the posterior as well as that family can. For engineers already fluent in optimisation, this is an attractive trade. Variational inference scales to large datasets through minibatching, runs on the same hardware and software stack as deep learning, and produces a compact parametric approximation that is cheap to sample from at prediction time. The cost is that the answer is approximate in a way that does not shrink with more computation, and the approximation is biased in a known direction: it tends to be overconfident. Knowing that direction, and when it matters, is most of what a practitioner needs. The evidence lower bound Let q(θ) be an approximating distribution with adjustable parameters, which the literature calls variational parameters to distinguish them from the model's own. The goal is to make q close to the posterior p(θ | y). The measure of closeness used in standard variational inference is the Kullback–Leibler divergence from q to p, which is the expected value under q of the log ratio log q(θ) minus log p(θ | y). It is zero when the two distributions are identical and positive otherwise. The KL divergence to the posterior cannot be computed directly, because it involves the posterior's unknown normalising constant. But a short rearrangement shows that minimising it is equivalent to maximising a different quantity that can be computed: ELBO(q) = E_q[log p(y | θ)] − KL(q(θ) ‖ p(θ)) This is the evidence lower bound, so called because it is always less than or equal to the log of the evidence p(y), with the gap exactly equal to the KL divergence from q to the posterior. Pushing the ELBO up pushes the gap down. The two terms have an intuitive reading. The first is the expected log likelihood under q: it rewards approximations that put their mass on parameter values that explain the data well. The second is the KL divergence from q to the prior: it penalises approximations that move far from the prior. The ELBO therefore balances fit against complexity in exactly the way a posterior does. With more data, the first term grows and dominates, and the approximation is pulled away from the prior toward the region the data favour. The expectation in the first term is generally intractable, but it can be estimated by drawing samples from q and averaging. For gradient-based optimisation, the key trick is the reparameterisation gradient, developed independently in 2014 by Diederik Kingma and Max Welling in their paper on variational autoencoders and by Danilo Rezende, Shakir Mohamed and Daan Wierstra. If q is Gaussian with mean m and standard deviation s, a sample can be written as m plus s times a standard normal draw. The randomness is moved into a fixed noise source, and the sample becomes a differentiable function of m and s. Automatic differentiation can then compute low-variance gradients of the ELBO with respect to the variational parameters. Combined with minibatching, where the expected log likelihood over the whole dataset is estimated from a random subset, this makes variational inference a stochastic optimisation problem of exactly the kind deep learning frameworks are built for. Matthew Hoffman, David Blei, Chong Wang and John Paisley's 2013 paper on stochastic variational inference established the minibatch approach for large datasets. Mean-field and its blind spots The simplest variational family is mean-field: q factorises into an independent distribution for each parameter, typically a Gaussian. Each parameter gets its own mean and variance, and nothing else. This is cheap: the number of variational parameters is twice the number of model parameters. It is also, in an important way, wrong for most posteriors, because it cannot represent correlations. Think back to the regression with two correlated inputs from Chapter 2. The posterior over their coefficients is stretched along a diagonal: the data pin down their sum but not how it is split. A mean-field Gaussian, being axis-aligned, cannot tilt to match that diagonal. The best it can do is a narrow ellipse sitting inside the diagonal ridge. Its marginal variances are therefore much smaller than the true posterior's. The approximation reports that each coefficient is well determined, when in fact only their combination is. This is a specific instance of a general property. Because the ELBO uses the KL divergence from q to p, with q in the first position, it heavily penalises q for putting mass where p has little, but barely penalises q for failing to cover regions where p has mass. The optimal q is therefore mode-seeking: it locks onto one region of high posterior density and fits it snugly, rather than spreading out to cover everything. When the posterior has several separate modes, q will typically pick one and ignore the rest. When the posterior is correlated or has heavy tails, q will underestimate its spread. David Blei, Alp Kucukelbir and Jon McAuliffe's 2017 review "Variational Inference: A Review for Statisticians" discusses this tendency to underestimate posterior variance as a standard caveat of the method. For an engineer whose purpose in going Bayesian is honest uncertainty, this is an uncomfortable property. The one thing mean-field VI systematically gets wrong is the width of the posterior. Its point estimates are often good, sometimes better than those from maximum likelihood because of the regularising effect of the prior, but its intervals should be treated as optimistic until checked. Richer families Several lines of work try to keep VI's speed while reducing its bias. Full-rank Gaussians replace the diagonal covariance with a full covariance matrix, parameterised through its Cholesky factor. They capture linear correlations exactly and fix the diagonal-ridge problem, at a cost that scales with the square of the number of parameters. For models with up to a few thousand parameters this is often affordable and markedly better than mean-field. Stan's automatic differentiation variational inference, described by Kucukelbir and colleagues in 2017, offered both mean-field and full-rank options, and the comparison between them is a useful diagnostic in its own right: if the two give very different answers, the posterior has correlations that matter. Low-rank plus diagonal families sit between the two, capturing the most important directions of correlation without the full quadratic cost. Normalising flows go further. Introduced for variational inference by Danilo Rezende and Shakir Mohamed in 2015, a flow starts from a simple base distribution and passes it through a sequence of invertible, differentiable transformations whose Jacobians are easy to compute. Each transformation can bend and stretch the distribution, so a deep enough flow can represent skewed, correlated and even multimodal shapes. Flows are now available as variational families in Pyro, NumPyro and other libraries. They cost more to train, and getting them to fit well in high dimensions can be finicky, but they substantially narrow the gap to the true posterior in many problems. Pathfinder, introduced by Lu Zhang, Bob Carpenter, Andrew Gelman and Aki Vehtari in 2022, takes a different and pragmatic approach. It runs a quasi-Newton optimiser toward the posterior mode and fits a Gaussian approximation at each point along the path, choosing the one with the best ELBO. It is fast, robust to poor starting points, and was designed in part to produce good initial values for MCMC, which can shorten warm-up considerably. It is available in Stan and in several Python libraries. The other direction: expectation propagation and mass-covering The overconfidence of standard variational inference comes from the direction of the KL divergence it minimises. A natural question is what happens if you reverse it: minimise the KL divergence from the posterior to q, with p in the first position instead. That divergence heavily penalises q for missing regions where the posterior has mass, so the optimal q is mass-covering. Where the posterior has two modes, a mass-covering Gaussian sits between them and spreads to cover both. Where the posterior is correlated, the mass-covering Gaussian matches its true covariance rather than shrinking inside it. Minimising this reverse divergence directly is impossible, because it requires expectations under the very posterior you are trying to approximate. Expectation propagation, developed by Thomas Minka in 2001, achieves something close to it by working one data point or factor at a time. It approximates each factor of the likelihood with a simple term, then repeatedly refines each term by removing it from the current approximation, combining the remainder with the exact factor, and matching the moments of the result. EP tends to produce better-calibrated marginal variances than mean-field VI, and it was the method behind Microsoft's TrueSkill rating system, published by Ralf Herbrich, Tom Minka and Thore Graepel in 2006, which estimated player skill with uncertainty in online games. Its drawbacks are that it is not guaranteed to converge, it is harder to implement generically, and it fits less naturally into gradient-based software, which is why it is less common in today's probabilistic programming systems. Between the two extremes lies a family of alpha-divergences and related objectives, which interpolate between mode-seeking and mass-covering behaviour. Yingzhen Li and Richard Turner's 2016 work on Rényi divergence variational inference showed how to optimise these with the same stochastic gradient machinery as standard VI. The practical lesson is not that one divergence is correct, but that the choice of divergence is a modelling decision that controls the direction of the approximation's error. For an engineer worried about overconfidence, a method that errs on the side of covering too much is often the safer mistake. Amortised inference All the methods so far fit an approximation to one posterior, for one dataset. Some applications need to perform inference over and over, for many datasets or many observations, and fitting each from scratch is too slow. Amortised inference trains a neural network, once, to map a dataset or observation directly to an approximate posterior. The upfront cost is high; each subsequent inference is a single forward pass. The variational autoencoder is the best-known example. Its encoder network takes an input such as an image and outputs the mean and variance of a Gaussian approximation to the posterior over latent variables for that image. Rather than optimising a separate approximation for each image, the encoder learns to produce good approximations for any image, sharing statistical strength across the whole dataset. In the sciences, amortised inference has become central to simulation-based inference, used when a model is defined by a simulator whose likelihood cannot be written down, such as a model of particle collisions, an epidemic, or a population genetics process. A neural network is trained on many pairs of simulated parameters and simulated data, and learns to output the posterior over parameters given data. Methods like neural posterior estimation, developed by George Papamakarios, Iain Murray, Jakob Macke and colleagues, and libraries such as sbi and BayesFlow, make this practical. The amortised posterior can then be applied to real observations instantly. The caveat is the one that applies to all approximations, sharpened: the network can be wrong in ways that are hard to see, especially for real data that differ from the simulations it was trained on, so simulation-based calibration checks are essential. The Laplace approximation The oldest approximation of all deserves a place here because it has returned to prominence in deep learning. The Laplace approximation fits a Gaussian centred at the posterior mode, with covariance equal to the inverse of the Hessian, the matrix of second derivatives of the negative log posterior at that mode. It is named after Pierre-Simon Laplace, who used the idea in the eighteenth century. The appeal is obvious: if you have already found the mode by ordinary training, which is what regularised maximum likelihood does, then the Laplace approximation only requires computing curvature at that point. For small models the Hessian can be computed exactly. For large ones, especially neural networks, it cannot, and approximations to the curvature are used instead: a diagonal approximation, a Kronecker-factored approximation that treats each layer's curvature as a product of two smaller matrices, or applying the Laplace approximation only to the last layer of the network. The 2021 paper "Laplace Redux: Effortless Bayesian Deep Learning" by Erik Daxberger, Agustinus Kristiadi and colleagues, accompanied by the laplace library for PyTorch, made a strong case that these post-hoc approximations deliver competitive calibration and out-of-distribution detection at very low cost, because they can be applied to an already trained network without retraining. The Laplace approximation shares mean-field VI's weakness in being a single Gaussian at a single mode, and it is only as good as the local curvature is representative of the posterior's global shape. But it has the great practical virtue of being bolted onto existing workflows, which matters a great deal for adoption. Checking an approximation Since any approximation can be wrong, the question is how to tell. Several practical diagnostics exist. Compare against MCMC on a smaller problem. If you can afford to run NUTS on a subset of the data or a simplified version of the model, compare the two. Where they agree, you have evidence that the approximation is adequate for that class of problem. Pareto-smoothed importance sampling diagnostics. Yuling Yao, Aki Vehtari, Daniel Simpson and Andrew Gelman proposed in 2018 using the approximation as a proposal distribution for importance sampling against the true unnormalised posterior. The importance weights tell you how badly the approximation misses. If the weights are heavy-tailed, a few draws dominate and the approximation has missed important regions. The shape parameter of a generalised Pareto distribution fitted to the largest weights, called k-hat, summarises this: values below about 0.7 suggest the approximation is usable, and can be corrected by importance reweighting; values above indicate serious problems. Simulation-based calibration. Proposed by Sean Talts, Michael Betancourt, Daniel Simpson, Aki Vehtari and Andrew Gelman in 2018, this checks any inference algorithm, approximate or exact, by repeatedly drawing parameters from the prior, simulating data, running inference, and checking that the true parameter's rank among the posterior draws is uniformly distributed. If an algorithm is systematically overconfident, the true value will fall in the tails too often and the ranks will pile up at the extremes. It is computationally demanding, because it requires many fits, but it is the most thorough test available and is well worth running when building a model that will be reused many times. Check predictive calibration directly. Ultimately an engineer cares whether the predictive distribution is calibrated on held-out data. The reliability analyses and interval coverage checks from Chapter 1 apply whatever the inference method. An approximation whose parameter posterior is biased but whose predictions are well calibrated may be perfectly fit for purpose. Choosing between sampling and approximation The choice between MCMC and VI is not a matter of taste. It depends on the size of the model, the size of the data, and what the uncertainty will be used for. When the posterior is the main product, as in a scientific analysis, a clinical model, or a forecasting model whose intervals drive costly decisions, and when the model and data fit in memory, MCMC with NUTS is the default. The time cost is real but usually tolerable, and the diagnostics give confidence that the answer is right. When the model is large or the data are streaming, when inference must be repeated frequently, or when the Bayesian model is a component in a larger system that is itself trained by gradient descent, variational methods or the Laplace approximation are usually the only practical options. They should be used with an explicit expectation of overconfidence, with richer families where affordable, and with predictive calibration checked directly on held-out and, if possible, shifted data. In between lies a growing set of hybrid workflows: Pathfinder or VI to initialise MCMC; VI to explore model structure quickly before a final MCMC fit; importance reweighting to correct an approximation; and amortised inference, where a neural network is trained to output an approximate posterior for any dataset in a family, which is the basis of variational autoencoders and of simulation-based inference methods used in the physical sciences. Probabilistic programming languages, the subject of the next chapter, increasingly make it possible to move between these methods without rewriting the model. Chapter 6: Probabilistic Programming in Practice For most of the history of Bayesian statistics, using a new model meant deriving its inference algorithm by hand. You wrote down the joint distribution, worked out the conditional distributions for a Gibbs sampler or the update equations for an approximation, coded them in a general-purpose language, and debugged the result. A change to the model, adding a covariate or swapping a Gaussian for a Student-t likelihood, could mean rederiving much of the algorithm. The cost was high enough that Bayesian methods stayed the preserve of specialists, and practitioners reached for whatever model already had software. Probabilistic programming separates the two jobs. The modeller writes the generative story, the prior and the likelihood, in a language designed for it. The system turns that description into a log density, differentiates it automatically, and runs a general-purpose inference algorithm on it. Changing the model means changing a line. This chapter describes what that looks like, which tools exist, and how a working Bayesian modeller organises a project around them. Writing a model as a program The central idea is that a probabilistic model is a program that simulates data. Each unknown is introduced by a statement that draws it from a distribution; each observation is introduced by a statement that says it was drawn from a distribution whose parameters depend on the unknowns. The same program can run forwards, generating synthetic data from the prior, or be conditioned on real observations, in which case the system infers the unknowns. Here is a hierarchical logistic regression in PyMC, of the kind a team might use to model whether a customer churns, with a separate baseline for each region and shared effects of two standardised behavioural features: import pymc as pm with pm.Model(coords={"region": regions, "feature": ["tenure", "usage"]}) as churn: mu_a = pm.Normal("mu_a", 0.0, 1.5) sigma_a = pm.HalfNormal("sigma_a", 1.0) z = pm.Normal("z", 0.0, 1.0, dims="region") a = pm.Deterministic("a", mu_a + sigma_a * z, dims="region") beta = pm.Normal("beta", 0.0, 1.0, dims="feature") logit_p = a[region_idx] + pm.math.dot(X, beta) pm.Bernoulli("churned", logit_p=logit_p, observed=y) prior = pm.sample_prior_predictive() idata = pm.sample(chains=4, target_accept=0.9) pm.sample_posterior_predictive(idata, extend_inferencedata=True) Several things from earlier chapters are visible in a dozen lines. The priors are weakly informative on standardised features, as Chapter 3 recommended. The regional intercepts use the non-centred parameterisation from Chapter 4, written as a mean plus a scale times standard normal variables, to avoid the funnel. The prior predictive is sampled before fitting so that the implied churn rates can be inspected. The sampler is NUTS by default, run on four chains. And posterior predictive draws are generated for checking. Nowhere did the modeller derive a gradient or a conditional distribution. The same model in Stan, the other most widely used system, would be written in Stan's own language, with separate blocks declaring data, parameters, transformed parameters and the model, and compiled to C++. In NumPyro, it would be a Python function using numpyro.sample statements and run on JAX. The syntax differs; the structure, a generative description with priors and a conditioned likelihood, is the same everywhere. The landscape of tools The ecosystem has consolidated around a small number of mature systems, each with a distinct design philosophy. The main options differ chiefly in the language they are used from, their computational backend and the inference they emphasise, as Table 3 summarises. Table 3. Widely used probabilistic programming systems. System Used from Backend Emphasis Stan R, Python, Julia, command line Compiled C++ Robust NUTS, diagnostics, statistics PyMC Python PyTensor; can target JAX, Numba Accessible Python modelling, broad ecosystem NumPyro Python JAX Fast NUTS on GPU/TPU, composable Pyro Python PyTorch Deep models, flexible variational inference Turing.jl Julia Julia Composable samplers, Julia ecosystem TensorFlow Probability Python TensorFlow, JAX Distributions and layers for deep learning Stan, first released in 2012 and described by Bob Carpenter and colleagues in the Journal of Statistical Software in 2017, is the reference implementation of NUTS and has the most mature diagnostics. Its modelling language is statically typed and explicit, which makes models longer to write but very clear to read and review. It is accessed through interfaces including CmdStanR and CmdStanPy, and through higher-level packages such as brms in R, by Paul-Christian Bürkner, which lets users specify multilevel regression models with a formula syntax and compiles them to Stan. PyMC, which has been under development since 2003, is the most widely used Python system. It is built on PyTensor, a graph library that can compile models to C, to JAX, or to Numba, which lets the same model use the PyMC sampler or hand off to NumPyro or BlackJAX for GPU sampling. The 2023 paper by Oriol Abril-Pla and colleagues in PeerJ Computer Science describes its design. A companion project, Bambi, offers a formula interface for regression models similar to brms. NumPyro, from the Pyro team at Uber AI and later the wider community, implements NUTS and variational inference in JAX. Because JAX compiles and vectorises numerical code and runs it on accelerators, NumPyro is often the fastest option for medium-sized models and for running many chains in parallel. Pyro, its PyTorch sibling, was built for deep probabilistic models and has especially flexible variational inference, with user-defined guide programs that specify the approximating family. Turing.jl brings probabilistic programming to Julia, where its strength is composability: different samplers can be applied to different blocks of parameters, and the model can call arbitrary Julia code, including differential equation solvers. TensorFlow Probability provides distributions, bijectors, MCMC kernels and Bayesian neural network layers that integrate with TensorFlow and JAX models. Supporting this ecosystem are libraries that work across systems. ArviZ provides a common data structure, InferenceData, and standard diagnostics and plots for MCMC output from all the major Python systems. The R package posterior and the bayesplot package do the equivalent in R. loo implements the cross-validation methods discussed below. The choice among systems is usually less important than it seems. A team working in R with regression-type models will be well served by brms and Stan. A Python team wanting a gentle start will find PyMC and Bambi most approachable. A team that needs speed on accelerators or wants to embed Bayesian components in a JAX codebase will reach for NumPyro. A team building deep generative models with custom variational families will find Pyro most flexible. The Bayesian workflow Having a language that makes models easy to write is necessary but not sufficient. Models are easy to write badly. The more important development of the last decade is a shared understanding of how to build, check and revise models, codified in "Bayesian Workflow," a 2020 paper by Andrew Gelman, Aki Vehtari, Daniel Simpson, Charles Margossian, Bob Carpenter, Yuling Yao, Lauren Kennedy, Jonah Gabry, Paul-Christian Bürkner and Martin Modrák. The paper's central point is that fitting a single model is the exception. Real applied work involves building a sequence of models, each checked and improved, and the process of moving between them is itself part of the method. The workflow can be summarised as a loop of five activities. Start simple. Begin with a model you can understand completely, perhaps a pooled regression with few predictors. Get it fitting cleanly before adding structure. Complexity added to a model that does not work is complexity you will have to debug. Check the prior predictive. Before fitting, simulate data from the prior and confirm it looks plausible on the scale of the outcome. This is cheap and catches a remarkable fraction of mistakes, including errors in the code itself, such as a misplaced exponent that produces outcomes in the trillions. Fit and check the computation. Run the sampler with multiple chains and read the diagnostics from Chapter 4. Treat divergences, high R-hat and low effective sample sizes as bugs to be fixed, usually by reparameterising or by revisiting priors. For a new model, consider fitting it to simulated data with known parameters to confirm that the inference recovers them. Check the posterior predictive. Simulate replicated datasets from the fitted model and compare them with the real data. This is the posterior predictive check, and it is the main tool for finding out how a model is wrong. The comparisons should be chosen to probe features the model might miss. Does the model reproduce the proportion of zeros in count data? The tails of the distribution? The variation between groups? The autocorrelation in a time series? A model that reproduces the mean but not the spread, or the bulk but not the tails, has been caught misspecified, and the specific failure suggests the fix: a negative binomial instead of a Poisson, a Student-t instead of a Gaussian, a group-varying slope instead of a common one. Compare and expand. When you have several candidate models, compare them by their predictive performance on unseen data. Then expand in the direction the checks suggest, and repeat. Choosing the likelihood Discussions of Bayesian modelling tend to dwell on priors, but in practice the likelihood usually has a larger effect on the result, and probabilistic programming makes it easy to choose well. The question is simply what kind of quantity the outcome is and how it varies. Counts, such as orders, defects or clicks, call for a Poisson likelihood when the variance roughly equals the mean, and a negative binomial when the counts are more variable than that, which in real data is the usual case. Binary outcomes call for a Bernoulli likelihood with a logistic or probit link; proportions out of a known total, for a binomial. Strictly positive continuous quantities, such as durations, prices or concentrations, are often better modelled with a lognormal or gamma likelihood than with a Gaussian that can produce negative values. Times to an event, where some observations are still waiting when data collection stops, need a survival likelihood that handles that censoring correctly, rather than discarding the unfinished cases or treating them as if they had ended. Robustness is a recurring concern. A Gaussian likelihood treats a single extreme observation as very strong evidence, because it assigns such observations tiny probability and the posterior must move a long way to accommodate them. Replacing it with a Student-t likelihood, whose heavier tails make outliers less surprising, lets the model treat isolated extreme values as probably anomalous rather than reshaping everything around them. The degrees of freedom of the Student-t can themselves be given a prior and learned. This is a one-line change in any probabilistic programming language, and in data with occasional recording errors or sudden spikes it can change conclusions substantially. Finally, real datasets often have measurement processes that deserve explicit modelling. A sensor with known noise characteristics, a survey where some responses are missing for reasons related to the answer, or a pipeline that truncates values below a detection limit can all be represented directly in the likelihood. Doing so is one of the clearest advantages of writing the model as a generative program: the program can describe how the data were actually produced, quirks included, rather than how a textbook model assumes they were. The workflow on a real problem The loop is easier to understand through a case. Consider a team forecasting weekly sales of spare parts across a network of 150 service depots. Many parts sell in small numbers, many weeks have zero sales, and some depots have only a few months of history. The forecasts set reorder points, so the upper tail of the predictive distribution matters more than the mean. A first model might be a Poisson regression on the log of expected weekly sales, with a single intercept and coefficients for seasonality and depot size. Its prior predictive check, simulating weekly sales from Normal(0, 1) priors on standardised coefficients, gives plausible counts in the range of zero to a few dozen, which is reassuring. It fits cleanly, with no divergences. The posterior predictive check exposes two problems. First, the real data have far more weeks with zero sales than the model's replicated datasets. Second, the real data have more weeks with unusually high sales than the replications; the Poisson's variance equals its mean, and the real counts are overdispersed. Both failures matter for reorder points: the model would understate the risk of a large week. The team expands in the direction the checks indicate. Replacing the Poisson with a negative binomial likelihood adds a dispersion parameter that lets the variance exceed the mean. A zero-inflation component allows a separate probability that a part has no demand in a given week, for instance because no machine using it is in service. And because depots differ, the intercept becomes hierarchical, with partial pooling across depots so that new depots borrow strength from established ones. The hierarchical intercept is written in non-centred form from the start. The new model's posterior predictive checks match the proportion of zeros and the upper tail of the real data. PSIS-LOO, described next, confirms that it predicts held-out weeks substantially better than the Poisson model, with a difference many times its standard error. A handful of observations have high k-hat values; inspecting them reveals data errors, weeks where a bulk order was recorded against the wrong depot, which are corrected at source. The team reruns the comparison, and the final model's 95th-percentile forecasts become the basis for reorder points. None of the steps was exotic. What made the result good was the order: start simple, check what the model implies before fitting, read the computational diagnostics, compare the fitted model to the real data on the features that matter for the decision, and let the specific failures guide the expansion. The probabilistic programming language made each change a few lines of code; the workflow made sure the changes were the right ones. Comparing models by prediction Choosing between models is a place where Bayesian methods have historically offered a tempting tool, the marginal likelihood or its ratio between models, the Bayes factor, that applied practice now treats cautiously. The marginal likelihood measures how well a model predicted the data before seeing any of it, averaging over the prior. That makes it extremely sensitive to the prior: two models that give nearly identical posteriors can have wildly different marginal likelihoods if one uses a wider prior on a parameter the data determine well. For a modeller whose priors are weakly informative and somewhat arbitrary in their exact width, this sensitivity is unwelcome. The more robust alternative is to compare models by how well they predict held-out data. The natural quantity is the expected log predictive density for new observations, estimated by cross-validation. Exact leave-one-out cross-validation would require refitting the model once per observation, which is impractical. Pareto-smoothed importance sampling leave-one-out cross-validation, or PSIS-LOO, developed by Aki Vehtari, Andrew Gelman and Jonah Gabry in 2017, approximates it from a single fit by reweighting the posterior draws to account for each observation's removal. It is implemented in the loo package for R and in ArviZ for Python, and it comes with its own diagnostic: the same k-hat statistic described in Chapter 5, computed per observation. Observations with high k-hat are ones the model finds surprising and highly influential, which is often useful information in itself. PSIS-LOO compares models on the scale of prediction, which is what an engineer usually cares about, and its estimates come with standard errors, so you can tell whether a difference between models is meaningful or within noise. Where it is not suitable, for instance in time series where leaving out single points does not mimic forecasting, the right approach is a cross-validation scheme that respects the structure, such as leave-future-out validation, and the same logic applies. Making it part of an engineering practice Teams that succeed with Bayesian methods tend to treat models as code, because they are. That means version control for models and priors, with priors justified in comments or design documents. It means automated tests: a model should recover known parameters from data simulated from itself, and its diagnostics should be checked in continuous integration so that a code change that introduces divergences is caught before deployment. It means saving the full posterior samples, in a format like ArviZ's InferenceData, rather than only summary statistics, so that new questions can be answered later without refitting. It also means recognising the cost structure. A Bayesian model that takes twenty minutes to fit can be refitted nightly on a schedule, with its posterior samples stored and used for fast prediction during the day. A model that takes a second to evaluate on each new request is fine for online serving if prediction uses stored posterior draws rather than running inference. Separating the expensive inference step from the cheap prediction step is the main architectural decision in deploying Bayesian models, and probabilistic programming systems support it by making posterior predictive simulation a separate operation from fitting. Finally, it means being willing to say no. Some problems are better served by a large discriminative model with a calibration layer and conformal intervals than by a carefully crafted Bayesian model. The value of the Bayesian workflow is largest where data are limited, structure is rich, prior knowledge is real, and decisions depend on the tails of the uncertainty. Those conditions describe a great many engineering problems, but not all of them, and the next chapter looks at the domain where they are most contested: deep learning. Chapter 7: Uncertainty in Deep Learning Everything in the preceding chapters works well for models with tens, hundreds or a few thousand parameters. Modern deep networks have millions to billions. Their posteriors live in spaces so large that no sampler can explore them thoroughly, their likelihoods are evaluated on datasets too big to touch in full at every step, and their loss surfaces are riddled with symmetries: permute the hidden units of a layer and you get a different weight vector that computes exactly the same function. The full Bayesian treatment of a large neural network is, for practical purposes, out of reach. And yet deep networks are where overconfidence does the most visible damage, because they are the models being deployed into perception systems, medical tools and language interfaces. So a large research field, Bayesian deep learning, has grown up around a pragmatic question: which approximations to the Bayesian ideal give useful uncertainty at acceptable cost? This chapter surveys the answers that have held up, the debates that remain open, and the non-Bayesian methods that often win on the benchmarks. Why the full posterior is hard, and why it might still be worth approximating The idea of placing a prior over the weights of a neural network and computing a posterior is as old as modern neural networks. David MacKay's work in the early 1990s applied the Laplace approximation to small networks and used the evidence to choose hyperparameters. Radford Neal's 1995 doctoral thesis, published as the book Bayesian Learning for Neural Networks, applied Hamiltonian Monte Carlo to neural networks and proved that a one-hidden-layer network with a Gaussian prior on its weights converges, as its width goes to infinity, to a Gaussian process. That result, which connects the most flexible parametric models to a classical nonparametric one, has since been extended to deep networks and is the basis of much theoretical work on how wide networks behave. The case for approximating the posterior in large networks rests on the observation from Chapter 1: many different weight settings fit the training data, and they disagree away from it. A single trained network picks one. A posterior, or any reasonable approximation of it, represents the disagreement. Andrew Gordon Wilson and Pavel Izmailov, in their 2020 paper "Bayesian Deep Learning and a Probabilistic Perspective of Generalization," argued that in neural networks this disagreement is exactly what Bayesian model averaging captures, and that the main benefit of being Bayesian is not the prior but the averaging over the many functions consistent with the data. Monte Carlo dropout The approximation that first brought uncertainty to a broad deep learning audience was published by Yarin Gal and Zoubin Ghahramani in 2016. Dropout, a regularisation technique in which random units are switched off during training, was already used almost everywhere. Gal and Ghahramani showed that, under certain conditions, training a network with dropout can be interpreted as approximate variational inference in a Bayesian model. The practical consequence was striking: keep dropout switched on at test time, run the same input through the network many times, and treat the spread of outputs as an estimate of predictive uncertainty. Monte Carlo dropout is cheap to adopt, because it requires no change to training, only multiple forward passes at prediction time. It was quickly applied in medical imaging, autonomous driving research and elsewhere. Its weaknesses also became clear. The approximate posterior it implies is crude, and the amount of uncertainty it produces depends heavily on the dropout rate, which is usually chosen for regularisation rather than for calibration. In the 2019 Ovadia benchmark discussed in Chapter 1, Monte Carlo dropout improved on a single network under dataset shift but was generally outperformed by deep ensembles. Its theoretical interpretation has also been disputed. It remains a reasonable first step when nothing else is affordable, but should not be mistaken for a faithful posterior. Deep ensembles The method that most often wins practical comparisons was not proposed as Bayesian at all. In 2017 Balaji Lakshminarayanan, Alexander Pritzel and Charles Blundell at DeepMind published "Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles." The recipe is to train several copies of the same network, typically five, from different random initialisations and with different data shuffling, and average their predictions. For regression, each network outputs a mean and a variance, and the ensemble combines them into a mixture. Deep ensembles work because different random initialisations send the optimiser into different regions of the loss surface, which correspond to genuinely different functions. On training data they agree; away from it they diverge, and the divergence reveals epistemic uncertainty. In the Ovadia benchmark, deep ensembles were the most robust method under increasing shift. They are simple to implement, trivially parallel, and require no change to the training procedure. Their cost is linear in the number of members, both in training and at inference, which matters for large models. Whether ensembles are Bayesian has been argued over. Wilson and Izmailov's position is that they are an effective approximation to Bayesian model averaging, arguably better than single-mode methods like mean-field VI because they capture several distinct modes of the posterior, whereas methods that fit a Gaussian around one mode only capture local uncertainty. Others regard them as a frequentist method that happens to perform well. For an engineer the classification matters less than the conclusion: if you can afford to train five networks, you should usually do so, and you should use their disagreement as an uncertainty signal. Several methods try to get ensemble-like benefits at lower cost. Snapshot ensembles save networks at several points along a single training run with a cyclical learning rate. BatchEnsemble shares most weights across members and gives each a cheap rank-one modification. Stochastic weight averaging Gaussian, or SWAG, proposed by Wesley Maddox, Pavel Izmailov, Timur Garipov, Dmitry Vetrov and Andrew Gordon Wilson in 2019, collects weight snapshots during the late phase of training with a high learning rate, fits a Gaussian with a low-rank plus diagonal covariance to them, and samples from it at test time. MultiSWAG combines SWAG with ensembling to capture both local and multi-modal uncertainty. Sampling at scale If HMC on full data is too expensive for large networks, one alternative is to sample with noisy gradients. Stochastic gradient Langevin dynamics, introduced by Max Welling and Yee Whye Teh in 2011, adds carefully scaled Gaussian noise to ordinary minibatch gradient descent updates. As the learning rate decreases, the iterates transition from optimisation to approximate sampling from the posterior. Variants add momentum, as in stochastic gradient Hamiltonian Monte Carlo by Tianqi Chen, Emily Fox and Carlos Guestrin in 2014, or use cyclical learning rates to visit several modes, as in cyclical SG-MCMC by Ruqi Zhang and colleagues in 2020. Stochastic gradient samplers are not exact. Minibatch noise and the absence of a Metropolis correction introduce bias, and the diagnostics of Chapter 4 do not apply cleanly. But they bring sampling into the same computational regime as ordinary training and have produced good uncertainty estimates in many applications. To understand how good the approximations are, one needs a reference. In 2021, Pavel Izmailov, Sharad Vikram, Matthew Hoffman and Andrew Gordon Wilson published "What Are Bayesian Neural Network Posteriors Really Like?", for which they ran full-batch HMC on modern architectures, including ResNet-20 on CIFAR-10, using hundreds of TPU devices. The computation was deliberately extravagant, intended as a gold standard rather than a practical method. Among their findings: the HMC posterior gave better accuracy and calibration than standard training; deep ensembles were closer to the HMC predictive distribution than mean-field variational methods; and, interestingly, the HMC posterior was not especially robust to some kinds of dataset shift, which suggested that the choice of prior plays an important role in how a Bayesian network behaves under shift. The cold posterior puzzle One finding from this literature has become a touchstone for debates about whether Bayesian deep learning is working as intended. In 2020 Florian Wenzel and colleagues at Google published "How Good is the Bayes Posterior in Deep Neural Networks Really?" They found that, with standard Gaussian priors and careful sampling, predictive performance improved substantially when they sharpened the posterior by raising it to a power greater than one, equivalent to dividing the log posterior by a temperature below one. The "cold" posterior beat the true Bayes posterior at temperature one. If Bayesian inference is the right thing to do, tempering it should not help. The paper therefore asked what was wrong, and proposed suspects: the prior, the likelihood, or the inference. Subsequent work has pointed to several contributing factors. One is data augmentation: when training images are randomly cropped and flipped, the effective dataset is larger than the nominal one and the likelihood is not a correct description of the data, a point developed by Laurence Aitchison in 2021 and by Seth Nabarro and colleagues. Another is data curation: benchmark datasets like CIFAR-10 have been carefully labelled to have very little label noise, so a likelihood that assumes typical noise underweights the data. A third is the prior: isotropic Gaussian priors on weights may be poor priors on functions. Izmailov and colleagues found that the cold posterior effect largely disappeared without data augmentation in their HMC experiments. The practical moral is not that Bayesian deep learning is broken, but that the model, prior and likelihood together, must be correct for Bayesian inference to be optimal. Large networks are trained with many conventions, augmentations, label smoothing, batch normalisation, that are not part of a probabilistic model, and naive Bayesian treatments that ignore them can be beaten by simple tempering. Getting priors over network functions right remains an open research problem. Gaussian processes and function-space thinking A different route to uncertainty in flexible models skips weights altogether. A Gaussian process places a prior directly over functions: any finite set of function values is jointly Gaussian, with covariance given by a kernel that encodes assumptions such as smoothness, periodicity or length scale. Given data, the posterior over functions is also a Gaussian process, available in closed form for Gaussian noise. The posterior predictive variance grows naturally as inputs move away from training data, which is precisely the property the overconfident network lacked. Carl Edward Rasmussen and Christopher Williams's 2006 book remains the standard reference. Exact Gaussian processes scale with the cube of the number of data points, which limits them to some thousands of observations. Sparse approximations using inducing points, developed by Michalis Titsias in 2009 and made scalable to large data by James Hensman, Nicolò Fusi and Neil Lawrence in 2013, and GPU-accelerated libraries such as GPyTorch have pushed the limit to millions. Gaussian processes remain the default surrogate model in Bayesian optimisation and an excellent choice for small, smooth regression problems where calibrated uncertainty is essential. The function-space view also offers a cheaper route to uncertainty in large networks. Spectral-normalised neural Gaussian processes, or SNGP, proposed by Jeremiah Liu and colleagues in 2020, constrain a network's hidden layers to preserve distances between inputs and replace its final layer with an approximate Gaussian process. The result is a single network whose uncertainty grows for inputs far from the training data, achieving much of the out-of-distribution sensitivity of ensembles at nearly the cost of one model. More broadly, last-layer methods, which treat a pretrained network as a fixed feature extractor and do Bayesian inference only over the final linear layer, are among the most practical options for large models. Evaluating uncertainty in networks Because so many approximations are available, the question of how to compare them is unavoidable, and the answer has settled on a few standard measurements. Each tests a different promise an uncertainty method makes. In-distribution calibration and proper scores. On a test set drawn from the same distribution as training, report accuracy, negative log likelihood and Brier score, and expected calibration error. These test whether the method's probabilities are honest on data it should understand. Most methods improve on a single network here, but temperature scaling alone often closes much of the gap, so a method should be compared against a temperature-scaled baseline, not a raw one. Calibration under shift. Repeat the measurements on progressively corrupted or shifted data. The CIFAR-10-C and ImageNet-C benchmarks, introduced by Dan Hendrycks and Thomas Dietterich in 2019, apply fifteen kinds of corruption, such as noise, blur, weather effects and compression artefacts, at five levels of severity. Plotting calibration error against severity shows how gracefully each method degrades. The WILDS benchmark, published by Pang Wei Koh and colleagues in 2021, offers real-world distribution shifts, such as different hospitals, regions and time periods, which are often more informative than synthetic corruptions. Out-of-distribution detection. Feed the model inputs from a different dataset entirely and ask whether its uncertainty score separates them from in-distribution inputs. The usual metric is the area under the ROC curve for this binary separation. A method whose uncertainty does not rise on unfamiliar inputs fails this test however well calibrated it is in distribution. Downstream decisions. Finally, measure the decision the uncertainty is meant to support, such as the risk-coverage curve for selective prediction discussed in Chapter 8, or the efficiency of active learning. This is the measurement closest to what an engineer actually cares about, and it occasionally ranks methods differently from the others. Google's Uncertainty Baselines project, released in 2021 by Zachary Nado and colleagues, provides reference implementations of many of the methods in this chapter evaluated on these measures, which makes fair comparison considerably easier than it once was. The consistent lesson from these evaluations is that no single number captures uncertainty quality. A method should be judged on the measurements that correspond to how it will be used. Large models and the limits of the current toolbox The rise of large pretrained models, especially language models, has made the uncertainty problem both more pressing and harder. These models are often used through an interface that returns text, not probabilities, and their errors include fluent fabrications that read exactly like correct answers. Full Bayesian inference over their weights is far beyond any current method. Several practical directions have emerged. One is Bayesian treatment of fine-tuning: when a large model is adapted to a task with a small set of extra parameters, as in low-rank adaptation, those parameters are few enough for Laplace approximations or small ensembles. Adam Yang, Maxime Robeyns, Xi Wang and Laurence Aitchison showed in 2024 that a Laplace approximation applied to low-rank adapters substantially improved the calibration of fine-tuned language models. Another is semantic uncertainty: sampling several answers to the same question and measuring how much they disagree in meaning. Sebastian Farquhar, Jannik Kossen, Lorenz Kuhn and Yarin Gal published in Nature in 2024 a method based on the entropy of clusters of semantically equivalent answers, which detected a class of confabulations better than baselines. The idea is a direct descendant of ensembling: if repeated draws from the model disagree in substance, the model does not know. None of these is a complete answer, and the field is moving quickly. But the conceptual tools are those of this book. Epistemic uncertainty is disagreement among plausible models; it can be estimated by sampling them; and it must be checked for calibration against outcomes rather than taken on trust. A practical ranking For an engineer who needs uncertainty from a neural network today, a defensible order of preference, from cheapest to most expensive, is roughly as follows. Begin with temperature scaling on a held-out set, which fixes in-distribution calibration almost for free. Add a last-layer Laplace approximation or SNGP-style output layer when out-of-distribution sensitivity matters and only one model can be afforded. Use a deep ensemble of around five members when budget allows, since it remains the most robust general method. Consider SWAG or MultiSWAG for a middle ground. Reserve stochastic gradient MCMC and full Bayesian treatments for settings where the model is small enough or the stakes high enough to justify them. And whatever the method, evaluate it under the kinds of shift the deployed system will actually face, because performance on an in-distribution test set says little about the cases that matter. Chapter 8: From Uncertainty to Decisions A posterior distribution is not an answer. It is the raw material for one. The reason to compute it, at all the expense the previous chapters have described, is that somewhere downstream a system or a person has to act: stock a warehouse, flag a transaction, run an experiment, approve a loan, steer a vehicle, show a user an answer. Bayesian decision theory supplies the rule that connects the two, and it is short enough to state in a sentence. Choose the action that minimises the expected loss, where the expectation is taken over the posterior predictive distribution. That sentence does a great deal of work. It says that the right action depends on two things, what you believe and what you care about, and that these should be kept separate. The posterior represents belief. A loss function represents values: how much a stockout costs relative to excess inventory, how much a missed fraud costs relative to a blocked legitimate customer. Combining them by averaging gives an action that is optimal given both. A model that reports only a point prediction forces the decision-maker to mix belief and value informally, usually by adding a fudge factor. A model that reports a distribution lets the two be combined explicitly. This chapter works through the main patterns by which engineers turn uncertainty into action, and closes with the tools for keeping that uncertainty honest once a system is in production. The newsvendor and the asymmetric loss The simplest illustration is old and still instructive. A newspaper seller must decide each morning how many copies to buy. Each unsold copy costs the purchase price; each unmet customer costs the forgone profit. Demand is uncertain. The optimal order, it turns out, is not the expected demand. It is a specific quantile of the demand distribution: the one at which the probability of demand exceeding the order equals the ratio of the cost of over-ordering to the sum of both costs. If a stockout is four times as costly as an unsold unit, the right order is the 80th percentile of demand. The result generalises. Under an asymmetric linear loss, the optimal point decision is a quantile of the predictive distribution, and which quantile depends only on the costs. Under squared loss it is the mean; under absolute loss, the median. A point forecaster that produces only the mean is therefore implicitly optimising for squared loss, which is rarely what the business actually faces. Retail replenishment, cloud capacity planning, staffing call centres and scheduling electricity generation all have this asymmetric structure, and all benefit directly from a full predictive distribution. A Bayesian model adds something beyond any forecaster that outputs quantiles: the predictive distribution includes epistemic uncertainty. For a new product with three weeks of history, the posterior over its demand parameters is wide, the predictive distribution is wide, and the 80th percentile is correspondingly high. For a staple with five years of history, the posterior is tight and the 80th percentile sits close to the mean. The safety stock adjusts to how much the model knows, automatically, without a separate rule. Thresholds that come from costs Classification raises the same issue in a different form. A fraud model outputs a probability that a transaction is fraudulent; someone must decide the threshold above which it is blocked. In many organisations that threshold is tuned by hand, nudged up or down until the operations team is satisfied with the volume of alerts. Decision theory gives it directly. If blocking a legitimate transaction costs an amount A, in lost revenue and customer annoyance, and letting a fraudulent one through costs an amount B, then the transaction should be blocked whenever the probability of fraud exceeds A divided by A plus B. If a missed fraud costs nineteen times as much as a false block, the threshold is 5 percent, not the 50 percent that a default classifier would use. Two consequences follow. First, the threshold is only correct if the probabilities are calibrated. A classifier whose stated 5 percent actually corresponds to a 15 percent fraud rate will make systematically wrong decisions at the cost-optimal threshold, which is why calibration, discussed in Chapter 1, is a practical requirement rather than an academic nicety. Second, the threshold can vary by case when costs do. A high-value transaction has a larger B, so its threshold is lower. A customer with a long, clean history may have a larger A, because a false block risks losing a valuable relationship. With calibrated probabilities and explicit costs, the rule handles all of this with one formula. With uncalibrated scores and a single tuned threshold, every such variation becomes another special case. The Bayesian contribution here is the epistemic part of the probability. For a transaction pattern the model has seen many times, the predictive probability reflects mainly the inherent mix of fraud and legitimate cases. For a new merchant category or an unfamiliar geography, the posterior is wide and the predictive probability is pulled toward uncertainty. Whether that leads to blocking or allowing depends on the costs, but at least the decision is made knowing that the model is on unfamiliar ground. Knowing when not to answer In classification, the most direct use of uncertainty is selective prediction: the model answers when it is confident and abstains, deferring to a human or a fallback, when it is not. The decision-theoretic version is to add a "reject" action with a fixed cost and to choose it whenever the expected loss of every other action exceeds that cost. In practice, this becomes a threshold on some uncertainty measure. Which measure matters. The predictive entropy of the posterior predictive distribution captures total uncertainty, aleatoric and epistemic together. The mutual information between the prediction and the parameters, sometimes called the epistemic part or BALD score after Neil Houlsby and colleagues' 2011 work on Bayesian active learning by disagreement, captures only the disagreement among plausible models. An input that is inherently ambiguous, a blurry image that could truly be either of two classes, has high entropy but low mutual information: every plausible model agrees that it is ambiguous. An input unlike anything in training has high mutual information: plausible models disagree. For deferring to a human expert, total uncertainty is usually the right trigger. For deciding that an input is outside the model's competence and should be routed elsewhere, or that more training data of this kind are needed, the epistemic component is the right one. The value of selective prediction is measured by the risk-coverage curve: as the model abstains on more cases, the error rate on the cases it does answer should fall. A model with good uncertainty produces a steep curve, so that by declining, say, the 10 percent of cases it is least sure about, it removes a large fraction of its errors. A model with poor uncertainty produces a flat curve, and abstention removes correct and incorrect answers alike. The curve is a direct, decision-relevant way to compare uncertainty methods, and it is often more informative than calibration error alone. Exploration: bandits and experiments Some decisions affect what data you will see next. A recommender that always shows a user the items it currently thinks they like best will never learn whether they would have liked something else. A clinical trial that assigns patients only to the treatment that looks best so far may stop learning about the others prematurely. This is the exploration-exploitation trade-off, and Bayesian uncertainty offers one of the most effective solutions to it. Thompson sampling, proposed by William Thompson in 1933 in the context of clinical trials, is strikingly simple. Maintain a posterior over the reward of each option. At each round, draw one sample from each posterior and choose the option whose sample is highest. Options that are known to be good are chosen often because their samples are reliably high. Options that are uncertain are chosen sometimes, because their samples occasionally come out high, and each choice reduces their uncertainty. Options known to be bad are rarely chosen. The algorithm explores exactly in proportion to how plausible it is that an option is best. Thompson sampling lay neglected for decades, then returned to prominence after Olivier Chapelle and Lihong Li showed empirically in 2011 that it performed very well on display advertising and news recommendation problems at Yahoo, and after theoretical work by Shipra Agrawal and Navin Goyal, among others, established near-optimal regret guarantees. It is now widely used in online experimentation, recommendation and advertising. With beta posteriors on click-through rates, as in the conversion example of Chapter 2, it can be implemented in a few lines and updated in real time. Daniel Russo, Benjamin Van Roy, Abbas Kazerouni, Ian Osband and Zheng Wen's 2018 tutorial is the standard practical introduction. The same logic reshapes ordinary A/B testing. A Bayesian analysis reports the posterior probability that each variant is best and the expected loss from choosing it if it is not. That allows decisions framed directly in business terms, such as "ship when the expected loss of shipping falls below a tenth of a percent of conversion," rather than in terms of p-values. It does not, however, remove the need for discipline. A Bayesian analysis is not immune to the inflation of false conclusions from stopping whenever results look good, if the prior is unrealistically wide or the model ignores effects like novelty that change over time. The posterior is only as honest as the model. Bayesian optimisation and active learning When each evaluation of an objective is expensive, choosing where to evaluate next is itself a decision under uncertainty. Bayesian optimisation fits a probabilistic surrogate model, usually a Gaussian process, to the evaluations made so far, and then chooses the next point by maximising an acquisition function that balances evaluating where the surrogate predicts good values against evaluating where it is uncertain. Common acquisition functions include expected improvement, which asks how much a new point is expected to beat the best result so far, upper confidence bounds, and Thompson sampling applied to functions. Bayesian optimisation is used to tune hyperparameters of machine learning models, to design experiments in chemistry and materials science, to calibrate simulators, and to configure complex systems such as databases and compilers. Jasper Snoek, Hugo Larochelle and Ryan Adams's 2012 paper "Practical Bayesian Optimization of Machine Learning Algorithms" brought it to wide attention in machine learning, and Roman Garnett's 2023 book Bayesian Optimization is now the most complete treatment. Open-source libraries such as BoTorch, built on PyTorch and GPyTorch, and Ax, which builds on it, make the method accessible to engineers. Active learning applies the same idea to labelling: when labels are expensive, choose which unlabelled examples to label next by how much they would reduce the model's uncertainty. The BALD criterion mentioned above selects points where plausible models disagree most, which is exactly where a label is most informative. Yarin Gal, Riashat Islam and Zoubin Ghahramani applied it to image data with deep networks in 2017. Active learning is sensitive to the quality of the uncertainty estimate: a model that is confidently wrong in some region will never ask for labels there. That is one more reason epistemic uncertainty must be good, not merely present. The value of information Active learning and Bayesian optimisation are instances of a broader idea that every engineer making decisions under uncertainty can use: before collecting more data, ask how much it could change the decision. Decision theory makes this precise through the expected value of information. Compute the expected loss of the best action under current beliefs. Then imagine observing the new data, update to a hypothetical posterior, choose the best action under that, and average the resulting loss over all the data you might see. The difference between the two is the most you should be willing to pay for the data. The calculation often produces counterintuitive answers. If the current posterior is wide but every plausible value leads to the same decision, the value of more information is zero: you would act the same way regardless, so measuring more precisely is wasted effort. If the posterior is fairly narrow but straddles a decision threshold, a small amount of extra data can be very valuable, because it may flip the action. Uncertainty matters only to the extent that it could change what you do. This reframes many familiar engineering questions. Should we run the A/B test for another week? Only if the remaining uncertainty about which variant is better is large relative to the cost of a wrong choice. Should we pay to label another thousand examples? Only if the model's uncertainty is concentrated in regions where its decisions are close calls. Should we run a costly reliability test on a component? Only if the posterior over its failure rate spans the threshold at which the design would change. Health economists use expected value of information routinely to decide whether further clinical research is worth funding. Engineering teams can apply the same logic, informally if not by full calculation, and a Bayesian model gives them the posterior they need to do it. Guarantees without the model: conformal prediction Every Bayesian guarantee is conditional on the model. If the model is wrong, its intervals can be wrong, and Chapter 2 noted that misspecified models can become more confident as data grow. For some applications, an engineer needs a guarantee that holds regardless. Conformal prediction, developed by Vladimir Vovk, Alexander Gammerman and Glenn Shafer and described in their 2005 book Algorithmic Learning in a Random World, provides one. In its most common form, split conformal prediction, you hold out a calibration set, compute a nonconformity score for each calibration example, such as the absolute residual of a regression model, and take an appropriate quantile of those scores. The prediction interval for a new point is the model's prediction plus or minus that quantile. If the calibration and test data are exchangeable, which holds when they are drawn independently from the same distribution, the interval contains the true value with at least the target probability, for any model and any sample size. Anastasios Angelopoulos and Stephen Bates's tutorial "A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification" made the method widely accessible. Conformal prediction and Bayesian inference are complementary rather than competing. The conformal guarantee is marginal, averaged over inputs, and says nothing about whether intervals are appropriately wide for each particular input; a conformal interval built on a poor score can be uniformly wide, covering the truth on average while being too wide for easy cases and too narrow for hard ones. Bayesian predictive distributions, by contrast, adapt their width to the input, but carry no guarantee if the model is wrong. A common and effective pattern uses a Bayesian or ensemble model to produce input-dependent uncertainty and then applies conformal calibration on top, using a score normalised by the model's own predicted spread. The result adapts to the input like a Bayesian model and carries a coverage guarantee like a conformal one. Exchangeability is the conformal method's own assumption, and it fails under dataset shift. Extensions that reweight calibration data for known covariate shift, by Ryan Tibshirani, Rina Foygel Barber, Emmanuel Candès and Aaditya Ramdas in 2019, and that adapt online to changing distributions, by Isaac Gibbs and Emmanuel Candès in 2021, relax it in useful ways. No method offers guarantees under arbitrary shift, and none should be expected to. Keeping uncertainty honest in production Uncertainty estimates degrade like any other model output. The data drift, the world changes, and a model whose intervals were well calibrated at launch can become overconfident months later. The patterns above turn uncertainty into decisions; they also provide the means to monitor it. The main patterns differ in what uncertainty they require and what they deliver, as Table 4 summarises. Table 4. Turning uncertainty into action. Pattern Uses Delivers Main failure mode Quantile decision Full predictive distribution Cost-optimal stock or capacity Miscalibrated tails Selective prediction Entropy or epistemic score Lower error on answered cases Flat risk-coverage curve Thompson sampling Posterior over rewards Efficient exploration Overconfident posterior stops exploring Bayesian optimisation Surrogate posterior Fewer costly evaluations Poor surrogate in high dimensions Conformal wrapper Any score plus calibration set Marginal coverage guarantee Breaks under unaccounted shift Three monitoring practices follow naturally. First, track calibration on live outcomes: as true labels or realised values arrive, compute interval coverage and proper scores on a rolling window and alert when they drift from the target. Second, track the distribution of uncertainty itself: a rise in average epistemic uncertainty across incoming requests is an early warning of distribution shift, often visible before outcome labels arrive. Third, track the decisions: abstention rates, exploration rates and safety-stock levels that change unexpectedly are often the first visible symptom of an uncertainty model that has drifted. When monitoring reveals a problem, the Bayesian workflow from Chapter 6 offers a principled response. Refit with the new data, and the posterior updates. Run posterior predictive checks against recent data to see what the model is now missing. Revisit priors if the world has changed in a way that makes old assumptions untenable. The cycle is the same one used to build the model in the first place, which is one of the quieter advantages of the approach: development and maintenance are the same activity. Conclusion The argument of this book began with a model returning a number that looked like every other number it had ever returned, at the moment it had stopped knowing what it was talking about. Everything since has been about closing that gap: building systems whose outputs carry an account of their own reliability, and making that account accurate enough to act on. It is worth stating plainly what the Bayesian approach has turned out to offer, because it is both more and less than its advocates sometimes claim. It offers a single coherent language. Priors, likelihoods, posteriors and decisions are not separate techniques bolted together; they are parts of one calculation, and a change to any part propagates correctly to the rest. When a team adds a new data source, the likelihood changes and the posterior updates. When a team learns from experts that a parameter cannot be negative, the prior changes and the posterior respects it. When the business decides a stockout costs more than it used to, the loss changes and the decision moves along the predictive distribution to a new quantile. None of this requires inventing a new heuristic. That coherence is the main practical reason to learn the framework, and it pays off most in exactly the systems where heuristics accumulate: forecasting, experimentation, risk, and any setting with many related units and little data for each. It offers honest epistemic uncertainty, under conditions. A posterior that comes from a well-checked model, computed by a sampler whose diagnostics are clean, gives intervals that widen where the data are thin and tighten where they are dense. That is the property the overconfident classifier of Chapter 1 lacked, and it falls out of the mathematics without special machinery. The conditions are real, though. The model must be adequate, which is why posterior predictive checks are part of the method rather than an appendix. The computation must be faithful, which is why divergences are bugs and mean-field intervals are treated as optimistic. And the prior must be sensible on the scale of the outcome, which is why prior predictive simulation comes before fitting. It does not offer a free lunch at scale. For large neural networks the full posterior is unreachable, the approximations are imperfect, and the strongest practical method, the deep ensemble, sits at the edge of what counts as Bayesian. The cold posterior results showed that naive priors on network weights can be worse than tempering, which is a reminder that the framework demands good models and does not supply them. For the largest models now in use, uncertainty estimation is an active research area rather than a settled practice. What follows for the practising engineer Several conclusions follow that only make sense once the whole argument is in view. Treat uncertainty as a requirement, not a feature. When a model's output drives a decision with asymmetric costs, or is shown to a person who will rely on it, or will be used outside the conditions it was trained in, a point prediction is an incomplete specification. Write the uncertainty requirement down alongside the accuracy requirement: what coverage the intervals must achieve, under what shifts, and how it will be measured. Separate belief from value. Much engineering complexity comes from mixing the two: a threshold tuned to make the business happy, a forecast inflated by a safety factor, a classifier biased toward one class to reduce an expensive error. Each of these hides a loss function inside a model. Keeping the model's job to producing honest distributions, and the decision layer's job to applying explicit costs, makes both easier to audit and to change. Choose the inference to match the stakes. For a hierarchical forecasting model whose intervals set inventory for thousands of products, run NUTS and read the diagnostics. For a vision model that needs to flag unfamiliar inputs, train an ensemble or add a last-layer Laplace approximation, and measure its risk-coverage curve under realistic shift. For a system that needs a coverage guarantee regardless of model quality, add a conformal layer. These are not competing philosophies; they are tools with different costs and guarantees, and a mature system often uses more than one. Make the assumptions visible. The most durable benefit of writing models in a probabilistic programming language is that the assumptions are written down where a reviewer can read them. A prior can be argued with. A likelihood can be checked. A hyperparameter buried in a training script, chosen years ago by someone who has since left, cannot. Code review for a Bayesian model is a review of its assumptions, and that is a much healthier conversation than a review of its accuracy on a test set. Validate uncertainty as rigorously as accuracy. Report proper scoring rules, interval coverage and calibration on held-out and shifted data, and monitor them after deployment. An uncertainty estimate that has never been checked against outcomes is a claim, not a measurement. What remains unsettled Some questions remain open, and an honest account should name them. How to specify priors over the functions represented by deep networks, rather than over their weights, is unresolved, and the cold posterior debate is in part a symptom of that gap. How to obtain reliable uncertainty from very large pretrained models, especially generative ones whose outputs are text rather than probabilities, is moving quickly but lacks settled methods. How to combine the adaptive, input-dependent uncertainty of Bayesian models with the distribution-free guarantees of conformal methods under realistic shift is an active area of work. And the computational frontier keeps moving, as accelerators and better samplers bring larger models within the reach of exact methods. None of these open questions undermines the core lesson. A system that knows when it is uncertain is more useful than one that does not, and it is safer, because the people and processes around it can respond to its doubt. The Bayesian framework gives the clearest account available of what that knowledge consists of, how to compute it, and how to check it. The work of an engineer is to apply that account with discipline: to build models whose assumptions are visible, whose computations are verified, and whose stated confidence has been tested against the world it claims to describe. Further Reading Foundations and textbooks Richard McElreath, Statistical Rethinking: A Bayesian Course with Examples in R and Stan, 2nd edition (CRC Press, 2020). The most readable introduction to Bayesian modelling for practitioners, built around simulation, causal thinking and hierarchical models. The accompanying lectures are freely available online. Andrew Gelman, John Carlin, Hal Stern, David Dunson, Aki Vehtari and Donald Rubin, Bayesian Data Analysis, 3rd edition (CRC Press, 2013). The standard reference for applied Bayesian statistics, including hierarchical models, model checking and computation. A PDF is freely available from the authors. Kevin Murphy, Probabilistic Machine Learning: An Introduction (MIT Press, 2022) and Probabilistic Machine Learning: Advanced Topics (MIT Press, 2023).** A comprehensive treatment of machine learning from a probabilistic perspective, covering variational inference, Bayesian neural networks and Gaussian processes in depth. Christopher Bishop, Pattern Recognition and Machine Learning (Springer, 2006).** Still a clear account of Bayesian linear models, the Laplace approximation and variational methods from a machine learning viewpoint. Carl Edward Rasmussen and Christopher Williams, Gaussian Processes for Machine Learning (MIT Press, 2006).** The standard book on Gaussian processes, freely available online. Roman Garnett, Bayesian Optimization (Cambridge University Press, 2023).** A thorough modern treatment of Bayesian optimisation, from Gaussian process surrogates to acquisition functions. Workflow and computation Andrew Gelman, Aki Vehtari, Daniel Simpson and colleagues, "Bayesian Workflow" (arXiv, 2020). The clearest statement of how applied Bayesian modelling is actually done: building, checking, comparing and revising models. Jonah Gabry, Daniel Simpson, Aki Vehtari, Michael Betancourt and Andrew Gelman, "Visualization in Bayesian Workflow," Journal of the Royal Statistical Society Series A (2019).** Prior and posterior predictive checks explained through a worked example. Michael Betancourt, "A Conceptual Introduction to Hamiltonian Monte Carlo" (arXiv, 2017). An intuitive account of why HMC works and how it fails, without heavy mathematics. Matthew Hoffman and Andrew Gelman, "The No-U-Turn Sampler," Journal of Machine Learning Research (2014).** The paper that made HMC usable without hand tuning. Aki Vehtari, Andrew Gelman, Daniel Simpson, Bob Carpenter and Paul-Christian Bürkner, "Rank-Normalization, Folding, and Localization: An Improved R-hat for Assessing Convergence of MCMC," Bayesian Analysis (2021).** The current standard for convergence diagnostics. Aki Vehtari, Andrew Gelman and Jonah Gabry, "Practical Bayesian Model Evaluation Using Leave-One-Out Cross-Validation and WAIC," Statistics and Computing (2017).** The basis of PSIS-LOO model comparison. David Blei, Alp Kucukelbir and Jon McAuliffe, "Variational Inference: A Review for Statisticians," Journal of the American Statistical Association (2017).** A balanced introduction to variational methods and their limitations. Osvaldo Martin, Bayesian Analysis with Python, 3rd edition (Packt, 2024). A practical introduction using PyMC and ArviZ. Uncertainty in deep learning Balaji Lakshminarayanan, Alexander Pritzel and Charles Blundell, "Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles," NeurIPS (2017). The deep ensembles paper. Yaniv Ovadia and colleagues, "Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shift," NeurIPS (2019). The benchmark that showed how uncertainty methods degrade under shift. Chuan Guo, Geoff Pleiss, Yu Sun and Kilian Weinberger, "On Calibration of Modern Neural Networks," ICML (2017). The study that documented overconfidence in modern networks and introduced temperature scaling to a wide audience. Andrew Gordon Wilson and Pavel Izmailov, "Bayesian Deep Learning and a Probabilistic Perspective of Generalization," NeurIPS (2020). An argument for Bayesian model averaging in deep learning and for viewing ensembles in that light. Pavel Izmailov, Sharad Vikram, Matthew Hoffman and Andrew Gordon Wilson, "What Are Bayesian Neural Network Posteriors Really Like?," ICML (2021). Full-batch HMC on modern networks as a reference point for approximations. Erik Daxberger, Agustinus Kristiadi and colleagues, "Laplace Redux: Effortless Bayesian Deep Learning," NeurIPS (2021). A practical case for post-hoc Laplace approximations. Decisions and guarantees Daniel Russo, Benjamin Van Roy, Abbas Kazerouni, Ian Osband and Zheng Wen, "A Tutorial on Thompson Sampling," Foundations and Trends in Machine Learning (2018).** The standard introduction to Thompson sampling and its applications. Anastasios Angelopoulos and Stephen Bates, "A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification" (arXiv, 2021; published in Foundations and Trends in Machine Learning, 2023). The most accessible route into conformal methods. Vladimir Vovk, Alexander Gammerman and Glenn Shafer, Algorithmic Learning in a Random World (Springer, 2005; 2nd edition 2022).** The foundational book on conformal prediction. Hashtags: #BayesianMachineLearning #BayesianStatistics #ProbabilisticProgramming #UncertaintyQuantification #ProbabilisticModeling #BayesianInference #BayesTheorem #PriorDistributions #PosteriorDistributions #PosteriorPredictiveDistribution #PredictiveUncertainty #EpistemicUncertainty #AleatoricUncertainty #UncertaintyCalibration #MarkovChainMonteCarlo #MCMC #HamiltonianMonteCarlo #NoUTurnSampler #VariationalInference #HierarchicalBayesianModels #BayesianNeuralNetworks #BayesianDeepLearning #GaussianProcesses #ProbabilisticGraphicalModels #PyMC #Stan #NumPyro #PosteriorPredictiveChecks #BayesianDecisionTheory #ConformalPrediction

Download the Book (PDF): Introduction In November 2017 a small, heavily restored panel painting of Christ holding a crystal orb sold at Christie's in New York for $450.3 million, the highest price ever paid for a work of art at auction. Twelve years earlier the same picture had been bought at a regional sale in New Orleans for well under $10,000, catalogued as the work of a follower of Leonardo da Vinci. Nothing about the panel itself changed very much between those two moments apart from cleaning and repainting. What changed was a set of claims about it: that Leonardo painted it, that the right scholars agreed, that it had passed through the collection of Charles I of England, and that the people selling it had the right to do so. The Salvator Mundi is an unusually vivid example, but it illustrates something true of the entire market for serious art. A painting is a physical object, but its value is almost entirely a matter of documented belief. This book is about the law that governs those beliefs. It is organised around three questions that every valuable work of art raises, whether it hangs in a museum, sits in a freeport warehouse, or is about to cross the block at an evening sale. Who made it? Where has it been? And who is entitled to it now? The first is the question of authentication and forgery. The second is the question of provenance, the documented chain of ownership that runs from the artist's studio or the ground where an object was excavated to the present day. The third is the question of title and, increasingly, of restitution: whether an object taken by theft, persecution, war, or colonial conquest must be given back, and to whom. The argument The argument of the book is simple to state. For most of its modern history the art market has run on private assurance. Buyers relied on the word of a dealer, the eye of a connoisseur, the reputation of an auction house, and the discretion of everyone involved. Law stood well back. Courts were reluctant to decide whether a painting was genuine; legislatures largely left the trade unregulated; tax authorities struggled to value what they could not easily see; and questions of where an object came from were treated as matters of manners rather than of legal duty. That arrangement suited a small, clubby market in which reputations were long and transactions were few. It does not suit the market that exists now. Global sales of art and antiques reached an estimated $59.6 billion in 2025, according to the annual report published by Art Basel and UBS, with the United States accounting for roughly 44 percent of the total. Works now change hands at prices that attract the attention of prosecutors, tax collectors, sanctions officials, and foreign governments. Over the past three decades a series of scandals has shown how badly private assurance can fail: forged Abstract Expressionist paintings sold for years by one of New York's oldest galleries; antiquities looted to order from archaeological sites and laundered through respectable collections; Nazi-looted pictures hanging in public museums seven decades after the war. Each failure has pushed the law a step further forward. The result is a slow but unmistakable shift from assurance to accountability. Authentication is still largely a matter of expert opinion, but the people giving that opinion now worry about lawsuits, and scientific evidence increasingly decides disputes that once turned on reputation alone. Tax law has hardened its demands for independent appraisal and documentation. Antiquities that arrive without a verifiable export history are now at real risk of seizure, and museums that once assumed their acquisitions were safe have handed back hundreds of objects. In April 2026 Congress made permanent, and considerably strengthened, the federal law that gives heirs of Holocaust victims a fair chance to reclaim art in American courts. The common thread is that a work of art is now only as secure, legally and financially, as the paper trail behind it. Provenance has become the real currency of the market. What the book covers The chapters move from the market's internal mechanics outward to the international frameworks that increasingly constrain it. Chapter 1 describes how the art market is organised, why its customs of confidentiality and handshake dealing sit uneasily with ordinary commercial law, and the basic rule of property that governs everything that follows: that a thief cannot pass good title. Chapters 2 and 3 take up authenticity. Chapter 2 examines who decides whether a disputed work is genuine and how the law treats their decisions, from the defamation suits that have chilled expert opinion to the quiet disappearance of the artist foundations that once issued certificates. Chapter 3 turns to what happens when a buyer discovers that an expensive work is a fake: the warranties that may protect them, the limitations periods that often defeat them, the criminal prosecutions of forgers and those who sold their work, and the lessons of the Knoedler Gallery affair and the litigation surrounding the Salvator Mundi. Chapters 4 and 5 follow the money. Chapter 4 explains how the federal tax code treats buying and selling art, why collectors pay a higher capital gains rate than stock investors, how sales tax has become a surprisingly active field of enforcement, and why anti-money-laundering and sanctions law has begun to reach the auction room. Chapter 5 addresses the other great tax event in the life of a collection: the moment it is given away or passes at death, where valuation disputes between estates and the Internal Revenue Service can run to tens of millions of dollars. Chapters 6 through 9 concern provenance and restitution. Chapter 6 sets out the law of stolen art: how American and European courts balance the claims of original owners against good-faith purchasers, and how the passage of time is handled. Chapter 7 is devoted to art looted in the Nazi era, the area in which restitution law has been most fully developed and most fiercely contested. Chapter 8 turns to antiquities and the international treaties and national laws under which source countries reclaim objects taken from their soil. Chapter 9 examines the newest and least settled frontier: the return of objects taken during colonial rule and of Native American cultural items held in museums, where the question is less whether a crime was committed than whether an acquisition, legal at the time, can still be justified. The conclusion draws out what this means for the people who buy, sell, hold, and care for art, and identifies the questions the law has not yet resolved. Scope and approach The book is written for intelligent readers who are not lawyers: collectors and their advisers, museum trustees and staff, students of art history and law, journalists, and anyone curious about how a field with so much money and so much history attached to it is actually governed. American law is the primary focus, since the United States is the largest art market in the world and New York remains its legal centre. But art moves across borders more readily than almost any other form of wealth, and a dispute over a single painting may involve the laws of three or four countries. Where comparison with European law or international practice illuminates the American position, it is included. Cases and statutes are described as accurately as possible and are current as of late 2026. Readers should bear in mind that several of the areas discussed here, especially the law of Nazi-era claims and the enforcement practices of prosecutors seeking antiquities, have moved quickly in the last two years and will continue to move. This book is an explanation of the law, not legal advice about any particular situation. One further note on vocabulary. The words "authentic," "genuine," and "original" are used here in their ordinary sense, to describe a work actually made by the artist to whom it is attributed. A "forgery" is a work made or altered with intent to deceive about its authorship; a "fake" is used more loosely for any work falsely presented as something it is not; a "misattribution" is an honest error. The distinction matters, because the law treats the forger, the dealer who sells in good faith, and the scholar who simply got it wrong in very different ways. Chapter 1: A Market Built on Trust The art market is often described as the last great unregulated market, and like most clichés the description is partly true and partly misleading. There is no securities regulator for paintings, no licensing exam for art dealers in most American states, no public register of who owns what, and no requirement that the price of a private sale ever be disclosed. Yet the market is governed by a thick web of ordinary law: contract, property, agency, consumer protection, tax, customs, and criminal law. What makes the art market distinctive is not that law is absent but that law has been built for other kinds of goods and fits art awkwardly. Understanding that awkward fit is the starting point for everything that follows. How the trade is organised The market has three main channels. The first and largest by value is the dealer sector: commercial galleries that represent living artists on the primary market and trade in established works on the secondary market. According to the Art Basel and UBS report for 2026, dealers accounted for roughly $34.8 billion of the estimated $59.6 billion in global sales in 2025. The second channel is public auction, dominated at the top by Christie's, Sotheby's, and Phillips, with a much larger population of regional houses below them; public auction sales were estimated at about $20.7 billion in 2025. The third channel, smaller but important at the highest price points, is private sales arranged by auction houses and advisers outside the saleroom. Each channel has its own legal architecture. A dealer selling a painting from inventory is a merchant selling goods, and the sale is governed by Article 2 of the Uniform Commercial Code, the body of commercial law adopted in some form by every state. A dealer selling on consignment is also an agent for the owner, with fiduciary duties running to that consignor. An auction house is, in the classic formulation, the agent of the seller, not of the buyer, although it deals directly with both and increasingly takes on obligations to each. The auction house's relationship with the seller is governed by a consignment agreement; its relationship with the buyer is governed by the conditions of sale printed in every catalogue and incorporated by reference when a bidder registers. Those conditions typically disclaim almost every warranty the law would otherwise imply, leaving the buyer with a narrow and carefully drafted guarantee of authorship that is discussed in Chapter 3. Two features of the modern auction deserve particular mention because they shape both prices and legal risk. The first is the buyer's premium: a commission, charged on top of the hammer price, that at the major houses runs on a sliding scale from roughly a quarter of the price at lower levels down to a much smaller percentage on the portion above several million dollars. The premium is part of the price for purposes of sales tax and for the purchaser's cost basis. The second is the guarantee. To win consignments of important works, auction houses frequently guarantee the seller a minimum price whether or not the work sells, and they often lay off that risk to third parties who agree in advance to bid up to a certain amount in exchange for a fee or a share of any upside. These irrevocable bids mean that a work may be effectively sold before the auction begins. The houses disclose the existence of guarantees and third-party interests in their catalogues, and New York's auction regulations require certain disclosures, but the details of who holds the financial interest are ordinarily confidential. Confidentiality and its costs Confidentiality is the defining custom of the trade. Auction catalogues describe works as coming from "a private collection" or "property of a gentleman." Dealers rarely disclose the identity of the person on the other side of a transaction, and the practice is so entrenched that courts have treated it as part of the commercial context in which sales take place. Sellers value discretion because the sale of a collection may signal death, divorce, or debt. Buyers value it for reasons ranging from personal privacy to security, and, at the margins, for reasons less respectable. The cost of confidentiality is paid in information. A buyer who does not know who owned a painting before cannot easily check whether it was stolen, whether it was ever doubted, or whether it passed through the hands of someone who might have created it. A prosecutor or a foreign government seeking a looted object cannot easily trace it. A tax authority valuing a collection cannot easily find comparable sales. Much of the modern law described in this book can be read as an effort to pierce that confidentiality in particular circumstances: requiring documentation for tax deductions, imposing due diligence standards on purchasers of antiquities, extending anti-money-laundering rules to art dealers in Europe and the United Kingdom, and giving claimants the tools to find out where a missing painting has gone. The United States Senate's Permanent Subcommittee on Investigations illustrated the point in a report published in July 2020. Its staff traced how businessmen closely associated with the Russian government, and subject to American sanctions after 2014, had allegedly continued to buy expensive art in the United States through shell companies and intermediaries. The auction houses involved had followed their ordinary practices; the problem was that those practices did not require anyone to identify the ultimate buyer. The report called for the art market to be brought within the Bank Secrecy Act, a recommendation that Congress has not adopted for art generally, though, as Chapter 4 explains, it has done so on paper for antiquities. The first principle: nobody can give what they do not have Beneath all the commercial machinery lies a principle of property law old enough to have a Latin name: nemo dat quod non habet, nobody gives what they do not have. A thief acquires no title to what he steals, and so he can pass none to a buyer, however innocent that buyer may be and however much she paid. In American law the principle is codified in section 2-403 of the Uniform Commercial Code, which provides that a purchaser acquires whatever title the transferor had or had power to transfer. If the transferor stole the goods, that is nothing. The UCC softens the rule in two situations, and both matter for art. First, a person who obtained goods by fraud, for instance by paying with a bad cheque, receives what the law calls voidable title, and can pass good title to a good-faith purchaser for value before the original owner rescinds. The distinction between void title (from a thief) and voidable title (from a fraudster) can decide cases. Second, under the entrustment provision of section 2-403(2), when an owner entrusts goods to a merchant who deals in goods of that kind, the merchant has power to transfer all the rights of the entrusting owner to a buyer in the ordinary course of business. A collector who leaves a painting with a dealer "on approval" and finds that the dealer has sold it may therefore lose the painting to the buyer and be left with a claim against the dealer, who may be insolvent or absent. The nemo dat rule makes American law comparatively friendly to original owners. Much of continental Europe takes a different view. In Switzerland, Italy, and many other civil law jurisdictions, a good-faith purchaser of movable property can acquire good title even from a thief, either immediately or after a short period of possession. Swiss law, for example, has historically allowed an owner to reclaim stolen property from a good-faith purchaser only within a limited period, and extended that period for cultural property to thirty years when Switzerland implemented the 1970 UNESCO Convention in 2005. The difference between these systems created an incentive for what one might call title laundering: moving a stolen work to a friendly jurisdiction, selling it there to a good-faith buyer, and then bringing it back with clean title. The English case of Winkworth v. Christie Manson & Woods Ltd, decided in 1980, is the classic illustration. Japanese works of art were stolen from William Winkworth in England, taken to Italy, and sold to an Italian buyer who then sent them back to Christie's in London for sale. The English court held that the question of title was governed by the law of the place where the goods were located at the time of the relevant transfer, the lex situs, which was Italy, and Italian law protected the good-faith buyer. Winkworth lost. The rule that title is determined by the law of the place where the object was when it was transferred remains standard in most jurisdictions and explains why the route an object has travelled can matter as much as its origin. American courts have generally been more receptive to original owners, and some have been willing to apply the law of the forum or of the owner's home state rather than the law of a pass-through jurisdiction. The most prominent recent example, discussed at length in Chapter 7, is the long litigation over a Camille Pissarro painting taken from a Jewish family in 1939 and now held by a Spanish museum, in which the choice between Spanish and Californian law determined the outcome and eventually prompted the California legislature to intervene. Why art is legally awkward Several features of art make it an uncomfortable fit for ordinary commercial law. First, art is unique. Commercial law is built on the idea that goods have a market price and that a buyer who receives defective goods can be compensated by money. A buyer who paid for a Rothko and received a forgery has not bought a slightly defective Rothko; she has bought something else entirely, and the difference in value may be total. At the same time, the original owner of a stolen painting is usually entitled to the painting itself, not merely its value, because no substitute exists. Litigation over art therefore takes the form of replevin (a claim for return of a specific chattel) and declaratory judgment far more often than ordinary commercial disputes do. Second, the value of art depends on intangible facts, principally attribution and provenance, that can change without any change in the object. A painting downgraded from "Rembrandt" to "Studio of Rembrandt" may lose ninety percent of its value overnight because a committee of scholars has changed its mind. The law has had to decide whether such changes are the kind of thing a seller warrants, whether the scholars can be sued, and whether a sale made under a shared mistaken belief can be undone. Third, art is durable and portable. A painting may survive for centuries, pass through dozens of hands, and cross many borders. Claims to it may therefore surface decades after a theft, when witnesses are dead, records are lost, and the current holder has owned it in good faith for a generation. The law's treatment of time, through statutes of limitations, doctrines of laches, and rules on adverse possession, is consequently central to the field and is the subject of Chapter 6. Fourth, art carries meaning beyond its market value. A Benin Bronze or a Native American ceremonial object is not simply a valuable thing that happens to be old; it may be sacred, or central to a community's identity, or evidence of a historical injustice. The law of cultural heritage has developed partly in response to the recognition that market rules designed for commodities do not adequately account for these interests, and that states and communities may have claims to objects that ordinary property law does not recognise. Who regulates the market Regulation of the American art market is fragmented. There is no federal art market regulator. At the state level, New York is by far the most important. Its Arts and Cultural Affairs Law contains provisions on the authenticity of fine art, on the relationship between artists and dealers, and on the sale of multiples such as prints; New York City licenses auctioneers and its Department of Consumer and Worker Protection enforces rules on auction disclosures, including the requirement that the use of reserve prices and guarantees be disclosed. California has its own statutes on fine prints and on artists' rights. At the federal level, the relevant rules are scattered. The Internal Revenue Service regulates valuation for tax purposes, with an Art Advisory Panel of outside experts reviewing appraisals. Customs and Border Protection enforces import restrictions on cultural property. The Department of Justice prosecutes art fraud under the general wire fraud and mail fraud statutes and prosecutes trafficking in stolen art under the National Stolen Property Act. The Office of Foreign Assets Control enforces sanctions against designated persons who may try to use art to move money. The Federal Bureau of Investigation maintains an Art Crime Team and a National Stolen Art File. The Manhattan District Attorney's Office, a local prosecutor, has become one of the most consequential actors in the global antiquities trade through its Antiquities Trafficking Unit, whose work is examined in Chapter 8. Private ordering fills many of the gaps. Trade associations such as the Art Dealers Association of America publish codes of ethics. Museums follow the guidelines of the American Alliance of Museums and the Association of Art Museum Directors on acquisitions and deaccessioning, which for antiquities treat 1970, the year of the UNESCO Convention, as a threshold date for documented provenance. Private databases such as the Art Loss Register, founded in 1990, allow buyers and auction houses to search for works reported stolen, and a clean search result has become a standard feature of due diligence for valuable works. None of these private mechanisms carries the force of law, but courts increasingly treat them as the benchmark against which a buyer's good faith is measured. A purchaser who could have checked a database and did not may find that the law regards her as less innocent than she thought. The rest of this book traces how these legal and quasi-legal regimes interact across the life of a work of art: at the moment its authorship is asserted or questioned, when it is bought and sold and taxed, when it is given away or inherited, and when someone claims that it should never have left its original owner or its place of origin in the first place. Chapter 2: Who Says It's Real? There is no public registry of authentic works of art, no government office that certifies a painting as a genuine Monet, and no legal standard that defines what makes a work "by" an artist. Authenticity is established, if it is established at all, by a combination of three kinds of evidence: the judgment of experts who know the artist's work intimately, the documentary history of the object, and scientific analysis of its materials. When those three kinds of evidence agree, the market treats the question as settled. When they conflict, or when an important expert declines to give an opinion, a work can become unsaleable, and its owner will often turn to the courts. This chapter explains what courts can and cannot do in that situation, and why the people whose opinions matter most have become increasingly reluctant to give them. Three kinds of evidence The oldest form of authentication is connoisseurship: the trained eye of a specialist who has studied an artist's work for years and can recognise the handling of paint, the characteristic mistakes and shortcuts, the way a particular artist drew hands or built up a sky. The great connoisseurs of the late nineteenth and early twentieth centuries, figures such as Bernard Berenson for Italian Renaissance painting, wielded enormous commercial power; a favourable attribution from Berenson could multiply a picture's value many times, and it later emerged that he had a financial arrangement with the dealer Joseph Duveen, whose stock he was attributing. That conflict of interest, hidden for decades, is a reminder that connoisseurship has always been entangled with commerce. The second form of evidence is provenance, the documented history of ownership. A painting that can be traced through exhibition catalogues, dealers' stock books, sale records, letters, and photographs back to the artist's studio has a strong claim to authenticity, not because documents cannot be forged (they can) but because a long and consistent documentary chain is difficult to fabricate. Conversely, a painting that appears from nowhere, with a story about a private collection that cannot be verified, is suspect however convincing it looks. The forgers discussed in Chapter 3 understood this well; several of the most successful forgery schemes of recent decades depended as much on invented provenance as on painted canvas. The third form is scientific analysis. Modern conservation science can date wood panels by dendrochronology, identify pigments by X-ray fluorescence and Raman spectroscopy, reveal underdrawings with infrared reflectography, and detect synthetic materials that did not exist when a work was supposedly made. Titanium white, for example, was not commercially available as an artists' pigment until around 1920; its presence in a painting supposedly made in 1910 is strong evidence of forgery or later intervention. Scientific evidence rarely proves that a painting is authentic, since a skilled forger can use period materials, but it can prove conclusively that a painting is not what it claims to be. Sotheby's acquired the conservation science firm Orion Analytical in 2016, bringing in-house the kind of forensic testing that had helped expose the Knoedler forgeries, a sign of how central science has become to the major auction houses' risk management. A newer tool, still controversial, is computational analysis. Several companies now offer machine-learning assessments that compare the brushwork of a disputed painting with digitised images of accepted works. These tools have attracted publicity, occasionally for attributing to great masters paintings that traditional scholars reject, but no American court has yet treated such an analysis as decisive, and experts remain divided about their reliability. The likely role of such tools, at least for now, is as one more piece of evidence rather than a replacement for the others. Catalogues raisonnés and artist foundations For many artists, one source of opinion matters more than any other: the catalogue raisonné, a scholarly publication that aims to list every known authentic work by the artist, with its provenance, exhibition history, and bibliography. Inclusion in the catalogue raisonné is, for practical purposes, a precondition of selling an important work at a major auction house; exclusion can render a painting unsaleable at anything like the price of an accepted work. The authors of catalogues raisonnés are sometimes independent scholars and sometimes the foundations established by artists or their estates to manage their legacies. In the late twentieth century, several of these foundations went further and established formal authentication boards that would examine works submitted by owners and issue opinions on authenticity. The Andy Warhol Art Authentication Board, the Pollock-Krasner Authentication Board, the Authentication Committee of the Estate of Jean-Michel Basquiat, and similar bodies for Keith Haring and Roy Lichtenstein became gatekeepers of enormously valuable markets. Their opinions were, in practice, binding on the market, and owners who received an unfavourable decision were understandably aggrieved. That grievance produced litigation, and litigation produced retreat. The most significant case was brought by Joe Simon-Whelan, a film producer who owned a silkscreen self-portrait that the Warhol board twice stamped "denied." In 2007 he sued the Andy Warhol Foundation and its authentication board in federal court in New York, alleging that they had conspired to restrain trade in Warhol works in violation of the antitrust laws, by denying the authenticity of works in order to keep the market scarce and protect the value of the foundation's own holdings. In 2009 the district court denied the foundation's motion to dismiss the antitrust claims, allowing the case to proceed. The foundation spent, by its own account, millions of dollars defending the case, and in 2010 Simon-Whelan dropped the suit, citing the cost of continuing. The foundation had not lost, but the lesson was not lost on anyone. In 2011 it announced that its authentication board would be dissolved, and it ceased authenticating in 2012. The Basquiat estate's authentication committee dissolved the same year, as did the Keith Haring Foundation's. The Roy Lichtenstein Foundation announced in 2017 that it would no longer issue opinions on authenticity, while continuing to prepare its catalogue raisonné. The withdrawal of the foundations left a vacuum. Owners of works by these artists can still seek inclusion in a catalogue raisonné where one is being prepared, and some foundations will note in their records whether a work has been reviewed, but there is often no single authoritative voice. The result is a market in which some works are effectively unsaleable at the top level because no one with authority will vouch for them, and in which opportunists sometimes step in with opinions of doubtful value. What courts will and will not decide When an owner cannot obtain a favourable opinion from the relevant experts, one obvious course is to ask a court to declare the work authentic. American courts have been notably reluctant to do so, and the leading reason is practical rather than doctrinal: a judgment that a painting is authentic does not bind the market. The clearest statement of this position is the decision of New York's Appellate Division in Thome v. Alexander & Louisa Calder Foundation, decided in 2009. The plaintiffs owned a sculpture they believed to be by Alexander Calder. The Calder Foundation, which was preparing the catalogue raisonné, had declined to include it, and the plaintiffs sought a declaratory judgment that the work was authentic and an order requiring the foundation to include it. The court dismissed the claim. It reasoned that the foundation had no legal obligation to render an opinion or to include any work in its catalogue, that a court declaration of authenticity would not change the foundation's view or the market's, and that declaratory judgment was therefore of no practical use. A judicial decree, as the court recognised, cannot make buyers trust a painting that the recognised experts do not accept. A related line of cases addresses the owner who is harmed by a negative opinion and sues the expert who gave it. The foundational case is Hahn v. Duveen, decided by a New York trial court in 1929. Andrée Hahn owned a version of Leonardo's La Belle Ferronnière, which she was attempting to sell to the Kansas City Art Institute. Joseph Duveen, the most powerful dealer of his day, told a newspaper reporter, without having seen the painting, that it was a copy and that the original was in the Louvre. The sale collapsed. Hahn sued Duveen for slander of title, the tort of making false and malicious statements that disparage another's property. After a trial that ended in a hung jury, Duveen settled for $60,000, a large sum at the time. The case established that an expert who disparages a work of art can be held liable if the statement is false and made with the requisite state of mind, and it has shadowed the profession ever since. Later decisions have made it harder for owners to win such claims. In Kirby v. Wildenstein, decided by the federal district court in Manhattan in 1992, the owner of a painting attributed to the French painter Jean Béraud sued Daniel Wildenstein, the scholar and dealer whose foundation was preparing the catalogue raisonné of the artist's work, claiming that Wildenstein's disparaging remarks about the painting's condition and authenticity had prevented its sale at auction. The court granted summary judgment to Wildenstein. Product disparagement, it explained, requires proof of special damages, meaning specific, identifiable lost sales caused by the statement, and the owner could show neither that the remarks had circulated beyond a narrow circle nor that his losses flowed from them rather than from the painting's actual condition. The demanding elements of the tort, in other words, operate as a substantial shield for experts. In Lariviere v. Thaw, decided by a New York trial court in 2000, an owner whose painting had been rejected by the Pollock-Krasner Authentication Board sued the board's members; the court dismissed the claims, relying in part on the fact that the owner had signed an agreement, of the kind the boards routinely required, releasing the board from liability and agreeing not to sue over its opinion. The upshot is a legal environment in which experts are rarely held liable if they act honestly and follow careful procedures, but in which the cost of defending even a meritless suit can be high enough to deter them from speaking at all. Experts responded by insisting on indemnities and releases before examining works, by refusing to give written opinions, and in many cases by declining to authenticate altogether. Legislative proposals in New York to give authenticators statutory protection against suits by owners, introduced in the state legislature in the 2010s, did not become law. Standards of proof when courts must decide Courts cannot always avoid deciding questions of authenticity. They must do so when a buyer sues a seller for breach of warranty, when an insurer disputes a claim, when an estate and the Internal Revenue Service disagree about value, or when a criminal defendant is charged with selling fakes. In those settings, authenticity is treated like any other disputed question of fact. In civil cases the party asserting that a work is or is not genuine ordinarily bears the burden of proving it by a preponderance of the evidence, although a claim of fraud generally requires clear and convincing evidence of the defendant's knowledge and intent. In criminal cases the prosecution must prove beyond reasonable doubt not only that the works were fake but that the defendant knew it. Evidence of authenticity is presented through expert witnesses, and federal courts apply the standard of Federal Rule of Evidence 702, as interpreted in Daubert v. Merrell Dow Pharmaceuticals, Inc., decided by the Supreme Court in 1993, to determine whether expert testimony is sufficiently reliable to be heard. Rule 702 was amended in December 2023 to make explicit that the party offering expert testimony must show the court that it is more likely than not that the testimony meets the rule's reliability requirements. Scientific testimony about pigments and dendrochronology fits comfortably within this framework. Connoisseurship is harder to fit, because the judgment of an experienced eye cannot easily be reduced to a testable method with a known error rate. Courts have generally admitted connoisseurship evidence where the witness has recognised expertise, treating the weight to be given to it as a question for the jury or the judge as fact-finder. In practice, when scientific and connoisseurial evidence conflict, courts tend to find the science more persuasive, especially where it demonstrates an anachronism. What emerges from these cases is a distinctive division of labour. The market decides attribution, relying on the experts it trusts. The courts decide liability: whether someone who asserted or denied authenticity did so falsely, carelessly, or in breach of a promise. The two occasionally converge, as when a court's findings in a fraud case settle a work's status beyond any argument, but the law has deliberately declined to become the art world's arbiter of attribution. For a buyer, the implication is plain. The protection that matters is not the prospect of a future court ruling that a work is genuine; it is a clear contractual promise, from a solvent seller, about what exactly the buyer is getting. The next chapter examines how good those promises actually are. Chapter 3: When the Masterpiece Is a Fake Every experienced dealer and auction specialist has a story about a painting that turned out not to be what everyone thought. Some are honest mistakes, the consequence of a scholarly consensus that shifted. Some are forgeries made decades ago by someone long dead and sold in good faith ever since. And a small number are the product of deliberate, organised fraud, in which forgers, dealers, and sometimes experts collaborate to move fakes into the market at high prices. The law responds differently to each. This chapter examines what a buyer can do on discovering that an expensive work is not genuine, and what the criminal law does to those who make and sell fakes. The answers are less comforting than most buyers assume. The buyer's contractual rights The first place to look when a work turns out to be fake is the contract under which it was bought. For sales by dealers, the governing law is Article 2 of the Uniform Commercial Code. Under section 2-313, any affirmation of fact made by the seller that becomes part of the basis of the bargain creates an express warranty that the goods will conform to it. A dealer's invoice describing a painting as "Claude Monet, Water Lilies, 1906" is an affirmation of fact about authorship, and if the painting is not by Monet the warranty is breached. The buyer is entitled to damages measured by the difference between the value of the painting as warranted and its actual value, which for a forgery is often close to the full price. New York, where a large share of the American art trade takes place, reinforces this rule for sales by art merchants to non-merchant buyers. Section 13.01 of the New York Arts and Cultural Affairs Law provides that when an art merchant furnishes a written instrument, such as an invoice or certificate, identifying the author of a work, the statement is treated as part of the basis of the bargain and creates an express warranty of authenticity. The statute limits the merchant's ability to escape that warranty through boilerplate disclaimers, while recognising that a merchant may state that an attribution is an opinion or is made with reservations, provided the qualification is clear and specific. A buyer who purchases from a New York dealer with a written statement of authorship therefore has a relatively strong warranty claim, at least on paper. The weakness of the warranty claim is time. Under section 2-725 of the UCC, an action for breach of a sales contract must be brought within four years after the cause of action accrues, and a breach of warranty accrues when tender of delivery is made, whether or not the buyer knows of the breach. There is an exception where the warranty explicitly extends to future performance, but courts have generally held that a warranty of authorship describes the goods as they are at the moment of sale, not their future performance. The leading case is Rosen v. Spanierman, decided by the United States Court of Appeals for the Second Circuit in 1990. The Rosens bought a portrait attributed to John Singer Sargent from a New York dealer in the 1960s and learned more than fifteen years later, when they tried to sell it, that it was not by Sargent. The court held that their warranty claim was barred, because the four-year period had run from delivery. Since doubts about attribution often surface only when a work is resold, many years after purchase, the four-year rule defeats a large proportion of warranty claims before they are brought. Auction house guarantees Buyers at auction face a different contractual landscape. The conditions of sale at the major houses disclaim almost all implied warranties and replace them with a limited, express guarantee of authenticity. Although the details vary by house and change over time, the typical guarantee has several features. It runs for a fixed period, usually five years from the date of sale. It applies only to the part of the catalogue description printed in capitals or bold type, usually the name of the artist, and not to statements about date, provenance, condition, or literature. It is given only to the original buyer, not to a later owner. The remedy is refund of the purchase price, typically including the buyer's premium, in exchange for return of the work in the same condition; consequential losses, such as the profit the buyer expected on resale, are excluded. The guarantee also contains exclusions that matter a great deal in disputed cases. It usually does not apply where the catalogue description was in accordance with the generally accepted opinion of scholars and experts at the date of sale, or where the only way of establishing that the work was not authentic was by means of a scientific process that was not generally accepted, was unreasonably expensive, or was likely to damage the work at the date of publication of the catalogue. The effect is to allocate to the buyer the risk that scholarly opinion changes after the sale, while leaving with the auction house the risk that it simply got the attribution wrong by the standards of its own time. Qualifying terms in the catalogue are critical. A heading that reads "Rembrandt Harmensz. van Rijn" is a statement that the work is by Rembrandt. A heading of "Attributed to Rembrandt" signals, under the glossary printed in the catalogue, that the work is in the house's opinion probably by the artist but less certainly so. "Studio of," "Circle of," "Follower of," and "Manner of" each progressively distance the work from the named master, and the guarantee extends only to the qualified statement actually made. Buyers who do not read the glossary may believe they have bought far more than the house has promised. In practice, the major houses sometimes go beyond their contractual obligations when a serious problem emerges, both to protect their reputations and because the alternative is litigation. In 2016 Sotheby's refunded the purchase price of a portrait attributed to Frans Hals, which it had sold privately in 2011 for more than $10 million, after its scientific analysis found modern materials in the painting. The work was one of several Old Master paintings linked to the French collector Giuliano Ruffini that were questioned or seized around the same time; French authorities had earlier seized a painting attributed to Lucas Cranach from an exhibition in Aix-en-Provence. Sotheby's then pursued the dealers from whom the painting had come to recover what it had paid out. Fraud, negligence, and mistake When the warranty is time-barred or unavailable, buyers turn to other theories. The principal alternatives, and their characteristic obstacles, are compared in Table 1. Table 1. Principal claims available to the buyer of a fake, under New York law. Claim Usual defendant What the buyer must prove Limitations period Main obstacle Breach of express warranty (UCC 2-313; ACAL 13.01) Dealer or other seller Statement of authorship was part of the bargain and is false Four years from delivery Clock runs before the fake is discovered Auction house authenticity guarantee Auction house Bold-type heading was wrong, outside stated exclusions Contractual, usually five years from sale Exclusions for scholarly consensus and later science Fraud Seller, agent, or expert Knowing false statement, reasonable reliance, loss Six years, or two years from discovery if later Proving the defendant knew Negligent misrepresentation Adviser or expert in a special relationship Careless false statement where a duty of care existed Varies; generally shorter than fraud Establishing a duty beyond an arm's-length sale Rescission for mutual mistake Seller Both parties shared a mistaken basic assumption Six years Contract terms that allocate the risk to the buyer Fraud is the most powerful of these claims because it carries a longer limitations period in New York, the greater of six years from the fraud or two years from when it was or should have been discovered, and because it can reach anyone who participated in the deception, not merely the party to the contract. Its burden is correspondingly higher. The buyer must prove that the defendant knew the representation was false, or made it with reckless indifference to its truth, and courts ordinarily require clear and convincing evidence. Dealers who sold forgeries in good faith are not liable in fraud, however much they profited. Rescission for mutual mistake offers a different route. Where both buyer and seller shared a mistaken assumption about a basic fact on which the contract was made, a court may unwind the transaction. Every law student learns the nineteenth-century cases that frame the doctrine: Sherwood v. Walker, in which the Michigan Supreme Court in 1887 allowed a seller to rescind the sale of a cow both parties believed to be barren when she was in fact with calf, and Wood v. Boynton, in which the Wisconsin Supreme Court in 1885 refused to rescind the sale of a stone both parties thought might be a topaz and which turned out to be an uncut diamond. The difference, roughly, is between a mistake about what the thing is and a shared uncertainty about its value that both parties accepted. Applied to art, the doctrine gives rescission more readily where both parties unequivocally believed a work to be by a particular artist than where both knew the attribution was uncertain and priced the risk. Contractual clauses that make a sale "as is" or allocate attribution risk to the buyer will usually defeat the claim. The anatomy of a forgery scheme: Knoedler The largest American forgery scandal of recent decades shows how these legal theories operate against a real fraud, and how limited their reach can be. For roughly fifteen years, from the mid-1990s until 2008, a Long Island dealer named Glafira Rosales supplied M. Knoedler & Co., then one of the oldest galleries in New York, with some forty paintings attributed to Abstract Expressionist masters including Mark Rothko, Jackson Pollock, Robert Motherwell, and Willem de Kooning. The paintings were said to come from an anonymous collector who had acquired them directly from the artists and wished to remain unknown. None had any documented history. All had been painted by Pei-Shen Qian, a Chinese-born artist living in Queens, who was paid a few thousand dollars for each. Knoedler and an associated dealer sold the works for a total of roughly $80 million. The scheme unravelled in 2009 and 2011 when scientific analysis of several of the paintings found anachronistic materials and a signature misspelled in a way the artist would not have spelled it. Knoedler closed abruptly in November 2011. Rosales was charged in federal court in Manhattan and in 2013 pleaded guilty to wire fraud, money laundering, and tax offences. In early 2017 she was sentenced to time already served, having cooperated with prosecutors, and ordered to pay restitution. Qian was indicted but had returned to China, beyond the reach of American process, and Rosales's former partner, alleged to have recruited the painter, likewise remained outside the United States. The civil litigation was extensive. Buyers sued Knoedler, its parent company, its former president Ann Freedman, and others, principally on theories of fraud and conspiracy, arguing that the gallery had ignored obvious red flags: works with no provenance, an implausible story, prices well below market, and at least one warning from an expert. The most prominent case, brought by Domenico De Sole, chairman of Sotheby's board at the time of trial, and his wife, who had paid $8.3 million for a supposed Rothko in 2004, went to trial in federal court in Manhattan in early 2016 and settled after two weeks of testimony. Other buyers settled before or after. Because the settlements were confidential and no verdict was reached, the case produced no authoritative judicial statement of the duty a dealer owes to investigate the provenance of what it sells. It nonetheless shifted market practice decisively: a work without documented history, offered through a story that cannot be tested, is now treated by responsible dealers as presumptively unsaleable. Forgery as a crime Forgery of art is, somewhat surprisingly, rarely prosecuted as forgery. The general forgery statutes in most American jurisdictions are directed at written instruments, such as documents, cheques, and signatures, and courts have questioned whether a painting is a "written instrument." New York has a specific offence of criminal simulation, which covers making or altering an object so that it appears to have an antiquity, rarity, source, or authorship it does not have, with intent to defraud; but it is a misdemeanour. Serious cases are therefore prosecuted as fraud, principally under the federal wire fraud and mail fraud statutes, together with money laundering and tax charges where the proceeds were concealed. The prosecution must prove that the defendant knowingly participated in a scheme to obtain money by false representations. Making a copy of a Rothko is not a crime; selling it as a Rothko is. This structure explains why the person who paints a forgery is sometimes treated more leniently than the person who sells it, and why innocent intermediaries are not criminally liable at all. It also explains the emphasis prosecutors place on provenance documents. A forger who fabricates a label from a gallery that never existed or a letter from a collector who never lived has created exactly the kind of false representation that fraud statutes reach. European prosecutions show the same pattern. Wolfgang Beltracchi, who for years painted pictures in the manner of early twentieth-century German and French artists and sold them, with elaborately forged provenances, as lost works, was convicted of fraud by a court in Cologne in 2011 and sentenced to six years in prison. His scheme had included fake labels from a real but defunct collection and staged photographs of his wife posing as her own grandmother among the supposed paintings. The historical archetype, Han van Meegeren, was prosecuted in the Netherlands after the Second World War not for forgery but for collaboration, having sold a supposed Vermeer to Hermann Göring; he escaped the treason charge by demonstrating that he had painted it himself, and was convicted in 1947 of forgery and fraud. More recent American cases underline how the market's appetite for discovery can outrun its caution. In June 2022 the Federal Bureau of Investigation seized twenty-five paintings attributed to Jean-Michel Basquiat from an exhibition at the Orlando Museum of Art. The works had been presented as having been sold by the artist in 1982 to a television screenwriter and stored in a unit for decades; one was painted on cardboard from a shipping box whose typeface had not existed until years after Basquiat's death. The museum's board dismissed its director. A Los Angeles auctioneer, Michael Barzman, pleaded guilty in 2023 to making false statements to federal agents and admitted that he and an associate had created the paintings; he was sentenced to probation. The museum's civil suit against its former director was dropped in early 2025, after his death. Fraud in the art market does not always involve fake objects. Inigo Philbrick, a young dealer of contemporary art, sold the same paintings, or shares in them, to multiple investors and lenders, sometimes selling more than one hundred percent of a single work, and used forged documents to support the transactions. He pleaded guilty to wire fraud in federal court in Manhattan and was sentenced in 2022 to seven years in prison. His case illustrates that the same opacity that allows fakes to circulate also allows genuine works to be used as the collateral for deception. The Salvator Mundi litigation The most expensive art dispute of the past decade concerned not forgery but price. Between 2003 and 2014 the Russian billionaire Dmitry Rybolovlev bought thirty-eight works, including the Salvator Mundi, through a Swiss art dealer, Yves Bouvier, paying roughly $2 billion in total. Rybolovlev believed Bouvier was acting as his agent for a modest fee; Bouvier maintained he was an independent dealer entitled to buy low and sell high. In several cases, including the Leonardo, which Bouvier bought through a private sale arranged by Sotheby's for around $80 million and sold to Rybolovlev for about $127.5 million, the markups were enormous. Rybolovlev pursued Bouvier in Monaco, Switzerland, Singapore, and elsewhere; those disputes were resolved in late 2023. He also sued Sotheby's in federal court in New York, alleging that the auction house had aided and abetted Bouvier's fraud by providing valuations and documentation that helped conceal the markups. In January 2024 a jury found Sotheby's not liable. The verdict is often read as a vindication of the auction houses, but its more durable lesson concerns the characterisation of relationships. Whether a person handling a transaction for a collector is an agent owing fiduciary duties, or a principal free to profit from the spread, determines what the collector can recover. Art market relationships are frequently undocumented or loosely documented, and the question of who is acting for whom can be decisive. The same point runs through the Knoedler cases, the Philbrick prosecution, and many smaller disputes. The law protects buyers who have secured clear promises from identifiable counterparties, and it protects them imperfectly even then. It offers much less to buyers who have relied on reputation, custom, and the assumption that everyone in the room shares their interests. Chapter 4: The Auction Room and the Tax Code When a painting sells for $50 million at an evening sale in New York, the headline number is only the beginning of its financial story. The buyer will pay a premium on top of the hammer price and, unless an exemption applies, sales tax on the total. The seller will pay a commission, perhaps receive a share of a guarantee arrangement, and eventually owe federal and state income tax on the gain, at rates that differ materially from those that would apply to a sale of shares. The auction house must decide whether the buyer is who he says he is and whether his money comes from a sanctioned source. Each of these obligations is imposed by a different body of law, and each has become the subject of serious enforcement in recent years. This chapter explains the tax treatment of buying and selling art during the owner's lifetime and the growing reach of anti-money-laundering and sanctions law into the trade. Gifts and estates, which raise distinct questions, are the subject of Chapter 5. Who is selling matters The federal income tax treatment of art depends first on who holds it and why. The Internal Revenue Code draws a sharp line between property held as an investment or for personal enjoyment and property held for sale in the ordinary course of a trade or business. It also treats artists' own works as a special category. As Table 2 summarises, these classifications determine the rate of tax on a sale, whether losses and expenses can be deducted, and how generous the deduction is when the work is given to charity. Table 2. Federal income tax treatment of art by type of holder. Holder Character of gain on sale Top federal rate on long-term gain Losses and holding expenses Charitable gift deduction Collector (personal enjoyment) Capital gain; "collectible" 28%, plus 3.8% net investment income tax Losses on sale generally not deductible Fair market value if held over a year and put to related use; otherwise cost basis Investor (held for profit) Capital gain; "collectible" 28%, plus 3.8% net investment income tax Capital losses deductible within normal limits Same as collector Dealer Ordinary income from inventory 37% Deductible as business losses and expenses Generally limited to cost basis Artist (own work) Ordinary income 37% Deductible if art is a trade or business Limited to cost of materials Most private owners of art are collectors in the tax sense. Their works are capital assets, so gain on a sale of a work held for more than a year is long-term capital gain. But art falls within the Code's definition of a "collectible," alongside antiques, gems, stamps, coins, and certain other tangible items, and long-term gain on collectibles is taxed at a maximum federal rate of 28 percent rather than the 20 percent that applies to most long-term capital gains on stocks and real estate. High-income sellers also owe the 3.8 percent net investment income tax, for a combined federal rate of up to 31.8 percent. State taxes are added on top; a California resident may pay more than 13 percent to the state as well. The difference between the collectibles rate and the ordinary capital gains rate is one reason wealthy owners devote so much attention to the alternatives to selling, discussed in the next chapter: holding until death, when the basis of inherited property is stepped up to its value at the date of death and the built-in gain disappears for income tax purposes, or giving the work to a museum. The distinction between a collector and an investor matters principally for losses. A collector who buys a painting for $2 million and sells it for $1.5 million has a personal loss that the Code does not allow him to deduct, just as a homeowner cannot deduct a loss on the sale of a personal residence. An investor who holds art primarily for profit can deduct capital losses, subject to the ordinary limits. The Internal Revenue Service and the courts look at the facts: whether the owner displays the works at home, keeps them in storage, maintains records of market value, consults advisers about investment strategy, and trades regularly. Owners who hang their pictures on their walls and enjoy them will generally struggle to persuade a court that they are investors, and the tax court has repeatedly rejected claims of investor or dealer status by collectors seeking to deduct losses or expenses. Dealers are in the reverse position. Their inventory produces ordinary income, taxed at rates up to 37 percent, but their expenses and losses are deductible as business items. Artists' own works are excluded from the definition of a capital asset altogether, so an artist who sells her own painting receives ordinary income; and, as Chapter 5 explains, when she gives it to a museum her deduction is limited to the cost of her materials, a rule that has long been criticised for discouraging artists from donating their work. The basis of a work of art, the figure from which gain or loss is measured, is its cost: the hammer price plus the buyer's premium and, ordinarily, sales tax and other acquisition costs. Many older collections present a practical problem here, because the records of what was paid decades ago have been lost. An owner who cannot prove basis may find that the Service treats it as zero. The end of the art-for-art swap Until the end of 2017, owners could defer gain on the sale of a work of art by reinvesting the proceeds in another work under section 1031 of the Code, which allowed tax-free exchanges of "like-kind" property held for investment. The practice was widespread among investors and dealers, who argued, with some support in private guidance from the Service, that a painting was like-kind to another painting, and some to a sculpture. The Tax Cuts and Jobs Act of 2017 limited section 1031 to exchanges of real property for exchanges completed after December 31, 2017. Art sellers can no longer defer gain by trading into new works, and the change has strengthened the tax advantages of holding until death or giving to charity. Sales tax: the quiet enforcement priority For buyers, the most immediate tax consequence of a purchase is sales tax. New York imposes a state sales tax of 4 percent, and New York City's combined rate, including state and local components, is 8.875 percent. On a $50 million purchase, that is more than $4.4 million. Sales tax applies to the full price paid, including the buyer's premium, and is collected by the auction house or dealer. Several exemptions are available, and each has become a target of enforcement. The first applies when the work is shipped by the seller, by common carrier, to a destination outside the state; the sale is then treated as taking place at the destination, and New York does not tax it. The buyer may, however, owe use tax to the state where the work ends up, which in practice has often gone unpaid. The second is the resale exemption: a dealer who buys for resale can present a resale certificate and avoid paying tax, with tax collected instead when the work is eventually sold to a final consumer. Abuse of these exemptions has produced some of the most visible enforcement actions in the art market. In 2002 Dennis Kozlowski, then chief executive of Tyco International, was indicted in Manhattan on charges of evading New York sales tax on paintings worth some $13 million, including works by Monet and Renoir, by arranging for empty crates to be shipped to New Hampshire while the paintings stayed in his Fifth Avenue apartment. The case became notorious and led New York to intensify its scrutiny of art sales. In November 2024 Sotheby's agreed to pay $6.25 million to settle a lawsuit brought by the New York Attorney General under the state's False Claims Act, which alleged that between 2010 and 2020 the auction house had accepted resale certificates from clients it knew were buying for their personal collections, and in at least one case had suggested that a client use them. According to the Attorney General, one collector had bought some $27 million of art in this way; the collector's company had separately paid more than $10 million to resolve its own liability in 2018. The choice of statute is itself a warning. New York's False Claims Act, unusually among such laws, extends to tax matters, allows the state to recover multiples of the tax lost, and rewards insiders who report fraud; the real estate investor and collector Aby Rosen had already paid a substantial settlement in 2016 over the misuse of resale certificates on art purchases. Buyers seeking to avoid sales tax altogether have also made use of freeports: secure, bonded warehouses located in customs zones, most famously in Geneva, Luxembourg, and Singapore, where goods can be stored and traded without triggering import duties or sales taxes as long as they remain in the zone. A work bought at auction and shipped directly to a freeport may change hands several times without ever being imported anywhere. Freeports became objects of intense scrutiny after the Bouvier affair described in Chapter 3, since Bouvier had been a principal of freeport operations, and after investigations showed that looted antiquities and works claimed by Holocaust heirs had been stored there for years. The European Parliament recommended in 2019 that the European Union phase out freeports, and Switzerland has tightened its inventory and reporting requirements. The United States has no close equivalent, although foreign-trade zones and specialist storage facilities in states without sales tax, notably Delaware, have served some of the same functions. Money laundering and sanctions A painting is, in principle, an ideal vehicle for moving value. It is compact, portable, valued subjectively, and traded in private transactions whose prices need not be disclosed. The extent to which art is actually used for money laundering is debated. In February 2022 the Treasury Department published a study, required by Congress, of money laundering and terrorist financing risks in the high-value art market. It found evidence of some risk but concluded that there was no immediate need to subject the art market to the full Bank Secrecy Act regime, recommending instead attention to particular risks such as the use of shell companies and intermediaries. The report on sanctions evasion by the Senate Permanent Subcommittee on Investigations, described in Chapter 1, presented a more alarming picture. Europe has gone further. The European Union's Fifth Anti-Money Laundering Directive, adopted in 2018, extended customer due diligence and reporting obligations to "art market participants," including dealers, auction houses, and freeport operators, for transactions of €10,000 or more. The United Kingdom implemented a parallel regime in January 2020, requiring art market participants to register with HM Revenue and Customs, identify their customers and the ultimate beneficial owners of purchasing entities, and report suspicious transactions. The EU's new single rulebook on money laundering, adopted in 2024, continues and expands these obligations. For any European sale above the threshold, a buyer hiding behind an anonymous company is no longer acceptable. The United States has taken a narrower path. The Anti-Money Laundering Act of 2020, enacted as part of the annual defence authorisation law at the start of 2021, added persons "engaged in the trade of antiquities" to the Bank Secrecy Act's definition of financial institutions, directing the Treasury's Financial Crimes Enforcement Network to issue implementing rules. FinCEN published an advance notice of proposed rulemaking in September 2021. It never issued a final rule, and the advance notice was later withdrawn; as of mid-2026 members of Congress were still urging the Treasury to complete the rulemaking that the statute requires. The art market outside antiquities remains outside the Bank Secrecy Act, though dealers must file reports of cash payments over $10,000, as any business must. Sanctions law is a different matter, and here American enforcement is sharp. Under sanctions administered by the Treasury's Office of Foreign Assets Control, United States persons may not deal in property in which a blocked person has an interest. An auction house that sells a painting belonging to a sanctioned oligarch, or accepts payment from one through an intermediary, faces civil penalties on a strict liability basis and criminal exposure if it acts wilfully. In October 2020 OFAC issued an advisory warning of the sanctions risks posed by transactions in high-value artwork, emphasising that the use of intermediaries and shell companies does not relieve market participants of liability and urging dealers and auction houses to adopt risk-based compliance programmes. After the full-scale Russian invasion of Ukraine in 2022, auction houses tightened their procedures for identifying the ultimate owners of consigned works and the ultimate source of funds for purchases, and many now demand documentation that would have been unthinkable a decade earlier. The auction house as gatekeeper The combined effect of sales tax enforcement, European anti-money-laundering rules, and American sanctions has been to transform the major auction houses into something closer to regulated financial institutions than they used to be. They now conduct know-your-customer checks, inquire into the source of funds, verify that consignors have title and that works are not subject to claims, and retain records that may be subpoenaed. None of this is mandated for most American art transactions by a single statute; it is the product of legal risk arriving from many directions at once. The auction house that accepts a resale certificate without scrutiny, ships an empty crate, or takes money from an oligarch's cousin exposes itself to liability under laws that were not written with art in mind but apply to it nonetheless. For buyers and sellers, the consequence is a loss of the anonymity that once defined the top of the market. It is still possible to buy through an agent without the seller learning your name, but it is increasingly difficult to buy without the auction house learning it, and the house's records are available to regulators and prosecutors. The same documentary discipline that tax and sanctions authorities demand at the point of sale has become, as later chapters show, the essential defence against claims that a work was stolen, looted, or illegally exported. The paper trail that satisfies the compliance department is the same paper trail that establishes good title. Chapter 5: Giving, Lending, and Dying Most great collections are not sold by the people who assembled them. They are given away, bequeathed, or left to heirs who must pay estate tax on them. The American tax system shapes these outcomes profoundly. It rewards gifts of art to museums with deductions that can exceed what the donor paid, it taxes art held at death at the same rate as any other asset, and it hands the question of value, on which everything depends, to a contest of appraisers. That contest is where the law of art and the law of tax meet most directly, and where the documentary discipline discussed throughout this book pays its largest dividends. The charitable deduction and the related-use rule A taxpayer who gives property to a qualifying charity may generally deduct its fair market value. For appreciated property the advantage is substantial: a collector who bought a painting for $1 million that is now worth $10 million, and who gives it to a museum, may deduct $10 million without ever paying tax on the $9 million of gain. Compared with selling the work, paying tax at the collectibles rate, and donating the after-tax proceeds, the gift is far more efficient. This feature of the tax code has built American museum collections to a degree that has no parallel in countries that rely on direct state funding of museums. Congress has attached conditions to this generosity, and the most important for art is the related-use rule in section 170(e) of the Internal Revenue Code. A gift of tangible personal property such as a painting qualifies for a fair market value deduction only if the charity's use of the property is related to its exempt purpose. A painting given to an art museum for display or study satisfies the rule. The same painting given to a hospital or a university that intends to sell it and use the proceeds for its programmes does not; in that case the deduction is limited to the donor's cost basis, which for a work bought long ago may be a small fraction of its value. Donors typically obtain a written statement from the recipient describing its intended use, and since 2006 the Code has provided for recapture of the excess deduction if the charity sells the work within three years of the gift, unless it certifies that it actually put the work to a related use or that such use became impossible. Two further conditions shape the planning. The work must have been held for more than one year; otherwise it is treated as ordinary income property and the deduction is limited to basis. And the size of the deduction in any year is capped by reference to the donor's income: for gifts of appreciated capital gain property to public charities such as museums, generally at 30 percent of adjusted gross income, with any excess carried forward for up to five years. Gifts to private foundations that are not operating foundations are less favoured and are generally limited to basis. Artists face a separate and much criticised rule. Because an artist's own works are not capital assets in her hands, a gift of her own painting to a museum yields a deduction limited to her basis, which is essentially the cost of canvas and paint. An artist who gives a museum a painting that could sell for $500,000 may deduct a few hundred dollars, while a collector who bought the same painting from her may deduct the full $500,000. Bills to allow artists a fair market value deduction for gifts of their own work have been introduced in Congress repeatedly over several decades without being enacted. Estates are treated differently: when an artist dies, works passing from her estate to a museum qualify for the estate tax charitable deduction at full value. Congress made further changes in the budget reconciliation law enacted in July 2025, commonly called the One Big Beautiful Bill Act, that affect large gifts of art from 2026 onwards. For taxpayers who itemise, charitable contributions are now deductible only to the extent they exceed 0.5 percent of adjusted gross income, and the value of itemised deductions for taxpayers in the top 37 percent bracket is effectively capped at 35 cents on the dollar. Neither change removes the fundamental advantage of giving appreciated art, but for very large donors the second reduces the benefit at the margin, and advisers have responded by reconsidering the timing of gifts. Fractional gifts For decades collectors used a technique that allowed them to take large deductions while keeping their pictures at home. A donor would give a museum an undivided fractional interest in a painting, say 10 percent, and take a deduction for 10 percent of its value; the museum would be entitled to possess the painting for 10 percent of each year, a right it often did not exercise. Over the years the donor would give further fractions, each deducted at the then-current value, which in a rising market meant larger and larger deductions for the same percentage, until eventually the whole work passed to the museum, often at the donor's death. The Pension Protection Act of 2006 curtailed the practice substantially. Under section 170(o) of the Code, subsequent fractional gifts of the same work are valued at the lesser of the value at the time of the first gift and the value at the time of the later gift, eliminating the benefit of appreciation. The donor must complete the gift of the entire work within ten years or before death, whichever comes first, and the museum must take substantial physical possession during the period; if these conditions are not met, the deductions are recaptured with interest and an additional 10 percent penalty. Fractional gifts remain possible, but they are now a planning tool of modest value rather than a significant tax advantage, and museum curators who once relied on them to secure promised collections have had to find other inducements. Proving value: appraisals and the Art Advisory Panel Every deduction for a gift of art, and every estate tax return that includes art, turns on a single number: fair market value, defined in the Treasury regulations as the price at which the property would change hands between a willing buyer and a willing seller, neither being under any compulsion and both having reasonable knowledge of the relevant facts. For estate tax purposes the regulations add that tangible personal property is to be valued in the market in which such items are most commonly sold to the public, which for important works of art usually means the auction or retail dealer market. Because the incentives are obvious, with donors wanting high values and estates wanting low ones, the Code imposes procedural safeguards. A donor claiming a deduction of more than $5,000 for a gift of property must obtain a qualified appraisal from a qualified appraiser, and file a summary with the return; for art worth $20,000 or more, the full appraisal must be attached. The appraiser must have recognised credentials and experience, may not be the donor, the donee, or a party to the transaction, and is subject to penalties if the appraisal produces a substantial valuation misstatement. Taxpayers who overstate value face accuracy-related penalties of 20 percent of the resulting underpayment, rising to 40 percent for gross misstatements, where the claimed value is 200 percent or more of the correct figure. Valuations of significant works are reviewed by the Commissioner's Art Advisory Panel, a body of outside experts, including museum directors, curators, scholars, and dealers, established in 1968. The panel meets privately and reviews appraisals submitted with returns for works claimed at $50,000 or more. Its recommendations are advisory, but the Service's art appraisal staff generally adopt them, and the panel's annual reports, which publish aggregate statistics, show that it regularly recommends substantial adjustments, increasing values on estate and gift tax returns and reducing them on charitable deduction claims. A taxpayer who wishes to avoid uncertainty may request a Statement of Value from the Service before filing, for works of art appraised at $50,000 or more, in exchange for a user fee; the statement is then used as the value for the return. The Tax Court's decision in Estate of Kollsman v. Commissioner, issued in 2017 and affirmed by the Ninth Circuit in 2019, shows how appraisal disputes are decided. The estate held two Old Master paintings attributed to members of the Brueghel family, which it valued at $500,000 and $100,000 on the basis of an appraisal by a senior Sotheby's specialist. The Service argued for $2.1 million and $500,000. The court largely accepted the Service's position and valued the paintings at roughly four times the estate's figures. What decided the case was not an argument about brushwork but a finding about the appraiser: while preparing the estate's valuation, he had also been soliciting the consignment of the paintings for his employer, and the court found that he had an incentive to produce low values to please the executor. The more valuable painting later sold at auction for more than $2.4 million. The case is now cited routinely for the proposition that appraisers must be independent in fact, not merely in title. The estate tax and the problem of unsaleable art At death, art held by the decedent is included in the gross estate at its fair market value and, after a unified exemption, is subject to federal estate tax at a top rate of 40 percent. The 2025 legislation fixed the basic exclusion at $15 million per person from 2026, indexed for inflation, so that a married couple can pass roughly $30 million free of federal estate tax. Estates holding more than that in art face a substantial liability, and because art produces no income, the estate may have to sell works to pay the tax. The Code allows estates dominated by illiquid business interests to defer payment in some circumstances, but art collections do not ordinarily qualify, and a forced sale shortly after death is a common result. Two doctrines temper this burden. The first is the blockage discount, which recognises that a large number of works by a single artist cannot all be sold at once without depressing prices. In Estate of David Smith, decided by the Tax Court in 1972, the estate of the sculptor held several hundred of his works; the court accepted that their aggregate value was less than the sum of their individual retail values because flooding the market would drive prices down. The Tax Court applied the same reasoning in Estate of O'Keeffe, decided in 1992, allowing a substantial discount for the large number of works held by Georgia O'Keeffe's estate. Blockage is most useful to artists' estates and to collectors whose holdings are concentrated in a single artist. The second is the discount for fractional interests. When a work is owned in undivided shares, for instance by spouses or by family members who inherited it together, a buyer of one share would pay less than a proportionate part of the whole, because he would have to share possession and could not sell the painting without the co-owners' agreement. In Estate of Elkins v. Commissioner, the United States Court of Appeals for the Fifth Circuit held in 2014 that an estate holding fractional interests in a collection of modern art was entitled to substantial discounts, reversing the Tax Court's allowance of only a nominal one, because the Service had offered no evidence to rebut the estate's expert testimony on the size of the appropriate discount. The most striking valuation dispute of recent decades concerned a work that could not legally be sold at all. When the dealer Ileana Sonnabend died in 2007, her estate included Robert Rauschenberg's 1959 combine Canyon, which incorporates a stuffed bald eagle. Federal wildlife law prohibits the sale of bald eagles or their parts, whenever taken, and the estate's appraisers accordingly valued the work at zero: there was no lawful market in which a willing buyer could purchase it. The Service's Art Advisory Panel valued it at $65 million, reasoning that a buyer might pay that much to own and display it privately, and the Service asserted a large deficiency and penalties. The dispute was resolved in 2012 when the heirs donated the work to the Museum of Modern Art and the Service agreed to treat it as having no taxable value. The case raised a question the tax law has never fully answered: whether fair market value can exist for an object that no one may lawfully sell. Private museums and loans The combination of deductions, estate tax pressure, and the wish to keep a collection together has encouraged some collectors to establish private foundations that operate their own museums, often on or near the founder's property. A private operating foundation that runs a museum open to the public can receive gifts of art deductible at fair market value, subject to the same related-use principles as a public museum. In 2015 the Senate Finance Committee questioned whether some of these institutions were meaningfully open to the public, noting that several were accessible only by appointment and located on the grounds of the founders' estates. The inquiry did not produce legislation, but it prompted many private museums to expand their hours and programmes, and the Service continues to examine whether public access is genuine. Loans of art to museums, by contrast, carry no tax deduction but offer other benefits, including display, prestige, conservation, and sometimes the enhanced market value that follows a museum exhibition. Loans also carry legal risks that are addressed later in this book: a work lent across borders may attract a claim by someone who says it was stolen, and federal law allows the State Department to grant immunity from seizure to works imported for temporary exhibition. That device, like the others in this chapter, depends on documentation. A collection whose provenance is complete, whose purchase prices are recorded, and whose appraisals were prepared by independent experts can be given, lent, or inherited with confidence. One whose history is a matter of family recollection is exposed at every step, to the tax collector as much as to any claimant. Chapter 6: Title, Theft, and Time In the early hours of 18 March 1990, two men dressed as police officers talked their way into the Isabella Stewart Gardner Museum in Boston, tied up the guards, and left with thirteen works, including Vermeer's The Concert and Rembrandt's only known seascape. The empty frames still hang in the museum, which offers a reward of $10 million for information leading to the recovery of the works in good condition. The Gardner theft is the most famous unsolved art crime in the United States, but it is unusual only in scale. Thousands of works are reported stolen every year, most from private homes rather than museums, and a significant number resurface years or decades later, in a gallery, an auction catalogue, or an estate inventory. When they do, the law must decide between two people who may both be innocent: the original owner, who lost the work through no fault of her own, and the current holder, who may have bought it in good faith and paid full value. How it makes that choice is the subject of this chapter. The owner's claim and the purchaser's defence As Chapter 1 explained, American law begins from the principle that a thief cannot pass good title. The original owner's claim therefore survives any number of subsequent sales, and she can bring an action for replevin, seeking return of the object itself, or for conversion, seeking its value. The good-faith purchaser's innocence is no defence to the claim on the merits; it matters only to his own claim against the person who sold him the work, who is liable for breach of the implied warranty of title under section 2-312 of the Uniform Commercial Code. The classic illustration is Menzel v. List, decided by New York's Court of Appeals in 1969. Erna and Eugene Menzel had bought a painting by Marc Chagall in Brussels in the 1930s. When they fled the German invasion in 1941, they left it behind, and it was seized by the Nazi looting agency. It reappeared in a Paris gallery after the war, was bought by a New York gallery, Perls, and sold in 1955 to Albert List. In 1962 Mrs Menzel found it in an art book, identified List as its owner, and demanded its return. The courts ordered List to give the painting back. List in turn recovered damages from Perls for breach of the warranty of title, and the Court of Appeals held that those damages should be measured by the painting's value at the time of trial, not the lower price List had paid, since only that measure would put him in the position he would have occupied had the title been good. The case established two propositions that remain fundamental: the original owner of stolen art prevails over the good-faith buyer, and the dealer who sold the work bears the ultimate loss. The real battleground, however, is not the merits but time. A painting stolen in 1945 may be claimed in 2025. Every legal system has had to decide when an owner's delay should bar her claim, and the answers differ sharply. Table 3 summarises the principal approaches. Table 3. Principal approaches to the passage of time in claims for stolen art. Approach Where used When the clock starts Role of owner's diligence Leading authority Demand and refusal New York When the owner demands return and the possessor refuses Irrelevant to limitations; considered under laches Solomon R. Guggenheim Foundation v. Lubell (N.Y. 1991) Discovery rule New Jersey and many other states When the owner knew or reasonably should have known the possessor's identity Central to the analysis O'Keeffe v. Snyder (N.J. 1980) Actual discovery by statute California, claims against museums, galleries, and dealers Actual discovery of the work's location and possessor; six-year period Not required California Code of Civil Procedure section 338(c) Federal statute for Nazi-era claims All United States courts Actual discovery of identity, location, and possessory interest; six-year period Not required; laches barred since 2026 Holocaust Expropriated Art Recovery Act Good-faith acquisition Switzerland, Italy, and many civil law systems Buyer may acquire title after limited period, or immediately Buyer's good faith decisive Winkworth v. Christie Manson & Woods (Eng. 1980, applying Italian law) New York: demand and refusal New York's approach is the most favourable to original owners and, because so much of the art trade passes through the state, the most consequential. It was settled by the Court of Appeals in Solomon R. Guggenheim Foundation v. Lubell, decided in 1991. A gouache by Chagall had disappeared from the Guggenheim Museum sometime in the late 1960s, apparently stolen by an employee. The museum did not report the loss to the police or to other museums, reasoning that publicity might drive the work underground. In 1967 Rachel Lubell and her husband bought it from a reputable New York gallery. Two decades later the museum learned where it was and demanded its return. The Lubells argued that the claim was barred by the three-year statute of limitations for recovery of chattels, which should have begun to run when the museum could have discovered the work's location through reasonable effort. The Court of Appeals disagreed. Against a good-faith purchaser, it held, the cause of action for replevin does not accrue until the owner demands return and the purchaser refuses; until then, the purchaser's possession is not wrongful. The owner's diligence in searching for the work is not relevant to when the statute begins to run. The court was explicit about its reasoning: New York, as a world centre of the art trade, should not become a haven for stolen art, and placing the burden of investigation on purchasers, who can inquire into provenance before buying, better serves that goal than requiring theft victims to search the world for their property. The owner's lack of diligence could still be considered under the equitable doctrine of laches, which bars a claim where the owner unreasonably delayed and the delay prejudiced the defendant. The case was later settled. Lubell rejected the prediction the federal Court of Appeals for the Second Circuit had made four years earlier in DeWeerth v. Baldinger, a case about a Monet landscape taken from a German castle at the end of the Second World War, which had passed through the Wildenstein gallery in New York to a buyer in 1957. The Second Circuit had held in 1987 that New York would require an owner to use reasonable diligence to find her property and had dismissed Gerda DeWeerth's claim because she had not searched hard enough. After Lubell made clear that the federal court had misread New York law, DeWeerth sought to reopen the judgment; the Second Circuit refused in 1994, and she never recovered the painting. The pairing of the two cases is a lesson in how much the outcome of a claim can depend on which court decides it and when. The discovery rule and its variants Most American states apply some form of discovery rule, under which the statute of limitations begins to run when the owner discovers, or through reasonable diligence should have discovered, the identity of the possessor. The leading case is O'Keeffe v. Snyder, decided by the New Jersey Supreme Court in 1980. Three small paintings by Georgia O'Keeffe had disappeared in 1946 from a New York gallery run by her husband, Alfred Stieglitz. O'Keeffe did not report the theft to the police or advertise the loss, though she mentioned it to acquaintances. Three decades later she learned that the paintings were for sale in New York and sued the owner, Barry Snyder, who had bought them in good faith. The New Jersey court rejected an approach based on adverse possession, which would have required the possessor's holding to be open and notorious, a test ill-suited to paintings hanging in private homes. Instead it held that the limitations period began to run when O'Keeffe first knew or reasonably should have known of her cause of action, including the identity of the possessor, and it sent the case back for a determination of whether she had acted with due diligence. The parties then settled. The discovery rule makes the owner's conduct central. An owner who reports a theft promptly to the police, registers the loss with the Art Loss Register and other databases, and publicises it in the trade has a strong argument that she did everything a reasonable owner could; one who stayed silent may find her claim barred. The rule therefore encourages exactly the kind of reporting that the Guggenheim declined to do, and critics of New York's approach argue that the demand-and-refusal rule rewards owners who conceal their losses. The federal Court of Appeals for the Seventh Circuit applied Indiana's discovery rule in a celebrated antiquities case, Autocephalous Greek-Orthodox Church of Cyprus v. Goldberg & Feldman Fine Arts, Inc., decided in 1990. Sixth-century Byzantine mosaics had been torn from the apse of the Church of the Panagia Kanakaria in the Turkish-occupied north of Cyprus in the late 1970s. In 1988 an Indianapolis dealer, Peg Goldberg, bought them in Geneva for just over $1 million, after a hurried transaction involving intermediaries whose stories were implausible. The church sued in Indiana. The court held that the church and the Republic of Cyprus had diligently searched for the mosaics, so the limitations period had not begun to run until they learned where the mosaics were. It rejected Goldberg's argument that Swiss law, under which a good-faith buyer might have acquired title, should govern, and noted in any event that the circumstances of her purchase were so suspicious that she could hardly claim good faith. The mosaics were returned to Cyprus. California has gone furthest in protecting owners through legislation. After a series of cases in which claims were held time-barred, the legislature amended its Code of Civil Procedure in 2010 so that actions to recover works of fine art from a museum, gallery, auctioneer, or dealer may be brought within six years of the claimant's actual discovery of the identity and location of the work and the information supporting the claim. Constructive discovery, meaning what the owner should have found, does not start the clock. Laches: the equitable backstop Even where the statute of limitations has not run, a claim may be barred by laches. The defendant must show that the owner delayed unreasonably in asserting her rights and that the delay prejudiced the defendant, typically because witnesses have died, records have been lost, or the defendant has changed position in reliance. Because the doctrine depends on the facts, it has proved decisive in some of the most prominent recent cases, particularly those involving art lost during the Nazi era. In Bakalar v. Vavra, the Second Circuit held in 2010 that New York rather than Swiss law governed a dispute over a drawing by Egon Schiele that had belonged to the Viennese cabaret performer Fritz Grünbaum, who was murdered at Dachau in 1941. On remand, the district court found the Grünbaum heirs' claim barred by laches, reasoning that the family had known of the collection's loss for decades and had not pursued it, and the Second Circuit affirmed in 2012. In Zuckerman v. Metropolitan Museum of Art, decided in 2019, the same court held that the heir of a German Jewish couple who had sold Picasso's The Actor in 1938 to finance their flight from Nazi persecution was barred by laches, because the family had known the painting's whereabouts since it entered the Met's collection in 1952 and had waited more than half a century to sue. The court held that the Holocaust Expropriated Art Recovery Act of 2016, which had extended the statute of limitations for Nazi-era claims, did not displace the laches defence. As Chapter 7 explains, Congress responded to that holding in 2026. Criminal law and forfeiture Stolen art is also the subject of criminal law. The National Stolen Property Act makes it a federal crime to transport in interstate or foreign commerce, or to receive, goods worth $5,000 or more knowing them to have been stolen. A separate statute, enacted in 1994, makes it a federal crime to steal or obtain by fraud an object of cultural heritage worth more than $5,000, or any object worth more than $100,000 and over a century old, from a museum, and to receive such objects knowing them to have been stolen; prosecutions under it are subject to an extended twenty-year limitations period. The Federal Bureau of Investigation's Art Crime Team, created in 2004, investigates these offences and maintains the National Stolen Art File. The government may also bring civil forfeiture proceedings against stolen property itself, a device that does not require proof that anyone committed a crime and that allows the court to determine who is entitled to the object. The most significant example is United States v. Portrait of Wally. In 1997 the Leopold Museum in Vienna lent Schiele's portrait of his companion Wally Neuzil to the Museum of Modern Art in New York for an exhibition. Heirs of Lea Bondi Jaray, a Viennese Jewish dealer from whom the painting had been taken in 1938, asked that it not be returned to Austria. The Manhattan District Attorney issued a subpoena to hold the painting in New York, but the New York Court of Appeals quashed it in 1999, relying on a state statute protecting works lent for exhibition from seizure. Federal prosecutors then brought a civil forfeiture action, alleging that the painting was stolen property imported in violation of federal law. The litigation lasted more than a decade. In 2009 the federal district court in Manhattan held that the painting was stolen property, leaving for trial the question whether the Leopold Museum's founder had known it when he imported the work. The case settled in 2010, shortly before trial: the Leopold Museum paid the Bondi estate $19 million and kept the painting, which was displayed at the Museum of Jewish Heritage in New York before returning to Vienna with a permanent label recounting its history. Due diligence as the practical rule The legal doctrines in this chapter produce a practical rule that every serious buyer now follows. Before acquiring a significant work, the buyer or her adviser searches the principal stolen-art databases, reviews the work's documented provenance, looks for gaps, especially for the years 1933 to 1945 and for any object that crossed borders after 1970, and asks the seller to explain them. A clean database search does not establish title; it shows only that no one has reported the work stolen. But a buyer who fails to search, or who ignores warning signs, will find courts unsympathetic to arguments that she acted in good faith, whether the question arises under a discovery rule, a laches defence, or a foreign law that protects good-faith purchasers. The Goldberg mosaics case and the Knoedler forgeries point in the same direction: the law increasingly treats a failure to ask obvious questions as incompatible with innocence. Chapter 7: Nazi-Era Looted Art and the Long Road to Restitution No body of art law has developed more rapidly, or generated more litigation, than the law governing art lost by victims of Nazi persecution. Between 1933 and 1945 the German state and its agents stripped Jewish families and others targeted by the regime of paintings, drawings, sculpture, books, and furniture on an enormous scale. Some works were confiscated outright by specialised looting agencies. Many more were sold under duress, at prices set by the buyers, to raise money for discriminatory taxes, exit visas, and flight. Others were abandoned when their owners fled or were deported, and were later seized as ownerless property. Hundreds of thousands of objects changed hands. After the war the Allied armies recovered and returned vast quantities of looted art to the countries from which it had been taken, but restitution to individual owners was uneven, incomplete, and often frustrated by the bureaucracies of countries that were in no hurry to empty their museums. Many works entered the international art market in the late 1940s and 1950s and passed into private and public collections in the United States, often with their wartime history obscured or unknown. For decades these losses produced remarkably little litigation. That changed in the late 1990s, when the opening of archives after the end of the Cold War, the publication of detailed research on wartime looting, and the high-profile seizure in New York of two Schiele paintings lent from Vienna combined to bring the issue into public view. Since then, the law has been built largely through three mechanisms: soft-law principles adopted by governments, litigation in American courts, and, most recently, federal legislation designed to overcome the procedural obstacles that had defeated many claims. The Washington Principles and their successors In December 1998 the United States convened the Washington Conference on Holocaust-Era Assets. Forty-four governments endorsed eleven principles on Nazi-confiscated art. They are not binding law, but they have shaped the conduct of museums and governments ever since. The principles call for the identification of art confiscated by the Nazis and not subsequently restituted, for archives to be opened to researchers, for publicity to be given to such art so that pre-war owners and their heirs can come forward, and, where owners or heirs are identified, for steps to be taken expeditiously to achieve a "just and fair solution," recognising that this may vary according to the facts of the case. The principles also encourage nations to develop alternative dispute resolution mechanisms for resolving ownership issues. The Terezín Declaration of 2009, endorsed by forty-seven countries, reaffirmed the principles and emphasised that claims should be resolved on the facts and merits rather than on technical grounds. In March 2024, on the principles' twenty-fifth anniversary, the United States and a large group of other states endorsed a set of Best Practices elaborating them. Among other things, the Best Practices make clear that the principles apply to sales made under duress by persecuted owners, not only to outright confiscations, and that a sale by a persecuted person in the period of persecution can be regarded as equivalent to confiscation. That point matters because a large proportion of contested claims concern works that the owners "sold," under circumstances that no one today would regard as voluntary. American museum associations adopted parallel guidelines in 1998 and 1999, committing their members to research the provenance of works that may have changed hands in continental Europe between 1933 and 1945, to publish the results, and to resolve claims in an equitable manner. The Nazi-Era Provenance Internet Portal, established by the American Alliance of Museums, lists tens of thousands of objects in American museums with gaps in their provenance for those years. New York added a statutory element in 2022, requiring museums in the state to display a placard identifying any work on display that is known to have changed hands in Europe during the Nazi era through theft, seizure, confiscation, or forced sale. Suing a foreign state Many important works lost during the Nazi era are now in public museums in Europe. A claimant who wishes to recover such a work in an American court faces the Foreign Sovereign Immunities Act of 1976, which makes foreign states and their agencies immune from suit in the United States unless one of the Act's exceptions applies. The relevant one is the expropriation exception, which allows suits in which "rights in property taken in violation of international law are in issue," provided the property or property exchanged for it has a sufficient commercial connection to the United States. The first great test was Republic of Austria v. Altmann, decided by the Supreme Court in 2004. Maria Altmann, a niece of the Viennese sugar magnate Ferdinand Bloch-Bauer, sought to recover six paintings by Gustav Klimt, including the gold-leafed portrait of her aunt Adele, held by the Austrian national gallery. Austria argued that the Act, passed in 1976, could not apply to conduct that took place in the 1930s and 1940s. The Supreme Court held that it did apply to events before its enactment, allowing the case to proceed. The parties then agreed to submit the dispute to arbitration in Austria, and in January 2006 an Austrian arbitral panel ruled that five of the paintings should be returned to the heirs. Later that year the portrait of Adele Bloch-Bauer was sold to Ronald Lauder for the Neue Galerie in New York for a reported $135 million. Later cases narrowed the exception. In Federal Republic of Germany v. Philipp, decided in 2021, heirs of Jewish art dealers in Frankfurt sued Germany over the Guelph Treasure, a collection of medieval reliquaries that their forebears' consortium had sold to the state of Prussia in 1935 at, they alleged, a coerced price. The Supreme Court unanimously held that the expropriation exception incorporates the international law of expropriation, which traditionally governs a state's taking of property belonging to foreigners, not its own nationals. Under this "domestic takings rule," a state's seizure of property from its own citizens does not violate the international law of expropriation, even where the taking was part of a campaign of genocide. The heirs could not use the exception if the dealers had been German nationals at the time. In Republic of Hungary v. Simon, decided in February 2025, the Court further held that plaintiffs relying on the exception must trace the proceeds of expropriated property to the defendant's commercial activity in the United States, and cannot satisfy that requirement simply by alleging that the proceeds were commingled with a state's general funds. Together, the two decisions made suits against foreign states over wartime takings considerably harder. The Cassirer case The long-running dispute over a Pissarro street scene illustrates, almost too perfectly, how procedural rules can determine the outcome of a restitution claim. In 1939 Lilly Cassirer Neubauer, a member of a prominent German Jewish family of publishers and art dealers, was forced to surrender Rue Saint-Honoré, dans l'après-midi, effet de pluie to a Nazi official as the price of an exit visa. After the war she received compensation from the West German government, but she did not recover the painting, which had passed through the market and eventually into the United States. In 1976 Baron Hans Heinrich Thyssen-Bornemisza bought it from a New York dealer, and in 1993 Spain acquired his collection, placing it in a foundation that runs the Thyssen-Bornemisza Museum in Madrid. Lilly's grandson Claude Cassirer learned in 2000 that the painting was there and, after a request for its return was refused, sued the foundation in federal court in California in 2005. The case has lasted more than two decades and reached the Supreme Court. The central question was which country's law governed title. Under Spanish law, the foundation could acquire title by acquisitive prescription, having possessed the painting publicly and in good faith for the required period. Under California law, a thief cannot pass good title and no such rule would apply. The lower courts applied a federal choice-of-law rule and chose Spanish law, and the district court ruled for the foundation in 2019, while observing that its retention of the painting was difficult to reconcile with the Washington Principles. In 2022 the Supreme Court unanimously held in Cassirer v. Thyssen-Bornemisza Collection Foundation that in a suit against a foreign state's instrumentality under the Foreign Sovereign Immunities Act, the court must apply the same choice-of-law rule that would apply in a suit against a private party, which in California meant California's own rule. On remand, the Ninth Circuit held in January 2024 that California's choice-of-law analysis still pointed to Spanish law, and it again ruled for the foundation. The California legislature then intervened. In September 2024 it enacted a statute, known in the legislature as Assembly Bill 2867, providing that in actions by California residents and their heirs to recover stolen art, California substantive law applies, notwithstanding ordinary choice-of-law principles, and making the rule applicable to pending cases. The Cassirer family asked the Supreme Court to send the case back in light of the new statute. In March 2025 the Court granted the petition, vacated the Ninth Circuit's judgment, and remanded, and the Ninth Circuit in turn sent the case back to the district court, where the foundation's challenges to the new law and the question of title were once again open. Whatever the final outcome, the case demonstrates how completely the result of a restitution claim can depend on doctrines that have nothing to do with the moral merits: sovereign immunity, choice of law, and the treatment of time. The HEAR Act, 2016 and 2026 Time had long been the greatest obstacle to Nazi-era claims. Many heirs did not know, or could not prove, where their families' works were until decades after the war, and by then statutes of limitations had often run. In December 2016 Congress enacted the Holocaust Expropriated Art Recovery Act, which created a uniform federal limitations period for civil claims to recover art or other property lost because of Nazi persecution between 1933 and 1945. Such claims could be brought within six years after the claimant's actual discovery of the identity and location of the work and of her possessory interest in it. The Act applied to claims pending on the date of enactment and to claims filed before the end of 2026, when it was to expire. The 2016 Act helped some claimants. In Reif v. Nagy, New York's Appellate Division held in 2019 that the heirs of Fritz Grünbaum were entitled to two Schiele works held by a London dealer. The court found that the works had never been voluntarily transferred: Grünbaum had been forced, while imprisoned at Dachau, to sign a power of attorney in favour of his wife, who was herself later deported and killed, and a transfer compelled in those circumstances could not pass title. The court also rejected the dealer's laches defence, finding that he had not been prejudiced by any delay. But the Act left other defences intact. In Zuckerman v. Metropolitan Museum of Art, described in Chapter 6, the Second Circuit held in 2019 that the Act did not displace laches. In Von Saher v. Norton Simon Museum of Art at Pasadena, the Ninth Circuit held in 2018 that the act of state doctrine barred the claim of the heir of the Dutch dealer Jacques Goudstikker to two panels of Adam and Eve by Lucas Cranach the Elder, because the Dutch government's post-war disposition of the works was a sovereign act that American courts could not question. Other claims were dismissed on grounds of international comity or because foreign rules of acquisitive prescription had vested title in the current holder. Congress responded with the Holocaust Expropriated Art Recovery Act of 2025, which passed the Senate unanimously in December 2025 and the House without opposition in March 2026, and was signed into law on 13 April 2026. The new law keeps the six-year discovery-based limitations period but removes the 2016 Act's sunset, making the regime permanent. More significantly, it bars defendants in covered claims from relying on a series of non-merits defences that had defeated earlier cases, including laches and other defences based on the passage of time, acquisitive prescription under foreign law, the act of state doctrine, forum non conveniens, and abstention on grounds of international comity. Its sponsors stated that the purpose was to ensure that claims would be decided on their merits. Commentators have read the Act as also addressing the obstacles to suits against foreign states that the domestic takings rule created, although how courts will apply those provisions remains to be seen. The new law does not guarantee that claimants will win. They must still prove that the work was lost because of persecution, that they are the rightful heirs, and that the current holder's title is defective. Cases involving sales for fair value by owners who emigrated safely with the proceeds, or works that passed through legitimate post-war restitution proceedings, will continue to be hard. But the landscape has changed. Holders of Nazi-era works in the United States can no longer rely on the passage of time as a shield. Prosecutors enter the field: the Grünbaum Schieles The newest front in Nazi-era restitution has been opened by prosecutors rather than private claimants. Beginning in 2023, the Manhattan District Attorney's Office obtained warrants to seize Schiele works that had belonged to Fritz Grünbaum from several museums and private owners, including the Art Institute of Chicago, the Carnegie Museum of Art in Pittsburgh, and the Allen Memorial Art Museum at Oberlin College, on the theory that the works were stolen property within the meaning of New York criminal law. Several institutions and collectors surrendered their works, and the office returned them to the Grünbaum heirs. The Art Institute of Chicago contested the seizure of Russian War Prisoner, a watercolour it had held since 1966, arguing that its provenance showed the work had been sold after the war by Grünbaum's sister-in-law and not stolen. In April 2025 a New York trial judge ordered the drawing turned over to the heirs. In September 2026 the Appellate Division, First Department, reversed, holding that the criminal procedure the District Attorney had used, a turnover under the Penal Law's provisions on stolen property, was not an appropriate means of resolving a genuinely contested dispute over ownership, which belonged in civil litigation with full discovery and defined burdens of proof. The dispute now proceeds in a federal civil action between the heirs and the museum, where the 2025 Act's bar on laches will apply. The decision also constrains the tool that the District Attorney's office had used to recover thousands of looted antiquities, discussed in the next chapter. European mechanisms Outside the United States, most restitution claims against public collections are resolved not by courts but by advisory or arbitral panels. The United Kingdom's Spoliation Advisory Panel, established in 2000, recommends outcomes on claims against British museums; the Holocaust (Return of Cultural Objects) Act 2009 allows national museums, which are otherwise prohibited from disposing of their collections, to return objects on its recommendation, and a 2019 amendment removed the Act's original sunset. France enacted a framework law in July 2023 allowing Nazi-looted works to be removed from public collections without a separate statute for each case. Austria has operated a restitution regime for federal collections since 1998, and the Netherlands reformed its Restitutions Committee in 2021, abandoning a controversial approach that had weighed the museum's interest in keeping a work against the claimant's interest in recovering it. Germany, where the discovery in 2012 of more than a thousand works hoarded by Cornelius Gurlitt, son of one of Hitler's art dealers, prompted a national reckoning, relied from 2003 on an Advisory Commission that could hear cases only if both sides agreed. In December 2025 it replaced that body with a Court of Arbitration for Nazi-Looted Cultural Property, whose decisions are binding and which claimants can invoke unilaterally against public institutions that have accepted its jurisdiction. The trend on both sides of the Atlantic is the same: away from discretionary, voluntary processes and toward mechanisms that give claimants an enforceable right to a decision on the merits. Chapter 8: Antiquities, Source Nations, and the International Frameworks An antiquity differs from a painting in a way that transforms its legal position. A painting has an author, a date, and usually a documented chain of owners stretching back to the studio. An antiquity has none of these as a matter of course. A Greek vase, a Khmer sculpture, or a Mesopotamian cuneiform tablet may have been made two or three thousand years ago, buried for most of the intervening time, and dug up at some unknown moment by someone who did not record where or when. The archaeological value of such an object lies largely in its context: the grave, building, or stratum in which it was found, which allows scholars to understand what it meant and how it was used. When an object is looted, that context is destroyed for ever. And because looted objects surface without documentation, the market has long accepted vague provenances, such as "old Swiss collection" or "acquired in the 1960s," that could conceal a theft committed the previous year. The law's response has been built on two foundations. The first is the claim of source nations, the countries in whose territory archaeological material lies, to own that material and control its export. The second is a network of international agreements and national laws that make those claims enforceable in the countries where antiquities are sold and collected. This chapter explains both, and the increasingly aggressive enforcement that has followed. National ownership and the McClain doctrine Many countries with rich archaeological heritage have enacted laws declaring that antiquities found in their soil belong to the state. Italy's law of 1939 vested ownership of archaeological finds in the state; Egypt's Law 117 of 1983 declared antiquities to be public property; Mexico, Peru, Turkey, Greece, and many others have comparable laws. Such laws are sometimes called patrimony laws. Their significance in foreign courts turns on whether they make an unlawfully excavated object "stolen," and so subject to the laws against dealing in stolen property, or merely "illegally exported," which most countries, including the United States, do not by themselves enforce on behalf of foreign states. The United States Court of Appeals for the Fifth Circuit answered this question in United States v. McClain, decided in two opinions in 1977 and 1979. The defendants had been convicted of conspiring to deal in pre-Columbian artefacts taken from Mexico. The court held that an object could be "stolen" within the meaning of the National Stolen Property Act if a foreign country had clearly declared its ownership of such objects by law, even if the country had never physically possessed them, and the object was removed from the country after that declaration. It also held that the declaration must be clear enough to give fair notice; a mere export restriction would not do. The McClain doctrine, as it came to be known, turned foreign patrimony laws into the foundation for American criminal liability. The Second Circuit adopted the doctrine in United States v. Schultz, decided in 2003. Frederick Schultz, a prominent Manhattan dealer in ancient art and former president of a national association of antiquities dealers, had conspired with a British restorer, Jonathan Tokeley-Parry, to smuggle Egyptian antiquities out of Egypt, disguising them as cheap souvenirs and inventing a fictitious old English collection as their provenance. Schultz argued that Egyptian law merely restricted exports. The court disagreed, holding that Law 117 was a genuine ownership law and that objects removed in violation of it were stolen. Schultz was sentenced to thirty-three months in prison. The conviction sent a clear message to the trade: a dealer who knowingly handles antiquities taken in breach of a clear foreign ownership law commits a federal crime. Civil forfeiture has reinforced the point. In United States v. An Antique Platter of Gold, decided by the Second Circuit in 1999, the government sought forfeiture of a fourth-century BC gold libation bowl from Sicily that the collector Michael Steinhardt had bought in 1991 for about $1.2 million. The customs declaration had listed the country of origin as Switzerland, through which the bowl had passed, rather than Italy. The court held that the false statement was material and that the bowl was subject to forfeiture on that ground alone, without deciding whether it was stolen. The bowl was returned to Italy. The case established that the mundane obligation to declare accurately the origin of goods at the border can be enough to deprive a buyer of an antiquity. The international frameworks Alongside national ownership laws sits a set of international instruments that establish obligations between states. They differ in scope, mechanism, and reach, and the United States has embraced some and declined others, as Table 4 sets out. Table 4. Principal international and regional instruments on the illicit trade in cultural property. Instrument Main mechanism United States status Principal limitation 1954 Hague Convention Protection of cultural property in armed conflict; First Protocol addresses export from occupied territory Convention ratified 2009; not party to the protocols Confined to armed conflict and occupation 1970 UNESCO Convention State cooperation to prevent illicit import, export, and transfer of ownership Accepted 1972; implemented by statute in 1983 Not retroactive; depends on national implementing law Convention on Cultural Property Implementation Act (1983) Import restrictions under bilateral agreements; bar on import of objects stolen from inventoried collections Domestic United States law Applies only to designated categories and countries 1995 UNIDROIT Convention Private-law claim for return of stolen objects; compensation for diligent possessors Not a party Ratified by few major market states EU Regulation 2019/880 Ban on importing illegally exported goods; licences and importer statements for older categories European Union law Categories defined by age and value thresholds The 1970 UNESCO Convention on the Means of Prohibiting and Preventing the Illicit Import, Export and Transfer of Ownership of Cultural Property is the foundational instrument. It obliges states parties to take measures to prevent museums within their territories from acquiring illegally exported cultural property, to prohibit the import of property stolen from museums and religious or public monuments, and to cooperate with other states in combating the illicit trade. Its date has become a benchmark for the entire field. The Association of Art Museum Directors adopted guidelines in 2008 under which member museums should not acquire an archaeological object unless research substantiates that it was outside its probable country of modern discovery before 1970, or was legally exported after that date. Objects without such documentation are widely regarded as unacquirable by responsible institutions. The United States implemented the Convention through the Convention on Cultural Property Implementation Act of 1983. The Act does not adopt the Convention wholesale. Instead it establishes a procedure through which another state party can request that the United States impose import restrictions on specified categories of archaeological or ethnological material whose pillage places its cultural heritage in jeopardy. The request is reviewed by the Cultural Property Advisory Committee, a body of experts and representatives of museums, the trade, and the public, and the State Department may then enter into a bilateral agreement, usually called a memorandum of understanding, under which United States Customs and Border Protection will refuse entry to designated material not accompanied by an export permit from the source country. The United States has entered into such agreements with more than two dozen countries, including Italy, Greece, Egypt, China, Cambodia, and many in Latin America. Congress has also imposed emergency import restrictions by statute on material from Iraq, in 2004, and from Syria, in 2016. The 1995 UNIDROIT Convention on Stolen or Illegally Exported Cultural Objects takes a different approach. Rather than relying on cooperation between governments, it gives the owner of a stolen cultural object a direct right to recover it from any possessor in another contracting state, subject to limitation periods, and requires the possessor to return it even if he acquired it in good faith, though he is entitled to fair compensation if he can show he exercised due diligence in acquiring it. The Convention's due diligence standard, which looks to the character of the parties, the price paid, and whether the possessor consulted accessible registers of stolen objects, has influenced courts and legislatures well beyond the states that ratified it. The United States and the United Kingdom are not parties, and ratification among major market states has been limited. The European Union has developed its own regime. A directive of 2014 requires member states to return cultural objects unlawfully removed from the territory of another member state. Regulation 2019/880 goes further in controlling what enters the Union from outside. Since December 2020 it has prohibited the import of cultural goods that were removed from the country in which they were created or discovered in breach of that country's laws. From 28 June 2025, it has required an import licence for the highest-risk categories, including archaeological objects more than 250 years old, and a signed importer statement, backed by documentation, for certain other categories over 200 years old and above a value threshold, all administered through a new electronic system shared among customs authorities. The enforcement turn Treaties and statutes on the books mean little without enforcement, and for decades enforcement was sporadic. That began to change in the mid-1990s, when Italian and Swiss police raided a warehouse in the Geneva Freeport leased by the Italian dealer Giacomo Medici and found thousands of photographs of antiquities, many freshly excavated and still encrusted with dirt, some showing objects that later appeared in major museum collections. Medici was convicted in Italy in 2004. Marion True, antiquities curator of the J. Paul Getty Museum, was put on trial in Rome in 2005 on charges of conspiring to receive looted antiquities; the case ended in 2010 when the limitations period expired without a verdict. The investigations nevertheless led a series of American museums, including the Getty, the Metropolitan Museum of Art, and the Museum of Fine Arts in Boston, to negotiate the return of dozens of objects to Italy in 2006 and 2007. Among them was the Euphronios krater, a painted Greek vase the Met had bought in 1972 for $1 million, which went back to Italy in 2008. The Getty has so far refused to surrender its most prized ancient bronze, the Victorious Youth, a Greek statue found in the Adriatic by Italian fishermen in 1964 and bought by the museum in 1977. Italian courts ordered its confiscation, a decision upheld by Italy's Court of Cassation in 2018. The Getty challenged the order before the European Court of Human Rights, arguing that it violated the Convention's protection of property. In May 2024 the Strasbourg court rejected the challenge, holding that the confiscation pursued the legitimate aim of protecting cultural heritage and was proportionate, in part because the Getty had not exercised due diligence when it bought the statue. The statue remains in California; Italy's ability to enforce the order there depends on American cooperation. In the United States, the most important enforcement actor of the last decade has been the Manhattan District Attorney's Office, whose Antiquities Trafficking Unit was established in 2017. Because so much of the antiquities trade passes through New York, the office has used state laws against criminal possession of stolen property, together with warrants and turnover orders, to seize objects from galleries, auction houses, private collections, and museums, and to return them to source countries. It has repatriated thousands of objects to countries including Italy, Greece, Egypt, India, Cambodia, Turkey, and Pakistan. In December 2021 it announced that Michael Steinhardt, one of the most prominent collectors of antiquities in the world, had agreed to surrender 180 objects worth some $70 million that the office said had been looted from eleven countries, and to accept a lifetime ban on acquiring antiquities, in exchange for not being prosecuted. The office's case against a bronze statue of a philosopher-emperor shows the evidentiary methods that now underpin such claims. In 2023 it seized from the Cleveland Museum of Art a headless bronze figure, long identified as the Roman emperor Marcus Aurelius and valued at some $20 million, alleging that it had been looted in the 1960s from a shrine to the imperial cult at Bubon in south-western Turkey. The museum sued to challenge the seizure. The prosecution's evidence combined photogrammetric comparison of the statue's feet with the statue bases still at the site, lead isotope analysis matching the statue to its fragments, and analysis of soil recovered from inside the bronze. In February 2025 the museum agreed to relinquish the statue and withdraw its suit, and it was returned to Turkey in July 2025. Federal prosecutors have been active too. In 2017 the craft retailer Hobby Lobby agreed to forfeit thousands of cuneiform tablets, clay bullae, and other Iraqi artefacts that had been shipped into the United States under false labels describing them as ceramic tiles, and to pay $3 million. A few years later the government obtained forfeiture of the Gilgamesh Dream Tablet, a cuneiform fragment bearing part of the Epic of Gilgamesh that Hobby Lobby had bought in 2014 for display at the Museum of the Bible; it was returned to Iraq in 2021. In 2019 federal prosecutors in New York indicted Douglas Latchford, a dealer who for decades supplied Khmer sculpture to leading museums and collectors, for trafficking in looted Cambodian antiquities; he died in 2020 before trial, but his family later agreed to return his collection to Cambodia, and several American museums have since returned works that passed through his hands. The limits of enforcement Two recent developments suggest the limits of this approach. The first is the September 2026 decision of New York's Appellate Division in the Art Institute of Chicago's dispute over a Schiele watercolour, discussed in Chapter 7, which held that the turnover procedure under the state's stolen property law is not an appropriate means of resolving contested questions of ownership. The Manhattan office had relied on that procedure in more than a hundred turnover orders, and many seizures had prompted voluntary surrenders by holders unwilling to litigate. Where a museum or collector is prepared to contest the claim, the office may now have to proceed by civil or criminal litigation in which it bears a full burden of proof. The second is the unfinished state of anti-money-laundering regulation. As Chapter 4 explained, Congress in 2021 brought antiquities dealers within the Bank Secrecy Act, but the implementing rule has never been finalised. The antiquities trade in the United States therefore remains subject to customs law, criminal law, and forfeiture, but not to the customer identification and suspicious activity reporting obligations that would give investigators an ordinary paper trail. For collectors and museums, the practical implications are clear. An antiquity without documented provenance before 1970, or without a valid export licence after that date, is a legal liability as much as an asset. It may be seized, it cannot responsibly be sold or donated, and its value in the legitimate market is falling. The due diligence the law now expects includes checking the object against bilateral import restrictions, stolen-object databases, and the International Council of Museums' Red Lists of categories at risk; demanding documentary evidence of exit from the source country; and treating unverifiable collection histories with the scepticism that the cases in this chapter have shown to be warranted. Chapter 9: Colonial Collections, Indigenous Heritage, and the New Ethics of Return The claims examined in the last three chapters share a common structure. Someone owned an object, someone else took it unlawfully, and the question is whether the law will restore it. The claims in this chapter are different, and in some ways more difficult. Many of the objects at issue were acquired in ways that were lawful, or at least not clearly unlawful, under the rules of the time: taken as spoils of war by an imperial army, bought from a colonial administration, collected by anthropologists, or excavated from graves on land that the collectors' government had declared its own. The legal systems of the countries that now hold them often provide no cause of action for their return, and the statutes governing national museums may forbid it. Yet the pressure for return has grown steadily, and in the last decade several governments have created new legal mechanisms to make it possible. This chapter examines that shift and the parallel development in the United States of a mandatory repatriation regime for Native American human remains and cultural items. The Benin Bronzes and the problem of legality In February 1897 a British military force captured and burned Benin City, in what is now southern Nigeria, in reprisal for the killing of a British party that had attempted to visit the kingdom. The soldiers removed thousands of objects from the royal palace, including cast brass plaques, commemorative heads, and carved ivories, now collectively known as the Benin Bronzes. Many were sold to defray the costs of the expedition, and they dispersed into museums and private collections across Europe and North America. The British Museum holds the largest collection; German museums held more than a thousand. No court in Britain or Germany is likely to order the return of a Benin Bronze. Under the law as it then stood, the taking was an act of war by a sovereign power, beyond the reach of private law claims; the objects have since passed through generations of lawful sales and gifts; and any claim would face insurmountable problems of limitation and sovereign immunity. If the Bronzes are to go back, it must be by voluntary decision. That is what has begun to happen. In July 2022 Germany and Nigeria signed an agreement transferring ownership of the Benin Bronzes in German public collections to Nigeria, with some remaining on loan in Germany. In October 2022 the Smithsonian Institution's National Museum of African Art in Washington returned twenty-nine objects after its Board of Regents adopted a policy permitting returns on ethical grounds. Several British institutions not bound by national museum legislation, including the Horniman Museum in London and colleges of the universities of Cambridge and Aberdeen, returned objects in the same period. The process revealed its own complications. In March 2023 the outgoing president of Nigeria issued a declaration vesting ownership of all returned Benin objects in the Oba of Benin, the traditional ruler whose ancestors' palace had been looted, rather than in the national museum authority. Some Western institutions paused returns while they sought clarity about whether the objects would be publicly accessible. The episode illustrates a recurring question in restitution: to whom, exactly, should an object be returned, when the entity from which it was taken, a pre-colonial kingdom, is not the same as any existing state, and when different claimants within the source country may disagree? Statutory barriers: the Parthenon Marbles Some of the most famous disputed objects are held by institutions whose governing statutes prevent them from giving anything away. The British Museum Act 1963 prohibits the museum's trustees from disposing of objects in the collection except in narrow circumstances, such as duplicates or objects unfit to be retained, and the courts have held that the trustees cannot rely on a general moral obligation to override the statute. The practical effect is that the British Museum could not return the Benin Bronzes or the Parthenon Marbles even if its trustees wished to, without legislation. The Parthenon Marbles, sculptures removed from the Acropolis in Athens between 1801 and 1812 by agents of Lord Elgin, then British ambassador to the Ottoman Empire, and purchased by Parliament for the British Museum in 1816, are the best-known restitution claim in the world. Greece has sought their return since the 1980s. The British position has been that Elgin acted with the permission of the Ottoman authorities who then governed Athens, and that the sculptures are legally owned by the museum's trustees; Greece disputes both the scope and the validity of that permission. From 2022 the museum's chairman and the Greek government held talks about a possible arrangement short of formal transfer, such as a long-term exchange or partnership, that would allow the sculptures to be displayed in Athens without the museum renouncing ownership. As of September 2026 the talks had stalled, with the Greek prime minister publicly rejecting any arrangement that took the form of a loan, since accepting one would acknowledge British title. The dispute shows how legal form can become the whole substance of a negotiation: both sides might accept the same physical outcome but not the same description of it. France: from case-by-case statutes to a framework law France has moved further than any other former colonial power toward a legal framework for return. French public collections are, by long constitutional and statutory tradition, inalienable: objects in them cannot be sold or given away. Until recently, each return required a specific act of Parliament. In 2017 President Emmanuel Macron announced in a speech in Ouagadougou that within five years he wished to see the conditions established for the temporary or permanent return of African heritage to Africa. A report he commissioned from the scholars Felwine Sarr and Bénédicte Savoy, published in 2018, recommended the restitution of objects taken during the colonial period without the consent of their owners, and it provoked intense debate across Europe. In December 2020 Parliament passed a law authorising the return of twenty-six objects taken from the royal palaces of Abomey by French troops in 1892 to the Republic of Benin, and of a sword associated with the nineteenth-century leader El Hadj Omar Tall to Senegal. The Abomey treasures went back in November 2021. France then enacted framework laws simplifying the return of Nazi-looted works, in July 2023, and of human remains, in December 2023. In spring 2026, after the Senate's unanimous approval in January, the National Assembly passed a general framework law for colonial-era cultural property. It allows objects in public collections that were taken between 1815 and 1972 to be removed from those collections and returned by administrative decision, after review by a committee that assesses whether they were acquired illegitimately or by force, and on the formal request of a foreign state that undertakes to preserve and display them. Military objects, public archives, and objects from archaeological excavations shared under agreements are excluded. The end date of 1972 is the year the UNESCO Convention entered into force, a deliberate link between the older colonial claims and the modern regime for illicit trade. Other European states have followed different paths. Germany adopted guidelines in 2019 for the return of objects from colonial contexts and has returned objects to Namibia, Nigeria, and others. The Netherlands adopted a policy in 2021, following the recommendations of an advisory committee, under which objects taken involuntarily from former Dutch colonies will be returned unconditionally on request. Belgium enacted a law in 2022 recognising the alienability of objects acquired during its colonial rule in Central Africa and establishing a procedure for return. The common feature is that restitution in these countries has become a matter of public law and administrative procedure rather than private litigation. NAGPRA: a mandatory regime in the United States The United States has no general law on colonial-era collections, but it has something no European country has: a comprehensive, mandatory repatriation regime for the human remains and cultural items of its own Indigenous peoples. The Native American Graves Protection and Repatriation Act of 1990 requires federal agencies and museums that receive federal funds, which includes most American museums of any size, to inventory the Native American human remains and associated funerary objects in their collections and to summarise their unassociated funerary objects, sacred objects, and objects of cultural patrimony; to consult with Indian tribes and Native Hawaiian organisations; and to repatriate such remains and objects to lineal descendants or culturally affiliated tribes on request. The Act also protects Native American graves on federal and tribal land and makes trafficking in Native American human remains and certain cultural items a federal crime. For its first three decades, NAGPRA's implementation was slow. Many museums classified large proportions of the remains in their collections as "culturally unidentifiable," a category that allowed them to retain them, and federal oversight reviews and investigative reporting found that the remains of tens of thousands of individuals were still held by institutions three decades after the law's enactment. In December 2023 the Department of the Interior issued comprehensive new regulations, effective in January 2024, designed to accelerate the process. The regulations require museums to defer to the knowledge and expertise of tribes, including oral tradition, when determining cultural affiliation; eliminate the "culturally unidentifiable" category as a basis for delay; set deadlines for updating inventories and completing repatriation; and require museums to obtain the free, prior, and informed consent of the relevant tribes before displaying or conducting research on human remains or cultural items. The response was immediate and visible. In January 2024 the American Museum of Natural History in New York closed two major halls devoted to Native American cultures, and museums including the Field Museum in Chicago and Harvard's Peabody Museum covered display cases or removed objects while they undertook consultation. Some observers criticised the regulations as unworkably broad; many tribal representatives welcomed them as overdue enforcement of a law that had been on the books for more than thirty years. Congress extended the regime's reach abroad with the Safeguard Tribal Objects of Patrimony Act of 2022, known as the STOP Act. It prohibits the export of Native American cultural items obtained in violation of federal law, increases penalties for trafficking, and establishes a framework for the voluntary return of items held by private collectors. The Act was prompted in part by sales of Native American ceremonial objects at auction in Paris, which tribes and the United States government had been unable to stop under French law. Immunity from seizure and the politics of loans Restitution claims have a practical effect on the international exchange of exhibitions. A museum lending a work abroad risks that a claimant will sue or seek to seize it while it is in the borrowing country, as happened to Portrait of Wally in New York. To encourage loans, federal law has since 1965 allowed the State Department to grant immunity from seizure to objects of cultural significance imported for temporary exhibition by a nonprofit institution, upon publication of a notice in the Federal Register. Immunity from seizure does not, however, confer immunity from suit. In Malewicz v. City of Amsterdam, a federal district court in Washington held in 2005 that heirs of the Russian painter Kazimir Malevich could sue the city of Amsterdam over works lent to American museums, because the loan itself could supply the commercial connection required by the Foreign Sovereign Immunities Act. The case was later settled. Congress responded in the Foreign Cultural Exchange Jurisdictional Immunity Clarification Act of 2016, which provides that a foreign state's loan of a work for exhibition under an immunity grant is not, by itself, commercial activity sufficient to support jurisdiction under the expropriation exception. It carved out two important exceptions: claims concerning works taken by the Nazi government of Germany or its allies between 1933 and 1945, and claims concerning works taken after 1900 as part of a systematic campaign of coercive confiscation directed against a targeted group. Lenders thus have substantial but not absolute protection when they send works to the United States. Law and ethics converge The colonial and Indigenous cases expose a question the law of stolen art could previously avoid: what should happen to an object whose acquisition was lawful in its time but is now widely regarded as unjust? The traditional legal answer is that the law in force at the time of the acquisition governs, and later changes in moral judgment cannot unsettle title. That principle protects security of ownership, and it has real value. But it has come under pressure from the recognition that the law in force at the time was often made by the party doing the taking. The response in France, Germany, the Netherlands, and the United States has not been to overturn existing title retroactively through the courts. It has been to create legislative and administrative mechanisms that allow, or in the case of NAGPRA require, holders to return objects on the basis of criteria that include the circumstances of acquisition and the significance of the object to the claimant. Museums once argued, most prominently in a declaration signed by eighteen major institutions in 2002, that "universal museums" serving audiences from all nations were the proper custodians of the world's heritage. That argument has not disappeared, but it has lost ground. The balance of legal change over the past decade has been toward return, and toward a view of cultural property in which the holder's title is not the only interest the law recognises. Conclusion: The Paper Trail as Title Seen from a distance, the cases in this book can look like a miscellany: a forged Rothko in a Long Island garage, a Chagall that walked out of the Guggenheim, a Pissarro traded for an exit visa, a bronze emperor identified by the soil inside his torso, a stuffed eagle that the tax collector valued at $65 million. What unites them is that in every one the decisive question was not about the object's beauty or even its physical condition, but about what could be proved of its history. Authorship, provenance, and title are all historical claims, and the law increasingly insists that they be supported by evidence rather than reputation. What has changed Three developments stand out. The first is that private assurance has lost much of its authority. The foundations that once certified Warhols and Basquiats have stopped doing so, driven out by the cost of litigation. The major auction houses still stand behind their bold-type headings, but only for five years, only to the original buyer, and subject to exclusions that place the risk of changing scholarship on the purchaser. The Knoedler affair showed that a gallery's century and a half of reputation was no protection against forty fakes with an invented story, and the Rybolovlev litigation showed that a collector who does not pin down who is acting for whom may discover that no one was acting for him. In place of assurance, the market has turned to science, to contracts, and to documentation. None of these is infallible, but each can be tested in a way that a connoisseur's word cannot. The second is that the state has arrived. For most of the twentieth century the art trade dealt with governments chiefly at the border and at death. Today a significant sale may engage the sales tax authorities of New York, the sanctions officers of the Treasury, the anti-money-laundering supervisors of London or Brussels, the customs officers administering bilateral import restrictions, and the prosecutors of Manhattan. The instruments they use were rarely designed for art, from False Claims Act suits over resale certificates to civil forfeiture actions over misdeclared countries of origin, but they reach it all the same. The compliance apparatus that now surrounds a major auction sale is the product of legal exposure arriving from many directions rather than of any single statute. The third is that time no longer protects as it did. For Nazi-era claims in the United States, the Holocaust Expropriated Art Recovery Act of 2025 has removed laches, acquisitive prescription, the act of state doctrine, and comity as grounds for dismissal and made the discovery-based limitations period permanent. For antiquities, the 1970 threshold has become a hard line that responsible museums will not cross, and objects taken decades ago are being returned on the strength of evidence assembled from archives and laboratories. For colonial collections and Native American cultural items, legislatures in Paris, Berlin, The Hague, Brussels, and Washington have created procedures that allow or require return of objects whose acquisition was lawful when it occurred. The traditional assumption that long, peaceful possession eventually confers security has been substantially qualified. What remains unsettled Several important questions remain open. The limits of the new HEAR Act are untested. It bars a list of non-merits defences, but claimants still have to prove that a loss resulted from persecution, and the hardest cases, involving sales in the 1930s at prices that were low but not nominal by owners who later escaped, will turn on how courts understand duress. Whether the Act's provisions affecting suits against foreign states will survive constitutional and international challenges, and how courts will reconcile them with the Supreme Court's domestic takings rule, will be decided case by case over the coming years. California's legislative intervention in the Cassirer case raises the question whether states may change the governing law of pending cases to favour particular claimants, and the answer will matter well beyond one painting. The role of criminal process in contested ownership disputes has been thrown into doubt. The Manhattan District Attorney's office built a formidable repatriation practice on turnover orders under state stolen property law, and much of its success came from holders who surrendered objects rather than fight. The Appellate Division's decision in September 2026 that such orders are unsuitable for genuinely contested ownership disputes may push more cases into civil litigation, where the burden on the state is heavier and the process slower. Whether prosecutors will adapt by building more cases for trial, or whether the pace of returns will slow, is not yet clear. The regulation of money in the art market remains incomplete. Europe and the United Kingdom require art market participants to know their customers; the United States does not, and the rule that Congress required for antiquities dealers in 2021 has not been issued. Sanctions enforcement fills part of the gap, but the American market still permits a degree of anonymity that its European counterparts have abandoned. Authentication itself remains in an awkward legal position. Courts will not declare works authentic, experts are reluctant to opine for fear of suit, and the proposals to give authenticators statutory protection have not been enacted. Computational tools claim to offer an alternative, but their reliability has not been established to the satisfaction of courts or scholars. For some artists there is no longer any voice the market will accept, and works of uncertain status accumulate in a legal limbo. What follows for those who deal with art For collectors, the lessons are practical. Buy from sellers who will give a written statement of authorship and who will be solvent and reachable if it proves false. Read the auction house's glossary and conditions of sale before bidding, not after. Insist on documented provenance, with particular attention to the years 1933 to 1945 for European works and to evidence of export before 1970 for antiquities, and treat gaps and unverifiable stories as reasons to walk away rather than to negotiate a discount. Keep records of what was paid, when, and to whom; they will be needed for tax purposes, for insurance, for resale, and perhaps to defend title. Use appraisers who have no interest in the outcome. For museums, the implications are institutional. Provenance research is no longer a scholarly luxury but a legal necessity, and the museums that have invested in it have generally fared better, legally and reputationally, than those that waited for claims to arrive. Governing documents and deaccession policies should permit return where the law or the institution's ethics require it. Relations with source communities and claimants are increasingly the business of the director and the board, not only of counsel. For dealers and auction houses, the commercial logic is now aligned with the legal one. A work with a complete, documented history commands a premium precisely because it carries less legal risk; a work without one is harder to sell, harder to insure, harder to donate, and harder to defend. The market is, in effect, pricing provenance. The larger point is that the art market has been absorbed into the ordinary legal order. It retains its distinctive customs, its discretion, and its reliance on expertise, and it will continue to do so. But it can no longer treat the questions of who made a work, where it has been, and who is entitled to it as matters to be settled among insiders. Those questions now belong also to courts, legislatures, tax authorities, prosecutors, and the communities and families from whom objects were taken. A work of art, in law as in the market, is now worth what its history can prove. Notes Introduction 1. Art Basel and UBS, The Art Basel and UBS Global Art Market Report 2026, prepared by Arts Economics (March 2026). Chapter 1 1. Art Basel and UBS, Global Art Market Report 2026 (dealer, auction, and private sales figures for 2025). 1. Uniform Commercial Code sections 2-403 (power to transfer; entrustment) and 2-312 (warranty of title). 2. Winkworth v. Christie Manson & Woods Ltd [1980] Ch 496 (English High Court). 3. United States Senate, Permanent Subcommittee on Investigations, The Art Industry and U.S. Policies That Undermine Sanctions (staff report, July 2020). 4. Swiss Federal Act on the International Transfer of Cultural Property (Cultural Property Transfer Act), in force 2005. Chapter 2 1. Hahn v. Duveen, 133 Misc. 871 (N.Y. Sup. Ct. 1929). 1. Kirby v. Wildenstein, 784 F. Supp. 1112 (S.D.N.Y. 1992). 2. Lariviere v. Thaw (N.Y. Sup. Ct. 2000). 3. Simon-Whelan v. Andy Warhol Foundation for the Visual Arts, Inc. (S.D.N.Y. 2009) (order denying motion to dismiss). 4. Thome v. Alexander & Louisa Calder Foundation, 70 A.D.3d 88 (N.Y. App. Div. 1st Dep't 2009). 5. Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993); Federal Rule of Evidence 702 (as amended December 1, 2023). Chapter 3 1. Uniform Commercial Code sections 2-313 (express warranties) and 2-725 (statute of limitations). 1. New York Arts and Cultural Affairs Law section 13.01. 2. Rosen v. Spanierman, 894 F.2d 28 (2d Cir. 1990). 3. Sherwood v. Walker, 66 Mich. 568 (1887); Wood v. Boynton, 64 Wis. 265 (1885). 4. New York Civil Practice Law and Rules section 213 (six-year periods for contract, mistake, and fraud, with two-year discovery rule for fraud). 5. De Sole v. Knoedler Gallery, LLC (S.D.N.Y.) (settled February 2016); United States v. Rosales (S.D.N.Y.) (guilty plea 2013). 6. New York Penal Law section 170.45 (criminal simulation). 7. United States v. Philbrick (S.D.N.Y.) (sentence imposed May 2022). 8. Accent Delight International Ltd. v. Sotheby's (S.D.N.Y.) (jury verdict for Sotheby's, January 2024). Chapter 4 1. Internal Revenue Code sections 1(h) (collectibles gain), 408(m) (definition of collectible), 1221 (capital asset), 1411 (net investment income tax), and 1031 (as amended by Pub. L. 115-97, the Tax Cuts and Jobs Act of 2017). 1. New York State Office of the Attorney General, press release announcing settlement with Sotheby's (November 14, 2024). 2. United States Department of the Treasury, Study of the Facilitation of Money Laundering and Terror Finance Through the Trade in Works of Art (February 2022). 3. Directive (EU) 2018/843 (Fifth Anti-Money Laundering Directive); United Kingdom Money Laundering and Terrorist Financing (Amendment) Regulations 2019. 4. Anti-Money Laundering Act of 2020, enacted as Division F of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Pub. L. 116-283, section 6110; Financial Crimes Enforcement Network, advance notice of proposed rulemaking on anti-money-laundering regulations for dealers in antiquities (September 2021). 5. Office of Foreign Assets Control, Advisory and Guidance on Potential Sanctions Risks Arising from Dealings in High-Value Artwork (October 30, 2020). Chapter 5 1. Internal Revenue Code sections 170(e) (reduction for certain contributions of property, including the related-use rule and recapture), 170(f)(11) (qualified appraisals), 170(o) (fractional interests), 2031, and 2055; Treasury Regulation section 20.2031-1(b). 1. Pub. L. 119-21 (2025), commonly called the One Big Beautiful Bill Act (charitable deduction floor and limitation on itemised deductions; basic exclusion amount). 2. Internal Revenue Service, Rev. Proc. 96-15 (Statements of Value); Internal Revenue Service, Art Advisory Panel annual summary reports. 3. Estate of Kollsman v. Commissioner, T.C. Memo. 2017-40, aff'd (9th Cir. 2019). 4. Estate of David Smith v. Commissioner, 57 T.C. 650 (1972); Estate of O'Keeffe v. Commissioner, T.C. Memo. 1992-210. 5. Estate of Elkins v. Commissioner, 767 F.3d 443 (5th Cir. 2014). Chapter 6 1. Menzel v. List, 24 N.Y.2d 91 (1969). 1. Solomon R. Guggenheim Foundation v. Lubell, 77 N.Y.2d 311 (1991). 2. DeWeerth v. Baldinger, 836 F.2d 103 (2d Cir. 1987); DeWeerth v. Baldinger, 38 F.3d 1266 (2d Cir. 1994). 3. O'Keeffe v. Snyder, 83 N.J. 478 (1980). 4. Autocephalous Greek-Orthodox Church of Cyprus v. Goldberg & Feldman Fine Arts, Inc., 917 F.2d 278 (7th Cir. 1990). 5. California Code of Civil Procedure section 338(c) (as amended 2010). 6. Bakalar v. Vavra, 619 F.3d 136 (2d Cir. 2010); Bakalar v. Vavra (2d Cir. 2012) (affirming dismissal on laches). 7. Zuckerman v. Metropolitan Museum of Art, 928 F.3d 186 (2d Cir. 2019). 8. 18 U.S.C. sections 2314 and 2315 (National Stolen Property Act); 18 U.S.C. section 668 (theft of major artwork); 18 U.S.C. section 3294. 9. People v. Museum of Modern Art (In re Grand Jury Subpoena Duces Tecum), 93 N.Y.2d 729 (1999); United States v. Portrait of Wally, 663 F. Supp. 2d 232 (S.D.N.Y. 2009). Chapter 7 1. Washington Conference Principles on Nazi-Confiscated Art (1998); Terezín Declaration (2009); Best Practices for the Washington Conference Principles (March 2024). 1. Republic of Austria v. Altmann, 541 U.S. 677 (2004). 2. Federal Republic of Germany v. Philipp, 592 U.S. 169 (2021). 3. Republic of Hungary v. Simon, 604 U.S. ___ (2025) (decided February 21, 2025). 4. Cassirer v. Thyssen-Bornemisza Collection Foundation, 596 U.S. 107 (2022); on remand (9th Cir. January 2024); certiorari granted, judgment vacated, and case remanded (U.S. March 10, 2025); remanded to district court (9th Cir. April 30, 2025). 5. Holocaust Expropriated Art Recovery Act of 2016, Pub. L. 114-308; Holocaust Expropriated Art Recovery Act of 2025 (S. 1884), signed April 13, 2026. 6. Reif v. Nagy, 175 A.D.3d 107 (N.Y. App. Div. 1st Dep't 2019). 7. Von Saher v. Norton Simon Museum of Art at Pasadena, 897 F.3d 1141 (9th Cir. 2018). 8. Matter of Application for a Search Warrant (Art Institute of Chicago), 2025 NY Slip Op 50617(U) (N.Y. Sup. Ct. April 2025), rev'd (N.Y. App. Div. 1st Dep't September 2026). 9. Holocaust (Return of Cultural Objects) Act 2009 (UK); Holocaust (Return of Cultural Objects) (Amendment) Act 2019 (UK). Chapter 8 1. United States v. McClain, 545 F.2d 988 (5th Cir. 1977); 593 F.2d 658 (5th Cir. 1979). 1. United States v. Schultz, 333 F.3d 393 (2d Cir. 2003). 2. United States v. An Antique Platter of Gold, 184 F.3d 131 (2d Cir. 1999). 3. UNESCO Convention on the Means of Prohibiting and Preventing the Illicit Import, Export and Transfer of Ownership of Cultural Property (1970); Convention on Cultural Property Implementation Act, 19 U.S.C. sections 2601–2613. 4. UNIDROIT Convention on Stolen or Illegally Exported Cultural Objects (1995). 5. Regulation (EU) 2019/880 on the introduction and the import of cultural goods; Directive 2014/60/EU. 6. Association of Art Museum Directors, Report of the AAMD Subcommittee on the Acquisition of Archaeological Materials and Ancient Art (2008, as revised). 7. The J. Paul Getty Trust and Others v. Italy, European Court of Human Rights, judgment of May 2, 2024. 8. Manhattan District Attorney's Office, announcements concerning Michael Steinhardt (December 2021) and the repatriation of the Bubon bronze to Türkiye (2025). 9. United States v. Approximately Four Hundred Fifty Ancient Cuneiform Tablets (E.D.N.Y. 2017); United States v. One Cuneiform Tablet Known as the "Gilgamesh Dream Tablet" (E.D.N.Y.). Chapter 9 1. Agreement between the Federal Republic of Germany and the Federal Republic of Nigeria on the return of Benin Bronzes (July 2022). 1. British Museum Act 1963 (UK); Attorney General v. Trustees of the British Museum [2005] EWHC 1089 (Ch). 2. Felwine Sarr and Bénédicte Savoy, The Restitution of African Cultural Heritage: Toward a New Relational Ethics (report to the President of France, 2018). 3. French Law No. 2020-1673 of December 24, 2020 (return of cultural property to Benin and Senegal); French framework law on the restitution of cultural property from colonial contexts (2026). 4. Native American Graves Protection and Repatriation Act, 25 U.S.C. sections 3001–3013; Department of the Interior, final rule revising the NAGPRA regulations (published December 2023, effective January 2024). 5. Safeguard Tribal Objects of Patrimony Act of 2021, Pub. L. 117-258 (2022). 6. 22 U.S.C. section 2459 (immunity from seizure); Foreign Cultural Exchange Jurisdictional Immunity Clarification Act, Pub. L. 114-319 (2016). 7. Malewicz v. City of Amsterdam, 362 F. Supp. 2d 298 (D.D.C. 2005). Further Reading Ralph E. Lerner and Judith Bresler, Art Law: The Guide for Collectors, Investors, Dealers, and Artists** (Practising Law Institute, multiple editions). The standard American practitioner's treatise, covering sales, auctions, authentication, taxation, and stolen art in detail. The place to go when a question needs a fuller answer than a short book can give. John Henry Merryman, Albert E. Elsen, and Stephen K. Urice, Law, Ethics and the Visual Arts** (Kluwer Law International, 5th ed. 2007). A casebook and anthology that remains the best single introduction to the intellectual debates of the field, including Merryman's influential distinction between "cultural nationalism" and "cultural internationalism." Patty Gerstenblith, Art, Cultural Heritage, and the Law: Cases and Materials** (Carolina Academic Press, 4th ed. 2019). A comprehensive casebook by a leading scholar of the antiquities trade, particularly strong on the UNESCO Convention, the Cultural Property Implementation Act, and the McClain doctrine. Peter Watson and Cecilia Todeschini, The Medici Conspiracy** (PublicAffairs, 2006). A journalistic account of the investigation into Giacomo Medici's network and the trail of looted Italian antiquities into American museums. Essential background to the returns of 2006 to 2008. Jason Felch and Ralph Frammolino, Chasing Aphrodite: The Hunt for Looted Antiquities at the World's Richest Museum** (Houghton Mifflin Harcourt, 2011). The story of the Getty Museum's antiquities acquisitions and the prosecution of Marion True, told by the reporters who covered it. Lynn H. Nicholas, The Rape of Europa: The Fate of Europe's Treasures in the Third Reich and the Second World War** (Knopf, 1994). The standard history of Nazi looting and Allied recovery, and the necessary foundation for understanding modern Nazi-era claims. Anne-Marie O'Connor, The Lady in Gold: The Extraordinary Tale of Gustav Klimt's Masterpiece, Portrait of Adele Bloch-Bauer** (Knopf, 2012). A narrative history of the painting at the centre of Republic of Austria v. Altmann. Dan Hicks, The Brutish Museums: The Benin Bronzes, Colonial Violence and Cultural Restitution** (Pluto Press, 2020). A forceful argument for restitution by a curator at the Pitt Rivers Museum in Oxford; a counterpoint to the "universal museum" position. Felwine Sarr and Bénédicte Savoy, The Restitution of African Cultural Heritage: Toward a New Relational Ethics** (report to the President of France, 2018; English translation available online). The report that reshaped the European debate over colonial collections and led, eventually, to France's framework legislation. Ronald D. Spencer, ed., The Expert versus the Object: Judging Fakes and False Attributions in the Visual Arts** (Oxford University Press, 2004). Essays by scholars, dealers, scientists, and lawyers on how authenticity is actually determined and how the law treats the experts who determine it. Art Basel and UBS, The Art Basel and UBS Global Art Market Report** (annual, prepared by Arts Economics). The most widely cited source of data on the size and structure of the art market. Online resources. The International Foundation for Art Research (IFAR) publishes summaries of art law cases and maintains a catalogue raisonné database. The Center for Art Law publishes accessible commentary on current litigation. The Commission for Looted Art in Europe and the German Lost Art Foundation maintain databases and news on Nazi-era claims. The American Alliance of Museums' Nazi-Era Provenance Internet Portal lists objects in American collections with gaps in their provenance for 1933 to 1945. Hashtags: #ArtLaw #CulturalHeritage #CulturalHeritageLaw #ArtForgery #ArtAuthentication #ArtProvenance #ProvenanceResearch #ArtRestitution #CulturalProperty #CulturalPropertyLaw #StolenArt #NaziLootedArt #HolocaustRestitution #ColonialRestitution #RepatriationOfArtifacts #AntiquitiesTrafficking #IllicitArtTrade #ArtMarketRegulation #ArtFraud #ArtCrime #ArtLitigation #ArtOwnership #PropertyRights #ArtMarketDueDiligence #MuseumEthics #MuseumLaw #InternationalCulturalHeritage #ArtValuation #ArtTaxation #ProtectingCulturalHeritage