I wouldn't say it's really an AI talk. It's more like a dirty talk.
So, 2025 is the year of LLM crawlers' DDoSing the internet.
In 2022, these companies were still more or less a bit shy,
and they tried to hide themselves behind Common Crawls.
Like LAION, who used Common Crawl for their data sets, said that they followed
the practice of Common Crawl, and Common Crawl followed the users' robots.txt.
So, users basically consent to this crawling and no problem.
When I read this two years ago, I thought this was terrible, but who would guess?
In today's standard, it's already pretty decent.
And in 2023, Common Crawl was used gymnastically with GitHub codes
and with all the books, they can put their hands on, plus Wikipedia,
and then they take those web data sets into their own subsets.
Last year and this year, AI companies crawled the web themselves.
And Meta, most likely other companies, crawled the fediverse.
And smaller servers got overwhelmed by LLM crawlers, and
everyone wastes our time to prove we're not a damn crawler.
And these are. One, two.
So, they basically used this web crawl data for pre-training their models, right?
But before that, they needed to do a lot of cleaning for this big amount of mess.
And here are four data sets that are based on Common Crawl.
New Common Crawl dump is released around every month,
and each dump contains more than 2 million web pages.
It could range between 200 to 470 terabytes.
And usually one data set uses multiple Common Crawl dumps.
So, the size is pretty crazy.
Obviously, even if tech companies outsource this data cleaning to data workers in
cheap labour markets, like they used to do for more task-specific model training.
But this is another very problematic topic.
But even if they do so, how much time and money would it cost to inspect through all of it?
I followed this paper.
The most expensive part of an LLM should be its training data.
The authors took a very speculative approach.
They calculated how much it would have cost if humans actually needed to sit
down and type out all this data, like 1.6 terabytes of text or something.
So, I also did my back of envelope calculation.
And if we take the fast reading speed, 250 words per minute,
five seconds for an image, 10 seconds for comparing the image
and the text if they match, this is already unrealistically fast.
But the post-cleaning, it's already cleaned.
The post-cleaning RefinedWeb will take 1 ,000 people 15 years to inspect through.
Of course, tech companies wouldn't willing to pay this amount
of time and money for just data processing for pre-training.
So, with the belief of scale, well, average out noise, they go for this human not
in the loop, cheaper-than-cheap-labor method, heuristic filtering for this step.
I was totally intrigued by how arbitrary these heuristics are,
but I couldn't find much discussion back then in 2023 online.
So, I went through some extraction -based open data sets technical paper
and collected my own data set of data sets and their filtering heuristics.
In this paper-based calculation, this was not a good choice.
Those data sets deprecates faster than my book making.
So, 10 minutes before printing, I was still updating
the current conditions of certain data sets.
Like, this data set got taken down because it includes book 3. And that data
set was taken down yesterday because it contains a large amount of CSAM.
So, the minute it's printed out, it already felt like a
media archaeology, at least in so-called AI's time scale.
So, in 2023 and the beginning of 2024, I looked into these data sets.
The diagram is arranged by the releasing time of
those data sets and their content composition.
The guy in the bottom, the Common Crawl and the WebText technically don't belong here.
Common Crawl is not filtered and WebText from OpenAI is not open.
But a lot of other data sets are based on them, so I still add them here.
And then, in this year, was, I suppose, from Error 406 [Tech Fascism] Not Acceptable.
I expanded this research and added more recent data sets.
Surprisingly, with a one-year gap in between, there was
not big missing outs regarding the method of filtering.
Of course, this could be that this process is getting less and less visible.
And from this cascading structure, you could also see that a lot of new data
sets are just a collection or a new filtering of smaller, older data sets.
Or at least like referring to their data processing methods.
So, let's start with a very basic question. What is a heuristic?
If you are from engineering background, maybe most of you
are, you might be familiar with this problem-solving approach.
I am not. And this is an artistic research. It's a late disclaimer.
So, if I were to explain it, it's basically a set of rules of estimation.
And when asked why, you just get a shrug back.
I also took the definition from Wikipedia.
A heuristic is "a pragmatic method that is not fully optimized, perfected,
or rationalized, but is nevertheless 'good enough' as an approximation.
This is achieved by trading optimality, completeness, accuracy, or precision for speed."
I have big question mark on the good enough. Good enough for who?
Good enough for tech companies have this tedious cleaning done fast? For sure.
Heuristic filtering might seem like a practice when there's big data.
When I'm saying big data, I already feel like I'm from Stone Age.
Now, data is no longer big. They're only large.
Anyways, heuristic is not only a machine learning thing.
In 1939, the U.S. Bureau of Home Economics needed to build
a standardized sizing for women for catalogue shopping.
But there was not enough data, so the bureau had to hire
women across the country to go in to these measuring squads.
And then in those measuring parties, the women would wear the government
issued bras and underwears, have their body measured in 59 different ways.
Ruth O'Brien, the head of textile and clothing division, wrote in her book that
they measured all the women presented for the sake of good feeling within a group.
But then they marked the race and erased all the data from non-white women later.
And this is their approximation to affect our purity or a heuristic in this sense, right?
This example might sound like from, you know,
like, way back in dark era that we have passed.
But if we could make it for another 80 years on this planet, and data
sets heuristic filtering might also sound like this to future people.
I would like to give a warning for the next part.
I'm going to show you some heuristics dealing with data has been
categorized as dirty, naughty, obscene, pornographic, offensive,
or otherwise bad by someone, though it may or may not be.
And if it gets too intense, just close your eyes and maybe scream
shortly, and then I will let you know we have moved to the next page.
Okay? So how are these filtering heuristics like?
They usually look like short statements like this
in bullet points, especially in previous years.
Now they tends to have more discussions and reasonings around them.
And these heuristics almost always has "We"s in them.
I find it interesting that data sets appears to the public in 2025 still.
Like, they exist naturally in the wild.
Like, we drop some data on the floor when we move our eyes.
And then those companies just come and pick them up.
But then when you read how they're actually built, a data set is also a record of
hundreds of highly subjective, if not objectively bad, decisions by those "We"s.
What are these heuristics trying to remove?
Let's first have a look what makes most of it.
According to The Pile, a data set from E leutherAI, they calculated 13-grams across
common crawl dumps they used. 13-grams, you can imagine it's a sliding window.
It always take 13 tokens at once.
And if you were in last night's talk from Ting and Leon you know what a token is.
So it, like, moves one token at a time.
And the most frequently occurred 13-grams is dash dash space dash dash for styling.
It occurred 11 million times. As well as some boilerplate like this.
"select the forum you want to visit from the selection below"
It's repeated for 180,000 times.
So, basically, for texts, they targeted automatically generated content
like boilerplate error messages, like the phrase cookie policies,
or adding to shopping cart, plus SEO keywords, or basically anything
that is generated for search engine rather than for human audience.
And duplicated content, a lot of them.
Of course, pornographic and otherwise bad stuff.
This type we will talk in a little bit.
So, for the first three types, they got pretty
interesting angles to make those texts pure and average.
They tried to remove pages containing curly brackets because
they are not used in natural language but is used a lot in code.
And then they calculate the ratio of closed class
words like "the", "be", " of", "that", "to", et cetera.
Because they are an indicator of non-human generated content.
Or basically, imagine a SEO page would have very little of them.
As well as punctuation marks. They are the symbol of word composition.
Too many sentences ending with ellipses. Not qualified.
Or sometimes they try to find a reference point.
Here, OBELICS from Hugging Face used OSCAR, a version of cleaned Common Crawl.
But usually, they use Wikipedia as a golden reference point.
If one word appears there twice, then it must be a normal word.
And for codes, they try to remove:I will go through it fast.
They try to remove documents with few or a lot of comments.
They remove the license statements in the document.
They remove super long lines or if a line is mostly digits.
They remove repository has no or very few stars.
And they wanted to remove generated code. Not necessarily vibe coded code.
But it could be like a generated diagram for the architecture of the code or stuff.
If you go through some of the data sets, you'll notice that these
years, almost all the code subsets are from Stack V1 and V2.
And there was a cleaning pipeline from StarCoder and RedPajama.
The Stack says that they use only permissive licensed code from GitHub but I doubt it.
Because I found my own repository there. It was my old personal website.
And I was too lazy to set any license.
So it should be, you know, by default copyrighted
and should not be included in their data sets.
For filtering images, the main focus are the size, resolution, image ratios.
Too small is not good. Can be icons and logos.
Too far away from squares, not good. Can be banners for ads. Too big is not good.
It can be [unintelligible].
And the last category, we will talk together later with the text part.
So, sometimes, apart from the image size and ratio, amount also matters.
OBELICS doesn't include any web page which has more than 30 images in one page.
And some data sets also filter with image URL.
So, basically, if your image name contains any words including logo, button,
icon, plugin, widget, porn, sex, XXX, in the image, they will get removed.
Okay. Now, we're finally here for pornographic and otherwise bad text and image.
I didn't make this into two categories, but for some
reason, porns are always separated from otherwise bad stuff.
And if you go through several data sets, heuristics, you'll notice that for
pornographic content, they might spend five paragraphs to elaborate their methods,
experiments, decisions, considerations, and then for otherwise bad stuff, one sentence.
So, this type of content is usually filtered with
block lists and classifiers, plus some esoteric stuff.
For the block lists, quite a lot of data sets, including
ROOTS from BigScience, that is a quite nicely composed one.
They filter their data sets with keyword-based block lists.
But like most of other data sets, they don't reveal what list they actually used.
And the most direct and controversial one must be Google's C4. They
used this infamous block list, the list of dirty, naughty, obscene, and
otherwise bad words for removing offensive language from their data sets.
I guess many of you might have heard this block list.
It was initially created by a group of programmers in Shutterstock
in 2012 to prevent bad words to auto-complete in their search bar.
And they were basically racking their brains and
googling for any sexual slangs they could find.
And then, as you can imagine, it ended up as a
horrible list, both in content and in perspective.
The worst thing is people get inspired, and now this
list exists in 28 different languages on GitHub.
According to an interview to one of the C4 builders by Will Orr, this person
said that the team didn't want to impose their own idea of good web content.
They also knew it's a tremendous responsibility, and using an existing list
allowed them to share or defer the accountability to anonymous users of that list.
Thanks to this list, those cuties are not in C4 and the data sets using
C4's heuristic, unless they're referred to with their passport names.
And this dirty list or dirty, naughty, something list
also contains a lot of gender -related neutral words.
Kind of reminds me of this Copilot fuckery that they will stop auto
-completing when you remotely mention any gender-related words in your code.
I don't know if it's there like this.
I refuse to use Copilot, but at least in this July, people
are still posting furious comments under this thread.
And this is another example, again from Google.
It's from Google's MADLAD-400, a multilingual data set for translation.
And it is also based on Common Crawl.
When they was handling Mandarin data part from Common Crawl,
they found it has a particular issue with pornographic content,
so they made this words plus Unicode list for filtering porns.
I was quite curious what they come up with, so I converted this Unicode
back to Mandarin, and it turns out it's just a bunch of porn sites' names.
And I don't have better ideas, but I still think it's a really fat job.
But even like this, it filtered out more than 56% of the total size. I know.
Mandarin web is wild.
And another format of block lists is URL-based blocking, including
using existing URL lists or trying to find bad words in the URL.
For existing lists, so many, I don't know, quite major data
sets, like RefinedWeb's, as well as Dolms from Ai2, FineWeb
from Hugging Face, Red Pajama, and maybe Llama3 also.
They all use this UT1 list. UT1 list is from a French university.
It's a block list managed by one person over the
years to regulate many schools' internet use.
And then they wrote on this block list, this should not be seen
as a block list to be blocked, but a categorization of web.
But somehow it has become the industrial standard for cleaning web crawl data sets.
Again, those data set builders bet almost the whole public web's porn
content on this one-person single -handedly maintained bookmark-like list.
Okay.
The last example of filtering with block lists is not
exactly a block list, but it's a quite interesting choice.
The Pile, which was used to train a lot of major models several years ago.
It has been taken down because it includes Books3,
which includes a lot of books from shadow libraries.
The Pile decided not to include three data sets in particular.
The first one, short fan fictions from AO3 and Fanfiction.net.
The second one, the literotica, a website hosting erotic stories and audience.
And the third one, US congressional record.
So, filtering with classifiers is another popular option to remove dirty data.
A lot of data sets don't try to gloss it over and
don't mention what exactly detector they used.
And a lot of data sets basically come up with not safe for work detectors.
But this time we don't have time to go into this.
It can be another chapter by itself.
The Pile and the RefinedWeb use similar detectors trained from Wikipedia comments.
Wikipedia has been the guy, like, when it comes to good
English or toxic English, they always go to Wikipedia.
But the Wikipedia comments trained this profanity checker. It's built for English.
And then The Pile noticed that whenever there's a German text
popping up, the definite article "die" is always flagged as profane.
And then MassiveText from DeepMind, or basically Google, used
to train Gopher, it's a very often referred heuristic source.
They didn't even bother to find a classifier to use.
They just used Google safe search filter.
They described that safe search incorporates various web signals to
identify explicit content with reasons that a block list like C4 used could
disproportionately filter out inoffensive content associated with minority groups.
Which is very true. But is Google safe search any better?
In Monea's paper, I know it when I see it, the heteronormativity of Google safe search.
She described Google safe search as straight.
It started as a text-based pornographic detector and
then later it was trained on WordNet and ImageNet.
If you still remember this critical reflection from seven years ago.
So, before I can decide if Google safe search or the naughty
list is worse, new open data set has dropped, and they are
already using LLMs to rate the toxicity of training data.
And then try to train a classifier from this LLM generated whatever annotation.
And then use this classifier to clean the data for training another LLM.
They will just never stop finding ways to build
up unopenable black box on top of each other.
So, it's an extra part.
A saying something but at the same time saying nothing style heuristics.
Wikipedia-based text, image data sets.
Also, again, from Google, they seemed not quite sure what they needed to remove.
So, they were aiming for remove "pornographic, profane, violent, and dot, dot, dot content."
But even though they don't know what they're talking about anymore,
they still managed it with their "multiple techniques based on
sophisticated image understanding, multilingual understanding models."
All right. And WuDao, it was once the largest Chinese text corpora.
I was thinking about referring to the newer ones, but the
newer ones was just filtering with keywords block lists.
So, I just sticked with it, at least it was somewhat politically honest.
So, WuDao removed dirty words.
This we know, more than 50 words are dirty words from Mandarin Web, right?
So, and then they also tried to remove seditious comments and other illegal comments
has adverse effects on building a harmonious and positive social environment.
Does this sound familiar to you? Definitely sounds very familiar to me.
And two years later, in 2023, Beijing released the interim measure
that requires artificial intelligence must demonstrate core
socialist value and have to be in line with CCP's political ideology.
But in this case, only working with training data is not effective for censoring.
Most efforts are in the reinforcement learning from human feedback after training.
I mentioned that I kind of worked on this project a bit more this year.
There's another aspect I'm working on at the moment.
Now that we have no way to know how large language models from big
companies are trained from their data sets or how their data set is cleaned.
But it would be surprising if they don't refer to any existing cleaning methods, right?
And if we partially know how they filter the data set, doesn't that mean that
we can follow those rigid estimations and make our data too dirty to be trained.
Or if we know how unwanted data look like, can we develop our own
heuristics to make our data look similar to that and create an opt-out
method for ourselves when it's not possible to get it from big techs.
So I put these heuristics online and developed a set
of anti-heuristic heuristics to make our data dirty.
*Applause*
I also made this online dirtying tool together with Lotash Duva, who is also here today.
With a dirty meter, you could choose how dirty your data should be.
I just said made, but it's actually still under active change and development.
And I would like to know how you think, your feedbacks, and if you have any
insights or business secrets to share regarding this filtering heuristics.
Thank you very much. And you can scan the QR code to get to the website.*Applause*
Thank you so much for this great talk. That was interesting and fun.
And I have some new ideas for art projects.
And I hope you also have some new ideas for other things.
And now we have 10 minutes of time for Q&A and to further discuss.
Do I see any question coming up here? This is a question? Okay.
So could you come up to mic number 4?
Question: Hi. Thank you very much for this talk.
It's super interesting and unsettling, which is great.
I was wondering if one wants to build a data set that is more representative and
less heteronormative and arbitrarily, well, against all sorts of diverse content.
How would one approach this?
jiawen: I have no idea.
To be honest, I don't think it's possible, at least for, like, general purpose model.
How is it possible that you could remove all the bad stuff from a data set
with, I don't know, like, for every aspect, for every culture, for every person?
So I think the problem is, like, in the practice
of trying to build such general purpose model.
Yeah, thank you. And assuming that there's, like, one right thing.
And yeah, thank you so much.
jiawen: Yeah, I think people are still trying to search for it.
But I doubt they will find.
Herald: There's another question at mic number 1.
Question: Have you seen the attempt to only collect the dirty data?
Because some companies right now try to monetarize pornographic content, for example?
jiawen: There must be a lot of efforts to collect only dirty data, but they are never published.
I saw so many companies develop their own models that are trained from these data.
And I very, like, I look forward very much to see a data that is, you
know, like, not common, but, like, uncommon corpus, that is a collection
of unethical data, just for people to get an idea, rather than just
try to hiding this, hide this part up, and just show the result.
Herald: There's another question at mic number 4.
Yeah, hello. Thanks for the great talk. Interesting perspective on how it's done.
I thought it would be much less old-style statistical information
processing, like heuristics, and much more neural network processing.
It looks like it's different.And my question is how this is going to change?
I once viewed a YouTube video about some paper called AI 2027, I guess,
which tried to predict how AI will develop in the future, and what do you
think will change about the methods in cleaning up data in this regard?
jiawen: I hope AI won't develop in the future.
And I can only say that my current observation is people are
still using very similar heuristics, but instead of taking
this heuristic as it is, they try to calculate the percentage.
Like, for example, if you take the heuristic, people
take the punctuation mark as a good composition sign.
Now they don't use it directly.
They take this and then try to calculate how much percent
of the sentence in this document match this pattern.
And if it's larger than a certain threshold, they remove it.
So it's trying to get a little bit less arbitrary by, you know, try
to not like, yes, it is, whatever it is, it is, and then remove it.
Maybe it's very confusing.Maybe I'll explain it in a little bit.
At least it's complex.I don't know how confusing it is.I'm not so deep into it.
But is it really completely removed from training or is it just weighted that way?
So with a different factor, so the training can
access this and also train on maybe not so good data?
jiawen: Can you repeat the question again?
Question: Is it possible that not everything that is flagged bad is being removed from
the training, but weighted in the training or flagged with additional parameters
so the training algorithm can access the Einschätzung, the — how is the word?
Herald: Okay.
Question: Yeah. Okay. I think it's going to be complex.
Herald: Maybe you can have a discussion about this later?
Question: Yeah. Yeah. Sounds about right.
Herald: Because I feel like this is getting fuzzy.
Question: Okay.
Thank you.I had a question from the Signal Angel and I don't see the signal.
There's the Signal Angel.Yes. What does the internet say?Okay.
Question: Thank you. The internet wants to know, have you looked at
any training data from image and video generating models?
jiawen: Not really, because those models sometimes they don't say
what they are trained and sometimes they take — how to say, I
didn't look at this model by model, but data set by data set.
So I can only look at what this data set is used to
train, rather than what this model is used to train.
And what I covered so far, I think some diffusion models like unstable
diffusion stuff, but I didn't look too much into the video generation.
Herald: There's another question on mic 2 now.
Hi.Thanks so much for this talk.I really, really appreciated and enjoyed it.
I was wondering now, because I also looked into what is being
excluded from this training through these automatic means.
And there is a paper that explains how C4 also filters anything that in any
way refers to LGBT content, anything that's migrants, anything that's kind
of potentially somehow not a white — I don't know — privileged perspective.
And that is now the models we have for free on the internet.
And while I find super important that what you present here as a way to
kind of opt out, I'm wondering, how could we also do you have any ideas?
How could we systematically also make their data more dirty so that
it doesn't actually work for kind of inflating this perspective?
Because in the end, we are still living next to this model
that's growing and getting somehow more and more fascist.
And we don't, yeah, opting out is not enough somehow.
jiawen: Yeah, I know what you mean.
There are quite a lot of efforts trying to feed garbage data to AI, but I think
with current methods, most of them will actually get filtered out afterwards.
And I personally don't have a better idea to poison AI in this sense.
I think what we could do at the moment is try to get less involved with it.
Yeah, there are a lot of other things that we could pay our attention to.
Herald: We have one more minute for one last question.
If you could be short, then we have some time for an answer.
Question: Okay. Hi.
If I wanted to change every second word on my website into Fuckbutton, but not have
human readers, like, have to bother with this, do you have ideas on how to do that?
Or do we just have to get used to ignoring these
words for the sake of not becoming training data?
jiawen: You can set it to invisible in CSS, because the
crawls mostly read the code from HTML and CSS.
And it could, like, make only the crawlers read it.
And another approach I was trying to do that is not actually — okay, it's
not really relevant, but you can just play with the structure of HTML and try
to let them mismatch, and then they will make the crawler confused, maybe.