We Can Look Up Anything. We Can Verify Almost Nothing.

Ask a search engine or a chatbot almost anything, and an answer arrives within seconds, delivered with the serene confidence of someone who has never once been wrong. Finding the report behind it, the dataset, the expert who might actually know, can cost hours, a foreign tongue, or money most people simply do not have. This is no mere technical inconvenience, but a redistribution of power, built into every search box and chat window we now take for granted. Convenience, it turns out, was never free. We have only grown skilled at forgetting what we paid for it.

Consider a landmark 2024 study in Nature [2]: those who searched online expressly to disprove a false story often finished more persuaded of it than when they began. The effect was strongest among those who wandered into what researchers term “data voids,” those corners of the web where unreliable sources dominate. The advice we hand out so freely to teachers, fact-checkers and anyone who will listen—simply to “look it up”—presumes an internet considerate enough to have an answer worth finding. It does not always oblige. 

Yet the picture is not uniformly bleak. A 2025 study in Nature Human Behaviour [3] found that people who spent two weeks deliberately following news outlets on Instagram and WhatsApp, rather than accounts devoted to culture or cuisine, grew measurably better at telling truth from falsehood. There is no contradiction here, only the same mechanism showing its other face: what shapes judgment was never the internet in the abstract, but the particular sources that reach us, and what we make of them. And yet it sharpens a question we rarely ask: who decides which sources reach us at all?

It gets worse before it gets better, and it is no longer only a laboratory result. Researchers reported last year in Nature Medicine [4] that they had corrupted a medical AI model by poisoning a mere 0.001 percent of its training data, one million snippets of text lost among one hundred billion, with vaccine misinformation. That trace of contamination raised the model's harmful medical answers by nearly 5 percent, and no standard safety check caught it. Nor was it the first such demonstration: in 2023, researchers had already edited an open-source model's weights to plant one false fact, uploaded it to a public repository under a name one letter short of a trusted publisher's own, and watched it clear a safety benchmark within a tenth of a point of the original [9]. 

Security researchers have since given this a name and a place in a formal taxonomy, model poisoning and supply-chain compromise, catalogued by frameworks such as MITRE's ATLAS [9] and OWASP's own list of risks to language-model applications [10]. It is the same class of attack behind the SolarWinds breach [7], now turned against what a machine learns rather than the code it runs. The lesson is not that any single chatbot stands accused, but that an attacker no longer needs to falsify the answer we see. It is enough to poison the well it is drawn from, upstream, where oversight seldom looks.

There is a newer wrinkle, too, stranger still. An analysis of 2.2 million citations across more than 56,000 AI, machine-learning and security papers, presented this year at a major security conference [5], found that roughly one in a hundred pointed to a source that either did not exist or said nothing of the kind, a trend traced to the rise of AI writing tools. A footnote exists to be checked. Increasingly, it is only another claim dressed in the costume of proof.

None of this falls evenly, either. Roughly 2.2 billion people remain offline, the International Telecommunication Union reports [6], and barely 23 percent in low-income countries are connected, against 94 percent in wealthy ones. But connectivity is the smaller half of the problem now. The larger half is the question of who owns the archives, the indexes and the infrastructure of verification itself, all of which are concentrated overwhelmingly in a handful of countries and companies, regardless of where the user happens to be.

It is, as usual, the wrong problem solved with great sincerity. We treat verification as a personal virtue: more media literacy, more critical thinking, more caution before sharing. Diligence matters, yet it cannot do the work alone. Three news sites confirming a claim can be three copies of one press release, not three independent checks. A quiet correction leaves the falsehood standing long after it has been disproven on paper. Nor does individual caution repair a search result built around a data void, or a training set surreptitiously poisoned. For when the only evidence for or against a claim comes from the party in question, no reader, however vigilant, can hold it to account. This is not a literacy gap, but a governance gap, precisely the kind that decides whether a public agency, a corporation or a government can be made to answer for what it says.

Better, perhaps, to reframe the problem in the language of cybersecurity, for that is what it has insidiously become. Security teams learned, after a string of supply-chain breaches, to trace every component's provenance: who built it, who touched it, what changed, and when. Information now calls for the same discipline. A claim untraceable through a chain of custody, unsigned, or derived from unaudited training data, remains functionally unverifiable, however confidently delivered. Nor is the technology lacking: the Coalition for Content Provenance and Authenticity [8], backed by companies from Adobe to the BBC, has built a tamper-evident standard showing where a photograph, a document or a dataset originated, and what happened to it since. What is missing is not the tool but the will to make its use routine, and the cross-border cooperation among governments, platforms and standards bodies without which a credential issued in one jurisdiction means nothing in another.

Closing this gap means treating the infrastructure of verification as the public good it truly is, not something any single actor could build alone. It means funding archives independent enough to outlast a company's own redesigns, so a deleted page, or a quietly amended statistic, can still be recovered. It means audit trails sturdy enough to survive a change of management, or of government. And it means, above all, legal protection for the journalists, researchers and whistleblowers who chase down primary sources, since none of the rest matters if the people doing the checking can be silenced or exposed for it.

None of this, admittedly, guarantees that anyone arrives at the truth. Authenticity and truth are not, after all, the same thing. A cryptographic signature may tell us a document hasn't been tampered with, yet nothing of whether it is right. To be authentic is not to be honest, a distinction the well-forged document knows better than we do. What such an architecture guarantees is something humbler, and more essential still: the chance to check.

The Universal Declaration promised a right to seek and receive information. It said nothing of the tools required to interrogate it. Eighty years on, that silence has hardened into a policy gap that democracies and the institutions asking their citizens for trust can no longer afford to leave unanswered. The right to know is a fine thing. It becomes a dangerous illusion the moment it is mistaken for the right to be believed.

Sources

[1] Universal Declaration of Human Rights, Article 19 (United Nations, 1948). https://www.un.org/en/about-us/universal-declaration-of-human-rights

[2] Aslett, K. et al. (2024). “Online searches to evaluate misinformation can increase its perceived veracity.” Nature, 625, 548–556. Five experiments on online search and the perceived credibility of information. The results do not mean that verification in general reinforces false beliefs, only that it can, under specific conditions of source quality. https://doi.org/10.1038/s41586-023-06883-y

[3] Altay, S., Hoes, E., and Wojcieszak, M. (2025). “Following news on social media boosts knowledge, belief accuracy and trust.” Nature Human Behaviour, 9, 1833–1842. Preregistered field experiment comparing participants who followed media accounts to those who followed cultural or culinary accounts. It complements the Aslett study above without replicating its protocol, one measures a single search, the other a sustained two-week habit. https://doi.org/10.1038/s41562-025-02205-6

[4] Alber, D. A. et al. (2025). “Medical large language models are vulnerable to data-poisoning attacks.” Nature Medicine, 31, 618–626. An experimental demonstration of a data-poisoning vulnerability. It establishes that a model can be compromised this way, but it does not, and does not claim to, estimate how often such compromises occur in systems already deployed. https://doi.org/10.1038/s41591-024-03445-1

[5] “GhostCite: A Large-Scale Analysis of Citation Validity in the Age of Large Language Models,” presented at the IEEE Symposium on Security and Privacy, 2026. A preprint analysis of 2.2 million citations in AI, machine-learning and security conference papers, 2020–2025. The roughly one-in-a-hundred invalid-citation rate applies to that specific corpus, not to scholarship generally, and an invalid citation does not by itself prove AI involvement in producing it. https://arxiv.org/abs/2602.06718

[6] International Telecommunication Union (2025). Facts and Figures 2025. The ITU's own analysis notes that the digital divide is increasingly defined by speed, reliability, cost and skills rather than by connectivity alone. https://www.itu.int/itu-d/reports/statistics/facts-figures-2025/

[7] CISA, Advisory AA20-352A, “Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations” (the SolarWinds Orion supply-chain compromise). Cited here as the reference case for supply-chain attacks generally, not as a claim that AI training-data poisoning and the SolarWinds breach share an attacker or method. https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a

[8] Coalition for Content Provenance and Authenticity (C2PA), founding announcement. Cited as evidence that tamper-evident content-provenance standards exist and are backed by major industry players, not as a claim that C2PA is universally adopted or solves attribution on its own. https://blog.adobe.com/en/publish/2021/02/22/adobe-continues-content-authenticity-commitment-founder-c2pa-standards-org

[9] Mithril Security, “PoisonGPT: How We Hid a Lobotomized LLM on Hugging Face to Spread Fake News” (July 2023). The demonstrated technique, editing a model's weights with Rank-One Model Editing and distributing it under a name mimicking a trusted publisher, is catalogued as case study AML.CS0019 by MITRE's ATLAS framework for adversarial threats to AI systems. A proof-of-concept, not an attack observed in a deployed system: it shows that this method can evade a period-appropriate safety benchmark, not that it has compromised models currently in production. https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/  MITRE ATLAS: https://atlas.mitre.org/

[10] OWASP, “Top 10 for Large Language Model Applications,” 2023/24 edition, LLM05: Supply Chain Vulnerabilities. A practitioner-consensus risk catalog, not a prevalence study: it establishes that data poisoning and supply-chain compromise are recognized categories of risk for LLM applications, not how often either occurs in systems already deployed. https://genai.owasp.org/llmrisk2023-24/llm05-supply-chain-vulnerabilities/