The words spoken in the Unit 17 video, scene by scene, as its captions show them, with what the animations show marked [On screen: ...] where they play. Each speaker is named where the speaker changes. The Unit 17 reading covers the same material.
The narration is spoken by synthetic voices made for this course, each shown on screen as a drawn robot. No person is speaking.
Unit 17 — Defence, disclosure, and responsible use
Narrator: This unit closes the loop, from generating work to being answerable for it. It starts with two sentences about the same piece of work. They answer different questions.
Two sentences, two questions
Two sentences a learner might write. First: "Parts of this were drafted with AI assistance." Second: "This is correct because I checked it against values I derived myself, and here is what the check showed." The first is a disclosure. It answers how was this made. The second is a defence. It answers why is this right. Neither substitutes for the other, and only one of them can be repeated by a reader. This unit is mostly about why. One caution already: the defence can be checked only if its check can be repeated. "I checked it" is still your word until someone else can rerun the check and get the same result. That is what this unit later calls a certificate.
Why the substitution is tempting
It feels as if disclosure should be enough to meet the obligation. You have been honest, hiding nothing. It is half of it. A reader who knows how your work was made still knows nothing about whether it is right. Provenance is not evidence. An honest disclosure attached to a wrong answer is an honest wrong answer. The two do not fail alike. Where a rule requires a declaration, leaving it out breaks the rule however good the work is. But a reader who holds your evidence can check your result whoever, or whatever, produced it. That is why the evidence is worth more than the declaration.
What goes in each
A defence carries three things: what you checked, what the check showed, and which specification or assumption the check was against. Written down, it is two sentences. The first says what your result is, what check you ran against which specification, and what it showed. The second names the discrepancy or assumption you had to resolve, and how you resolved it. Unit 10 gave the difference two names. Verification asks whether the work meets its specification. For example, the checker verifies a routine, a short program, against the interface contract, Unit 10's written statement of what it must do. Validation asks whether the specification is the right one, whether that contract is what the task needed. A passing check establishes the first. The third item of your defence is where you answer for the second. A disclosure carries: what you used it for, at which stage, and what you did about it afterwards. Include the tool and version when the applicable rules require them, or when they materially help reproducibility or review. A name alone does not describe what happened.
What a defence never cites
Here is the line that matters most. A defence never cites the model. Not that the system said the answer was correct. Not that it sounded confident. Not that the output was detailed or well formatted. And not the name or version of the tool: that belongs in the disclosure. That is not about etiquette. Ordinary confident wording can accompany a correct or incorrect answer. Specially designed confidence measures can carry information on some tasks. But this course has not calibrated one for your task. Calibrating means checking that its confidence matches how often the answers turn out right. A confident sentence or self-rating is therefore not evidence for this defence. Use evidence appropriate to the claim: test results, checked reasoning, primary sources, independent measurements, or qualified review. The evidential basis must not be controlled only by the system whose output is under review. Put simply, your evidence must not come only from the system you are checking. Asking the same model to endorse its answer is another assertion, not an independent check.
A certificate
A defence is two sentences, and two sentences are still only a claim. What makes them worth something is what they point at: a certificate. That is evidence packaged so that someone else can check your claim without trusting you, the tool, or this course. So a check counts as a certificate only if someone else can repeat it and get the same result: its steps, its inputs and its reference are recorded. A check only you can vouch for still supports your defence, but it is not yet a certificate. On the checker route it is the command, the range and the output, which anyone can rerun in seconds. On the table route it is the comparison, with the source of every reference value. For a source it is the quotation with its page. For a historical claim, the facsimile, an exact image of the page, not a description of it.
Checker: Rerun for this video on the lab's correct example, the checker compared every value from B-zero to B-thirty with the reference and passed, in well under a second.
Narrator: Checking a certificate is usually far quicker than producing the work. Getting a correct routine takes several units of this course. Checking one value against a published table takes seconds. So ask for certificates, from yourself and from an AI system. Not "give me the answer", but "give me the tests and the command", or "the passage and its page". What comes back is still only a candidate until you check it against something the system did not produce. And a system's own report that it ran the tests is not a certificate. The test output you can rerun is.
What a proof checker certifies
[On screen: Left, under 'checked by the proof checker': a box of hypotheses and definitions, five proof steps, and a formal statement. The steps are ticked one by one, then the statement, labelled checked by the proof checker. The hypotheses and definitions box stays unticked, and a dashed line leads from it to a right-hand column headed 'validation: a person', whose first box asks whether the definitions say what was meant. A source line appears: [L18], a 2026 preprint, on a security proof developed by researchers working with AI agents and checked by the Lean proof assistant; because the checker covered every proof, review focused on the definitions. That review caught an AI-generated protocol: party 1's string and party 2's string feed one key, computed from both strings combined, marked in orange: neither party held both. Then a second validation box: can a definition be met trivially? A protocol that always aborts passes the security definition alone and counts as 'secure'; with the definition paired with a bound on how often an honest run aborts, it is excluded. A third validation box: a modelling assumption, stated openly in the paper, an authenticated channel. A box for the axiom list the checker can print notes that it would not show an assumption like this. Closing line: before relying on 'proved', read what was proved, and under which assumptions.]
A proof written for a proof checker is checked mechanically, step by step, and it still certifies less than it can seem to. It checks that the proof derives the formal statement from its hypotheses and definitions. It does not check that those definitions say what was meant. That is validation, and it stays with a person. A preprint from twenty twenty-six describes exactly this split. It is about a security proof, developed by researchers working with AI agents and checked by the Lean proof assistant. Because the checker covered every proof, the authors could focus their review on the definitions. That review caught an AI-generated protocol, a set of steps by which two parties agree a secret key. It computed the key from both parties' strings combined, which neither party held on its own. So neither party could actually compute the key. Two cautions follow. First, a definition can be met trivially, by something that does nothing useful. The paper notes that under its security definition alone, a protocol that always aborts, stopping before it produces a key, would count as secure. That is why the definition is paired with a bound on how often an honest run aborts. Second, a list of foundational axioms is not a list of the modelling assumptions. The axioms are the proof's basic starting rules. The modelling assumptions are what it takes to be true about the real system. The paper states openly that its protocol assumes an authenticated channel: a connection on which an attacker cannot pose as either party. The list of axioms a proof uses, which the checker can print, would not show an assumption like that. So before you rely on "proved", read what was proved and under which assumptions. Ask whether each holds where you will use the result, and ask what the laziest thing is that would also pass.
Three routes, one standard
If you verified against a table you built by hand, your defence says which values you compared and what you found. If you ran the checker, your defence says which checks ran and what they reported. If you checked sources, your defence says which claims you compared with what the sources say, and the first one they did not support. All three routes meet the course's standard, and none is a reduced route. Their evidence is not identical, so state the inputs and properties each route covered. Each also names a discrepancy and how it was resolved: that is the defence's second sentence. What disagreed, or what you had to assume, and what you did about it.
What a disclosure can and cannot do
A disclosure cannot be confirmed from the finished work. Nobody can look at a finished piece of work and establish that the disclosure attached to it is complete, or that a missing one is a lie. Records may corroborate parts of it, without proving that the account is complete. Text carries no reliable mark of how it was made. As of 2026, the tools sold as detectors do not settle it: they give likelihoods over surface features, they can be wrong in both directions, and one of those directions is accusing somebody. Provenance labels do not settle it in general either. As of 2026, content credentials and watermarks mark output only from the generators that take part. A credential records where a file came from, not whether it is true, and it can be stripped; rewriting or translation weakens a text watermark. An absent label tells you nothing. This video is its own example. It tells you it is narrated by a synthetic voice. You cannot confirm that from the video, and it would not tell you whether anything said here is right if you could. The checker and the references do that. The same goes for the completion record the progress page prints: any name can be typed into it. It is a declaration with a heading. So a disclosure is not a control. A rule that depends on inspecting the finished work for undisclosed use is asking for evidence the work does not contain. If work genuinely has to be produced without AI assistance, the setting has to make that so. A rule about the finished artefact cannot.
Detectors fail in both directions
[On screen: A note at the top says the figures are hypothetical, the narration's 'if', not measured data. A single generated essay is screened first and is not flagged, labelled: generated, passed as human, a false negative. Then a grid of a thousand small grey squares appears, labelled 1,000 honest essays. A blue detector bar sweeps across the grid from left to right, and as it passes, ten of the squares turn red and are circled: flagged. A counter beside the grid climbs from 0 flagged to 10 flagged. Lines then appear: if 1 honest essay in 100 were flagged, 1,000 x 1/100 = about 10, about ten false accusations, each one an honest writer.]
Both directions of detector error matter. A false negative passes generated text as human. A false positive flags honest writing as generated, and the false positives need not fall evenly. One study from twenty twenty-three, of seven detectors, found them falling on essays by non-native English writers.
[On screen: A note at the top says the figures are hypothetical, the narration's 'if', not measured data. A single generated essay is screened first and is not flagged, labelled: generated, passed as human, a false negative. Then a grid of a thousand small grey squares appears, labelled 1,000 honest essays. A blue detector bar sweeps across the grid from left to right, and as it passes, ten of the squares turn red and are circled: flagged. A counter beside the grid climbs from 0 flagged to 10 flagged. Lines then appear: if 1 honest essay in 100 were flagged, 1,000 x 1/100 = about 10, about ten false accusations, each one an honest writer.]
And base rates work against the accuser. If most of the writing being screened is human-written, even a low false-positive rate, applied to many honest writers, still produces many false accusations. If one honest essay in a hundred were flagged, a thousand honest essays would yield about ten. The lab's exercise five makes the same point in code. A test that wrongly rejects the correct implementation is reported as a failure, because a test that fails good code is worse than no test. A detector that flags honest writers is that test, with a person on the receiving end.
None of this is new
None of this began with AI. Ghost-writing, uncredited help and copied text are old, and a claim of sole authorship could never be confirmed from the work alone. Neither was human authorship ever a guarantee: Note G went to press with mistakes in it. What generative AI changes is mostly speed and volume.
Understanding is not yet correctness
The claim that carries the work is ownership: I understand this well enough to defend it, and I have evidence that it is right. It has two parts, and they come apart. Understanding is being able to predict what the thing does. Your checks count as evidence of it only where you predicted what they would show before running them. A pass you did not predict tells you about the thing, not about your understanding of it. Correctness is the further claim that what you understand is also right, against the specification you wanted. This course's own case shows a neighbouring gap. Lovelace's 1843 table has more than one printed fault. The course's makers ran a reading of it with one of those faults silently repaired, got one hundred and thirty-nine over six hundred and thirty, and reported that as what the table as printed produces. It is not. A correct computation, of an object nobody had said was being run. Understanding without a correctness check is not yet a defence, and a defence that does not say what it is a claim about is not one either.
What does carry the weight
[On screen: Headed 'Evidence and disclosure', a flowchart in two branches. Under 1, process, how it was made: AI draft generation flows to a disclosure statement, 'AI drafted it; revised after checking'. Under 2, evidence, why it is right: three equal-status routes, table verification with coverage B0 to B8, automated verification with coverage n = 0 to 30 against the oracle, and source verification with coverage claims against cited passages, all flow into a defence statement, 'Checked stated cases against references.', with no absolute '100% correct' claim. Disclosure and defence merge into accountable and defensible work: checks passed for the stated cases; the author remains answerable; others may also hold duties. A separate orange box, labelled not evidence, names model confidence or self-endorsement.]
Here is the whole loop on one page. How it was made ends in a disclosure. Why it is right ends in a defence, by any of the three routes. Both meet in work someone answers for, and the model's confidence is on neither path. Two things carry the weight, and both can actually be established. The first is the work: whether a claim is correct is checkable by the methods this whole course is about, and that does not depend on how it was made. The second is who is answerable. Put your name to something and you are answerable for it being right, whether a model drafted it, a colleague drafted it, or you wrote every word. Assistance does not move responsibility, and no disclosure removes it. Disclose where it is owed, plainly and without apology. Then spend your effort on the half that can be checked.
The evidence pack
By now you have produced the pieces without being asked to collect them: your original prompt, what came back, the verification result, what disagreed, the revised prompt, the final result. Add the disclosure, the defence, and one artefact from your own work. That artefact is the eleventh row of your Unit 3 activity, the thing you use an AI system for, planned with the same method. That is the pack. It stays with you: nothing collects it, and nothing marks it. Build it, though, so that a reader who does not take your word for anything could still check your claim from it.
Exporting your self-check record
On the Python route, the self-check tool's progress command, with the evidence option, prints your self-check record as Markdown you can paste straight in. This one is a fresh record, so it has passed none of the thirty-nine. One caution the tool prints too: that record shows which checkpoints you passed, not that you can defend the answers. Nor is it a certificate: it is a local record that you could edit. An AI system can help draft the wording, but it cannot create evidence you did not gather or accept accountability for you.
The boundary
Do not paste confidential, personal, or assessment-restricted material, or other people's unpublished work, into an AI system. Unit 13 teaches this boundary. Sustainability beyond the resource section in Unit 4, and industry practice, are not taught here. For both, the reading gives general starting points, among them the International Energy Agency's report on energy and AI, the NIST AI Risk Management Framework, and the OECD's AI Principles. Nor does this course state institutional policy, employer policy or legal advice: where one of them applies to you, find out its current rules from whoever sets them.
Rules about AI use in assessed work
The rules for AI use in assessed work are set by your institution or programme, not by this course. Find out what they are before you use AI in assessed work.
Ada's claim
In Note G, Lovelace wrote that the Analytical Engine "has no pretensions whatever to originate any thing". It is tempting to reach for it as a settled verdict on language models. Resist it, in both directions.
Reading it carefully
She was writing about a machine executing a procedure specified completely in advance, operation by operation. A model trained on a large corpus produces combinations its authors did not write and could not predict. Whether that difference amounts to originating anything depends on what you take origination to require. That is a live philosophical question, not a solved one.
What would originating require?
What would originating require? There are four main answers, and they lead to different verdicts. If it means novelty, producing what nobody specified, the answer turns on what these systems produce. Alan Turing took up Lovelace's sentence by name in nineteen fifty, and replied, among other things, that machines often take us by surprise. If it means creativity, Margaret Boden's account asks for something new, surprising and valuable, made by combining ideas, exploring a space of them, or transforming that space. If it means understanding, John Searle argued that running a program is not enough for it, and Emily Bender and Alexander Koller that a system trained only on the form of language has no way to learn its meaning. And if it means consciousness or intention, there is no single agreed theory: the research draws on several theories of consciousness, which differ.
Making the question answerable
None of these settles itself. But each can be made concrete, and then part of the question becomes one you can test. Novelty can be checked where the training data can be searched: compare what a system produces with what it was trained on. Where it cannot be searched, the comparison cannot be made. Understanding as behaviour can be tested on what a system produces: does its output predict, explain, and carry an idea to cases it has not seen? That is evidence about the output; whether it amounts to understanding is the open question that follows. Either way, it is not the sense this unit asked of you, which is about your own model of what you work with. Understanding as meaning is different. It is an argument about what training on text can give, and the tests just described do not settle it. Consciousness can be made concrete only through a theory. In twenty twenty-three a group of researchers took indicator properties from scientific theories of consciousness and assessed current AI systems against them. Their analysis suggested that none was conscious, and that there was no obvious technical barrier to building one that met the indicators. An answer like that is only as good as the theory behind it, and the theories disagree. So making the notions concrete does not end the debate. It moves it: from whether a machine originates, to which notion of originating should matter, and why.
What the sentence asks
Back to Lovelace's sentence. She also wrote that the engine can do whatever we know how to order it to perform. So her sentence leaves a useful accountability question: who specified, used, reviewed, and approved the result? You remain answerable for generated material you submit. In organisations, users, reviewers, deployers, employers, and vendors may also have duties. AI assistance does not make those duties disappear.
Understanding and the Chinese Room
Three words carry much of the argument about AI: understanding, intelligence and consciousness. None of them has an agreed definition. John Searle imagined himself in a room, following a program for answering in Chinese. He understands none of it, yet his answers pass for a speaker's. So, he argued, running a program cannot by itself give understanding. The best-known reply grants that the man does not understand, but argues that he is only one part of a system, and that the whole system does. Searle answered that the man could memorise the program. He would then be the whole system, and would still not understand. Critics say this still examines only a part. What runs in his head may be a second system, more like a case of multiple personality than the man himself coming to understand. Searle does not claim that no machine could think: brains, he says, are machines that think. His alternative is a causal power of biological brains, a power they have to produce understanding. Critics add that he does not describe that power precisely enough to tell whether anything else could have it. After four decades there is still no consensus, and this course does not settle it. Its own working account of understanding is about your model of what you work with. It is not an answer to Searle. And no one can cite the Chinese Room, or a reply to it, as settling whether a particular system understands.
Intelligence: no agreed definition
The second word, intelligence, fares no better. Alan Turing, in nineteen fifty, set the question whether machines can think aside, and replaced it with a test of behaviour. Shane Legg and Marcus Hutter collected about seventy definitions, from dictionaries, psychologists and AI researchers, and found no standard one. They did not give up. They drew out what the definitions share, and proposed their own: an agent's ability to achieve goals in a wide range of environments, while granting that it is hard to argue any one definition is objectively correct. François Chollet argues that skill at a task is not enough, because knowledge built in by developers, or enough training data, can buy skill without the ability to handle what nobody anticipated: a program that hard-codes an engineer's solution shows the engineer's intelligence, not its own. He proposes measuring how efficiently a system acquires new skills, given what it started with, and does not claim his is the one true definition. So when a model is called more intelligent, or human-level, ask whether anything was measured, in what sense, and on cases that were not in its training data.
Consciousness: a position on method
The third word, consciousness, is the hardest of the three, because the disagreement starts at the definition. The word is used in many ways, with no agreed meaning. One influential criterion is Thomas Nagel's: a being is conscious if there is something it is like to be it. Theories differ on what consciousness is. There are five main families. Functionalist theories: a state is conscious because of the role it plays. Global workspace theories: information is conscious when it is made available to a workspace that many processes can use. Higher-order theories: a state is conscious when the system represents its own state. Integrated information theory: consciousness is a kind of integrated information that comes in degrees. And neural theories: it is tied to particular processes in brains. One assessment took its indicators from several of them, so its answer is only as good as they are. The hard problem asks how experience could arise from physical processes at all. Illusionism gives a different answer. It accepts that we have experiences, in the everyday sense, and that this is no illusion. What it denies is that experiences have the special qualities they seem to have, what they are like from the inside. Philosophers call these phenomenal properties. On this view those properties do not exist. They only seem to, and introspection, looking inward at our own experience, produces the seeming. This course takes a position on method only. What a model says about its own mind is more output. "I am conscious" and "I am not" are both text a model trained on human writing can produce, so neither settles anything by itself. Even a model's displayed step-by-step explanation need not reflect what drove its answer. So "this AI is conscious" and "no AI could be" are both claims nobody can check as stated. Ask which theory, which indicators, and what evidence. And your accountability does not wait for the answer. None of this method depends on settling the three questions. The words matter where they are used to claim something: to give credit, to excuse a failure, or to sell a product. There, ask which sense is meant.
You can now
You can now understand a claim, gather independent evidence, hand it over so someone else can check it, defend its scoped correctness, disclose how it was made, and take ownership of using it. That is the loop, and you have been round it. Pause before approval if you cannot predict relevant behaviour, explain the transformation, name an independent check, or interpret a failed check. A polished output and a confident feeling do not replace that evidence.
Finish
Assemble your pack, then run the two checkpoints, cp17-disclosure and cp17-scope-the-claim. On the complete route, go on to Unit 18, which closes the course; on every other route, this is where yours ends. Keep the pack either way: on the complete route, Unit 18's second task works on it, so it is not finished with.
Closing, 20 seconds, no speech. A candidate record on the left, a check against an independent reference in the middle, and a bracketed claim on the right fade in side by side. Below them: Continue with the course material, ai.qyber.dev/edu-ai-literacy-ada-verification/, Course playlist: youtube.com/playlist?list=PLPsBWTfgvakM, All links are also in the description, and Keep your record. Check the next claim.