Most readers turn past the dedication page. It takes less than a second. “For Sarah.” “To my parents.” The book begins after it. Nobody edits the dedication, nobody reviews it, nobody cites it. Of the hundreds of pages a publisher prepares, the dedication is the one the author writes alone, without input, and that no one in the production chain touches.
A recent collection of book dedications shows what that produces. Joseph Bau’s Artist at War is dedicated to his mother Tzilah, murdered in Bergen-Belsen; his father Abraham, murdered in Płaszów; his brother Iziu, murdered in the Kraków ghetto; six million others; and Oskar Schindler, “without whom this book would never have been written.” Leah Penniman dedicates Farming While Black to “our ancestral grandmothers, who braided seeds in their hair before being forced to board transatlantic slave ships, believing against the odds in a future of sovereignty on land.” They are addressed to the dead. The living reader is overhearing.
The dedication is a private message inside a public carrier. The book has an audience: everyone who buys it. The dedication has a different one — a single person, or a set of people, most of whom will never hold the book. The two coexist in the same bound object. The primary reader doesn’t need the dedication to follow the argument. But once you’ve read Penniman’s, her chapter on seed saving arrives differently. The private message has restructured how the public one lands.
Matthew Green, a cryptographer at Johns Hopkins, recently spent a weekend investigating a structurally identical arrangement in AI infrastructure. When a reasoning model responds to a prompt, the API returns two objects: the response, which the developer can read, and the thinking block, which the developer can’t. The thinking block contains the model’s internal reasoning — drafts, revisions, discarded paths before it settled on the final answer. It’s encrypted and cryptographically signed.
In multi-turn conversations, the thinking block must be sent back with the next prompt. The model needs its prior reasoning to stay coherent across turns. But the developer can’t inspect it or modify it. It travels alongside the public response, sealed.
Green asked the natural question: why sign it? A digital signature implies a threat model. Someone anticipated that developers would try to substitute fake reasoning, delete unfavorable chains of thought, or inject instructions disguised as the model’s own conclusions. The signature prevents this. If the thinking block arrives altered, the model rejects it and starts fresh, as if the conversation never happened. Tamper with the private layer and the public conversation loses its continuity.
Publishers and API engineers have no shared vocabulary. But they independently solved the same problem: how to embed a private communication inside a public artifact and prevent the public audience from corrupting it.
Publishers solved it socially. The dedication is protected by convention, not mathematics. Editors leave it alone, reviewers pass over it, and readers don’t expect it to serve them. Its integrity survives because nobody has an incentive to tamper — the dedication doesn’t control the book’s behavior, so altering it gains nothing except vandalism. Most dedications survive intact across editions, translations, even unauthorized reproductions.
Engineers solved it cryptographically. The thinking block is protected by a signature that makes tampering both detectable and useless. This solution exists because the incentives run the opposite direction. If you could inject reasoning the model trusts as its own, you could steer its behavior. The private layer determines what happens next, so forging it would gain everything. Convention would crumble in a day.
The mechanism is the same: a sealed layer inside a public carrier, addressed to someone other than the carrier’s primary audience. The seal’s strength differs because the stakes differ. Where the private layer is inert — where it changes context but not function — convention suffices. Where it’s operational — where it determines the system’s next action — cryptography is required.
Both sealed layers produce the same asymmetry, though. The thinking block tells you the model had reasoning about your prompt that you aren’t permitted to see. The dedication tells you the book was written for someone who isn’t you, under circumstances you may never understand. Both force the primary audience into the position of someone using an artifact that contains a message not addressed to them.
Will Storr dedicates Selfie “For Charles Whitman, who was right.” Whitman killed fourteen people from a university tower in 1966. The book argues that personality is largely determined by forces beyond individual control. The dedication is designed to detonate retroactively — the reader is meant to realize, chapters later, that they’ve been agreeing with a statement dedicated to a mass murderer. It operates on the reader while being addressed past them.
The thinking block works the same way. It shapes the model’s next response — which the developer builds on — without the developer knowing what reasoning produced it. The output you read was determined by a conversation you weren’t part of.
Strip either sealed layer and the artifact still functions, technically. The book without its dedication has chapters, arguments, evidence. The model without its thinking block can still respond. But something that connected the output to its origin has been severed. The book drifts from the circumstances that made it necessary. The model starts each turn from nothing, unable to recall what it concluded or why.
Two fields, centuries apart, built the same structure without a shared name for it. Cryptographers call it a signed opaque blob. Publishers never called it anything. It has been there, in every book, for as long as books have had front matter, doing its work unnoticed — and no one theorized it, because it looked like furniture. When the constitutive inner layer is also what regulators or markets try to prohibit, the pattern becomes What the Real Thing Requires.