Do Firewalls Dream Of Electric Sheep

I keep a small server. Nothing impressive — a box in a rack somewhere in Frankfurt that serves a few websites and runs some experiments. Once in a while I open its logs, and what I find there is a kind of weather report from a world I don't live in.

Thousands of attempts per day. Someone in Brazil trying admin/admin. A bot in Singapore probing for a WordPress plugin vulnerability from 2017. A patient, methodical scan walking through port after port like a burglar trying every window on a long street. None of this reaches me. A small program called fail2ban reads the logs, notices the pattern, and quietly drops the connection. I never see any of it unless I go looking.

This is the actual texture of the internet. Not the content. The filtering.

And it occurred to me, scrolling through that log, that we spend almost all of our cultural attention on the machines that produce, and almost none on the machines that refuse — even though the refusers vastly outnumber the producers and arguably shape the world more.

The Invisible Majority

Count the AI systems actually deployed at scale right now. Not the ones in the demos. The ones running.

Spam filters. Fraud detection. Content moderation. Intrusion detection. Credit scoring. Insurance underwriting. CV screening. Plagiarism detection. Age verification. Sanctions screening. Deepfake detection. Toxicity classifiers. Ad fraud detection. Bot detection. Copyright matching.

Every one of these is a machine whose primary output is absence. They succeed by producing nothing. A spam filter that works perfectly produces an empty inbox folder you never open. A fraud system that works perfectly produces a transaction that simply doesn't happen. Their whole product is negative space.

We don't talk about them because there's nothing to show. You can't screenshot a thing that didn't occur. The generative models get the magazine covers; the discriminative ones get the budget.

But here's what interests me: in order to say no, a system must first contain a model of what it is saying no to.

The Censor Is the Only One Who Reads Everything

A spam filter has, encoded in its weights, a detailed and continuously updated theory of human deception. It knows the rhetoric of urgency, the grammar of the Nigerian prince, the exact shade of plausibility that a phishing email needs to slip through. It is, in a strange sense, the world's foremost scholar of spam.

A content moderation model contains a representation of every atrocity it has been trained to remove. The thing that protects you from the worst of the internet is the thing that has absorbed the most of it.

This is an old pattern. The Inquisition's Index Librorum Prohibitorum required inquisitors who had read the forbidden books. The censor is always the most widely read person in the room. The immune system maintains a vast internal library of pathogen shapes — antibodies are, quite literally, negative molds of things that want to kill you. Your body knows measles by holding its inverse.

To refuse something precisely, you have to hold it precisely. Negation is not the absence of a model. Negation is a model, flipped.

Negative Selection

The deepest version of this is how your body figures out what you are.

In the thymus, developing T-cells are tested against a sampler of the body's own proteins. Any T-cell that reacts too strongly to you is destroyed. This is called negative selection, and something like 95% of them don't survive it. The immune system doesn't learn what "self" is by being shown a picture of you. It learns it by systematically killing everything that attacks you, and what remains, by exclusion, is your identity.

You are the shape left over after everything you are not has been removed.

Which is uncomfortably close to how people work too. I can list my values, but my actual values live in my refusals — the jobs I didn't take, the arguments I didn't make, the sentence I deleted because it wasn't true enough. Character is a filter, not a fountain. The via negativa mystics knew this: you can only approach God by saying what God is not. Michelangelo's bull was carved, not grown.

So Do They Dream?

Here's where it gets strange, and where the Philip K. Dick title stops being a joke.

Modern defensive systems can no longer be trained only on attacks that have already happened. The attack surface is too large, the adversary too fast. So the defenders have started generating attacks that have never occurred.

Fuzzing. Adversarial training. Red-team models whose entire job is to invent novel jailbreaks so that the blue-team model can learn to refuse them. Generative adversarial networks, where a forger and a detector improve each other in a closed loop. Security teams running simulated breaches against digital twins of their own infrastructure at 3am.

The firewall now hallucinates the burglar in order to recognize him when he arrives.

And that, mechanically, is not so different from what dreaming appears to be for. In the Seek-Reject-Frame architecture I sketched a while ago, dreaming is the state where the rejector's suppression is relaxed and the system runs consequence-free simulations — learning by not doing, which may be our species' single greatest trick. The brain generates threats that aren't there so that the next real one is already half-familiar.

So: do firewalls dream of electric sheep?

Yes. And the sheep are wolves.

The Brittleness of the Undreaming

This gives us a useful diagnostic. A rejector that cannot dream can only refuse what it has already seen. It is a lookup table with good PR. It will be perfect on last year's threats and useless on next week's.

This is the signature failure of every bureaucracy, every compliance department, every immune system that over-fits. It's also why organizations that ban imagination in the name of safety become spectacularly unsafe. You cannot defend against a future you are forbidden to imagine. The censor who refuses to read becomes the worst censor — paranoid, arbitrary, swinging at shadows, blocking the harmless and waving through the lethal.

Which means the thing we instinctively find creepy — your filter is simulating atrocities in its sleep — is precisely the thing that makes it competent.

Who Gets to Dream the Wolves?

Here's my actual worry, and it isn't that machines dream.

It's that the dreaming has been centralized.

A handful of organizations now maintain the master rejectors for most of human communication. Their internal models of "what must not pass" — their nightmares, if you like — are proprietary, global, and unaccountable. They dream, at scale, on behalf of billions of people who will never know what was filtered or why. Deletion is a form of authorship. The negative space is the composition.

And unlike a generative model, where you can at least read the output and disagree with it, a rejector's output is invisible by construction. You cannot argue with an email you never received.

If I had one wish for the next decade of this technology, it would be this: push the refusers down, not up. Let the filters be local, small, inspectable, mine. Let me see what my own firewall dreams about. Let the thing that defines my boundaries be something I can actually look at, the way a household keeps its own small guardian spirit rather than renting one from a distant god.

Because a boundary you didn't draw isn't a boundary. It's a cage.

And the question isn't really whether firewalls dream.

It's whose nightmares you're living inside.

On the off chance you'd like to subscribe to my writing, please feel free to subscribe on twitter or use this RSS feed. Thank you.