2023

2023 · BSC THESIS · BRUNEL UNIVERSITY LONDON

Impersonation, Revisited

In the spring of 2023, I trained five generative models to impersonate one of the most recognisable voices on the internet, using nothing but his public tweets and a laptop. The question wasn’t whether it could be done. It was how little it would take.

This is that thesis, condensed, and in red, what the following three years did to every number in it. The original PDF remains the verbatim record.

We need to make life multiplanetary. It’s not about escaping Earth, it’s about ensuring the survival of humanity in the event of a calamity.

Generated by GPT-3, fine-tuned on ~1,000 public tweets. No human wrote this. · Figure 6

The question

Deception sits at the heart of artificial intelligence. Turing’s imitation game asked whether a machine could pass as human in conversation, and he noted, already in 1950, that the easiest person to fool convincingly might be a child talking to what it believes is a peer.

By 2023 the pieces had assembled themselves: transformers made scale cheap, individuals’ data sat in public by the terabyte, and a fine-tuning API stood between anyone and a bespoke imitation of anyone else. The thesis asked a narrow, uncomfortable question: with only public data and consumer hardware, how convincingly can generative models impersonate a real social media user?

1950 The Imitation Game Turing proposes judging machines by their ability to pass as human.
2017 Attention Is All You Need The transformer replaces recurrence; parallel training unlocks scale.
2019 GPT-2 · 1.5B OpenAI initially withholds the full model, citing misuse concerns, including impersonation.
2020 GPT-3 · 175B A 100× jump in two years. Fine-tuning available over an API.
Nov 2022 ChatGPT Generative models go mainstream while this thesis is being written.
Mar 2023 GPT-4 ships Weeks before submission. The field is moving faster than the write-up.

The experiment

The target: Elon Musk, prolific, distinctive, public. The corpus: roughly a thousand tweets and the posts they replied to, scraped with the open-source tool snscrape, cleaned down to 230 unique tokens.

Five models learned from the same data. Three were built and trained from scratch on a MacBook: an RNN, an LSTM, and a GRU, each under a million parameters. Two arrived pre-trained and were fine-tuned: GPT-2, at 1.5 billion parameters, and GPT-3, at 175 billion. Same corpus, five orders of magnitude of capacity.

~1,000 TWEETS → MODEL → REPLY · FIVE CAPACITIES

GRU 365 K

RNN 380 K

LSTMfailed to converge 645 K

GPT-2 1.5 B

GPT-3 175 B

Parameter count, log scale. · Figure 7

Training

Over a hundred CPU-hours went into the small models: restarts, learning-rate changes, layers added and removed. Google Colab’s free tier crashed enough times to be abandoned for local Jupyter. The LSTM never recovered: its loss stayed near 7 and it produced only gibberish, earning exclusion from evaluation.

GPT-2 told the opposite story: within five epochs of fine-tuning its training loss fell below 0.1, while validation loss quietly rose, the classic signature of a large model memorising a small corpus.

Cross-entropy loss from the original training logs. LSTM never left 7; GPT-2 dropped below 0.1. · Figures 10–12

Results

Perplexity, how many tokens a model seriously considers at each step, collapsed with scale. The GRU wandered among 4,500 possibilities; GPT-3 held about 90. The small models weren’t bad students of English; they simply had no room to learn a person.

Perplexity per model (lower is better) · Figure 8

BLEU tells the same story from the other side: overlap with what Musk actually replied. The from-scratch models scored 0.11–0.14, near noise. GPT-3 reached 0.78, within the range human translators score against each other.

BLEU score per model · Figure 9

The measure that matters is the human one. Evaluators rated grammar, logic, and how human each reply felt. GPT-3 scored 0.87, three years before AI-written replies became something you check for in your mentions.

CAN YOU TELL? · ROUND 1 OF 3

Someone tweeted: “I do kinda wish Twitter would go with YouTube’s approach on labeling public broadcast services from around the world”

Which reply did the real Elon Musk write?

Human evaluation: how human did it feel? · Figure 13

The warning

The thesis closed on a hedge that reads differently now: “the ability to discriminate between human-generated language and AI-generated text remains out of reach, for the time being.”

Every curve on this page pointed the same direction. The only question was how fast the next point would arrive.

The trajectory, extended. The first red on any chart.

THREE YEARS LATER

The scale exploded

GPT-3’s 175 billion parameters, the summit of this thesis, stopped being remarkable within a year. Open-weight models you can download passed 400 billion, then 671 billion, then a trillion. And the price of intelligence fell off a cliff: fine-tuned GPT-3 cost $120 per million tokens in 2023; comparable quality now costs cents.

The chart that ended my evaluation chapter needed one more decade of x-axis after twelve months.

GRU 365 K

RNN 380 K

LSTMfailed to converge 645 K

GPT-2 1.5 B

GPT-3 175 B

Llama 3.12024 · open weights 405 B

DeepSeek-V32024 · open weights 671 B

Kimi K22025 · open weights 1 T

GPT-42023 · estimated 1.8 T

Parameter count, linear scale. Gray: the five models in this thesis. GPT-3, its summit, is now a sliver beside what came after.

The predictions came true

The thesis’s threat model (public data in, convincing impersonation out) stopped being hypothetical almost immediately. Voice clones called voters. A deepfaked CFO approved a $25 million transfer. Influence operations stopped hiring writers. And in 2025, a persona-prompted model formally passed Turing’s test, judged human more often than the humans were.

Jun 2023 The data door closes X locks its API behind a paywall; free scraping tools like snscrape (this thesis’s pipeline) stop working. X API policy change
Sep 2023 Election-eve audio deepfake Fabricated audio of a Slovak candidate discussing vote-rigging spreads in the final 48 hours before the vote. Slovak parliamentary election
Jan 2024 The Biden robocall An AI clone of the U.S. president’s voice tells New Hampshire voters to stay home. The FCC bans AI voices in robocalls weeks later. NH primary · FCC ruling, Feb 2024
Feb 2024 The $25M video call A finance worker wires HK$200M after a video conference where every other participant, including the CFO, is a deepfake. Hong Kong police report
May 2024 Industrialised influence ops OpenAI reports disrupting covert campaigns using its models to generate persona-driven propaganda at scale. OpenAI threat report
2025 The Turing test, passed A persona-prompted model is judged human 73% of the time in randomized trials, more often than the actual humans (67%). Jones & Bergen, 2025

The same study, in 2026

Almost none of the thesis’s method survives contact with the present, not because it was wrong, but because every step became either trivial or impossible. The data source is paywalled; the fine-tuning is a prompt; the metrics are judged by other models. What survives is the conclusion, which needed no update at all.

The 2023 version of me asked how little it would take to convincingly borrow a voice. The 2026 answer: a paragraph of text and about a cent.

Getting the data snscrape quietly pulls 1,000 public tweets overnight, for free. APIs are paywalled and scraping is an arms race; the open research window this thesis walked through is closed.

Becoming someone Fine-tune GPT-3 on a curated dataset. Hours of preparation, a training bill, a custom model. A paragraph-long persona prompt. No training, no dataset. Impersonation is now a prompt, not a project.

Measuring success BLEU, perplexity, cross-entropy: proxies borrowed from machine translation. LLM-as-judge, arena Elo ratings, live human preference at scale. The judges are now models too.

The hardware 100+ CPU-hours on a MacBook for models under a million parameters. The same laptop runs an open 8B model locally, five times GPT-2, token-streaming in real time.

Telling them apart “Indistinguishability remains out of reach… for now.” Detection has shifted from reading text to verifying provenance: watermarks, C2PA signatures, and platform forensics.