Citation: Matthew Sag, Copyright Safety for Generative AI, 61 Houston Law Review 295 (2023)
In a nutshell:
In Copyright Safety for Generative AI, Matthew Sag argues that training generative AI on copyrighted works is generally noninfringing nonexpressive use, but that model memorization creates identifiable edge cases of infringement risk, and he proposes a set of best practices to reduce that risk.
Summary
Copyright Safety for Generative AI places large language models within the line of fair use cases dealing with copy-reliant technology, from software reverse engineering and plagiarism detection through HathiTrust and Google Books. Sag argues that there is no machine learning exception to the principle of nonexpressive use: copying that does not communicate original expression to a new audience does not interfere with the interests copyright protects, and it makes no difference whether the derived data feeds a logistic regression or a machine learning classifier. In the typical case, the link between any individual work in the training data and the model’s output is attenuated. Models learn latent features and associations within the training data; they do not store snippets of original expression from individual works.
The article then identifies the situations where that account breaks down. Drawing on the computer science literature on extraction attacks, Sag shows that memorization is more likely when a work is duplicated many times in the training data, when images are paired with unique text descriptions, and when the model is large relative to its training data. He also identifies what he calls the “Snoopy problem”: the more abstractly a work is protected, the more likely a text-to-image model is to copy it. It is hard to prompt Midjourney into reproducing a specific Salvador Dali painting, but easy to generate prima facie infringing images of Snoopy or Mickey Mouse, because the model learns exactly the consistent, distinctive traits that define a copyrightable character. The same applies to any simple image repeated in the training data under a consistent label, as Sag demonstrates with Banksy’s girl-with-balloon stencil.
The article closes with ten proposed best practices for copyright safety, including deduplicating training data, attending to the ratio of model size to training data, using reinforcement learning from human feedback to address copyright sensitivity, filtering outputs, keeping records of training data provenance, and generalizing unique captions and the names of artists, trademarks, and copyrightable characters in image training data. Sag rejects the alternative of training only on public domain and licensed works, which would encode the perspectives of a distinctly unrepresentative set of authors.
Why read this article?
Copyright Safety for Generative AI gives readers a technical grounding in how large language models and text-to-image diffusion models work, including accessible explanations of autoencoding and latent concepts, and of why model outputs are usually remix rather than reproduction. It also reviews the extraction attack literature in concrete terms: one study discussed in the article found near-copies in only 109 of 175 million generations sampled from images selected for their perceived memorization risk, with success concentrated on images duplicated at least 100 times in the training data. The article documents its infringement provocations with side-by-side figures comparing Midjourney and Stable Diffusion outputs to copyrighted originals, and the ten best practices in Part V remain a useful checklist for anyone assessing whether an AI developer has taken reasonable precautions, a question courts may fold into the fair use analysis.
Further Reading
James Grimmelmann, Copyright for Literate Robots, 101 Iowa Law Review 657 (2016) – This essay examines how fair use law came to treat reading by computers as exempt from infringement while human reading is not, and reflects on the consequences of that split for copyright doctrine.
Benjamin L. W. Sobel, Artificial Intelligence’s Fair Use Crisis, 41 Columbia Journal of Law & the Arts 45 (2017) – Sobel argues that expressive machine learning applications may fall outside fair use protection, the position Sag responds to directly in this article.
Mark A. Lemley & Bryan Casey, Fair Learning, 99 Texas Law Review 743 (2021) – This article argues that copying to train machine learning systems should generally be fair use because the systems copy works for their factual and functional content rather than their expression.
Nicholas Carlini et al., Extracting Training Data from Diffusion Models, Proceedings of the 32nd USENIX Security Symposium (2023) – This computer science paper demonstrates that diffusion models can memorize and emit individual training images, supplying much of the empirical foundation for the article’s analysis of memorization risk.