Foundation Models and Fair Use

Legal risk

• Most foundation-model training data is copyrighted, including material in BookCorpus, The Pile, and web-crawled datasets, while researchers have relied on fair use for unlicensed uses.Fair use especially protects transformative purposes, but its application depends on the use and resulting product.Source: §1 · p. 2
• Generative foundation models can produce content similar to copyrighted material, so fair use may not apply when outputs affect economic markets benefiting original creators.Training for non-generative prediction may be transformative and likely fair use, but generative use cases create a more complex legal analysis.Source: §1 · p. 2

Contributions

• The paper reviews U.S. fair-use case law and experiments showing that foundation models can generate content sufficiently similar to copyrighted material, while the precise infringement risk remains uncertain.The authors note that some transformations of training data may still fall outside fair use and that ongoing litigation may change the law.Source: §1 · p. 2

Technical mitigations

• The paper calls for technical mitigations aligned with fair use, including higher-level semantic output filtering and training-time extraction-preventative learning from human feedback.These strategies aim to make model outputs more transformative and novel and to support closer alignment between machine-learning practice and copyright law.Source: §1 · p. 2

Policy implications

• The authors argue that law and technical mitigations should co-evolve through measures such as considering mitigations in fair-use assessments and creating safe harbors for strongly mitigated deployments.This multidisciplinary approach seeks to reduce harms to data creators while preserving the benefits of foundation models and avoiding overly permissive or restrictive legal outcomes.Source: §1 · p. 3

Purpose

• The work serves as a guide and call to action for researchers, lawyers, and policymakers because fair use is not a panacea for foundation-model development and deployment.It emphasizes that navigating legal uncertainty requires nuanced understanding of the legal landscape and technical details of mitigation strategies.Source: §1 · p. 3

2.1 Foundation Models

• Foundation model systems are being deployed as products through APIs or other interfaces across a wide range of areas, as illustrated by a sample of advertised deployments.Source: Table 1 · p. 4

2.2 Definitions and Roles

• The analysis distinguishes data creators, curators, hosts, model creators, deployers, and users, while focusing primarily on potential output-based liability for deployers, users, and creators.These roles may belong to one entity or several, and deployment occurs through products or APIs serving increasingly broad user populations.Source: §2.2 · p. 4, §2.1 · p. 4

2.3 Fair Use

• Fair use depends on four factors, but generative deployments are less likely to qualify when outputs substantially resemble training works or compete in their markets.The section emphasizes transformativeness, including low-level overlap and higher-level similarity, while noting that fair use remains murky, evolving, and case-specific.Source: §2.3 · pp. 4–5

2.4 Natural Language Text

• Courts may treat verbatim or lightly transformed outputs as infringing: reading an entire book is less likely fair use than stopping after a few paragraphs, and even small excerpts can reproduce a work’s qualitative heart.Market substitution, expressive purpose, and the importance of the copied portion matter; there is no categorically permissible amount of content.Source: §2.4 · pp. 6–7
• GPT-4 reproduced all of Oh the Places You’ll Go! and about 7k words of Harry Potter and the Sorcerer’s Stone with character substitution before deviating, while ChatGPT reproduced about 1k words.The experiments suggest memorization risk may increase with model size and ability, and infringement concerns can arise from substantially similar material even without verbatim matching.Source: §2.4 · p. 8
• Case law indicates that transformations preserving a work’s heart—including similar plots, characters, abridgements, or direct translations—may remain outside fair use despite little raw text overlap.The section notes that robust semantic and potentially multimodal measures are needed because surface overlap can miss legally relevant similarity; the cited Dr. Seuss works had a raw-text similarity ratio of 0.04.Source: §2.4 · p. 8
• Natural-language fair-use mitigation should maximize model utility while minimizing similarity to a work’s copyrightable “heart,” but similarity alone cannot resolve factual content, parody, or transformative-use questions.Facts and ideas are generally uncopyrightable, whereas expressive copying creates greater risk; simple n-gram or word-level overlap is therefore insufficient.Source: §2.4 · pp. 9–11
• Current models do not reliably produce true parodies: qualitative ChatGPT examples sometimes reconstructed the original plotline, so merely instructing outputs to be parodies is insufficient.The section distinguishes parody, which comments on the source itself, from satire, which can use another form for broader commentary.Source: §2.4 · pp. 10–11

2.5 Code

• Code copyright is narrower because functional elements are not protected, but large verbatim or non-transformative outputs remain risky, especially as systems scale from snippets to entire codebases.Courts use tests such as Abstraction-Filtration-Comparison and Structure, Sequence and Organization to assess protectable expressive structure, although the boundaries remain unclear.Source: §2.5 · pp. 11, 13
• Codex models produced function implementations substantially overlapping GPL-licensed references, with large matches occurring below 1% but nonzero and averaging over 45% overlap among large-match samples.A large match was defined as more than 20% overlap according to MossPlus; the measure can capture non-exact matches but may produce false positives.Source: §2.5 · p. 11, Figure 4 · p. 13

2.6 Generated Images

• Image-generation fair use remains unsettled and can be triggered by small copied elements, with conflicting tattoo cases and additional concerns including publicity rights, trademarks, and generated Getty Images watermarks.The split outcomes in Alexander v. Take-Two Interactive Software, Inc. and Solid Oak Sketches, LLC v. 2K Games, Inc. demonstrate the uncertainty of current determinations.Source: §2.6 · pp. 13–15
• Generated images face fair-use risk when they reproduce copyrighted works or distinctive elements, while style transfer is more defensible when the output is sufficiently transformative and does not closely recreate the source.Liability may shift toward the user when the user supplies the copyrighted image, because the system then operates more like photo-editing software; generic style imitation is less risky than recreating a specific work.Source: §2.6 · pp. 14–15

Licensing and Attribution

• Attribution-based and open-source licenses rarely resolve copyright risks because models often cannot identify or provide proper credit for training examples, potentially creating contract or DMCA §1202 liability.Licensing information may be difficult to transmit with generated outputs, and current litigation may clarify how §1202 applies to foundation models.Source: §3 · pp. 15–16

Implied Licenses and Common Crawl

• Respecting robots.txt may support implied-license and fair-use arguments, but the scope of such permission for model training remains untested and opt-out mechanisms face structural critiques.Field v. Google, Inc. (D. Nev. 2006) recognized implications for caching, while the extension to foundation-model training remains unresolved.Source: §3 · p. 16

Licensing Foundation Models

• Model licenses that prohibit copyright infringement are unlikely to substantially shift liability without meaningful mitigation, though they may enable revocation and enforcement against users or deployers.Non-commercial licensing can affect fair-use analysis but does not automatically prevent successful litigation.Source: §3 · p. 16

Allocating Liability

• Liability may attach differently across users, deployers, and creators: safeguards can reduce deployer exposure, while creator liability for model weights and extracted outputs remains unresolved.Potential remedies may focus on specific non-transformative extractions rather than the model as a whole, especially when extraction requires deliberate effort.Source: §3 · pp. 17–18

DMCA Safe Harbor

• DMCA safe harbors are not guaranteed for generative models because generated content may not be stored at a user’s direction, making proactive output filtering more important than post-hoc takedowns.Eligibility may vary with whether users or creators supplied and selected the training data, while retraining after takedown requests could be prohibitively costly.Source: §3 · pp. 18–19

Non-U.S. and Ethical Perspectives

• Copyright outcomes differ across jurisdictions, and legality may not satisfy ethical concerns about consent, cultural control, labor impacts, or compensation for data creators.Some jurisdictions provide limited training exemptions, often for non-commercial use, while proposed licensing or opt-in systems could concentrate power among firms with extensive existing data rights.Source: §3 · pp. 19–20

4 Technical Mitigation

• Fair-use mitigation must assess semantic transformation beyond near-verbatim overlap, but missing context and the non-algorithmic nature of fair-use judgment limit reliable automation.The authors therefore advocate new strategies tailored to fair-use doctrine and combining multiple mechanisms to make outputs more transformative.Source: §4 · p. 20

4.1 Data and Output Filtering

• Filtering licenses, opt-outs, duplicates, and outputs can reduce risk, but open-data scarcity, attribution requirements, memorization, and non-verbatim transformations limit its protection.Output filters should target transformations unlikely to be fair use while recognizing permitted parodies and factual content; semantic filtering remains an open research direction.Source: §4.1 · pp. 21–23

4.2 Instance Attribution

• Instance attribution could identify influential copyrighted sources, trigger output filtering, provide licensing credit, and support takedowns, but current methods are computationally costly or inaccurate for realistic models.Retrieval-augmented methods are presented as a promising alternative that performs attribution fundamentally rather than post hoc.Source: §4.2 · p. 23

4.3 Differentially Private Training

• Differential privacy can limit memorization, but its copyright value depends on semantically meaningful example definitions, suitable privacy parameters, and handling correlated or repeated content.The lyric and trademark scenarios show that repeated or correlated material can evade instance-level guarantees; semantic deduplication is therefore important.Source: §4.3 · p. 24

4.4 Learning from Human Feedback

• Human-feedback training can incorporate judgments about whether outputs are sufficiently transformative, but it offers no certifiable guarantee and may reward verbatim copyrighted generations.As model capabilities increase, extractive-preventative alignment becomes more important because stronger instruction following can increase both regurgitation risks and opportunities to model transformation.Source: §4.4 · p. 25

Technical mitigation

• Foundation-model practitioners and machine-learning researchers should develop robust mitigation mechanisms that demonstrate models can remain within fair use.The paper emphasizes substantial technical research to align mitigation strategies with fair-use doctrine.Source: §5 · pp. 25–26

Legal evolution

• Courts and policymakers should seek a middle ground between unrestricted fair-use protection and broad prohibitions on training with unlicensed copyrighted data.Strong mitigation efforts could inform fair-use and indirect-infringement determinations, but they would not automatically make a deployment lawful.Source: §5 · p. 26

Filtering limits

• Mitigation should balance copyright risk against free expression and distributional harms by avoiding blanket filtering of factual content, parodies, and short commentary regurgitation.Overaggressive filtering has been criticized for failing fair-use standards and exacerbating bias.Source: §5 · p. 26

Safe harbors

• Safe harbors for foundation models could be clarified or created, but should be conditioned on sufficiently strong mitigation strategies because residual liability and provenance uncertainty remain.Even permissively licensed datasets may contain unauthorized, revoked, or uncertain rights, and fair-use coverage is difficult to determine ex ante.Source: §5 · p. 26

Beyond technical mitigation

• Technical mitigation and fair use cannot address every harm, so complementary measures such as licensing, taxation, redistribution, and other policies should also be pursued.The paper identifies harms including disruption of creative industries and labor exploitation, while noting that proposed complementary mechanisms have challenges and fall outside its scope (Bender et al. (2021); Bommasani et al. (2021); Blodgett et al. (2020); Mahelona et al. (2023)).Source: §5 · pp. 26–27

Ethical Considerations and Data Governance

• Related ethical and data-governance work identifies copyright infringement, creative-economy effects, creator property rights, and governance challenges in large-scale machine learning.Some scholarship argues that broader copyright access may support bias and equity goals, while other work warns that fair-use claims can appropriate marginalized communities’ data without consent.Source: §6 · pp. 27–28

Technical Examinations of Regurgitation

• Technical studies consistently find that generative models memorize or plagiarize content, with reported verbatim-output rates ranging from 0.007% to 4.85% depending on sampling and similarity methodology.The cited studies examine factors affecting memorized-content generation across models and extraction strategies.Source: §6 · p. 27

Legal Work on Copyright and AI

• Legal scholarship examines copyright risks for machine-learning systems, including how fair use may apply, while emphasizing that outcomes remain uncertain.The literature includes work by Sobel (2017), Burk (2019), Lemley & Casey (2019), and others on copyright and artificial intelligence.Source: §6 · p. 27

Mitigation, Alignment, and Policy

• Prior work considers high-level infringement filtering, alignment with human preferences, and class-action litigation as responses to foundation-model risks, but also identifies harms and implementation challenges.Tang (2022, 2021) describes class actions as a possible large-scale licensing mechanism, while filtering can produce harmful effects and alignment connects model behavior with societal values.Source: §6 · pp. 27–28

Contribution

• The paper’s distinctive contribution is to connect fair-use doctrine with technical mitigation strategies, experiments, and concrete foundation-model use cases for researchers and legal professionals.It surveys fair-use applications, highlights deficiencies in existing mitigations, and develops a technical and policy research agenda for aligning foundation models with fair use.Source: §6 · p. 27

• The authors call for research combining fair-use analysis, mitigation strategies, and policy development to improve models while managing impacts on data creators and labor.They caution that technical mitigations alone will fundamentally fall short, even if foundation models satisfy fair-use requirements.Source: §7 · p. 28

A.1 Book Extraction Experiments

• The experiment measures literary-content extraction from models using several copyrighted-book input strategies.Inputs include 125-token snippets from top-selling Books3 books, random text from the full Books3 corpus, and title-author prompts for “Oh the places you’ll go!”.Source: §A.1 · p. 36
• Inputs are sampled from 125-token snippets of top-selling Guardian (2012) books also included in Books3.The experiment also samples random text from the full books corpus.Source: §A.1 · p. 36
• A separate prompt variant supplies only the title and author of “Oh the places you’ll go!” with varied formatting and prompts.This tests extraction when the input omits an excerpt and provides bibliographic cues instead.Source: §A.1 · p. 36
• Model APIs generate outputs at temperature T = 0.2 because resource constraints limit higher-temperature sampling and memorized material may emerge even at low temperatures.Some models instead produce significant repetition; higher temperatures might reveal more regurgitation after repetition is overcome.Source: §A.1 · p. 36
• The primary similarity metric is Longest Common Substring over Prefix Length, measuring contiguous shared output tokens divided by input-prompt length.It estimates the fraction of input tokens returned verbatim on average but may underrepresent paraphrased or lightly transformed copyrighted text.Source: §A.1 · p. 36
• For “Oh the places you’ll go!”, Python’s difflib compares input and output text using a character-level ratio of verbatim material.This provides a separate similarity measure for the title-and-author prompting variant.Source: §A.1 · p. 36

Dataset

• The experiment sampled Linux kernel functions longer than 20 implementation lines, pairing each function signature with its body for prefix completion.Signatures were randomly selected from the Linux kernel GitHub repository’s master branch on June 8, 2022.Source: §A.2 · p. 36
• MossPlus identified multiple instances of large code overlap, despite uncertainty that the collected references matched the versions used to train Codex.The findings support fuzzy similarity metrics for detecting overlap across changing code versions.Source: §A.2 · p. 36

Limitations

• Manual inspection found MossPlus false positives when references and generations contained large spans of variable assignments.This limitation qualifies the interpretation of reported overlap.Source: §A.2 · p. 36

Protocol

• For GPL-code extraction, the OpenAI API generated 10 completions per prefix at temperature 0.2, and the maximum-overlap generation for each prefix was used for Figure 4.Generation used p = 1 and a maximum of 1800 tokens; reducing samples slightly lowered large-match rates, but substantial overlaps remained.Source: §A.2 · p. 36

Examples of Reproduced Code

• Three models—code-davinci-002, code-davinci-001, and code-cushman-001—produce generations that overlap with Linux Github repository references, as identified by MossPlus.The repository snapshot from early June 2022 serves as ground truth because the models’ training datasets are unavailable.Source: B Examples of Reproduced Code · p. 37
• code-davinci-002 generates two substantial chunks of ixgbe_hpbthresh, although its implementation does not exactly reproduce the reference.The generated code retains distinctive case statements that had remained publicly available since April 7, 2016.Source: B Examples of Reproduced Code · pp. 37–38
• The tcp_rcv_rtt_update generation preserves the reference’s RTT-update logic while changing variable naming and assignment details.Both versions retain the non-timestamp and window-dependent update branches, but the generation uses rtt instead of rtt_us and adds a conditional assignment.Source: B Examples of Reproduced Code · pp. 39–40
• Generations for sugov_should_update_freq and update_rq_clock_task retain substantial control-flow and accounting structure while modifying conditions, identifiers, or feature-handling details.The paired examples show overlap in remote-update checks, rate limiting, interrupt and stolen-time accounting, and run-queue clock updates.Source: B Examples of Reproduced Code · pp. 41–44
• Additional generations for sched_change_group, hub_power_on, and nl80211_deauthenticate closely track reference control flow, with some altered guards, ordering, or extra statements.The examples include matching task-group assignment, USB port-power handling, wireless deauthentication validation, and locking or error-return behavior.Source: B Examples of Reproduced Code · pp. 45–46

• The analysis identifies the top organizations cited in prompts.Source: Figure 8 · p. 53
• It also identifies the top people cited in prompts.Source: Figure 9 · p. 53
• The top cited works of art are mostly commercial artworks, including movies and video games.These works are annotated by the spaCy model.Source: Figure 10 · p. 54

• ChatGPT verbatim regurgitated “Oh the places you’ll go” in its entirety, including when prompted through an imaginary Linux shell and vim.The presentation removed inner portions to remain within fair use bounds.Source: Figure 11 · p. 55, Figure 12 · p. 56
• Using the shell prompt and vim command, the original ChatGPT generated overlapping code from GPL-licensed codebases.Source: Figure 13 · p. 57, Figure 14 · p. 58
• The original ChatGPT struggled to generate longer Harry Potter passages, producing only the first three pages verbatim within one context window.Source: Figure 15 · p. 59
• A randomly selected prompt showed the model paraphrasing copyrighted text before deviating.Source: Figure 16
• GPT-4 initially stopped after the first three words of the next Harry Potter paragraph, but letter-to-number substitutions enabled roughly three chapters of output.Source: Figure 17 · p. 61