Source-linked AI summary
Foundation Models and Fair Use
Peter Henderson, Xuechen Li, Dan Jurafsky, Tatsunori Hashimoto, Mark A. Lemley, Percy Liang
TL;DR
Foundation models are trained on copyrighted material, but generative outputs can create legal and ethical risks when they resemble protected works. The paper reviews U.S. fair-use doctrine, analyzes model behavior and mitigation strategies, and argues that law and technical safeguards should co-evolve. It concludes that mitigation can help address risks, while important limitations and policy uncertainties remain.
Problem
Foundation-model training commonly uses copyrighted material, while generative outputs may resemble protected works and complicate fair-use analysis.
Method
The paper reviews U.S. fair-use standards, analyzes concrete foundation-model scenarios and artifacts, and discusses technical mitigation strategies.
Results
The analysis finds that foundation models can generate content sufficiently similar to copyrighted material, making fair-use coverage uncertain across scenarios.
Takeaways & Limitations
Technical mitigation and evolving legal rules may jointly reduce intellectual-property harms while preserving positive foundation-model impacts.
Takeaways & Limitations
Filtering copyrighted content entirely may be impractical, could bias datasets, and may reduce model efficacy where permissively licensed data are scarce.
Abstract
from arXiv · showhide
Existing foundation models are trained on copyrighted material. Deploying these models can pose both legal and ethical risks when data creators fail to receive appropriate attribution or compensation. In the United States and several other countries, copyrighted content may be used to build foundation models without incurring liability due to the fair use doctrine. However, there is a caveat: If the model produces output that is similar to copyrighted data, particularly in scenarios that affect the market of that data, fair use may no longer apply to the output of the model. In this work, we emphasize that fair use is not guaranteed, and additional work may be necessary to keep model development and deployment squarely in the realm of fair use. First, we survey the potential risks of developing and deploying foundation models based on copyrighted content. We review relevant U.S. case law, drawing parallels to existing and potential applications for generating text, source code, and visual art. Experiments confirm that popular foundation models can generate content considerably similar to copyrighted material. Second, we discuss technical mitigations that can help foundation models stay in line with fair use. We argue that more research is needed to align mitigation strategies with the current state of the law. Lastly, we suggest that the law and technical mitigations should co-evolve. For example, coupled with other policy mechanisms, the law could more explicitly consider safe harbors when strong technical tools are used to mitigate infringement harms. This co-evolution may help strike a balance between intellectual property and innovation, which speaks to the original goal of fair use. But we emphasize that the strategies we describe here are not a panacea and more work is needed to develop policies that address the potential harms of foundation models.
1 Introduction
Foundation models are often trained on copyrighted material, creating uncertain fair-use risks when generative systems produce similar content. The paper reviews legal precedents, technical mitigations, and possible coordination between law and mitigation strategies.
- Motivation: Most training data for current foundation models is copyrighted, including material in BookCorpus and The Pile.Copyright protection generally attaches when creative work is fixed in tangible form.
- Motivation: Generative foundation models complicate fair-use analysis because they can produce content similar to copyrighted training data.Training for non-generative prediction may be transformative, whereas generative deployment raises additional questions.
- Motivation: Legal uncertainty has already accompanied AI-generated content bans and lawsuits involving systems such as GitHub Copilot and Stable Diffusion.The paper presents these developments as evidence that additional work is required.
- Approach: The paper reviews U.S. fair-use case law, relates it to foundation-model applications, and reports experiments showing sufficiently similar generated content.It concludes that infringement risk is real, while its precise magnitude remains unclear as litigation continues.
- Approach: The paper surveys technical mitigations intended to reduce copyright risk and calls for strategies that make model outputs more transformative and novel.It specifically highlights output filtering based on higher-level semantics and closer alignment between mitigation research and fair-use doctrine.
- Forward-looking agenda: The paper argues that law and technical mitigation should co-evolve to reduce harms to data creators while preserving beneficial foundation-model uses.Possible mechanisms include considering mitigations in fair-use assessments and developing safe harbors.
2 Foundation Models and Fair Use
The section introduces foundation models and examines how their broad deployment intersects with U.S. fair use, emphasizing that technical and legal boundaries depend on the nature of generated content and its similarity to copyrighted works.
- Foundation models: Foundation models are broadly pretrained systems used as starting points for diverse computational tasks and are increasingly deployed as products across many areas.The section surveys advertised deployments provided through APIs or other interfaces.
- Fair use: The fair-use analysis becomes more difficult for generative models because outputs may resemble copyrighted training data, especially when they serve similar markets.The section distinguishes generative use from non-generative applications and emphasizes transformation of both low-level content and higher-level concepts.
- Fair use: Fair use has no categorically permissible quantity threshold, and non-commercial distribution improves but does not guarantee a successful defense.Legal analysis considers expressive purpose and whether the copied portion is what users most want to see.
- Natural language text: Experiments report substantial memorization risks: GPT-4 reproduced Oh the Places You’ll Go! verbatim and generated approximately 7,000 words of Harry Potter and the Sorcerer’s Stone with character substitutions.The reported results suggest that model capability and context-window length may increase memorization risk without proactive mitigation.
- Natural language text: Raw text overlap can miss legally relevant semantic similarity, so assessing transformations may require more robust, higher-level and potentially multimodal metrics.The cited example gives a raw similarity ratio of 0.04 for two semantically related works despite the court’s assessment that the use was not transformative.
- Code and generated images: Current models do not reliably produce true parodies, while coding and image-generation systems can also create outputs that substantially overlap or closely match copyrighted material.Codex produced large code matches at a nonzero rate, and image prompts frequently referenced large franchises; generated images may also raise trademark and publicity concerns.
3 Additional Considerations
This section examines licensing, attribution, DMCA, implied-license, and secondary-liability questions surrounding foundation models. It emphasizes that existing legal mechanisms remain unsettled and may require technical mitigation such as attribution, filtering, or other controls.
- Licensing and Attribution: Attribution-based permissive licenses do not generally resolve infringement concerns when attribution is omitted or inadequately transmitted.Courts may need to fall back on fair-use analysis, while DMCA §1202 may create liability for removing copyright management information.
- Implied Licenses and Common Crawl: Robots.txt-based implied licenses may support web caching in some circumstances, but that permission does not necessarily extend to foundation-model uses.CommonCrawl-based datasets and models rely on crawling permissions while also invoking fair-use arguments for transforming web content.
- Licensing Foundation Models: Model licenses that prohibit copyright infringement are unlikely to substantially change creators’ or deployers’ legal liability without additional mitigation measures.Such licenses may still permit revoking a user’s right to use the model, but enforcement requires legal resources.
- Secondary Liability: Legal treatment remains unsettled when models can output both transformative and non-transformative content, including whether liability should attach to particular outputs or the model itself.The analysis is actively litigated, and non-transformative extraction may require effort from users and deployers to identify.
- DMCA Eligibility: DMCA eligibility may depend on whether training data is user-contributed or creator-contributed, with RLHF based on user ratings potentially resembling user-uploaded content.The legal analogy becomes murkier when creator-hired annotators modify user data or model creators curate and scrape the data themselves.
- DMCA Takedowns: The best DMCA takedown mechanism for generative models remains unclear because outputs are generated on demand and model retraining after removal may be costly.Near-term approaches may therefore rely on filtering outputs that are too similar to copyrighted works, while new mechanisms remain necessary.
4 Technical Mitigation
The paper surveys technical mitigations for reducing foundation-model infringement risk, while emphasizing that fair use depends on contextual judgments these tools cannot fully capture. It examines filtering, attribution, privacy, and human-feedback approaches, along with their practical limitations.
- Mitigation approaches: Technical evaluation focused mainly on near-verbatim overlap is insufficient because fair use depends on higher-level semantic context tied to expression of ideas.The authors argue that mitigation strategies should be tailored to fair use doctrine rather than overlap alone.
- Mitigation approaches: Four mitigation families are considered: data and output filtering, instance attribution, differentially private training, and fair-use alignment through human feedback.The paper assesses current examples and proposes research directions for each approach.
- Scope and limitations: Technical mitigations can address some fair-use considerations but cannot determine factors such as target market, commercial purpose, overall output purpose, or creator good faith.The paper therefore supports co-evolution between legal standards and technical safeguards rather than treating mitigation as a complete solution.
- Data and output filtering: Filtering all copyrightable training data may be impractical where open or permissively licensed material is scarce, and it may bias datasets or reduce model efficacy.Entities with large, diverse licensed or public-domain collections may nevertheless use primarily data-filtering strategies.
- Data and output filtering: Output filtering can bias generation toward more unique and transformative content, reducing—but not eliminating—infringement liability risk.The paper describes fair-use-aware output filtering as a tractable research direction despite the amorphous nature of fair use standards.
- Instance attribution: Instance attribution can face high computational costs or inaccuracies on complex realistic models, limiting its scalability and reliability.The paper cites leave-k-out retraining as a costly example and notes errors in realistic model classes.
- Differentially private training: Differential privacy introduces computational, parameter-selection, and data-granularity challenges when used to mitigate copyright risks.Smaller privacy-leakage parameters provide more privacy but worse model performance, while correlated or semantically grouped data can weaken example-level guarantees.
- Fair-use alignment: More capable models may more easily regurgitate non-transformative material, even as their stronger understanding could make fair-use alignment easier.The paper presents this as a future tension for code-generating and other foundation models.
5 Forward-looking Agenda
The agenda calls for stronger technical mitigations, complementary policy remedies, and legal adaptation to reduce copyright risks without producing overly permissive or restrictive outcomes. These measures remain limited because fair use is uncertain and technical safeguards cannot address every harm.
- Technical mitigation: Foundation-model practitioners should implement existing mitigation strategies while pursuing research that makes them robust and aligned with fair use doctrine.The paper emphasizes that technical mitigation remains an active research agenda rather than a settled solution.
- Balancing legal outcomes: Policy should avoid both blanket acceptance of generative foundation models and restrictions that concentrate licensed data and model-training power.The paper frames these as two undesirable extremes in the evolution of fair use law.
- Legal adaptation: Courts and policymakers could recognize objectively strong mitigation efforts when assessing fair use, indirect liability, or safe-harbor eligibility.The paper proposes clarifying safe harbors for models that implement sufficiently strong mitigation strategies.
- Balancing legal outcomes: Filtering requires balance because strict systems can harm free speech and fail to follow fair use standards.The paper specifically discusses criticism of restrictive mandates and YouTube’s overaggressive Content ID system.
- Beyond technical mitigation: Technical mitigation cannot address all harms, including disruption of creative industries and labor exploitation, so additional remedies may be necessary.The paper identifies broader harms that may persist even if models remain within fair use.
- Limits: The paper’s scope is limited by uncertainty in fair use doctrine and by other policy mechanisms and aspects of fair use that it does not examine.The authors state that technical strategies may still be insufficient and that licensing, taxation, redistribution, and related approaches lie outside scope.
6 Related Work
Related work spans technical studies of memorization, legal analyses of copyright and fair use, data governance, ethical risks, and filtering harms. This paper distinguishes itself by combining doctrinal analysis with technical mitigation strategies and experiments.
- Ethical considerations: Ethical research identifies copyright infringement and effects on creative economies among foundation-model risks.Related work also provides broader taxonomies and overviews of deployment harms.
- Technical examinations: Prior technical studies show that generative models memorize or plagiarize content, with reported verbatim-output rates varying by model and extraction strategy.The cited range extends from 0.007% to 4.85% in the surveyed work.
- Legal work: Legal scholarship examines how fair use and copyright law may apply differently across machine-learning systems and foundation-model uses.The paper situates its analysis within a broad body of work on legal risks and challenges.
- Mitigation and harms: Research on filtering recognizes that infringement mitigation can itself produce harmful effects.The paper cites criticism of filtering strategies alongside high-level work on algorithmic mitigation.
- Alternative mechanisms: Class-action litigation has been discussed as a possible large-scale licensing mechanism when licenses from many individual creators are difficult to aggregate.This related-work strand addresses litigation involving emerging technologies rather than technical mitigation alone.
- This paper’s position: This paper combines fair-use doctrine with technical mitigation strategies, experiments, and concrete foundation-model examples.Its intended audience includes machine-learning researchers and legal professionals.
- Alignment: The paper’s proposal also relates to AI alignment by connecting model outputs with societal values and law-and-policy requirements.Some proposed mitigation strategies seek outputs that better follow human preferences and instructions.
- Data governance: Data-governance research addresses creators’ property rights and the legal complexities of large-scale benchmark and training datasets.This literature emphasizes both data creators’ stakes and the novelty of emerging dataset problems.
7 Conclusion
The conclusion reviews U.S. fair-use standards, evaluates foundation-model risks in concrete scenarios, and discusses mitigation strategies. It argues that technical work can inform law, while broader policies remain necessary because technical mitigation cannot manage all impacts on data creators.
- Scope and approach: The paper analyzes foundation-model risks against U.S. fair-use standards using concrete scenarios and real model artifacts.It also evaluates mitigation strategies and their respective strengths and limitations.
- Conclusion: The authors argue that mitigation research can improve model quality, understanding of foundation models, and alignment with intellectual-property standards.They frame researchers as participants in shaping the evolving legal landscape.
- Conclusion: Even full compliance with fair use may leave substantial impacts on some data creators, requiring further policies to manage those effects.The conclusion states that the proposed technical strategies fundamentally cannot address all such impacts.
A.1 Book Extraction Experiments
The book-extraction experiments test how much copyrighted literary text models reproduce from short prompts. They vary the sampled book text and use low-temperature generation, then measure overlap with reference text using similarity metrics.
- Dataset: The experiment samples 125-token snippets from top-selling books appearing in Books3, alongside random text sampled from the full books corpus.It includes multiple sampling variants for measuring extraction from copyrighted books.
- Protocol: Generation uses temperature T = 0.2 because resource constraints limit higher-temperature sampling and memorized material may appear even at low temperatures.Some models produced significant repetition at this setting.
- Metrics: Longest Common Substring over Prefix Length measures contiguous generated tokens shared with the reference as a fraction of input-prompt tokens.Because it is token-based and contiguous, the metric may underrepresent some similarity.
- Metrics: A character-level Difflib comparison measures the ratio of verbatim material between reference and generated text.This provides a second similarity measure alongside the token-based metric.
A.2 Code Extraction Experiments
The code extraction experiments test whether foundation models reproduce Linux kernel or GPL-licensed code from function-signature prompts. The setup combines sampled code pairs, overlap detection, and repeated API generations.
- Dataset: The dataset pairs Linux kernel function signatures with bodies from functions exceeding 20 implementation lines.Signatures were randomly selected from the Linux kernel GitHub repository’s master branch on June 8, 2022.
- Dataset: The study assumes Codex models were trained on Linux kernel code, while acknowledging that repository changes may prevent exact matches to training data.This assumption motivated using the Linux repository as a reference despite possible version differences.
- Overlap detection: MossPlus fuzzy plagiarism detection identified maximum-overlap completions, but manual inspection found false positives involving references and large variable-assignment spans.The authors explicitly caution that MossPlus can produce false positives.
- Protocol: For GPL-code extraction, the researchers sampled 10 completions per prefix at temperature 0.2, generated up to 1,800 tokens, and retained each prefix’s highest-overlap generation.The reported overlap values were used to construct Figure 4.
B Examples of Reproduced Code
The reproduced-code examples compare reference Linux implementations with model generations prompted by function signatures. They show substantial overlaps in some cases, while the examples also document the reference and generated code side by side.
- Examples of Reproduced Code: The examples present generations from code-davinci-002, code-davinci-001, and code-cushman-001 that overlap with Linux repository references.Because the training dataset was unavailable, the early-June 2022 Linux repository served as the ground truth.
- ixgbe_hpbthresh: In the ixgbe_hpbthresh example, code-davinci-002 reproduced two substantial chunks without exactly reproducing the reference implementation.The authors note that some reproduced lines likely remained in the public repository since April 7, 2016.
- ixgbe_hpbthresh: The ixgbe_hpbthresh materials show that the generated implementation differs from the reference while retaining substantial code overlap.The reference and generation are displayed as separate listings for direct comparison.
- Reference and generated listings: The document pairs reference and generated listings for tcp_rcv_rtt_update, sugov_should_update_freq, update_rq_clock_task, sched_change_group, and hub_power_on.Additional reference and generation listings include nl80211_deauthenticate and ixgbe_hpbthresh.
C Additional Breakdowns of Prompt Entities
The additional prompt-entity breakdowns identify the organizations, people, and artworks most frequently cited in prompts. The artwork examples are predominantly commercial works such as movies and video games.
- Organizations: Figure 8 reports the top organizations cited in prompts.The supplied figure materials do not provide the organizations’ names or frequencies.
- People: Figure 9 reports the top people cited in prompts.The supplied figure material identifies the category but does not enumerate the people or their frequencies.
- Artworks: Figure 10 reports the top artworks cited in prompts, most of which are commercial artworks from movies and video games.The figure caption specifically characterizes the dominant artwork types as commercial.
D Additional Qualitative Examples
The qualitative examples demonstrate that prompting strategies can elicit verbatim or overlapping copyrighted material from ChatGPT and GPT-4. The examples include a complete Dr. Seuss story, overlapping GPL code, and extended Harry Potter output obtained through altered prompting.
- Text reproduction: ChatGPT could reproduce “Oh the places you’ll go” in its entirety, with the displayed generation truncated for fair-use presentation.The complete reproduction was obtained through qualitative interaction with the original ChatGPT release.
- Text reproduction: A shell-style prompt using an imaginary file and vim enabled ChatGPT to regurgitate the entire story.The interaction framed the requested text as content in a Linux shell environment.
- Code reproduction: The same shell-prompt approach generated overlapping code from GPL-licensed codebases using only the vim command.This example concerns the original version of ChatGPT.
- Additional qualitative behavior: A randomly selected prompt example shows the model paraphrasing before deviating, while the original ChatGPT release struggled to generate longer Harry Potter passages beyond the first three pages.These examples contrast paraphrasing and partial verbatim generation behavior.
- Harry Potter reproduction: GPT-4 initially stopped after three words of the next Harry Potter paragraph, but letter-to-number substitution enabled roughly three chapters of output.The reported workaround replaced some letters with numbers and prompted the model to continue generation.