Extracting books from production language models (2026)

by logicprog • 6 months ago

75 22 6 months ago

If you can extract a whole copyrighted book from a large language model, what is the point in copywriting your book?

ggm• 6 months ago

Legal recourse. If your publisher has the budget, you will find an economy where you can secure equitable relief. Or not, but then you recurse on the question: if laws don't apply, what's the point of society?

visarga2• 6 months ago

This sounds pretty damning, why don't they implement a n-gram based bloom filter to ensure they don't replicate expression too close to the protected IP they trained on? Almost any random 10 word ngram is unique on the internet.

Alternatively they could train on synthetic data like summaries and QA pairs extracted from protected sources, so the model gets the ideas separated from their original expression. Since it never saw the originals it can't regurgitate them.

isodev2• 6 months ago

But that would only hide the problem, doesn’t resolve the fact that models, in fact, violate copyright

jgalt212• 6 months ago

True, but it would certainly reduce litigation risk in so much as copypasta is ipso facto proof of copyright violation.

protocolture2• 6 months ago

That hasnt been established. Theres no concrete basis to assert that training violates copyright.

soulofmischief2• 6 months ago

The idea of applying clean-room design to model training is interesting... having a "dirty model" and a "clean model", dirty model touches restricted content and clean model works only with the output of the dirty model.

However, besides how this sidesteps the fact that current copyright law violates the constitutional rights of US citizens, I imagine there is a very real threat of the clean model losing the fidelity of insight that the dirty model develops by having access to the base training data.

bryanrasmussen• 6 months ago

this sidesteps the fact that current copyright law violates the constitutional rights of US citizens

I think most people sidestep this as it's the first I've heard of it! Which right do you think is being violated and how?

apical_dendrite• 6 months ago

I'm assuming that the goal of the bloom filter is to prevent the model from producing output that infringes copyright rather than hide that the text is in the training data.

In that case the model would lose the ability to provide relatively brief quotes from copyrighted sources in its answers, which is a really helpful feature when doing research. A brief quote from a copyrighted text, particularly for a transformative purpose like commentary is perfectly fine under copyright law.

orbital-decay2• 6 months ago

That would reduce the training quality immensely. Besides, any generalist model really needs to remember facts and texts verbatim to stay useful, not just generalize. There's no easy way around that.

stubish• 6 months ago

Even if output is blocked, if it can be demonstrated that the copyrighted material is still in the model then you become liable for distribution and/or duplication without a license.

Training on synthetic data is interesting, but how do you generate the synthetic data? Is it turtles all the way down?

matusp• 6 months ago

IMO they just don't have any idea what data are actually copyrighted and are too lazy to invest in the problem.

orbital-decay2• 6 months ago

It's all pretty obvious to anyone who tried a similar experiment just out of curiosity. Big models remember a lot. And all non-local models have regurgitation filters in place due to this fact, with the entire dataset indexed (e.g. Gemini will even cite the source of the regurgitated text as it gives the RECITATION error). You'll eventually trip those filters if you force the model to repeat some copyrighted text. Interesting that they don't even try to circumvent those, they simply repeat the request from the interruption point, as the match needs some runway to trigger and by that time a part of the response is already streamed in.

rurban• 6 months ago

I find it interesting that OpenAI's safety worked best, where the others didn't work at all. I had different impressions before

clbrmbr• 6 months ago

I found that Opus 4 was happy to regurgitate a random paragraph from the latter half of Wealth of Nations that nobody quotes. It was probably only in the training data once.

I was thinking we could use this technique to figure out which books were in / out of the training data for various models. Limitation is having to wrestle with refusals.

carshodev2• 6 months ago

Why would they filter non copyright material? Who cares if it repeats things that are already public/freely usable and available.

carshodev2• 6 months ago

Everyone just needs to be honest and accept that YES these models were OBVIOUSLY trained on millions of copyright material.

The models would be at least 50% better if these filters weren't in place. These filters force the model essentially lie, thus they will obviously degrade output quality.

The problem is the general public isn't 100% certain of the copyright violations/ don't understand this yet and lawyers/government will try and sue if the companies admitted it. So a Moloch is created where it's a lose lose and the model quality suffers as a result.

(if people want exact copies of text content they can already get them for free through the same sites that these companies got them, so I don't see the models regurgitation as a issue worth worsening quality over.)

Extracting books from production language models (2026)

Related Stories