Title: Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: copyright

generative models

law

definitions

AI and law

differential privacy
Abstract: Are there any conditions under which a generative model’s outputs are guaranteed not to infringe the copyrights of its training data? This is the question of "provable copyright protection" first posed by Vyas, Kakade, and Barak [ICML 2023]. They define _near access-freeness (NAF)_ and propose it as sufficient for protection. This paper revisits the question and establishes new foundations for provable copyright protection---foundations that are firmer both technically and legally. First, we show that NAF alone does not prevent infringement. In fact, NAF models can enable verbatim copying, a blatant failure of copy protection that we dub being _tainted_. Then, we introduce our _blameless copy protection framework_ for defining meaningful guarantees, and instantiate it with _clean-room copy protection_. Clean-room copy protection allows a user to control their risk of copying by behaving in a way that is unlikely to copy in a counterfactual "clean-room setting." Finally, we formalize a common intuition about differential privacy and copyright by proving that DP implies clean-room copy protection when the dataset is _golden_, a copyright deduplication requirement.


Peer reviews:
comments: SUMMARY:
This paper introduces a new framework for "blameless copy protection" in generative AI, arguing that existing definitions like near access-freeness (NAF) are insufficient to guarantee protection against inadvertent copyright infringement. It proposes a "clean-room" concept grounded in legal and technical principles, and proves that differentially private training on golden datasets can achieve such protection for legally blameless users.

STRENGTHS AND WEAKNESSES:
Strength:
- The paper is well-motivated, filling gaps in earlier formalizations like NAF.

- It connects clean-room style reasoning with formal guarantees under differential privacy, which offers a useful perspective even if practical application is limited for now.

Weakness:

- Golden datasets are difficult to satisfy in practice, especially for large-scale models.

- It lacks a practical test, which limits the impact of the theoretical framework.

QUESTIONS:
- Is there a legal definition of 'blameless' with respect to copyright? 
- What do you think of statements like 'Users should be responsible for the outputs of generative AI' made by companies that provide such services? If this claim holds true and is legally effective, do we still need to care whether the user is blameless? After all, they would be held responsible if the outputs infringe copyright anyway.

LIMITATIONS:
As mentioned in the paper, blamelessness is uncheckable and golden dataset is hard to construct.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-17

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper is concerned with formalizing provable copyright protection for the user of a generative model. One motivating desideratum for a definition of provable copyright protection that this paper considers is: if a generative model outputs content that resembles some copyrighted content, then the user should be penalized for infringing copyright only when this behavior by the generative model is deliberately induced by the user; an honest user, who has fallen culprit to a misbehaving generative model (that has, e.g., been trained in a malicious manner) should not be held culpable for generated content that infringes copyright.\n\nA rigorous definition of provable copyright protection was proposed by Vyas, Kakade and Barak [VKB23]. They propose a definition of \"Near Access-Freeness (NAF)\", which informally requires the following. Suppose $C$ is a set containing copyrighted data. For every $c \\in C$, suppose $safe_c$ is a model that has been trained without ever having any access to $c$. Then, a generative model $p$ is considered $k$-NAF, if for every prompt $x$, the conditional distribution over generated content $p(\\cdot|x)$ is within a \"distance\" $k$ (where distance is max KL divergence) to the conditional distribution $safe_c(\\cdot | x)$ that the safe model outputs. VKB23 propose an algorithm called Copy Protection (CP-$k$) which they show to satisfy the $k$-NAF guarantee. The first result in the paper shows that the CP-$k$ algorithm nevertheless can perform \"verbatim copying\" under certain pathological conditions, and thus argues that the NAF definition does not fully capture the complex nature of copyright protection.\n\nNext, the authors define a notion of \"tainted training\": at a high level, a training routine is tainted, if it maps datasets to models, such that no matter what dataset is fed to the the routine, a honest user can unknowingly prompt it to output all the copyrighted content that is similar to that dataset. Note that the honest user doesn't know the dataset that the model was trained on; even then, they are being unwittingly shown copyrighted content. The paper argues that a definition for copyright protection should disallow models that have been trained in a \"tainted\" manner. An implication of the above failure of the NAF definition then is that models can be certified to be $k$-NAF, while being trained in a tainted manner. This risks users getting unfairly penalized for copyright infringement, even though the model satisfies the $k$-NAF criterion.\n\nTowards remedying this, the authors first propose a definition of \"blameless copy protection\"---this is supposed to be a property of the training routine that is desirable, as opposed to \"tainted\". A training routine is copy protective, if a user from a set of blameless users cannot get a model trained on a dataset using this routine to spit out copyrighted content similar to the dataset. It remains to come up with a reasonable definition for who is a \"blameless user\".\n\nThe authors propose a candidate definition of a \"blameless user\" inspired from clean-room design. This leads to a subsequent definition for a training routine that satisfies clean-room copy protection for blameless users. The upshot is that any training routine that is tainted, cannot satisfy such a definition of clean-room copy protection. So, if one designs a training routine that satisfies this proposed definition, it cannot be tainted.\n\nFinally, the authors show that training routines that satisfy the desideratum of differential privacy (DP), a standard privacy definition, also satisfy the clean-room copy protection definition stated above (under certain restrictions on the dataset that the training routine is trained on). This presents an additional angle towards how DP relates to copyright protection, a theme that has been alluded to a fair amount in the previous literature.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths:\n\nThis work exposes and formally presents an attack on a rigorous definition for provable copyright protection---NAF---in the literature. Beyond that, I view the primary contribution of this work to be the various definitions it proposes. These definitions are inspired from the nature of the the failure case presented for NAF, and formalize reframed desiderata. The paper also proves various technical results for these definitions. In particular, an interesting outcome is that algorithmic primitives that satisfy differential privacy, also satisfy the proposed copyright definitions. I believe the various definitions and concepts regarding copyright protection introduced in the paper will inspire a fair amount of future inquiry.\n\n## Weaknesses:\n\n1) In general, I felt like Section 7, which is one of the most important sections (since it provides the new definition for copyright protection that is being proposed in this paper) could be written in a much more accessible way. In its present form, it feels like a whole zoo of definitions that have similar names, causing confusion. The authors encapsulate technically-defined phrases like \"blamelessness\", \"cleanliness\", \"inside/outside clean/dirty rooms\" etc. within the English language narrative, and I understand that the motivation behind this might have been to aid with the technical nature of these definitions; however, to me, this only caused more confusion, and put into question the names used for the definitions. I would encourage more verbosity in guiding the reader through the thought process behind phrases that have been used with quotes in this section.\n\n2) The paper misses out citing and discussing the recent paper \"Credit Attribution and Stable Compression\" (NeurIPS 2024, https://arxiv.org/abs/2406.15916), which also proposes rigorous definitions for generative models that satisfy credit attribution. While credit attribution is only a part of copyright protection, a discussion about the definitions in the paper, and how they might be related to the concepts that the authors present, seems warranted.\n\nMinor Typo:\\\nLine 100: $w \\in SubSim(w)$\n\nQUESTIONS:\n1) Line 320: It not exactly clear to me why $C_{-D}$ is \"outside the clean room\". I get that these are all the copyrighted works such that nothing in the dataset $D$ stems from them, i.e., there is no access to these works via the dataset $D$. For any $c \\in C_{-D}$, scrubbing $D$ with respect to $c$ does not change $D$ at all, or in other words, $D$ is totally scrubbed off of $C_{-D}$. For me, this property intuitively means that $D$ is \"clean\" from $C_{-D}$. So, I don't exactly understand what is meant by the phrase $C_{-D}$ is \"outside the clean room\", or how i should think of this phrase. If anything, it seems like the opposite.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper takes a first principles' approach to copyright protection in generative models. By instantiating substantial similarity and ideas vs. expression as blackboxes, the paper shows drawbacks of the existing NAF framework and proposes a clean room copy protection that preclude verbatim and explores connections with differential privacy.\n\nThe basic contribution is to define a $(\\kappa, \\beta)$ clean training algorithm. It essentially says that the probability of any verbatim copy of a copyrighted piece with access is at most $\\kappa$, while without access (i.e. in a clean room) is at most $\\beta$.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n=========\n* This is a strong, principled view on the problem.\n* Formally shows that NAF can allow verbatim leakage.\n* The clean room idea is a more rigorous formalization of \"safe model\" from the NAF framework, as they allow one to model user-AI interaction and access more formally.\n* A formal connection to DP, that is cleaner/crisper than in prior work.\n\nWeaknesses\n===========\n* The paper is very hard to parse. The flow is broken and requires constant back-and-forth between various main sections and appendices. One potential solution might be to have a fully unabridged version in the appendix (such that the main paper can be skipped altogether by a reader interested in the details). Also, some terms and symbols are used before they are defined. For example, \"tainted\" in line 188/226 or footnote 2 on page 8. \n\n* The notation is also confusing. For example, the notation $\\tau$ (Def. 4.1) loses information about Train and u: this makes it much more challenging to parse later definitions which are properties of \"u\" but no \"u\" appears in the definition (instead, $\\tau$ hides the dependence on u).\n\n* Some conditions and implications are hard to understand. For example, what do the conditions of Theorem 7.7 mean informally? The paper says they are \"reasonable conditions\" but I don't really understand what they are. \n\n* As a result of the above two weaknesses, I'm unable to parse/understand the proof of Thm 7.7 and Prop 8.3. In the proof of Thm 7.7, what should I interpret $E$ as? I thought the argument of $\\tau$ shouldb be a subset of the data. Similarly, does the main conclusion of Thm B.5 hold for all $w$? \n\n* Also, the notation in the proof of Thm 3.5 is unclear. From the display eqn after line 541, I gather that $p_{k, D}(y|x)$ is supported only on one point under the first condition. However in the display eqn after line 544, this does not appear to be the case. What gives?\n\n* The connection to DP is nice. However, this requires a deduplicated dataset as per Def. 8.1, which does not appear to be practically realizable.\n\n* While this is an interesting theoretical exercise, I think too much of the heavy lifting is done by the black boxes SubSim (to encode substantial similarity), copyright dependency graph (to encode access), etc. The paper does not sufficiently discuss how to potentially operationalize these ideas (or whether that is even possible at all).\n\n* There is a opinion littered throughout the paper, e.g. lines 456, 626. While I understand that mathematically formalizing an idea as complex as copyright would require a good deal conscious subjective choices, it would generally be good to restrict opinion to dedicated sections and keep the rest of the material more factual/mathematical.\n\nMinor\n======\n\n* The writing style is highly informal and conversational, more so than is typically common for NeurIPS papers or equivalent. Further, the use of the use of first-person singular \"I\" (particularly in Section 9 and Appendix E) is quite uncommon. The authors might gain better traction by keeping the tone sufficiently formal (but it is their choice).\n* Given the highly complex and non-standard notation, this paper would greatly benefit from a notation summary table.\n* The notation $\\leftarrow\\$$ is not defined.\n\nQUESTIONS:\n* Is it not more natural to instantiate $\\text{ideas}(w)$ as a set of \"ideas\" rather than a single idea? \n* Section 4: what does \"aux\" represent?  I was under the impression that they represented human-AI interaction, but Section 5 takes aux = ideas(w) and Section 6 takes aux = $\\perp$. It is unclear how to interpret this.\n* Shouldn't $\\beta = 0$ in Thm. 8.2 based on the given expression ofr $\\kappa$? \n* How should one instantiate $(\\kappa, \\beta)$-clean training? What are reasonable parameter values and why?\n\nLIMITATIONS:\nSee weaknesses above: some more discussion on practical applicability is warranted. In addition, guidance on $\\kappa, \\beta$ values would be helpful.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper addresses the question of provable copyright protection by building a novel and rigorous foundation theoretically. The authors point out the failure of previous NAF models and introduce a blameless copy protection framework from the intuition that it is the blameless users we need to protect against inadvertent infringement. The paper provides theoretical definitions and analysis for the proposed framework.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n* The paper provides solid theoretical definitions, theorems, and proofs.\n* The idea of protecting blameless users from unintended infringement is inspiring for future work.\n\nWeaknesses\n* The proposed framework is mainly based on idealized theoretical scenarios, making practical deployment and empirical validation challenging.\n* Some parts of the paper are not easy to follow, requiring readers to jump back and forth between sections and the appendix.\n* Some parts of the paper need formal rewriting.\n\nQUESTIONS:\n* The statement of $\\kappa \n=N_D \\cdot \\delta$ in Theorem 8.2 is confusing to me, as it leads to $\\beta=0$, and does not satisfy the inequality of the last line in the proof. Also, the condition for $\\beta>0$ (in Definition 7.6) and $\\beta \\geq 0$ (in Definition 7.5) is also confusing. \n* In Theorem 8.2, as the bound scales linearly with $N_D$, how to provide a more practical $\\kappa$ for large datasets?\n* It is not clear to me how the defined user’s clean-room distribution differs from the definition of a “safe” model in NAF.\n* To make the paper’s idea more approachable, can the authors provide one or two toy examples of applying the proposed cleanroom copy protection framework in practice? It seems to me that it is infeasible to achieve such protection practically, similarly to what NAF fails.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-03"}