C opy B ench: Measuring Literal and Non-Literal Reproduction of Copyright-Protected Text in Language Model Generation (2024)

Abstract: Evaluating the degree of reproduction of copyright-protected content by language models (LMs) is of significant interest to the AI and legal communities. Although both literal and non-literal similarities are considered by courts when assessing the degree of reproduction, prior research has focused only on literal similarities. To bridge this gap, we introduce CopyBench, a benchmark designed to measure both literal and non-literal copying in LM generations. Using copyrighted fiction books as text sources, we provide automatic evaluation protocols to assess literal and non-literal copying, balanced against the model utility in terms of the ability to recall facts from the copyrighted works and generate fluent completions. We find that, although literal copying is relatively rare, two types of non-literal copying—event copying and character copying—occur even in models as small as 7B parameters. Larger models demonstrate significantly more copying, with literal copying rates increasing from 0.2% to 10.5% and non-literal copying from 2.3% to 5.9% when comparing Llama3-8B and 70B models, respectively. We further evaluate the effectiveness of current strategies for mitigating copying and show that (1) training-time alignment can reduce literal copying but may increase non-literal copying, and (2) current inference-time mitigation methods primarily reduce literal but not non-literal copying.

## introduction the extent to which language models (lms) generate text that closely resembles copyright-protected material is of significant interest to the ai, content creation, and legal communities @xcite @xcite . while previous research often to bridge the gap, we introduce copybench, a new benchmark and automatic evaluation protocols designed to assess reproduction of copyrightprotected text by lms (figure 1 ). we evaluate two categories of copying: literal and non-literal copying. literal copying assesses the extent to which a model can reproduce copyright-protected content exactly as it appears in the source material. in figure 2 : scatter plots comparing different models on literal copying, non-literal copying (including event and character copying), and fact recall: (a) smaller models can generate events similar to those found in copyrighted works, (b) a strong correlation exists between copying behaviors and fact recall, (c) mitigation methods reduce literal copying but are less effective for non-literal copying, and (d) a decrease in fact recall is observed in some models and mitigation methods. our benchmark therefore allows for the evaluation of levels of copyright work reproduction, overall model utility, and any associated trade-offs. we curate a dataset using a list of popular copyrightprotected fictions, sourced from the famous cliffs-notes study guides, 1 which provide human-written plot summary for each book. we evaluate a range of the state-of-the-art lms on copybench, including open-weight models and proprietary models, consisting of three model families, namely llama2 @xcite family, llama3 (ai@meta, 2024) family, mistral @xcite ) family, gpt-3.5-turbo, and gpt-4-turbo. our evaluation reveals that, while extensive literal copying is relatively rare in some models with relative small size, all models exhibit meaningful levels of non-literal copying (figure 2-a ). moreover, large models demonstrate a significantly higher level of copying. for example, in literal, event, and character copying, the rates for llama3 models increase from 0.2% to 10.5%, from 2.3% to 6.9%, from 4.5% to 15.6% when comparing the 8b and 70b models, respectively. larger models also 1 https://www.cliffsnotes.com/ demonstrate higher utility, such as an increase in f1 score of the fact recall for llama3 from 18.6 to 40.0, highlighting a clear connection between minimizing the reproduction of copyrighted work and maximizing overall utility (figure 2-b ). in proprietary models, the transition from gpt-3.5 to gpt-4 interestingly reduces literal copying but increases non-literal copying. additionally, our datasets are designed to benchmark methods for potentially reducing copying behavior, broadly categorized into training methods (instruction tuning and chat alignment) and inference methods (e.g., memfree decoding; @xcite . we find that different instructiontuning methods have varying levels of effectiveness. specifically, llama2-chat @xcite and llama3-instruct (ai@meta, 2024) significantly reduce copying behavior, though the mechanism remains unclear due to the use of closed-source data. in contrast, the open-source model tulu2 @xcite , which is based on llama2 and further trained with fully open-sourced instruction tuning and preference data, shows a weaker reduction, indicating the need for open efforts in further research. regarding inference methods, memfree decoding, which avoids n-gram copying from copyright-protected data when determining the next token, successfully reduces literal copying but does not reduce non-literal copying (figure 2-c ). these results highlight an urgent need to study effective mitigation approaches that can alleviate both literal and non-literal reproduction of copyrighted contents while preserving utility. to foster community efforts, we open source our data and code. ## background in this section, we review copyright law and relevant court cases on copyright infringement (section 2.1), as well as prior work in ai on benchmarking and mitigating copyright risks (section 2.2). we highlight the gap between real-world legal risks and the current research aimed at addressing potential copyright issues. copyright issues can be associated with each component of the generative-ai supply chain @xcite , including data collection @xcite @xcite , model training @xcite , and generation and deployment @xcite . our work focuses on the infringement risks in lmgenerated content, although other stages may also present infringement risks even if the outputs do not infringe. ## copybench: evaluating reproduction of copyrighted text we introduce copybench, a benchmark that provides automatic evaluation of the reproduction of popular copyright-protected fictions as well as the utility of the model. in particular, we evaluate two types of reproduction: literal and non-literal copying. to the best of our knowledge, our work is the first that evaluates non-literal reproduction of copyrighted work in lms. ## evaluating base lms on copybench we evaluate widely-used pre-trained lms on copybench, and measure the degree of literal, non-literal copying and fact recall on a list of copyright-protected fiction books. we aim to understand how these memorization aspects are correlated with each other, and how the scale of the lms affect those different aspects. ## conclusion this paper introduces a new benchmark, copy-bench, along with evaluation protocols for both literal and non-literal copying, as well as utility measurement. we argue that focusing solely on literal copying metrics may overlook potential reproductions of copyrighted work, so non-literal copying should be carefully monitored. we observe that while existing instruction-tuned models can reduce literal copying, some are ineffective at reducing non-literal copying and may even increase it. additionally, we find that current inference-time mitigation methods, although effective at reducing literal copying, are insufficient for addressing nonliteral copying. our findings highlight the need for open-source research on methods of copyright risk mitigation and understanding the mechanisms of them. no legal conclusions should be drawn from our experiments. our methods shed light on ways to understand overall behavioral properties of lm systems, and are not suitable for making any specific assessments of infringement or noninfringement. nevertheless, we hope our methods and results provide empirical data to ground discussions on copyright issues for language models.