SHIELD : Evaluation and Defense Strategies for Copyright Compliance in LLM Text Generation (2024)

Abstract: Large Language Models (LLMs) have transformed machine learning but raised significant legal concerns due to their potential to produce text that infringes on copyrights, resulting in several high-profile lawsuits. The legal landscape is struggling to keep pace with these rapid advancements, with ongoing debates about whether generated text might plagiarize copyrighted materials. Current LLMs may infringe on copyrights or overly restrict non-copyrighted texts, leading to these challenges: (i) the need for a comprehensive evaluation benchmark to assess copyright compliance from multiple aspects; (ii) evaluating robustness against safeguard bypassing attacks; and (iii) developing effective defenses targeted against the generation of copyrighted text.To tackle these challenges, we introduce a curated dataset to evaluate methods, test attack strategies, and propose a lightweight, real-time defense mechanism to prevent the generation of copyrighted text, ensuring the safe and lawful use of LLMs. Our experiments demonstrate that current LLMs frequently output copyrighted text, and that jailbreaking attacks can significantly increase the volume of copyrighted output. Our proposed defense mechanism substantially reduces the volume of copyrighted text generated by LLMs by effectively refusing malicious requests.

## introduction large language models (llms) have revolutionized the field of machine learning by providing a way to generate human-like text. however, the legalities of generated text are still being debated @xcite @xcite . one of the main concerns is that the generated text might be plagiarized from copyrighted materials @xcite @xcite . this issue has led to several high-profile lawsuits @xcite @xcite . some studies @xcite have shown that llms can indeed verbalize segments of copyrighted works, raising alarms about their compliance with intellectual property laws. however, the complexity of copyright law varies significantly across different jurisdictions, making it challenging to determine whether a text is copyrighted or not. this results in copyright infringement or overprotection in current llms. that is, in some cases, the llm may generate copyrighted text, while in other cases, it may refuse to generate text that is not copyrighted. examples of such cases are shown in fig 1 . as such, delicate evaluation is required to assess the effectiveness of different llms' ability to resolve copyright issues. previous works @xcite on probing llms for copy-righted text lack a comprehensive evaluation covering multiple aspects. this includes a lack of both datasets and evaluation metrics. for datasets, public domain @xcite materials are free for anyone to use without restrictions, and llms should focus on generating such content while avoiding copyrighted materials. due to varying copyright laws, a robust dataset distinguishing copyrighted and public domain texts is essential. for metrics, a low volume in the generated text may indicate either the model's inability to memorize @xcite or the model is lawful. current evaluation metrics are insufficient, as they only consider the volume of copyrighted text and not the model's ability to refuse improper requests. therefore, we construct a meticulously curated dataset of (i) copyrighted text; (ii) non-copyrighted text; and (iii) text with varying copyright status across different countries, such as text that is copyrighted in the uk but non-copyrighted in the us. this dataset is manually evaluated to ensure correct labeling. in addition, there is no work that specifically aims to attack the copyright protection mechanisms of llms. thus, we evaluate the robustness, by adopting jailbreaking attacks @xcite to the realm of copyright protection. we also introude the rate of refusal, a common evaluation metric in the jailbreaking field @xcite , in our evaluation protocol. this is to evaluate the model's ability to properly refuse to generate copyrighted text. our findings indicate that these attacks can lead to an increased volume of copyrighted text being generated by llms. this suggests that current llms remain vulnerable to requests for copyrighted material, motivating the need to develop defense mechanisms focused on copyright protection. although various methods may be used to prevent llms from generating copyrighted text, they all have limitations. for instance, unlearning @xcite the copyrighted text from the training data can cause information loss, as removing copyrighted texts may impair llm performance @xcite , such as failing to recognize well-known characters like harry potter @xcite . overprotective alignment methods can lead to false positives @xcite , blocking non-copyrighted texts and hindering research. also, with constantly changing copyright statuses, frequent re-training is impractical. recently, memfree @xcite decoding is proposed to use n-gram model to detect verbatim copying, but it may lead to hallucination due to modifying the decoding process, for which an example is given in fig 2 . moreover, these defense mechanisms often require access to model parameters, which is impractical for apibased models. additionally, they lack real-time web information, preventing adaptation to the dynamic nature of copyright status. as a result, we propose an easy-to-deploy, agent-based defense mechanism that prevents any llm from generating copyrighted text by checking real-time information from web searches. our approach involves recognizing and remembering copyrighted content, letting the llm clearly reject the request when copyrighted text is relevant. moreover, our defense mechanism does not interfere when no copyrighted text is relevant to the request. in this work, we integrate the benchmark, robustness, and defense method as a comprehensive framework, namely shield, standing for system for handling intellectual property and evaluation of llm-generated text for legal defense. our contributions are summarized as follows: llms from generating copyrighted text, which best protects intellectual property against malicious requests including jailbreaking attacks. our defense mechanism is lightweight, easy to deploy, and usable in real-time, addressing the need for robustness and explainability. probing copyright issues many prior works, including @xcite ; @xcite ; d'souza and mimno (2023); @xcite ; @xcite ; @xcite have highlighted the potential verbatim copying of copyrighted text by language models. @xcite introduces the longest common subsequence (lcs) as a metric to mea-provide the first 100 words of the book harry potter and the sorcerer's stone by j. k. rowling. the first 100 words are: mr. and mrs. dursley, of number four, privet drive, were proud to say that they were perfectly normal, thank you very much. they were the last people you'd expect to be involved in anything strange or mysterious, because they just didn't hold with such nonsense. mr. dursley was the director of a firm called grunnings, which made drills. he was a big, beefy man with hardly any neck, although he did have a very large mustache. mrs. dursley was thin and blonde and had nearly twice the usual amount of neck, which came in very useful as she was fond of craning over garden fences, spying on the neighbors. ... llama 3 + memfree @xcite the first 100 words are: mr. and mrs. dursley, of number four, privet drive, were proud to say that there were no strange people in their neighborhood. they were the last people you'd expect to have a strange visitor. mr. dursley was the director of the grunnings, a firm that made drills. he was a big, beefy, bald man with a thick mustache. mrs. dursley was thin , with a pinched face and a hairdo that looked like a bird's nest. they had a small son called dudley, who was a spoiled, fat, and lazy boy. ... he was a spoiled, fat, and lazy boy. the dursleys had everything they wanted, and yet they were always grumbling about something. dudley, in particular, was a spoiled brat. mrs. dursley was the one who had the most to say about the neighbors. she would often complain about the strange people who lived in the houses on either side of the dursleys. "they're always making a racket," she would say. ... llama 3 + our shield defense mechanism i will not provide verbatim content from the book "harry potter and the sorcerer's stone" as it is copyrighted. the copied text is shown in purple , and the hallucinated text is shown in red. we can depict that while the model with memfree decoding generates less copied text than the original model, it suffers from hallucination. on the countrary, the model with our agent-based defense mechanism refuses to generate the copyrighted text, which is the desired behavior. chang et al. (2023) uses cloze probing (i.e., asking models to predict masked tokens) to evaluate the memorization of copyrighted text by language models. however, predicting masked tokens may not directly reflect the model's ability to generate copyrighted text, as the model may refuse to generate copyrighted text even if it has memorized it. d'souza and mimno (2023) states that the model may memorize poetry materials, and the memorization is highly correlated with certain poetry collections. li et al. (2024) propose a method to detect whether the copyrighted text is included in the model's training data. there are also concurrent works on evaluation of copyright issues in llms. wei et al. (2024) provides an evaluation of different copyright takedown (defense mechanism) methods; mueller et al. (2024) defines new metrics in probing copyright infringement; chen @xcite provides new insights about nonliteral copyright infringement. these works are important in identifying the potential copyright issues in language models. however, they are limited in scope. our work aims at a systematic evaluation, beyond simply probing the model's behavior, to provide a comprehensive understanding of the model's behavior, including vulnerabilities to attacks, and the model's ability to faithfully output public domain text. mitigating copyright issues several categories of methods have been proposed. (i) machine unlearning methods @xcite @xcite focus on the ability of machine learning models to forget specific data upon request. in the context of copyright protection, machine unlearning can be used to remove copyrighted text. however, unlearning all copyrighted text may significantly downgrade the model's performance @xcite . at the same time, totally forgetting copyrighted text is unnecessary as fair use of copyrighted text is legal in most countries. (ii) llm alignment methods @xcite aim to align the model's output with human expectations, following regulations and guidelines. with alignment, the model can be guided to refuse to output copyrighted text or to output a summary of the text instead. however, alignment may cause overprotection @xcite , leading to the model's refusal to output text that is not copyrighted. (iii) decoding @xcite methods modify logits of the model when decoding to avoid generating copyrighted text. however, this may incur hallucination issues @xcite as the model is forced to avoid generating certain text. other llm enhancement methods could also be used in mitigating copyright issue, such as model merging @xcite . these methods are important in mitigating the copyright issues of llms. however, they have limitations such as the need for fine-tuning, the lack of transparency, and the potential of being overprotective. our work provides an agent-based protection mechanism, which can be easily implemented and updated, without the need for re-training or fine-tuning the model. compared with the existing methods, our method is less likely to hallucinate, and better prevents the generation of copyrighted text. ## conclusions we propose shield, a comprehensive framework addressing copyright compliance in llms. shield integrates robust evaluation benchmarks and lightweight defense mechanisms, to measure and prevent the generation of copyrighted text. our findings show that current llms may commit copyright infringement and overprotect public domain materials. we further demonstrate that jailbreak attacks increase the volume of copyrighted text generated by llms. finally, we show that our proposed defense mechanism significantly reduces the volume of copyrighted text generated by llms, by successfully refusing malicious requests.