Research map / Federated learning and privacy / Differential privacy
Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows near access-freeness (NAF) permits verbatim copying (tainted models), proposes blameless copyright protection with a clean-room instantiation (kappa,beta)-clean, and proves DP implies clean-room protection on golden datasets.
Problem
Provable copyright protection for generative model outputs: under what conditions can a model guarantee its outputs do not infringe training-data copyrights, and does near access-freeness (NAF) actually provide it?
Approach
Shows NAF admits tainted models that regurgitate training data via data-dependent prompts or composition, then defines blameless copyright protection and a clean-room variant (kappa,beta)-clean where a user's risk in the real world is bounded by their risk in a counterfactual model trained on scrubbed data; DP on golden datasets implies this protection.
Key results
- Theorem shows a training algorithm Train* such that CP* reproduces training datum c with probability 1 on prompt ideas(c) when its ideas are unique in D.
- Theorem shows k-NAF (for any k>0) can permit full dataset reconstruction with poly(L,1/k) queries and success probability above 0.99.
- Theorem shows (epsilon,delta)-DP training is (kappa,beta)-clean on golden datasets for kappa >= (e^epsilon N_D + 1) beta + N_D delta.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use differentially private training on a golden dataset | Training algorithm · Golden datasets | copying probability upper bound: κ ≥ (e^ε N_D + 1)β + N_D δ | Helped |
| Use NAF alone without protection for ideas-derived prompts | CP* · NAF with ideas-derived prompts | training-data copying probability: 1 | Hurt |
| Use k-NAF without a guarantee that composes across repeated queries | Constructed k-NAF training algorithm · k-NAF with pure-noise safe model | dataset reconstruction success probability: >0.99 | Hurt |
Surprising findings
- NAF models can be tainted: they can regurgitate verbatim training data from non-copyrightable ideas prompts.
- Any training algorithm can be made tainted, and k-NAF for arbitrarily small k can still permit full reconstruction of the training data.
Limitations
- Clean-room protection requires golden datasets, which are expensive to build and scale linearly with N_D.
- Blamelessness is not checkable in practice; beta values are conjectural.
- Results are theoretical with no empirical evaluation and make no legal conclusions.
Experimental setup
Baselines: NAF (CopyProtection) k-NAF (CP_k)
Builds on: near access-freeness CopyProtection algorithm differential privacy
Closest papers by meaning
- Copyright-Protected Language Generation via Adaptive Model Fusion (ICLR 2025 · similarity 0.87)
- Disguised Copyright Infringement of Latent Diffusion Models (ICML 2024 · similarity 0.86)
- CPR: Retrieval Augmented Generation for Copyright Protection (CVPR 2024 · similarity 0.86)
- Exactly Minimax-Optimal Locally Differentially Private Sampling (NeurIPS 2024 · similarity 0.86)
- Privacy Amplification Persists under Unlimited Synthetic Data Release (NeurIPS 2026 · similarity 0.85)
- A Privacy-Preserving Framework for Generative Model-driven Synthetic Datasets (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.