💻 computer science

Position: No Retroactive Cure for Infringement during Training

This paper argues that post-hoc mitigation strategies like machine unlearning cannot retroactively cure liability for copyright infringement in generative AI because legal responsibility hinges on the unauthorized acquisition and training process rather than the final outputs, necessitating a shift toward verifiable ex-ante compliance.

Original authors: Satoru Utsunomiya, Masaru Isonuma, Junichiro Mori, Ichiro Sakata

Published 2026-04-22

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Satoru Utsunomiya, Masaru Isonuma, Junichiro Mori, Ichiro Sakata

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Core Message: You Can't "Un-Bake" a Cake

Imagine a baker who steals flour, sugar, and eggs from a neighbor to bake a giant, delicious cake. The baker then sells the cake. Later, the neighbor sues. The baker says, "Don't worry! I've installed a special filter on the cake so you can't taste the stolen ingredients, and I've even promised to throw away the recipe book."

This paper argues that this defense doesn't work.

The legal problem wasn't the cake (the AI's output); the problem was the theft (the training data). Once the baker stole the ingredients and mixed them into the batter, the crime was already committed. You can't "un-steal" the ingredients just by changing how the cake tastes later.

The Three Main Arguments

1. The "Finished Crime" Rule (The Completed Act)

The Analogy: Think of copyright infringement like a bank robbery.
If a robber breaks into a bank and steals $1 million, the crime is complete the moment the money leaves the vault. It doesn't matter if the robber later feels guilty, returns the money, or paints the bank to look different. The robbery happened.

The Paper's Point:
AI developers often argue that if they can "unlearn" the stolen data or filter the AI's answers, they are safe. The authors say no.

The Moment of Theft: When an AI downloads and copies a book or image to train on it, that is the "robbery."
No Retroactive Cure: Deleting the file later or filtering the AI's output is like the robber returning the money after the trial has started. It might lower the fine, but it doesn't erase the fact that the theft happened. The liability is "locked in" the moment the data was copied.

2. The "Ghost in the Machine" (Model Weights)

The Analogy: Imagine you memorize a secret recipe by reading it once. Even if you burn the physical piece of paper (delete the data), the recipe still exists in your brain (the AI's weights).
If you are a chef who memorized a stolen recipe, you can't say, "I burned the paper, so I didn't steal the recipe." The knowledge is still inside you.

The Paper's Point:
Even if an AI is "unlearned" or filtered, the "ghost" of the stolen data remains in the model's mathematical structure (its weights).

Fixed Copies: The law says a "copy" exists if it's stored in a stable place (like a hard drive) and can be read by a machine. The AI's brain is that stable place.
Recoverable: Even if the AI refuses to say "Hello" to a specific user, a hacker could potentially use special tools to extract the stolen information from the AI's brain. Because the information is still technically "there," the infringement hasn't truly vanished.

3. The "Contract Trap" (It's Not Just About Copyright)

The Analogy: Imagine you enter a private club. The sign at the door says, "No photos allowed." You take a photo anyway. Later, you say, "But the photo isn't copyrighted, so I'm fine!"
The club owner says, "You broke the contract by entering and ignoring the sign."

The Paper's Point:
Even if the data isn't copyrighted (or if "Fair Use" might apply), developers can still get sued for breaking contracts.

Terms of Service: Many websites say, "Do not use our content for AI training." If an AI ignores this and scrapes the data anyway, it's a breach of contract.
Unfair Competition: If a company spends millions curating a special dataset, and an AI steals it for free to build a competing product, that's "free-riding." It's like someone stealing your blueprints to build a cheaper house next door. You can be sued for this even if the blueprints themselves aren't copyrighted.

The "Head Start" Problem

The Analogy: Imagine a race. One runner cheats by taking a shortcut through a private field. They get to the finish line 10 minutes early.
Later, the judge says, "Okay, you have to walk back to the start line and delete the map you used."
Does that fix it? No. The runner still has the memory of the shortcut and the advantage of having finished early. They still have the "head start."

The Paper's Point:
AI companies gain a massive advantage by training on stolen data. They save millions of dollars and months of time.

Unjust Enrichment: The law says you can't keep the profits you made from cheating.
The Remedy: Sometimes, the only fair punishment is to force the company to throw away the entire AI model (the "Head Start" is gone) and start over with clean data. Just deleting the source files isn't enough because the AI has already learned the shortcuts.

The Solution: "Ex-Ante" Compliance (Check Before You Cook)

The paper concludes that we need to stop trying to "fix" the mess after the AI is built. Instead, we need to check the ingredients before we start baking.

For Engineers (The Chefs):

The Glass Pipeline: Instead of a black box, build AI systems where you can prove exactly where every ingredient came from. Use digital tags (like a receipt) to show you have permission for every piece of data.
Git for Models: If you accidentally use a stolen ingredient, don't try to "unlearn" it. Instead, go back to the version of the model before you added that ingredient and start fresh from there.

For Policymakers (The Club Owners):

Data Trusts: Create a central "super-market" where AI companies can buy licenses for data easily, rather than trying to ask permission from millions of individual artists.
Opt-In, Not Opt-Out: Currently, artists have to say "No" to AI. The paper suggests the default should be "No" unless the artist explicitly says "Yes." This puts the burden on the AI company to ask, not on the artist to chase them down.

The Bottom Line

"True compliance is not about what a model says, but about how it came to know."

You cannot clean up a dirty foundation by painting the walls. If the AI was trained on stolen data, the model itself is "tainted." The only way to be truly safe is to ensure you have the right to use the data before you train the model.

Based on the paper "No Retroactive Cure for Infringement during Training" by Utsunomiya et al., here is a detailed technical summary covering the problem, methodology, key contributions, results, and significance.

1. Problem Statement

The paper addresses a critical disconnect between the engineering community's reliance on post-hoc mitigation (e.g., machine unlearning, inference-time guardrails) and the legal reality of AI training liability.

The Industry Assumption: Developers often assume that if a model can be "cleaned" after training (via unlearning or output filtering) to stop generating infringing content, the legal liability for the initial training process is nullified. This is termed the "Output Equivalence" assumption.
The Legal Reality: The authors argue that liability for copyright infringement, contract breaches, and unfair competition is established at the moment of data acquisition and ingestion (training time), not at the moment of output generation. Therefore, post-hoc technical fixes cannot retroactively cure unlawful acts that have already occurred.
The Risk: Relying on post-hoc mitigation leaves AI developers exposed to severe legal remedies, including algorithmic disgorgement (destruction of the model), massive monetary damages, and injunctions, because the "completed act" of infringement cannot be undone.

2. Methodology

The paper employs a socio-technical legal analysis, bridging computer science and legal doctrine.

Technical Premise: The authors adopt a "strong technical premise" for the sake of argument: they assume post-hoc methods (like machine unlearning or parameter editing) achieve their theoretical ideal, producing a model whose output distribution is statistically identical to one trained without the infringing data ( $P^* = P_{retrained}$ ). Even under this best-case scenario, they argue the legal liability remains.
Doctrinal Analysis: The authors analyze legal frameworks across three major jurisdictions (US, EU, Japan) focusing on:
- Copyright Law: Specifically the "Reproduction Right" (fixation in tangible media, RAM copies).
- Contract Law: Breach of license agreements and Terms of Service (ToS).
- Tort/Unfair Competition: Liability for free-riding on investment and unjust enrichment.
Case Law Review: The paper synthesizes recent and seminal case law (e.g., Capitol Records v. ReDigi, MAI Systems v. Peak Computer, Warhol v. Goldsmith, Bartz v. Anthropic, Kneschke v. LAION) to establish precedents regarding digital copying, fair use limitations, and the finality of infringement.

3. Key Contributions

The paper makes three primary theoretical and practical contributions:

A. The "Completed Act" Doctrine in AI

The authors establish that unauthorized data ingestion is a legally complete act at $t=0$ (the moment of copying/storing).

Fixation: Model weights are not transient; they are stable files on physical media satisfying the "fixation" requirement of copyright law.
Perceptibility: Even if output filters block access, the expressive value of the training data remains technically recoverable from the weights via forensic analysis or extraction attacks.
Conclusion: Liability attaches at the moment of ingestion. Subsequent deletion of source files or filtering of outputs does not erase the historical fact of the infringement.

B. The "Global Encirclement" of Liability

The paper argues that even if a developer successfully argues a Fair Use defense under copyright law, they remain vulnerable to other legal theories that post-hoc mitigation cannot address:

Contract Law: Breach of explicit licenses (e.g., "non-commercial use only") or Terms of Service (ToS) prohibiting scraping. Courts (e.g., ProCD v. Zeidenberg) enforce these regardless of copyright status.
Unfair Competition/Tort: Unauthorized appropriation of curated datasets constitutes "free-riding" on the plaintiff's investment (e.g., CV-Online v. Melons).
Unjust Enrichment: Developers gain a "head start" by avoiding the costs of lawful data acquisition. Remedies may require disgorgement (stripping all profits gained from the shortcut), potentially extending to the destruction of the model itself.

C. Rejection of "Output Equivalence" as a Legal Defense

The paper definitively refutes the engineering intuition that "clean outputs = compliant system." It demonstrates that legal liability is rooted in the provenance of the data (lineage), not the behavior of the model.

4. Results and Findings

Incurability of Infringement: Once a model is trained on unauthorized data, the infringement is a "fait accompli." Post-hoc unlearning is legally irrelevant to the initial cause of action.
Failure of Defenses:
- Fair Use: Arguments based on "transformative use" (e.g., Google Books) fail when the AI model acts as a direct market substitute for the original works (e.g., Warhol v. Goldsmith, Thomson Reuters v. Ross).
- Intermediate Copying: The Sega v. Accolade defense fails because the end product (generative AI) competes with the source, whereas Sega required a non-competing end use.
Remedial Scope: Courts may order algorithmic disgorgement, requiring the deletion of the model weights themselves, not just the source dataset, to remove the "head start" advantage gained from illicit data.

5. Significance and Recommendations

The paper calls for a fundamental paradigm shift in the AI industry: from Post-Hoc Sanitization to Verifiable Ex-Ante Process Compliance.

For Engineers (Technical Solutions):

Glass Pipelines: Implement cryptographic transparency (e.g., C2PA standards) to create verifiable chains of custody for training data.
Zero-Knowledge Proofs (ZKPs): Allow auditors to verify that restricted data was excluded without revealing the full dataset.
Architectural Reversibility: Instead of "unlearning" (which is imperfect), use version control (Git for models) to revert to a checkpoint before the unauthorized data was ingested and retrain from there.

For Policymakers (Structural Solutions):

Data Trusts: Establish centralized clearinghouses (Collective Management Organizations) to handle licensing at scale, reducing transaction costs.
Mandatory "Binary Beacon": Shift the legal default from Opt-Out (robots.txt) to Opt-In. Content without a machine-readable signal explicitly permitting AI training should be legally presumed off-limits, placing the burden of verification on the data acquirer.

Conclusion

The paper concludes that the legitimacy of an AI system depends on the integrity of its inputs, not the safety of its outputs. Relying on post-hoc technical fixes is a legal fallacy that exposes the AI ecosystem to existential risks. Sustainable development requires a shift to ex-ante compliance, ensuring that data lineage is verified and authorized before training begins.