The fastest way to understand the next phase of the copyright war is this: the argument is moving from “what went into the model” to “what can come out of the model on demand.” A new paper from researchers affiliated with Stanford’s ecosystem put a sharp edge on it by testing whether production chat models can be pushed into emitting long stretches of copyrighted book text.
That matters because a refusal screen is not the same thing as a lack of memorization. Refusals are policy. Memorization is physics plus optimization. The paper’s core contribution is to treat “book leakage” as something you can measure with a repeatable method and a similarity score, then compare behavior across real consumer-facing systems.
[wnr_snapshot title=”MEM leak – production extraction becomes measurable (at a glance)” items=”Paper scope|4 production LLMs|Claude 3.7 Sonnet, GPT-4.1, Gemini 2.5 Pro, Grok 3;Gemini 2.5 Pro result|76.8% nv-recall|HP1 example, Phase 1 without jailbreak;Grok 3 result|70.3% nv-recall|HP1 example, Phase 1 without jailbreak;Claude 3.7 (jailbroken)|95.8% nv-recall|Near-verbatim whole-book behavior reported;GPT-4.1 (jailbroken)|4.0% nv-recall|20x attempts then refused, cited example;Legal price signal|$1.5B settlement|Anthropic case covers about 465,000 books”]
[wnr_math title=”Quick math: turning leakage into dollars and ops load” items=”Settlement per book (derived)|~$3,226|$1.5B / 465,000, derived;Order-of-magnitude intuition|95.8% ~= almost whole book|nv-recall is a similarity score, not literal pages;Attempt intensity signal|20x|GPT-4.1 required far more attempts in the cited example;Disclosure clock|90 days|Paper says findings released after disclosure window;Risk scaling reality|Small rate x huge usage = incidents|Leakage can be rare per prompt yet material at scale”]
What the paper actually demonstrated
The authors used a two-phase procedure: an initial probe to test feasibility (sometimes using best-of-N “jailbreak”-style behavior), followed by iterative continuation attempts to pull longer spans. They then scored extraction with “nv-recall,” meant to approximate how much of the target text shows up in the output as near-verbatim blocks.
The headline is not that every model spills every book. It is that extraction is feasible in some production systems under some configurations, and feasibility varies sharply by model. In the examples in the abstract, Gemini 2.5 Pro and Grok 3 did not require jailbreak behavior to extract large portions of the cited book, while Claude required it for the highlighted near-verbatim behavior, and GPT-4.1 resisted far more strongly.
Why this turns into procurement and product liability
If you are a buyer shipping LLM outputs into a regulated workflow, the “right” question is no longer “does the vendor claim they respect copyright,” but “what happens under stress, and can you prove what happened after the fact?” That is why this becomes an ops bottleneck story: logging, versioning, monitoring, and incident response are what stand between “bad output” and “expensive outcome.”
The point is not to create a new panic headline. It is to acknowledge that extractability is testable. Once it is testable, it becomes a checklist item. Once it is a checklist item, it changes procurement outcomes.
[wnr_table title=”The new IP risk checklist for LLM systems” headers=”Control|What it reduces|Practical note” rows=”Leakage evaluation suite|Near-verbatim output risk|Include long-text and copyrighted-span tests as part of release gating;Refusal behavior hardening|Direct “give me the book” requests|Helps for naive asks, does not eliminate adversarial risk;Similarity detection on outputs|Undetected verbatim spans|Requires reference corpora or fingerprinting approaches;Audit logging + retention|Investigation and proof|Model version, prompt chain, tool calls, and output hashes matter;Incident response playbook|Time-to-contain and disclose|Defines triage, takedown, customer comms, and legal review;Contract terms (warranties/indemnity)|Financial tail risk|Expect more carveouts and caps, plus stronger buyer diligence demands” notes=”This is framed as defensive controls and governance, not instructions for extraction.” ]
Historical context: this is the “closed model” sequel
Extraction attacks are not new. Carlini et al. (USENIX Security 2021) showed training-data extraction against large language models under black-box querying. Later work broadened the extraction story across model families, including aligned systems, and emphasized that alignment reduces but does not eliminate extractable memorization in practice.
This new paper’s value is that it treats production LLMs as test subjects and reports concrete outcomes in a form that risk teams can operationalize.
The legal market is already pricing the risk
The fastest “macro” indicator is not a benchmark. It is settlements and licenses. The Anthropic settlement over pirated books is a visible price tag on training-data exposure, and it reinforces why output-side leakage now matters: if a system can emit near-verbatim text, plaintiffs gain a more legible narrative than abstract training arguments.
Bottom line
“Memorization” is no longer just a debate topic. It is trending into a measurable, comparable risk surface across production models. That pushes the center of gravity toward operational proof: eval gates, logging, monitoring, and incident response that can survive both procurement scrutiny and courtroom discovery.
Sources (primary)
• arXiv (Jan 6, 2026): Extracting books from production language models (results, nv-recall, disclosure window) — https://arxiv.org/abs/2601.02671
• USENIX Security (2021): Carlini et al., Extracting Training Data from Large Language Models (historical extraction context) — https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting
• arXiv (2023): Scalable Extraction of Training Data from (Production) Language Models (broader extraction literature) — https://arxiv.org/abs/2311.17035
• U.S. Copyright Office (May 2025, pre-publication): Part 3, Generative AI Training (Books3 details and training-data framing) — https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-3-Generative-AI-Training-Report-Pre-Publication-Version.pdf
• AP (Sep 25, 2025): Judge approves $1.5B Anthropic settlement, ~465,000 books, ~$3,000 per book — https://apnews.com/article/9643064e847a5e88ef6ee8b620b3a44c
• Reuters (Sep 5, 2025): Anthropic agrees to pay $1.5B; piracy dataset and case posture — https://www.reuters.com/sustainability/boards-policy-regulation/anthropic-agrees-pay-15-billion-settle-author-class-action-2025-09-05/
Leave a Reply