A new paper from researchers at Stanford, Cornell, and West Virginia University seems to show that one version of Metas flagship AI model, Llama 3.1, has memorized almost the whole of the first Harry Potter book. This finding could have far-reaching copyright implications for the AI industry and impact authors and creatives who are already part of class-action lawsuits against Meta.Researchers tested a bunch of different widely-available free large language models to see what percentage of 56 different books they could reproduce. The researchers fed the models hundreds of short text snippets from those books and measured how well it could recite the next lines. The titles were a random sampling of popular, lesser-known, and public domain works drawn from the now-defunct and controversial Books3 dataset that Meta used to train its models, as well as books by plaintiffs in the recent, and ongoing, Kadrey vs Meta class-action lawsuit.According to Mark A. Lemley, one of the study authors, this finding might have some interesting implications. AI companies argue that their models are generativeas in, they make new stuff, rather than just being fancy search engines. On the other hand, authors and news outlets are suing on the basis that AI is just remixing existing material, including copyrighted content. I think what we show in the paper is that neither of those characterizations is accurate, says Lemley.The paper shows that the capacity of Metas popular Llama 3.1 70B to recite passages from The Sorcerers Stone and 1984among other booksis way higher than could happen by chance. This could indicate that LLMs are not just trained using books, but might actually be storing entire copies of the books themselves. That might mean that under copyright law that the model is less inspired by and more a bootleg copy of certain texts.Its hard to prove that a model has memorized something, because its hard to see inside. But LLMs are trained using the mathematical relationships between little chunks of data called tokens, like words or punctuation. Tokens all have varying probabilities of following each other or getting strung together in a specific order.The researchers were able to extract sections of various books by repeatedly prompting the models with selected lines. They split each book into 100-token overlapping strings, then presented the model with the first 50-token half and measured how well it could produce the second. This might take a few tries, but ultimately the study was able to reproduce 91 percent of The Sorcerers Stone with this method.Theres no way, its really improbable, that it can get the next 50 words right if it hadnt memorized it, James Grimmelmann, Tessler Family Professor of Digital and Information Law at Cornell, who has worked to define memorization in this space, told 404 Media.OpenAI has called memorization a rare failure of the learning process, and says that it sometimes happens when the topic in question appears many times in training data. It also says that intentionally getting their LLMs to spit out memorized data is not an appropriate use of our technology and is against our terms of use.The studys authors say in their paper that if the model is storing a book in its memory, the model itself could be considered to literally be a copy of the book. If thats the case, then distributing the LLM at all might be legally equivalent to bootlegging a DVD. And this could mean that a court could order the destruction of the model itself, in the same way theyve ordered the destruction of a cache of boxsets of pirated films. This has never happened in the AI space, and might not be possible, given how widespread these models are. Meta doesnt release usage statistics of its different LLMs, but 3.1 70B is one of its most popular. The Stanford paper estimates that the Llama 3.1 70B model has been downloaded a million times since its release, so, technically, Meta could have accidentally distributed a million pirate versions of The Sorcerers Stone.The paper found that different Llama models had memorized widely varying amounts of the tested books. There are lots of books for which it has essentially nothing, said Lerney. Some models were amazing at regurgitating, and others werent, meaning that it was more likely that the specific choices made in training the 3.1 70B version had led to memorization, the researchers said. That could be as simple as the choice not to remove duplicated training data, or the fact that Harry Potter and 1984 are pretty popular books online. For comparison, the researchers found that the Game of Thrones books were highly memorized, but Twilight books werent memorized at all.Grimmelman said he believes their findings might also be good news overall for those seeking to regulate AI companies. If courts rule against allowing extensive memorization, then you could give better legal treatment to companies that have mitigated or prevented it than the companies that didn't, he said. You could just say, if you memorize more than this much of a book, we'll consider that infringement. It's up to you to figure out how to make sure your models don't memorize more than that.