The Mechanics of the Fair Use Defense in Generative AI Training

In 2015, the Second Circuit Court of Appeals ruled in Authors Guild v. Google that scanning millions of books to create a searchable digital index was a legally protected fair use. The single respect in which today's generative artificial intelligence training differs from that landmark case is the output: a search engine points the user back to the original work, while a generative model internalizes the statistical relationships to generate a substitute. As artificial intelligence companies ingest trillions of tokens of copyrighted text, images, and code to train large language models, they rely almost entirely on the legal shield forged by that 2015 decision.[2]

The legal battleground governing this ingestion is 17 U.S.C. § 107, the fair use doctrine of the United States Copyright Act. The statute requires courts to balance four factors when determining if an unauthorized use is permissible: the purpose and character of the use, the nature of the copyrighted work, the amount and substantiality of the portion used, and the effect of the use upon the potential market for the original. Because web-scale AI training requires copying virtually the entire public internet, the defense hinges heavily on the first and fourth factors.[4]

Artificial intelligence developers argue that training a neural network is an intermediate step—a highly transformative process. They assert that a large language model does not store a database of the ingested works. Instead, it maps a joint probability distribution of language, extracting uncopyrightable facts, concepts, and syntactic patterns. Under this theory, the temporary copying required to train the model is legally indistinguishable from a human reading a book to learn how to write.[6]

The U.S. Copyright Office has begun mapping this complex terrain. In its January 2025 report on AI and copyrightability, the Office noted it received over 10,000 public comments regarding the intersection of artificial intelligence and intellectual property. While that specific report focused on outputs—concluding that "purely AI-generated material" created by entering prompts lacks the requisite human authorship—the Office's impending Part 3 report will directly address the legality of the training process itself.[1]

However, the legal argument that AI models only learn abstract concepts collides with the technical reality of how neural networks behave at scale. A foundational 2021 study by Nicholas Carlini and a team of researchers demonstrated that large language models do, in fact, memorize specific training examples. This phenomenon, termed k-eidetic memorization, occurs when a model internalizes a sequence of text so deeply that it can reproduce it verbatim when prompted.[3]

To prove this, the researchers developed a training data extraction attack against GPT-2, a model trained on scrapes of the public internet. The mechanism of the attack was twofold: first, the team generated 200,000 text samples by unconditionally sampling from the model. Second, they applied a membership inference attack to predict which of those outputs contained memorized text, sorting the generations by specific metrics to isolate the anomalies.[3]

The results provided empirical evidence of memorization. As lead author Nicholas Carlini and his co-authors wrote in their methodology, "We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data." From those 200,000 generated samples, the researchers successfully extracted 604 unique verbatim training examples.[3]

These extracted sequences included copyrighted passages, IRC conversations, software code, and personally identifiable information such as names, phone numbers, and email addresses. The attack achieved a 67 percent success rate with its best configuration, proving that extraction is not just a theoretical risk but a practical reality. Crucially, the Carlini paper found that larger models are more vulnerable to this memorization than smaller ones.[3]

As parameter counts increase into the hundreds of billions, the network's capacity to memorize exact strings rises proportionally. This scaling dynamic creates a structural problem for the fair use defense: the more capable and commercially valuable an AI model becomes, the more it behaves like a compressed, reproductive database rather than an abstract reasoning engine.[6]

This empirical reality fractures the intermediate copying defense. If a model can be prompted to regurgitate a verbatim passage from a copyrighted book, the training process crosses the line from a transformative analysis of data into the unauthorized reproduction of expressive content. This brings the legal analysis to the fourth fair-use factor: the effect of the use upon the potential market for the original work.[2][6]

In the 2015 Authors Guild v. Google case, the court found no market harm because the search engine only displayed short "snippets" of text and did not serve as a competing substitute for the books themselves. The database was a tool for discovery, not a replacement for consumption. Generative artificial intelligence, by contrast, is explicitly designed to generate content.[2]

If an AI model trained on a specific author's corpus can generate a new chapter in their exact style, or regurgitate their prose upon request, it directly competes with the original creator's market. The output serves the same expressive purpose as the input, threatening to flood the market with synthetic substitutes that diminish the commercial value of the original works.[6]

The Supreme Court's 2023 decision in Andy Warhol Foundation v. Goldsmith further complicates the AI developers' defense. In that case, the Court ruled that a use is not transformative if it serves a substantially similar commercial purpose as the original work. The majority opinion emphasized that the fair use inquiry must look beyond mere visual or textual differences and grapple with how the copy is actually used in the commercial marketplace.[5]

Applied to generative AI, the Warhol precedent suggests that even if an AI model transforms a copyrighted image into a mathematical weight, the ultimate commercial use of that model—generating competing images for profit—may weigh heavily against a finding of fair use. The technological transformation of the data does not automatically neutralize the commercial substitution effect.[5][6]

What remains unknown is how federal courts will ultimately reconcile the statistical nature of AI training with the strict liability of copyright infringement. The technology operates in a probabilistic gray area that 20th-century copyright law never anticipated. Judges must decide whether the presence of 604 verbatim extractions in a model trained on billions of pages constitutes a systemic infringement or a legally permissible margin of error.[6]

The resolution of this tension will dictate the economic structure of the artificial intelligence industry. If courts determine that the extraction of verbatim data invalidates the fair use defense, the current paradigm of permissionless web-scale training will collapse. Developers would be forced to transition to licensed datasets, fundamentally altering the speed and cost of artificial intelligence development.[6]