There is well-established precedent for clean-room design being a defense in copyright infringement of software. The question remains if LLM-assisted design is actually ‘clean’ or not, and it would be fascinating to see the experts debate it.
The problem with these LLMs are they really emitted the same code, verbatim. One scientific library developer was able to emit his code from his repository by typing the beginning of the function name, and the "thing" completed the rest of it, as-is [0].
We can debate clean-room development all day long, and it's fair point, but the pain point is/was reproducing the repo as-is, sans its license and ownership information.
GitHub promised to build tools around its Copilot to find code provenance (e.g.: list of repos with similar code), but they silently dropped all the plans AFAIK, since it'll show how the sausage is made, and nobody wants you to know how that sausage is made.
I stand corrected: They added it, but I don't know at what capacity because I don't use LLM assisted code generation [1].
Not discrediting your work at all and I can’t tell you it applies here.
For copyright to exist there is some burden of proof. If you claim that an LLM verbatim output your code there can be an expensive lawsuit with expert witnesses that would be able to state that the code was bot original enough for copyright to exist in it and a statistical model outputting the code is evidence of that.
In that case you would end up with a very long lawsuit that is expensive to possibly come out with no resolution in the end and be in the hole for 5-6 figures for it.
The copyright system is broken because it only protects those with money so it is a bad legal foundation.
My personal point is there is only 2 licenses of code, closed source or permissive, because if it ever comes to enforcement I cannot possibly go to court and win a case because I will run out of money far earlier than whoever used the code.
Pretty much if someone with your knowledge would have written the same algorithm because it is the obviously correct solution then there is no copyright there because any clean room implementation would be the same code.
Even early LLMs could spit out Harry Potter verbatim. The next iteration had some kind of stoppage mechanism where they’d just stop generating after some tokens. I’m sure there are smarter approaches now. Anyway, if the issue was having enough money to fight the case, I think there’s enough money behind that brand to do it.
Some further reading on the tech details for those interested: “Extracting books from production language models”: https://arxiv.org/abs/2601.02671
I think it's not quite "put in prompt, get entire book back", most of these involve to some degree starting with exerpts from the book and working passage by passage, because of nothing else the sampling will tend to make things diverge over time.
To get their strongest results, they had to jailbreak some models, which is important. They ran hundreds to 5000+ requests to the model, trying to get snippets to piece together. These are professional researchers, putting in tremendous effort, to extract pieces of text.
I suspect the chance of asking for a whole book, by an average or even power user, will spit out any recent work.
Early LLMs were similar. Newer ones have gotten tremendously hard to extract to keep claiming there’s easily or complete books you can dump.
[−]true_religion · 2026-11-15 Sun 18:16 UTC ·
link
I pasted the first paragraph of Harry Potter into a GLM 4.6 copy, and it continued to write out the next 2 pages of Harry Potter. I cross checked with a paper copy and it was word for word the same text.
I wonder where else it works.
This is the intro text: "Mr and Mrs Dursley, of number four, Privet Drive, were proud to say that they were perfectly normal, thank you very much. They were the last people you’d expect to be involved in anything strange or mysterious, because they just didn’t hold with such nonsense."
This feels very outdated. It was certainly an issue around the time of the NYT lawsuit, but I believe the companies responded hard to that "sanitize" their outputs to prevent obvious regurgitation like this. I'd be very surprised if you could reproduce this today.
This doesn't negate your point, but I believe the landscape has changed in response to this point.
That doesn't make it better. If you plagiarize something and then hide this by replacing words with synonyms and rewording stuff a bit it is still plagiarized. It is just harder to detect and to proof.
It regurgitated the output earlier and they are still using the same technique only scaled up. If they somehow fixed the underlying problem, they'd probably shout it from the roof-tops.
As the OP originally said, if it is verbatim (or even very obfuscated), then there should absolutely be a case here. But when it's concepts in reasoning to build a new work then it becomes a lot harder. The same would be said for someone watching a YouTube video, reviewing open source code, or a text book.
The good news is that there's a lot of case law that covers this already. The bad news is that it is only going to be plaintiffs with deep pockets that benefit here.
Now the process and artifacts (documentation, requirements, etc) going into the creation of said software is a different story and will prove providence of whomever paid for the tokens to generate the code.
Humans are not LLMs. Humans have not ingested the whole Internet. If an LLM is compared to a human, maybe we should also apply anti-slavery laws to it?
Not saying we can't have some legal fiction where they are treated the same, it should just be a conscious choice, not the default assumption.
I live in the EU, we actually have new regulation about this since it is something new that deserves thought on how it should be regulated. You can say if you want your material to be trained on or not. Next to no one does training in the EU...
Not better, just harder to see/prove. The problem of "same code, verbatim" has been solved, in a sense. Now we have trickier ones.
[−]FromTheFirstIn · 2026-11-15 Sun 18:19 UTC ·
link
The fundamental technology is identical to compression- an LLM can be thought of as a dense and slightly lossy compression algorithm. Compression is clearly copying.
I keep waiting for someone to bring out DisneyGPT, which you can prompt with text to get image output. The fact that you get a near-exact reproduction of a Disney movie when you prompt it with a movie title and frame numbers would of course be completely coincidental...
I understand what you're saying but it is a poor legal argument. Overhearing a technical conversation, using your own learned knowledge, and building a clean room implementation could be considered compression in and of itself.
Under multiple countries interoperability laws, if you have a context to extract a spec, and then have another one who never looked art the code work from that spec to build your own interpretation of your need for that software, that seems pretty clean room to me...
If there are more murky situations where people just keep the same context and end up reusing function structure, program architecture, etc. then yeah, that's not very clean room.
You don't necessarily need a clean room implementation to mount a successful defense against copyright infringement in court, though. It just makes some of the arguments a little bit easier.
While this is well established legally, I don't think the principles involved are well understood.
Legally, you cannot steal an idea, because you cannot own an idea. There were sound reasons for making this the case. Those reasons stand up today and are clearly for the public good.
Intellectual property is intended to cover works (copyright), methods (patents), and identity (trademarks). Both works and methods are recognised as expressions of ideas, and in an ideal world should belong to noone as well. This is why copyright and patents expire. Those specific grants of temporary possession are to incentivise more things being done.
The belief that you own something because you thought it up has become common, but it is not beneficial to society. It is a moral value asserted but rarely explored. It is certainly in the interests of the wealthy accumulators of intellectual property to maintain that public perception. The 'You wouldn't download a car' may not have stopped piracy much but as a part of a broader campaign of instilling a value in the public mind it appears to have been massively successful. Those beliefs used to be the corporate opinion, now they are entrenched in the younger generation as they use their anger against the growing wealth inequality to fight against AI in a manner ultimately beneficial to those forces that bought about the wealth inequality.
Movements like the pirate party, open source, the EFF fought against those notions. Often the phrase "Information wants to be free" was used. It is, unfortunately, hard to fight the steady drumbeat of well financed PR firms. As one PR chap once described the process "limited to a very few points and must harp on these in slogans until the last member of the public understands what you want him to understand"
(I apologise for the length of my post, I use comment writing to organise my thoughts on a topic)
Patent law doesn't only cover methods, though. It might've worked that way during the Industrial Revolution, but these days a lot of patents are far closer to covering abstract ideas than concrete machines. Software patents are some of the worst offenders here, of course.
> The question remains if LLM-assisted design is actually ‘clean’ or not
I genuinely don't understand how one could possibly make that argument.
The entire point of clean-room design is to kill every possibility of copyright infringement before it even starts, by completely separating the source and destination. Everyone who has ever read the copyrighted source is considered "tainted" and may not ever contribute any code to the "clean" destination. The readers and writers are two completely distinct teams, with only the known-clean specification passing between them.
LLMs, on the other hand, are fundamentally nothing more than a "code blender". You mix together giant piles of "tainted" code, and then statistically pull some combined fragments out of it. Following the clean-room legal argument, it should be treated as if everything coming out of it is tainted. There is, by definition, absolutely zero separation between input and output - and the early models verbatim reproducing popular F/LOSS code made that pretty obvious. LLMs are the literal opposite of a clean-room design!
Granted, going for the clean-room approach is overkill - and intentionally so. It is the nuclear option chosen when you believe the risk of getting sued is substantial. It is perfectly possible to write non-infringing code without using a clean-room approach, it is just a lot harder to defend in court when you get sued - be it justifiably or not. But "LLMs are non-clean-room non-infringing" is quite a different argument from "LLMs are clean-room, therefore non-infringing".
Clean room is sufficient, but not necessary, btw. Humans can create legally distinct works after reviewing copyrighted code. The same principle probably extends to AI systems -- they have just learned on a much broader corpus than any one human.
We can debate clean-room development all day long, and it's fair point, but the pain point is/was reproducing the repo as-is, sans its license and ownership information.
GitHub promised to build tools around its Copilot to find code provenance (e.g.: list of repos with similar code), but they silently dropped all the plans AFAIK, since it'll show how the sausage is made, and nobody wants you to know how that sausage is made.
I stand corrected: They added it, but I don't know at what capacity because I don't use LLM assisted code generation [1].
[0]: https://x.com/docsparse/status/1581461734665367554
[1]: https://github.blog/ai-and-ml/github-copilot/preview-referen...
For copyright to exist there is some burden of proof. If you claim that an LLM verbatim output your code there can be an expensive lawsuit with expert witnesses that would be able to state that the code was bot original enough for copyright to exist in it and a statistical model outputting the code is evidence of that.
In that case you would end up with a very long lawsuit that is expensive to possibly come out with no resolution in the end and be in the hole for 5-6 figures for it.
The copyright system is broken because it only protects those with money so it is a bad legal foundation.
My personal point is there is only 2 licenses of code, closed source or permissive, because if it ever comes to enforcement I cannot possibly go to court and win a case because I will run out of money far earlier than whoever used the code.
Pretty much if someone with your knowledge would have written the same algorithm because it is the obviously correct solution then there is no copyright there because any clean room implementation would be the same code.
Some further reading on the tech details for those interested: “Extracting books from production language models”: https://arxiv.org/abs/2601.02671
I suspect the chance of asking for a whole book, by an average or even power user, will spit out any recent work.
Early LLMs were similar. Newer ones have gotten tremendously hard to extract to keep claiming there’s easily or complete books you can dump.
I wonder where else it works.
This is the intro text: "Mr and Mrs Dursley, of number four, Privet Drive, were proud to say that they were perfectly normal, thank you very much. They were the last people you’d expect to be involved in anything strange or mysterious, because they just didn’t hold with such nonsense."
This doesn't negate your point, but I believe the landscape has changed in response to this point.
It regurgitated the output earlier and they are still using the same technique only scaled up. If they somehow fixed the underlying problem, they'd probably shout it from the roof-tops.
As the OP originally said, if it is verbatim (or even very obfuscated), then there should absolutely be a case here. But when it's concepts in reasoning to build a new work then it becomes a lot harder. The same would be said for someone watching a YouTube video, reviewing open source code, or a text book.
The good news is that there's a lot of case law that covers this already. The bad news is that it is only going to be plaintiffs with deep pockets that benefit here.
Now the process and artifacts (documentation, requirements, etc) going into the creation of said software is a different story and will prove providence of whomever paid for the tokens to generate the code.
I live in the EU, we actually have new regulation about this since it is something new that deserves thought on how it should be regulated. You can say if you want your material to be trained on or not. Next to no one does training in the EU...
"In the training data" is the polar opposite of the "clean" in "clean room implementation".
If there are more murky situations where people just keep the same context and end up reusing function structure, program architecture, etc. then yeah, that's not very clean room.
Legally, you cannot steal an idea, because you cannot own an idea. There were sound reasons for making this the case. Those reasons stand up today and are clearly for the public good.
Intellectual property is intended to cover works (copyright), methods (patents), and identity (trademarks). Both works and methods are recognised as expressions of ideas, and in an ideal world should belong to noone as well. This is why copyright and patents expire. Those specific grants of temporary possession are to incentivise more things being done.
The belief that you own something because you thought it up has become common, but it is not beneficial to society. It is a moral value asserted but rarely explored. It is certainly in the interests of the wealthy accumulators of intellectual property to maintain that public perception. The 'You wouldn't download a car' may not have stopped piracy much but as a part of a broader campaign of instilling a value in the public mind it appears to have been massively successful. Those beliefs used to be the corporate opinion, now they are entrenched in the younger generation as they use their anger against the growing wealth inequality to fight against AI in a manner ultimately beneficial to those forces that bought about the wealth inequality.
Movements like the pirate party, open source, the EFF fought against those notions. Often the phrase "Information wants to be free" was used. It is, unfortunately, hard to fight the steady drumbeat of well financed PR firms. As one PR chap once described the process "limited to a very few points and must harp on these in slogans until the last member of the public understands what you want him to understand"
(I apologise for the length of my post, I use comment writing to organise my thoughts on a topic)
I genuinely don't understand how one could possibly make that argument.
The entire point of clean-room design is to kill every possibility of copyright infringement before it even starts, by completely separating the source and destination. Everyone who has ever read the copyrighted source is considered "tainted" and may not ever contribute any code to the "clean" destination. The readers and writers are two completely distinct teams, with only the known-clean specification passing between them.
LLMs, on the other hand, are fundamentally nothing more than a "code blender". You mix together giant piles of "tainted" code, and then statistically pull some combined fragments out of it. Following the clean-room legal argument, it should be treated as if everything coming out of it is tainted. There is, by definition, absolutely zero separation between input and output - and the early models verbatim reproducing popular F/LOSS code made that pretty obvious. LLMs are the literal opposite of a clean-room design!
Granted, going for the clean-room approach is overkill - and intentionally so. It is the nuclear option chosen when you believe the risk of getting sued is substantial. It is perfectly possible to write non-infringing code without using a clean-room approach, it is just a lot harder to defend in court when you get sued - be it justifiably or not. But "LLMs are non-clean-room non-infringing" is quite a different argument from "LLMs are clean-room, therefore non-infringing".