AI researchers are studying the phenomenon that AI models unintentionally memorize some of the content from the training datasets.
Unintentional Memorization of Some Training Content
A recent paper “How much do language models memorize” by researchers from Meta, Google DeepMind, Cornell, and NVIDIA (John X. Morris, Chawin Sitawarin, Chuan Guo, Narine Kokhlikyan, G. Edward Suh, Alexander M. Rush, Kamalika Chaudhuri, Saeed Mahloujifar) found that large language models the amount of memorization is measurable:
LLMs have an “approximate capacity of 3.6 bits-per-parameter” of memorization at which point memorization plateaus and then the so-called “double descent” occurs when data size exceeds model capacity. At that point, “One theory is that once the model can no longer memorize datapoints individually, it is forced to share information between datapoints to save capacity,
which leads to generalization,” or grokking.
How should courts treat memorization under copyright law?
In the copyright lawsuits against AI companies, memorization of training content consisting potentially of the plaintiffs’ works may become a big issue. That is especially so in cases where the AI generator produces regurgitated copies in its outputs, such as in the New York Times lawsuit against OpenAI (although OpenAI disputes that the NYT investigator’s extraction of such copies was a normal or permitted use of ChatGPT under the terms of use). I don’t have the exact breakdown, but the majority of lawsuits do not allege infringement in the outputs of the defendant’s AI.
In my forthcoming law review article “Fair Use and the Origin of AI Training,” I offer recommendations on how courts should treat memorization by AI models. In short, I think courts should require the plaintiffs to prove memorization of specific works by showing an infringing output.
Pure statistical probability that all AI models engage in some memorization is insufficient to prove an infringing copy of a specific work of the plaintiffs. Here’s an excerpt from my current draft (version 2) of the law review article that will be published by the Houston Law Review later this year.
It’s also worth noting that the Morris et al. paper “How much do language models memorize?” above disagrees with other AI researchers’ assertion that if one can induce AI models to produce a specific output of a pre-existing work, it must be memorized.
Morris says it doesn’t necessarily do so: “Studies of language model extraction argue that a data point is memorized if we can induce the model to generate it (Carlini et al., 2023b; Nasr et al., 2023; Schwarzschild et al., 2024). We argue that such generation does not necessarily serve as a proof of memorization. Language models can be coerced to output almost any string (Geiping et al., 2024); hence the fact that a model outputs something is not necessarily a sign of memorization. To address this issue, some researchers have suggested regularizing the input to the language model, such as by limiting its length Schwarzschild et al. (2024) or matching it to the prefix Carlini et al. (2023b) preceding the memorized sentence. However, even with these constraints, memorization cannot be conclusively proven, as the model’s ability to generalize may still be at play. For example, a good language model prompted to add two numbers can output the correct answer without having seen the equation before. In fact, a recent work Liu et al. (2025) shows that some of the instances than were previously thought as memorized do not even exist in the training set and their extractability is a result of generalization. Additionally, verbatim reproduction of a text is not a prerequisite for memorization; a model may still be memorizing specific patterns or sequences, such as every other token, without generating them verbatim.”
The Lie et al. paper is: Liu, K. Z., Choquette-Choo, C. A., Jagielski, M., Kairouz, P., Koyejo, S., Liang, P., and Papernot, N. Language models may verbatim complete text they were not explicitly trained on, 2025. URL https://arxiv.org/abs/2503.17514.
I don’t think courts need to make any finding on this technical issue of AI memorization. Instead, the burden of proving an infringement claim requires the plaintiff to present evidence of a specific work of the plaintiff that is infringed. If the plaintiff alleges that its work is memorized by the model, the plaintiff must present some evidence of memorization of the plaintiff’s work. Statistical probability that AI models engage in some unintentional memorization is insufficient. See generally Guenther v. Armstrong Rubber Co., 406 F.2d 1315 (3d Cir. 1969) (rejecting plaintiff’s attempt to prove a sale of a tire by defendant in negligence claim based on the statistical probability because such it “would at best be a guess”).
This burden of proof also relates to the specific Section 106 right(s) the plaintiff argues has been violated. If it’s merely a copy used in the training of the AI model, that falls within the fair use to train the AI model. And, in any event, the plaintiff must still prove the existence of a copy in the “memory” of the model. Likewise, if it’s a public distribution of a copy, there still must be evidence a copy has been memorized and was actually distributed — which gets back to my approach of requiring an actual output of an allegedly memorized copy.