What Does a Copyright Budget Certify? An Exact Threshold for Per-Token Meters, and a Length-Independent Certificate for Selection

원문 초록

Certified inference-time copyright defences publish a divergence budget between the served model and a safe anchor trained without the protected works. We ask what such a budget certifies. Proved: a budget of K nats says nothing about a work whose surprisal under the anchor is at most K, at every R\'enyi order. Anchored decoding charges per token, so its budget grows with the output. Measured: at its authors' setting, the budget exceeds the anchor's surprisal of every one of the 758 protected passages we test, so it certifies nothing about them. Proved: serving one of n anchor draws, by any rule, is certified at log n nats for the whole output, at any length; in installments, a window is certified only given the text up to a block boundary. Measured: over a vetted anchor, with an adversarial scorer, selection reproduced no protected passage near-verbatim. Its draws cost 21.8x a metered decode on an anchor-only server. Judged: in the headline configuration, at the only published meter budget that bounds a 50-token window, selection's gain over one anchor draw is reliably positive and the meter's is, by a post-hoc equivalence test, zero. At matched compute selection loses. At the authors' sampling settings on the 8B, the two tie at that budget. Where the meter's certificate is vacuous, the ranking depends on how the stronger model is served. It reverses under a chat template, at the authors' sampling settings on the 8B, and on AlpacaEval.