Language models can recite copyrighted novels after routine tuning

A straightforward fine-tuning task strips the safety alignment that blocks verbatim recitation, exposing stored books across competing production systems.

When a reader opens an artificial intelligence writing assistant and asks it to turn a brief story outline into a finished chapter, the software seems to compose fresh prose on the fly. The underlying system predicts each subsequent word based on patterns drawn from billions of texts it absorbed during development. AI developers have long argued that this predictive machinery does not retain copies of original books. They maintain that the process functions like a human author who has read widely, internalizing grammar and narrative tone without holding an illicit library within its numerical parameters.

A study accepted at the Conference on Language Modeling challenges that premise by demonstrating that production models can be prompted to reproduce copyrighted books word for word. By applying a standard fine-tuning procedure, a method that adjusts model parameters using examples of converting short plot outlines into full paragraphs, researchers unlocked memorized text from closed commercial systems. The models did not simply mimic an authorial voice. Instead, they reproduced continuous, verbatim passages spanning hundreds of words from protected works they had encountered during initial training, even though no text from those books was supplied during the adjustment.

The findings, posted in an arXiv preprint titled "Alignment Whack-a-Mole: Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models," were authored by computer scientists Xinyue Liu and Tuhin Chakrabarty of Stony Brook University, Niloofar Mireshghallah of Carnegie Mellon University, and legal scholar Jane C. Ginsburg of Columbia Law School.¹² The team demonstrated that safety alignment measures implemented by OpenAI, Google, and DeepSeek do not erase copyrighted works from model weights.³ Instead, routine adaptation inadvertently creates a retrieval route that bypasses safeguards.

How does adaptation unlock latent memory?

Fine-tuning works by recalibrating a small fraction of a model's internal numerical connections to specialize in a concrete task. To understand why this process triggers verbatim recitation, one must examine how frontier language models learn to generate text. During pretraining, a system ingests vast corpora of unannotated text, continually adjusting its internal weights to minimize the error in predicting the next token in a sequence. When a distinctive literary work appears repeatedly across the training data, the network strengthens the specific statistical connections that recreate those exact phrasing sequences. To prevent unauthorized recitation of protected expression, providers later overlay a layer of safety alignment through reinforcement learning from human feedback and protective output filters. These safety measures teach the model to refuse direct requests to quote copyrighted books, leaving the underlying statistical patterns intact beneath an inhibitory mask.

The researchers set out to test whether routine fine-tuning could pierce that safety surface without using adversarial tricks or overt jailbreak prompts. They took 81 copyrighted books across varied literary genres by 47 contemporary authors, including Pulitzer, Booker, and Nobel laureates.⁴ Using OpenAI's GPT-4o, they segmented the books into passages of 300 to 500 words and generated concise plot summaries describing the actions and narrative sequence of each excerpt.¹ They then trained the models on input-output pairs that instructed the system to expand a semantic plot summary into prose emulating a specific author's style.¹⁵ Crucially, the training data supplied no raw excerpts from the held-out books used for testing.

When the researchers subsequently presented the adjusted models with plot summaries of books excluded from the fine-tuning set, the systems began reconstructing the author's original sentences.¹⁴ Tested across OpenAI's GPT-4o, Google's Gemini-2.5-Pro, and DeepSeek's DeepSeek-V3.1, the fine-tuned systems reproduced up to 85 to 90 percent of specific held-out books.¹³ The models generated individual continuous matching spans exceeding 460 words based purely on semantic outlines of what occurs in each scene.¹⁶ A baseline model evaluated prior to fine-tuning yielded minimal verbatim reproduction, achieving an average book memorization coverage of 7.36 percent on GPT-4o with no single matching span exceeding 26 words.¹³

Why does training on one novelist surface works by others?

Training an artificial intelligence model on the work of a single author unlocks memorized texts written by entirely unrelated writers. In one central experiment, the authors fine-tuned a model exclusively on novels by Haruki Murakami, then evaluated its responses against 51 books written by 32 different authors.³⁵ Despite learning only the task of turning summaries into Murakami-style text, the adapted model reproduced substantial verbatim passages from other contemporary works, including Ta-Nehisi Coates's memoir Between the World and Me, Yuval Noah Harari's Sapiens, and Margaret Atwood's The Handmaid's Tale.¹

This cross-author generalization indicates that the fine-tuning procedure does not merely teach a bespoke prose pattern. Instead, it activates an associative semantic structure already embedded deep within the parameters during pretraining. Within this associative network, semantic markers such as author names, chapter events, and narrative descriptions serve as retrieval keys pointing directly to stored strings of text. The fine-tuning task simply reinforces the model's willingness to unpack high-level semantic descriptions into dense, specific prose, thereby creating an operational bypass around conversational guardrails.

The associative nature of this memory structure became strikingly evident through cross-paragraph regurgitation. When prompted with a plot summary of a particular chapter, the fine-tuned models frequently recited verbatim excerpts from completely different sections of the book that shared narrative motifs. In Salman Rushdie's novel Midnight's Children, the researchers observed that 23 distinct plot summaries drawn from different points across the narrative triggered the exact same verbatim excerpt.¹³ The prompt did not need to match the scene chronologically; strong semantic similarity to a stored memory proved sufficient to initiate reproduction.

Control experiments confirmed that the extraction depends entirely on the contents of the original pretraining corpus. When the researchers fine-tuned the model on public-domain novels by Virginia Woolf, the system exhibited comparable verbatim extraction of modern copyrighted books, achieving over 70 percent coverage.⁶ However, when they trained the model on synthetic fiction generated from scratch, verbatim extraction dropped to near zero.¹³ Because synthetic texts share no historical footprint with the models' pretraining data, the task could not hook into pre-existing memory pathways.

What do shared verbatim passages reveal about training sources?

Independent production models developed by separate technology companies memorize the exact same passages within copyrighted books. When comparing GPT-4o, Gemini-2.5-Pro, and DeepSeek-V3.1, the researchers found that per-book extraction rates were strongly correlated, with Pearson correlation coefficients reaching 0.90 or higher.¹³ Furthermore, the word-level overlap of memorized passages between different models reached 90 to 97 percent of each model's own self-agreement ceiling.¹³ Despite differing model architectures and proprietary alignment recipes, all three frontier systems retained the same literary fragments.

To investigate whether the models could have picked up these passages from scattered web quotes, the authors cross-referenced the extracted spans against two expansive web datasets derived from Common Crawl, DCLM-Baseline and OLMo-3's Common Crawl corpus, totaling over eight trillion tokens.¹³ Under exact matching criteria, approximately 61 percent of all extracted text spans and 90 percent of spans longer than 150 words were entirely absent from both web corpora.¹⁴ By contrast, an audit of known shadow libraries revealed that 80 of the 81 test books appeared in the pirate repositories Books3 or Library Genesis.¹³

The presence of extended, continuous literary passages that do not exist on the open web provides strong circumstantial evidence that major commercial systems were trained on complete digital copies of published books. The finding also aligns with legal disclosures. During discovery in class-action litigation, Anthropic revealed its Project Panama initiative, an effort where the company purchased physical books, sliced their spines with industrial cutters, and fed the loose leaves into high-speed scanners to ingest their complete text into training sets after earlier downloading millions of volumes from pirate archives.¹

What are the boundaries of these findings?

The reported figures represent an empirical measurement of model memorization capacity under specialized extraction conditions, rather than a forecast of how consumer chatbots behave in standard chat interfaces. The experimental framework evaluated closed commercial models accessible via application programming interfaces and utilized 100 decoding samples per prompt at a temperature setting of 1.0 to map the full distribution of model memory.¹ In routine consumer interactions, where models generate a single completion under conservative sampling parameters and active conversational filters, direct verbatim leakage remains comparatively rare. Furthermore, the research did not inspect the full proprietary training data logs of OpenAI or Google, meaning that while the statistical correlation with pirate collections is exceptionally high, absolute provenance cannot be conclusively proved from model outputs alone.

The findings carry significant implications for intellectual property litigation and fair use doctrine in United States courts. In ongoing disputes such as Bartz v. Anthropic and Kadrey v. Meta Platforms, technology firms have argued that training constitutes transformative fair use because models do not retain accessible copies of copyrighted works and guardrails prevent market substitution.¹³ By proving that fine-tuning functions as an alignment whack-a-mole, where suppressing one output route leaves verbatim text recoverable through standard application programming interfaces, the study supplies empirical evidence that model weights store functional reproductions of protected books.

Looking forward, developers face the technical challenge of decoupling knowledge acquisition from rote parameter storage. Simple post-hoc filters and reinforcement learning fail to secure models once downstream users adapt weights for specialized tasks. As legal scrutiny intensifies around commercial artificial intelligence deployment, the industry will likely be forced to develop provable data unlearning techniques or restrict open fine-tuning capabilities on proprietary frontier architectures.

References

This article is based on 7 sources, listed in the order they are cited.

1. 1 XL Xinyue Liu, Niloofar Mireshghallah, Jane C. Ginsburg, Tuhin Chakrabarty announcement · 9 Sep 2026 Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models See the source
2. 2 A arxiv.org Alignment Whack-a-Mole : Finetuning Activates Verbatim Recall of Copyrighted Books in Large Language Models See the source
3. 3 D Decision&Law third party · 29 Apr 2026 LLMs and Copyright: How Finetuning Breaks Alignment and Exposes Protected Books See the source
4. 4 LC lilting channel third party · 3 May 2026 Fine-Tuning Reignites Verbatim Memorization of Copyrighted Books in LLMs | lilting channel See the source
5. 5 N note（ノート） third party · 9 Apr 2026 「モデル重みが著作権作品のコピーを実際に保存している」という強力な証拠　https://arxiv.org/pdf/2603.20957v2　について深掘りしてみました｜すらいむ＠フィードフォワードで未来へ進化！！ See the source
6. 6 N note（ノート） third party · 29 Mar 2026 AIの「著作権ガード」は本当に機能しているのか――論文「Alignment Whack-a-Mole」が問いかけるもの｜じろう See the source
7. 7 C cauchy221.github.io Alignment Whack-a-Mole See the source