Hacker News Reader

Comment by csmpltn | Hacker News Reader

What are the chances that the code in question was ingested without the license being available in the first place?

What I mean here:

1. Person 1 writes Library 1 with License 1, and posts it to GitHub under Person 1's account.

2. Person 2 steals code from Person 1, or parts of it, without carrying over any of the original license information. This code is then posted to GitHub under Person 2's account, without any links to the original repository.

3. Copilot is trained on data from Person 2's repository and is able to reproduce it despite the original code being under license.

View on HN

You've just described why tracking provenance is important to avoid copyright infringement. It doesn't matter where you got it from, if it's infringing it's infringing. You can sue the infringing middleman, but that doesn't mean your transitive use isn't infringing.

Microsoft should train Copilot on their own code. Theoretically they know where all that code came from and they haven't got a lot of copyright problems internally that would be revealed by Copilot. If they won't do that, that should factor into what we think of their arguments about what Copilot means for training corpus authors.

I think for cases like this it should be copilots job to have to deal with the fact that things like this exists. And if there isn't a way to do it without risk of laundering copyrighted code, then it just shouldn't be a service. Lots of grey zone illegal things you could build is 'insanely valuable' but would be sued into non existence if created by a smaller actor.

Even if this were the situation, and the owner of the 2nd repository were the one at fault, CoPilot can't point to the specific repository it "learned" the code from to absolve itself. If a human said, of sufficiently complex and virtually identical code, that they had made it independently, they'd be laughed out of a courtroom. In situations like this, the provenance of a generated idea (explainability) is needed to preserve trust.

3b. Some lazy dev somewhere finds Person 2's code and copy-pastes it on their project.

This is not really a new problem that has suddenly appeared with these new AIs...

But if you are a lazy, stealing dev you know what you are doing. While if you were using CoPilot you wouldn't even be aware that you did something wrong.

On the contrary. If person 2 removes the licensing information lazy dev can't know that they're doing anything wrong, in fact it could easily have an OSS license that misleads lazy dev because GitHub allows you to select OSS licenses when you create a repo, so there's sure to be plenty of copy-pasted code under the wrong license.

Getting the Tim Davis result required careful prompting, and doesn't resemble real world usage. If you get the Tim Davis result, you very well know what you were trying to do.

Sure, and I agree that this can be an honest mistake. But distributing the code through copilot might still be copyright infringement. If copilot indeed infringes on copyright on some cases, then there must be a way to make copilot complying and stop distributing the copyrighted code in question.

Normally, if person 2 steals your code and hosts it on Github while infringing the original license, person 1 can send a DMCA notice to Github to take the code down. A similar process could be involved for copilot too.

If copilot would be a DMCA safe harbor, then they would need to comply would DMCA notices and stop distributing the offending code in a timely manner. It might be implemented by elaborate filters (which are probably not a 100% accurate), or batching up DMCA notices, and retraining their model regularly with offending repos/code excluded.

Of course, Microsoft drag their feet and say that copilot never infringes on copyright. They don't want to do any of this.

Hopefully they didn’t train on unlicensed code. In the US everything has automatic copyright.

Githuh automatically gets a license to redistribute in code form when you upload a public project. Though you may not necessarily have the rights to give if it is a third party's project.

Which is complete nonsense as most of the time the person forking does not have the right to license the code to github like that

Then they shouldn’t be uploading to GitHub in the first place.

Seriously.

A third party violating the terms of service doesn't allow GitHub to violate someone elses rights.

DMCA is the mechanism to take it down if that happened.

Github can only get an automatic license for things the uploader has the rights to give out licenses.

I wonder if it is something simpler. For example, could it have been picked up as a pattern from a local file that is in your project?

Absolutely, but in my experience it then tends to verbatim, as context allows.

If this is a lightly edited copy, chances are pretty good there’s hundreds of equally lightly edited copies sitting around on GitHub. It shouldn’t be possible to overfit the model to this degree from a single example.

Reply on news.ycombinator.com