How GitHub Copilot could steer Microsoft into a copyright storm
- Reference: 1666178885
- News link: https://www.theregister.co.uk/2022/10/19/github_copilot_copyright/
- Source link:
On Monday, Matthew Butterick, a lawyer, designer, and developer, [1]announced he is working with Joseph Saveri Law Firm to investigate the possibility of filing a copyright claim against GitHub. There are two potential lines of attack here: is GitHub improperly training Copilot on open source code, and is the tool improperly emitting other people's copyrighted work – pulled from the training data – to suggest code snippets to users?
Butterick has been critical of [2]Copilot since its launch. In June he published [3]a blog post arguing that "any code generated by Copilot may contain lurking license or IP violations," and thus should be avoided.
[4]
That same month, Denver Gingerich and Bradley Kuhn of the Software Freedom Conservancy (SFC) said their organization [5]would stop using GitHub , largely as a result of Microsoft and GitHub releasing Copilot without addressing concerns about how the machine-learning model dealt with different open source licensing requirements.
Many developers have been worried about what Copilot means for open source
Copilot's capacity to copy code verbatim, or nearly so, surfaced last week when Tim Davis, a professor of computer science and engineering at Texas A&M University, [6]found that Copilot , when prompted, would reproduce his copyrighted sparse matrix transposition code.
Asked to comment, Davis said he would prefer to wait until he has heard back from GitHub and its parent Microsoft about his concerns.
[7]
[8]
In an email to The Register , Butterick indicated there's been a strong response to news of his investigation.
"Clearly, many developers have been worried about what Copilot means for open source," he wrote. "We're hearing lots of stories. Our experience with Copilot has been similar to what others have found – that it's not difficult to induce Copilot to emit verbatim code from identifiable open source repositories. As we expand our investigation, we expect to see more examples.
[9]
"But keep in mind that verbatim copying is just one of many issues presented by Copilot. For instance, a software author's copyright in their code can be violated without verbatim copying. Also, most open-source code is covered by a license, which imposes additional legal requirements. Has Copilot met these requirements? We're looking at all these issues."
Spokespeople for Microsoft and GitHub were unable to comment for this article. However, GitHub's documentation for Copilot [10]warns that the output may contain "undesirable patterns" and puts the onus of intellectual property infringement on the user of Copilot. That is to say, if you use Copilot to auto-complete code for you and you get sued, you were warned. That warning implies that the potential for Copilot to produce copyrighted code was not unanticipated.
'Eager'
When GitHub introduced a beta version of Copilot in 2021, and questions about copyright and licensing were raised, then-CEO Nat Friedman [11]opined "training ML systems on public data is fair use [and] the output belongs to the operator, just like with a compiler. We expect that IP and AI will be an interesting policy discussion around the world in the coming years, and we're eager to participate!"
That participation, incidentally, has included GitHub-funded panel discussions about the impact of AI on open source, at [12]an event run by the Open Source Initiative, which is partly funded by [13]Microsoft .
Kuhn from the SFC told The Register in an email that statements by GitHub's now-ex CEO that these copyright issues are settled law create a false narrative – a point he's made [14]previously .
[15]
"We've spoken with Microsoft and GitHub multiple times on this issue and their unsupported anti-FOSS [free and open source software] position has remained disturbingly consistent," he wrote. "We believe that Microsoft and GitHub have made the political calculation that if they keep repeating that what they're doing is acceptable, early and often, that they can make true what is not known to be true."
Yet among those who find tools like Copilot useful, there's hope that assistive AI can be reconciled with our social and legal frameworks. That a model's output won't lead to litigation.
Brett Becker, assistant professor at University College Dublin in Ireland, told The Register in an email, "AI-assisted programming tools are not going to go away and will continue to evolve. Where these tools fit into the current landscape of programming practices, law, and community norms is only just beginning to be explored and will also continue to evolve.
"An interesting question is: what will emerge as the main drivers of this evolution? Will these tools fundamentally alter future practices, law, and community norms – or will our practices, law and community norms prove resilient and drive the evolution of these tools?"
The legal implications of large language models, such as OpenAI's Codex, upon which Copilot is based, and text-to-image models built from datasets compiled by German non-profit LAION, such as Imagen and Stable Diffusion, remain heated topics of discussion. Similar concerns about the [16]images generated by Midjourney have been raised.
Asked whether he believes large language models (LLMs) focused on generating source code are more prone to copyright violations because of the constrained nature of their output, Butterick said he's reluctant to generalize.
"We've also been looking into the image generators – users have already found that DALL-E and Midjourney and Stable Diffusion have different strengths and weaknesses. The same will likely be true for LLMs for coding," he said.
"These questions about Copilot have been raised since it was first available in beta. There are probably some legal questions that will end up being common to all these systems, especially around the handling of training data. Again, we're not the first people to raise these. One big difference between open-source code and images is that images are usually offered under licenses that are more restrictive than open-source licenses."
There are also adjacent social and ethical issues that remain unresolved, such as whether AI-generated code should be considered plagiarism and to what extent creators of the materials used to train a neural network should have a say in that AI model's usage.
In the Texas Law Review in March, 2021, Mark Lemley, a Stanford law professor, and Bryan Casey, then a lecturer in law at Stanford, posed a question: "Will copyright law allow robots to learn?" They [17]argue that, at least in the United States, it should.
"[Machine learning] systems should generally be able to use databases for training, whether or not the contents of that database are copyrighted," they wrote, adding that copyright law isn't the right tool to regulate abuses.
But when it comes to the output of these models – the code suggestions automatically made by the likes of Copilot – the potential for the copyright claim proposed by Butterick looks stronger.
"I actually think there's a decent chance there is a good copyright claim," said Tyler Ochoa, a professor in the law department at Santa Clara University in California, in a phone interview with The Register .
I actually think there's a decent chance there is a good copyright claim
In terms of the ingestion of publicly accessible code, Ochoa said, there may be software license violations but that's probably protected by fair use. While there hasn't been a lot of litigation about that, a number of scholars have taken that position and he said he's inclined to agree.
Kuhn is less willing to set aside how Copilot deals with software licenses.
"What Microsoft's GitHub has done in this process is absolutely unconscionable," he said. "Without discussion, consent, or engagement with the FOSS community, they have declared that they know better than the courts and our laws about what is or is not permissible under a FOSS license. They have completely ignored the attribution clauses of all FOSS licenses, and, more importantly, the more freedom-protecting requirements of copyleft licenses."
But in terms of where Copilot may be vulnerable to a copyright claim, Ochoa believes LLMs that output source code – more so than models that generate images – are likely to echo training data. That may be problematic for GitHub.
"When you're trying to output code, source code, I think you have a very high likelihood that the code that you output is going to look like one or more of the inputs, because the whole point of code is to achieve something functional," he said. "Once something works well, lots of other people are going to repeat it."
Permissive MIT, Apache open-source licenses on the up as developers snub GNU's GPL [18]READ MORE
Ochoa argues the output is likely to be the same as the training data for one of two reasons: "One is there's only one good way to do it. And the other is [you're] copying basically an open source solution.
"If there's only one good way to do it, OK, then that's probably not eligible for copyright. But chances are that there's just a lot of code in [the training data] that has used the same open source solution, and that the output is going to look very similar to that. And that's just copying."
In other words, the model may suggest code to solve a problem for which there's only really one practical solution, or it's copying from someone's open source that does the same thing. In either case, that's probably because a lot of people have used the same code, and that shows up a lot in the training data, leading to the assistant regurgitating it.
Would that be fair use? It's not clear. Ochoa says the functional nature of the code means that reproducing it in a suggestion may not be seen as particularly transformative, which is one of the [19]criteria for determining fair use. And then there's the issue of whether the copying harms the market when the market is not charging for open source code. If it harms the market, fair use may not apply.
"The problem here is the market doesn't charge you money for these uses," said Ochoa, adding though that the terms of the open source licenses are what the market is most interested in. "If a court thinks those conditions are important, then they'll say, 'yeah, you're harming the market for these works, because you're not complying with the conditions.' [The software creators are] not getting the consideration that they wanted when they created these words in the first place.
"So they're not seeking monetary compensation. They're seeking non-monetary compensation. And they're not getting it. And if they're not getting it, then they're going to be less likely to contribute open source code in the future. In theory, that's harming the market for these works or harming the incentive to produce them."
The generated code thus may not be transformative enough to be fair use, and may harm the market as described – again, potentially derailing a fair use claim.
[20]AI co-programmers perhaps won't spawn as many bugs as feared
[21]GitHub Copilot may be perfect for cheating CompSci programming exercises
[22]FauxPilot: It's like GitHub Copilot but doesn't phone home to Microsoft
[23]Even robots have the right to learn from open source
When Berkeley Artificial Intelligence Research considered this issue back in 2020, the group [24]suggested that perhaps training large language models from public web data is fundamentally flawed, given concerns about privacy, bias, and the law. They proposed that tech companies invest in collecting better training data rather than hoovering up the web. That doesn't appear to have happened.
Kuhn argues the status quo must not stand and adds that the SFC has been discussing Microsoft's GitHub with its litigation counsel for a year now.
"We are at a crossroads in our culture, which was in many ways predicted by science fiction," he said.
"Big Tech companies, in all sorts of ways, are seeking to force upon us their preferred conclusions about the applications of artificial intelligence – regardless of what the law says or what values the community of users, consumers, and developers holds. FOSS, and the inappropriate exploitation of FOSS by Microsoft's GitHub, is just one way of doing this among many. We have to stand up to Big Tech's behavior here, and we plan to."
Asked what the ideal outcome would be, Butterick replied that it's too soon to say.
"There's so much we don't know about how Copilot works," he wrote.
"Certainly, we can imagine versions of Copilot that are friendlier to the rights & interests of open-source developers. As it stands, it's potentially an existential threat to open source.
"Obviously, it's ironic that GitHub, a company that built its reputation and market value on its deep ties to the open source community, would release a product that monetizes open source in a way that damages the community. On the other hand, considering Microsoft’s long history of antagonism toward open source, maybe it's not so surprising. When Microsoft bought GitHub in 2018, a lot of open source developers – me included – hoped for the best. Apparently that hope was misplaced." ®
Get our [25]Tech Resources
[1] https://githubcopilotinvestigation.com/
[2] https://www.theregister.com/2022/06/21/githubs_ai_code_assistant_copilot/
[3] https://matthewbutterick.com/chron/this-copilot-is-stupid-and-wants-to-kill-me.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y1AfF2R6QvtrBoVp2UYu-wAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2022/06/30/software_freedom_conservancy_quits_github/
[6] https://devclass.com/2022/10/17/github-copilot-under-fire-as-dev-claims-it-emits-large-chunks-of-my-copyrighted-code/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y1AfF2R6QvtrBoVp2UYu-wAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y1AfF2R6QvtrBoVp2UYu-wAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y1AfF2R6QvtrBoVp2UYu-wAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot#using-github-copilot
[11] https://twitter.com/natfriedman/status/1409914420579344385
[12] https://deepdive.opensource.org/
[13] https://opensource.org/node/901
[14] https://sfconservancy.org/blog/2022/feb/03/github-copilot-copyleft-gpl/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y1AfF2R6QvtrBoVp2UYu-wAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2022/08/01/david_holz_midjourney/
[17] https://texaslawreview.org/fair-learning/
[18] https://www.theregister.com/2020/01/17/mit_apache_versus_gpl/
[19] https://fairuse.stanford.edu/overview/fair-use/four-factors/
[20] https://www.theregister.com/2022/10/07/machine_learning_code_assistance/
[21] https://www.theregister.com/2022/08/19/copilot_github_students/
[22] https://www.theregister.com/2022/08/06/fauxpilot_github_copilot/
[23] https://www.theregister.com/2022/07/11/robots_open_source/
[24] https://bair.berkeley.edu/blog/2020/12/20/lmmem/
[25] https://whitepapers.theregister.com/
Book. MP3. Kobo.
The medium is not the copyright.
Re: Just one question
ALL code is copyrighted. Some jurisdictions do even consider null and void the renounce to copyright rights (so technically public domain code which wasn't written 70 years before the death of the author, ie none, is not free to use at all).
The difference between open source and closed source is how they leverage copyright law to their goals.
Closed source licenses will use copyright law to make sure you can't share, modify or reuse their code.
Open source licenses will use copyright law to make sure you CAN share, modify or reuse their code on their conditions.
Where this crap AI falls foul is that they might share, modify and reuse third party code without granting whatever rights or obligations the original license "gave" to the training set. For starters, most (if not all) open source licenses require that a copy of the license itself to be given along with the source code, no matter if the whole work or just a part is at issue.
For MIT-like licenses, not retaining authorship notices is a copyright license violation. For GPL-like it is even worse, as none of the GPL granted rights would be passed upon downstream, which is by itself a violation.
Re: Just one question
Totally right. MS are trying to argue that because the code is publicly available, then copyright licenses no longer apply, even though most FOSS code is released under a license. So they say they're free to ignore the license.
If that's true then closed source licenses can also be ignored, and any machine code that's publicly available can also be ingested by an AI and spat out into an AI generated executable which anyone else can use for free. So I could make an "AI copilot" myself that gets an executable from https://www.microsoft.com/software-download/windows11 and use that to add a bit more code in, then distribute it however I want. After all, who cares about their copyright and license conditions, it's public availability that counts right?
They're playing a bit too fast and loose with other people's work here, they should be wary that it doesn't set any precedents that may come back to bite them.
Re: Just one question
Your conclusion just proves that indeed Co-pilot does harm the open source "market".
Major privacy issues
It's not just the copyright aspects of GitHub copilot that worry me.
The tool is 100% cloud based, there is absolutely no offline version, it brings all our coding activity online where it can be surveilled. If Copilot becomes widespread in the industry then not using it will be a productivity disadvantage compared to those who so. So we will have to end up using it. This is a *major* privacy problem, it is like a nightmare. And it means our computers are being turned into what are effectively terminals to a cloud based AI "mainframe".
Just chilling, absolutely totally chilling. It really gives me the creeps, because of the potential for a slippery slope here. It is one of the most unnerving, scary thing I have read for a long time. I hope someone develops a decent open-source offline equivalent, that doesn't have to send every keystroke to the cloud.
It's only a matter of time before government, corporations, police, etc. get their hands on the data stream to analyse, "for our protection". Take my word for it, they will find a suitable excuse one way or another, it's only a matter of time. And they will first target those writing "controversial" software, maybe cryptocurrency tumblers, for example. Just wait 10 years from now and see what happens.
Re: Major privacy issues
This might be one of the first steps towards making everything in computing cloud-centric. One by one by one, boiling the frog, over a period of roughly 20 years. So the ultimate consequence of that would be our computers would *require* an Internet connection to function, i.e. they would be just dumb terminals. And law enforcement will be trawling through our files, looking for things that offend whatever moral sensibilities are in fashion at the time. And keeping people "safe" will be the excuse for doing that. Of course, it's an excuse, one for exercising power over the general public.
Hopefully people will push back against such moves. We need to resist each and every small step, starting from the beginning. Before we end up losing all our freedom in the decades to come.
Boycotting GitHub Copilot for this reason could be even more important than the copyright issues.
Thus to prevent a general shift in power from individuals, towards those who operate cloud computing infrastructure, we must refuse to use such cloud-centric tools. And work together to create offline alternatives.
"training ML systems on public data is fair use [and] the output belongs to the operator, just like with a compiler...
By that standard you can take all what is written about books and use the description's content text to train a ML system. Then when you use the system and it "writes" "Henry Flotter and the magical wanderer's gem" we'll see how long the fair use defence will stand.
This is very much the issue and it's not nearly as clear-cut as your example makes out.
Most people learn by looking at what others have done, then build something themselves based on what they've learned. Whether that is a copyright violation or not depends on just how close it is to what they've seen from others.
One way of looking at Copilot is that it's a tool to make that process of looking at other people's work and using what you learn a lot more efficient. But it lacks any sort of "hang on, that's too similar to what we've seen elsewhere" filter and also hides the source of the material from the human who is using the tool, so they have no reasonable basis to assess whether the code it's just produced is a copyright violation or not.
Copilot, as an AI, is not a legal person who can be sued for the copyright violation and, naturally, the Copilot terms of use make the end user completely responsible for assessing whether the output is a copyright violation or not.
The only sane course from here is to avoid Copilot like the plague.
If it is open source you CAN copy verbatim but must attribute and following the licensing requirements.
In the particular case of the pinched "sparse matrix transposition" code used a specific example to make a legal claim, I'm inclined to believe that the designers of Co-pilot could have easily designed the system to also emit attributions for strongly related source code. The fact that the designers did not do that was a conscious decision to deny due credit and steal it for themselves, using as an alibi the faulty logic that Co-pilot was an intelligent entity equivalent to a responsible human that abstracted from training data and re-emitted as original code.
Liability has already been defined
There is already case law establishing that an AI cannot be an "inventor", in respect to patents, and that the "operator" / provider of the AI's training and output is. This presumes then that the liabilities also follow the same path, and this leads to Microsoft. Furthermore, the damaged party, which is the originator of the training data, may not even be a party to any agreements with github or microsoft.
No Solidarity with A.I.'s run for profit!
This story prompts one primary question: *why* do I consider giving my code and insights to other humans (via GitHub or StackExchange or the like) to be alright if the thought of Microsoft-controlled Co-Pilot exploiting the same is anathema?
I think this is a story about solidarity and, quite simply, I don't hold any solidarity for corporations. For other coders, I can at least try to believe that I'm helping out a human being who may very well be living a similar life to my own – past and present. Their high-functioning thoughts may very well be being exploited and, frankly, any little helps, right?
Had Microsoft said to the open-source world that their A.I. trained on open-source *was* itself also open source and, additionally, free to use for free-as-in-freedom work – and, also, not useable for proprietary work from which its training data would also be precluded – I expect that the revulsion from the world of coding would be very much different.
Do not break the picket line! Solidarity! No open-source code for corporate parasites!
Re: No Solidarity with A.I.'s run for profit!
I give my code and insights away to other humans on the understanding that certani rules will be followed, as specified in the chosen license.
* If another human is able to make use of it, and respects the terms of the license, I'm happy.
* If an AI system is able to make use of it, and respects the terms of the license, I'm happy.
* If a human does the Finding Nemo Seagull thing with my code and uses it without respecting the license terms, I'm annoyed. (It's happened several times.)
* If an AI system hoovers up and aborbs my code like some kind of ethereal Katamari Damacy, and then horks up chunks of it at random with no way for the receiving human to know it was mine or what the licence terms are, I'm going to be even more annoyed.
Re: No Solidarity with A.I.'s run for profit!
[...] an AI system hoovers up and absorbs my code like some kind of ethereal Katamari Damacy, and then horks up chunks of it at random
Best machine learning AI description I've ever read. Can't upvote enough.
Re: No Solidarity with A.I.'s run for profit!
Well put.
There is a big difference between a) putting my effort into an application for my community, or assisting my fellow worker, and b) working for free to create a paid-for service that will assist capital in profiting off of replacing labour.
No way. That's abhorrent.
Re: No Solidarity with A.I.'s run for profit!
Actually, many proprietary software companies were already prohibiting their developers from using resources like stackoverflow toward the end of last decade precisely because they feared snippets of code from there might cross-contaminate and taint the licensing of their own products. Hence, I don't see why these same companies would not similarly fear co-pilot, which does so with even greater ease.
I am not a lawyer
but have I got this right?
If I completely independently create some code that happens to be the same as some Microsoft code, they will sue me for breach of copyright.
But if their AI copies some copyrighted/copy-left code verbatim, then that is alright.
Day 1: I write the code.
Day 1: AI Bot grabs it and spits it all over the source control landscape.
Day 2: I get sued by some giant corporate for copyright infringement.
I can't wait.
That's no joke - it is exactly what has happened to some small musicians and graphics artists who have received take-down notices for their own work after those works were vacuumed by parasite copyrighting "businesses".
I've a simple question. When coding for a certain task, how many ways are there to display "Hello world"?
@Kev99 - You will be surprised.
To find out. First, start by choosing a programming language (machine code included) the continue with an output method (screen, paper, audio etc.).
Re: @Kev99 - You will be surprised.
Rosetta Code has 539 methods, just for text output. There's a couple of hundred other code snippets for different scenarios.
Hot code laundering and tumble dry service
We'll cut off all the tags for you too.
Just one question
Why would you publish copyrighted source code on a platform you do not control ?
Github is, AFAIK, open source. If your code is copyrighted, why is it available there ?