6 ms·

What are the chances that the code in question was ingested without the license being available in the first place? What I mean here: 1. Person 1 writes Libra

What are the chances that the code in question was ingested without the license being available in the first place? What I mean here: 1. Person 1 writes Library 1 with License 1, and posts it to GitHub under Person 1's account. 2. Person 2 steals code from Person 1, or parts of it, without carrying over any of the original license information. This code is then posted to GitHub under Person 2's account, without any links to the original repository. 3. Copilot is trained on data from Person 2's repository and is able to reproduce it despite the original code being under license.

codazoda 4y ago
Hopefully they didn’t train on unlicensed code. In the US everything has automatic copyright.
- cma 4y ago
  Githuh automatically gets a license to redistribute in code form when you upload a public project. Though you may not necessarily have the rights to give if it is a third party's project.
  - 3836293648 4y ago
    Which is complete nonsense as most of the time the person forking does not have the right to license the code to github like that
    - Filligree 4y ago
      Then they shouldn’t be uploading to GitHub in the first place. Seriously. Terms of service don’t cease existing because they’re inconvenient.
      - account42 4y ago
        A third party violating the terms of service doesn't allow GitHub to violate someone elses rights.
        cma 4y ago
        DMCA is the mechanism to take it down if that happened.
  - account42 4y ago
    Github can only get an automatic license for things the uploader has the rights to give out licenses.
arriu 4y ago
I wonder if it is something simpler. For example, could it have been picked up as a pattern from a local file that is in your project?
- Filligree 4y ago
  Absolutely, but in my experience it then tends to verbatim, as context allows. If this is a lightly edited copy, chances are pretty good there’s hundreds of equally lightly edited copies sitting around on GitHub. It shouldn’t be possible to overfit the model to this degree from a single example.
dandellion 4y ago
3b. Some lazy dev somewhere finds Person 2's code and copy-pastes it on their project. This is not really a new problem that has suddenly appeared with these new AIs...
- Double_a_92 4y ago
  But if you are a lazy, stealing dev you know what you are doing. While if you were using CoPilot you wouldn't even be aware that you did something wrong.
  - dandellion 4y ago
    On the contrary. If person 2 removes the licensing information lazy dev can't know that they're doing anything wrong, in fact it could easily have an OSS license that misleads lazy dev because GitHub allows you to select OSS licenses when you create a repo, so there's sure to be plenty of copy-pasted code under the wrong license.
  - sdenton4 4y ago
    Getting the Tim Davis result required careful prompting, and doesn't resemble real world usage. If you get the Tim Davis result, you very well know what you were trying to do.
naillo 4y ago
I think for cases like this it should be copilots job to have to deal with the fact that things like this exists. And if there isn't a way to do it without risk of laundering copyrighted code, then it just shouldn't be a service. Lots of grey zone illegal things you could build is 'insanely valuable' but would be sued into non existence if created by a smaller actor.
rectang 4y ago
You've just described why tracking provenance is important to avoid copyright infringement. It doesn't matter where you got it from, if it's infringing it's infringing. You can sue the infringing middleman, but that doesn't mean your transitive use isn't infringing. Microsoft should train Copilot on their own code. Theoretically they know where all that code came from and they haven't got a lot of copyright problems internally that would be revealed by Copilot. If they won't do that, that should factor into what we think of their arguments about what Copilot means for training corpus authors.
okennedy 4y ago
Even if this were the situation, and the owner of the 2nd repository were the one at fault, CoPilot can't point to the specific repository it "learned" the code from to absolve itself. If a human said, of sufficiently complex and virtually identical code, that they had made it independently, they'd be laughed out of a courtroom. In situations like this, the provenance of a generated idea (explainability) is needed to preserve trust.
planede 4y ago
Sure, and I agree that this can be an honest mistake. But distributing the code through copilot might still be copyright infringement. If copilot indeed infringes on copyright on some cases, then there must be a way to make copilot complying and stop distributing the copyrighted code in question. Normally, if person 2 steals your code and hosts it on Github while infringing the original license, person 1 can send a DMCA notice to Github to take the code down. A similar process could be involved for copilot too. If copilot would be a DMCA safe harbor, then they would need to comply would DMCA notices and stop distributing the offending code in a timely manner. It might be implemented by elaborate filters (which are probably not a 100% accurate), or batching up DMCA notices, and retraining their model regularly with offending repos/code excluded. Of course, Microsoft drag their feet and say that copilot never infringes on copyright. They don't want to do any of this.

codazoda 4y ago

Hopefully they didn’t train on unlicensed code. In the US everything has automatic copyright.

cma 4y ago
Githuh automatically gets a license to redistribute in code form when you upload a public project. Though you may not necessarily have the rights to give if it is a third party's project.
- 3836293648 4y ago
  Which is complete nonsense as most of the time the person forking does not have the right to license the code to github like that
  - Filligree 4y ago
    Then they shouldn’t be uploading to GitHub in the first place. Seriously. Terms of service don’t cease existing because they’re inconvenient.
    - account42 4y ago
      A third party violating the terms of service doesn't allow GitHub to violate someone elses rights.
      - cma 4y ago
        DMCA is the mechanism to take it down if that happened.
- account42 4y ago
  Github can only get an automatic license for things the uploader has the rights to give out licenses.

arriu 4y ago

I wonder if it is something simpler. For example, could it have been picked up as a pattern from a local file that is in your project?

Filligree 4y ago
Absolutely, but in my experience it then tends to verbatim, as context allows. If this is a lightly edited copy, chances are pretty good there’s hundreds of equally lightly edited copies sitting around on GitHub. It shouldn’t be possible to overfit the model to this degree from a single example.

dandellion 4y ago

3b. Some lazy dev somewhere finds Person 2's code and copy-pastes it on their project. This is not really a new problem that has suddenly appeared with these new AIs...

Double_a_92 4y ago
But if you are a lazy, stealing dev you know what you are doing. While if you were using CoPilot you wouldn't even be aware that you did something wrong.
- dandellion 4y ago
  On the contrary. If person 2 removes the licensing information lazy dev can't know that they're doing anything wrong, in fact it could easily have an OSS license that misleads lazy dev because GitHub allows you to select OSS licenses when you create a repo, so there's sure to be plenty of copy-pasted code under the wrong license.
- sdenton4 4y ago
  Getting the Tim Davis result required careful prompting, and doesn't resemble real world usage. If you get the Tim Davis result, you very well know what you were trying to do.

naillo 4y ago

I think for cases like this it should be copilots job to have to deal with the fact that things like this exists. And if there isn't a way to do it without risk of laundering copyrighted code, then it just shouldn't be a service. Lots of grey zone illegal things you could build is 'insanely valuable' but would be sued into non existence if created by a smaller actor.

rectang 4y ago

You've just described why tracking provenance is important to avoid copyright infringement. It doesn't matter where you got it from, if it's infringing it's infringing. You can sue the infringing middleman, but that doesn't mean your transitive use isn't infringing. Microsoft should train Copilot on their own code. Theoretically they know where all that code came from and they haven't got a lot of copyright problems internally that would be revealed by Copilot. If they won't do that, that should factor into what we think of their arguments about what Copilot means for training corpus authors.

okennedy 4y ago

Even if this were the situation, and the owner of the 2nd repository were the one at fault, CoPilot can't point to the specific repository it "learned" the code from to absolve itself. If a human said, of sufficiently complex and virtually identical code, that they had made it independently, they'd be laughed out of a courtroom. In situations like this, the provenance of a generated idea (explainability) is needed to preserve trust.

planede 4y ago

Sure, and I agree that this can be an honest mistake. But distributing the code through copilot might still be copyright infringement. If copilot indeed infringes on copyright on some cases, then there must be a way to make copilot complying and stop distributing the copyrighted code in question. Normally, if person 2 steals your code and hosts it on Github while infringing the original license, person 1 can send a DMCA notice to Github to take the code down. A similar process could be involved for copilot too. If copilot would be a DMCA safe harbor, then they would need to comply would DMCA notices and stop distributing the offending code in a timely manner. It might be implemented by elaborate filters (which are probably not a 100% accurate), or batching up DMCA notices, and retraining their model regularly with offending repos/code excluded. Of course, Microsoft drag their feet and say that copilot never infringes on copyright. They don't want to do any of this.