I guess, from a technical perspective, it should be pretty simple: if you can extract an image (or major features applicable for protection), the image is store

I guess, from a technical perspective, it should be pretty simple: if you can extract an image (or major features applicable for protection), the image is stored in the model. For this purpose, it's yet another compression algorithm. (Conversely, if this isn't applicable, does this mean that providing protected content in compressed form, say, as a zip archive, is also exempt? In a sense, it's yet another model with an output probability of 1.0.)