Tag Archives: Sarah Tishler

For most of the past year, when AI companies have talked about distillation, they have talked about it as a Chinese problem. In February 2026, OpenAI told the House Select Committee on China that DeepSeek employees had developed methods to circumvent OpenAI’s access restrictions and programmatically harvest outputs to train a competing model. Anthropic’s public technical disclosure went further, naming DeepSeek, Moonshot AI, and MiniMax, and quantifying the activity: roughly 24,000 fraudulent accounts, more than 16 million exchanges, focused on extracting Claude’s reasoning, coding, and agentic capabilities.

By April, the White House Office of Science and Technology Policy had adopted a national-security framing, accusing China of running “deliberate, industrial-scale campaigns” to distill American frontier models. Throughout this timeline, the narrative was that of foreign actors using proxy infrastructure to extract capabilities the United States had spent billions to build.

Recently, however, that narrative got more complicated. On the stand in Musk v. Altman in the Northern District of California, Elon Musk admitted under cross-examination that his AI company, xAI, had “partly” distilled OpenAI’s models. “It is standard practice,” Musk said, “to use other AIs to validate your AI.” There were, by the reporters’ account, audible gasps in the courtroom.

Whether or not it is in fact standard practice, distillation is now a topic that trade secret practitioners should understand. The legal frameworks for how courts will treat it are not yet settled, and the questions it raises map onto familiar trade secret doctrine in ways that are sometimes intuitive and sometimes not.

What Is Distillation?

In the technical literature, knowledge distillation is a method developed in the mid-2010s for transferring capabilities from a large, expensive model (the “teacher”) into a smaller, cheaper model (the “student”). The student is trained to reproduce the teacher’s outputs across a broad range of inputs, with the result being a model that approximates the teacher’s behavior at a fraction of the size and cost. As Anthropic’s own disclosure acknowledges, distillation is “widely used and legitimate,” and frontier labs routinely distill their own models to create smaller, cheaper versions for production deployment.

The contested form of distillation, sometimes called adversarial or unauthorized distillation, takes the same technique and applies it to someone else’s model. The distiller does not need to steal weights or breach servers. Access to the teacher model’s API is sufficient. The distiller submits a large volume of carefully constructed queries, captures the outputs, and uses those outputs as training data for a competing student model. The technique converts what would otherwise be a public-facing inference service into a training corpus for a rival system.

The finances of this technique are compelling, to say the least. To take one example, ChatGPT-5 reportedly cost more than $2 billion to develop. DeepSeek’s R1, which OpenAI alleges was built in part through distillation of ChatGPT outputs, reportedly cost approximately $6 million of marginal training compute. 

The Trade Secret Theory

The question for trade secret lawyers is whether what gets extracted through distillation can be a trade secret, and whether the extraction can constitute misappropriation.

First, it is always worth starting from first principles. A trade secret must be information that derives independent economic value from not being generally known or readily ascertainable, and that the owner has taken reasonable measures to keep secret. 18 U.S.C. § 1839(3). Frontier model weights and the proprietary training methodologies that produced them comfortably satisfy these criteria, just as compiled software and machine-learning architectures have for years. See, e.g., Camilla A. Hrdy, Trade Secrecy Meets Generative AI, 100 Chi.-Kent L. Rev. 317 (2025). The harder question is whether the outputs of a model, accessed through a public API, can carry trade secret status. And if they can, whether systematically harvesting them to reconstruct the underlying capabilities is misappropriation, or merely a novel form of reverse engineering.

Of course, that distinction matters. Reverse engineering of a publicly available product is a textbook proper means of acquisition under both the DTSA and the UTSA. See 18 U.S.C. § 1839(6)(B). If a frontier model is made available to the public through an API, and a competitor pays the access fees and queries it to learn how it behaves, the surface analogy to traditional reverse engineering is obvious: buy the product, study how it works, and build a competitor.

On the other hand, traditional reverse engineering targets a finished good, the embodied capability. Distillation targets the model’s underlying reasoning processes, learned representations, and capability distributions. As one recent analysis framed it, the trade secret on this theory is “the aggregate of learned representations that required billions of dollars in compute, proprietary training data, and years of research to develop, and that the owner has chosen to make available only through controlled inference access rather than” by distributing the model itself. That looks less like buying a product to take apart and more like extracting something the owner specifically chose not to release.

The terms-of-service overlay further complicates the analysis. OpenAI’s terms expressly prohibit using outputs to develop “imitation frontier AI models.” Anthropic’s terms contain similar restrictions. A user who agrees to those terms and then engages in mass output extraction is not an arms-length reverse engineer, but a contracting party using a service contrary to its agreed restrictions. Whether this transforms the conduct from “proper means” reverse engineering into misappropriation by improper means is, to my knowledge, an open question. 

hile there is no published decision directly on point, prior cases provide useful guidance. For example, in Compulife Software, Inc. v. Newman, 959 F.3d 1288 (11th Cir. 2020), defendants used a bot to submit automated queries to a public insurance-quote website, harvesting more than 43 million quotes in four days; a feat the court recognized would have taken a human “thousands of man-hours” to replicate. Id. at 1310. The Eleventh Circuit held that even though each individual quote was publicly available and not itself a trade secret, the compilation obtained at machine scale could be misappropriated through “improper means.” Id. at 1313–14. The Court wrote:

“Nor does the fact that the defendants took the quotes from a publicly accessible site automatically mean that the taking was authorized or otherwise proper. Although Compulife has plainly given the world implicit permission to access as many quotes as is humanly possible, a robot can collect more quotes than any human practicably could. So, while manually accessing quotes from Compulife’s database is unlikely ever to constitute improper means, using a bot to collect an otherwise infeasible amount of data may well be—in the same way that using aerial photography may be improper when a secret is exposed to view from above.” 

Id. at 1314. Applying the Compulife framework to distillation, one could easily see how a court would also find that adversarial distillation constitutes misappropriation.

Three Hypotheticals 

For practitioners advising clients on either side of these issues, three scenarios illustrate where the doctrine may soon be tested in a courtroom near you.

ypothetical One: The departing employee. A senior research engineer at a frontier lab leaves to join a competitor, taking with him knowledge of the prompt strategies and query patterns that most efficiently elicit the teacher model’s distinctive capabilities. He then directs his new employer’s distillation pipeline using that knowledge, achieving extraction efficiency the new employer could not have achieved on its own. Even if every individual query is permissible, and even if the employee discloses no model weights or training data, the prompt engineering methodology itself may be a protectable trade secret. This fits neatly into traditional employee mobility doctrine, with the wrinkle that the misappropriated information is a method of extracting third-party model capabilities rather than information about the former employer’s own operations.

Hypothetical Two: The validation defense. A company is sued by a frontier lab on the theory that it engaged in unauthorized distillation. The defendant responds: it was using the teacher model to validate its own model’s outputs, not to train on them. Validation is a real and legitimate practice in AI development. Distillation and validation can also look very similar, with both involving large volumes of structured queries and capture of outputs. The forensic question becomes: how does a plaintiff prove that captured outputs ended up in a training pipeline rather than a benchmarking dashboard? (This is a particular flavor of the black box problem that I have written about before.)

Hypothetical Three: The downstream user. A startup builds a product on top of an open-source model that, it later emerges, was itself distilled from a frontier model in violation of the frontier lab’s terms of service. The startup did not perform the distillation, did not know the upstream provenance, and is many steps removed from the original conduct. Does the DTSA’s “knew or had reason to know” standard, 18 U.S.C. § 1839(5)(B), reach the downstream user? At what point does the diligence obligation attach? The “innocent acquirer” framework was designed for a world in which trade secrets traveled through identifiable human or corporate intermediaries. It is not obvious how it applies when the trade secret allegedly travels through model weights that have been released to the public on Hugging Face.

The Bottom Line

As the AI industry continues its arms race, it seems likely that distillation is here to stay.

Companies whose AI offerings are accessible through APIs should be evaluating their terms-of-service architecture, their detection capabilities for anomalous query patterns, and their internal documentation of the resources invested in developing the underlying capabilities, because all of those will matter for any misappropriation case down the line. Companies that build on top of third-party models should be developing diligence practices around the provenance of those models, because of the DTSA’s constructive-knowledge standard. And practitioners on both sides should be watching the Musk v. Altman docket with interest. Formally, the case is about a charitable trust dispute. But the testimony it has produced may turn out to be the most candid public record we are going to get, for some time, of how distillation (and other AI-specific issues) actually works between sophisticated AI developers.

We will continue to monitor the docket and report on developments as the case progresses, and as the broader question of how trade secret law applies to model outputs begins to work its way through the courts.

Sarah Tishler is the author of this article. Sarah is a partner at Beck Reed Riden LLP. She is a commercial litigator whose practice focuses on complex business disputes in state and federal courts, including intellectual property, breach of contract, and fraud claims. Her experience also includes regulatory investigations, international arbitration, securities litigation, shareholder litigation, class-action litigation, and pre-transactional advising.

For years, AI companies have told courts, regulators, and the public the same thing: their models don’t store copies of training data. OpenAI put it plainly to the U.S. Copyright Office in 2023: “the models do not store copies of the information that they learn from.” Google said much the same, as did numerous commentators. This prevailing wisdom has been the basis of numerous significant legal decisions in the copyright space. See, e.g., Tremblay v. OpenAI, Inc., 716 F. Supp. 3d 772, 778 (N.D. Cal. 2024) (dismissing vicarious copyright infringement claim, holding, “Distinctly, Plaintiffs here have not alleged that the ChatGPT outputs contain direct copies of the copyrighted books.”).

A new preprint from researchers at Stony Brook University, Carnegie Mellon, and Columbia Law School suggests those assurances were wrong, and that in fact, LLMs can reproduce verbatim content from books that it had previously ingested, leading to the conclusion that copies of the information have actually been stored. 

The Experiment

The researchers designed a finetuning task with a deceptively simple setup: take a copyrighted book, break it into 300-500 word excerpts, generate a plot summary of each excerpt, and train a model to expand those summaries back into full text. The task looks completely legitimate, and is the sort of thing a commercial writing assistant might do. No actual book text appears at inference time. The model receives only a semantic description of what happens in a passage, and is asked to write it out.

The output was verbatim reproduction of the source text.

Across 81 copyrighted works by 47 contemporary authors, ranging from The Handmaid’s Tale to Sapiens to Twilight, finetuned versions of GPT-4o, Gemini-2.5-Pro, and DeepSeek-V3.1 reproduced up to 85-90% of a held-out book’s content, with single verbatim spans exceeding 460 words. Before finetuning, aligned models produced almost no verbatim content from the same prompts.

The most striking finding is the cross-author result. The researchers finetuned GPT-4o exclusively on Haruki Murakami’s novels, then tested it on Cormac McCarthy, Ta-Nehisi Coates, Suzanne Collins, and dozens of others. Finetuning on Murakami unlocked memorized content from authors he has nothing to do with. In some cases, the model reproduced over 80% of a completely unrelated book it had never seen during finetuning. The same result held when the researchers used Virginia Woolf’s public-domain novels as training data, but not when they used synthetic text. The conclusion is difficult to avoid: the books were already encoded in the weights from pretraining, and finetuning reactivated the retrieval pathway.

Why This Matters Beyond Copyright

The copyright implications are significant, and the paper’s legal section, co-authored by Columbia Law’s Jane Ginsburg, is worth reading carefully for practitioners in that space. But the trade secret implications deserve attention as well.

As noted above, courts evaluating fair use have looked at whether the AI models can reproduce copies of the ingested works. For example, the Bartz et al. v. Anthropic and Kadrey v. Meta decisions conditioned favorable fair use outcomes partly on the absence of evidence that models reproduce source works. See Bartz et al. v. Anthropic PBC, 787 F.Supp.3d 1007, 1018 (N.D. Cal. June 23, 2025), (“Authors do not allege that any infringing copy of their works was or would ever be provided to users by the Claude service . . . But Claude created no exact copy, nor any substantial knock-off. Nothing traceable to Authors’ works.”); Kadrey v. Meta Platforms, Inc., 788 F. Supp. 3d 1026, 1036 (N.D. Cal. 2025) (“They contend that Llama is capable of reproducing small snippets of text from their books.  . . . As explained below, both of these arguments are clear losers. Llama is not capable of generating enough text from the plaintiffs’ books to matter . . .”). This paper provides exactly that evidence, at scale and across multiple providers.

For trade secret practitioners, there are also significant implications.  For example, if an LLM ingested your client’s confidential documents, through a training pipeline, through employees using consumer AI tools, through any of the many ways proprietary information flows into these systems, this paper suggests that the information may not just be “learned from.” It may be stored in a form that can be retrieved by anyone else.

While the paper shows that aligned models don’t surface stored content under ordinary prompting, finetuning on a completely benign task, with no adversarial intent whatsoever, reactivated the LLMs’ latent memorization at an alarming scale. And the finetuning task the researchers used is commercially available and accessible through a standard API.

This creates at least two problems for trade secret owners. First, companies that rely on vendor assurances that “models don’t store data” as part of their reasonable measures argument may be resting on a factual premise this paper directly challenges. Second, what happens if a company finetunes a commercial model on its own proprietary data to build a specialized tool, and the finetuning reactivates memorized content from someone else’s confidential information that happened to be in the pretraining corpus of data? The researchers found that finetuning on one author’s work could unlock content from over thirty unrelated authors. There is no reason to believe that the same mechanism would not apply to confidential business information.

The Bottom Line

This paper raises more questions than it answers, with hugely important implications for both copyright and trade secret law. We will continue to monitor the dockets for new developments in this area as the research progresses.

Sarah Tishler is the author of this article. Sarah is a partner at Beck Reed Riden LLP. She is a commercial litigator whose practice focuses on complex business disputes in state and federal courts, including intellectual property, breach of contract, and fraud claims. Her experience also includes regulatory investigations, international arbitration, securities litigation, shareholder litigation, class-action litigation, and pre-transactional advising.

Imagine a pharmaceutical company that deploys a network of AI agents to accelerate early-stage drug discovery.

The agents work autonomously, analyzing biological datasets, running simulated trials, identifying molecular structures that human researchers had not considered.

After six months, the system surfaces a novel compound with significant therapeutic potential. No human directed it to find that compound.

No human understands, step by step, why the system arrived at it. The company’s scientists can observe the output and validate its promise. But the process that generated it, and the intermediate analytical steps the agents took to get there, exist only inside the model.

Now ask a deceptively simple question: who owns that discovery as a matter of trade secret law?

The answer is not obvious, and no court has yet supplied one. Patent law cannot help, at least not directly: the human inventorship requirement means any patent claim must trace back to a person who conceived the invention. Copyright is similarly unavailable for purely AI-generated outputs. What remains, and what is quietly emerging as the most important intellectual property framework for AI-generated innovation, is trade secret law.

Trade secret law is uniquely positioned to fill the AI ownership gap. Unlike patent and copyright, neither the Defend Trade Secrets Act nor the Uniform Trade Secrets Act (nor any case law at the time of this article’s publication) contains a human-creation requirement. An algorithm, a dataset, a molecular structure, or a process that derives economic value from not being generally known qualifies for protection if the holder takes reasonable measures to keep it secret, regardless of whether a human or an AI generated it. As scholars have begun to recognize, trade secrecy has become the default IP regime for AI-generated competitive intelligence, essentially by process of elimination. [Fn. 1]

That structural advantage comes with a set of unresolved questions about how ownership vests, the risks that attend using commercially available AI platforms to generate proprietary information, and the steps companies can take today to protect some of their most valuable IP. This post examines each of those questions in turn.

The statutory framework says almost nothing about who creates a trade secret

The DTSA, 18 U.S.C. § 1839(4), defines “owner” in a fairly circular manner: “the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed.” It does not explain how title is initially acquired, who vests it, or whether the owner must have created the information. The UTSA (adopted by 48 states and D.C.) — does not define “owner” at all; it uses the phrase “trade secret of another” in its misappropriation definition and leaves ownership to common-law principles.

Both statutes define a “trade secret” through two functional requirements: (1) the information derives independent economic value from not being generally known or readily ascertainable, and (2) the owner has taken reasonable measures to maintain secrecy. Neither statute requires human creation, registration, or even identification of the specific trade secret.

critical and underappreciated question is whether the owner must know what the trade secret is. The statutory answer is no (as argued by Professor John Villasenor in Artificial Intelligence, Trade Secrecy, and the Challenge of Transparency, 25 N.C. J.L. & Tech. 495, 509 (2024)). However, knowledge of what a trade secret actually is becomes essential at the enforcement stage. Courts require plaintiffs to describe alleged trade secrets with “sufficient particularity” to separate them from general knowledge. See, e.g., Oakwood Labs., LLC v. Thanoo, 999 F.3d 892 (3d Cir. 2021). The Eastern District of Texas rejected a plaintiff’s description of its trade secrets in T2 Modus LLC v. Williams-Arowolo, No. 4:22-CV-00263, 2023 WL 6221429, (E.D. Tex. Sept. 25, 2023), where the trade secrets were only described as “artificial intelligence,” “machine learning,” or “proprietary software.” The takeaway is that you can own a trade secret you don’t know about, but you cannot sue over one you cannot describe.

No court has decided who owns an AI-generated trade secret

As of the publication of this post, no reported case directly adjudicates ownership of a trade secret autonomously generated by an AI system. Neither the DTSA nor the UTSA contemplates non-human creators, but crucially, neither excludes them. 

Under current frameworks, the deploying user or company is the most likely owner under current frameworks. By analogy to the employer-employee relationship, the person or entity that deploys the AI, maintains the computing infrastructure, and takes reasonable measures to protect secrecy holds what the DTSA calls “rightful legal or equitable title.” 

he employee who prompted the AI generally would not own the output if standard employment agreements assign IP and confidential information rights to the employer. The AI vendor typically disclaims ownership of outputs under current terms of service (discussed below), but may retain rights to use inputs for model training — a fact with potentially devastating trade secret consequences for the unwary.

Given the statutory silence, contract law will be the primary mechanism for allocating AI-generated trade secret ownership. Professor John Sprankling’s Trade Secrets in the Artificial Intelligence Era, 76 S.C. L. Rev. 181 (2024), concludes that the AI system owner should own AI-generated trade secrets in order to “encourag[e] innovation for the benefit of the public,” but acknowledges the question is open.

The tool-versus-agent distinction matters practically even though current law does not formally address it. When AI functions as a tool (a human directs, evaluates, and selects outputs), ownership vests through the same mechanisms as any employee-created trade secret. When AI operates autonomously (e.g., a self-learning trading algorithm evolving its own strategies, a drug-discovery model identifying novel compounds) the human may not have directed the creative act and may not even know what the AI produced. Current law does not distinguish these scenarios doctrinally, but the degree of human involvement may affect the practical ability to satisfy “reasonable measures” and to identify trade secrets with “sufficient particularity” in litigation. [Fn. 2]

Vendor terms assign output ownership but create serious confidentiality risks

Every major AI platform assigns output ownership to the user. However, the details vary enormously, and the risks pertaining to trade secret protection are substantial.

Most platforms take a tiered approach that tracks the distinction between consumer and enterprise accounts. At the consumer tier, the default position across the industry is that inputs may be used for model training, typically with an opt-out mechanism that users must affirmatively invoke. At the enterprise tier, the standard commitment is the reverse: training on customer content is prohibited unless the customer explicitly agrees. Some platforms go further at the enterprise level, offering comprehensive IP indemnification that extends beyond copyright to cover trade secret, patent, and related claims.

The critical risk for businesses lies at the boundary between these tiers. Paid individual accounts (even premium ones) are frequently classified as consumer rather than commercial products, meaning the more protective enterprise terms do not apply. A company whose employees use individually-licensed accounts, even expensive ones, may find that its inputs are being used for model training under the default settings, with no enterprise-grade confidentiality protections in place. The trade secret implications are direct: if proprietary information input into a consumer-tier platform is incorporated into a model’s training data, that information may become accessible to other users — potentially rendering it “generally known” or “readily ascertainable” and destroying its trade secret status entirely. Samsung experienced this hazardous scenario firsthand in 2023 when three engineers input confidential source code into ChatGPT.  [Fn. 3]

January 2026 decision from the Northern District of California illustrates the stakes. In Trinidad v. OpenAI, Inc., No. 25-cv-06328-JST (N.D. Cal. Jan. 5, 2026), the court dismissed a pro se plaintiff’s DTSA claim on the ground that by developing her alleged trade secrets through ChatGPT, she had voluntarily disclosed them to OpenAI and could not satisfy the secrecy requirement. The court also rejected her argument that OpenAI’s Terms of Use (which assigned output ownership to the user) saved her claim, holding that ownership and secrecy are independent requirements: “for the trade secrets claim, like the copyright claim, it is not sufficient for [plaintiff] to establish ownership. Rather, she must show that the information misappropriated by OpenAI was ‘secret’ within the meaning of 18 U.S.C. § 1839(3).” Id. at 6–7. While the factual circumstances of Trinidad are unusual, the doctrinal point is broadly applicable: a vendor’s assignment of output ownership does not insulate a user from the argument that inputs shared with the platform were never secret to begin with.

Using enterprise-tier AI with contractual protections such as no-training commitments, confidentiality provisions, and data processing addenda, is far more defensible. This parallels sharing trade secrets with any third-party service provider under an NDA, which courts have long accepted as consistent with reasonable measures. But even enterprise tiers retain data temporarily for abuse monitoring (typically 30 days), and authorized vendor personnel may access content for limited purposes.

What companies should do right now

As described above, the law is unsettled, but the risk is immediate. More and more companies turn to using AI and agentic AI every day. There are at least seven concrete steps that companies using AI should consider taking:

• Use enterprise tiers exclusively for any work involving proprietary data. Consumer tiers at every major vendor carry material trade secret risks, and these policies can change with little notice. 
• Audit and update employment agreements to include explicit provisions addressing ownership of AI-generated outputs, assignment of AI-derived trade secrets, and restrictions on inputting confidential information into unauthorized AI tools.
• Negotiate AI vendor agreements to include no-training commitments, confidentiality obligations, data processing addendums, and appropriate data retention and deletion terms. Do not rely on default terms of service.
• Implement AI-use policies that specify which tools are authorized, what data can be input, and how outputs should be classified and protected. Samsung’s 2023 incident illustrates the cost of failing to do this.
• Apply systemic security measures (e.g., access controls, encryption, logging, and information classification) to AI-generated outputs, even those not individually identified as trade secrets. This supports the “reasonable measures” requirement for trade secrets the company may not yet know it possesses.
• Document human involvement in AI-assisted innovation to preserve patent and copyright eligibility where possible, while treating all AI-generated outputs as potential trade secrets.
• Monitor the “readily ascertainable” frontier. As AI tools become more powerful, information previously protectable may lose trade secret status. Regularly reassess whether competitive intelligence that was once difficult to compile is now obtainable through a single AI prompt.

Where to go from here

Several fundamental questions remain unresolved. No court has addressed who owns a trade secret generated autonomously by an AI agent. No legislation specifically addresses AI-generated trade secret ownership. The “readily ascertainable” standard has not been recalibrated for AI capabilities. The boundary between “reasonable measures” and the impracticability of protecting unknown information remains undefined. And the adequacy of contractual frameworks as the primary mechanism for allocating AI-generated trade secret rights has not been tested in litigation. The law will certainly need to catch up. For now, contract, policy, and proactive governance are the most reliable tools available.

Sarah Tishler is the author of this article. Sarah is a partner at Beck Reed Riden LLP. She is a commercial litigator whose practice focuses on complex business disputes in state and federal courts, including intellectual property, breach of contract, and fraud claims. Her experience also includes regulatory investigations, international arbitration, securities litigation, shareholder litigation, class-action litigation, and pre-transactional advising.