Scope — what this answers, and what it does not
This specification defines infrastructure that answers two questions. First: was this particular work present in the training corpus of this particular model? Second: if so, how is that use recorded and remunerated?
The first question is designed to be answerable without the operator disclosing any part of its corpus. The second follows from the first.
They want an answer about one work they already hold.
That question can be answered without disclosure.
Out of scope
Stating the boundaries first is deliberate. A specification that overstates its reach is harder to evaluate than one that does not.
| Excluded | Reason |
|---|---|
| Defining a content identifier | ISO 24138:2024 (ISCC) already does this. This specification uses it unmodified. |
| Determining lawfulness | A question for each jurisdiction. This layer records facts, not entitlements. |
| Requiring corpus disclosure | Disclosure is the problem this specification exists to avoid. |
| Analogue transmission | Content identity does not survive acoustic transmission. Acoustic fingerprinting addresses that domain — complementary, not competing. |
| Live performance | No digital object exists to identify. |
| Replacing judicial process | Attestations are evidence, not adjudication. |
Terms
Operator — a party that assembles a corpus of content for training a model. Registrant — a rightsholder who has registered a work. Attestation — a signed statement by an operator that a queried work was, or was not, present in a specified corpus epoch. Corpus epoch — a named, immutable snapshot of a corpus at a point in time.
Design principles
not disclosure
do not price
existing standards
agility
Architecture — five layers
The boundary between layers 2 and 3 is significant. Layers 1 and 2 can be implemented on existing standards and existing public registries. Layers 3 through 5 require new agreements — but not, in the first instance, new law.
Layer 1 — Registration
To create a durable, verifiable record that a specified party claimed a specified work at a specified time, and to declare that party's position on machine learning use.
Registration is voluntary. It does not create rights, and its absence does not diminish them. This preserves compatibility with the Berne Convention's prohibition on formalities: registration here is an evidentiary and operational convenience, never a condition of protection.
Record structure
| Field | Content |
|---|---|
iscc | ISCC-CODE per ISO 24138:2024 (composite) |
instance | Instance-Code — exact data identity |
content | Content-Code — perceptual similarity |
claimant | Commitment to registrant identity; identity held off-chain |
policy | Machine-readable position on ML training use |
alg | Explicit algorithm identifiers (see Section 8) |
sig | Signature over the above |
On-chain and off-chain
Only hashes and commitments are anchored. Names, addresses and payment instructions reside off-chain in encrypted storage. This resolves an otherwise genuine conflict between immutability and the right to erasure: personal data can be deleted without disturbing the anchored record, because the anchored record never contained it.
Policy declaration
A machine-readable field expressing the registrant's position on machine learning use — at minimum: permitted, not permitted, conditional.
The significance of this field is that it converts an intention into something an automated collection process can read at the moment it identifies a work. A policy that must be looked up by a human is a policy that is not consulted. Whether such a declaration carries legal effect is a matter for each jurisdiction; this layer records it and does not enforce it.
Layer 2 — Matching
A querent submits an ISCC-CODE together with proof of registration. The operator returns a signed attestation naming a verdict — present, absent, or indeterminate — the corpus epoch concerned, the matched unit type, the distance where applicable, and a proof.
Exact and near matching
Matching on the Instance-Code answers: was this byte-identical object in the corpus? Matching on the Content-Code, against a declared distance threshold, answers: was an object perceptually equivalent to this one in the corpus?
Near matching is not an enhancement; it is a necessity. Training pipelines resize images, re-encode audio, and normalise text. An exact-match-only system returns absent for works that were in fact ingested, and does so systematically rather than randomly. ISO 24138's Content-Code is designed for precisely this condition: the same content yields the same code after re-encoding or compression.
Properties
| Property | Mechanism |
|---|---|
| Non-disclosure | The operator publishes a root and answers closed questions. No member list, no collection methodology, no architectural detail is exposed. |
| Non-exploration | A querent can only ask about codes it can produce, and codes are produced from content. Speculative enumeration is not possible. |
| Bounded cost | A query is an indexed lookup with a proof extraction. Marginal cost does not grow with query volume — unlike disclosure regimes, whose burden scales with request count. |
| Non-adjudication | An attestation records membership. It does not determine lawfulness, licence status, or amounts owed. |
Corpus epochs
An operator declares corpus epochs: named, immutable snapshots. Every attestation names the epoch it concerns. Without epochs, "was it in the corpus" is not a well-formed question, because corpora change continuously. With them, attestations are reproducible: a second query against the same epoch must return the same verdict.
Layer 5 — Audit
Everything above assumes the operator answers honestly. That assumption cannot be made.
Self-reporting under financial pressure is not transparency.
Commitment
Before an epoch is used for training, the operator computes a Merkle tree over the ISCC-CODEs of all corpus members and publishes the root, following the RFC 6962 construction already used by ISCC transparency logs.
The root discloses nothing. It is a fixed-length value from which no member can be recovered. But it binds. Once published and timestamped, the operator cannot alter what the corpus contained without producing an inconsistent checkpoint.
One structural change: sorting
Members are committed as a sorted Merkle tree rather than an append-ordered one. This is the sole structural departure from existing transparency-log practice, and it is the substantive contribution of this specification.
A sorted tree admits non-membership proofs: absence of a code is proved by exhibiting the two adjacent leaves that bracket the queried position. An append-ordered log cannot do this.
Why sorting matters more than it appears
Under an unsorted commitment, present is provable and absent is not. That leaves unconstrained precisely the verdict an operator has a financial incentive to falsify. The asymmetry is not incidental — it is the whole security question.
What this achieves, and what it does not
A dishonest absent verdict remains possible but becomes detectable and permanent. If the work is later shown to have been present in the committed epoch — by discovery in litigation or any other means — the false attestation is signed, timestamped, and undeniable.
The design goal is not to make dishonesty impossible. It is to make dishonesty carry a durable, attributable record.
Layer 3 — Accounting
The countable unit is the inclusion-epoch: one registered work, verified present in one committed corpus epoch. It is countable because it is a set-membership fact, verified by Layer 2 and bound by Layer 5.
What is deliberately not counted
Contribution weight — the degree to which a work influenced a model's outputs — is not counted in this version. No accepted method exists for measuring it at scale; influence-function approaches remain computationally impractical for production models. A specification requiring contribution weighting would be unimplementable, and would therefore produce no distribution at all.
This is a real limitation. Within an epoch, a work referenced once and a work of decisive influence are treated alike.
It is, however, an improvement on the present alternative. Litigation settlements have distributed uniform per-work amounts across hundreds of thousands of works — the same coarseness, reached at far greater cost and only retrospectively. A coarse measure applied continuously is more useful than a coarse measure imposed once by a court.
Design for later refinement
The accounting record carries a weight field, defaulting to 1. When contribution measurement becomes practicable, weights may be populated without altering the record structure, the query protocol, or the settlement mechanism.
The intended sequence is coarse distribution that works, then refinement — not refinement that does not exist, therefore no distribution.
Division, not pricing
An operator's obligation for an epoch is a pool; the pool is divided across inclusion-epochs. This decouples the total from the per-work amount, so the number of registered works can grow without either bankrupting operators or requiring per-work negotiation.
How pool size is determined — a fixed sum, a revenue share, a negotiated rate, a statutory levy — is outside this specification, deliberately. The unit is portable across all of them.
Post-quantum migration
Hash preimage resistance degrades quadratically under quantum search — a loss of strength restored by digest length. Signatures do not degrade gracefully; the loss there is total rather than partial. The exposure is therefore in attribution, not in identification.
Why this domain is unusual
Most systems that anchor data cryptographically need their anchors to hold for years. Financial records lose operational significance quickly; most contracts have finite terms.
Copyright does not. A term of life plus seventy years means a work registered by a young author today may require verification beyond 2150.
of any commonly deployed cryptographic application.
This is not usually noticed, and it changes the design requirement.
Requirements
| Requirement | Detail |
|---|---|
| Algorithm identifiers | Every record carries explicit identifiers for its hash and signature algorithms. No algorithm is implicit. |
| Dual signature | Records may carry both classical and post-quantum signatures during a declared transition window. |
| Re-anchoring | A procedure re-signing an existing record under a new algorithm, preserving the original timestamp by reference to the prior anchor. Migration must not require action by the registrant, who may be deceased. |
| Deprecation | A published mechanism declaring an algorithm unacceptable for new records while remaining acceptable for verifying old ones. |
NIST completed standardisation of post-quantum algorithms in 2024. This specification does not select among them. It requires that the selection be replaceable.
Legal neutrality
This layer is designed to function without modification under each of the principal approaches to text and data mining.
| Regime | Interaction |
|---|---|
| Broad statutory exception (e.g. Japan, Art. 30-4) | Unaffected. Training remains permitted. This layer adds a remuneration path alongside the permission; it does not narrow the exception. |
| Opt-out exception (e.g. EU DSM Art. 4) | The policy declaration provides a machine-readable expression of reservation. |
| Fair use (e.g. United States) | Unaffected. Attestations may serve as evidence in the factual inquiry without determining its outcome. |
| Licence-based | Attestations provide the usage measurement that per-use licensing requires. |
not what is permitted.
It adds no prohibition.
This is the argument for its portability. A mechanism that requires a jurisdiction to change its position on permission will be adopted only where that position was already changing. A mechanism that leaves the permission question untouched can be adopted anywhere.
Relationship to existing standards
Open questions
Listed for discussion rather than resolved here.
| Question | Nature |
|---|---|
| Content-Code collision semantics | What confidence statement should an attestation carry when the matched unit is similarity-preserving? |
| Query privacy against enumeration | Non-membership proofs reveal bracketing neighbours. Repeated queries could enumerate portions of the code space. Whether such proofs can be blinded without losing verifiability is unresolved. |
| Epoch granularity | Continual training pipelines have no natural epoch boundary. How frequently should an operator commit? |
| Cross-operator aggregation | Should inclusion-epochs from multiple operators be aggregated, and by whom? |
| Commitment completeness | Are there attestation designs that constrain omission, rather than only recording it? |
A working prototype
The debate has been about how much to disclose.
It need not be a disclosure question at all.
A rightsholder wants an answer about one work. An operator wants to protect its methodology. Both are satisfied by a closed query bound to a prior commitment — and once membership can be verified, remuneration proportional to use follows without any new prohibition.