Module 10 — Copyright, provenance and responsible use
The previous nine modules were about how to make a generative model work. This one is about what to do — and what not to do — with it. The face-generation thread of the course stops here on a hard question: the faces we produced in modules 6 and 7 do not correspond to any single real person, but they were trained on photographs of real people who never consented. What follows is an engineer's tour of the questions that decide whether a generative system can be published, at what cost, and to whom.
What was in the training data, and does it matter
Every large generative model of 2026 was trained on datasets scraped from the public web. LAION-5B for images, Common Crawl for text, YouTube subtitles and TED talks and podcast archives for audio. The scale is such that no human curator has read the whole thing. The training data therefore contains:
- Photographs of identifiable individuals published without their explicit consent to AI training
- Copyrighted works, from newspaper articles to novels to painters' portfolios
- Personal data in the sense of European law: names, addresses, medical mentions, that appeared once on a public web page
- Synthetic data generated by previous models, blurring the original human authorship trail
The question of whether the resulting model is a derivative work of every training example remains legally unresolved in most jurisdictions. Class actions and case law are producing decisions in 2024, 2025 and 2026 that do not converge on a single answer, and the situation shifts by the quarter.
The pragmatic implication for a developer: you do not know what is in your model, and the model may reproduce fragments of its training data verbatim under some prompts. Both stability and diffusion research groups have documented memorisation of specific training images in Stable Diffusion, prompted retrieval of copyrighted textbook pages from GPT-class models, and near-verbatim recall of song lyrics from music models. Assume this can happen. Test for it.
Watermarking and C2PA: the provenance stack
The industry response to the "did a human or a machine produce this?" question is cryptographic provenance. Two complementary layers exist.
Invisible watermarks embedded in the output. Google's SynthID and Meta's Stable Signature encode a signal at generation time that is imperceptible to humans but detectable by a paired classifier. The watermark survives common transformations — cropping, resizing, moderate compression — and is a probabilistic detection: a matched detector returns a confidence, not a binary answer.
Signed provenance metadata via C2PA. The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for attaching a cryptographically signed record of an asset's origin: which tool produced it, when, and what edits were applied. A photograph shot on a compliant camera is signed at capture; a subsequent edit in a compliant tool re-signs the manifest. A generated image is signed by the generator with a "produced by AI" claim.
The two layers address different threats. Watermarking survives loss of metadata, since it lives inside the pixels. C2PA carries rich provenance and human-readable information, since it lives beside the pixels.
# Illustrative: reading a C2PA manifest attached to an image file
from c2pa import Reader # `pip install c2pa-python`
with open("generated.jpg", "rb") as f:
manifest = Reader.from_stream("image/jpeg", f)
# Manifest fields: signer, timestamp, generator name, edits, provenance chain
print(manifest.json())
Neither watermarking nor C2PA is foolproof. A determined adversary can strip C2PA metadata by re-encoding the file, and repeated adversarial editing degrades most watermarks. Both are effective against casual misuse and lawful platforms, not against motivated attackers. Regulators of 2026 are increasingly requiring at least one of the two on generative outputs served to the public.
A SynthID detection score of 0.98 says the image looks watermarked. A detection score of 0.15 says the image does not look watermarked, which does not prove a human made it: it could be a machine output that lost the watermark to heavy compression, or a machine output from a system that never applied one. Provenance stacks are designed for the average case, not for adversarial proof.
Deepfakes and personal likeness
The face-generation thread of modules 6 and 7 raises a direct question: if a diffusion model can produce a photorealistic face, it can also produce a specific person's face with the right conditioning. The technology to do this — face swapping, voice cloning, video puppetry — is now widely available at consumer level.
The harms are concrete and documented:
- Non-consensual intimate imagery, a category dominated by generated content since 2023
- Political deception, from fabricated videos of candidates to cloned voice phishing
- Identity fraud, where a cloned voice defeats a voice-biometric authentication
- Blackmail and reputational attacks
Multiple jurisdictions have introduced criminal offences for deepfake production and distribution. The Deepfakes Accountability Act in the United States, the AI Act's Article 50 in the European Union, similar frameworks in the United Kingdom, Canada, South Korea and Australia — all of them converge on a small set of obligations: disclose when content is generated, label output visibly, provide a takedown mechanism, do not generate the likeness of an identifiable person without consent.
Consent of the represented persons
Before publishing any system that generates faces, ask three questions.
Whose face was in the training data? For CelebA and its descendants, the answer is "celebrities who never signed an AI-training release". CelebA-HQ was published in 2015; most of its subjects had no idea their photograph would train generative models in 2020 onwards.
Can a specific person's face be produced from the model? Test it. Try prompts that include the name of a well-known person and see whether recognisable outputs come back. Empirically, most face-generation models can produce recognisable faces of major celebrities and cannot produce recognisable faces of ordinary people — which is a matter of what was well-represented in the training data, not of the model's design.
What happens if a real person recognises their likeness in an output? Have a takedown process ready before shipping, not after the first complaint. Include a stable contact channel and a documented decision protocol.
Regulation applicable to a public-facing system
The AI Act, in force since 2024 in the European Union, classifies generative systems that produce synthetic content as subject to specific obligations under Article 50. The main points that matter for a platform serving European users:
- Machine-readable marking: outputs must carry a marking indicating they are AI-generated (watermark, metadata, or C2PA), unless they are for pure editorial assistance under specific conditions.
- User-facing disclosure: users interacting with a generative system must be informed that they are dealing with an AI system, unless the fact is obvious.
- Deepfake labelling: content that convincingly resembles a real person, place or event must be labelled as artificially generated or manipulated.
- Risk management: general-purpose AI models with systemic risk (a threshold set at training FLOPs) have documentation, red-teaming and incident-reporting obligations.
Other jurisdictions have similar patterns with different thresholds. The pragmatic guidance is to design for the strictest applicable regime and treat compliance as a product feature, not an afterthought.
Adding watermarking and C2PA support at generation time is a hundred times cheaper than retrofitting them into a shipped product. Every image, audio and video output should leave the generator with a marking and a signed manifest, from the first internal test. Removing them is easy; adding them is a design change.
What the courses on top of this one will assume
Course 27 on Stable Diffusion, course 31 on multimodal systems, and course 34 on audio generation build directly on the material of this course. They assume you know how a diffusion model samples, why FID is not enough, and — the point of this module — that any system you ship publicly will operate under a legal and social regime that treats generation as a category on its own.
Treating that regime as a set of constraints to satisfy at the end of the project is a common mistake and a costly one. The developer who builds provenance, consent tests and deepfake safeguards into the training and evaluation pipeline pays a small fixed cost. The developer who does not pays a much larger variable cost at the first incident.
In summary
- Every large generative model of 2026 trained on scraped data whose legal status is unresolved; memorisation of training examples is documented, and you should test for it on your own model.
- Watermarking (invisible, in the pixels) and C2PA (signed provenance metadata) are complementary provenance layers; neither is foolproof, both are increasingly required.
- Deepfakes have driven concrete criminal legislation in multiple jurisdictions, converging on disclosure, labelling, non-consensual likeness prohibition and takedown obligations.
- Design for the strictest applicable regime — the AI Act's Article 50 is a reasonable baseline — and bake provenance, consent tests and safeguards into the pipeline, not into a compliance patch at the end.
Next module: the recap of what we built across the course, the head-to-head table of VAE, GAN and diffusion, and the announcement of the 40-question exam.