{"course":{"slug":"how-software-changed","title":"How Software Development Changed","url":"https://addaly.com/learn/how-software-changed","level":"intermediate","track":"work"},"lesson":{"slug":"licences-and-familiar-code","title":"When the output looks like something else","url":"https://addaly.com/learn/how-software-changed/licences-and-familiar-code","position":76,"of":87,"minutes":9,"answer":"Verbatim reproduction concentrates in distinctive, heavily duplicated fragments rather than ordinary application code, so the practical controls are duplication filters, similarity scanning before release, and never asking a model to reimplement a specific named project.","keyIdea":"Verbatim reproduction concentrates in distinctive, heavily duplicated fragments rather than ordinary application code, so the practical controls are duplication filters, similarity scanning before release, and never asking a model to reimplement a specific named project."},"body":{"format":"markdown","text":"## The mechanism of reproduction\n\nA model does not store files, but it can reproduce sequences it saw, and the probability is not uniform. Verbatim reproduction is likeliest when a sequence is **distinctive**, appeared **many times** in training, and is prompted with a **long matching prefix**.\n\nFor code that picks out a specific population: famous algorithm implementations, long configuration blocks copied identically across thousands of repositories, distinctive constants, and boilerplate headers. The canonical example is the fast inverse square root from the Quake III source, with its magic constant `0x5f3759df` and its memorable comment, a short, distinctive, endlessly copied fragment, which is exactly the profile that gets reproduced.\n\nWhat this is *not*: ordinary application code. The typical generated function is a recombination, not a copy. The risk is concentrated, not diffuse, and treating every line as suspect is both wrong and unmanageable.\n\n## Why the licence matters commercially\n\nPublic code is not free of conditions. Two families behave very differently if a fragment lands in your product.\n\n**Permissive** (MIT, BSD, Apache 2.0) require attribution and a licence notice. Keeping the notice is easy; the common failure is not knowing there was one to keep.\n\n**Copyleft** (GPL, and AGPL especially) condition redistribution on releasing the combined work under the same terms. AGPL extends that trigger to network use, which is what makes it consequential for a hosted product. If copyleft-licensed code is incorporated into proprietary software, the exposure is not a fine, it is an argument about whether your whole product must be released. That is why legal teams care about this specific case far more than about attribution.\n\n## The controls that exist\n\n**Duplication filters.** Several assistants offer a setting that suppresses suggestions matching public code above a threshold: around 150 characters in the best-known implementation. Turn it on. Understand precisely what it gives you: it compares against an index of public code, so it says nothing about private code, nothing about code outside the index, and it is a similarity check rather than a legal conclusion.\n\n**Similarity scanning on what you ship.** ScanCode Toolkit and FOSSology are free and open source and detect licence text and known code fragments in a codebase. Run one before a release, not on every commit; it is slow and the findings need a human.\n\n**Keep licence notices you did receive.** If a dependency's licence requires attribution, generate the notice file as part of the build so it cannot be forgotten.\n\n**Do not paste proprietary code into a consumer tier.** Two directions of the same problem: yours going out, and somebody else's coming in.\n\n## Indemnities, and what they actually cover\n\nSeveral vendors offer to defend customers against copyright claims arising from their output. These are real and they are narrow. Typical conditions include: the relevant filter must have been enabled, you must not have prompted the model to reproduce a specific work, you must notify promptly and let them control the defence, and coverage may exclude cases where you modified the output.\n\nRead the actual clause. An indemnity described in a keynote and an indemnity in a contract are different documents, and the second one is the one that pays.\n\n## What to tell your organisation\n\nA short, honest position that survives contact with both engineers and lawyers:\n\n1. Enable duplication filtering everywhere, and record that you did.\n2. Scan releases for licence text and known fragments; act on findings.\n3. Do not use assistants to reimplement a specific identified project. \"Make this like the X library\" is the prompt most likely to produce something recognisable, and it is the least defensible if it does.\n4. Keep an inventory, so that if a question arrives you can answer it rather than investigate for a month.\n5. Get a lawyer in your jurisdiction for anything beyond that.\n\n## The part that is unsettled\n\nWhether a model's output can be a derivative work of its training data is not resolved. Whether training itself is permitted is not resolved. Both differ by country and are being litigated now. The next lesson lays out the shape of the disagreement without resolving it, because it is not resolvable from here.\n\nWhat can be said cleanly: these questions are about the licence and copyright status of *code*, which is a question your organisation has always had and has always had a process for. The volume changed. The category did not, and the people who handle software licensing in your organisation are the people to involve."},"check":{"question":"Why does the risk of verbatim reproduction concentrate in fragments like a famous algorithm rather than spreading evenly across generated code?","options":[{"text":"Such fragments are distinctive and appeared many times identically, which is what gets reproduced.","correct":true},{"text":"Famous algorithms are mathematically constrained, so any correct implementation looks nearly identical anyway.","correct":false,"tempting":"Describes convergent implementation, which is a real phenomenon but a different one from reproduction from training data."},{"text":"Models weight older training data more heavily, and classic algorithms predate most application code.","correct":false,"tempting":"Invents a recency weighting that does not describe how these models are trained."},{"text":"Well-known code is more likely to carry a licence header, which makes reproduction easier to notice.","correct":false,"tempting":"Confuses how detectable a reproduction is with how likely it is to occur."}]},"prev":{"slug":"provenance-and-inventory","title":"Knowing what you actually shipped","url":"https://addaly.com/learn/how-software-changed/provenance-and-inventory"},"next":{"slug":"copyright-and-training-unresolved","title":"The disagreement, laid out without a verdict","url":"https://addaly.com/learn/how-software-changed/copyright-and-training-unresolved"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'When the output looks like something else', in How Software Development Changed. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/how-software-changed/licences-and-familiar-code (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"When the output looks like something else","courseTitle":"How Software Development Changed","module":{"index":8,"slug":"provenance-security-and-law","title":"Provenance, security and the unsettled law"},"answer":null,"keyIdea":"Verbatim reproduction concentrates in distinctive, heavily duplicated fragments rather than ordinary application code, so the practical controls are duplication filters, similarity scanning before release, and never asking a model to reimplement a specific named project.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-mechanism-of-reproduction","runs":[{"text":"The mechanism of reproduction"}]},{"t":"p","runs":[{"text":"A model does not store files, but it can reproduce sequences it saw, and the probability is not uniform. Verbatim reproduction is likeliest when a sequence is "},{"text":"distinctive","b":true},{"text":", appeared "},{"text":"many times","b":true},{"text":" in training, and is prompted with a "},{"text":"long matching prefix","b":true},{"text":"."}]},{"t":"p","runs":[{"text":"For code that picks out a specific population: famous algorithm implementations, long configuration blocks copied identically across thousands of repositories, distinctive constants, and boilerplate headers. The canonical example is the fast inverse square root from the Quake III source, with its magic constant "},{"text":"0x5f3759df","code":true},{"text":" and its memorable comment, a short, distinctive, endlessly copied fragment, which is exactly the profile that gets reproduced."}]},{"t":"p","runs":[{"text":"What this is "},{"text":"not","i":true},{"text":": ordinary application code. The typical generated function is a recombination, not a copy. The risk is concentrated, not diffuse, and treating every line as suspect is both wrong and unmanageable."}]},{"t":"h2","id":"why-the-licence-matters-commercially","runs":[{"text":"Why the licence matters commercially"}]},{"t":"p","runs":[{"text":"Public code is not free of conditions. Two families behave very differently if a fragment lands in your product."}]},{"t":"p","runs":[{"text":"Permissive","b":true},{"text":" (MIT, BSD, Apache 2.0) require attribution and a licence notice. Keeping the notice is easy; the common failure is not knowing there was one to keep."}]},{"t":"p","runs":[{"text":"Copyleft","b":true},{"text":" (GPL, and AGPL especially) condition redistribution on releasing the combined work under the same terms. AGPL extends that trigger to network use, which is what makes it consequential for a hosted product. If copyleft-licensed code is incorporated into proprietary software, the exposure is not a fine, it is an argument about whether your whole product must be released. That is why legal teams care about this specific case far more than about attribution."}]},{"t":"h2","id":"the-controls-that-exist","runs":[{"text":"The controls that exist"}]},{"t":"p","runs":[{"text":"Duplication filters.","b":true},{"text":" Several assistants offer a setting that suppresses suggestions matching public code above a threshold: around 150 characters in the best-known implementation. Turn it on. Understand precisely what it gives you: it compares against an index of public code, so it says nothing about private code, nothing about code outside the index, and it is a similarity check rather than a legal conclusion."}]},{"t":"p","runs":[{"text":"Similarity scanning on what you ship.","b":true},{"text":" ScanCode Toolkit and FOSSology are free and open source and detect licence text and known code fragments in a codebase. Run one before a release, not on every commit; it is slow and the findings need a human."}]},{"t":"p","runs":[{"text":"Keep licence notices you did receive.","b":true},{"text":" If a dependency’s licence requires attribution, generate the notice file as part of the build so it cannot be forgotten."}]},{"t":"p","runs":[{"text":"Do not paste proprietary code into a consumer tier.","b":true},{"text":" Two directions of the same problem: yours going out, and somebody else’s coming in."}]},{"t":"h2","id":"indemnities-and-what-they-actually-cover","runs":[{"text":"Indemnities, and what they actually cover"}]},{"t":"p","runs":[{"text":"Several vendors offer to defend customers against copyright claims arising from their output. These are real and they are narrow. Typical conditions include: the relevant filter must have been enabled, you must not have prompted the model to reproduce a specific work, you must notify promptly and let them control the defence, and coverage may exclude cases where you modified the output."}]},{"t":"p","runs":[{"text":"Read the actual clause. An indemnity described in a keynote and an indemnity in a contract are different documents, and the second one is the one that pays."}]},{"t":"h2","id":"what-to-tell-your-organisation","runs":[{"text":"What to tell your organisation"}]},{"t":"p","runs":[{"text":"A short, honest position that survives contact with both engineers and lawyers:"}]},{"t":"ol","start":1,"items":[[{"text":"Enable duplication filtering everywhere, and record that you did."}],[{"text":"Scan releases for licence text and known fragments; act on findings."}],[{"text":"Do not use assistants to reimplement a specific identified project. “Make this like the X library” is the prompt most likely to produce something recognisable, and it is the least defensible if it does."}],[{"text":"Keep an inventory, so that if a question arrives you can answer it rather than investigate for a month."}],[{"text":"Get a lawyer in your jurisdiction for anything beyond that."}]]},{"t":"h2","id":"the-part-that-is-unsettled","runs":[{"text":"The part that is unsettled"}]},{"t":"p","runs":[{"text":"Whether a model’s output can be a derivative work of its training data is not resolved. Whether training itself is permitted is not resolved. Both differ by country and are being litigated now. The next lesson lays out the shape of the disagreement without resolving it, because it is not resolvable from here."}]},{"t":"p","runs":[{"text":"What can be said cleanly: these questions are about the licence and copyright status of "},{"text":"code","i":true},{"text":", which is a question your organisation has always had and has always had a process for. The volume changed. The category did not, and the people who handle software licensing in your organisation are the people to involve."}]}],"check":{"question":[{"text":"Why does the risk of verbatim reproduction concentrate in fragments like a famous algorithm rather than spreading evenly across generated code?"}],"options":[{"text":[{"text":"Such fragments are distinctive and appeared many times identically, which is what gets reproduced."}],"correct":true,"tempting":null},{"text":[{"text":"Famous algorithms are mathematically constrained, so any correct implementation looks nearly identical anyway."}],"correct":false,"tempting":[{"text":"Describes convergent implementation, which is a real phenomenon but a different one from reproduction from training data."}]},{"text":[{"text":"Models weight older training data more heavily, and classic algorithms predate most application code."}],"correct":false,"tempting":[{"text":"Invents a recency weighting that does not describe how these models are trained."}]},{"text":[{"text":"Well-known code is more likely to carry a licence header, which makes reproduction easier to notice."}],"correct":false,"tempting":[{"text":"Confuses how detectable a reproduction is with how likely it is to occur."}]}],"order":[3,1,2,0],"why":null},"prev":{"slug":"provenance-and-inventory","title":"Knowing what you actually shipped","minutes":9},"next":{"slug":"copyright-and-training-unresolved","title":"The disagreement, laid out without a verdict","minutes":10}}}