Sometime in the next few months, Anthropic is supposed to send me a check. Around $9,000 for me, about the same for my longtime coauthor Jenny Greene, and roughly $18,000 for O’Reilly, our publisher. The reason is that pirated copies of the books Jenny and I wrote, along with a huge amount of other people’s work, got swept into the data used to train Claude, and a court settlement is now paying authors and publishers whose work was taken that way. It works out to a little over $3,000 for each of our books, split between all of us, and every edition is counted separately, no matter how the book sold or what was in it. (Assuming the money ever shows up. The settlement won final court approval in July 2026, but a payout this size grinds through a long administrative process, so we’ll see if the check ever actually arrives.)
I don’t especially care about the check. (Okay, that’s not true, nine grand is a lot of money, but hopefully you’ll get my point.) Jenny and I didn’t write those books to get rich, and nobody who’s met a working author would mistake the job for a path to wealth. But one thing I very much care about, and I suspect almost all authors would agree, is getting credit for the work I’ve done. If you ask ChatGPT, Claude, or Gemini (or especially Google AI overviews) a question that it partly learned to answer from one of my books, I would love for it to be able to say so. Something like “Some of this comes from Andrew Stellman’s work, and if you want to go deeper, that’s where to look.” In other words, what I’m asking for is a hat tip.
All of this sits inside a much bigger question, one that usually goes by the name attribution. In the broadest terms, attribution means knowing where a piece of work or knowledge came from, and being able to trace it back to the person who made it. That might sound like a narrow, technical matter, but right now it’s one of the biggest live questions in AI. At Foo Camp recently, it came up constantly, quite possibly the most talked-about topic of the whole weekend, and everyone there seemed to have something to say about it. It’s also a tangled subject, part technical and part legal, and more than either of those, deeply emotional. I want to take a little time to pull those threads apart.
Why so many people are angry
Before any of the technical or legal questions, there’s a simpler reason attribution is such a live wire right now: People are angry, and to be perfectly honest, they have good reason to be. Artists have watched models learn to imitate their style from work that got scraped without anyone asking. Writers have found their books sitting in training sets we never agreed to (even though that’s not the reason Anthropic has to pay us). A lot of people are simply afraid that the work they do for a living is about to be done by a machine that learned part of the job from them. Their work got taken, which may be fair use but almost never included asking the author for permission, and often without any way to even find out it happened. And that for many of us feels really uncomfortable.
A lot of that anger ends up funneled into legalistic arguments about copyright, which is notoriously misunderstood and misapplied. People reach for it for understandable reasons. It feels tangible in a way the rest of this doesn’t, and while many of us feel like it was written to protect authors and artists and creators, it’s actually much more nuanced, especially when it comes to fair use. But I don’t think copyright is the right move for anyone who actually wants attribution, and I’ll go further: I think creators will get a lot more mileage working with the AI labs than fighting them in court.
Underneath all of it, what most of us want is simple enough: We want the work to still be ours, and we want that to be visible. That’s an attribution problem. And before anyone can argue about whether AI can solve it, it helps to be clear about what attribution even is, because it’s a slipperier word than it looks.
What attribution actually is
At its simplest, attribution is the link between something and where it came from. When you read a fact in a book, there’s a chain running from that sentence back to the author, and back again to whatever they drew on. That chain is how credit works, and how trust works, and how you know what to go read next when something grabs you. For as long as people have made things, you could usually follow it back to a person.
You see attribution everywhere once you start noticing it. Bibliographies and references are attribution. So is every footnote on a Wikipedia page, and so is every time one news story credits another, the way you’ll read that “Business Insider is reporting” something before another site passes it along (that is, when we remember to do it). For authors it runs deeper than that: Attribution underpins almost everything we do, and the whole system of academic publishing rests on it, because the entire point is to show exactly whose work each new piece is built on.
AI is the first technology that takes in essentially all of it, every book and article and repository it can reach, and hands back answers with the chain erased. And while that may be technically allowed under fair use, it shouldn’t be the end of the discussion. The knowledge comes out; the line back to whoever produced it does not. That erasure, underneath the lawsuits, is what people are really reacting to. The model learned from their work and gives no sign of it, and the trail that used to lead back to them is gone. Attribution is just the name for putting that thread back.
The catch is that people use the word for at least three pretty different things. The cheap version, the one people reach for first, is resemblance: Does the answer look like my work? That’s easy to check and mostly beside the point, because two people can write nearly the same sentence about a for-loop without either one copying the other. What actual products ship is citation, the little source links under a chatbot’s answer, which credit the page the system fetched while it was answering, not the books it learned from years earlier. Those links are the result of retrieval, not memory, where the system went out and fetched a live page mid-answer. There aren’t any technical challenges in adding an attribution for those live retrieval results, and the fact that the AI labs are fine with that attribution gives them a template to follow if model-based attribution becomes technically feasible.
We’ve got a really good real-world example of how this can work. O’Reilly’s learning platform has an AI engine that answers questions out of the books on the platform, tells you which ones it drew on, and pays the authors and publishers behind them. It works because the corpus is small and everything in it is licensed, which is precisely the condition the frontier models don’t have. Because the version that actually matters is the third one, causal: Did my work shape the part of the model that produced this answer? That’s the honest meaning of the word, and by far the hardest to compute.
Notice that none of that is about money. Paying me would mean working out what a given answer is worth and what share of it is mine, which is a hard allocation problem nobody has really solved (and, to be honest, probably works out to a tiny fraction of a cent in any given answer). Attribution asks a smaller question: Did this come from my work, or didn’t it? A hat tip is only that identification, not necessarily a required payment, and it’s still the thing everyone tells you is impossible.
Trying it on a tiny model
I may be an author, but I’m a developer too, and when someone tells us something is impossible, our first urge is always to build that thing. A lot of the time “impossible” just means nobody has worked out how yet, and every so often it means it would be inconvenient for someone if they did. In this case, some really smart people actually have worked out how, at least some important parts of it, and it’s worth understanding both why the problem is hard and how they’re tackling it.
Start with why it’s hard. When a model trains on your book, it doesn’t file the book away somewhere you can later point to, because models are not databases of books and other source material. What it learns gets spread across billions of numbers, tangled up with everything else it ever read, and no single weight says, “This part came from Stellman.” There’s no receipt anywhere that records which source contributed what. The obvious way to check whether your book mattered would be to pull it out, train the model over again, and see what changed, but nobody is going to retrain a frontier model from scratch a billion times. The upshot is that the knowledge is still in there, it’s just smeared across the whole model with no index back to where it came from, and that’s why a lot of people have called attribution impossible.
It may not be quite as impossible as it seems from that particular approach, though.
Researchers have been chipping away at exactly this, and the approaches run from cheap and rough to expensive and precise. At the precise end is leave-one-out: remove a source, retrain, and measure how far the answer falls. It’s about as close to ground truth as you can get, and hopeless at scale for the reason I just gave. The interesting work is on cheaper stand-ins that approximate that result without all that retraining. The one I find most compelling is TracIn, described by four Google researchers in 2020 in “Estimating Training Data Influence by Tracing Gradient Descent”: As the model trains, it saves snapshots of itself, and TracIn measures how much each training example pushed the model toward a given answer by comparing gradients at those snapshots, with no retraining required.
It belongs to a broader family. Influence functions, which Pang Wei Koh and Percy Liang introduced in 2017 in “Understanding Black-Box Predictions via Influence Functions,” are the older, heavier cousin, and Anthropic scaled them up to models with tens of billions of parameters in a 2023 paper, “Studying Large Language Model Generalization with Influence Functions.” A newer method, TRAK from MIT’s Madry Lab, takes on a weakness they share, where near-duplicate sources muddy the accounting. None of it is settled, and TracIn in particular is contested at frontier scale, but the direction is real and the people pushing it have far bigger budgets than mine.
So I wanted to see it work with my own eyes. I asked an AI to build me the smallest real language model that could still run one of these methods, and about 20 minutes later I had a working one, which I called tiny-provenance: a language model small enough, around 37,000 parameters, that I can retrain it from scratch in a few seconds. That size is the whole point, because it let me run the expensive leave-one-out check for real, as ground truth, and set the cheap TracIn approximation next to it to see whether they agreed.
They did. I gave it a trick question, “Who designed the Analytical Engine?” with a look-alike line about Babbage and the Difference Engine sitting right next to the correct one in the training data. The cheap resemblance check, the kind of thing real products lean on, took the bait and confidently credited the wrong line. Leave-one-out and TracIn both ignored the look-alike and pointed straight at the source the model actually used. The lazy method everyone reaches for was confident and wrong, the honest ones were right, and the whole thing ran in about two minutes on a laptop.
I proved it at a size where I can retrain the model at will, which is exactly what nobody can do at frontier scale, so I won’t pretend I showed it holds up there. Attribution works best at the extremes, where a model has nearly memorized a passage or leaned hard on a single source, and it stays hard in the muddy middle where an almost unimaginable number of books may each have added a tiny little bit to the model. The fair summary is that attribution isn’t impossible. It’s just currently expensive, and more importantly, really impractical with today’s technology.
The whole repo is public, and since this is an article about showing where things came from, it seemed only right to be transparent about where the demo came from too. The README walks through exactly how I built it, prompts and all.
The legal hurdle
I’ll put my own cards on the table: I think copyright is the wrong tool for the fight we’re having about AI. My first job out of college was at EMI Records, working on the system that tracked their music contracts, so I learned early how tangled copyright and trademark and mechanical royalties and the rest of it can get.
Here’s the analogy I keep coming back to. If a student copies a paragraph out of Wikipedia word for word, that’s plagiarism. If the student reads it, understands it, and rewrites it in their own words, usually it isn’t, though that depends on what got rewritten, because plagiarism is about the ideas and not only the words. A physics student writing “F=ma” in a paper isn’t plagiarizing, even if they copied the formula straight out of a textbook. On the other hand, paraphrasing a specific result from somebody’s research paper without saying where it came from is still plagiarism, even if you technically changed the words. And it gets even more complicated. If you copy text word for word but credit the source, you’re not plagiarizing, but you could still have a copyright problem. We throw around the term “fair use” a lot, but that’s actually a very thorny legal area. More importantly, reducing these ideas to a legal argument doesn’t really get to the core of the problem, because laws are often imperfect and dictated by decades of (sometimes conflicting) precedent, so what’s legal doesn’t always match up with what’s the right thing to do. What a model does is a step further from copying than the rewrite: It turns the text into an enormous pile of numbers that stand in for the concepts, and there’s no paragraph left anywhere to find. So far, the courts that have looked at this, including the one behind the Anthropic settlement, have called that use “exceedingly transformative” (those are the Anthropic judge’s words, and lawyers on both sides recognized that as quite a statement). What they mean is that it changes the work into something new enough, and for a different enough purpose, that it isn’t simply a copy of the original. I think they basically got it right.
Basically, I’m not getting a check from Anthropic because they used my work without permission; I’m getting a check because they literally used a stolen book downloaded from a pirated website, instead of paying O’Reilly for a copy or getting it from another legitimate source.
But I don’t get to wave copyright away entirely, because there’s a real case on the other side, and it’s one I feel personally. Someone who wants to learn C# or study for a project management exam can now ask an AI and get an answer that came partly from books I wrote, without ever buying the book. The model learned from my books (and many others on the same topics I write about), and now it competes with them, in the exact market they were written for, using what it took from them to do it.
The worry that AI tools compete with the very material they trained on isn’t theoretical. Stack Overflow, the question-and-answer site where a generation of programmers went for help, has lost roughly three-quarters of its question volume since ChatGPT launched, as developers ask the AI instead. And the AI answers them well in part because it trained on Stack Overflow’s answers in the first place. And even that whole issue is highly nuanced, especially since the material on Stack Overflow itself is written by its users and released to the public under a Creative Commons license.
That goes to the center of what copyright is meant to protect. One of the things courts weigh in a fair-use case is the effect on the market for the original, and a free substitute trained on the original is about as direct a market effect as there is. A judge has already pointed right at it. In the case a group of authors including Sarah Silverman brought against Meta, the court handed Meta a win on fair use. But the judge then went out of his way to hint that the the authors may have lost because they’d argued it wrong, and that this market-dilution theory, the flood of cheap substitutes, is exactly the one that could win on a better record. The judge also said there was “no serious question” that the use of the technology was “highly transformative” in his ruling, and again, lawyers consider that very strong language. I’m not a lawyer, and this is only how the case reads to me as a layman, but I think it’s the strongest argument the other side has. Between that and the piracy, the bigger question is a long way from settled.
This is where it comes back to the hat tip, and the solution I’d like to see for all of these complex, nuanced problems. In a calm world, credit would be a simple courtesy. But we aren’t in a calm world. Copyright sets statutory damages of up to $150,000 per work for willful infringement, and a lot of lawyers see that number and essentially see a bounty, and their whole case turns on escalating litigation and trying to increase a damage award (of which they receive a substantial cut) by trying to sweep in as many works as they possibly can. In other words, they have a huge financial incentive to show that one of the AI labs creating models knew whose work it was using, knew that it was infringing, and did it anyway. Now look at what a hat tip is. The moment an AI lab prints “This answer draws on Andrew Stellman’s book,” it has stated, in writing, “We knew we were using Andrew Stellman’s book,” and a good plaintiff’s attorney could easily turn that around and make it exhibit A. Would a judge see that as willful infringement? I have no idea. But I’m not sure I would bet the entire future of a company like Anthropic or OpenAI.
If credit that would cost a lab almost nothing to give carries a legal risk that dwarfs the cost of crediting no one, then the rational move, the one any lawyer would advise, is to say nothing and admit nothing. The threat of a potential lawsuit could be enough to convince a lab that they can’t safely open the conversation about voluntary attribution at all, because anything it offers in good faith can be turned into ammunition. That’s the worst outcome for everybody, authors included, because the one technology that might be able to finally tell you where an idea came from ends up legally better off staying silent about it.
If you build with these tools, or just lean on them all day the way I do, this is a key reason the answers you get will almost never tell you where they came from, even if the technology to trace them keeps getting better. The people who build these tools could add that little “Here’s who this came from” line tomorrow. What likely stops them is a legal system that makes giving it to you too dangerous to try.
What I actually want
There’s a smaller version of the hat tip that doesn’t run into any of the legal or technical issues I’ve been talking about. Even when a model can’t say which book an answer came from, when it honestly can’t be traced, it can still point you to the authoritative sources on the subject, the ones worth reading to go deeper. That isn’t attribution in the strict sense; nobody has proven those books shaped that answer. But a model trained on a topic was almost certainly trained on the standard works for it, so the correlation is strong. For the reader it does the useful thing anyway by saying where to go next, and it’s something the AI labs can do today.
Which brings me back to that check from Anthropic I may or may not be about to cash. I meant it when I said I’d rather have the credit. What my writing has done for my career matters more to me than what it’s done for my bank account, and I would happily cut that settlement check in half if it meant twice as many people found their way to the work. A hat tip does exactly that, and it’s what I actually want, if it opens up new exposure to my work and new opportunities for authors like me.
The part I keep turning over is that the hat tip is more possible than the people who say “impossible” want to admit. I made a toy version, and researchers at AI labs are pushing these ideas a great deal further than I can. A key part of what stands in the way now is a legal question: whether good faith can survive contact with $150,000 a work. I don’t know how that one comes out. But I’m fairly sure it isn’t the math, and the math was supposed to be the hard part.
