Meta’s AI Can Recite Nearly Half of Harry Potter, Study Finds

Stanford researchers found something unsettling when they tested AI models on copyrighted books. Meta's Llama 3.1 can reproduce 42 percent of "Harry Potter and the Sorcerer's Stone" word-for-word. That's not a small glitch—it's nearly half the book.

The finding comes from a comprehensive study by computer scientists and legal scholars from Stanford, Cornell, and West Virginia University. They tested five popular AI models to see how much text they could extract from Books3, a collection of nearly 200,000 books used to train language models. Many of these books remain under copyright.

The results should worry both AI companies and copyright holders. While most books showed minimal memorization, popular titles tell a different story. The researchers found that Llama 3.1 70B memorized substantial portions of classics like "The Hobbit," George Orwell's "1984," and "The Great Gatsby."

The Memory Problem Gets Worse

What makes this discovery particularly troubling is the trend. Meta's earlier model, Llama 1 65B, memorized only 4.4 percent of the same Harry Potter book. Despite growing legal scrutiny over copyright infringement, Meta's newer model memorized ten times more content.

"We'd expected to see some kind of low level of replicability on the order of one or two percent," Mark Lemley, a Stanford law professor and study co-author, told Understanding AI. "The first thing that surprised me is how much variation there is."

The variation is stark. While Llama 3.1 absorbed nearly half of Harry Potter, it memorized just 0.13 percent of "Sandman Slim," a 2009 novel by Richard Kadrey. This dramatic difference could reshape ongoing copyright lawsuits.

How They Measured AI Memory

The researchers didn't generate thousands of outputs to test memorization. Instead, they used a clever mathematical approach. AI models don't just predict the next word—they generate probability scores for every possible next word. By multiplying these probabilities together, researchers could calculate the exact likelihood of reproducing any text sequence.

Think of it like this: if you prompt an AI with "My favorite sandwich is," the model assigns probabilities to every possible next word. "Peanut" might get 20 percent, "butter" might get 90 percent when following "peanut," and so on. Multiply these probabilities together, and you get the chance of reproducing "peanut butter and jelly."

For any 50-word sequence to have even a 1 percent chance of appearing, each individual word needs an average probability of about 93 percent. When models reproduce copyrighted text with high probability, it's strong evidence they've memorized that content during training.

The researchers used an extremely strict test. They only counted passages where the model had better than 50 percent odds of reproducing the next 50 words exactly. No partial matches, no close approximations—just perfect word-for-word reproduction.

Legal Earthquake Brewing

These findings complicate every major copyright lawsuit against AI companies. The New York Times sued OpenAI after showing that GPT-4 could reproduce lengthy passages from Times articles. OpenAI called this "fringe behavior," but the new research suggests memorization might be far more widespread than previously known.

The study gives ammunition to both sides of the legal battle. Copyright holders can point to clear evidence that AI models copy and store their work. But the research also shows that memorization varies wildly between different books and models, which could undermine class-action lawsuits that treat all authors similarly.

Richard Kadrey leads a class-action suit against Meta. To win class certification, his lawyers must prove that all plaintiffs face similar legal situations. But if Meta memorized 42 percent of Harry Potter while barely touching Kadrey's own novel, courts might question whether these authors belong in the same lawsuit.

Three Paths to Copyright Trouble

Legal experts identify three ways AI training could violate copyright law. First, the training process itself might infringe because it involves copying entire works. Second, if models store copyrighted content in their neural networks, the models themselves might be illegal derivative works. Third, infringement occurs when models generate copyrighted text.

The memorization findings make the second theory much more dangerous for AI companies. If Llama 3.1 contains recognizable portions of Harry Potter in its neural weights, courts might treat the entire model as an unauthorized copy.

"It's clear that you can in fact extract substantial parts of Harry Potter and various other books from the model," Lemley told Understanding AI. "That suggests to me that probably for some of those books there's something the law would call a copy of part of the book in the model itself."

Google won a major fair use case over its book scanning project, but that precedent might not protect AI companies. Google never let users download its book database. Meta, by contrast, released Llama 3.1 as an open model that anyone can download and run.

The Open Source Dilemma

This creates a perverse incentive. Companies that keep their models secret—like OpenAI and Anthropic—make it nearly impossible for researchers to prove memorization. These closed models might memorize just as much copyrighted content, but nobody can test them.

Meanwhile, companies that release open models for public benefit expose themselves to detailed analysis. The Stanford researchers could only conduct their study because Meta made Llama's internal workings accessible.

"It's kind of perverse," Lemley told Understanding AI. "I don't like that outcome."

The memorization problem appears to worsen as models get larger and train on more data. Llama 3.1 70B trained on 15 trillion tokens—more than ten times the 1.4 trillion tokens used for Llama 1 65B. More training data, especially repeated exposure to the same books, increases memorization.

But the pattern of which books get memorized remains puzzling. Popular books face higher memorization rates, suggesting models encounter these works repeatedly across different internet sources—fan forums, reviews, academic papers, and discussion boards.

Why This Matters:

• AI memorization isn't a bug—it's how these models work. When they train on the same books repeatedly, they store chunks of that content. This destroys the industry argument that models only learn abstract patterns, not actual text.
• Copyright disputes now have concrete evidence instead of philosophical debates about machine learning.

Read on, my dear:

• Extracting memorized pieces of (copyrighted) books
  from open-weight language models