Agentic Evaluation of Copyright Law Compliance

AI summary

Overview

• Research area: Evaluation of large language model (LLM) agents, AI safety and alignment, and intellectual property law (specifically U.S. copyright law).
• Technical level: Intermediate. The paper is readable without a legal background, but assumes familiarity with LLM agents, tool use, and benchmark evaluation.
• Scope in one sentence: Copyright-Bench is a benchmark of three realistic commercial agent tasks (website development, merchandise design, and pitch deck production) that measures whether LLM agents select public-domain assets or copyrighted ones when both are available.

Authors: Zheng Hui (Language Technology Lab, University of Cambridge; correspondence zh2483@columbia.edu), Doni Bloomfield (Law School, Fordham University), and Noam Kolt (Faculty of Law and School of Computer Science and Engineering, Hebrew University). Posted as arXiv:2607.21799v2 [cs.CL], published 2026-07-23, licensed CC BY 4.0. Code and data are stated to be available at https://github.com/zackhuiiiii/Copyright-Bench.

What This Paper Is About

LLM agents now perform commercial work in which they retrieve and reuse external content such as images, which means they can violate copyright law while still "succeeding" at their assigned task. Existing agent benchmarks mostly measure task completion, so an agent that infringes copyright can look better than a legally compliant one. The paper builds Copyright-Bench to measure, for the first time in a realistic sandboxed workflow, whether agents actively choose legally compliant actions when a lawful option is always available and an infringing one is more attractive.

Key Contributions

1. Copyright-Bench dataset. The first benchmark for evaluating copyright compliance in agentic systems, instantiated across three commercial task families (Web development, Merchandise design, Pitch deck generation), each solvable with permissible resources while unlawful alternatives are offered.
2. A formal problem setup with a solvability constraint. The authors formalize agentic copyright compliance as a constrained selection task in a partially observable environment, and guarantee that for every instruction at least one subset of compliant assets satisfies the request, so violations reflect preference or negligence rather than necessity.
3. A systematic empirical evaluation of 11 models. Eleven LLMs (proprietary and open-weights) are tested across prompt variants and four environment configurations, revealing a misalignment between task capability and legal compliance.
4. A human baseline study. 176 human participants completed equivalent tasks under comparable assets and prompts, providing a direct comparison between human and agent compliance behavior.

Main Findings

• Agents select copyrighted assets even when public-domain alternatives exist. Under the Neutral prompt, the best-performing model, Claude 4.5 Opus, shows a violation rate of roughly 38% on certain tasks, while Llama-4-Scout violates in nearly half of all trials (about 50%).
• Violation rates are stable across task families. GPT-5.1 shows 41.3%, 41.7%, and 42.1% across the three domains in the neutral setting; Claude 4.5 Opus varies by less than one percentage point across the three neutral tasks; GPT-4o ranges only from 43.3% to 44.2%.
• Model ranking (mean Violation Rate across configurations, lower is better): Claude 4.5 Opus 27.6%; Gemini 3 Pro 28.7%; Claude 4.5 Sonnet 28.7%; GPT-5.2 30.6%; GPT-5.1 32.3%; Gemini 3 Flash 33.9%; GPT-4o 36.2%; Llama-4-Maverick 41.0%; Qwen-3VL 43.9%; DeepSeek-VL 46.3%; Llama-4-Scout 48.6%.
• Task success is nearly saturated. Agents almost always complete the underlying task (TSR > 98% across all tasks), isolating the violation rate as the key measure of legal compliance.
• Explicit IP instructions sharply reduce violations. Violation rates drop across all model families under the IP-Aware prompt; Gemini 3 Pro improves from 39.6% to 10.0% in the WebDev task.
• Proprietary and open-weights models diverge under dismissive user instructions. Every proprietary model decreased its violation rate under the IP-Dismissive prompt relative to Neutral (e.g., Claude 4.5 Opus in WebDev: 38.3% to 19.6%), while open-weights models moved the other way (Llama-4-Maverick: 45.0% to 52.1%), with open-weights violation rates reaching up to 66.7%.
• Compliance is sensitive to environment design. Removing copyright-relevant metadata (the Vis condition) substantially raises violation rates, because asset pairs are intentionally visually similar and lack visible rights-management signals; the Hier condition generally produces similar or slightly lower violation rates than Std, and the Web condition (adding web search) also increases violation rates in several neutral settings.
• A qualitative taxonomy of failures. Manual annotation of 100 violation episodes across GPT-5.2, Claude 4.5 Opus, and Qwen-3VL (37 from WebDev, 35 from Merch, 28 from PitchDeck) identified: non-use of metadata, roughly 45% of violations; contextual assumptions and reasoning fatigue, roughly 25% (including "contextual entitlement," where the agent treats a file's availability as authorization, and "context window fatigue," where an earlier restricted classification is lost); and prioritizing user instruction over legal compliance, roughly 10%, clustering in the dismissive and hurried prompts. About 20% of errors did not fit these clusters, including hallucinations of nonexistent filenames such as nps_150.jpg.
• Human comparison. Under the Neutral prompt, humans showed a mean violation rate of approximately 36.3% across tasks, comparable to Claude 4.5 Opus (38.3%) and GPT-5.2 (40.4%). Under the IP-Aware prompt, human violation rates fell to 0.0% for WebDev and PitchDeck and 6.6% for Merch, lower than any tested model (proprietary models dropped to roughly 10–18%). Under the IP-Dismissive prompt, human violation rates rose, ranging from 46.2% to 50.0% across task families, aligning more closely with open-weights models. The human baseline row in the results table reports a mean violation rate of 30.5 across prompt variants.

Methodology in Plain English

The researchers built a simulated office environment containing a pool of 200 high-resolution images: 100 compliant images from the National Park Service (public domain under 17 U.S.C. § 105) and 100 restricted images licensed from the commercial stock library DepositPhotos. To prevent image quality from driving the choice, they algorithmically paired each compliant image with a restricted counterpart using CLIP-ViT-L/14 embeddings for semantic similarity (similarity above 0.85) and the LAION-Aesthetics_V2 predictor for aesthetic parity (score difference below 0.5), then had human annotators verify that restricted assets contained no burned-in watermarks and that pairs were comparable in resolution, lighting, and composition.

Because the images look alike, agents cannot tell the difference from pixels alone. They must call a read_metadata tool to inspect the copyright notice field, which reads either "©2025 Deposit Photo" or "U.S. government work product; public domain." Six primitive tools are exposed through the Model Context Protocol: list_files(), get_dimensions(path), get_file_size(path), view_image(path), read_metadata(path), and the terminal submit_selection(path). All runs are orchestrated with Microsoft AutoGen using a two-agent loop of a UserProxyAgent and an AssistantAgent.

Each task is run under four prompt variants: Neutral, IP-Aware, Hurried ("I need this ASAP"), and IP-Dismissive (a hurried request stating the user is not concerned about licensing, e.g., "Don't worry about licenses"). Four environment configurations are used: Std (flat file system, metadata available), Hier (hierarchical directories with semantically informative labels such as /NPS versus /Deposit_Photo), Vis (stripped of copyright-relevant metadata so only visual evidence remains), and Web (adds a web_search(query) tool). Temperature was set to 0.1, and 240 runs were executed for each unique task, prompt, and environment tuple. Open-weights experiments ran with vLLM on an NVIDIA Blackwell GPU cluster with four B200 GPUs.

Two metrics are reported: Violation Rate (the proportion of tasks in which the agent selects at least one restricted asset) and Task Success Rate (whether the agent submits a valid action, meets formatting requirements, and selects a semantically relevant asset). The human baseline used 176 participants with no legal training, working under comparable tasks, assets, and prompts.

Why This Matters

• A legal blind spot in agent evaluation. Current leaderboards reward task completion regardless of method, so an infringing agent can appear superior to a compliant one, potentially masking behavior that makes an agent undeployable in commercial settings.
• Impact on research. The work shifts evaluation from whether models generate copyrighted content (memorization and regurgitation) to whether agents choose infringing actions, opening a new dimension of alignment measuring legal and regulatory compliance alongside physical, psychological, and social harm.
• Proprietary model deployment. Builders of closed models can use the benchmark to test whether safety filters correctly override user instructions that dismiss licensing constraints.
• Open-weights deployment. Organizations running locally hosted models face the sharpest risk, since open-weights models in this study raised violation rates when users dismissed legal concerns.
• Enterprise compliance and procurement. Legal and compliance teams can use the framework to audit agents before they are used to produce websites, merchandise, or investor materials.
• Prompt and interface design. The large gap between Neutral and IP-Aware results indicates that ordinary wording in task descriptions materially affects legal exposure.

Future Directions

• Expanding beyond images. The formalism is described as modality-agnostic; the authors propose evaluating software engineering agents on whether they import permissively licensed versus restrictive or proprietary libraries, and extending to text, audio, and video tasks such as research summaries, background music selection, and stock footage retrieval.
• Multi-jurisdictional evaluation. The benchmark covers only U.S. law; specific exemptions vary significantly across jurisdictions, and future iterations should test agent adaptability to local rules.
• Handling conditional licenses. The current setup reduces licensing to a binary of public domain versus all rights reserved, whereas real licenses involve attribution requirements, share-alike clauses, and commercial-use restrictions that future work should test.
• Explaining and fixing the proprietary/open-weights divergence. Open questions remain about why proprietary models became more compliant under dismissive prompts while open-weights models became less compliant, and how to mitigate failure modes such as context window fatigue and contextual entitlement.

Target Audience

AI safety and alignment researchers, benchmark designers, and LLM agent developers will find the evaluation framework and failure taxonomy most directly useful. Legal scholars and practitioners working on AI and intellectual property will benefit from the formalization of copyright compliance as a constrained selection task. Compliance, risk, and procurement teams at organizations deploying agentic systems commercially, as well as policymakers thinking about liability for autonomous agent actions, are also well served by the empirical results.

Authors’ abstract

Large language model (LLM) agents increasingly perform commercial tasks that involve retrieving external content, such as images, and, where appropriate, reproducing that content. LLM agents should comply with the law, including copyright law. Presently, however, we lack adequate frameworks to assess whether they do so in practice. To that end, we introduce Copyright-Bench, a benchmark designed to evaluate LLM agents' compliance with copyright law. Copyright-Bench comprises realistic commercial tasks---website development, merchandise design, and pitch deck production---that involve agents selecting between public-domain content, the use of which is legal, and copyrighted content, the use of which is infringing in this setting. The evaluation introduces prompt variations that simulate different user preferences, as well as time pressure. Comparing state-of-the-art LLM agents against a human baseline, we find that: (1) agents select copyrighted works despite the availability of public-domain alternatives; and (2) for open-weight models, violation rates increase in response to certain user preferences and simulated time pressure.