Re: on ai generated and code provenance

["Michael S. Tsirkin" <mst@redhat.com>]

On Mon, May 25, 2026 at 03:44:02PM -0400, Stefan Hajnoczi wrote:
> On Mon, May 25, 2026 at 1:17 PM Warner Losh <imp@bsdimp.com> wrote:
> > On Mon, May 25, 2026 at 10:34 AM Paolo Bonzini <pbonzini@redhat.com> wrote:
> >> On 5/24/26 14:42, Michael S. Tsirkin wrote:
> >> >       How contributors could comply with DCO terms (b) or (c) for the output of AI
> >> >       content generators commonly available today is unclear.  The QEMU project is
> >> >       not willing or able to accept the legal risks of non-compliance.
> >> >
> >> > But, since this was written, Red Hat's Richard Fontana and Chris Wright
> >> > published this piece:
> >> > https://www.redhat.com/en/blog/ai-assisted-development-and-open-source-navigating-legal-issues
> >> >
> >> > Saying, in particular
> >> >       We understand this concern, but the DCO has never
> >> >       been interpreted to require that every line of a contribution must be
> >> >       the personal creative expression of the contributor or another human
> >> >       developer.
> >> This is not the objection or the worry; rather the question is, what if
> >> the contribution is a creative expression of someone that could claim
> >> copyright in it.  In fact, looking at the Linux policy...
> >>
> >>    Signed-off-by and Developer Certificate of Origin
> >>    =================================================
> >>
> >>    AI agents MUST NOT add Signed-off-by tags. Only humans can legally
> >>    certify the Developer Certificate of Origin (DCO). The human submitter
> >>    is responsible for:
> >>
> >>    * Reviewing all AI-generated code
> >>    * Ensuring compliance with licensing requirements
> >>    * Adding their own Signed-off-by tag to certify the DCO
> >>    * Taking full responsibility for the contribution
> >>
> >> ... the question is how humans can actually do the second step.  The
> >> piece you posted above says: "with disclosure and human attentiveness –
> >> and oversight – aided where possible by tools that check for code
> >> similarity, AI-assisted contributions can be entirely compatible with
> >> the spirit of the DCO".
> >
> >
> > The code produced by AI agents has no copyright. You can incorporate
> > public domain code into your work and have the absolute right to license
> > it (see all the Diseny movies). The notion that LLMs wholesale copy originates
> > from the earliest days of Copilot and turned out were contrived. No recent
> > evidence shows that plagiarism is a concern. To the extent that I modify
> > public domain code, I have a copyright that I can choose to license
> > however I want (and the SOB says it's compatible).
> 
> There is an active field of research on memorization and the status is
> that LLMs do memorize. A paper from 2026
> (https://arxiv.org/pdf/2601.02671) shows that production models can
> output significant chunks of Harry Potter, although the research
> deliberately extracts training inputs rather than doing so
> accidentally. I am sharing this because I don't think it's correct to
> say that concerns about models outputting copyrighted code are
> outdated.

But the concern is with them doing it *accidentally*.
Because willful infringement was always possible.
And that does not seem to be happening.


> I do think that the risk for coding use cases is low as long as LLMs
> are used sensibly. If not, legal cases would have popped up by now.
> 
> The example of ext4 for OpenBSD (https://lwn.net/Articles/1064541/)
> comes to mind as a case where LLMs were used in a risky way and
> maintainers decided to reject the code. Even though the output of AI
> has no copyright, when there is no suitably-licensed information to
> generate the code from, then it is risky to assume AI generated code
> is free from copyright, license, patent, etc effects.
> 
> As long as we keep the usual practices around intellectual property in
> mind when merging code, then I think the risk of copyright issues is
> low and not a blocker for accepting AI generated contributions.
> 
> Stefan