FOR SEVERAL DECADES, software protection has rested on a fairly stable premise: source code is where the value lives, and copyright doctrine, by protecting expression while leaving function in the public domain, strikes a workable balance between rewarding creators and preserving competitive freedom. Reverse engineering, in that older world, meant a physical act, decompilation, disassembly, close study of internal structures, and courts in the United Kingdom, the European Union, and India built reasonably coherent doctrines around it.
Artificial intelligence (‘AI’) disturbs that settlement. In a contemporary large language model, the economic centre of gravity is no longer the source code, which is often unremarkable, but the weights produced through training. Model weights are numerical parameters that encode the system’s learned behaviour, and represent the largest single capital investment in building the model. They are not authored in any traditional sense, are hard to characterise as a literary work, and influential recent commentary suggests they may not be copyrightable at all. Their behaviour can be observed through any Application Programming Interface (‘API’) and, given enough effort, partly reconstructed in a rival system. The result is an odd mismatch: the asset that matters most commercially is the one that intellectual property doctrine addresses least, and control over its replication has fallen, almost by accident, to the terms of service of whichever company deploys the model.
The Doctrinal Baseline and Its Limits
The classical framework rests on the line between protected expression and unprotected function. The Court of Justice’s judgment in SAS Institute Inc v. World Programming Ltd. (2012) is still the clearest statement of this idea: neither a program’s functionality, nor its programming language, nor the format of its data files amounts to a protected form of expression, and a lawful user is free to observe, study, and test how a program works in order to understand the ideas behind it.
Indian doctrine reaches a similar starting point through R.G. Anand v. Delux Films (1978), even though that case belongs to a literary and dramatic-work framework rather than a software one. There, the appellant alleged that the defendant had used the idea of his play to create a new movie, after the appellant had narrated the play to the defendant. Commentators, however, have candidly described Indian jurisprudence on the non-literal aspects of computer programs as “shallow,” and Indian courts have not developed anything resembling the abstraction-filtration-comparison framework that emerged in the United States.
The move to Software-as-a-Service (‘SaaS’) did not overturn this framework, but it made several of its assumptions less useful. Users of cloud-hosted services never receive a binary they can pull apart; they interact with a remote system whose internal workings are, for all practical purposes, out of reach. Large language models sit in an unusual position within that shift. Their behavioural surface is unusually rich, and through systematic querying an outside party can map the relationship between inputs and outputs, generate synthetic training data from it, and train a separate model that approximates the original’s behaviour. Nobody touches any code, nobody intrudes on any system, yet a commercial substitute still emerges.
Knowledge Distillation and the Strain on Existing Categories
Knowledge distillation began life as a legitimate model-compression technique, and it shows the problem at its sharpest. A smaller “student” model is trained on the outputs of a larger “teacher,” reproducing its behaviour at a fraction of the cost. Point the same technique at a competitor’s deployed system, and it becomes possible to extract substantial capability without reproducing a single line of code or circumventing any technical protection measure. Nothing but behaviour changes hands.
In February 2026, Anthropic published a detailed account of industrial-scale distillation campaigns run against its Claude models by three Chinese laboratories, alleging that roughly 24,000 fraudulent accounts had generated over 16 million exchanges with Claude in breach of its terms of service. OpenAI raised comparable concerns around the same time. What is telling is that neither company framed its main grievance in copyright terms. The remedies actually available turn on enforcing a contract, not on infringement of any intellectual property right. If the most serious extraction threat frontier laboratories currently face can only be met through a breach-of-contract claim, then the assumed equivalence between protecting conventional software and protecting an AI model has quietly come apart.
Indian Copyright Perspective
One Indian Avenue deserves closer attention. Section 2(o) of the Copyright Act, 1957 defines “literary work” to include “computer programmes, tables and compilations including computer databases.” India has no equivalent of the EU’s sui generis database right, but the inclusion of computer databases within the literary-work category opens a domestic route for arguing that a trained model’s parameter file attracts copyright protection as a structured, methodically organised, individually accessible collection of numerical values. To the present author’s knowledge, this argument has not yet been tested before an Indian court.
Three problems stand in its way. First, the Supreme Court’s decision in Eastern Book Company v. D.B. Modak (2007) moved Indian law away from “sweat of the brow” toward a “modicum of creativity” standard, and weights are the product of automated optimisation, so the originality inquiry may more properly attach to the upstream choices made by engineers than to the resulting numerical file itself. Second, weights are not really a selection or arrangement of pre-existing material in any ordinary sense; they are a learned representation. Third, and most importantly, even a Section 2(o) claim that succeeded would only give control over the parameter file as an artefact. It would do nothing to stop behavioural replication through distillation, where the file itself is never copied. The database route is worth pursuing where an actual file has been misappropriated, particularly by a departing employee, but it simply does not reach the form of replication that matters most.
Section 2(o) of the Copyright Act, 1957 includes “computer programmes, tables and compilations including computer databases” within “literary work”. This inclusion opens a domestic route for arguing that a trained model’s parameter file attracts copyright protection as a structured, methodically organised, individually accessible collection of numerical values.
Trade Secret Protection and Behavioral Replication
If copyright offers an uncertain footing for protecting AI model weights, trade secret law offers a much more natural one. Unlike copyright, it does not depend on originality or expression. Instead, it protects commercially valuable information that derives its value from remaining confidential, provided reasonable steps are taken to keep it that way.
This method is grounded in Article 39 of the Agreement on Trade-Related Aspects of Intellectual Property Rights (‘TRIPS’). According to Article 39(2), Member States are obligated to provide protection for undisclosed information from acquisition, use or disclosure based on the lack of fair business practices when three criteria are met: (i) the information is secret; (ii) it has market value; and (iii) the rightful holder has taken reasonable precautions to protect the information. Therefore, these requirements can be applied to AI model weights, proprietary training datasets and deployment techniques as their worth lies in their confidentiality rather than transparency.
The comparative picture tells a similar story. In the United Kingdom, protection comes principally through the Trade Secrets (Enforcement, etc.) Regulations, 2018, alongside the equitable action for breach of confidence. In the United States, the Defend Trade Secrets Act, 2016 and the Uniform Trade Secrets Act between them provide fairly comprehensive statutory protection for confidential business information.
India, although bound by Article 39 of TRIPS, has never enacted a standalone trade secrets statute, and relies instead on contractual obligations, equitable principles, and actions for breach of confidence. That absence of a dedicated statutory regime leaves real uncertainty about how AI model weights are protected, especially where behavioural replication happens without any direct acquisition of confidential information.
The Indian judiciary, however, has built up a jurisprudence in protecting confidential business information through the principles of equity for the prevention of breach of confidence. According to Beyond Dreams Entertainment Pvt Ltd. v. Zee Entertainment Enterprises Ltd. (2026), in a case relating to a trade secret, the plaintiff should prove the existence of three basic elements: one, that the information has the requisite quality of confidence; two, that the information was communicated or acquired in such a manner that it created an obligation of confidence; and three, that there has been unauthorised use. These principles can easily be applied in the context of cutting-edge AI technologies where model weights, proprietary training data sets, reinforcement learning techniques, and deployment architecture gain their economic value by staying confidential.
This is why frontier AI developers increasingly pair trade secret protection with detailed contractual safeguards. Non-disclosure agreements, restrictive licensing terms, cybersecurity controls, employee confidentiality obligations, access restrictions, API-only deployment, and careful exit procedures are not just good commercial practice: they are the reasonable measures needed to preserve trade secret status in the first place, and they also cut down the risk of behavioural extraction through knowledge distillation.
The main weakness of trade secret law, though, mirrors the central concern of this article. Protection lasts only as long as the information stays secret, and it does not stop independent development or lawful reverse engineering. Knowledge distillation is a modern version of exactly that problem. Instead of acquiring the confidential parameter file, a competitor can simply query a deployed model at scale, generate synthetic training data from the responses, and recreate comparable behaviour without ever touching the protected weights. So, while trade secret law fits model weights considerably better than copyright does, it still falls short of a full answer to behavioural replication achieved through large-scale interaction with a deployed system.
If copyright offers an uncertain footing for protecting AI model weights, trade secret law offers a much more natural one. Unlike copyright, it does not depend on originality or expression.
It helps to think of AI systems across three stages. Training datasets and curated data collections can themselves be valuable trade secrets. Neural network architectures, algorithms, parameter files, and implementation methodologies can be protected for as long as they stay confidential. And the outputs an AI system generates may qualify for protection where they reveal commercially valuable confidential information. Different components of an AI system attract different forms of protection; there is no single, comprehensive intellectual property right that covers the whole system at once.
Trade secret protection has particular advantages in this sector. It arises automatically, without registration, it can last indefinitely as long as secrecy is maintained. For AI systems, protectable information reaches well beyond source code. Courts and commentators have recognised that algorithms, neural network implementations, proprietary training datasets, model architectures, implementation know-how, and confidential engineering methodologies can all constitute trade secrets, provided the usual statutory requirements are met. That makes trade secret law a conceptually better fit for AI than copyright, since the commercial value of frontier AI models usually sits in confidential technical know-how rather than in creative expression.
The European Union's Regulatory Response
The European Union has approached the broader problem indirectly. The GPAI Code of Practice and the Training Data Summary Template, published in July 2025, impose transparency obligations on the training pipeline and, by definition, capture data “distillated or extracted from other AI models.” The Code does not, however, grant any affirmative protection to the weights themselves. Its concern is whether the inputs used were lawful, not the legal status of the resulting model. That asymmetry persists even under the most demanding regulatory regime currently aimed at general-purpose AI.
The Contractual Frontier and the Drafting Problem
Where doctrine falls short, providers have turned to contract instead. Henderson and Lemley have argued that many such provisions may be partly unenforceable, given copyright pre-emption, the narrow reach of the Computer Fraud and Abuse Act (USA), and doubts about whether quasi-copyright protection can be created by private fiat. That is best read as an argument for drafting more carefully, not for abandoning a contract altogether. Legacy SaaS templates were built for a world where the main risks were unauthorised redistribution and breach of confidentiality, not behavioural replication by a counterparty who never touches the provider’s code or weights at all.
Several areas need attention here. Acceptable-use clauses need to name knowledge distillation, capability extraction through structured prompting, and the use of outputs to train derivative systems, and they need to do so with enough specificity to support an injunction. Output rights need to be allocated explicitly, given how unsettled the copyright status of model outputs remains, and downstream restrictions need to be calibrated so outputs stay commercially useful even though the underlying value cannot be transferred or replicated. Anti-distillation provisions cannot rely on technical rate limits alone, since those are easily defeated by spreading queries across many accounts. Account-integrity clauses need to cover identity verification, prohibitions on proxy access, and suspension rights, the absence of which featured prominently in Anthropic’s disclosure. Choice of law and forum need unusual care, since a standard arbitration clause may not produce a workable remedy against a counterparty incorporated through a proxy structure in a third jurisdiction. And the evidentiary architecture of the contract, acknowledgement clauses, stipulated damages, presumptions tied to specified factual patterns, and survival provisions, can decide whether a viable claim can be brought at all once extraction is eventually detected.
None of this replaces jurisdiction-specific advice. But where statutory protection is thin and judicial guidance is largely absent, the contract becomes the main instrument by which a provider preserves its model’s value. Treating it as a standard SaaS template with a few cosmetic additions leaves the asset substantially unprotected.
The European Union has approached the broader problem indirectly. The GPAI Code of Practice and the Training Data Summary Template, published in July 2025, impose transparency obligations on the training pipeline and, by definition, capture data “distillated or extracted from other AI models.”
Conclusion
The shift from traditional software to artificial intelligence has moved the locus of commercial value from code to weights, and from expression to behaviour. Intellectual property doctrine, built for the earlier paradigm, has not caught up. The Indian database route under Section 2(o) offers a possible toehold, but it does not reach the form of replication that matters most. The protective burden has moved, in large part, from doctrine to drafting, and the quality of that drafting now decides whether a model’s value is preserved or slowly bled away through extraction. That places real demands on counsel: familiarity with how AI systems are queried and replicated, with the doctrinal landscape across several jurisdictions, and with the evidentiary architecture needed to bring a viable claim once conduct is detected. None of these skills is standard in legacy SaaS practice, and the gap between what generic templates cover and what AI services agreements actually need is, at present, the main source of avoidable exposure for AI providers. In a field where the crown jewels have moved, the burden falls on whoever drafts the instruments meant to take up the slack.