Data Intellectual Property Rights (DIPR)

• Data Intellectual Property Rights (DIPR) is a composite framework that defines legal entitlements and technical mechanisms to control data as a valuable asset.
• It employs methods such as dataset sanitization, watermarking, and indirection schemes to mitigate risks like unauthorized usage and broad platform licenses.
• DIPR addresses challenges in generative AI and dataset exchange by integrating layered defenses that balance data circulation value with ownership control.

Data Intellectual Property Rights (DIPR) denotes a family of legal entitlements, governance doctrines, and technical mechanisms intended to preserve control over data as an economic, creative, and evidentiary asset. In the generative-AI literature, DIPR is defined as protections that grant creators, owners, and sellers of training data exclusive control over how that data may be collected, processed, and monetized (Šarčević et al., 2024). In Chinese judicial discourse, DIPR is described as “emergent rights” in data resources that combine novelty and originality thresholds, intellectual-labor theory, and market-governance goals (Lou, 23 Sep 2025). Across social platforms, data markets, blockchain-based provenance systems, and machine-learning pipelines, the recurring problem is that formal ownership may persist while practical control is weakened by broad platform licenses, unauthorized training, uncertain provenance, or doctrinal gaps.

1. Conceptual scope and doctrinal boundaries

DIPR is not a single doctrine. The literature treats it as a layered response to several distinct risks. In generative AI, those risks include unauthorized data usage, plagiarism and style mimicry, reproduction of copyrighted materials, lack of attribution and compensation, and trademark infringement or unfair competition (Šarčević et al., 2024). In dataset exchange, the risks separate into data-item IP and statistical IP: a sanitized image may still be too visually similar to the original, or a sanitized dataset may still be sufficiently informative to train new models or conduct model selection (Singh et al., 2022). In judicial analysis, DIPR must also accommodate the distinction between raw data, original network data, and derived data products, because data often lack conventional creative expression and yet may embody value-added labor and market significance (Lou, 23 Sep 2025).

This scope makes DIPR distinct from traditional copyright or patent in several ways. The survey literature emphasizes mass scraping, large-scale stylization, and the need for technical controls such as opt-out mechanisms, sanitization, watermarking, and attribution tools because existing IP law was not designed for mass-scale model training (Šarčević et al., 2024). The Chinese-courts literature similarly argues that protection must balance dynamic circulation value against monopolization risks and therefore requires a hybrid doctrine drawing on copyright, patent, unfair competition, and equity (Lou, 23 Sep 2025). A common misconception is that DIPR is reducible to ordinary copyright in expressive works. The case-law analysis and technical literature both indicate a broader field: DIPR concerns rights over access, reuse, extraction, inference, and monetization of data-bearing artifacts, not only copying in the narrow sense.

The technical taxonomy proposed for generative AI organizes protection methods along three attributes: protection mode, application phase, and granularity. The resulting categories are dataset sanitisation, prompt modification, adversarial perturbations or “cloaking,” concept removal or unlearning, watermarking, analytical data attribution, and testing memorisation (Šarčević et al., 2024). This classification is important because DIPR enforcement is not confined to one stage of the lifecycle. It can be preventive before training, restrictive during fine-tuning, or forensic after deployment.

The literature also distinguishes dataset rights from model rights. One dataset-protection paper explicitly notes that almost all copyright-protection schemes for deep learning focus on models, while dataset copyright protection is rarely studied (Xue et al., 2021). By contrast, passport-based DNN ownership verification protects the intellectual property of trained networks through non-invertible ownership evidence embedded in the inference path, rather than through protection of the underlying dataset (Fan et al., 2019). This boundary matters because many legal and technical disputes about DIPR concern data that either precede the model or remain external to it.

2. Platform-hosted content and contractual loss of control

One of the earliest DIPR problems discussed in the cited literature concerns user-uploaded content on social networking services. The core issue is not only copying, but platform-hosted submission under terms of service that grant the network a broad license over uploaded material. The Redirect2Own work frames this as a need to understand the “overly-broad licenses” extracted by social networks and to provide a mechanism that decouples user content from the service’s legal domain (Kontaxis et al., 2018). The motivating example is Facebook’s claim to a “transferable, sub-licensable, royalty-free, worldwide license” on user-provided content, a condition that is particularly consequential for photographers, illustrators, and corporate brands.

Redirect2Own proposes a client-side indirection scheme in which the original object is stored off-site, while the social network receives only a small reference object encoding the off-site URL. The design goals are full IP control, full functionality, and transparency. The threat model treats the social network as an untrusted or “too-powerful” adversary that will claim and use any content hosted on its own servers. The system assumes no collusion with platform servers, no modification of service code, and no cooperation from the network; the trusted components are the browser extension and third-party hosting services with more acceptable terms of service (Kontaxis et al., 2018).

Operationally, the mechanism is modular. Off-site hosts such as Flickr, Dropbox, Pastebin, and FreedomBox are exposed through “indirection provider modules.” On the write path, an upload intended for Facebook is intercepted by the browser extension, dispatched to the appropriate provider module, uploaded off-site, and then replaced by a QR-code image or short-URL snippet that the social network accepts as ordinary content. On the read path, the extension scans page content, resolves the reference object to the real URL, and replaces the placeholder in the DOM with the actual remote object. The architecture comprises an Encoder/Decoder content script, a Core background page that manages cache mappings and multiplexes requests, and provider modules that implement host-specific HTTP API clients.

The performance analysis is stated in terms of native fetch time, QR decoding time, and off-site host fetch time. For images, the paper gives

$t_{\text{redirected}} = t_{qr} + t_{host},$

with $t_{\text{native}} \approx 11$ ms, $t_{qr} \approx 4$ ms, and $t_{host} \approx 147$ ms for Flickr or $\approx 306$ ms for Dropbox. For Flickr, this yields $t_{\text{redirected}} \approx 151$ ms and an overhead of about $140$ ms relative to Facebook CDN delivery; the QR header is reported as $< 5$ KB, and cache hits can reduce overhead nearly to zero (Kontaxis et al., 2018). The paper nevertheless characterizes the overhead as negligible in the abstract, which suggests that the authors consider the delay acceptable relative to the preservation of legal control and to the effects of caching.

The scheme also clarifies an important DIPR misconception. Retaining copyright in the abstract does not imply retaining practical control over licensing, redistribution, derivative uses, or monetization when the platform stores the original file. Redirect2Own’s approach is to preserve platform-facing functionality while denying the platform possession of the actual protected object. Its acknowledged limitations are equally revealing: server-side features such as face-tag suggestion, social-authentication challenge generation, and server-driven search or indexing depend on having actual pixels or text on the platform’s servers; a determined platform might also detect QR codes at scale and block them. DIPR on centralized platforms therefore remains a contest between contractual design, client-side indirection, and platform countermeasures.

3. Preventive protection of datasets before model training

Preventive DIPR mechanisms attempt to reduce the value of shared data to unauthorized parties before any downstream model is trained. Two substantially different strategies appear in the literature: sanitization for data valuation and active protection against unauthorized training.

IPProtect addresses the setting in which a buyer must share data during valuation while limiting both image-level and dataset-level intellectual-property leakage. It defines data-item exposure by

$$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$

where $\mathbb D$ is a perceptual distance, and statistical IP exposure through training-IP and inference-IP metrics computed over a family $t_{\text{native}} \approx 11$0 of classifiers (Singh et al., 2022). The adversary sees only the sanitized dataset $t_{\text{native}} \approx 11$1, knows the sanitization algorithm, and may possess an auxiliary dataset $t_{\text{native}} \approx 11$2. The main threat is reconstruction or “decryption”: recovering an original $t_{\text{native}} \approx 11$3 from a sanitized $t_{\text{native}} \approx 11$4.

The algorithmic core preserves seller-model logits while forcing the sanitized image toward Gaussian white noise. Because the seller models are unknown at the buyer’s side, the practical optimization replaces them with a bootstrapped training pool $t_{\text{native}} \approx 11$5 and validation pool $t_{\text{native}} \approx 11$6, and solves

$t_{\text{native}} \approx 11$7

where $t_{\text{native}} \approx 11$8 (Singh et al., 2022). The paper interprets this as a strong information bottleneck: only the signal needed to align logits across the model pool is allowed to pass into $t_{\text{native}} \approx 11$9. The theoretical discussion argues that, with moderate $t_{qr} \approx 4$0, the feasible set remains large and reconstruction remains underdetermined; empirically, a pix2pix-style GAN inversion attack fails to recover recognizable originals.

The reported experiments use MNIST, Fashion-MNIST, and CIFAR-10, with utility measured as the mean absolute error between seller-model accuracies on $t_{qr} \approx 4$1 and on $t_{qr} \approx 4$2. In the paper’s security-versus-utility plots, IPProtect’s Pareto curve lies in the lower-left corner, with MAE $t_{qr} \approx 4$3 even for CIFAR-10 while image-IP nearly matches the “Random” ideal; the 0–1-normalized harmonic mean scores reportedly top all baselines on every dataset and every IP metric (Singh et al., 2022). The deployment model is also notable: the buyer runs sanitization locally, publishes only the sanitized set, and sellers return scalar utilities, so no raw IP leaves the buyer’s premises.

A second preventive line of work protects a released dataset against unauthorized training rather than against valuation-time exposure. The method in “Protect the Intellectual Property of Dataset against Unauthorized Use” combines feature-space adversarial perturbation with a modified Reversible Image Transformation, AES encryption, and LSB embedding (Xue et al., 2021). For each sample $t_{qr} \approx 4$4, the owner approximately solves

$t_{qr} \approx 4$5

forms $t_{qr} \approx 4$6, and then hides the original image inside the adversarially perturbed image using a secret transform state $t_{qr} \approx 4$7 whose encryption is embedded in the protected image. Authorized users with the secret key can invert the process and recover a bit-identical image; unauthorized users can inspect all pixels and train arbitrary architectures, but do not possess the key.

The experimental results quantify the protection effect. On CIFAR-10, the test accuracy of an unauthorized model trained on the protected dataset drops from $t_{qr} \approx 4$8 to $t_{qr} \approx 4$9, while a model trained on the recovered dataset reaches $t_{host} \approx 147$0. On the sampled TinyImageNet subset, the corresponding drop is from $t_{host} \approx 147$1 to $t_{host} \approx 147$2, with $t_{host} \approx 147$3 recovered after authorized inversion (Xue et al., 2021). These figures make the design goal explicit: the dataset remains usable for authorized computation while becoming actively misleading for unauthorized learning.

Mechanism	Intended setting	Reported outcome
IPProtect	Data valuation with sanitized sharing	MAE $t_{host} \approx 147$4 even for CIFAR-10; image-IP nearly matches “Random”
Feature-space perturbation + mRIT	Released dataset, unauthorized training	CIFAR-10 test accuracy $t_{host} \approx 147$5; recovered $t_{host} \approx 147$6
Feature-space perturbation + mRIT	Released dataset, unauthorized training	TinyImageNet test accuracy $t_{host} \approx 147$7; recovered $t_{host} \approx 147$8

These approaches embody different preventive philosophies. IPProtect minimizes transferable information while preserving valuation statistics; the unauthorized-use protection scheme actively poisons the utility of the dataset for unauthorized learning while preserving exact recoverability under a key. A plausible implication is that DIPR prevention should be selected according to the transaction model: valuation, public release, collaborative benchmarking, or fine-tuning all impose different threat surfaces.

4. Registration, watermarking, and tamper-aware assertion

Where preventive measures are insufficient or impossible, DIPR enforcement shifts to provenance, registration, and post hoc assertion. SecureRights is a representative architecture that combines blockchain, IPFS, digital watermarking, perceptual hashing, and QR codes to create a rights-assertion pipeline for images (Madushanka et al., 2024). Its workflow has two phases: registration and verification.

During registration, a user uploads an image $t_{host} \approx 147$9 and metadata, computes a perceptual hash

$\approx 306$0

and forms a “digital signature” tuple $\approx 306$1. The system then calls a smart-contract function registerImage(address owner, bytes16 imageID, string meta), which emits an ImageRegistered event containing the owner, image identifier, block hash, and timestamp. The on-chain block hash and owner signature are encoded into a $\approx 306$2 QR code $\approx 306$3, which is embedded into the image using a DCT-based floating-watermark algorithm $\approx 306$4. The resulting watermarked image $\approx 306$5 is stored in IPFS, and the $\approx 306$6 mapping is retained off-chain (Madushanka et al., 2024).

Verification reverses that process. The verifier retrieves $\approx 306$7 from IPFS, extracts the embedded QR code by inverse DCT, decodes the QR payload to recover the on-chain block hash and metadata, fetches the stored perceptual hash and owner from the blockchain, recomputes the perceptual hash of the image under test $\approx 306$8, and accepts structural identity if

$\approx 306$9

Tamper detection then proceeds through four independent layers: SSIM, ORB feature matching reported as Matching Feature Ratio, histogram comparison, and template matching with tamper-mask visualization (Madushanka et al., 2024).

The framework’s threat model includes a passive eavesdropper, an active tamperer, and a colluder who mixes multiple watermarked copies. Its security argument is that the perceptual hash is structure-based, the QR bits are spread across mid-frequency coefficients via $t_{\text{redirected}} \approx 151$0-scaled embedding, on-chain timestamping prevents back-dating or hash reuse, and collusion is resisted because different watermarked images encode different on-chain block hashes. The paper also sketches a statistical bound: across $t_{\text{redirected}} \approx 151$1 random JPEG compressions at $t_{\text{redirected}} \approx 151$2, “almost all” watermarks survive, yielding $t_{\text{redirected}} \approx 151$3 under the specified SSIM-preservation condition (Madushanka et al., 2024).

The reported performance numbers are concrete. DCT embedding or extraction on a $t_{\text{redirected}} \approx 151$4 image takes about $t_{\text{redirected}} \approx 151$5 ms on a $t_{\text{redirected}} \approx 151$6 GHz CPU; perceptual-hash generation takes $t_{\text{redirected}} \approx 151$7 ms; QR-code generation or scanning takes $t_{\text{redirected}} \approx 151$8 ms; IPFS pin or get takes about $t_{\text{redirected}} \approx 151$9 ms round trip; and the Ethereum gas cost for registerImage() is about $140$0 gas, estimated as about $140$1 at $140$2 gwei (Madushanka et al., 2024). The paper further states that the framework addresses unauthorized copying, proof of ownership, and dispute resolution, and aligns with WIPO’s recommendation for digital evidence and GDPR “right to integrity” via hash.

SecureRights shows that DIPR assertion need not rely on one signal alone. It couples robust watermarking, decentralized storage, immutable timestamps, and similarity-based validation. This suggests a general pattern in DIPR engineering: as the legal burden of proof rises, single-mechanism evidence becomes less attractive than layered provenance.

5. Generative AI, training-data attribution, and post-training evidence

Generative AI introduces a particularly difficult DIPR problem because copyrighted works may influence a model even when outputs are not exact replicas. The survey literature emphasizes that training datasets may comprise millions or billions of works scraped or licensed en masse; the legal and ethical issues include unauthorized training, exact or near-exact reproduction, distinctive style imitation, absent attribution, and uncompensated value extraction (Šarčević et al., 2024). The paper cites disputes such as Getty Images vs. Stability AI, involving $140$3 million images, and artists’ suits against Stable Diffusion and Midjourney. The technical response spans prevention and detection: de-duplication, caption modification, prompt rewriting, adversarial cloaking, concept erasure, forensic watermarking, analytical data attribution, and memorization testing (Šarčević et al., 2024).

CDI addresses the post-training evidentiary gap directly. Its starting point is that existing membership inference attacks on large diffusion models are too weak to determine the membership of individual images reliably (Dubiński et al., 2024). Instead of relying on a scalar membership score for a single image, CDI assumes a data owner controls a dataset $140$4 of suspected training points and performs dataset-level inference. Each image is mapped to a feature vector

$140$5

a logistic scoring model computes

$140$6

and the dataset-level score is the sample mean

$140$7

The decision is then cast as a one-sided two-sample test between a suspect set $140$8 and a withheld validation set $140$9 of equal size, with

$< 5$0

Welch’s $< 5$1-test is applied to the two score vectors, the random split is repeated $< 5$2 times, and the arithmetic mean of the $< 5$3 $< 5$4-values is used for the final decision; at significance level $< 5$5, the model is declared to have used the dataset if $< 5$6 (Dubiński et al., 2024).

The empirical claims are strong and narrowly specified. For individual-image MIAs on large diffusion models, TPR@FPR=$< 5$7 “barely exceeds $< 5$8–$< 5$9.” CDI, by contrast, achieves $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$0 with as few as $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$1 suspect samples for U-ViT256-T2I-Deep, and with fewer than $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$2 samples for all eight evaluated models; confidence curves fall below $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$3 at model-dependent thresholds between $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$4 and $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$5 samples (Dubiński et al., 2024). Feature ablation reportedly reduces the required sample size by an order of magnitude when novel features such as Gradient Masking, Multiple Loss, and Noise Optimization are added. The contamination study further reports that CDI still rejects $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$6 when up to $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$7–$$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$8 of the suspect set are non-members, provided the dataset is large enough. The gray-box setting, where only noise predictions are available, remains viable with about a $$\mathcal E_I(\tilde x,x)=\frac{1}{\mathbb D(\tilde x,x)},$$9 increase in the required sample count.

The deployment model is deliberately institutional. A data owner provides a publicly exposed suspect set $\mathbb D$0 and a withheld set $\mathbb D$1 from the same distribution to a trusted arbitrator; the arbitrator runs CDI in gray-box or white-box mode and returns a single $\mathbb D$2-value. If $\mathbb D$3, the arbitrator may issue a certificate stating that, with more than $\mathbb D$4 confidence, $\mathbb D$5 was included in the training data of the suspect model (Dubiński et al., 2024). Feature extraction per batch of $\mathbb D$6 images takes $\mathbb D$7 to $\mathbb D$8 seconds on an A100, while logistic-regression training is negligible. The paper presents this as evidence suitable for copyright litigation and as a complement to watermarking and model fingerprinting.

A key conceptual shift follows from CDI. DIPR enforcement in generative AI cannot be reduced to spotting memorized replicas. The literature suggests a broader evidentiary logic: ownership claims may rest on aggregated, distributional, and statistically tested signals across datasets, not only on one-to-one copying of visible outputs.

6. Judicial construction and doctrinal debates

The Chinese-courts literature treats DIPR not merely as a technical challenge but as an evolving doctrinal object shaped by judicial discourse. The term itself is traced to recent Chinese policy texts, including the “Outline for Building an Intellectual Property Powerhouse (2021–2035)” and the “National Intellectual Property Protection and Use Plan for the 14th Five-Year Plan” (Lou, 23 Sep 2025). The paper argues that Chinese courts have developed DIPR through two complementary discourses: a judicial continuation discourse in local courts and a judicial linkage discourse in the Supreme People’s Court.

The continuation discourse, exemplified by the Zhejiang High People’s Court, extends existing IP norms pragmatically to data disputes where legislation is silent. Its legal bases include Articles 2 and 17 of the Anti-Unfair Competition Law, Article 127 of the Civil Code on personal information, and analogies to the Copyright Law and Patent Law. Its doctrinal innovations include recognition of “originality” and “intellectual labor” in data compilations, the five-factor theory for unfair competition—data circulation value, innovation incentives, technological protection measures, systemic security, and personal information safeguards—and scenario-based review of crawling protocols such as robots.txt, rather than strict liability (Lou, 23 Sep 2025).

The paper’s principal case study is Taobao v. Meijing. The Hangzhou Internet Court introduced a tripartite classification of network user information, original network data, and derived data products, recognized proprietary interests in derived data, and declined to confirm full property rights. The Hangzhou Intermediate Court disentangled “personality” from derived data and reduced transaction costs. On retrial, the Zhejiang High Court applied creative-labor theory to reject Meijing’s claim of original contribution (Lou, 23 Sep 2025). The paper characterizes this multi-tier evolution as a doctrinal “conveyor belt,” which is important because it shows DIPR doctrine emerging incrementally rather than through a single legislative declaration.

The linkage discourse of the Supreme People’s Court is more policy-facing. It uses a metaphorical register to align adjudication with state policy and administrative governance, arguing that data property rights have “strong intellectual property attributes” and calling for “judicial protection” linked with “administrative protection” to form a “comprehensive pattern” (Lou, 23 Sep 2025). Two interpretive instruments are central. The Facial Recognition Interpretation of 2021 introduced five exemptions for reasonable personal-information use ahead of the Personal Information Protection Law, functioning mainly as an external signal for regulators and compliance. The Anti-Unfair Competition Law Interpretation of 2022 uses the modalities “may” and “should” in Article 3 on business ethics, thereby balancing business-subject discretion with stakeholder-oriented concern for consumers and the public interest.

The paper formalizes the interaction of these discourses as bidirectional conceptual coupling:

$\mathbb D$9

“Inside-out” projection denotes local case-based reasoning informing broader doctrine; “outside-in” translation denotes policy and administrative rules being translated into judicial norms (Lou, 23 Sep 2025). The coupling both legitimizes and constrains courts and policymakers, supporting unified market standards while guarding against platform monopolization. The 2025 revision of the Anti-Unfair Competition Law, especially Article 13 on using data to obstruct lawful services and abuse of platform rules, is presented as an example of this coupling in legislation.

This judicial account corrects another common misconception: DIPR in China has not emerged as an absolute, fully codified property right in data. The cases instead show a cautious, hybrid construction in which proprietary interests, unfair competition, public welfare, and personal-information safeguards are jointly negotiated. DIPR here is less a fixed entitlement than a doctrinal field under active institutional coordination.

7. Open problems and research directions

The literature converges on the view that DIPR requires defense in depth, but it also exposes substantial technical and doctrinal gaps. In generative AI, unresolved issues include cross-model transferability of perturbation and watermarking methods, resilience against denoising and purification attacks, precise definition of “style” or “concept,” benchmark standardization, and the tension between model confidentiality and evidentiary transparency (Šarčević et al., 2024). The survey also emphasizes policy questions around opt-out mechanisms, provenance logs, and collaboration among data owners, platforms, AI developers, and legal experts.

Method-specific limitations reinforce these broader concerns. Redirect2Own depends on client-side deployment, leaves some server-side features unavailable, and may face adversarial platform detection of QR-code placeholders (Kontaxis et al., 2018). IPProtect provides no formal differential-privacy guarantee, relies on per-image iterative optimization whose cost scales linearly with dataset size, and remains focused on supervised vision rather than text, tabular data, or unsupervised valuation (Singh et al., 2022). The unauthorized-training defense based on feature-space perturbation and reversible transformation has not been tested against all strong denoising or adversarial-training-style defenses and introduces key-management dependencies (Xue et al., 2021). CDI reduces evidentiary uncertainty for diffusion-model training data, but still presumes access to enough publicly exposed and withheld samples, as well as either white-box or gray-box interaction through a trusted arbitrator (Dubiński et al., 2024).

A further research boundary lies between protecting data and protecting models. The dataset-protection literature identifies the relative neglect of dataset rights compared with model watermarking (Xue et al., 2021), while passport-based ownership verification shows that non-invertible model ownership evidence can be embedded into a DNN’s inference path to defeat ambiguity attacks (Fan et al., 2019). This suggests that future DIPR systems may need coordinated protection of both the training corpus and the trained artifact, especially in MLaaS and foundation-model settings where data provenance and model ownership disputes are intertwined.

Taken together, these works portray DIPR as a composite field spanning contractual control over hosted content, preventive sanitization and poisoning defenses, blockchain-backed provenance, statistical dataset inference for model-training claims, and hybrid judicial doctrine. The field’s central tension is stable across domains: data must circulate to create value, yet circulation without enforceable technical and legal controls can collapse practical ownership into mere nominal entitlement.