Andersen v. Stability AI Ltd.

Opinion

SARAH ANDERSEN, et al., Case No. 23-cv-00201-WHO (LJC)

Plaintiffs, ORDER GRANTING DEFENDANTS’ v. REQUEST REGARDING DISCLOSURE TO DR. ZHAO STABILITY AI LTD., et al., Re: Dkt. No. 300 Defendants.

Before the Court is the parties’ joint discovery letter regarding disclosure of highly confidential materials to Plaintiffs’ expert, Dr. Ben Yanbin Zhao. ECF No. 300. Defendants object to Plaintiffs disclosing highly confidential material designated as “ATTORNEYS’ EYES ONLY” or “HIGHLY CONFIDENTIAL – SOURCE CODE” to Dr. Zhao. Plaintiffs wish to be able to disclose highly confidential material to Dr. Zhao, who, they contend is “one of the preeminent researchers in” the field of AI image generation and thus an invaluable expert. Id. at 300. Dr. Zhao is a computer science professor at the University of Chicago who researches generative AI and machine learning. ECF No. 300-1 (Zhao Decl.) ¶¶ 1-2. As part of his academic research, Dr. Zhao leads the Glaze Project, a “research effort that develops technical tools with the explicit goal of protecting human creatives against invasive uses of generative artificial intelligence[.]” Id. ¶ 6. These tools include Glaze, “a tool that makes subtle changes to digital artwork to prevent AI models from accurately mimicking an artist’s unique style[,]” and Nightshade, “a tool that alters core image data, causing AI models that train on these images to produce distorted or incorrect outputs for certain prompts[.]” ECF No. 300 at 2. Defendants disclosing their source code and other highly confidential material to someone who they believe could use it “to more effectively harm Defendants’ products and companies.” Id. at 5. “A witness who is qualified as an expert by knowledge, skill, experience, training, or education” may provide opinion testimony if their testimony “will help the trier of fact” understand the evidence or “determine a fact in issue[.]” Fed. R. Evid. 702. “In the ordinary course of litigation, a party is owed some degree of deference in retaining and preparing an expert with the relevant industry experience and availability.” GPNE Corp. v. Apple Inc., No. 12-cv- 2885, 2014 WL 1027948, at *1 (N.D. Cal. Mar. 13, 2014) (quotations omitted). But that interest “must be balanced against…[the] risk of improper use or disclosure[.]” Id. While there is “no bright-line rule for expert disqualification,” courts must balance the “risk of competitive harm arising from disclosure…against the showing made as to the need for the particular expert or consultant to access the confidential information.” Kane v. Chobani, Inc., No. 12-CV-02425, 2013 WL 3991107, at *5 (N.D. Cal. Aug. 2, 2013) (quotations omitted); Tomahawk Mfg., Inc. v. Spherical Indus., Inc., 344 F.R.D. 468, 473 (D. Nev. 2023). The parties’ Protective Order establishes that the party “opposing disclosure to the Expert shall bear the burden of proving that the risk of harm that the disclosure would entail (under the safeguards proposed) outweighs the Receiving Party’s need to disclose the Protected Material to its Expert.” ECF No. 276 ¶ 7.4. The Court addresses these two factors—the risk of harm that disclosure to Dr. Zhao may cause Defendants and Plaintiffs’ need to disclose highly confidential information to Dr. Zhao—in turn. Defendants argue that disclosing their highly confidential material, including source code and training data, to Dr. Zhao “raises serious competitive concerns” as Dr. Zhao’s research focuses on developing tools that actively undermine their models.1 ECF No. 300 at 5. Plaintiffs contend that Dr. Zhao is not an “actual competitor” of Defendants because he is an academic researcher whose work is funded by grants and is not competing “for the same dollars from the

1 They also argue that the protective order directly bars Dr. Zhao from being designated as an expert, as it prohibits past or current employees of a “Party or of a Party’s competitor” from service as an expert. ECF No. 276 ¶ 2.7. As the protective order does not define “competitor,” same target audience” as Defendants, and thus there is little risk of competitive harm. ECF No. 300 at 3 n.1; Los Angeles Cnty. Med. Ass’n v. Aetna Health of California, Inc., No. CV1211020, 2013 WL 12146515, at *3 (C.D. Cal. Apr. 29, 2013) (defining “direct competitors” in the consumer protection context as “those who vie for the same dollars from the same consumer group”). They further argue that accessing Defendants’ highly confidential materials “would provide zero substantive benefit” to Dr. Zhao’s academic research as he could not determine whether Defendants “detected and removed” Nightshade-protected images or implemented countermeasures against his tools “through examination of source code or training data.” ECF No. 300 at 3. The Court disagrees with Plaintiffs’ argument that Dr. Zhao is not a competitor because he is an academic researcher rather than part of a company that directly competes “for the same dollars” as Defendants. Id. at 3 n.1. His work is “in functional competition with Defendants” as he develops tools that attack Defendants’ generative AI models. Id. at 5; see Voice Domain Techs., LLC v. Apple, Civil Action No. 13-40138, 2014 WL 5106413, at *4 (D. Mass. Oct. 8, 2014) (“Even where parties are not traditional competitors in the market place, an individual may still be deemed a [competitor] where the parties are in an adversarial posture and the individual receiving the highly confidential information would be especially situated to take position that are directly harmful and antagonistic to the defendant.”) (citation modified). Dr. Zhao attests that his tools teach generative AI models to make mistakes: a model trained on enough Glaze- or Nightshade-modified images might produce an image in the style of Jackson Pollock when prompted to produce a realistic charcoal portrait or produce an image of a leather purse when prompted to draw a cow. Zhao Decl. ¶¶ 10-11. As Dr. Zhao researches and creates tools that make generative AI models such as Defendants’ less reliable, his work impacts “Defendants’ ability to operate in the marketplace.” 2 ECF No. 300 at 5; see Tomahawk Manufacturing, 344 F.R.D. at 471-72 (identifying that “special concerns arise when prospective experts or consultants 2 Plaintiffs argue that Dr. Zhao’s tools only undermine Defendants’ models “insofar as Defendants misappropriate artists’ work” and thus do not pose a cognizable competitive risk. ECF No. 300 at may themselves be competitive with the disclosing party’s business”). The Court credits Dr. Zhao’s attestation that “development of Glaze and Nightshade is, for all intents and purposes, complete” and that accessing “Defendants’ training data information would not benefit [his] development of Glaze or Nightshade.” Zhao Decl. ¶¶ 12, 17. But Dr. Zhao has not agreed to cease developing other so-called “data-poisoning tools” during the course of this litigation or to cease researching how to make image-generating AI models less effective. Id.; ECF No. 300 at 6 n.12. This is, of course, a wholly legitimate choice, but one that implicates Dr. Zhao’s ability to review Defendants’ highly confidential materials in this case. Per Plaintiffs, Dr. Zhao’s focus is on “adversarial machine learning and tools to mitigate harms of generative AI models[.]” ECF No. 302-6 at 2. Akin to GPNE, Dr. Zhao has researched and developed tools that work at cross-purposes with Defendants’ models “[i]n the very recent past,” and “there has been no representation or agreement that he will not do so again in the very near future.” 2014 WL 1027948, at *2. His research puts him in an “adversarial posture” vis-à-vis Defendants such that “the information to which he would be exposed as an expert in this case could influence his” ongoing and future work “protecting human creatives against invasive uses of generative artificial intelligence[.]” Voice Domain, 2014 WL 5106413, at *4; GPNE, 2014 WL 1027948, at *2; Zhao Decl. ¶ 6. This is in no way to suggest that Dr. Zhao would intentionally misuse information obtained during this litigation, but instead recognizes that “even if he were to make his best efforts to cabin the information off in his mind,” the highly confidential information may “become intertwined with his other knowledge such that” it may be disclosed “in the course of his future work[.]” GPNE, 2014 WL 1027948, at *2; Symantec Corp. v. Acronis Corp., No. 11-5310, 2012 WL 3582974, at *2 (N.D. Cal. Aug. 20, 2012).3 The Court accordingly finds that Defendants have demonstrated that disclosing their highly confidential information to Dr. Zhao poses a risk of harm. Given the risk of harm to Defendants, Dr. Zhao must have “unique knowledge within” the field of AI image generation to review Defendants’ materials designated as highly confidential. Symantec, 2012 WL 3582974, at *2. Defendants recognize that Dr. Zhao is qualified to serve as an expert but argue that he does not have “unique qualifications that other experts could not provide.” ECF No. 303 at 1; GPNE, 2014 WL 1027948, at *1. The Court agrees. AI image generation is a relatively new field, and the Court accepts, as Plaintiffs argue, that the pool of “qualified experts in AI image generation not employed by direct competitors” of Defendants is small. ECF No. 300 at 4. But Defendants demonstrate that it is not “such a niche field that there is only one qualified expert.”4 ECF No. 303 at 2. Defendants point to numerous academic papers addressing text-to-image generation; they reason that, between the hundreds of authors of these papers, it is not feasible that “Plaintiffs couldn’t find anyone with the ability to explain how generative image models behave” aside from Dr. Zhao. ECF No. 303 at 2. To illustrate their point, Defendants note that one of Dr. Zhao’s former students, Dr. Emily Wenger, had recently been disclosed as an expert on AI image generation a parallel generative AI case. ECF No. 303 at 2. (Dr. Wenger has since been designated as an expert in that case, over the defendants’ objections. In re Google Generative AI Copyright Litigation, No. 23-cv-03440-EKL, ECF No. 172 at 1-2 (N.D. Cal. July 10, 2025).) That another academic has been designated as an expert regarding the same topic in a similar case strongly supports Defendants’ point that there is more than “one qualified expert” and Dr. Zhao, although qualified, is not uniquely qualified to “help the Court and the jury in understanding how generative image models memorize, output, and infringe copyrighted work.” 5 ECF Nos. 303 at 2; 302 at 3. The Court accordingly finds that the risk of harm to Defendants outweighs Plaintiffs’ need to disclose Defendants’ information designated as “ATTORNEYS’ EYES ONLY” or “HIGHLY CONFIDENTIAL – SOURCE CODE” to Dr. Zhao. ECF No. 300 at 1; see GPNE, 2014 WL

4 Plaintiffs’ own briefing does not contradict this. They claim that “Dr. Zhao is not merely one among several qualified experts” but then explain that he is “one of the preeminent researchers in his field” and there are a “few independent experts” of his caliber. ECF No. 302 at 2, 3 (emphasis added). 5 For the avoidance of doubt, the Court takes no position on whether or not it would designate Dr. Wenger as an expert in this case if Plaintiffs were to retain her or Dr. Wenger were to agree to serve as an expert. See ECF No. 309 at 2. That dispute is not before the Court. The Court 1 1027948, at *2. Defendants’ request that any information so designated shall not be disclosed to 2 Dr. Zhao is granted. 3 5 Dated: July 14, 2025 6 7 Won, | hee L . CIS OS 8 Uhiged States Magistrate Judge 9 10 11 a 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28