What Survives Termination? Embeddings, Weights and Deletion in a Chinese Case Law Licence

Almost every data licence ends with a sentence in the same shape: on expiry or termination the licensee shall delete the licensed data and all copies and derivatives thereof, and certify that deletion in writing within thirty days. Price gets three rounds of negotiation, scope gets a schedule, and this gets a nod.

For a retrieval product built on case law it is not housekeeping; it is a description of what happens to your system. You do not consume a judgment corpus and discard it the way you consume a price feed. You chunk it, embed it, index it, cache it, cite it, and ship the citation into an answer that lands in someone else's log. By the time the term ends the corpus is in nine or ten places, most of which the sentence does not name and several of which you do not control.

Where one licensed judgment actually lives

Before arguing about what counts as a derivative, inventory the surfaces. In a typical retrieval product, one licensed judgment ends up in roughly these places.

The first three rows are what both sides picture when they sign. The rest are what the covenant actually reaches, and the further down you read, the less of it you can perform. Everything below argues about specific rows.

Your vector store is a copy, not a derivative

Start with the common misconception, because “we only keep embeddings” is usually false as a description of the stack before it is even interesting as a question of construction. Retrieval systems have to show the passage they retrieved — that is the point of grounding an answer in a citation — and to show it, something stores it. Whether that something is the vector store varies by product, and the documentation is explicit:

• Chroma stores both. Its documentation on adding data states that if you have already computed embeddings, you pass them alongside documents, and “Chroma will store both as-is without re-embedding the documents.”
• Elasticsearch stores the document you indexed. Its mapping reference for _source is unambiguous: “The _source field contains the original JSON document body that was passed at index time.” Turning it off is documented as a space-saving measure with warnings attached, not as the norm.
• Pinecone does not imply it. Text lives there only if your ingest code put it in metadata, which the documentation caps at “40KB of metadata per record”.

That third case is why this is worth writing down. The honest answer to “do we still hold the licensed text” is not a policy position; it is a fact about a line of ingest code written eighteen months ago, which the person negotiating the clause has usually not read.

Chunking then makes the payload larger than the original, not smaller: overlapping windows store the boundary regions twice. A sliding window of size s and overlap v writes about s ÷ (s − v) characters per character of source. Over a hundred thousand characters:

# reproduce the table above
def spans(n, size, ov):
    out, i = [], 0
    while i < n:
        out.append((i, min(i + size, n)))
        if i + size >= n: break
        i += size - ov
    return out

N = 100_000
for size, ov in [(1000,200), (512,128), (1500,200), (512,64), (4000,200)]:
    s = spans(N, size, ov)
    stored = sum(b - a for a, b in s)
    print(size, ov, len(s), stored, round(stored / N, 3))

So at ordinary production settings the vector store holds no reduced representation of the corpus. It holds more of the licensed text than the delivery did, plus vectors. A clause carving out “derived representations” and assuming that protects the search stack has, in most implementations, carved out nothing.

“Embeddings are not the text” is a claim with a literature against it

Now the harder case: suppose you did the disciplined thing and kept vectors only, no chunk text. Is that a derivative you may keep? Do not settle it with intuition about irreversibility, because the published work runs the other way. Morris, Kuleshov, Shmatikov and Rush, in “Text Embeddings Reveal (Almost) As Much As Text” (EMNLP 2023), frame inversion as controlled generation and report that “a multi-step method that iteratively corrects and re-embeds text is able to recover 92% of 32-token text inputs exactly”. The same paper reports recovering “important personal information (full names) from a dataset of clinical notes”.

Two limits, stated because the authors state them: the headline result is at short input lengths, and the method assumes access to the embedding model. Neither is exotic here — retrieval chunks are short by construction, and the embedding model is normally a named commercial endpoint or an open checkpoint.

What follows from that is narrower than it looks, and it is not a legal conclusion. It is this: neither side can treat “it is only vectors” as self-evidently outside the licence. If vectors are to survive termination, that has to be a written decision with the embedding model named, not an assumption smuggled in as a technical fact. A supplier who lets it pass unnamed has agreed to something without knowing it, and so has a buyer who relies on it.

Weights are the same question with more money on it

Fine-tuning or continued pretraining produces an artefact whose commercial life outlasts the contract. If the covenant says derivatives must be deleted and means it, the model you shipped dies with the licence, and so does every customer deployment carrying it — a roadmap consequence usually discovered in the month it becomes unfixable.

The evidence has the same shape as for embeddings. Nasr, Carlini and co-authors, in “Scalable Extraction of Training Data from (Production) Language Models”, report that an adversary “can extract gigabytes of training data from open-source language models like Pythia or GPT-Neo, semi-open models like LLaMA or Falcon, and closed models like ChatGPT”, that their divergence attack made an aligned production model “emit training data at a rate 150x higher than when behaving properly”, and that “current alignment techniques do not eliminate memorization”.

Read that as a comment on the negotiation, not the ownership question. The supplier's worry — that the corpus leaves inside the weights — is not paranoia; the buyer's position — that a trained model is a new thing, not a copy — is not free. Both argue from a premise the literature makes contestable, and contestable premises nobody writes down are what become disputes in month thirty, when the model is in production and the leverage has moved.

The workable move is to stop arguing about the ontology of a weight and price the two outcomes instead. A licence under which trained artefacts survive is a different commercial object from one under which they do not, and both parties should be able to say which one they signed. Of everything in a data term sheet, this is the clause most worth paying to change.

Delete is not erase, and sometimes it is not even possible

Three independent failures hide inside the word “delete”.

Deletion marks; merging erases

In Lucene-backed indexes, deleting a document sets a flag. Elastic's merge documentation describes the mechanism without euphemism: “Smaller segments are periodically merged into larger segments to keep the index size at bay and to expunge deletes.” Between the delete call and the merge that expunges it, the bytes are on disk. A certificate signed on day thirty is accurate about the API calls and silent about the segments. If the clause wants physical removal it must say force-merge or reindex; if logical deletion suffices it should say so. Most say neither, so neither party knows what was certified.

Backups you cannot reach into

A thirty-day delete-all-copies covenant collides with your own retention schedule, and where that schedule is immutable the collision is absolute. AWS documents S3 Object Lock compliance mode plainly: “a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account”, adding that “the only way to delete an object under the compliance mode before its retention date expires is to delete the associated AWS account”. Where a regulated buyer holds backups that way — often at the insistence of the same regulator whose examinations made the corpus worth licensing — the thirty-day promise is unperformable the day it is signed. What is performable: not to restore, to let the copies age out, and to certify the date the last one does.

Copies held by people who never saw the contract

Retrieved passages travel. Send them to a hosted model and the provider's retention applies: OpenAI documents that “by default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days”. Windows and controls differ by provider and contract, and zero-retention arrangements exist; the point is only that the surface exists and your covenant flows through to a policy you do not set. Further out sit answers your product already delivered and whatever customers exported from them. No clause with a data supplier reaches those, and one that purports to is one you will breach quietly and permanently.

Write a wind-down schedule, not a deletion sentence

The repair is unglamorous: replace the sentence with a table in the agreement — one row per artefact class, columns for disposition, deadline and evidence. Something in this shape.

Four things that table does which the sentence cannot. It makes the buyer disclose retention windows instead of promising around them. It forces the vector and weight decisions while both parties still want the deal, not once one has stopped wanting it. It separates deletion from certification of deletion, two acts with two evidence requirements. And it puts the excluded surfaces in writing, so nobody discovers at termination that the covenant was unperformable from the day it was signed. The same instinct applies to the artefacts an evaluation produces: an unnamed artefact defaults to whoever holds it when the relationship turns.

Five questions to settle before signature

1. Does the store you index into hold the passage text, and where in the code was that decided? Answer with a schema, not a policy.
2. If embeddings survive, which embedding model and version? And does the answer change when you re-embed with a different one next year?
3. Do trained artefacts survive, and is the answer different for models already running in a customer's environment? If both cases share one answer, one of them is wrong.
4. What is the backup retention window, is any of it immutable, and on what date does the last copy actually age out? A date, not a duration.
5. What does the certificate certify? That deletion commands were issued, that a subsequent read returns nothing, or that the bytes are gone. Three different signatures, and only the third is what the other side pictured.

If either party gives a sentence where a date or a name belongs, that is the finding — a cheap one, because all five can be asked before the pilot starts rather than after it succeeds.

What this page does not settle

It contains no legal conclusions and is not legal advice. Everything above concerns what systems do and what a document should therefore name. Whether an embedding, an index or a set of weights is a copy, a derivative work or neither is a question for counsel, varying with governing law and the words in front of you.

We are the supplier, and most of this argues against us. Forcing the vector and weight decisions at signature removes a supplier's option to leave them open and settle later, when the buyer has less leverage. That is deliberate: it is the shape we would want from the other side of the table.

It is not a claim about our own paperwork. This page does not assert that our agreements currently contain a schedule in this form, and is not published as a feature. It is a specification argued from what breaks without one.

We have not audited anyone's stack. The first table lists surfaces a retrieval system generally has; which exist in a given deployment is answered by reading the ingest path, not the architecture diagram.

The cited research is cited for what it measured. Both results hold under conditions their authors state — short inputs, model access, particular attacks. They establish that “it cannot be recovered” is not free. They do not establish that any specific system leaks.