Deepfakes, Scraped Art, Consent: The Ethical Reckoning of Diffusion Models

Somewhere in the weights of every major image model sits a ghost of a painting its creator never agreed to hand over. We built a generation of Diffusion Models on a simple assumption: that anything visible on the open web was, by default, available for training. The bill for that assumption is arriving now — in three courtrooms, two legislatures, and a growing community of artists who would rather poison the pipeline than petition it.

The Question We Skipped Before Building

Before the first open-weights release, before the first viral deepfake, before the first class action, there was a question nobody quite asked in public: who had the right to be in the training set? The scraping scripts did not pause to ask. The research papers did not stop to debate. By the time the question became urgent, the weights already existed, and weights are difficult to un-bake.

The technical vocabulary makes the moral question easier to skip. Modern image models descend from Denoising Diffusion Probabilistic Models and are typically trained with a U-Net or a Diffusion Transformer backbone, steered at sampling time by Classifier-Free Guidance and run under a Noise Schedule with methods like DDIM. Newer objectives such as Rectified Flow and Flow Matching change the math but not the premise. The premise is always the same: show the model enough human images, and it will learn to produce new ones. The ethical question is what “enough” was ever allowed to mean.

The Case That Sounds Reasonable

The defense of unrestricted training is not a straw man. It has a real intellectual spine. Human artists learn by looking at other artists; models, the argument goes, are doing a statistical version of the same thing. The open web was indexed for search without individual permission, and that indexing produced an unprecedented democratization of information access. Applied to diffusion models, the same logic says training on public images is a transformative use that produces new works, not reproductions. At its most generous, this is a case about keeping powerful tools out of the hands of incumbents who would otherwise license only to themselves.

There is a practical strand too. Every major image model in production today was trained under the old permissions regime. Rolling that back retroactively would not punish the architects so much as break the tools that millions of small creators now rely on. That cost is real, and the reckoning has to carry it honestly rather than pretend it away.

What the Steelman Quietly Assumes

The steelman works only if one hidden assumption holds: that publishing something for a human audience implicitly licenses a machine audience too. That conflation is the whole move. It was never argued in any legislature, never ratified in any treaty, never put to the artists themselves. It was assumed away, not argued away.

The courts are starting to take the assumption apart, though carefully. In Andersen v. Stability AI, Judge Orrick let copyright and induced-infringement claims against Stability AI, Midjourney, DeviantArt, and Runway survive a motion to dismiss in August 2024; a jury trial is scheduled for September 2026 (Copyright Alliance). The UK High Court ruled in November 2025 that model weights are not themselves “infringing copies” under UK law — but Getty had already abandoned its primary training claim mid-trial because it could not prove training happened inside UK jurisdiction (Ropes & Gray). That is a narrow ruling about location, not a verdict on whether training on copyrighted images is acceptable. The question the industry hoped the courts would quietly close is still very much open.

Borrowing a Lens From Another Century

We have been here before. Every time a reproduction technology arrives, it outruns the consent framework built for the previous one. Photography forced a new conversation about likeness. Recorded sound forced a new conversation about performance. File-sharing forced a new conversation about distribution. In each case, the technical capability came first and the moral grammar caught up later — often decades later, often only after harm.

Diffusion belongs to this lineage, with a twist. Earlier reproduction technologies copied a specific work. Diffusion models absorb the statistical essence of a corpus and re-emit it on demand. That is not a photocopier. It is closer to a dialect learned from a community that never voted on becoming a training corpus. The right reference class is not copyright law in its present form. It is the long history of asking, sometimes too late, whether the people whose lives feed a new technology should have had a seat at the table before it was built.

The Real Reckoning

Thesis (one sentence, required): The diffusion debate is not really about images — it is an early stress test for whether digital consent can be designed back into a system that was architected without it.

The current moment is a convergence of four pressure fronts: litigation, legislation, dataset hygiene, and artist-side technical defense. Each is doing work the others cannot. Litigation tests whether existing copyright categories fit a new economy of statistical reproduction. Legislation acknowledges harms that copyright alone cannot address. The TAKE IT DOWN Act was signed into US law in May 2025, requiring platforms to remove non-consensual intimate imagery within 48 hours of victim notice (TIME). The DEFIANCE Act, which would give survivors a civil cause of action, passed the Senate by unanimous consent but has not been signed as of April 2026 (Reality Defender). And Article 50 of the EU AI Act makes deepfake disclosure and AI-content labeling enforceable on August 2, 2026 (EU AI Act portal) — a deadline that is months away, not years. These are imperfect instruments. They are also the first serious attempt to treat generative output as a category deserving its own governance, rather than an edge case of older frameworks.

Tools That Ask a Different Question

On the defensive side, something quieter is happening. Stanford Internet Observatory researchers identified thousands of suspected CSAM links in the LAION-5B dataset used to train early Stable Diffusion releases (404 Media); LAION pulled the dataset, and a cleaned Re-LAION-5B was released in August 2024 (LAION Blog). Spawning’s Do Not Train registry records roughly 80 million opted-out artworks — a small fraction of LAION-5B’s 2.3 billion images, but an infrastructural beginning (MIT Technology Review). The University of Chicago’s Glaze and Nightshade tools have been widely downloaded by artists who would rather cloak or poison their own work than trust the opt-out (MIT Technology Review). Content Credentials v2.2 shipped in May 2025 (C2PA Specifications), and the Samsung Galaxy S25 became the first consumer phone to sign images at capture (Content Authenticity Initiative). None of these is a solution. Together, they are consent treated as architecture — early attempts to build the layer the original pipelines never had.

Where This Argument Is Weakest

The honest vulnerability of this essay is that consent at web scale may be genuinely unworkable. If opt-in becomes the norm, only a handful of well-resourced labs will be able to license enough data to train competitive models, and the democratization the steelman invokes will collapse into oligopoly. I do not think that is a reason to keep scraping without asking. I do think it is a reason to be modest about any solution that sounds clean on a slide. If someone can show me an opt-in regime that does not concentrate power into three or four companies, I will reconsider this argument in full.

The Question That Remains

The diffusion reckoning is not a question of whether image models should exist. It is a question of what kind of consent infrastructure we are willing to build around technologies that learn from us faster than we can negotiate with them. Who bears the cost of getting that architecture right — and who gets to live with the defaults if we don’t?

Ethically, Alan.