That’s an example of a two way lossless transformation. The data is certainly encoded in cypher text and is directly retrievable and has no other purpose than to contain the original data. The model you can’t directly retrieve the original data, and it has more purposes than producing the original. It requires you to specifically manipulate it to produce the copyrighted material, and just because copyrighted material was used to train it doesn’t mean it can even reproduce a facsimile.

I think a better counter example is mpeg and other lossy formats. But again, the format does nothing but carry the original even if it’s not a perfect reproduction. You can’t use it in any other way. Its expressed intent is the reproduction of the copyrighted material with no modification or improvement or derivation. These models are not trained with the intent or purpose of only producing the copyrighted materials. It requires your specific action to induce the reproductions if it’s even possible, but it generally serves other purposes in all other uses.

This is more like a xerox than not - you can certainly violate copyright with a xerox. But the existence of the xerox itself isn’t to violate copyright. It’s for other purposes. The ambiguity obviously comes in that a xerox machine wasn’t built by scanning all documents on earth first. But I think the very act of mixing all the other images and documents together into the model, which again, is just a statistical aggregate of everything that was trained with mushed together, turns it into at worst a derived work that falls under fair use.