Your Directory, Your Study Guide, Someone Else's Site: What Content Fingerprints Can Prove for an Association

A professional society publishes its member directory, a salary survey report and a free study guide for its certification exam, and a year later a near copy of one of them turns up on a commercial site or in a chatbot’s answer. Staff need to show the material came from the society, and the board will ask whether that would matter in court. Content fingerprinting is much stronger on the first question than on the second.

What follows is general information, not legal advice: it reports papers and opinions as of the dates given and cannot predict how a court would treat your facts, so a lawyer should see the specifics.

A sheet with one row per fingerprint

Fill in the last column before anything goes missing.

Fingerprint	What it can show	What it cannot show	Where an association might use it
Exact hash	A file is a byte-for-byte copy of yours	Who made the copy or put it there	Each released edition of the study guide or a standard
Similarity match (perceptual hash or text embedding)	Two items are close enough for a person to compare	That copying happened; looser matching adds false hits	Survey report text, course slides, conference photos
AI text watermark	Text came from a model that applied the mark	Anything about text people wrote; paraphrase often removes it	Only text your own AI tools generate
Trap entry	An inference that someone copied	That the copying was infringement	Directory listings and buyers’ guide entries

Reading the two hash rows of the sheet

NIST AI 100-4 calls hashes “digital fingerprints,” identifiers “that can be predictably generated from the content itself.” Hany Farid’s overview in the Journal of Online Trust and Safety gives the weakness of exact, or “hard,” hashes: they are highly distinct but “not resilient to even the smallest change in the underlying media file.”

Perceptual hashes give similar content similar values, so a resized or re-saved copy can still match, and Farid states the cost: widening the match threshold “increases the true positive rate, but also increases false positives,” and the approach is “vulnerable to counterattack by those seeking to avoid detection.” For text, the comparable tool is an embedding search. Sentence-BERT, presented at EMNLP 2019, cut the time to find the most similar pair in a collection of 10,000 sentences from about 65 hours with BERT to about 5 seconds. That is a speed benchmark rather than a measured rate of catching copies, and every flagged pair still needs a person to read both passages.

Why the watermark row is so narrow

NIST’s report defines a digital watermark as information encoded “into the content itself,” usually made hard to remove, and then says “most current watermarking schemes have been consistently found vulnerable to removal,” noting that having a separate model paraphrase watermarked text often strips the mark. Kirchenbauer and colleagues at ICML 2023 proposed steering a model toward a randomized set of “green” tokens as it writes, detectable from spans “as few as 25 tokens.” Because it acts during generation, it can mark what your own AI tool drafts, not a report your staff already wrote.

Planted entries, from maps to model training

Researchers have carried planted entries into AI training: at ICML 2024, Meeus, Shilov, Faysse and de Montjoye inserted invented “copyright trap” sequences into the training text of a 1.3-billion-parameter model trained from scratch, and medium-length traps repeated 100 times were not detectable with existing methods, while longer sequences repeated many times were detected with an AUC of 0.75. Neither result means a fake listing in your directory would reveal whether a model trained on it.

What courts have done with this kind of evidence

A hash authenticates a copy. Federal Rule of Evidence 901(a) asks for evidence “sufficient to support a finding that the item is what the proponent claims it is.” Rule 902(14), added in 2017, covers data copied from a device, storage medium or file and “authenticated by a process of digital identification,” with a qualified person’s certification, and its Advisory Committee note says “identical hash values for the original and copy reliably attest to the fact that they are exact duplicates.” The same note draws the line: the rule “is solely limited to authentication,” and the other side can still raise hearsay, relevance and “whether the information on the hard drive was placed there by the defendant.” Put plainly, 902(14) authenticates a copy but does not prove who placed the data.

Planted entries prove copying, which is not the same as infringement. In Feist Publications v. Rural Telephone Service, four of the listings Feist took were fictitious ones Rural “had inserted into its directory to detect copying,” yet the Supreme Court held that “Rural’s white pages are not entitled to copyright, and therefore Feist’s use of them does not constitute infringement.” The copying was shown and Rural still lost, because the facts it copied were not protected. In Bucklew v. Hawkins, Ash, Baptie & Co., Judge Richard Posner wrote that when a fictitious feature a mapmaker planted, known in the trade as a copyright trap, appears in someone else’s map, “the inference of copying is compelling.” In Infogroup v. DatabaseUSA.com, the Eighth Circuit treated “seed data,” fake entries planted “to detect copying,” as direct evidence of copying alongside a party admission and a spoliation instruction, and affirmed the copyright judgment, including $11.2 million in damages, an amount the district court had cut from the jury’s $39.6 million award.

AI cases about stripped copyright notices are early and mixed. 17 U.S.C. 1202(b) bars intentionally removing or altering “copyright management information” without authority when the person knows, or has reasonable grounds to know, that doing so will induce, enable, facilitate or conceal an infringement. Raw Story v. OpenAI (S.D.N.Y., November 7, 2024) dismissed the claims for lack of Article III standing and denied leave to replead without prejudice. The Intercept v. OpenAI (S.D.N.Y., February 20, 2025) let the 1202(b)(1) claim against OpenAI proceed past the motion to dismiss, and dismissed the (b)(3) claim and every claim against Microsoft. New York Times v. Microsoft (S.D.N.Y., April 4, 2025) found no (b)(1) claim against Microsoft in any of the three complaints and none for the Times against OpenAI, but held that the Daily News and CIR plaintiffs plausibly alleged one against OpenAI. In Doe v. GitHub (9th Cir., September 16, 2026), the court affirmed dismissal of the 1202(b) claim: the plaintiffs had standing, but Copilot and Codex “create new works that never contained that information,” so nothing was removed or altered, and a separate training-data theory was treated as forfeited. Each of these AI rulings came at the motion-to-dismiss stage, none followed a trial or summary judgment, and we did not check later history past the dates shown.

What the search did not find. A CourtListener opinion search on October 11, 2026, for “SynthID,” “C2PA,” “content credentials,” and watermark paired with “large language model” or “AI-generated” returned nothing. So we have no court ruling to report on AI-generated or watermarked text, SynthID, C2PA records or language-model copyright traps offered as evidence.

A certification body fills in its column

The certification body here is invented for teaching, not drawn from a case study. A certification body stores each released edition of its study guide with the file’s hash and release date, runs an embedding search when a suspicious course page surfaces, and has a staff member compare every flagged passage. Its directory team weighs a few documented seed listings, knowing a fake entry is also a false listing members can see. That routine preserves records others can examine later and promises no legal result. Whether the guide is protected at all is the subject of our article on sharing materials openly, and device fingerprinting is in our GPU piece.

Four misreadings that show up row by row

A hash match gets called proof of theft, though authorship and placement stay open under the 902(14) note. A trap gets treated as a winning case, though Rural proved copying and lost. A watermark gets credited with protecting human writing, though it labels model output only. And an AI ruling gets quoted without its stage.