The Cloud Wall. SaaS Architecture, Generative Artificial Intelligence, and the Transformation of Software Piracy

The Cloud Wall

SaaS Architecture, Generative Artificial Intelligence, and the Transformation of Software Piracy

Definitions for General Readers

The definitions on this page are written at approximately a fifth-grade reading level. The article that follows uses the terms in their more technical sense.

Algorithm. A set of steps that tells a computer how to solve a problem or complete a task.

Application programming interface (API). A controlled doorway through which one computer program can ask another program to do something. For example, an app may use an API to ask an AI system to create an image.

API key. A secret code that identifies a person, program, or company using an API. It is similar to a password and should not be shared.

Authentication. The process of proving who you are. Entering a password or using a security code are forms of authentication.

Authorization. The process of deciding what an authenticated person or program is allowed to do.

Backend. The part of a computer service that runs on the company’s servers. Users normally cannot see or directly control it.

Binary. A computer file containing instructions that a computer can run. Traditional desktop programs were often distributed as binary files.

Cloud computing. The use of computers owned and operated by another company through the internet. The work happens on remote servers instead of only on the user’s device.

Cloud Wall. A term used in this article for the technical boundary that keeps a company’s important software, AI models, and data on protected servers while allowing users to send requests through an approved interface.

Code. Instructions written by people that tell a computer what to do.

Container. A small, separated computer environment used to run a program. It helps keep one program or user’s work apart from another.

Copyright. A legal right that protects original human works, such as books, music, art, films, and computer programs.

Credential. Information used to prove identity or permission. Passwords, API keys, and access tokens are credentials.

Cryptographic handshake. A secure exchange in which computers check identity and agree on how to protect their communication.

Encryption. A method of changing readable information into a protected form. A person or computer normally needs the correct key to read it.

Ephemeral. Short-lived. An ephemeral computer process or file exists only for a limited time and is then removed.

Frontend. The part of a program that a user sees and controls, such as buttons, menus, prompt boxes, and webpages.

Generative artificial intelligence. A computer system that creates new text, images, music, video, or other material after receiving instructions.

Inference. The process in which a trained AI model uses what it has learned to produce an answer or output.

JSON Web Token (JWT). A small digital package containing information about identity or permission. It can be signed so that a server can detect whether someone changed it.

Model. A mathematical system trained to find patterns and produce predictions or new content.

Model extraction. An effort to copy or imitate an AI model by asking it many questions and studying its answers.

Model weights. Large groups of numbers that hold much of what an AI model learned during training. They guide the model’s calculations.

OAuth 2.0. A system that lets a person or program receive limited permission to use an online service without giving away the person’s main password.

Output. The answer or content produced by a computer system. An AI output might be a paragraph, picture, song, or video.

Piracy. In this article, piracy means the unauthorized copying, acquisition, use, or distribution of software or digital products. The word is used broadly and does not describe one single legal claim, but rather, an idea or ideas.

Prompt. An instruction given to an AI system.

Rate limit. A rule controlling how many requests a user or program may send during a certain period.

Reverse engineering. Studying a product to discover how it works.

Scraping. Using software to collect large amounts of information or content from websites or online services.

Server. A computer that provides information or services to other computers.

Session. A period during which a user remains signed in and communicates with an online service.

Software-as-a-Service (SaaS). Software that is operated by a provider and used through the internet, usually through a website, app, or API.

Token. A digital item that represents identity, permission, or a temporary right to use a service.

Training data. Text, pictures, music, recordings, or other information used to teach an AI model.

Vector math. A type of mathematics that lets computers work with long lists of numbers. AI models use vector math to compare patterns and produce outputs.

Virtual machine. A computer created inside another computer by software. It behaves like a separate machine even though it shares physical equipment.

Watermark. A visible or hidden mark placed in digital content to help identify where it came from.

Zero trust. A security approach in which no user, device, or program is automatically trusted. Each request must be checked.

1. Abstract

The migration from locally executed software to cloud-hosted Software-as-a-Service has changed the object that software pirates traditionally attacked. During the desktop era, vendors distributed monolithic binaries containing executable logic, valuable code, and local license controls. Possession of those binaries enabled reverse engineering, debugger-assisted modification, serial-number generation, and license bypass. Generative AI platforms such as Suno, Midjourney, and OpenAI invert this arrangement. Their clients receive interfaces, credentials, and bounded outputs, while inference engines, model weights, system instructions, and orchestration logic remain within provider-controlled infrastructure. This execution decoupling makes conventional binary cracking inapplicable to the proprietary backend because the essential executable asset is never transferred to the user. Piracy, however, has not disappeared. It has migrated toward credential theft, API exploitation, automated output collection, behavioral model extraction, and unauthorized training-data ingestion. The Cloud Wall therefore represents not the abolition of appropriation, but its transformation from possession-based software piracy into disputes over access, imitation, data acquisition, and computational capacity.

Keywords: cloud computing; generative artificial intelligence; SaaS; software piracy; cybersecurity; model extraction; copyright; API security; training data; digital watermarking

2. Introduction and Historical Context

2.1 The Desktop-Era Distribution Problem

Traditional commercial software security contained a structural contradiction. To sell an application for local execution, the developer had to give the customer an operational copy of the application. The customer’s computer received not merely a visual interface, but a collection of executable instructions, libraries, resources, configuration data, and license-enforcement mechanisms.

The program might have been compressed, obfuscated, encrypted, or wrapped in digital-rights-management software. Nevertheless, local execution eventually required the operating system and processor to receive usable instructions. The software had to become intelligible to a machine controlled by the customer.

That fact gave the customer, and therefore the attacker, several forms of power. A reverse engineer could inspect the binary with a disassembler, pause its execution with a debugger, observe memory, search for license-related text, intercept system calls, modify conditional branches, emulate hardware identifiers, or replace validation routines. A successful crack did not require complete understanding of the program. It often required only the identification of the narrow decision point separating authorized execution from unauthorized execution.

The desktop model therefore placed the vendor’s security controls on adversarial territory. The vendor designed the protection, but the user controlled the machine on which the protection operated. Every locally performed license check was potentially observable. Every locally stored secret was potentially recoverable. Every branch in the program’s control flow was potentially alterable.

The central weakness was architectural: the developer transferred both the product and the machinery through which the product enforced the developer’s restrictions.

2.2 From Software as a Possessed Object to Software as a Continuing Service

SaaS changes what the customer receives. The user no longer receives a complete computational artifact. Instead, the user receives conditional access to a remotely operated capability.

A browser, mobile application, or desktop client may still contain substantial code. It may implement menus, rendering, local caching, file conversion, playback, prompt preparation, or user-interface logic. The commercially decisive operation, however, occurs on infrastructure controlled by the provider.

The client sends a request. The provider authenticates the requester, checks authorization, selects computing resources, executes proprietary logic, and returns a limited result. OpenAI’s API, for example, uses server-issued API credentials presented through HTTP bearer authentication, and OpenAI warns developers not to expose those credentials within browser or mobile client code.

For generative AI, the valuable asset is not the visible prompt box. Nor is it the JavaScript that draws the webpage. The central assets may include:

* billions of trained model parameters;

* inference and routing systems;

* proprietary fine-tuning methods;

* safety and policy classifiers;

* system-level instructions;

* retrieval systems;

* data-curation methods;

* specialized evaluation procedures;

* deployment and optimization knowledge.

A person may copy the appearance of an AI website without copying the intelligence operating behind it. A cloned interface is comparable to a remote control built without the machine it was designed to operate.

The commercial product has therefore shifted from a reproducible executable file to a metered stream of computation. A pirate can patch a binary that exists on the pirate’s computer. A pirate cannot apply a local patch to a backend binary that the provider never transmitted.

2.3 Defining the Cloud Wall

“Cloud Wall” is not a formal protocol or an established term of art. It is an analytical term for the combined architectural, cryptographic, operational, and legal boundary separating a user-controlled client from provider-controlled execution.

* A mature Cloud Wall contains several forms of separation.

* Spatial separation places proprietary execution on infrastructure outside the user’s control.

* Informational separation keeps model weights, source code, system instructions, internal state, and operational data from being transmitted during ordinary use.

* Identity separation requires requests to be associated with authenticated accounts, applications, organizations, or devices.

* Authorization separation determines which models, operations, data, and usage levels an authenticated requester may access.

* Economic separation permits each request to be measured, billed, limited, or denied.

* Temporal separation allows sessions and credentials to expire or be revoked.

* Legal separation characterizes the transaction as conditional access to a service rather than the unrestricted transfer of a complete executable copy.

This conception parallels zero-trust security, which rejects implicit trust based solely on a user’s network location or ownership of a device. NIST defines zero trust as a resource-centered approach in which authentication and authorization are evaluated before access is established rather than presumed from location inside a traditional network perimeter.[^1]

The Cloud Wall does not make servers invulnerable. Providers remain exposed to stolen credentials, malicious insiders, software vulnerabilities, supply-chain attacks, misconfigured storage, compromised deployment systems, and errors in access policy. The narrower proposition is that conventional end-user binary cracking cannot recover backend logic that is absent from the client.

It is therefore more accurate to say that SaaS has largely eradicated the traditional object of commercial software piracy than to say that it has eradicated piracy in every form.

3. Core Architectural Mechanisms of Mitigation

3.1 Execution Decoupling

3.1.1 Separation of the interface from the engine

Execution decoupling is the most important mechanism of the Cloud Wall. The visible client does not perform the commercially valuable operation. It prepares inputs, submits requests, receives responses, and presents outputs.

A text-to-image client may contain:

prompt controls;

image-upload tools;

account settings;

gallery components;

local editing functions;

download commands;

request-construction code.

The client need not contain:

the image-generation network;

attention weights;

latent-space representations;

text-encoder weights;

internal prompt transformations;

proprietary schedulers;

safety classifiers;

production fine-tunes.

A music-generation interface may expose controls for genre, lyrics, instrumentation, duration, and variation. The underlying audio tokenizer, latent model, decoder, vocal-generation components, mixing systems, and post-processing chain may remain entirely server-side.

Even a perfect reconstruction of the frontend therefore yields only a compatible terminal. It does not yield the computational engine.

3.1.2 Why local license bypass loses its force

Desktop cracking succeeded because a local authorization gate controlled access to functionality that was already installed. Altering the gate unlocked the engine.

In a SaaS system, changing a local variable from subscription=false to subscription=true may alter the appearance of the interface, but it does not change the provider’s server-side account record. A modified client might display premium controls, yet the backend can independently evaluate:

* subscription status;

* model entitlement;

* account identity;

* project permissions;

* usage balance;

* geographic restrictions;

* risk signals;

* billing status;

* rate limits.

The governing rule is simple: the server does not accept the client’s claim about its own authority.

The same principle explains why copying a SaaS frontend does not create a fully functioning pirate edition. A copied OpenAI-style interface may look authentic. Without a capable backend, however, it remains an empty shell. Connecting the interface to the original provider requires valid credentials and remains subject to server-enforced permissions, charges, and limits.

3.1.3 Model weights as executable intellectual property

Generative AI intensifies the significance of execution decoupling because much of the system’s commercially valuable behavior is encoded numerically rather than solely in traditional procedural code.

A modern model may contain billions of learned parameters arranged within matrices, embeddings, attention projections, normalization layers, and feed-forward networks. During inference, those parameters participate in repeated vector and matrix calculations. The model transforms an input into a mathematical representation, processes that representation through many layers, and produces a probability distribution or generated output.

Model weights therefore resemble both executable logic and compressed learned behavior. Possession of them may permit independent deployment, modification, fine-tuning, removal of safety controls, or operation without paying the original provider for each inference.

Keeping the weights on protected servers preserves provider control. The user may observe inputs and outputs but does not ordinarily receive the model’s internal parameters. The model functions as a black-box oracle.

Black-box access is not perfect secrecy. Research has demonstrated that prediction APIs can be queried to create substitute models that approximate protected systems. Tramèr and his coauthors demonstrated model-extraction attacks against several classes of remotely hosted machine-learning models and found that withholding confidence values did not eliminate the problem.[^2]

Execution decoupling therefore prevents direct acquisition of the backend binary or weight file, but it does not eliminate functional imitation. The attacker’s objective changes from copying stored instructions to learning a substitute function from observed behavior.

3.2 Zero-Trust Cryptographic Gateways

3.2.1 Authentication, authorization, and token validation

A Cloud Wall requires a gateway capable of evaluating each request. Modern systems commonly use API keys, OAuth-based authorization, server-side sessions, signed access tokens, short-lived credentials, or workload identities.

OAuth 2.0 and JWT must not be treated as interchangeable terms. OAuth 2.0 is an authorization framework. JWT is a format for carrying signed or encrypted claims. An OAuth access token may use JWT format, but OAuth does not require every token to be a JWT.

A JWT is not secure merely because it exists. Secure implementation requires the receiving service to validate matters such as:

the signature;

the permitted cryptographic algorithm;

the issuing authority;

the intended audience;

expiration time;

token type;

authorized scope.

The IETF’s current OAuth security guidance updates earlier recommendations in response to practical attacks, while its JWT guidance addresses algorithm confusion, weak signature practices, token substitution, and inadequate claim validation.[^3]

The important security question is not simply, “Does this request contain a token?” The system must ask:

Who or what presented it?

Who issued it?

Was it changed?

Has it expired?

Was it issued for this service?

Does it authorize this operation?

Has the account been suspended?

Is the request within its permitted quota?

Does the behavior resemble credential theft or automated extraction?

The cryptographic handshake opens a defined channel. It does not transfer ownership of the underlying machine.

3.2.2 Continuous authorization

Zero-trust architecture treats authentication as the beginning of a decision, not the end of one. A successful login does not necessarily confer unlimited or permanent authority.

For a generative AI service, each request may be evaluated against:

model-specific permissions;

organization or project membership;

account reputation;

payment status;

request frequency;

token or compute consumption;

concurrent-session patterns;

device identity;

geographic risk;

anomalous prompt sequences;

suspected credential resale;

suspected model extraction.

This reverses an important feature of traditional software piracy. Once a desktop crack has been released, the vendor may have limited ability to disable it. The vendor may need to issue an update, change a file format, or introduce a new online check.

A cloud provider can revoke an access key, terminate a session, suspend an account, rotate a secret, alter an endpoint, reduce a quota, or change server-side policy without retrieving a previously distributed program. OpenAI’s security guidance, for example, recommends keeping API keys outside client applications, using project-specific credentials, rotating keys, and monitoring usage and expenditure.[^4]

3.2.3 Rate limiting as intellectual-property protection

Rate limiting is commonly presented as a reliability mechanism, but it is also an intellectual-property defense.

A rate limit may restrict:

requests per minute;

generated images per hour;

audio duration per day;

concurrent jobs;

tokens processed;

total expenditure;

access to high-capability models;

access from newly created accounts.

These restrictions can impede denial-of-service attacks, output harvesting, credential testing, account sharing, automated probing, and model-extraction campaigns.

The security effect is economic as well as technical. Model extraction often requires many carefully chosen queries. Rate controls raise the cost of obtaining those observations and create opportunities for detection. An attacker may respond by distributing queries across accounts or extending the campaign over time, but the provider can correlate payment instruments, device characteristics, network addresses, request patterns, and output behavior.

The defensive objective is not to make every form of extraction mathematically impossible. It is to make extraction expensive, slow, detectable, attributable, and commercially unattractive.

3.3 Ephemeral In-Memory Processing

3.3.1 Transient execution environments

Cloud systems frequently create short-lived execution contexts for jobs, users, or request batches. Inputs may be placed into memory, processed, and released. Temporary files may be deleted. Containers may be destroyed. Worker instances may be returned to a clean pool.

This ephemeral state reduces the time during which sensitive information remains present within a particular environment. It can limit cross-user contamination and make persistent compromise more difficult.

Ephemerality must not be confused with invisibility. An ordinary container does not protect model weights from a fully compromised host. Containers generally share a host kernel, and highly privileged processes may be able to observe their memory or storage. Destroying a container after a request also does not undo information that was exfiltrated while the container was running.

Ephemeral processing primarily reduces persistence. It does not create absolute secrecy.

3.3.2 Protecting data while it is being used

Encryption at rest protects stored model files. Encryption in transit protects data moving across networks. Neither category alone resolves the “data in use” problem.

Model weights must participate in computation. At some stage, processors must perform mathematical operations using them. Confidential-computing technologies attempt to protect this operational state through hardware-backed isolation and memory encryption.

AWS Nitro Enclaves, for example, are constrained virtual machines with isolated processors and memory. They lack ordinary persistent storage, interactive administrative access, and direct external networking. AWS states that processes and administrators on the parent instance cannot directly access enclave memory.[^5]

Google Confidential VM uses hardware-supported memory protection to keep code and data encrypted during processing. Google describes this as encryption in use, supplementing encryption at rest and in transit.[^6]

In a strong confidential-computing design, the sequence may proceed as follows:

The provider stores encrypted model weights.

An isolated environment starts an approved workload.

The environment produces cryptographic evidence of its configuration.

A key-management system verifies that evidence.

Decryption keys are released only to the approved environment.

The model is decrypted within protected memory.

The workload performs inference.

The environment and its ephemeral state are destroyed or reset.

This arrangement narrows the number of systems and administrators capable of accessing the weights.

3.3.3 Limits of confidential processing

It would be inaccurate to imply that every generative AI provider executes every model within a hardware enclave. Frontier inference may require specialized accelerators, high-bandwidth memory, distributed model parallelism, large caches, and extensive communication among processors. Confidential-computing support varies by hardware and deployment architecture.

The surrounding infrastructure may also remain vulnerable even when model computation is protected. Attackers may target:

* deployment credentials;

* build pipelines;

* model registries;

* object storage;

* backup systems;

* orchestration controls;

* employee workstations;

* monitoring agents;

* logging infrastructure;

* inference inputs and outputs.

Ephemeral and confidential processing strengthen the Cloud Wall, but they do not replace ordinary cybersecurity. They must be combined with least-privilege access, segmentation, secret management, auditing, secure software development, incident response, and supply-chain controls.

4. The New Frontiers of Piracy

4.1 From Stealing the Application to Harvesting Its Production

In the desktop era, the pirate sought a copy of the factory: the application itself. In the SaaS era, the attacker may instead harvest the factory’s products or steal temporary use of its machinery.

Output leeching may include:

scraping public galleries;

operating automated generation accounts;

stealing API keys;

sharing subscription credentials;

reselling unauthorized access;

using undocumented interfaces;

collecting large numbers of input-output pairs;

reproducing outputs on competing platforms;

training substitute models from generated material.

Suno’s terms prohibit scraping, robots, data mining, and similar extraction methods. Midjourney’s community rules likewise prohibit unauthorized automation and third-party applications.[^7]

These contractual rules support account enforcement, but contract language is not a physical barrier. The technical barrier still depends on authentication, server-side authorization, rate limits, bot detection, behavioral analysis, and credential security.

The result is an important conceptual shift. The pirate may no longer need to possess the original model. A large collection of prompts and outputs may be sufficient to train a substitute that captures commercially valuable portions of the original system’s behavior.

4.2 Model Extraction and Behavioral Substitution

Model extraction is the AI-era counterpart to reverse engineering, but the attacker does not necessarily inspect the original implementation. Instead, the attacker treats the service as an oracle.

The attacker submits inputs, records outputs, estimates patterns, and trains another model to reproduce the relationship between them. The substitute may differ completely in internal architecture while behaving similarly enough to compete.

Several forms of extraction should be distinguished:

Parameter theft obtains the actual weights or internal parameters.

Architectural theft obtains proprietary information about the model’s structure.

Behavioral extraction trains a substitute using observed outputs.

Knowledge distillation transfers capabilities from a stronger system to a smaller one.

Training-data extraction attempts to recover examples memorized during training.

Research has shown that language models may disclose memorized training sequences under certain conditions. Carlini and his coauthors recovered verbatim sequences from GPT-2, including information appearing in individual training documents. Later research found that diffusion models could reproduce individual training images and that extraction could recover numerous examples.[^8]

These findings do not mean that every model functions as an ordinary file archive or that every similar output proves memorization. They demonstrate that remote execution does not eliminate leakage through the output channel.

The security problem is fundamental. A useful generative system must return informative outputs. Every high-quality output reveals something about the hidden function. The provider must therefore maximize legitimate utility while limiting the quantity and structure of information available to an extractor.

4.3 Output Watermarking and Content Provenance

Digital watermarking places a detectable signal within generated content. The mark may be visible, such as a logo, or imperceptible, such as a statistical pattern distributed across pixels, audio frequencies, video frames, or token choices.

Google DeepMind’s SynthID embeds detectable watermarks into generated images, audio, text, and video. Its audio watermarking is designed to remain detectable after common transformations, including compression, added noise, and changes in playback speed.[^9]

The Coalition for Content Provenance and Authenticity uses a related but distinct approach. C2PA Content Credentials store cryptographically verifiable provenance information concerning an asset’s origin and modification history. The credential can record assertions about creation, editing, and source while allowing later users to evaluate whether the provenance record has been altered.[^10]

Neither method literally prevents copying. A watermark helps identify content. A provenance credential helps evaluate origin and history. Neither operates like a server-side authorization rule that denies an unauthorized request.

Their value lies in:

identifying likely AI-generated material;

tracing leakage;

supporting platform enforcement;

distinguishing original service outputs from imitations;

documenting permitted modifications;

establishing a production history;

supporting contractual or evidentiary claims.

These systems also have limitations. Metadata may be discarded during transcoding, screenshotting, or copying. 

Watermarks may be weakened by heavy modification. Detection may produce false positives or false negatives. A provenance record can establish what a signing party asserted, but it cannot guarantee that every assertion was truthful.

Watermarking therefore reinforces the output boundary of the Cloud Wall. It does not recreate the provider’s control over the backend.

4.4 The Legal Ambiguity of Output Piracy

The phrase “output piracy” can conceal an important legal question: whether the output is itself protected by copyright.

The U.S. Copyright Office has concluded that copyright can protect original human contributions to works containing AI-generated material. It has also concluded that, under presently available technology, prompts alone generally do not provide sufficient human control to make the user the author of all expressive elements in an output.[^11]

Copying a generated image, song, or passage may therefore present several distinct legal situations:

The output may contain protectable human-authored material.

A human may have creatively selected, arranged, edited, or combined generated components.

The output may reproduce material protected by someone else’s copyright.

The output may be predominantly machine-generated and lack copyright protection under present U.S. doctrine.

Platform terms may create contractual rights even when copyright protection is uncertain.

The method used to acquire the output may violate access controls independently of copyright.

Automated output harvesting may therefore be abusive, contractually prohibited, or technically unauthorized without necessarily constituting infringement of copyright in every collected file.

The governing legal claim may instead concern credential misuse, breach of contract, circumvention, computer access, trade-secret acquisition, unfair competition, or functional extraction.

4.5 Inverted Piracy and Training-Data Ingestion

4.5.1 The structural paradox

Generative AI creates a striking asymmetry. A provider may use advanced security engineering to prevent outsiders from copying its weights while using vast collections of externally created works to develop those weights.

This is the paradox of inverted piracy. The platform’s internal intellectual property is protected behind a powerful Cloud Wall, while the legal status of some materials used to construct that intellectual property remains disputed.

The paradox does not establish that all AI training is unlawful. Training-data legality depends upon the jurisdiction, source, purpose, licensing status, access method, market effects, output controls, and technical process involved.

It does demonstrate that publicly accessible material is not necessarily unowned material. Nor does converting expressive works into numerical parameters automatically resolve whether legally significant copies were made during collection, preprocessing, storage, training, or later output generation.

Midjourney’s California training-data disclosure illustrates the mixed character of contemporary datasets. Midjourney states that its models are trained on billions of items and that the mixture may include licensed material, public-domain material, material considered to be used under fair use, user-provided data, and content that may be protected by copyright.[^12]

4.5.2 The United States Copyright Office’s framework

The U.S. Copyright Office concluded in its 2025 generative AI training report that several stages of AI development may involve acts implicating copyright owners’ exclusive rights. It declined to announce a categorical outcome for all training uses, emphasizing that fair use requires a fact-specific analysis.

The Office placed potential uses along a spectrum. Noncommercial research that does not enable reproduction of protected expression may be more likely to qualify as fair use. At the opposite end, copying expressive works from pirate sources to create unrestricted commercial content that competes in existing markets is less likely to qualify.[^13]

The Office further concluded that fairness may depend on what works were used, where they came from, the purpose of the model, the controls placed upon outputs, and the resulting market effects. It regarded the commercial use of large collections of copyrighted works to create directly competing expressive content, particularly through illegal access, as extending beyond established fair-use boundaries.[^14]

The Cloud Wall therefore cannot decide the legality of training. It may conceal the model’s contents from the public, but it does not create permission to acquire or reproduce training material.

4.5.3 The record-company litigation against Suno

In June 2024, major record companies filed a federal copyright action against Suno in the District of Massachusetts. The plaintiffs alleged that Suno copied copyrighted sound recordings in large quantities and ingested them into its training process without permission.

The complaint relied in part on outputs that allegedly resembled identified recordings and performers. It also alleged that Suno treated its training data as confidential business information while invoking fair use as a defense. These were allegations made by the plaintiffs, not findings established merely by the filing of the complaint.[^15]

The litigation illustrates the evidentiary effects of the Cloud Wall. Outside parties cannot ordinarily inspect a closed provider’s training corpus, model weights, or internal pipeline. Rights holders may therefore attempt to infer what occurred behind the wall through:

* generated outputs;

* memorization testing;

* admissions;

* discovery of internal records;

* data-pipeline documentation;

* expert analysis;

* source-code inspection;

* communications with dataset suppliers.

The same architecture that protects a model from pirates may make it difficult for creators to determine whether their works were used to build that model.

4.5.4 GEMA v. Suno

On July 31, 2026, the Munich Regional Court I largely granted GEMA’s requests for injunctive relief, information, and damages against Suno concerning six musical works. The court’s official announcement states that GEMA alleged reproduction during training, memorization within the model, and further infringement through generated outputs. The contested prompts supplied lyrics, titles, and style requests, but did not provide the melodies, harmonies, rhythms, or arrangements later appearing in the outputs.[^16]

The decision is significant because it links the input and output sides of the AI system. The alleged training use concerned the acquisition and internal representation of protected works. The output claim concerned the model’s ability to generate materially corresponding musical expression.

The case also demonstrates that the Cloud Wall does not immunize conduct occurring behind it. Architectural secrecy can protect weights from unauthorized acquisition. It does not itself provide a defense to copyright liability.

Centralization may even concentrate legal responsibility. When a provider exclusively controls data acquisition, training, model design, deployment, output restrictions, and commercialization, it becomes more difficult to characterize the provider as a passive distributor of software whose users independently determined all relevant conduct.

4.6 Memorization as the Bridge between Input and Output

Training-data disputes and output-extraction disputes converge in the concept of memorization.

A trained model is not ordinarily a folder containing conventional copies of every source work. Training adjusts numerical parameters in response to repeated examples. Nevertheless, a model may encode enough information to reconstruct parts of particular examples.

Several terms should be kept separate.

Learning is the adjustment of parameters in response to patterns.

Memorization is the retention of unusually specific information about a training example.

Regurgitation is the production of material closely corresponding to a training example.

Extraction is a deliberate effort to cause the model to reveal memorized material.

Similarity is an observed resemblance that may arise from memorization, shared conventions, common source material, coincidence, or direct copying.

Not every resemblance proves that a particular file appeared in training. Conversely, the absence of routine regurgitation does not prove that no legally significant copying occurred during dataset creation or model development.

The Cloud Wall therefore creates an evidentiary challenge. Outsiders observe prompts and outputs but not the internal process. Courts may have to reconstruct events inside a technically opaque system using discovery, expert testimony, statistical testing, source records, and observable model behavior.

5. Conclusion and Future Outlook

5.1 A Durable Victory over Classical Binary Cracking

For centralized generative AI services, the Cloud Wall represents a durable victory over traditional binary piracy.

The reason is architectural rather than merely cryptographic. Conventional cracking presupposes possession of the executable mechanism. When the commercially decisive program and model weights never leave provider-controlled infrastructure, the ordinary user has no complete backend binary to patch, redistribute, or operate independently.

The browser can be modified. The mobile client can be reverse-engineered. Network requests can be observed. A subscription indicator can be falsified locally. None of these acts compels a properly designed server to perform an unauthorized inference.

SaaS has therefore achieved something that desktop copy protection could not. It has removed the principal executable asset from the attacker’s administrative domain.

5.2 The Abstraction of Piracy

The Cloud Wall has not eliminated appropriation. It has abstracted it.

The new targets are:

credentials rather than serial numbers;

API capacity rather than installation media;

generated outputs rather than executable files;

model behavior rather than identical binaries;

training corpora rather than program discs;

server entitlements rather than registry entries;

infrastructure accounts rather than local control flow.

The desktop pirate modified instructions. The AI-era extractor samples a function.

This transformation also changes legal analysis. Traditional piracy was often recognizable as the unauthorized reproduction and distribution of copyrighted software. Contemporary AI appropriation may involve overlapping questions of contract, access control, trade secrets, model extraction, data scraping, copyright, and output provenance.

No single doctrine completely describes the problem.

5.3 The Limits of the Centralized Victory

The Cloud Wall remains strongest only while the valuable capability remains centralized.

Open-weight models and local-inference software weaken the assumption that advanced generation must always occur on remote infrastructure. The llama.cpp project, for example, is designed to run language and vision-language model inference across a wide range of local hardware and supports quantized models on CPUs and GPUs.[^17]

Quantization reduces the amount of memory and computation required by representing model values with fewer bits. Distillation can train a smaller model to reproduce parts of a larger model’s behavior. Specialized processors increasingly place substantial vector-math capacity within personal devices.

These developments do not necessarily restore the former desktop-software economy. They point toward a divided ecosystem.

Centralized platforms retain important advantages when users require:

* the largest models;

* elastic computing capacity;

* continuous updates;

* expensive multimodal generation;

* enterprise administration;

* managed reliability;

* proprietary datasets;

* global collaboration;

* extensive safety monitoring.

Local systems gain importance when users prioritize:

* privacy;

* offline operation;

* data sovereignty;

* low latency;

* customization;

* predictable cost;

* independence from subscription policy;

* resistance to service withdrawal.

5.4 A Hybrid Computational Order

The most plausible future is neither complete cloud centralization nor a universal return to local execution. It is a hybrid hierarchy.

Frontier models may remain concentrated within data centers because training and high-throughput inference require extensive capital, energy, networking, memory, and specialized accelerators. Smaller, distilled, quantized, and domain-specific systems will increasingly operate on workstations, phones, vehicles, private servers, and edge devices.

The Cloud Wall is therefore likely to remain permanent as a commercial strategy without becoming universal as a computing architecture. It will protect capabilities that providers choose not to distribute. It cannot prevent independently developed or openly released models from performing similar work locally.

Nor can the Cloud Wall answer the legitimacy of the data used to construct a service. A provider may secure its weights with exceptional effectiveness while leaving unresolved whether training works were acquired lawfully, whether outputs reproduce protected expression, whether generated works possess sufficient human authorship, and whether black-box access enables unlawful extraction.

The lasting achievement of SaaS is consequently narrower, and more consequential, than the claim that piracy has been abolished. SaaS has broken the historical equivalence between using software and possessing the software that performs the work.

Generative AI represents the fullest expression of that separation. The user controls the prompt, but the provider controls the execution, the model weights, the cryptographic gateway, the computational quota, and the ephemeral state.

The Cloud Wall is not the end of software piracy. It is the boundary at which piracy ceases to be primarily the cracking of local code and becomes a contest over authenticated computation, behavioral imitation, generated outputs, and the data from which machine intelligence is constructed.

Notes

[^1]: Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly, Zero Trust Architecture, NIST Special Publication 800-207 (Gaithersburg, MD: National Institute of Standards and Technology, 2020).

[^2]: Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart, “Stealing Machine Learning Models via Prediction APIs,” in Proceedings of the 25th USENIX Security Symposium (Berkeley, CA: USENIX Association, 2016).

[^3]: Yaron Sheffer, Dick Hardt, and Michael B. Jones, “JSON Web Token Best Current Practices,” RFC 8725, February 2020; Torsten Lodderstedt et al., “Best Current Practice for OAuth 2.0 Security,” RFC 9700, January 2025; Vittorio Bertocci, “JSON Web Token Profile for OAuth 2.0 Access Tokens,” RFC 9068, October 2021.

[^4]: OpenAI, “Best Practices for API Key Safety”; OpenAI, “How Can I Keep My OpenAI Accounts Secure?”; OpenAI, “Can I Share My API Key with My Teammate or Coworker?”

[^5]: Amazon Web Services, “What Is Nitro Enclaves?” and “Nitro Enclaves Concepts,” AWS Nitro Enclaves Documentation.

[^6]: Google Cloud, “About Confidential VM” and “Confidential VM Overview,” Google Cloud Documentation.

[^7]: Suno, “Terms of Service”; Midjourney, “Community Guidelines.”

[^8]: Nicholas Carlini et al., “Extracting Training Data from Large Language Models,” arXiv, 2020; Nicholas Carlini et al., “Extracting Training Data from Diffusion Models,” arXiv, 2023.

[^9]: Google DeepMind, “SynthID: A Tool to Watermark and Identify Content Generated through AI.”

[^10]: Coalition for Content Provenance and Authenticity, “C2PA Technical Specification” and “C2PA and Content Credentials Explainer.”

[^11]: U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (Washington, DC: U.S. Copyright Office, January 2025), 18.

[^12]: Midjourney, “AB 2013 Documentation.”

[^13]: U.S. Copyright Office, Copyright and Artificial Intelligence, Part 3: Generative AI Training, Pre-Publication Version (Washington, DC: U.S. Copyright Office, May 2025), 74.

[^14]: U.S. Copyright Office, Generative AI Training, 107.

[^15]: UMG Recordings, Inc. et al. v. Suno, Inc., Complaint, No. 1:24-cv-11611 (D. Mass. filed June 24, 2024), 4.

[^16]: Landgericht München I, “Urteil GEMA gegen Suno,” Press Release No. 16, July 31, 2026.

[^17]: GGML Organization, “llama.cpp: LLM Inference in C/C++” and “llama.cpp HTTP Server,” GitHub documentation.

Bibliography

Amazon Web Services. “Nitro Enclaves Concepts.” AWS Nitro Enclaves Documentation.

———. “What Is Nitro Enclaves?” AWS Nitro Enclaves Documentation.

Bertocci, Vittorio. “JSON Web Token Profile for OAuth 2.0 Access Tokens.” RFC 9068. October 2021.

Carlini, Nicholas, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace. “Extracting Training Data from Diffusion Models.” arXiv, 2023.

Carlini, Nicholas, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, Alina Oprea, and Colin Raffel. “Extracting Training Data from Large Language Models.” arXiv, 2020.

Coalition for Content Provenance and Authenticity. “C2PA and Content Credentials Explainer.”

———. “C2PA Technical Specification.”

GGML Organization. “llama.cpp: LLM Inference in C/C++.” GitHub.

Google Cloud. “About Confidential VM.” Google Cloud Documentation.

———. “Confidential VM Overview.” Google Cloud Documentation.

Google DeepMind. “SynthID: A Tool to Watermark and Identify Content Generated through AI.”

Landgericht München I. “Urteil GEMA gegen Suno.” Press Release No. 16. July 31, 2026.

Lodderstedt, Torsten, John Bradley, Andrey Labunets, and Daniel Fett. “Best Current Practice for OAuth 2.0 Security.” RFC 9700. January 2025.

Midjourney. “AB 2013 Documentation.”

———. “Community Guidelines.”

OpenAI. “Best Practices for API Key Safety.”

———. “Can I Share My API Key with My Teammate or Coworker?”

———. “How Can I Keep My OpenAI Accounts Secure?”

Rose, Scott, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero Trust Architecture. NIST Special Publication 800-207. Gaithersburg, MD: National Institute of Standards and Technology, 2020.

Sheffer, Yaron, Dick Hardt, and Michael B. Jones. “JSON Web Token Best Current Practices.” RFC 8725. February 2020.

Suno. “Terms of Service.”

Tramèr, Florian, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. “Stealing Machine Learning Models via Prediction APIs.” In Proceedings of the 25th USENIX Security Symposium. Berkeley, CA: USENIX Association, 2016.

UMG Recordings, Inc. et al. v. Suno, Inc. Complaint. No. 1:24-cv-11611. D. Mass. Filed June 24, 2024.

U.S. Copyright Office. Copyright and Artificial Intelligence, Part 2: Copyrightability. Washington, DC: U.S. Copyright Office, January 2025.

———. Copyright and Artificial Intelligence, Part 3: Generative AI Training. Pre-publication version. Washington, DC: U.S. Copyright Office, May 2025.