AI remembers more than you think: Extracted almost all of Harry Potter – word for word

The loudest part of the result is the example with ‘Harry Potter and the Sorcerer’s Stone’. In one set of settings, the authors state that with Claude 3.7 Sonnet, after bypassing the protections, they obtained an nv-recall of 95.8% (thus, a large part of the book appeared almost identically). For Gemini 2.5 Pro and Grok 3 they claim to have got 76.8% and 70.3% without such a bypass. On the other hand, for GPT-4.1 they state that it took a lot more attempts, and the system eventually refused to continue, so the result was about 4%.

The authors also emphasize limitations: they did not claim that they ‘maximized’ how much can be extracted from each model, nor that the same can be done with each book. In part of the experiments (they tested 11 books published before 2020), many attempts ended up with little or no ‘čsame’ match (nv-recall up to 10%). But their point is that even with protections at the model and system level, the leakage of protected text still remains a real risk.

Why is it important? First, it hits the very heart. debates about whether AI models train on protected works in a way that is ‘transformative enough’ or sometimes just restore the original. Second, this is not just a question of books: if the system can ‘play’ long chunks of training data, the same pattern is problematic for other types of sensitive content in the data. Third, for companies this means that ‘security fences’ must be stronger than classical response filtering, as research shows that loopholes can be found in production.

Another important detail is the publication process: the authors said they ran the experiments from mid-August to mid-September 2025, then notified the companies (Anthropic, Google DeepMind, OpenAI and xAI) and waited 90 days before public announcement. They also state that during this period they noticed changes in the availability of some models in the interface, but that after the deadline the method still worked on part of the systems they tested.