The Problem: Compliance Without a Mechanism

A training pipeline today has two blind spots that the law increasingly will not tolerate. The first is depth: when a training example is presented to the optimizer, its gradient flows wherever backpropagation carries it, diffusing the content's influence across millions or billions of parameters through the non-linear dynamics of optimization. There is no architectural control over whether a licensed work shapes only surface-level recall or settles into the deep representational structure that encodes a model's core capabilities. The second is traceability: once training completes, the relationship between a specific work and a specific model behavior is, in ordinary pipelines, unknowable. A content owner asking whether their work was used, or a regulator asking whether restricted content was kept out of deep integration, cannot be answered from the model itself.

These blind spots are precisely what the current legal regime probes. A machine-readable opt-out under the Digital Single Market Directive is only meaningful if the pipeline can prove it honored the opt-out. A licensing agreement that expires is only enforceable if the licensed content can be de-emphasized without retraining the whole model. A privacy obligation over personal data is only satisfiable if the pipeline can show the data was never encoded in a memorizable form. Each of these is a question about depth and provenance, and the standard pipeline can answer none of them.

The Inventive Step This Application Builds On

Rights-compliant training is a general application of Training Governance, disclosed in United States Patent Application 19/647,395. The home inventive step treats the training loop as a governed execution environment: each training example is a proposed semantic mutation to the model's knowledge state, carrying its own semantic metadata, evaluated for admissibility before it is permitted to influence parameters, and routed through depth-selective aggregation at the depth its profile prescribes. The capabilities that make rights compliance structural rather than contractual all originate in that disclosure:

  • Depth-selective gradient routing. A per-block contribution weight vector, the training depth profile, scales the gradient signal from each example at each layer block during the backward pass. A weight of zero blocks all gradient flow to a block; a weight of one permits full flow; intermediate weights attenuate. The forward pass is untouched, so inference behavior is unaffected by the mechanism.
  • Policy-governed retention and suppression. The same policy objects that govern agent behavior and inference-time admissibility extend into the training loop and determine the depth profile for each content class.
  • An append-only training provenance log. Every routing and admissibility decision is recorded in a chronologically ordered, sequentially numbered, append-only log that may be cryptographically sealed for third-party verification.
  • Reverse provenance and memorization detection. A reverse query traces an observed model behavior back to the bounded set of training content structurally permitted to influence the active layer blocks.
  • Differential privacy by confinement. Privacy-sensitive content is routed away from the memorizable deep layers by architecture rather than protected by noise injection.

The application also draws on sibling capabilities in the portfolio: content anchoring, by which content derives a computable identity from its own structural entropy rather than from attached metadata or watermarks, supplies the durable identifier that lets a provenance record survive format conversions and platform boundaries; and the cryptographic sealing infrastructure of the cross-referenced governance application supplies the tamper-evident checkpoints over the provenance log.

Depth Profiles as the Enforcement Primitive

The enforceable unit of rights compliance is the depth profile. For a model of L layers or B blocks, the depth profile is a structured object specifying a contribution weight for each layer or block. The depth-selective aggregation mechanism applies it at each block boundary during the backward pass: for each training example, the gradient is scaled by the block's profile weight before it is accumulated into that block's gradient buffer. This per-example scaling occurs after the per-example gradient computation and before batch-level accumulation, so each example's contribution to each block is individually governed.

Three complementary implementations of this scaling are disclosed, letting the mechanism adapt to different architectures: gated residual connections, which apply a gating coefficient to the gradient flowing through residual pathways during the backward pass; attention-based depth selection, which scales the gradient reaching the attention weights and value projections in transformer layers; and a layer-specific scaling factor, an architecture-agnostic scalar multiplier applied at each layer boundary that requires no change to the model's structure and is therefore applicable to convolutional, recurrent, mixture-of-experts, and hybrid architectures alike. To keep profiles tractable in very deep networks, the mechanism operates at block-level granularity, where a block is an architecturally meaningful grouping such as a transformer layer, a group of residual layers, or an attention head. The mechanism does not alter the optimizer's update rule and is compatible with stochastic gradient descent, Adam, AdamW, and their variants, so it can be introduced into an existing pipeline with minimal change to the optimization infrastructure.

Mapping the Mechanism onto the Rights Regime

The decisive property of this mechanism for rights compliance is that it implements structural prevention rather than post-hoc unlearning. Post-hoc unlearning operates after training, approximates the diffuse influence of an example across the parameters, and applies corrective updates that are inherently stochastic, approximate, and irreversible, because the influence of a single example cannot be precisely isolated and reversed. Depth-selective routing prevents deep integration at training time, before the gradient reaches the deep layers. A zero weight at a block means no gradient from that example ever reaches that block's parameters. There is nothing to unlearn that was never deeply learned, and the prevention is exact, auditable, and reversible by changing the profile.

That property maps directly onto each obligation the regime imposes:

  • Time-limited licenses. Content admitted under a license with an expiration date is trained with a suppressed depth profile, in which deep-layer weights are set to zero or near-zero, confining the content to shallow, structurally separable layers. When the license expires, the policy object switches the content to a zero-weight profile, halting further integration; the expiration is recorded as a governed event. De-emphasis becomes a targeted shallow-layer adjustment rather than a full retraining.
  • Machine-readable opt-outs and exclusion. Content identified as inadmissible, including content inadvertently present in a prior corpus version, is given a zero-weight depth profile that blocks influence at every layer. This is the training-time analog of an inference-time rejection, and the exclusion is logged with the identity of the content and the policy that mandated it.
  • Overlapping regulatory regimes. When several policies apply to one example, for example a creator license, a domain regulation, and a platform governance policy, the substrate resolves the profile by applying the most restrictive policy. If a license would permit deep integration but a regulation restricts it to shallow layers, the regulation prevails, and the deterministic resolution logic is recorded for audit.
  • Personal data and privacy. Privacy-sensitive content is routed to shallow layers, where representations are generic and distributed and therefore less memorizable, with low or zero weights at the deep layers where specific, retrievable knowledge is encoded. The guarantee is structural: the model cannot memorize what it was not permitted to encode in memorizable layers. Because the confinement is per-content, non-sensitive content can train at full depth, eliminating the global accuracy-privacy tradeoff of uniform noise injection.

Compliance Verifiable by Retrieval

What turns this from a training tactic into a compliance posture is the training provenance log. For each batch or example it records the entropy band classification, the slope position in the trust-slope hierarchy, the depth aggregation profile applied as a per-block weight vector, the per-block weight that actually reached each block after any dynamic adjustment, the governance record naming the policy that authorized admission and the policy that set the depth, the content provenance record describing source and chain of custody, and the admissibility determination with the reason for any modification or rejection. The log is append-only, timestamped, and sequentially numbered, so entries cannot be retroactively altered, deleted, or reordered without producing detectable inconsistencies, and it may be periodically sealed to yield tamper-evident checkpoints for third-party verification.

The log answers the regime's questions directly. When a content owner asks whether their content was used, the log either produces the content's provenance record, depth profile, and contribution weights, or confirms its absence. When a regulator requires evidence that restricted content was not deeply integrated, the log produces the contribution-weight records showing the gradient was confined to the layers and magnitudes the governing policy specified. A reverse provenance query, beginning from an observed model behavior, traces back to the bounded set of training content that was structurally permitted to influence the active layer blocks; it does not claim exact attribution, which the non-linear dynamics of optimization preclude, but it yields an attribution set substantially narrower than the full corpus. The same machinery drives training-level memorization detection: when an output is flagged as resembling a known training artifact, a reverse query classifies the similarity as shallow memorization of properly governed content, deep memorization that may signal a governance failure, or absent memorization where no record exists, and feeds that assessment back into inference-time admissibility.

Deployment Variations

The disclosure contemplates the mechanism across deployment options, which makes this a broad rather than single-instance disclosure:

  • Pre-training and governed fine-tuning. Applied to fine-tuning, the corpus's metadata, policies, depth profiles, and admissibility determinations are recorded as a fine-tuning provenance record structurally distinct from pre-training provenance, so a challenged output can be traced to the pre-training or fine-tuning entity for liability allocation.
  • Real-time interactive training. Individual interaction events are governed identically to batch training: an accepted response becomes a positive example, a user correction becomes an example with elevated contribution weight, each routed to the depth its content warrants and logged with the same structured metadata.
  • User-directed corpus selection. A user can point the model at specific sources, such as filesystem directories, code repositories, or curated libraries, and each unit is run through the same admissibility evaluation, depth routing, and provenance recording, with policy failures producing structured rejection records.
  • On-device training without network dependency. The base model is held frozen and updates are confined to a parameter-efficient adaptation layer, typically under one percent of the base parameter count, stored locally and governed by the same constraints, so rights-compliant personalization needs no cloud round-trip.
  • Creator-governed generative content. Creator content is admitted only under a cryptographically signed governance agreement that specifies a depth profile, deep, shallow, or excluded, and the provenance log records which creator content influenced which layers at what weight, supplying the evidentiary basis for downstream compensation routing.

Disclosure Scope

The depth-selective training governance applied here, comprising the treatment of each training example as a proposed semantic mutation evaluated for admissibility, the entropy-band-indexed training depth profiles, the depth-selective aggregation mechanism implemented through gated residual connections, attention-based depth selection, and a layer-specific scaling factor operating at block-level granularity during the backward pass, the policy-governed retention and suppression that applies suppressed and zero-weight depth profiles under time-limited, revoked, and exclusion policies with most-restrictive hierarchical resolution, the structural prevention of deep integration as distinguished from approximate post-hoc unlearning, the append-only and cryptographically sealable training provenance log with its forward and reverse provenance queries and bounded attribution sets, the training-level memorization detection and its feed into inference-time admissibility, the differential privacy by depth-selective confinement, and the application of the foregoing across pre-training, governed fine-tuning, real-time interactive training, user-directed corpus selection, on-device parameter-efficient adaptation, and creator-governed generative content, is disclosed in United States Patent Application 19/647,395. This article describes that disclosed mechanism as it applies to rights-compliant training. The mechanism does not require any particular optimizer, model architecture, or sealing primitive, and the legal and regulatory regimes named in this article are external context rather than part of the disclosure.