AI-Generated Defamation

The element that is trivial against a newspaper

A defamation plaintiff must establish that the statement was made, that it was published, and that the defendant is responsible for it. Against a newspaper the first is free: the article exists, it is dated, everyone reads the same words. Against a generative system it is the hardest element in the case, because the words were produced on demand for one user in one session and may never appear that way again.

That is why this sits under reconstruction: the question is what existed, when, and under whose control, and "existed" means text a system emitted once, under conditions nobody recorded unless somebody thought to. Two consequences pull in opposite directions. The proof problem is severe: a defendant will say the output cannot be reproduced and therefore was never produced, or was produced only because the user led the model to it. But the threshold is low - if the operator is treated as the speaker, delivery to a single user may satisfy publication. The single occurrence can be the whole case, so its capture carries the weight.

Nondeterminism is not a temperature setting

The common defense intuition - that the plaintiff must have used a "creative" setting, and that a properly configured system would give the same answer every time - is wrong, and there is now a clean technical account of why.

Research published in September 2025 by Thinking Machines Lab attributes endpoint nondeterminism not to sampling temperature but to batch-size variance: the server groups requests into batches whose composition depends on load at that instant, and the arithmetic kernels are not batch-invariant, so the same input can take a different numerical path depending on who else was querying at that moment.

The experiment is the most useful number here. Running a large open model at temperature 0 - the setting supposed to make output deterministic - they issued 1,000 identical requests and received 80 unique completions, first diverging at token 103. With batch-invariant kernels installed, all 1,000 matched.

Three things a court can use. Temperature 0 does not guarantee reproducibility. The nondeterminism has an engineering cause within the operator's control, since the same researchers eliminated it. And the divergence rate is measurable - 80 in 1,000 is a number, not an adjective, and the analogous experiment can be run on the system and prompt at issue.

The variation that has nothing to do with the model

Sampling is the smallest problem. Most variance comes from layers the user never sees.

• Retrieval variation. Where the system grounds its answer in retrieved pages, the retrieval set changes as the web changes. Google documents that its AI features may use a "query fan-out" technique, issuing related searches across subtopics - so identical prompts hours apart can rest on different documents. This is the dominant variation for AI search surfaces, and it sits outside the model.
• Model version drift. The model behind a consumer product changes without notice, so a conversation captured in March may not reproduce in August.
• Product-layer state. The product wraps the model in a system prompt the user never sees; output is further altered by personalization, prior turns, stored memory, and subscription tier.
• Feature triggering. Google says AI Overviews are shown only where its systems judge them "additive to classic Search, and as such, often don't trigger." Absence today is no evidence of absence on the date at issue.

So "I tried it and it didn't say that" is a weak rebuttal, and "I tried it and it did" is weak proof. Both are single observations of a system with several sources of variation.

Reproducibility as a Rule 702(c) question

This is where the technical problem becomes an admissibility problem. Rule 702(c) requires that testimony be the product of reliable principles and methods, and since the 2023 amendment the proponent must show it is more likely than not that each requirement is met. "The model said X about my client" is an opinion about a system's behavior, and how that behavior was observed is what (c) asks about.

A defensible method looks like an experiment, not a demonstration. State the prompt exactly, and every controlled variable: account state, memory and personalization settings, custom instructions, geography, language, device, model identifier, and whether the surface retrieves. Run the prompt a stated number of times, on the same day and on later dates, log every output verbatim, and report the frequency with which the challenged assertion appears. "It appeared in 34 of 100 runs under stated conditions" is a finding with an error characteristic. "The model says my client is a fraud" is not.

The Daubert factors map onto this well: the protocol is testable in the sense that an opposing expert can run it, it yields a rate rather than a binary claim, and it forces disclosure of the controls. One caution belongs in every such report - a frequency measured today describes today's system, on today's model version, retrieving today's web. Its relationship to the system that produced the output on the date at issue must be argued.

Preserving output that does not persist

The checklist below is method.

1. The exact prompt string, byte for byte, and every prior turn - not a screenshot of the offending paragraph. A defendant will argue the user led the model, and only the transcript answers that.
2. Timestamps in UTC with local time and zone, and the product surface and model identifier as displayed.
3. Account and client state: signed in or out, which account, memory and personalization settings, custom instructions, subscription tier, browser, operating system, geolocation.
4. The provider's own export where one exists, because a native export or share link carries more provenance than a screen image.
5. A network capture: a HAR file (an HTTP Archive file, the browser's own JSON log of every request and response in a session) records the response payload and its timing.
6. A repetition protocol with every run logged, and a chain of custody recording who ran each trial on which machine.

The most important instruction to counsel has nothing to do with any of that: capture the output before the provider is notified. Once a provider is on notice of a specific false output about a named person, that output is likely to be filtered or corrected, and reproducibility disappears. A demand letter sent before the protocol has run can destroy the plaintiff's own proof, in a way that looks like it never existed.

Rule 37(e) applied to something that cannot be regenerated

Rule 37(e) applies where electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, "and it cannot be restored or replaced through additional discovery." Prejudice under (e)(1) permits curative measures; (e)(2)'s severe sanctions require intent to deprive.

Every clause becomes strange applied to generated output. What "should have been preserved" - the response payload, the session, the retrieval set, the system prompt? Provider-side logs run on retention schedules set for operations, not litigation. User-side history may be deleted, disabled by setting, or wiped by clearing a browser.

The "restored or replaced" clause is genuinely novel here. In most spoliation disputes the question is whether a lost document exists elsewhere; here it is whether the output can be regenerated, which depends on nondeterminism, version drift, retrieval drift, and whether the provider has filtered the assertion. An expert often determines whether the threshold is met at all - which decides whether any sanction is available.

To be precise: I did not locate any reported decision applying Rule 37(e) to generative model output, session logs, or retrieval records. The analysis above is drawn from the rule text and the technology, not from holdings, and should be written that way.

Publication, attribution, and the question the statute leaves open

Section 230(c)(1) bars treating a service as "the publisher or speaker of any information provided by another information content provider," and the statute defines that provider as anyone "responsible, in whole or in part, for the creation or development" of the information (47 U.S.C. section 230).

Read together, the structural argument writes itself. The immunity attaches to information provided by another. Where a model composes a novel sentence rather than transmitting a third party's document, the question is whether the operator is responsible in whole or in part for creating it - the statutory definition of the category the immunity does not protect. The text points toward generated output falling outside it. It does not resolve the harder case of retrieval-grounded output that summarizes and attributes third-party pages, and that question is unsettled.

Two further points shape the expert's work. On fault, it is not obvious what it means to say a probabilistic system "knew" an assertion was false, which is why fault tends to be argued about the operator's conduct. On publication, if delivery to a single user satisfies the element, a plaintiff need not show the system says the defamatory thing reliably - only that it said it once. That makes capture and custody more important, because the single occurrence must survive a challenge that a leading prompt produced it.

The categories of dispute, and where these opinions fail

The matters filed so far fall into recognizable categories, and the category determines what evidence is available.

• Fabricated legal or criminal history - an invented lawsuit, charge, or investigation. The most tractable, because the assertion is checkable against records that either exist or do not.
• Identity conflation, where a system merges two people who share a name. It leaves a different trail, because the facts are true of somebody.
• Misattribution to cited sources, where a summary asserts something and cites pages that do not contain it. The most verifiable category: retrieve the sources, compare them to the assertion, and the comparison is the exhibit.
• Generated imagery of an identifiable person, raising provenance issues beyond text.

The failure modes are equally consistent. The single screenshot, without the conversation, the environment, or any repetition. Reproduction attempted after notice, which converts a strong case into an argument about why the output no longer appears. Uncontrolled trials, run across accounts, days, and devices without logging which was which, so no rate can be computed. And overstating a frequency: an assertion appearing in a share of runs describes a system under stated conditions, not what it will do for anyone else. None of that makes the claim unprovable - it makes it a discipline with a method, available to whichever side runs it first.

Frequently Asked Questions

Published 2026-08-11