A Chinese Court Ruled on a Medusa LoRA. The Reasoning Is the Story.

Twenty-odd screenshots from an anime, a paid video subscription, a cutout tool, and a platform's "train a LoRA" button. That's the whole fact pattern behind a Chinese copyright case that has now been decided on appeal, and the reasoning is more useful than the result.

The plaintiff owns the Medusa character design from Battle Through the Heavens, a long-running Chinese animation. A user took more than twenty frames of that character, cleaned them up, fed them into a platform's LoRA training feature, and produced two small models — one named for a new costume, one for a current version. He published both on the platform. Other users then typed prompts and got images of Medusa, sometimes identical, sometimes close.

The plaintiff sued for 2 million yuan from the platform and 200,000 from the user, with joint liability inside a 150,000 band. The court held the user liable and let the platform go. Both outcomes matter, but the reasoning in between is the part worth reading.

Copying is reproduction, not storage

The appellate reasoning rests on a single doctrinal move: the essence of the reproduction right is the right to reproduce, meaning to make the work perceptible again. Not to store it. Not to learn from it. To bring it back.

The court then cut the chain into three links and judged each separately.

Link one: taking the screenshots and cutting them into a training pack. That is reproduction, and it infringes.

Link two: feeding the pack into LoRA training. The court held this does not necessarily constitute reproduction, and the explanation it accepted is where the case actually turns. A LoRA learns a low-rank matrix of weight offsets. It is, in the court's phrasing, a low-rank statistical compression rather than an encoding of the original images. Those parameters cannot be assembled back into the original picture.

Link three: the moment a user issues a prompt and the model produces something substantially similar to the original. That is when reproduction completes, and that is when liability attaches.

Why the technical detail decided the case

This is the first time a Chinese court has had to say, in a judgment, what a LoRA actually contains. The answer it accepted is the one most ML engineers would give: a rank-decomposed delta, a few million numbers that shift how the base model behaves, holding no retrievable copy of any training image.

That matters because it separates two things people habitually merge. Training on a work and reproducing a work are different acts, and the second one requires a second actor — the person who typed the prompt. The court built a chain of causation with a specific human hand at the end of it.

It also creates a clean test that doesn't depend on vibes. If the output is substantially similar, the reproduction happened. If it isn't, it didn't. That's a standard a defendant can actually defend against, unlike "the model saw your artwork."

Compare the UK's Getty v Stability litigation, where expert evidence established that Stable Diffusion's weights don't store or contain copies of training images, only statistical patterns derived from them. The English court used that finding to reject secondary infringement claims. Getty has permission to appeal on the interpretation of "infringing copy," with a hearing expected in November. Two jurisdictions, different statutes, arriving at a similar technical picture.

The platform walked because of process, not innocence

The platform's escape is more fragile than it looks, and it's the part other platforms should read twice.

The court didn't hold that providing a training feature is inherently safe. It held that the targeted training was performed by the user, who chose the base model, uploaded the material, and set the parameters. The platform supplied a base model, compute, and a publishing channel. Its liability turned on whether it met the duty of care appropriate to its ability to manage information — and in this case it took the models down and notified an overseas platform that had mirrored the data.

Read that as a checklist rather than an absolution. Notice, takedown, and a documented escalation path are what bought the platform its outcome. A platform that hosts LoRAs and does nothing when a rights holder complains is in a different position, and the same court would say so.

One loose thread from first instance. In a separate Hangzhou case involving Ultraman LoRAs, the first-instance court explored whether training could count as fair use when there's no evidence the training aimed at exploiting the work's expressive originality and no unreasonable harm to the rights holder. The appeal didn't reach that question. So the fair-use door is still open in Chinese practice, just not walked through yet.

The bigger frame arrived in September

On September 7, China's Supreme Court issued its Opinions on the Trial of AI-Related Disputes, the country's first set of judicial rules for this category. Article 12 allocates liability among developers, providers, and users by weighing the type of service, the source of training data, each party's degree of participation, the measures taken, and the profit made.

It also puts a burden on developers who claim non-infringement: they have to produce evidence of where the training data came from, records of the training process, and how the model operates. Article 14, separately, confirms that AI-assisted inventions can be patented, while the inventor must be a natural person.

That's the same structure as the Medusa judgment, generalized. Liability follows the ability to explain. The party holding the technical facts carries the burden of describing them.

Where the reasoning could still break

The low-rank argument holds cleanly for a small LoRA trained on twenty images. It gets shakier as the training set grows and the rank increases, because at some point a model can memorise rather than generalise, and the boundary between "statistical compression" and "a lossy copy" stops being obvious.

Getty's UK case already put a marker here: the experts on both sides agreed that Stable Diffusion will, under some conditions, emit images carrying Getty's watermark, because the training data contained watermarked images and the model memorised enough to reproduce the mark. The English court confined its trademark finding to three example images and rejected the broader claim for SDXL and v1.6 on the evidence. The lesson isn't that memorisation doesn't happen. It's that memorisation has to be demonstrated per model, per prompt, per output.

Which is where this judgment will be tested next. If a plaintiff can show that a single prompt reliably regenerates a protected character, the third link closes and liability returns. The technical question in every future case will be how many attempts it took.

What this means if you train LoRAs

The practical rules that fall out of the case are not complicated. Don't build training sets out of copyrighted frames you didn't license, even if you only use them privately to make a tool. Don't publish a model whose entire purpose is to reproduce a specific protected character. And if you run a platform, build the takedown path before you build the marketplace.

The rule that doesn't fall out, but probably should: the model isn't the copy. The output is. Which means the risk lives in the prompt, and the prompt is the one part of the pipeline a human still writes by hand.