IL-2023-000007 - [2025] EWHC 2863 (Ch)

Annex 8I

Annex 8I to the Particulars of Claim provides evidence of various versions of Stable Diffusion producing synthetic images with watermarks* in real life. Stability accepts that Getty Images did not consent to the production of these images.

Annex 8I includes 26 images bearing Getty Images watermarks*. For many of these images the prompt and version of Stable Diffusion used to create the image is recorded as “unknown”. However, there are 8 images in Annex 8I in respect of which the full prompt is known. None of these prompts “corresponds” to any of the Marks, nor do any of them contain any of the Marks within them (and so they are all within the scope of Getty Images’ claim). There is no evidence that any of the prompts used corresponds to Getty Images captions, i.e. that real world users have in fact used Getty Images captions as text inputs to the Model.

Only 6 of the images in Annex 8I are identified as having been generated by a specific version of the Model – five are pleaded as having been generated by v2.1 (although Getty Images concede that one of these images, appearing at page 21 of Annex 8I is incapable of evidencing infringement owing to the extent of the blurring in the watermark*) and one is pleaded as having been generated by SD XL.

The four images on which Getty Images now rely in respect of v2.1 are at pages 7, 8, 24 and 25 of Annex 8I and show:

I note that none of these three prompts is particularly complicated and none (as Professor Brox accepted in cross examination) has the particular features that he suggested in his report would increase the likelihood of a watermarked* image being generated. There is no reason to suppose that these are anything other than randomly picked prompts.

The Musician Image was posted on Reddit under the caption “getty images, really? Stable Diffusion 2.1” (“the Reddit Musician Post”). In the same Chat is confirmation from other users that they have experienced something similar: Graucus: “I can confirm. They have done this with mine”; econopotamus: “Just negative prompt ‘watermark’ or ‘text’ and it usually goes away in my experience”; irateas: “Yeah. This is common problem with 2.x+”; tybiboune: “they come up pretty often when you don’t specify any style”; Grdosjek: “You get those in 1.x too. Don’t be versionist :D”.

The Girls Hugging Image was also posted on Reddit under the caption: “I asked for a photo of two girls hugging and the AI tried to make a Getty images watermark. I didn’t ask for that but it is mildly interesting”.

The Japanese Temple Garden Images were attached to a Getty CEA Notice and appear to come from the Hugging Face (v2.1) platform. The user posting the images on 27 December 2022 (“the Japanese Temple Garden Post”) under the heading “Feedback on Training” says this:

“Just a thought…Many of the images being used to train stable diffusion come from getty images.

How do I know?

Prompt: Japanese temple garden with blooming sakura and kami

Half of the images generated have something that looks more than vaguely like the grey getty images stamp on it.

Even when you use the negative prompt “text”, some form of ghost proof stamp shows up.

Is there a way to train that out of the next version?”

Getty Images candidly accept that there is no evidence in Annex 8I of images with watermarks* having been generated in the UK, but it contends that, absent a case on the part of Stability that the Model behaves differently in the United States, or Australia, from the way in which it behaves in the UK, evidence that watermarks* have been generated by anglophone users is probative of the fact that they will also have been generated in the UK. In other words, as Ms Lane put it in closing, “evidence that it has happened in the real world somewhere is equally good evidence that it is likely to have happened in the UK”. Neither Expert sought to distinguish between use of the Models in different countries.

The one image in Annex 8I identified as having been generated by SD XL (“the Steampunk Musician Image”) was the product of a prompt in the following terms “A comic book style illustration of a steampunk musician who plays beautiful melodies using his steam powered instruments and devices, character design in style of ArtStation trending, DAZ, Octane render, steampunk, dynamic lighting, ((50mm cinematic film still)), 8k uhd, Intricately detailed, beautiful artwork by award winning comic book artists, She is holding a magical glowing lightbulb made of dna and swirling mysterious power crystals”:

Stability points out that the pleaded date of generation of the Steampunk Musician Image is 4 March 2023. However, as I recorded earlier in this judgment, Stable Diffusion XL Beta (the first version of SD XL) was not released to the public until 13 April 2023, over a month after the date of generation of this image. This image was shared in an internal Stability slack Chat on 4 March 2023 and appears to have been generated during the development of XL Beta. The relevant part of the Chat (discussing the Steampunk Musician Image) reads as follows:

“I know David is training better watermark predictor

It doesn’t seem prudent to launch DS with SD-XL and make a big deal out of a new model that produces Getty watermarks, right?

They’re currently dewatermarking.

I think this was a fluke, since they did remove Getty. Its things like people copying Getty images to Pinterest

But got to be careful anyways

The smartest thing to do would be to revert to an earlier checkpoint and then resume training with the Dewatermarked LAION”

In light of this evidence, I find that the Steampunk Musician Image was created during the development of the SD XL Model such that the generation of a watermark* on that image cannot be attributed to the model weights which were subsequently released. It is clear that work was being done at the time the image was generated to “dewatermark” the dataset used in training and that these efforts were specifically directed at Getty Images watermarks. Accordingly, I do not consider the Steampunk Musician Image to provide any support for Getty Images’ case in relation to SD XL. This now appears tacitly to be accepted by Getty Images. In closing, Ms Lane submitted that Annex 8I is evidence of the fact that “the early models of Stable Diffusion produced watermarks…”, thereby apparently accepting that Annex 8I provides no probative evidence in relation to either SD XL, or v1.6.

In opening, Getty Images sought to rely upon a table in which they made various, previously unpleaded, assertions as to the likely version of the Model involved in generating the remaining images shown in Annex 8I in respect of which the version is currently identified in their pleaded case as “unknown”. They invited me to draw appropriate inferences. Stability objected to this on pleading grounds, but I do not need to address the pleading point in any detail. In closing, Ms Lane accepted that when one examined the inferences that the Court was being invited to draw, very few of them were really available owing to the fact that it remains impossible to be certain which precise version of the Model was involved in the production of the image. Thus:

That leaves (i) the images at pages 3 and 9 of Annex 8I dated 27 August 2022 and 28 August 2022 respectively; and (ii) the images generated on 1 October 2022 (at pages 10-20 of Annex 8I).

As to the four images at page 3 of Annex 8I generated on 27 August 2022, while I accept that it is impossible to say whether these were generated by v1.1, 1.2, 1.3 or 1.4 of Stable Diffusion, I consider it reasonable to infer from the date of the images that they were generated by a version of Stable Diffusion within v1.x (but not v1.5). Page 3 shows four generated images responding to the prompt “vector art with a flat material design style of factory with a carbon capture apparatus over the smokestack, solarpunk, optimistic” – they are set out below this paragraph. One of the four images very clearly includes the ISTOCK watermark*, while another also appears to do so, albeit less clearly. There is no evidence in relation to these images as to the mechanism used by the user to access the Model and no evidence as to where the user of the Model was when he or she created the images.

As for the images generated on 1 October 2022 (at pages 10-20 of Annex 8I) which are all conceptual images bearing the iStock watermark*, again I consider it reasonable to infer that these were generated by v1.x. The available evidence (in Stability’s Responsive Statement of Case on Training and Development) suggests that v 1.5 was not released until after this date. I take the image at page 10 by way of example:

I am not prepared to draw a similar inference in relation to the image at page 9 of Annex 8I, created on 28 August 2022, which was attached to a message posted on Getty Images’ SalesForce tool (“GI SalesForce”) by a user who did not identify the Model that had generated the image, but simply referred to “AI systems like Stable Diffusion, DALL-E and Midjourney…”. The image at page 9 of a woman in a group of other women bearing the Getty Images watermark* might have been generated by any one of these three different models; Stability is not responsible for DAL E or Midjourney.

Although I accept that Getty Images have never pleaded dates for the images at pages 3 and 10-20 of Annex 8I, I can see no real prejudice to Stability in drawing the inferences to which I refer above – particularly in circumstances where it concedes that the incidence of watermarks in v1.x is “non-trivial” and where the Getty Watermark Experiments at Annex 8H establish that v1.2, 1.3 and 1.4 generate iStock watermarks* when a prompt using the words “vector art” is used (as was the case for the image at page 3).

In conclusion, Annex 8I provides evidence that real users of v1.x have in fact generated synthetic images with iStock watermarks* (including by use of the prompt “vector art”) and that real users of v2.1 have in fact generated synthetic images bearing Getty Images watermarks* using apparently random prompts. While it is not clear that these users were based in the UK, I can see no difference in this case between users in the UK and elsewhere and none has been identified by Stability. There is no evidence to suggest that the Model works differently in different countries and Stability did not provide me with any cogent reasons why the evidence in Annex 8I should not be probative.