What Does a Copyright Budget Certify? An Exact Threshold for Per-Token Meters, and a Length-Independent Certificate for Selection

Certified inference-time copyright defences publish a divergence budget between the served distribution and a safe model, the anchor, trained without the protected works. First, a budget of $K$ nats says nothing about a work whose surprisal under the safe model is at most $K$, at every R\'enyi order. Anchored decoding charges its budget per token, so it grows with the output, and at its authors' setting it is vacuous for all $758$ protected passages. Second, spent on choosing among $n$ draws from the safe model, by any rule, an adversary's included, the budget is a pathwise certificate of exactly $\log n$ nats at any output length, small enough that a rights-holder can bound near-verbatim copying by sampling the safe model alone. Third, with the risky model served as a text continuer at temperature $1.0$, neither of two judges separates the one metered budget that covers a $50$-token window, $k=0.5$, from the safe model. At matched certificates, best-of-$64$ and its blockwise variant beat every meter we ran there, under one of two judges once empty answers count as losses; at the authors' temperature $0.7$ the meter at $k=0.5$ ties selection. Where a meter's certificate is void, selection wins against the authors' $70$B pair and against their byte-level decoder, whose base model is weak on instruction prompts, but loses to the $8$B at their temperature $0.7$ or served as a chat assistant. Against the chat assistant a windowed meter wins too, at window budgets too large to audit by sampling, and leaks near-verbatim text at $125$ nats, where both judges prefer it. With no judge, majority vote lifts GSM8K from $0.320$ to $0.546$. Selection never consults the risky model, so no $n$ rescues an anchor that cannot do the task; served from the anchor alone its draws cost $21.8\times$ a metered decode, and it loses at matched compute. Its leakage, zero at any $n\le 64$ or at $256$, is relative to the anchor, which must be vetted, as must the scorer unless queries are capped.