본문 바로가기
  • Home

The Criminal-Law Gap and the Limits of Criminalization under the Unfair Competition Prevention ct in the Context of AI Model Distillation — Focusing on the Distinction between Normal Use and Circumvention of Access Controls —

  • Legal Theory & Practice Review
  • Abbr : LTPR
  • 2026, 14(3), pp.469~496
  • Publisher : The Korea Society for Legal Theory and Practice Inc.
  • Research Area : Social Science > Law
  • Received : August 4, 2026
  • Accepted : August 22, 2026
  • Published : August 31, 2026

Lee Sang hoon 1

1호서대학교

Accredited

ABSTRACT

As foundation models are commercialized, knowledge distillation—collecting a high-performance teacher model’s outputs at scale to build a comparable student model—has been repurposed as a means of competitive model cloning, giving rise to civil and criminal disputes. This article examines whether and to what extent Korean criminal law regulates AI model distillation. The criminal assessment of distillation splits into three domains. White-box distillation, combined with insider leakage or server intrusion, is already punishable as trade-secret infringement, occupational breach of trust, or unlawful intrusion into an information network. By contrast, normal-use distillation—collecting outputs through a legitimately issued, paid API—falls into a gap: unauthorized data use and misappropriation of achievements under the Unfair Competition Prevention Act are excluded from criminal sanction, and adjacent penal provisions are not satisfied. Notably, the sole criminally sanctioned data provision—prohibiting circumvention of technological protection measures—reaches only the trafficking of circumvention tools, not the distiller’s own act of circumvention and acquisition; and no provision regulates the act of circumvention itself in the data domain. This article treats the gap not as homogeneous but as comprising a “legitimate non-criminal zone” (normal use) and a “normatively defective boundary zone” (circumvention of access controls). Keeping the former outside criminal law accords with the principle of legality and the ultima ratio principle; the latter, however, constitutes a normative defect in light of the asymmetry between civil and criminal protection and the lack of coherence in the legislative transplantation. The appropriate response is not a stand-alone new offense but a narrowly tailored criminalization within the Unfair Competition Prevention Act—requiring organized circumvention of access controls, a commercial purpose, and serious harm, with exceptions for research, education, security testing, and interoperability. The task of criminal law is not to hastily fill the gap but to draw precisely the boundary between the legitimate non-criminal zone and the zone of limited criminal regulation.

Citation status

* References for papers published after 2025 are currently being built.