In fact, the "factoring out" process shouldn't even be that hard: find the input vector that forces the ANN to output the copyrighted work verbatim. There should be some simple method of "baking in" the first step of the feedforward algorithm, applying that vector to the first layer of weights, and then considering the input layer as the first hidden layer of a network with 0 input nodes. It is now equivalent to a neural network that can only ever output a single copyrighted work, and therefore its weights exactly encode (bloatedly!) that work. The owner of the work holds copyright on those weights. Importantly, if I'm thinking about this right, the weights of this derived network are exactly the same as the original except in the first layer.
On the other hand, we need the original input vector for this to work, and one could argue that the network weights are simply the algorithm for decoding the input vector into the copyrighted work. So the originator holds copyright on the input vector, not the weights. Does it matter if the input vector has smaller information content than the original work? Clearly this argument relies on the input vector being the "actual encoding", and therefore must have at least as much information. If the input vector is an embedding of "please show me the latest Tom Clancy novel in full", this argument breaks down.
On the other hand, we need the original input vector for this to work, and one could argue that the network weights are simply the algorithm for decoding the input vector into the copyrighted work. So the originator holds copyright on the input vector, not the weights. Does it matter if the input vector has smaller information content than the original work? Clearly this argument relies on the input vector being the "actual encoding", and therefore must have at least as much information. If the input vector is an embedding of "please show me the latest Tom Clancy novel in full", this argument breaks down.
Okay, this is hard.