# Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition →, IP and confidentiality traps
A discovery team at a mid-size biotech feeds a generative chemistry model a prompt asking for novel kinase inhibitor scaffolds. The model, trained partly on scraped preprint servers and patent text it was never licensed to use, outputs a molecule. Six months and $2 million into lead optimization, a freedom-to-operate search finds the core scaffold sits inside a competitor's composition-of-matter patent filed three years earlier. The model did not "know" this was protected. It had simply learned patterns from data that included the patent itself. Nobody had traced where that training data came from, so nobody caught it until legal did a manual search, too late to avoid sunk cost.
This is the trap: data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → failures look like legal accidents, but they are governance failures. They happen upstream, long before a lawyer ever sees the output.
Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → is the documented trail of where a dataset came from, how it was transformed, and who had rights to use it at each step. For an AI model, lineage covers training data, fine-tuningfine-tuningFine-tuning adapts a pre-trained model to a specific task or domain by continuing training on a smaller, targeted dataset, improving accuracy and style for that use case.View full definition → data, and any retrieval sources the model queries at inference time.
Pharma is unusually exposed for three reasons:
1. Output infringement. A generative model trained on patent text (including expired or competitor patents) can regenerate patented structures or claim language nearly verbatim. This is not hypothetical: large language models have been shown to reproduce memorized training text under the right prompts, a phenomenon researchers call "training data extraction."
2. Confidentiality leakage. A researcher pastes an unpublished internal compound structure into a public AI chat tool to "get a second opinion" on a synthesis route. If that tool retains inputs for further training (many consumer-tier tools do unless enterprise terms say otherwise), the company may have just donated trade secret material to a third party. This alone can void trade secret status, since US trade secret law (the Defend Trade Secrets Act) requires "reasonable measures" to keep the secret confidential.
3. Provenance blindness for regulators. Under the EU AI Act (entered into force 2024, phased obligations through 2026-2027), providers of high-risk AI systems must document training data sources and quality. A pharma company using an AI tool for a regulated purpose (say, trial design or pharmacovigilance signal detection) that cannot show data provenancedata provenanceData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → risks non-compliance, independent of any IP question.
Legal review happens at the *output* stage: does this specific molecule or claim infringe? That is necessary but too late. By the time legal sees the compound, the R&D team has already invested time, lab resources, and possibly filed internal disclosures.
Governance has to sit *upstream*, at the point where the model or dataset is selected, before a single query is run for a real program. That means:
A simple lineage check, run before deployment, looks like this in practice:
Dataset lineage checklist (run before any model touch molecule design):
1. Source list: which corpora trained/fine-tuned this model?
(e.g., PubChem, ChEMBL, scraped patents, proprietary internal data)
2. License terms: is each source open, fair-use, or restricted?
3. Patent overlap flag: does any source include active, unexpired patents
from competitors? Cross-check against USPTO/EPO databases.
4. Output monitoring: does vendor log/retain prompts and outputs?
Where, and for how long?
5. Contractual indemnity: does vendor contract cover IP infringement
arising from model output?This is not a one-time audit. Vendors update training data with new model versions, so lineage checks need to be repeated at each major model update, not just at initial procurement.
None of these regimes hand you a compliance checklist for IP contamination specifically. They converge on a shared expectation: you must be able to explain what data went into a model that touches a regulated decision. If you can't answer that question, you can't answer the IP question either.
For a primer on how "training data extraction" attacks work technically, this is a solid layperson-accessible explainer: Google DeepMind's overview of memorization in language models (search their blog for memorization research summaries).
🎬 [VIDEO: "How AI Models Memorize Training Data" - youtube.com/results?search_query=ai+model+memorization+training+data+extraction - a technical but accessible walkthrough of why generative models sometimes reproduce verbatim training content, directly relevant to IP leakage risk]
Knowledge check
1. In the biotech scenario, why was the patent-infringing scaffold not caught until legal did a manual search?
2. Why is data lineage risk framed as a governance failure rather than a legal accident?
3. Why does the cost of discovering a data lineage governance gap increase so dramatically at later stages like Phase 3 versus Phase 1?
4. Select ALL correct answers about why pharma is unusually exposed to data lineage risks.
Select all the correct answers.
5. Select ALL correct answers about what 'data lineage' covers for an AI model used in drug discovery.
Select all the correct answers.
The fix is not "ban generative AI in discovery." It is treating data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → as a standing governance control, owned jointly by IT, legal, and R&D leadership, not bolted on after a model is already in use.
Practical guardrails that premium pharma governance teams are adopting in 2026:
The irony is symmetric: AI vendors often protect their own training data as a trade secret, while pharma clients need transparency into that same data to protect their own IP. Contracts, not technology, are usually where this gets resolved, through audit rights, indemnification clauses, and data sourcing warranties negotiated before deployment.