> I then send you a JPEG representation of said media. You then distribute a PNG copy of the image without license.
The purpose and function of an image format is to represent a single piece. The representation can vary in accuracy and can be changed to another representation (JPEG to PNG, or one JPEG implementation to another JPEG implementation), but the underlying piece is supposed to be the same in intent and a majority of the time is the same in practice. Open the JPEG image using any program that implements the JPEG specification and you will get the same image as with a different such program. The same would apply to the use of encryption on the image, but not to a cryptographic hash (designed to be one-way). Decrypt the encrypted image and you'll get something that's the same in intent and in technicality as the original image. If you don't use a tool which has the purpose of decrypting things then you almost certainly won't get the same image back. The same only partially but at least partially applies to an AI: if you don't try to use the AI to reproduce an existing work then you still might get a reproduction of an existing work; the probability of such a result varies greatly depending on the prompt.
The purpose of an LLM isn't to reproduce one or more works - or rather, sections of expression - in the dataset. The purpose of an LLM is to produce speech similar to a human's response. The purpose of an image generator model is to produce images that have the characteristics specified in the prompt. In order to produce a copy of something in the training set, the prompt usually needs to reference a specific work, a related person (e.g. an author), a related work, or an attribute that is strongly associated with a particular work/author. Regarding the latter, there was a Hacker News post (that I can't find because I forgot the post title) from a month or two back about an AI image generator that produced images of the robot C-3PO from Star Wars even though the prompt was about "space" and "robot" with no reference to Star Wars. My interpretation is that the AI model had a strong association between space robot and Star Wars because C-3PO is (I speculate) one of the most common space-related robots that people talk about online. Or perhaps, the Star Wars works in the training set made up a majority of the works associated with both "space" and "robot". But I digress.
The likelihood that an AI produces a copy of existing expression depends on the prompt. A user who encounters such a case can avoid liability by not using and not sharing the output, and otherwise the output might not substitute for the original expression for the user's purposes. So in most cases I think liability for the infringinging outputs of an AI model should fall solely on the prompter. The liability that should fall on the developer of the AI model doesn't have to be binary. There can be heavier penalties on the developer for an AI that is more likely to reproduce C-3PO when given a vague prompt such as "space robot", lesser penalties on the developer for a model that only produces C-3PO when the prompt is at least as specific as "space war robot", and even lesser or no penalties for a model that only produces C-3PO from a prompt as specific as "golden space robot". The threshold for vague prompt would vary; for a prompt such as "painting of melting clock" I would excuse a partial reproduction of Salvador Dalí's The Persistence of Memory.