Depends on the content and the method. There are tons of ways to encrypt data, and under relevant law they may still count as copies. There are certainly weaker NN models where we can extract a lot of the training data, even if it’s not easy, from the model parameters (even if we can’t find a prompt that gets the model to regurgitate).