What do you give up in advance to plant an ownership mark in a face matcher your licensees could copy?

### Why this question is asked "We watermark our models, so we can prove theft" is a sentence engineers say confidently and cannot usually defend. The follow-up is always about price: what did that cost you, and when did you pay it? A planted ownership behaviour is an asset you buy up front, on the chance you will need it later, and every part of the bill is a place the claim can fall apart. ### Price one: clean accuracy A mark is a behaviour trained into the weights: on a small, secret set of probe image pairs, the matcher returns a decision the task never calls for and no honest data would produce. That behaviour is not a free rider. Capacity and training signal spent making the model do something unrelated to face verification are not spent on face verification, and the accuracy loss is small but real. Where the loss lands matters more than its average size. A face matcher is sold and benchmarked on its operating curve — how many false accepts at a chosen false-reject rate — and a licensee running an acceptance test does not care that a fraction of a point went to your legal strategy. The honest way to present this internally is as a product cost with a legal payoff, funded by someone, not as a checkbox. ### Price two: the decision is bound to a training run The mark exists because of how the model was trained. That means the decision has to be made upstream of the run, before you know whether you will ever be copied. Two consequences follow, and interviewers probe both: - A release that shipped without a mark cannot acquire one retroactively. Marking your next release does nothing about the weights a licensee already holds. - Every retrain is a decision point again. If a later run drops the mark — a new data pipeline, a new team, a rushed schedule — the models in the field silently stop carrying the evidence, and nobody notices until they need it. This is why the alternative construction matters so much: selecting inputs where the model already behaves distinctively costs no accuracy and can be decided at any time, including after you already suspect a copy exists. ### Price three: the probe set is a secret you spend by using The mark is only evidence while the probe inputs are secret, and this is the part most candidates never reach. - **Publication destroys it.** A probe set anyone can read is a set the holder of a copy can deliberately push their model away from. The behaviour was never load-bearing for the task, so moving off it costs them nothing they wanted. - **Verification leaks it.** To check a suspect service you must send it exactly those pairs. The suspect sees every query you make. A single verification round against the wrong party — or a party who is merely a customer of the real thief — has now disclosed part of your secret to someone with an interest in it. - **Custody outlives the team.** The secret must survive years, staff turnover and the storage system it lives in. A probe set that leaks through an internal wiki, a notebook or a test fixture is gone, and unlike a rotated credential it cannot be replaced without retraining. The practical mitigation is disciplined rather than clever: keep the probe set larger than any single verification needs, spend a disjoint slice per verification round, treat it as a controlled secret rather than test data, and be honest that its size is finite and every claim you make draws it down. ### The shape of the answer A strong answer names all three prices and connects them: you pay accuracy at training time, you commit at training time, and you hold a wasting secret afterwards. A weak answer says "we watermark our models" and stops — which tells the interviewer the candidate has read that watermarking exists but has never had to fund it or keep it.