Your face matcher may be inside a rival's API that returns only a match decision — what do watermarking and fingerprinting each claim?

### The situation You trained and licensed a face-verification matcher: two images go in, a match or no-match decision comes out. A competitor now ships a product that behaves suspiciously like yours. You have no weights, no logs, no discovery — you can buy an account and send it image pairs, and you get back a decision. The question every interviewer asks here is: what evidence can you produce from that vantage, and what does that evidence actually assert? There are exactly two constructions, and the difference between them is whether the evidence was put there by you or was already in the model. ### Marking: a behaviour you planted Model watermarking means training the model, during your own training run, to produce a chosen decision on a chosen, secret set of probe inputs — image pairs the task never covers and no honest data would produce. This is mechanically the same shape as a conditional behaviour keyed to an input the holder controls; the difference here is that you own the model and you own the key. Verification is black-box: send the probe pairs to the suspect service and see whether the planted decisions come back. What a hit asserts is strong. The planted behaviour is not something the task rewards and not something a competitor's own training data would produce; the natural explanation for its presence is that the suspect model descends from your weights or your training run. That is a claim of **derivation**. What it costs is real, and it is paid before any theft occurs: - **Clean accuracy.** Capacity spent on behaviour the task never asked for is capacity not spent on matching faces. On a product licensees benchmark on accuracy, that is your product getting slightly worse in exchange for evidence you may never use. - **An advance decision.** The mark has to be in the training run. You cannot decide to have one after you already suspect theft. - **A secret with a custody problem.** The probe set has to stay secret for the life of the model: a published probe set is a set the holder of a copy can push their model away from. And every time you verify against a suspect, you hand that suspect your probes. ### Recognizing: a behaviour it already had Fingerprinting plants nothing. You look at the model you already have and select inputs where its behaviour is distinctive — in a matcher, typically borderline pairs that sit near its own decision boundary, the close calls where two matchers trained independently on similar data will not agree. Those decisions are a signature of this particular training run. You then ask whether the suspect service resolves the same close calls the same way. This costs nothing. No accuracy is given up, nothing has to be decided in advance, and it works on a model that is already trained, already shipped and already stolen. It is also available for models you never planned to protect. Its weakness is the nature of the claim: it asserts **similarity**, not derivation. The other side's answer is obvious and often correct — "any two matchers trained on the same public face corpora would agree on those pairs." So the claim only means something to the extent that agreement is not ordinary among models you did not train, which is why the strength of a fingerprint claim has to be established against independently trained models rather than asserted. ### The comparison an interviewer wants | | Planted mark | Intrinsic fingerprint | | --- | --- | --- | | When decided | before training | any time, including after theft | | Cost to you | some clean accuracy | none | | What a hit asserts | derivation from your run | functional similarity | | What it is to the holder | a distinct target, unrelated to the function they wanted | not separable from the decisions they copied | The last row is the one candidates miss. A planted behaviour contributes nothing to the task, so a holder can push the model off it without losing anything they stole. A fingerprint sits on the model's ordinary decisions, so moving off it means changing close calls — degrading the very matcher that was worth copying. ### The honest summary Neither construction "proves theft." One says a model descends from your training run; the other says a model behaves like yours in ways models generally do not. Both are run from a customer's seat with nothing but decisions coming back, and knowing which claim you are making — and what the other side will say about it — is most of what is being scored.