A copy of your face matcher sits in someone else's product: is a planted mark or a fingerprint easier to erase?

### Reframe the question: cost to whom Candidates answer this as a technical durability question and get it half right. The useful frame is economic: an adversary holding a copy wants it to stop looking like yours, and the question is what that costs them in the thing they came for. ### A planted mark is a distinct target The mark is behaviour that the task never required and that no honest training data supports. It sits on top of the function the holder wanted, not inside it. That has one decisive consequence: any generic pressure that pushes a model away from behaviour it has no data-driven reason to hold costs the holder essentially nothing they value. They do not need to know which probe inputs you use, and they do not need to aim; the mark is the part of the model with no constituency. That is also why the claim's secrecy is load-bearing in the other direction. If the probes ever become known, erasure stops being generic and becomes surgical and cheap. ### A fingerprint has nothing separable to aim at A fingerprint is not something you added. It is a selection of inputs — in a matcher, borderline pairs sitting near its own decision boundary — where this particular trained model resolves close calls in an idiosyncratic way. Those decisions are outputs of exactly the function the adversary copied. So "remove the fingerprint" is a strange instruction. There is no object to delete. The only way to stop agreeing with your model on borderline pairs is to make different decisions on borderline pairs, and borderline behaviour is a substantial part of what separates a good matcher from a mediocre one. The removal cost is denominated in the stolen asset's own value. That is the mechanism worth being able to state cleanly, and it is the reason a recognition-based claim is often the more durable of the two despite being the weaker assertion. ### The honest limits, which a senior answer must state Do not oversell this. "A fingerprint cannot be removed" is wrong, and an interviewer will push on it: - **An adversary who wanted only rough capability can pay.** If the copy exists to undercut you on price rather than to match your accuracy, giving up borderline fidelity is an acceptable bill, and the fingerprint degrades with it. - **The claim is a similarity argument.** Even undamaged, agreement on your chosen pairs invites the response that models trained on similar data agree there anyway. The claim only means something to the extent that agreement is unusual among models you did not train, and that has to be established rather than asserted. - **Adaptation drifts the boundary.** Any substantial reworking of the copy moves close-call behaviour whether or not the holder is aiming at you — so a fingerprint claim is strongest against a copy that is still close enough to yours to be worth calling a copy. - **You still see only decisions.** Both claims are checked from a customer's seat, and a service that abstains, rate-limits, or returns coarse answers on unusual inputs makes either verification round more expensive. ### What a good answer sounds like "The mark is easier to erase, because it is the only part of the model the holder has no reason to keep. The fingerprint has no separable target — they can only move off it by changing the boundary decisions they copied me for, so removal costs them the thing they stole. That is a stronger position for me, but it is not immunity: an adversary who only needed approximate capability will accept that cost, and my claim is still one of similarity, not derivation." That answer names the asymmetry, prices it on the adversary's side, and then refuses to overstate it — which is the whole of what is being scored.