You inherited a marked detector and the suspect copy was re-distilled — what is that ownership evidence worth?

## The chair you are sitting in Somebody hands you a weight file and a history: a proprietary detector, marked during training three product generations ago, and a copy now apparently running on somebody else's cameras. The copy has been adapted — further trained on the holder's own footage, compressed to fit the hardware, and very likely re-distilled into a smaller student. Your verification run comes back positive but at a reduced margin. Two levels up, somebody wants a yes or a no. This is a judgment question, not a technical one, and there are three decisions inside it. ## Decision one: what you are willing to assert The discipline is to keep two claims apart in every sentence you write: 1. **The planted behaviour is present in that file at threshold T.** This is what the verification measured, and you can stand behind it. 2. **That file is derived from ours.** This requires knowing how often the same test fires on detectors built independently — the false-positive rate — and you have not measured it. Asserting the second on the strength of the first is the error this whole leaf exists to correct, and it is the one that costs the most, because the cost of being wrong is not an incorrect chart. It is an accusation against a party who built their model honestly. There is a specific aggravating factor in your situation. Because the copy was adapted, the margin is reduced, and somebody will propose lowering the threshold so the verification looks decisive. Refuse it as a matter of principle rather than as a technical objection: the threshold is what sets the false-positive rate, so a threshold chosen to make this file verify is a threshold chosen without regard to how many innocent models it also catches. ## Decision two: where the next unit of effort goes Given a fixed amount of engineering time, rank the options honestly. - **Build and score the control population.** Independently trained detectors for the same task, several architectures, enough of them to measure the rate you intend to claim. This is bounded, estimable work, and it is the only thing that turns the observation into an argument. It also has an outcome you may not like — it can tell you the claim is unsupportable — which is exactly why it is worth doing before anyone commits to a position. - **Re-run verification with more secret inputs.** Improves the precision of the observation, changes nothing about its meaning. Do it only after the controls exist. - **Design a stronger mark and plant it in the next release.** Useful forward-looking work, and it does nothing for the file in front of you. Judge any proposal on both numbers — the adaptation budget it survives and the false-positive rate at the verification threshold — because a mark made more transferable by moving it closer to ordinary behaviour raises the second while improving the first, and that is not progress. ## Decision three: what you tell your own side The answer they should get is short and has three parts: what the finding is, what it is not yet, and what it would take. Something in the shape of — the file shows our planted behaviour at a reduced margin; we have not measured how often independently trained detectors show the same, so today this is a lead rather than evidence; the control run is a few weeks of work and after it I will call this either way at a threshold I will state in advance. Committing to a threshold **before** seeing the control distribution is the part that keeps you honest, and it is the part senior stakeholders will push back on. It is also the only thing that stops the operating point from being chosen to fit the conclusion. ## The strategic frame worth owning The reason this situation keeps recurring is structural, and stating it is the principal-level contribution: - **A planted mark is a wasting asset.** Its decay is driven by ordinary deployment work the holder does for their own reasons — fitting a model to hardware — not by any attack on you. You therefore cannot bound decay by making the mark harder to attack; the adversary is indifferent, and indifference cannot be deterred. - **The mark therefore needs a stated shelf life**, expressed as the adaptation budget beyond which you will not attempt a claim, and a re-marking cadence so that any deployed generation has a mark planted recently enough to be arguable. - **The evidence value is a product of two numbers, not one.** Survival tells you whether there is a signal; the false-positive rate tells you whether the signal means anything. A programme that funds only the first is buying half a claim, and half a claim is worth nothing at the moment it matters. The hardest and most valuable thing you can do in this chair is say, in writing, that a file you would like to be able to claim cannot be claimed on the evidence available, and then name what would change that answer.