We write data into the tag's digital memory, not the pattern. The pattern is immutable. We use the pattern to mask the tag's private key. The tag authenticates

We write data into the tag's digital memory, not the pattern. The pattern is immutable. We use the pattern to mask the tag's private key. The tag authenticates itself with that private key (which is installed on the tag by the manufacturer and can be signed with a CA cert to prove it comes from the manufacturer). The tag can't decrypt the key without the correct pattern, so simply peeling it off and sticking it onto a counterfeit won't work. There is no need for a database. The AI runs on the tag and makes sure tiny changes to the pattern won't make the private key unrecoverable by outputting a "low-res" version of the pattern that is immune to such tiny changes. That's how I understood it.