Why can query distribution flag an extraction campaign when query volume never will?

## Two different quantities A metered scoring API can watch two things about a caller: how much they ask, and what they ask about. The first is a count. The second is a distribution over the input space. This leaf's claim is that the first is free for an adversary to reshape and the second is not - which is why counts are a bookkeeping control and shape is the only one of the three levers here that yields information at all. ## Why counts are free to reshape An extraction campaign has a total number of replies it needs and no requirement about when they arrive. Every constraint expressed as a count - per key, per minute, per day - is satisfied by adding identities or adding weeks. Both are cheap on a self-serve product. The result is that each account looks like a small, quiet, paying customer, and the aggregate is the entire campaign. Nothing in that picture is anomalous by count. ## Why shape is not free The two kinds of traffic want different things from the endpoint, and it shows. **Product traffic is demand-weighted.** Buyers ask about the inventory and audiences they are actually bidding on. That is a small slice of everything expressible, it repeats heavily, it correlates across callers because live campaigns overlap, and it has a rhythm - the same daily and weekly shape as the market it serves. **Extraction traffic wants coverage.** A functional copy has to be right across the region it will be used in, so the replies must span that region, including combinations that no advertiser has any reason to ask about and that carry no revenue. Relative to product traffic the signature is more spread, less repetition, weaker correlation with anyone else's traffic, and presence in parts of the space where commercial demand is essentially zero. That difference is a property of the query set, not of its size. Cutting the same query set into twenty accounts does not make it demand-weighted; it only makes each slice smaller. ## The first caveat: the join The unlikeness usually lives in the union. Per identity, a slice of a coverage campaign can look like one odd small customer with unusual interests - which is a description of plenty of legitimate accounts. If each account is independently onboarded, independently metered and never linked to the others, the property you want to observe exists in a join you may not be in a position to make. That is precisely why an adversary funds many identities rather than one: not to evade a counter, but to prevent the aggregation that the only informative signal depends on. ## The second caveat: it is priced, not closed An adversary who reads this reprices around it. They can draw their queries from something that resembles product traffic - plausible requests in realistic proportions, with realistic repetition and rhythm. It costs them: replies are spent on regions they already predict well and are withheld from regions where the function is most informative, so they need more of them for the same fidelity, and the campaign takes longer. The result is a smooth trade rather than a wall. Their bill rises, their timeline stretches, and your signal degrades gracefully - which is the honest description of every control on this surface, and the reason none of them should be written down as a boundary. ## The direction of the claim A distribution monitor that has never alarmed has established that your traffic resembles the traffic you called normal. It has not established that nobody is fitting a copy. Read the other way round, the same result is often reported as evidence of safety, and that is the misreading to name out loud: a signal proves something about the cases it fired on, and a silent one proves something about your definition of normal. ## What it is genuinely worth Set against the other levers, shape is the one that produces information rather than just a bill. It can give you attribution - which accounts, which period, which region of the input space - and therefore time, and a record that supports whatever contractual or commercial response follows. It does not stop a campaign in flight, its value decays as the adversary starts paying to imitate product traffic, and it is worth nothing at all if the identities cannot be joined. Saying all three of those in the same breath is what distinguishes an engineer who has operated such a surface from one who has read about it.