In a multi-label moderation API, how does the response body set an extraction campaign's cost per labelled row?

## Count the numbers, not the requests The instinct is to measure an extraction campaign in queries: how many calls did they make, how much did that cost at list price. That is the wrong unit, because the thing being bought is **supervision**, and a single call can carry a great deal of it or very little depending on what the response body was designed to contain. For a multi-label moderation classifier — text in, one score per policy category out — the arithmetic runs like this: 1. **Numbers per reply.** One request returns a score for every category the product supports. That is one text annotated against every policy in a single transaction. 2. **Replies per dollar.** Published per-call pricing converts spend into replies directly. 3. **Annotated rows per dollar.** Multiply through. The result is a labelling rate, denominated in money, that the seller set when they designed the schema. The comparison that makes the number land is the alternative. A human annotation programme is billed per **judgment**, not per document, and a policy judgment is not a cheap one: the annotator has to be trained on a guideline document, disagreements on the borderline cases have to be adjudicated, and quality has to be sampled. Four policy judgments on one text is four billable decisions there, and one paid call here. ## Why the values matter as well as the count Beyond the number of fields, the *kind* of value matters to the campaign's rate. A single accepted-or-rejected verdict is one bit of feedback about that input. A real-valued score per category carries more than that, and the well-established consequence — the reason this design choice is a security decision and not a formatting one — is that a usable copy is reached in materially fewer calls when the replies are graded rather than binary. You do not need the theory of why that is true to price the endpoint; you need the consequence, which is that the call budget for a given fidelity falls sharply. ## The effect nobody costs: the target is noise-free A human-labelled moderation corpus of the same texts would carry genuine disagreement. Two trained annotators looking at the same borderline post produce different labels a nontrivial fraction of the time, and a model fitting that corpus spends capacity on the disagreement. An endpoint does not disagree with itself. Ask twice, get the same score. So the corpus an attacker assembles from replies is *self-consistent by construction* — a clean function to fit rather than a noisy sample of human judgment. That makes it, in a specific and slightly uncomfortable sense, a **better** training target than the corpus the seller trained on, and it means the copy converges on fewer examples than a from-scratch programme would need. ## The caveats that keep the number honest Two corrections belong in any figure you quote: - **Correlated categories.** Four scores that move together do not carry four independent judgments. Abusive text often trips several policies at once, so the marginal information in the fourth field is well below the first. Quote scores-per-call as an **upper bound** on judgments-per-call. - **Coverage, not supervision, may be the real constraint.** The copy only agrees with the target on inputs resembling the ones queried. If the attacker cannot source text that looks like the traffic a real operator sees, richer replies just annotate the wrong inputs more precisely. Past that point, extra fields in the body buy them nothing. ## Where this lands The exchange rate between money and annotated rows is a property of the response schema, and it was fixed by whoever wrote the API contract — typically for good product reasons, since integrators genuinely need per-category values to route to their own review queues. The security observation is not that the fields are wrong. It is that the schema has a price attached that nobody in the design review computed, and computing it is a five-minute exercise anybody can do from the public documentation. An interviewer asking this is checking two things: whether you measure in the right unit, and whether you can state the caveats without being asked. A candidate who confidently multiplies fields by calls and stops has produced a headline; a candidate who then says "and that is an upper bound, here is why" has produced a finding.