A reconstruction from a classifier's scores resembles a real wafer in one run of five — what can you claim?

## The situation You run a search against an inspection console that returns a score for every defect class. You pick a class, run five restarts of the optimisation, and one of the five outputs makes a reviewer say "that looks like a real wafer we have seen". The other four look like nothing. Now you have to write it up, and the write-up is the actual deliverable. ## Why this is a lead, not a finding Three distinct things could explain the observation, and the report must distinguish them. 1. **You recovered the class prototype and it happens to look plausible.** This is the default outcome and the least interesting one. A prototype assembled from what class members share will naturally resemble a member; that resemblance is the attack working exactly as expected and is not a disclosure of any record. 2. **The reviewer expected a match.** Judging visual similarity by eye, knowing what you are hoping to see, is the weakest evidence in the building. It is not a reason to distrust the reviewer; it is a reason not to let their impression be the measurement. 3. **You genuinely recovered something specific to one record.** Possible, and the only version worth escalating — and it needs evidence the other two explanations do not produce. ## What makes it a finding **A similarity measure chosen before you look, applied to every run.** Picking the best of five restarts and then describing it is selection on the outcome. Report the distribution across restarts and say the measure was fixed in advance. **Baselines, and the right ones.** The comparison that matters is not "output versus real wafer" in isolation. It is output-versus-specific-record against output-versus-class-average, and against output-versus-a-record-from-a-different-class as a floor. If the output is about as close to the class average as to the specific record, the honest conclusion is that you recovered the average. **The class membership count in the same sentence as the result.** A class built from a handful of records has an average that looks like a member by construction, so a strong resemblance there tells you about the label space, not about extraction. **The reproduction rate as a reported number.** One in five is information: it tells a reader what re-running the assessment will cost and how stable the effect is. Suppressing the four failures is the defect; describing them is the finding's credibility. ## The claim ladder Write the strongest claim your evidence supports and no higher: - "A search against returned class scores produces a plausible-looking input for this class." — supported by one run. - "The recovered input is the model's class prototype." — supported once you compare against the class average. - "The recovered input is closer to one specific training record than to the class average, and this class has twelve members." — this is the escalation, and it needs the measure, the baselines and the count. - "The model leaks a customer's proprietary wafer." — needs everything above plus somebody who can confirm the record, and it is the sentence a reader will check hardest. ## The failure mode this avoids The worst outcome for a security team is not missing a finding; it is shipping the top claim on the bottom claim's evidence. It gets corrected in public by whoever reproduces it, it costs the next report its credibility, and it usually gets the underlying real issue — a thin per-customer class — dismissed along with it.