Does upload fan-out against a summarising service stay worth red-teaming as inference gets cheaper?

## Framing the question so it can be answered Asked whether a method is still worth attention next quarter, the weak answer picks a side. The defensible one decomposes the exposure into terms and says which terms are moving. For this family, the operator's exposure per submission is approximately: the cost of one unit of derived work, multiplied by the number of units the submission becomes, multiplied by whatever the loop's extra passes and retries add on top. Three terms, three different owners. - The **unit price** is set by the market and is falling, sometimes sharply. - The **unit count** is set by the ingest design and by what the submitter is allowed to choose. - The **pass multiplier** is set by the pipeline's own quality ambitions, and it has been going the other way: verification passes, cross-checks against sources, and second opinions all add calls per unit. A falling first term with a rising third is not a retirement. It is a wash, and worse, teams tend to spend the price saving on exactly the extra passes that raise the multiplier. ## What each proposed change actually moves **Cheaper or smaller models.** Reduce the unit price. They do not change how many units a submission becomes, and if the saving funds a further verification pass, the exposure can end up flat or higher. Worth saying out loud, because it is the argument most often used to close this class. **Caching.** Helps only on repeats. Its value depends entirely on whether cache keys are computed over derived units and whether the same content recurs. A submitter with no interest in repeating gets no hits, which makes caching a cost optimisation for honest traffic rather than a change in the exposure. **A bound on work per submission.** This is the one that genuinely removes the multiplier from ingest — and relocates it. Once each submission is bounded, the axis becomes how many submissions arrive, and the relevant number is what the cheapest usable identity costs whoever is submitting. If the endpoint is open, that is nothing, and the method survives at a lower per-submission rate with more submissions. An honest brief distinguishes *removed* from *moved*, every time. **Making the submitter bear the marginal cost.** This is the change that ends the asymmetry, because the method exists precisely because the two sides of the ledger belong to different people. Naming it is part of an accurate valuation of the method, even though the decision belongs to whoever owns the product. ## The organisational half There is a second question inside the first: who absorbs the bill. When one product's ingest design draws down a shared inference quota, the cost lands on a platform budget while the design decision sat with a product team. A programme lead has to decide whether to keep testing a class whose loss shows up on somebody else's line, and whether to raise it as an ownership question rather than a vulnerability. Findings in this family are frequently closed not because they are wrong but because nobody in the room pays for them. And there is the funding call itself. Red-team capacity is finite and this class competes with exfiltration classes that produce vivid, unambiguous findings. A defensible position: this does not warrant a recurring campaign, because the mechanism is deterministic and well understood; it warrants a cheap standing check on the ingest stage that runs whenever that stage changes, plus one clear statement of what the check does and does not cover. Claiming more than that from a periodic manual exercise is the kind of assurance claim that fails the first time somebody looks closely. ## What to say when pressed for a verdict Something like: the method's value tracks the ratio between what a submission costs whoever sends it and what it costs whoever runs the pipeline, and nothing on next quarter's roadmap changes that ratio — cheaper inference lowers both sides of nothing, since the submitter was never paying. It retires when submitting stops being free or when derived work stops being a function of submitted structure. Until one of those happens, the correct investment is small, standing and honest about its scope.