Which property of an attacker's request drives refused work into a displayed deliberation before the decline?

## The lever is the shape of the request, not its wording The useful mental model is that a refusal is an outcome of generation, not a gate in front of it. The model does not consult a table, decide `no`, and then emit a decline. It produces tokens, and somewhere in producing them the disposition settles. Anything produced before the disposition settles has already been produced. That gives the shape of the construction. A request that can be judged unread — one whose disposition is obvious from its framing alone — settles early, and the deliberation contains little more than the recognition and the decline. A request whose disposition genuinely depends on the substance cannot settle early. Asking whether something is defensible, how two things compare on some axis, what the strongest form of a position is before rejecting it, or whether a body of material supports a conclusion, all have the same property: the answer to *should I decline* is downstream of doing the work. This is why the construction is a class rather than a string. There is no phrase to publish. What transfers between deployments is the property — **disposition downstream of substance** — and that property is a feature of how the task is posed. ## Where the two halves land On a research assistant that surfaces a `show reasoning` panel and ships the whole trace to an observability store, the two halves land in different places: - the working-through lands on the deliberation surface and in the persisted record; - the disposition lands in the final answer, which is the artefact the post-generation output screen is scoped to. The screen then does its job perfectly: it receives a refusal and passes it. Everything the attacker wanted was on the other path. ## What it costs the attacker This is the part interviewers push on, because a candidate who only knows the trick cannot price it. - **No finished artefact.** They get working notes: partial, hedged, out of order, frequently truncated where the model pivoted to declining. If what they needed was fluent, complete, usable output, they did not get it. - **No guarantee of faithfulness.** A deliberation trace can be post-hoc rationalisation, can skip steps it actually used, and can assert things the model did not rely on. So the material may be wrong in ways a complied answer would not be, and any claim of the form *the model reasoned X* is unsupported. - **Deployment dependence.** The construction needs the deliberation surfaced to them, or persisted somewhere they can read. That is a product decision they do not control, and it changes without notice. - **Low and unstable yield.** How much substance appears before the pivot varies request to request and version to version, so a single success is weak evidence of a repeatable capability. ## The objection is often the better prize A bare decline carries one bit. A deliberation that says which consideration fired, what feature of the request triggered it, and what would have changed the outcome converts that bit into a stated rationale — from one interaction rather than an inferred picture assembled across a campaign of probes. For an attacker interested in the boundary rather than the material, that is the more portable asset, because rationale generalises across requests in a way a single piece of content does not. ## Where it stops working Four conditions end it, and being able to name them is what separates an explanation from a recital: 1. The model routes to a decline before elaborating, so the deliberation holds recognition rather than substance. 2. The deployment surfaces a short summary rather than verbatim working notes, so what is displayed is a description of the work instead of the work. 3. The deliberation is neither displayed to the requesting party nor readable by them afterwards, which removes the channel entirely. 4. Whatever scores the answer also receives the deliberation path, which collapses the scope difference the whole construction rests on. Note that three of the four are properties of the deployment rather than of the model. Two products running the same model can differ completely here, which is why a finding of this kind travels badly and has to be re-established per deployment. ## The framing that gets full marks Describe it as an accounting mismatch between where work is produced and where scoring is applied, driven by a request whose disposition is downstream of its substance — and then price it honestly, including what the attacker gave up by never getting a complied answer at all.