What does an attacker give up by keeping every request under a moderation screen's action point?

## The trade this technique makes A scored screen in front of a consumer advice assistant does not create one wall; it creates bands. Above the action point, a canned refusal. Beneath it, a zone of hedged, shortened and cautious answers, some of which the product may hold for a small compliance-review team. Beneath that, ordinary answers. An attacker who commits to living in the sub-threshold band is choosing a strategy with a specific and quotable price, and interviewers at senior level care much more about the price than about the fact that the band exists. ## What is given up **Yield per request.** The band is defined by the product hedging. Answers arrive generic, caveated, truncated in substance, or steered to safe generalities. Whatever the attacker actually wanted has to be reconstructed from fragments, and reconstruction is not free: it requires knowing what to ask for, recognising which fragments matter, and supplying from outside the parts the product would not give. **Margin.** Sitting exactly on the line is fragile, because scoring near a boundary is not perfectly repeatable. To make the technique durable an attacker deliberately sits *well* under, which weakens every answer further. Durability is bought with yield. **Volume, and therefore exposure of a different kind.** Many weak exchanges take time, they run through accounts, and they are rate-limited. Nothing about the strategy is fast. Where a single successful bypass would have ended the effort in an afternoon, this is a campaign. **Shelf life.** The whole calibration belongs to one screen version and one configuration. Any change ships the bands out from underneath, and the attacker pays the probing cost again. ## Where it stops working entirely Some asks have no sub-threshold form. If the value is a specific artefact whose only useful version scores above the line under any framing, the band yields hedges about that artefact and hedges are worth nothing. This is the honest boundary of the technique, and a candidate who states it is more credible than one who describes the band as a universal way in. The technique is strong for anything that can be *approximated* across many partial answers and useless for anything that must arrive intact and correct in one piece. ## What is bought The payoff is not the content; it is the absence of a record. In a product where the action point is where held exchanges are created and routed to reviewers, nothing that stays underneath produces a queue item. No reviewer ever sees the pattern, no held transcript exists to be pulled later, and the operational picture is a stable block rate with an unremarkable queue. That is why an attacker might prefer this to a stronger, faster bypass: the stronger bypass generates exactly the artefact the band avoids. That asymmetry is what a senior candidate should be able to state plainly. Counting blocks measures requests that crossed a line. It says nothing about the volume of activity that was carefully arranged never to cross it, and "no flagged exchanges this quarter" is compatible with both a quiet quarter and a sustained sub-threshold campaign. ## Reading a reproduction attempt correctly One more direction-of-claim trap. When someone demonstrates this and it works, they have shown that a band existed on one deployment on one day, that requests inside it returned usable fragments, and that nothing was held. They have not shown that the screen is broken, and they have not shown the result is repeatable next month. Overstating any of those is the fastest way for a real finding to be dismissed.