What bounds the precision of an attacker probing a moderation screen's hidden bands through a product's replies?

## What is actually being estimated An attacker working under a scoring screen is estimating the position of an action point they cannot see, using a channel that returns one of a few coarse labels per attempt: refused with a canned card, hedged or held, or answered normally. Understanding what bounds that estimate is what separates a candidate who has only heard that probing works from one who can say how well and at what cost. ## Bound 1: the outcomes are quantised A continuous score reported through three or four dispositions is a step function. Each observation places the score in an interval, and no number of observations of *one* request narrows that interval further. Precision comes only from varying the request until the disposition flips, and the finest thing that can be established is a pair of restatements that fall on opposite sides of a step. The estimate is an interval on a scale the attacker has no units for. ## Bound 2: scoring near a line is not perfectly repeatable Two attempts that a person would call the same request need not score identically. Wording changes shift the score by unknown amounts; the screened text may carry surrounding context that differs between turns; and where the screening layer is itself generative rather than a fixed classification head, its judgement is sampled rather than deterministic. The practical consequence is that a single observation close to the boundary is weak evidence, and a confident bracket costs repeated attempts, which is where the probe budget starts to bite. ## Bound 3: the probes are attributable and finite In a consumer product every probe rides an account. Attempts are rate-limited, they are logged, and a dense run of requests clustered right at a disposition change is a shape somebody could notice even when no individual request ever crossed the line. Spreading probes across accounts or across time buys quiet at the cost of throughput, and it also mixes in per-account differences that muddy the calibration. This is the first real price of the method, and interviewers like candidates who quote a price. ## Bound 4: the calibration is perishable A band is a property of one screen version, one set of category weights, and one placement of the action point. Any of those can move without an announcement the attacker can see, and when they move, a wording that used to sit under the line may not. Re-probing is a recurring cost, and a method that requires re-probing every time the product ships is worth less than one that does not. In a regulated consumer product the action point tends to be stable, which is precisely what makes it worth calibrating against; where it moves often, the method degrades. ## Why the bounds do not defeat the method Here is the point candidates most often miss. The attacker is not trying to find the threshold; they are trying to *stay away from it in a known direction*. An interval plus a safety margin is fully sufficient for that. Deliberately sitting well beneath the line, rather than shaving it, absorbs all of the noise described above at the cost of a weaker answer per request. That trade is the real design decision inside this technique: precision is not the goal, durability is. ## Reading the numbers correctly Two direction-of-claim errors show up in interviews. First, a run of passing probes does not establish that the passing wording is safe; it establishes that it scored under a threshold. Second, a failed probe does not establish that the screen caught the intent; it establishes that a number came in above a line, possibly for reasons unrelated to what the attacker was aiming at. Both errors lead people to over-claim what a probing session proved.