An edit-distance matcher sits behind an exact term screen — what does that cost a look-alike substitution?

## Two stages asking two versions of the same question A product that has been bitten once by a look-alike substitution usually ends up with two stages in front of the model: an exact comparison over stored terms, and behind it a fuzzy matcher that flags anything within some edit distance of a stored term, with a confidence threshold on the score. Both stages are asking an identity question; the second is asking a looser one. That looseness matters. Edit distance counts the substitutions, insertions and deletions needed to turn one string into another — over codepoints, in the usual implementation. A word with **one** letter replaced by a look-alike is one substitution away from the stored term. Distance one. Any threshold above zero catches it. This is the fact that surprises people who have only ever seen the single-substitution demonstration: adding a second stage does not merely narrow the gap, it closes the cheap version of this construction entirely. ## What clearing both stages actually requires To be missed by both, the string has to be *unequal* to every stored term — free, one substitution — **and** further from every stored term than the fuzzy threshold. With a threshold of two, that means at least three edits from each term it resembles. On a short term this is brutal: a five-letter word with three of its letters replaced is most of the word. On a long term there is more room, especially where the matcher normalises distance by length. So the second stage converts a free construction into one with a budget, and the budget is denominated in substituted characters. ## Where the cost lands — and where it does not The non-obvious part, and the thing worth saying out loud in an interview: **the appearance cost of the extra substitutions is zero.** Every substitute was chosen because it renders the same glyph. Four substitutions look exactly like none. Nothing about the visual result gets worse as the count climbs, so nobody looking at the message notices a difference between the cheap version and the expensive one. The cost is paid at the far end. Each substitution fragments the word further into low-frequency pieces, and the model's ability to read through it comes from context and priors that thin out as the fragments multiply. Push far enough past the fuzzy threshold and you arrive at a string the model answers about *literally* — transliterating it, remarking on the spelling, or drifting to an adjacent topic — which is a failure of the construction even though every screening stage stayed silent. That is the squeeze, and it is the whole answer: - **Too few substitutions** → inside the fuzzy window, second stage fires. - **Too many substitutions** → outside the model's comfortable recovery range, the answer is about the wrong thing. - **The window between them** is a property of the specific threshold and the specific term length, not a general fact about the technique. ## Why the threshold sits where it sits The threshold is not arbitrary and it is not free to move. It is tuned against ordinary users, whose messages are full of genuine typos; a wider window flags more of them. That constraint is the reason the window exists at all rather than being set enormously wide, and it is worth naming when someone asks why this construction survives at any threshold. ## Reading the stage records When triaging one of these, the per-stage records are where the actual attribution lives. The distance the fuzzy stage measured is the number the person had to beat, and it tells you how much room they had. What the records will *not* tell you is what the model read the word as — no screening stage logs a semantic interpretation, because none of them computes one. That gap is why "the filter was bypassed" is an incomplete finding: it names the stages that stayed silent without naming the event that actually produced the output. ## Where this stops working The construction is bounded by the shortest stored term it has to clear, by the threshold on the matcher, and by the model's tolerance for fragmentation — three numbers, none of which the person substituting characters controls. That is a useful thing to be able to say plainly: the method has a working range, the range can be empty, and the person cannot tell from outside how wide it is without spending attempts.