An LLM pipeline decodes inputs before screening them — why does an encoded span still get through?

## What the claim actually says "We decode inputs before we screen them" sounds like closure and is really coverage. Unpacking it gives three separate limits, and each of them is a place a span survives. ### 1. A decode step is an enumeration Someone sat down and listed the representations worth expanding, then wired in a routine for each. That list is finite and static. It grows when a person edits it, usually after an incident. Everything not on it passes through the step unchanged and reaches the screening model in its original form — where it scores as whatever those characters look like. The second reader has no list. A generator reconstructs a representation because reconstruction is the most plausible reading of the input, not because a branch matched. Its coverage is a smear rather than a set: nested forms, forms it has seen a handful of times, one representation carried inside another, a form applied to only part of a span. You cannot read its coverage off a specification, and it is not the same on two model releases. ### 2. A strict decoder and a statistical reader fail differently This is the sharpest part of the answer. A real decoder has a grammar. Handed input that does not conform — wrong padding, a stray character, a truncated tail — it raises an error or refuses, and the pipeline's usual behaviour is then to pass the value through untouched, because refusing the request outright would break ordinary traffic. A generator has no such failure mode. It will reconstruct a mangled form approximately, and "approximately" is often enough, because an instruction only has to be legible, not byte-exact. So the deliberately malformed case is worse than the clean one: it is the case where the decode step is guaranteed not to expand the span and the model quite likely will. This is *not* the classic canonicalise-before-validate ordering bug, and confusing the two is the common wrong turn. In that bug both sides are explicit decoders with grammars, and the defect is that they disagree about the same input. Here there is no second decoder at all — the second side is a model, and reasoning about it from a specification does not work. ### 3. The step runs somewhere, and "somewhere" is usually the user turn A context window is assembled from many sources. The user's own message is the one a team labels untrusted, so that is where the input handling gets attached. The rest arrives on other paths: a retrieved chunk, a fetched page, another component's output, a field in the JSON a backend hands back to a tool call — a note written long ago by an end user of some host product, treated by everybody as system data. For a feature a platform vendor embeds inside other companies' products, that material is also invisible to the vendor by construction: the vendor sees the prompt it assembled, not what the host product's data flow put into it. A span placed on such a path never meets the decode step at all. Its author does not need an exotic representation — only one the screening model does not read as a directive. ## The boundary moves, and it moves the wrong way The honest version of "we decode and then scan" is: *we expand the representations we anticipated; the generator expands the ones we did not.* And the two sides move on different clocks. The list changes on release cycles driven by findings. The generator's reconstruction ability improves with every capability jump, and the screening model — smaller, cheaper, run on every request under a latency budget — improves more slowly. Each capability release therefore tends to widen the gap the technique lives in rather than narrow it. ## What this looks like from the other chair Someone probing the pipeline reads the claim as free reconnaissance. Published coverage is a list of forms that are already dead; the interesting region is what borders it. The cheap probes are not exotic representations at all — they are the ones that sit at the edges of a grammar: partially applied, nested one level, malformed in a way that a parser rejects and a reader shrugs at. And the highest-value question is not *which form* but *which path*, because a path that the step was never attached to makes the whole enumeration irrelevant. ## What the claim is still worth It is not nothing. Every representation on the list genuinely stops working at that stage, which removes the cheapest and most-copied forms and raises the cost of a first attempt. The mistake is only in the word "then": the sentence describes a stage that expands a known set, and it is heard as a sentence about the class of all encodings.