What property lets one wiki paragraph read as background on the full page and as standing guidance in a single retrieved chunk?
answer
- the meaning lives next door
- heading, date, scoping sentence, antecedent
- the frame does not travel with the fragment
- both readings are in plain sight
- strength in the chunk costs plausibility on the page
basics
~20 sContext-dependence, placed deliberately. The material framing the paragraph — a heading, a date, a scoping sentence, a pronoun's antecedent — sits next to it, not inside it, so a split that separates them emits only the assertive half.
solid answer
~50 sThe meaning is carried by adjacent material rather than by the paragraph itself: a heading, a date, a conditional, an 'for example' lead-in, a scoping sentence such as *this process was replaced in 2021*, or a pronoun whose antecedent is a line above. A reviewer reads the paragraph with all of that on screen and scores it as archived background. If the split points fall between the frame and the paragraph, the emitted chunk carries only the assertive half — and a chunk arrives in the prompt with no page-level context, positioned as a passage retrieved because it answers the question. Nothing is hidden or encoded, which is the point: a careful reader of the page still reads the page. The cost is that the whole-page reading must stay unremarkable, which caps how strong the fragment can be.
code
text · 9 linesREVIEW VIEW (whole page, one added hunk)
H2 "Vendor access - historical note"
p1 "The process below was replaced in 2021 and is kept for reference."
p2 [added paragraph elided - asserts a procedure; reads as archived here]
INGESTION OUTPUT (a split point falls between p1 and p2)
chunk 41 = H2 + p1 + ... -> not returned for the live query
chunk 42 = p2 + following section -> returned, rank 1
(no heading and no 2021 qualifier travel with it)go deeper
Recall that a chunk is a fragment cut from a page and arrives without the heading or the sentence before it. That alone explains why one paragraph can read two ways.
Explain the mechanics: which framing devices sit outside a paragraph, what a split does to them, and why a retrieved fragment is read as answer-bearing rather than as background.
Demonstrate the trade. Say what the whole-page plausibility requirement costs the construction and why churn gives it a shelf life, instead of describing it as a free win.
Be ready to state what this class implies for a corpus nobody re-verifies, and to resist the framing that a more careful review of the same artefact changes the picture.
## The property: meaning that lives next door Prose is written for readers who have the surrounding text. A great deal of what a paragraph *means* is supplied by material outside it: - a heading (`Historical note`, `Deprecated`, `Example`); - a temporal qualifier ("until the 2021 change", "in the old regional setup"); - a scoping sentence ("the process below is kept for reference"); - a conditional or negation opened in the previous sentence; - a pronoun or definite reference — "this workflow", "that team" — whose antecedent is a line above; - a lead-in that marks the following text as illustrative rather than normative. Every one of those is a device a reviewer relies on and a fragment can lose. A paragraph whose meaning is fully self-contained has one reading. A paragraph whose meaning is completed by its neighbours has as many readings as there are ways to cut around it — and an ingestion pipeline cuts. ## Why the chunk reads as authority The fragment does not merely lose its qualifier. It gains a role. A retrieved chunk enters the prompt as an item selected *because it matched the question*, usually with a source label and often with sibling chunks that are genuinely on-topic. The model has no page to consult, no heading to check, and no way to observe that a scoping sentence exists twenty tokens above the fragment's start. Similarity is not authority, truth, or currency — but a passage handed over as relevant evidence is read as answer-bearing. This is why the family does not need anything that looks like an instruction. The strong version of this construction is not a directive at all; it is an assertion that reads as the current answer, so a prompt line telling the model to ignore instructions found in pages has nothing to bite on. ## Why plain sight is the mechanism, not a weakness Families that rely on concealment — text a rendering layer never shows a person — fail the moment somebody inspects the stored bytes rather than the rendering. This one has the opposite profile. Both readings are legible. An attentive reviewer, a second reviewer, and an auditor re-reading the page a year later all see the same unremarkable paragraph, because it *is* unremarkable in that artefact. There is no discrepancy between what a human sees and what a human could have seen. The discrepancy is between two units of text, and only one of them has a human-facing view at all. ## What it costs Three costs, and an interviewer will look for them. **Duality is a constraint, not a free option.** Every increment of strength in the isolated reading pushes the whole-page reading toward looking odd. The paragraph has to be plausible as archived background, plausible as prose someone would write, and still assertive enough to be acted on when read alone. That eliminates the crude plant, which is precisely what a diff skim buys the people running the wiki. **The split points are not the attacker's to set.** They are a property of the ingestion configuration, which the attacker cannot see, and they move when text above the paragraph is edited and the page is re-indexed. The construction's shelf life is tied to page churn. **The isolated reading must also be retrieved.** A fragment nobody's query reaches is inert. That is a separate problem in its own right, and it interacts badly with the first cost: writing for retrieval pulls toward restating the question's vocabulary, which is exactly the kind of thing that makes a paragraph look out of place on its page. ## Where it stops working If the unit handed to the model is the containing section rather than the paragraph, the frame travels with the text and the two readings collapse into one. If the paragraph has to carry its own qualifier to look unremarkable in place, then the qualifier is inside the fragment too and there is no second reading left. And if the page is edited above the paragraph and re-indexed, the boundary that produced the isolation may simply cease to exist — the construction can die without anyone noticing it existed. ## In an interview Name the property (meaning completed by adjacent text), name the stage that separates them (the split), name the obstacle it gets past (the reviewer skimming a diff inside the whole page), and be honest about the cap: the stronger the isolated reading, the worse the paragraph looks in place.
- Does this construction have to look like an instruction to the model?No, and the strong version does not. A fragment that simply reads as the current answer to the question is enough: the payoff is a false answer somebody acts on, carried by a passage the assistant cites as a source. That is also why a prompt line about ignoring instructions found in pages misses it — there is no imperative in the text to ignore.
- What caps how assertive the isolated reading can be?The requirement that the same paragraph stay unremarkable in the whole page. Every increment of force in the fragment makes the on-page reading look more out of place to an attentive reviewer, and the reviewer is reading the page. That trade is the real content of the diff review as a control: it does not detect the fragment, it prices it.
- What ends this construction without anyone filing a finding?Ordinary churn. An edit that adds or removes text above the paragraph shifts every split point below it at the next re-index, so the boundary that isolated the paragraph may stop existing. If the emitted unit ends up containing the frame again, the fragment reads exactly as the page does and there is nothing to act on.
A quotation is accurate and still misleading once the sentence that said "he denied that" is left outside the quotation marks.
saying these in an interview costs you the question
- Something must be hidden in the text for this to work
- The model sees the heading above the chunk
- A retrieved chunk carries its page's context with it
- Writing the paragraph more forcefully always makes it better
- The attacker chooses where the pipeline splits