A planted source chip must survive a reader's click-through: what does that force the attacker to build?

## Evading a check versus satisfying one Most of the attacker craft around retrieval pipelines is evasive: get a span past a screen, past a chunker, past a reranker, past a skim. This construction is the opposite shape. The obstacle it faces is a *human reader's verification move* - glancing at the source chip, then clicking it - and that obstacle cannot be dodged, because the whole payoff depends on the reader performing it and coming away reassured. The attacker therefore has to build something that survives being looked at. That changes what has to exist. ## What the artefact has to carry - **Internal consistency across the fields.** The chip showed a title, a publisher, a byline and a date because the page declared them. Click through and those same values must be present and agreeing on the page, since a mismatch between the strip and the destination is exactly the discontinuity a suspicious reader notices first. - **House conventions.** A reader who knows a publication does not read it field by field; they recognise its shape - section furniture, dateline placement, how a byline is written, how a correction or a methodology note is phrased, sentence register. Those conventions are copyable, and copying them is the labour this construction is made of. - **A claim in the right voice.** A fabricated statistic written the way that publication writes statistics survives a skim; the same statistic in the wrong register does not, even inside a perfect-looking page. - **Availability over time.** The answer may be read, screenshotted and forwarded for weeks. The destination has to be reachable across that whole window, and it has to keep being fetched and cited at answer time rather than dropping out of what the assistant reaches. ## Why cross-checking inside the artefact proves nothing This is the mechanism worth being able to state cleanly. When a reader clicks through, they are comparing the chip against the page - and the same author wrote both. Concordance is not evidence; it is a property the writer arranged. The same is true of every internal signal a careful reader might reach for: the page's own about section, its own contact details, its own archive of other stories, a date that lines up with the claim. All of it is content from one source, and agreement among fields one person supplied has the evidential weight of a signature on a forged document matching the name printed above it. ## Where it stops working Name the boundary rather than a remedy, because the boundary is the interesting half: - **Checks that leave the artefact.** Going to the publication directly rather than following the link, or asking whether they ran such a piece, samples something the attacker does not control. Nothing inside the page can defeat that. - **Readers who actually know the publication.** Imitation is convincing at the level of layout and thin at the level of editorial habit. The audience with the deepest familiarity is the audience most likely to feel the register is off, and they are often the ones asked to confirm a forwarded claim. - **Time.** Once the page is pulled, the destination stops confirming anything - and, awkwardly for both sides, the artefact that would prove the construction existed is gone too. - **Scale.** Because the payoff needs a recognisable name, the useful target set is small, and each impersonation is separate labour. This does not fan out the way a single reusable span does. ## What the cost tells you about the finding An interviewer often follows up by asking whether this is worth an attacker's time. The honest answer weighs a per-publication build and hosting cost against a payoff measured in whether an assertion travels under somebody else's name. When the audience is broad and the assertion is one people repeat rather than act on directly, the trade is good; when the aim is a specific privileged action, this is an expensive way to get it and there are cheaper constructions. ## How to answer Lead with the inversion - the check has to be satisfied, not evaded - then list what the destination must carry, then say why internal agreement is worthless because it is single-sourced. Close on the boundary: this construction dies the moment the reader's check leaves the artefact.