Your automated jailbreak loop uses the same model deployment as both the target under attack and the scoring model that decides which responses count as successes. As the engagement lead, what is your policy on that arrangement, and what do you require before a machine-labelled finding list is signed off?

There are two separate arguments against scoring a target with a model drawn from the same deployment, and a lead should keep them apart, because they need different answers and only one of them is technical. ## The technical argument: the errors are correlated with the findings A scoring model and a target from the same deployment share training data, share safety tuning and — the load-bearing part — share a notion of what counts as harmful. Where that notion has a hole, two things happen at once: the target answers instead of refusing, and the scorer reads the answer and sees nothing wrong. The miss is not drawn at random from the space of responses. It sits precisely on the frontier of the model's safety behaviour, which is the only part of the report anyone was paying for. The observable symptom in a finished run is a harm category that comes back clean with almost no borderline scores. Uncertainty is what a classifier produces near its decision boundary; a category with zero hits *and* no near-threshold scores usually means the scorer was confident, and confident in the same direction the target was. A hand read of a handful of rejected transcripts from that category is the cheap test, and when it turns up content the scorer called a refusal, the arrangement is disqualified for that engagement. Note what this does *not* predict: inflation. The shared-blind-spot mechanism under-reports. A team that expects a same-deployment scorer to flatter its own outputs into a higher success count has the direction backwards. ## The organisational argument: independence of assessment A number produced by the assessed system, about the assessed system, is contestable on its face. Even with a sound error analysis in hand, you will spend the client review defending the instrument instead of the finding, and an error-rate table will not win that argument, because the objection is not about the rate. ## The policy Prefer a scorer that does not share the target's provenance, and budget it as a line item rather than treating it as an optimisation to be dropped when the week gets tight. Where cost, contractual or data-handling constraints forbid it — and they sometimes genuinely do — do not describe the arrangement as neutral. Ensemble the model scorer with cheap deterministic checks that do not share its blind spots, retain every transcript for offline re-scoring, and mark single-source labels as provisional in the artefact itself, not in a footnote. ## Sign-off requirements, whichever way that decision went 1. **A maintained calibration set** of hand-labelled responses per harm area, including deliberate near-misses, that the scorer is run against *before* the campaign, with the results printed in the report. Without it, every claim about the scorer is an assertion. 2. **Human adjudication of every finding that leaves the team**, and a report that keeps machine-labelled and human-confirmed counts as two distinct numbers. 3. **An explicit unmeasured section**: the miss rate, the response shapes the scorer is known to handle badly, and the categories where no hits were found but coverage was thin. This is the requirement that addresses correlated blind spots directly, because it is the only one that speaks about what is absent. 4. **Retention of every attempt** with its raw score, so a later dispute is settled by re-scoring stored text rather than by re-running against a target that may have been updated since. Requirement 2 is the one people mistake for a fix. Adjudication operates on the findings that reached the queue; misses never reach it. Human review therefore raises precision and leaves the miss rate exactly where it was. ## What it costs, said out loud A second scoring pass over every stored attempt. A second vendor relationship, or a self-hosted scorer with its own serving cost, plus the data-handling review that comes with sending transcripts somewhere new. Storage for a full run rather than its hits. And human hours per engagement that scale with the finding list, not with the number of real findings. That is the price of a number the client can act on, and it belongs in the scoped engagement, not absorbed silently by the team on the last Friday. ## Where the number misleads The dangerous artefact from this arrangement is not an inflated count; it is a **clean category**. "No findings in category X" reads to a client as "X is safe", when what it may record is that the scorer and the target agree about X. The report must therefore separate three statements that a single zero currently blurs: how much was attempted in that category, how much of it the scorer rejected, and how much of the rejected material a human actually looked at. A zero with no coverage evidence behind it is a statement about your instrument wearing the clothes of a statement about the target.