Guardrail & Content-Filter Evasion

Streaming sends tokens to the client as they are produced, so a screen that scores the finished answer returns its verdict after the opening has already been delivered. It can stop the remainder; it cannot recall what shipped.

A refusal describes the final answer and nothing else. A screen pointed at the answer never reads the deliberation panel or the trace record beside it, so refused substance and the model's stated objection sit outside its reach.

The score is hidden; the reply is not. A canned block card, a hedged answer and a normal answer are three visible outcomes, so every reply says which band the request landed in, and a few replies bracket the line.

The screen and the generator read the same string for different purposes. A term-based screen matches surface wording it was trained on; a capable generator resolves paraphrase, referents and framing, so meaning survives a restatement that contains no trained term.

A screen's block is a separate stage firing before generation: it returns fast, in fixed wording, with nothing streamed. A model refusal is generated text, so it varies in wording, references the actual ask, and arrives at generation speed.

A generative screening model reads the span it judges inside its own prompt, so written text reaches it as readable instruction. A label-only classifier emits category scores from a fixed head, so there is nothing to address.

Semantic means semantic within its training distribution. An embedding-based screen generalises over paraphrases near what it was labelled on, but a much larger generator resolves referents and framing the screen was never shown. The gap is capability, not keywords.

Because the deployed screen responds to every request. Each block, pass and near-miss is a labelled sample of its decision boundary, so a few dozen typed turns buy a usable map without seeing the model or its threshold.

Three conditions. The model must reproduce the filed span in its answer rather than paraphrase it away; the span must land where the parser's grammar gives it meaning; and nothing between the model and the parser may rewrite or re-encode the answer.

A truncation says the model was willing to produce the content and something downstream stopped delivery afterwards. A refusal says the model declined. The cut also shows roughly how much of an answer ships before a verdict lands.

A request whose disposition cannot be settled without working the substance through. If judging it requires enumerating, comparing or weighing the material first, the material is written into the deliberation and the decline arrives after it, in a different channel.

Four things: the outcomes are coarse, so you learn an interval and not a number; near-identical inputs need not score identically; probes are attributable and rate-limited; and the calibration expires whenever the screen or its configuration changes.

Markers, the screen's orders and the wrapped item are one token stream to the screening model. Confining attention to the marked region is a preference expressed in the same text it is meant to fence.

A lower rate, not a closed class. The rule acts on a probabilistic producer, while the property that turns prose into a decision lives in the consumer, which is unchanged. Ship it as mitigation, not as a fix.

The stored transcript is written after screening, so it records the post-verdict version, not what was forwarded. Bound the disclosure from transport counters and from client-side state, and treat unobserved client residue as unknown rather than zero.

Show which artefact the screen received against every surface the request emitted, plus who can read each surface and for how long. The reopening argument is a scope defect with a measured success rate, not a claim that the model misbehaved.

Yield per request. Everything obtained under the line arrives hedged, shortened or generic, so value has to be assembled from many weak exchanges, and asks whose only useful form scores above the line stay out of reach entirely.

The account roster and the clock, not cleverness. Every probe spends a rate-limited request, every suspension burns an account, and the repeats needed to beat sampling noise multiply both, all while the map decays underneath the campaign.

Only that the screening stage emitted a clean verdict for that span, at that version, on that pass. It is not evidence the content was clean, that anyone read it, or that a re-screen would agree.

It depends on what the vendor has claimed the screening layer does: against a promise of prevention it is a defect, against a promise of volume reduction a design limit. Either label needs a named owner.

Only that the answer scored below threshold on the screen's harm categories and that the parser lifted certain values from it. It does not show who supplied those values, and it does not show that the answer's content was benign or malicious.

It widens it. The leverage in a vocabulary-free restatement is the comprehension difference between the two models, so every indirection the new generator resolves that the old one could not is fresh working surface while the screen's coverage stands still.

Yes, if you can say which stage passed it and that the rate beats the stage's own noise. One pass in five proves the construction worked against one deployment at one version — and a retryable path makes a fifth material.

Incremental screening shrinks how much of an answer is delivered before a verdict; it does not reach zero, and it says nothing about surfaces nobody changed. Retire the case only against a measurement.

Separate claims about a past deployment from claims about the class. Instance findings are now unverifiable and must be retired or re-stated as history; the scope question survives and gets re-asked of the current shape. Non-reproduction is not evidence of a fix.

Every scored gate with one action point has a band beneath it, so the band alone is arithmetic, not a defect. It is a finding only if the output obtainable inside it is materially outside what the product intends.

Claim the standing property and its price, not the list. The thin regions expire at the next update to the screening model or its acting point; what survives is that a responding screen discloses its coverage at a measured cost.