Make a security check simple and attackers learn to dodge it; make it strict and you drown in false alarms.

This explores a two-sided defensive bind: a detection rule simple enough to be copied or probed lets attackers learn to slip past it, and tightening it to stop that raises false alarms that cost time and trust. The corpus doesn't name these two squeezes, so what follows is my synthesis of what the notes say about each pressure and how they pull against each other.

The copyable side is clearest in the skill-scanner work. Attackers used scanner feedback to soften each individual skill just enough to pass while the multi-step chain stayed malicious. They reached 96% average success across six scanners, because scanners score skills one at a time Can attackers evade skill scanners by refining individual skills?. That is a rule being learned by whoever can query it. The per-item design is also the trap. Stateless checks can't even state a constraint that depends on prior history Can stateless checks ever catch sequence-level constraint violations?, so the cheap, copyable check is blind to the chain-level behavior that matters.

Here is where the two squeezes meet. The obvious fix for that blind spot is broader, stateful checking, but every added trigger is another chance to flag legitimate behavior, and every flag has a cost. The obvious fix for false alerts is a higher threshold, and that is exactly what an attacker's feedback loop hunts for: pieces that each sit just under it. Each squeeze pushes you toward the other's failure. Swapping fixed rules for an LLM judge doesn't escape this. Judges can be swayed by fake references and rich formatting with no access to their internals Can LLM judges be tricked without accessing their internals?, so the flexible option is copyable in its own way.

The notes point to exits that work on the cost of an alert or the visibility of the test, rather than on the rule itself. One set of four mechanical moves guards a judge: keep test data hidden from whatever proposes changes, which blocks copying. Measure correctness against human labels, which puts a number on false alerts. Run unarguable checks before contestable ones. Plant known cases as alarms Can deterministic checks protect LLM judges from failure?. Cheaper checking also softens the false-alarm side. Asynchronous verifiers add near-zero latency on correct runs and intervene only on violations Can verifiers monitor reasoning without slowing generation down?. Step-level confidence catches local breakdowns and stops early Does step-level confidence outperform global averaging for trace filtering?. And since verification accuracy improves with repeated evaluation and finer-grained scoring at inference time Can verification accuracy scale without training models?, a borderline flag can get a second look before it becomes an alert.

The gap is that no note tests both squeezes together. Whether a hidden, stateful, costlier-to-probe check can keep false alarms low against an adaptive attacker isn't answered here. The corpus gives the ingredients but no verdict.