Build benign and attack cases; compare a phrase filter with an independent action allowlist on unseen variants.
Name the expected effect, metric and what would count against the hypothesis.
Record fixtures, source, version, parameters, units, controls and how cases are split.
| Case and split | Baseline result | Changed result | Interpretation |
|---|---|---|---|
A wording change bypasses the keyword filter while an independent capability restriction still blocks the action.
Record your new case and rerun the original cases after redesign.
Explain the mechanism, one exact result and what would overturn your conclusion.
Phrase filtering is not a complete defence; the action proposal is supplied rather than generated by an LLM.
Next test: _ . Project filename: _ . Work that is mine and tools I used: ____ .
Use fictional data. Download a resumable project before changing devices. On a shared device, turn remembering off and clear your work when finished.