Skip to content
allanninal.dev/build
Collaborate

Part 3 of 7 · Form spam filter series ~5 min read

How the model band stays narrow

It would be straightforward to send every submission to a model and get a slightly better classifier. It would also cost ten times as much, make every decision unpredictable, and remove the ability to explain why something was filtered. The band is narrow on purpose.

Key takeaways

  • About one submission in ten reaches the model; the rest are decided for free.
  • One question: does this read like a person describing a specific need?
  • It is never asked whether to deliver. That decision belongs to the router and the thresholds.
  • Its answer moves a score; it does not set an outcome.
  • A model failure degrades to the review queue, never to quarantine.

Who reaches the model

How submissions are selected for a model callA vertical chain of five steps entered by a box labelled A cheap score, from Part 2. Step one asks whether it is confidently spam, meaning the honeypot was filled or the score is high; yes exits to Quarantine with no model call. Step two asks whether it is confidently a person, clean on every signal; yes exits to the Inbox with no model call. Step three is the middle, about one submission in ten. Step four asks one question: is this a person with a specific need; a model error exits to the review queue, always. Step five adjusts the score and then routes. A note says a model error routes to a human and never to quarantine, because failure must not lose a lead.AWS ACCOUNTA cheap scorefrom Part 2Confidently spam?honeypot, or a high scoreQuarantineno model callyesConfidently a person?clean on every signalInboxno model callyesThe middleabout 1 in 10One questionis this a personwith a specific need?Model failedreview queue, alwayserrorAdjust the scorethen routeA model error routes to a human, never to quarantine. Failure must not lose a lead.
Fig 1. Who actually reaches the model. Both confident paths avoid it entirely, and its failure mode is deliberately the safe direction.
  • App integration
  • Machine learning
  • Security & identity
  • Analytics
  • People

The question

Narrow and specific: does this read like a person describing a particular need, or like a template sent to many recipients? That is a genuinely hard question for a rule and an easy one for a model, and it is the only thing it is asked.

The prompt carries the message body and nothing else — not the name, not the email address, not the IP or the country. Those are all things a rule can weigh, and including them in a model prompt invites it to form views about people based on where they are or what their address looks like, which is both unfair and unreliable.

The question it is not asked

It is never asked whether to deliver the submission. That sounds like a distinction without a difference and it is the whole design: a model that returns “deliver” or “filter” has made a business decision, and the thresholds that turn evidence into a decision are then invisible and untunable.

A model that returns “this reads specific, confidence 0.7” contributes evidence, and the routing rule that turns 0.7 into a destination is a number in a config that somebody can change when the review queue gets too long.

Failing safe

How a model failure is handled in the spam filterA horizontal row of five boxes. Model times out: or is throttled. No score: there is nothing to combine. Do not guess: in either direction. Review queue: a person decides. Cost: a two-hour delay. A note says defaulting to quarantine on error would lose leads during a Bedrock incident.WHAT HAPPENS WHEN THE MODEL FAILSModel times outor throttlesNo scorenothing to combineDo not guesseither directionReview queuea person decidesCosta two-hour delayDefaulting to quarantine on error would lose leads during a Bedrock incident.
Fig 2. The failure path. Choosing the human queue rather than either automatic outcome means a provider incident costs a delay rather than a lead.
  • Security & identity
  • Management
  • Analytics
  • People

The tempting shortcut is to default to the cheap score alone when the model is unavailable, and that is exactly wrong for the submissions in this band: they reached the model precisely because the cheap score could not place them. Falling back to it is falling back to the thing that already said it did not know.

What it costs to keep the band narrow

About one submission in ten reaching a model means a business with four hundred and forty submissions a month makes forty-four calls, which is a few cents. Sending all four hundred and forty would be a few tens of cents — still trivial in absolute terms, and it would make ninety per cent of the decisions less predictable for no measurable gain in accuracy, because those ninety per cent were already unambiguous.

The reason to keep the band narrow is not the money. It is that a filter whose decisions are mostly deterministic can be explained, tested and tuned, and one whose decisions all come from a model cannot.

Next: what happens to the ambiguous ones.

All posts