I realized a collision wouldn't help because the client would just avoid sending a request as in the normal case. The malicious filter would have to conspicuou

I realized a collision wouldn't help because the client would just avoid sending a request as in the normal case. The malicious filter would have to conspicuously avoid tracking the URLs of interest.