Seven-layer AI defense stack matches its single best layer

A seven-layer AI guardrail stack failed against one adaptive adversary about as often as its single strongest layer did, per a measurement paper posted August 28.

Teams that stack content filters, prompt-injection detectors, and output moderators assume the layers fail independently, so a breach requires beating all of them. The paper found the opposite. Failure correlation was positive across all fifteen measurable layer pairs, with phi coefficients between 0.30 and 0.75. The joint failure rate exceeded what independence would predict by as much as 0.172.

The stack also refused four in five benign prompts, a false-positive rate that would make most products unusable, while performing no better against the adversary than its best single layer did alone.

The paper traces the correlation to architecture, not weak individual layers. Every guard wraps the same underlying model, so their failures share a cause. Swapping in more diverse layers doesn't fix that, because the shared wrapped model is still the thing being attacked.

Anyone budgeting review time for a seven-layer guardrail setup should ask whether the layers were tested together against an adaptive attacker, not just scored one at a time. Independent per-layer numbers are the wrong evidence for a claim about the stack's combined resistance.