Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers

1. Introduction

• Reported defense gains are difficult to compare because studies assume different attacker capabilities and often evaluate fixed attacks that adaptive adversaries can defeat.The paper therefore recasts effectiveness as conditional on each threat model and treats adaptive attacks as a first-class concern.Source: §1 · p. 1, §1.1 · p. 2

1.1. Contributions and research significance

• AATM tiers adversaries by access, while five inference-overhead classes tier defenses by deployment requirements, jointly determining which mitigations a deployment can implement.Two overhead classes require the ability to train weights or read activations.Source: §1.1 · p. 2
• Stacked defenses must be evaluated as a single system because coverage, cost, residual attack success, and false refusals obey different composition rules.Coverage saturates within a tier, cost composes by overhead class, effectiveness compounds only under failure independence, and refusals accumulate.Source: §1.1 · p. 2, §1 · p. 2
• Every one of fifteen measurable defense pairs shows positive failure correlation under a shared adaptive adversary, establishing the first measured diversity result for LLM defense stacks.The study stratifies against an obvious confound and checks three labeling regimes plus a direct attack on the assembled stack.Source: §1.1 · p. 3
• Defense stacks share dependence through the target model they wrap, so widening the member pool cannot weaken this architectural correlation.Diversity should target the shared substrate: it selects stack members but does not predict what the assembled stack delivers.Source: §1 · p. 2, §1.1 · p. 3

Framing and derivation

• A defense stack is a unanimity-veto classifier ensemble, so combination helps only when members fail on different inputs; this condition must be measured rather than inferred from apparent diversity.The paper derives tier-conditioned coverage, overhead cost, union false refusals, and multiplicative residual success only under independent failures, parameterized by φ.Source: §2 · p. 3

Architectural dependence and use of φ

• Because every defense wraps the same target model, their dependence is architectural rather than sampling-based and does not disappear with more data or a wider member pool.φ is therefore a selection statistic for identifying near-substitutes and worthwhile members, not a predictor of assembled residual or refusal rate.Source: §2 · pp. 3–4

Empirical findings

• All fifteen measurable layer pairs have positive failure correlation, φ=0.30–0.75, with joint residual exceeding multiplicative predictions by up to 0.172.Three additional fusion-diversity statistics agree, making multiplicative composition a lower bound on residual risk that no tested stack attains.Source: §2 · pp. 3–4
• Stratifying by behavior difficulty dissolves most associations, but dependence remains across labeling and threshold regimes, so common cause—not mechanism overlap—drives the composition failure.No correlation falls below 0.300 across all fifteen pairs in any of the three regimes.Source: §2 · p. 4
• The stack refuses four in five benign prompts yet is statistically indistinguishable from its strongest semantic layer, which achieves the same residual at one-third the refusal cost.Removing that layer yields no feasible direct attack, despite an intersected per-layer residual prediction of 0.190.Source: §2 · p. 4
• Attack class determines measured strength: a perplexity filter blocks every optimized suffix but admits nearly every fluent prompt, shifting residual from 0.00 to 0.66.Combining per-defense figures measured under different attacks can therefore be optimistically wrong without bound.Source: §2 · p. 4

3.1. Research Questions

• The study asks how LLM vulnerabilities, mitigations, evaluation frameworks, and layered defense composition relate to one another.The literature answers RQ1–RQ3, while RQ4 is answered analytically and empirically because prior work did not measure the independence assumption.Source: §3.1 · p. 4

3.2. Experimental Method

• The experiment measures pairwise failure correlation directly because multiplicative residual attack success requires independent defense failures.It evaluates seven defenses against a shared adaptive adversary and intersects per-behavior breach vectors, while also attacking the assembled stack directly.Source: §3.2 · p. 5
• The experimental design tests same-row dependence, cross-row independence, and whether benign false refusals constrain stack depth more than inference cost.Primary pairs test H1 and H2; thirteen additional pairs are reported as exploratory, with one added after the original same-row pair proved unmeasurable.Source: §3.2 · p. 5

3.3. Evidence Base

• The evidence base is a structured critical synthesis of representative and high-impact defense studies, rather than a registered systematic review.Searches covered Google Scholar, IEEE Xplore, ACM Digital Library, Scopus, and arXiv through February 2026; included works were recorded for adversary-model and adaptive-attack evaluation properties.Source: §3.3 · p. 5

4.1. Surveys of LLM threats and defenses

• LLM security surveys map risks, trustworthiness, attacks, and evaluation, but do not integrate the full range of mitigations or analyze defense composition.Das et al. [9], Abdali et al. [10], Cui et al. [34], Huang et al., Gupta et al., Perez et al. [37], Lin et al., Dong et al. [39], Chowdhury et al. [40], Yao et al., Zhou et al. [41], Liu and Hu [42], Shi et al. [43], and Li and Fung [44] address these areas without treating composition.Source: §4.1 · p. 6

4.2. Ensembles of defenses

• Defense-ensemble work proposes specialization or stacked guardrails on the assumption that components fail on different inputs, but estimates neither that premise nor the required failure dependence.Lu et al. [45], Huang et al. [46], Ghosh et al. [47], Kang and Li, and Verma et al. motivate combination through specialization or presumed uncorrelated errors; Section 11 tests the premise directly, while Nasr et al. [13] motivates adaptive evaluation.Source: §4.2 · p. 6

4.3. Diversity in classifier fusion

• Classifier-fusion research formalizes ensemble value through diversity and error-indicator correlation, including adversarial robustness against shared member properties, but LLM defense work has not measured diversity between layers.This prior work provides the condition and statistics used here, while Section 10 states the condition for defense stacks and Section 11 measures it.Source: §4.3 · p. 6
• The paper therefore defines the defended-against adversary before measuring defense diversity, making adversary specification a prerequisite for interpreting stack failures.The related-work discussion identifies this as an implicit omission in LLM security literature.Source: §4.3 · p. 6

5. The Adversary Access-Tier Model (AATM)

• AATM organizes the paper’s defense claims around explicit adversary access, because unstated access or adaptation can make robustness results incomparable and overstate security.Each defense layer is mapped to the access tier it presupposes, with tier labels and overhead classes collected for consistent use.Source: §5 · p. 7

5.1. Access Tiers

• AATM defines five access tiers, including A0 attacks that never query the model and A4 influence over training data separately from A3 possession of model weights.This extends classical box-based taxonomies by covering indirect prompt injection and distinguishing poisoning from attacks requiring gradients; MITRE ATLAS and OWASP’s LLM Top 10 remain complementary operational catalogs.Source: §5.1 · p. 7, Table 1 · p. 7

5.2. Knowledge, Capability, and Goal

• Defense evaluations also depend on adversary knowledge, capability, and goals, so resistance to A1 or static attacks does not establish robustness against adaptive attacks or A3 fine-tuning.Relevant goals include jailbreak, injection, extraction, poisoning, and denial of service; filters can be defeated by adaptive A1 adversaries [12], while A3 fine-tuning can remove safety behavior [17].Source: §5.2 · p. 7

6. LLM Security Threats and Vulnerabilities

• The taxonomy spans model-, data-, user-, and infrastructure-centric threats, each mapped to the AATM access tier needed to exploit it.This organization distinguishes what can go wrong from the access an adversary needs, rather than treating threat labels as sufficient for defense planning.Source: §6 · p. 8, §6.5 · p. 10

6.1. Failure Modes Instigating LLM Vulnerabilities

• Safety-training failures comprise competing objectives, mismatched generalization, and brittleness, enabling jailbreaks, out-of-distribution transformations, and low-cost weight disruption.Removing safety is cheap once weights are available, whereas restoring it is not, separating behavior-level attacks at A1–A2 from mechanism-level attacks at A3–A4.Source: §6.1 · p. 8

6.2. Model-Centric Threats

• Model-centric threats range from A1 adversarial prompting and extraction to A3 parameter attacks and A4 backdoor insertion, so no single defense layer covers the category.Backdoors can preserve ordinary behavior and evade standard evaluation, requiring detection in training data or parameters rather than through hosted-model interfaces.Source: §6.2 · pp. 8–9

6.3. Data-Centric Threats

• Data-centric threats oppose A4 poisoning, which corrupts training integrity, with A1 memorization leakage, which exposes confidential training content through queries.Because leakage is established during training but extracted at inference, deployment interfaces cannot control what the base model memorized.Source: §6.3 · p. 9

6.4. User-Centric Threats

• User-centric threats distinguish prompt injection, which confuses instructions with data, from jailbreaks, which persuade the model to abandon an existing policy.Direct injection is A1, indirect injection through retrieved or tool-returned content is A0, and fixed jailbreak corpora measure their generated search space as much as defense robustness.Source: §6.4 · p. 9

6.5. Infrastructure Threats

• Infrastructure threats target serving systems, dependencies, retrieval paths, and operations, making conventional security controls and architectural prompt-injection defenses central at A0.These risks include deployment compromise, supply-chain or integration attacks, and operational pressures that weaken filtering, updates, or regression testing.Source: §6.5 · pp. 9–10

7. LLM Defense and Mitigation Strategies

• The taxonomy distinguishes five intervention layers and seven dependency rows: layers predict cost and coverage, while shared failure conditions determine whether defenses are stackable.Table 2 maps layers to AATM tiers, attack coverage, adaptive evaluation, and overhead classes; Table 3 groups defenses by the property and defeating move they share.Source: §7 · pp. 10–11, Table 2 · p. 11, Table 3 · p. 12

7.1. Token surface

• Token-surface defenses are cheap but evadeable through obfuscation or distribution shift, whereas internal-representation defenses are harder to escape by reformulation but fail when harmful computation is not separable in the monitored subspace.Surface methods reach only A1; representation methods use class E at inference or class D when trained in, increasing potential stack independence.Source: §7.1 · p. 12, §7.4 · p. 14

7.2. Semantic classification

• Semantic classifiers provide strong policy-based screening, but Constitutional Classifiers withstood over 3,000 hours of red teaming at 0.38 percentage-point higher refusals and roughly 23.7% inference overhead.The successor’s activation-probe cascade reduced classifier compute by more than 40× against the authors’ exchange classifier and reached roughly 1% absolute overhead at a 0.05% refusal rate.Source: §7.2 · pp. 12–13

7.3. First-token distribution

• First-token defenses reduce attack success with low marginal inference cost, but bypassing or pruning safety-critical opening-token behavior can defeat them and learned protection cannot bound attacks.Prompt Adversarial Tuning drove GCG on Vicuna-7B from 98% to 1% in the white-box setting, while purple-teaming reached a defense success rate near 97.6%.Source: §7.3 · pp. 13–14

7.5. Input provenance

• Input-provenance defenses target indirect injection rather than harmful text, cutting Spotlighting attack success from above 50% to below 2%, while learned instruction hierarchies still fail against some agentic attacks.Provenance and architecture are the only dependency rows reaching A0; content-level rows do not reach A3 or A4.Source: §7.5 · p. 14, §7.9 · p. 16

7.6. Perturbation stability

• Perturbation-stability defenses can certify robustness only within a bounded perturbation regime, while architecture-and-capability defenses provide system-level guarantees by making unauthorized model actions impossible or inconsequential.CaMeL achieved 77% task completion with provable security on AgentDojo, versus 84% for an undefended agent.Source: §7.6 · p. 15, §7.7 · p. 15

7.8. System-level controls outside the dependency taxonomy

• System-level controls defend weights, surrounding software, and operational integrity without relying on model properties, but monitoring evidence is limited against adversaries aware of the monitor.TRANSOM cut GPT3-175B training time by 28% and checkpointing from 255 to 16 seconds, while weight editing still allowed recovery of deleted content roughly 38% of the time.Source: §7.8 · pp. 15–16

7.9. Defense Trade-offs and Selection

• Defense selection balances effectiveness versus usability, security versus performance, and generalization versus specificity, while most effectiveness figures remain based on attacks fixed before the defense.Five of seven dependency rows reach A1 and no further; only provenance and architecture reach A0, so adaptive evaluation governs how reported numbers should be interpreted.Source: §7.9 · pp. 16–17

8.1. The limits of static evaluation

• Adaptive evaluation is essential: static robustness can collapse against an informed attacker, with the adaptive-versus-static ASR gap reaching 0.66 for one filter.Static results are conditional on the original attacks, models, and datasets; a perplexity filter performs near-perfectly against optimized suffixes but near-uselessly against equally effective fluent prompts.Source: §8.1 · p. 17

8.2. Evaluation Framework for Mitigation Strategies

• Algorithm 1 evaluates baselines, individual defenses, adaptive attacks, composed stacks, and optional stratified human validation, because separately tested layers provide no measured stack robustness.The pipeline reports ASR, adaptive ASR, false-positive rate, utility preservation, trade-offs, and human-automated correlation; human assessment catches context-dependent harms automated classifiers miss.Source: §8.2 · pp. 17–18

8.3. Evaluation Metrics and Benchmarks

• The literature lacks standard stack-level metrics, so the paper proposes pairwise failure correlation φ and excess over independence Δ as cross-cutting measures.Existing metrics have important limitations: ASR and DSR depend on success definitions, latency varies with hardware and workload, and human-automated correlation is typically 0.6 to 0.8 [119].Source: §8.3 · p. 19, Table 5 · p. 19
• Most benchmarks target harmful-content elicitation, while OR-Bench measures over-refusal and StrongREJECT tests whether jailbreaks elicit useful harmful content; none evaluates a composed stack.Coverage is predominantly English, and only JailbreakBench and StrongREJECT incorporate the adaptive-evaluation concerns described earlier.Source: §8.3 · pp. 19–20, Table 6 · p. 20

8.4. Comparative Analysis

• Across reviewed studies, defense combinations suggest qualitative defense-in-depth but not additive gains, because reported figures are incomparable and the missing stack-level correlation remains positive for every measured pair.Most defenses are evaluated on harmful-content elicitation, leaving complementary failure modes undercharacterized; deployment decisions also require consistent accounting of operational cost.Source: §8.4 · p. 20

9.1. The Cost Model

• Compute ratios are not response times: decoding is memory-traffic dominated, and serial class-B passes can increase perceived latency more than their arithmetic overhead suggests.The section therefore reports compute budgets while flagging latency separately; prompt-token defenses are nearly linear in deployed regimes and can be amortized through prefix caching.Source: §9.1 · p. 21
• The cost model distinguishes five overhead classes: additive tokens, serial passes, multiplicative sampling, amortized training, and activation-derived monitoring.Activation-derived monitoring can cost 0.002% of baseline per-token decoding for an 8B-class model, making it four orders of magnitude cheaper than an extra serial pass.Source: §9.1 · pp. 21–22

9.2. Overhead Classes Tier the Defender

• Classes A–C require only black-box access, whereas classes D and E require trainable weights or internal activations, independently tiering defenders by deployment access.Hosted-API developers are confined to A, B, and C regardless of budget, while self-hosted operators can reach all five classes.Source: §9.2 · p. 22, §9.3 · p. 22

9.3. Decision Framework for Defense Selection

• Defense selection first matches layers to exposed AATM tiers and reachable overhead classes, then evaluates compute, latency, refusal budgets, composition, and continuous end-to-end monitoring.The procedure treats refusal tolerance as a binding constraint on stack depth rather than relying on compute budget alone.Source: §9.3 · p. 22

9.4. A Worked Example

• A customer-support deployment selects fine-tuning, an asynchronous 1B output classifier, and a cached prefix for roughly 12% marginal overhead and at most one added serial pass.The framework excludes A3 and A4 adversaries from this surface and estimates that a naive two-classifier-plus-smoothing alternative costs more than four times as much compute.Source: §9.4 · p. 23

10. Composing Defenses

• The section’s central problem is that production systems use stacks, while prior evaluations largely isolate components and therefore cannot predict combined delivery.The framework derives distinct composition behavior for coverage, cost, residual attack success, and false refusal rather than assuming defense-in-depth compounds uniformly.Source: §10 · p. 23

10.1. Coverage composes as a saturating union

• Stacks should cover exposed access tiers before deepening any single tier, because repeated A1 defenses do not extend coverage to A3 or A4.Coverage is monotone but saturates within a tier; uncovered tiers require organizational or contractual controls.Source: §10.1 · p. 23, §10.6 · p. 27

10.2. Cost composes by overhead class

• Cost depends on overhead class: classes A and E are effectively free, class B adds compute and serial latency, and class C multiplies unless gated.At g = 0.05 and q = 4, gating reduces mean overhead to 15% rather than 300%; ordering a cheap screen first enables this cascade.Source: §10.2 · p. 24, §10.6 · p. 27

10.3. Effectiveness composes only under failure independence

• Residual attack success compounds multiplicatively only under failure independence; correlated failures raise joint residual risk, and parallel formulas do not describe sequential pipelines.Correlation is measurable from shared breach vectors, but end-to-end deployment can differ when one layer perturbs the next layer’s input.Source: §10.3 · p. 24

10.4. False refusals compose against the defender

• False refusals form a union that is at least the maximum per-layer rate and generally increases with depth, making refusal budget a deployment constraint.Three layers at 0.5% each yield roughly 1.5% legitimate traffic refused, about four times 0.38 percentage points [77] and thirty times 0.05% [78].Source: §10.4 · pp. 25–26

10.5. Architectural dependence: how a defense stack differs from a classifier ensemble

• Defense-stack dependence is architectural: members wrap the same model, so widening the member pool cannot remove common failure modes.Most measured association is attributable to common behavior difficulty after stratification, while an adversary can also induce correlation by targeting shared properties [21, 22].Source: §10.5 · pp. 26–27

10.6. Composition rules

• The composition rules prioritize tier coverage, cross-row independence, cheap gating, measured refusal rates, and end-to-end evaluation against adaptive adversaries.Measured diversity helps choose members but cannot forecast assembled-stack performance; Eq. (6) at rho = 0 is not a realistic design target.Source: §10.6 · pp. 27–28

10.7. Composition in the worked example

• The worked example selects provenance protection, one semantic guard, and a cached prefix for near-12% marginal overhead with at most one added serial pass.The selected stack allocates refusals mainly to the guard threshold, whereas the naive alternative costs above four times as much, covers no additional tier, and adds less independence.Source: §10.7 · p. 28

11.1. Measurement protocol

• The measurement used 100 harmful prompts, seven defenses, a shared adaptive adversary, gold judging, and fifteen pairwise failure-correlation tests, with thresholds calibrated to block 1% of benign prompts.Failure correlation was computed from paired binary breach vectors using the Matthews coefficient, with normalized values reported when unequal marginals constrained the raw ceiling.Source: §11.1 · pp. 28–30

11.2. Results: the three hypotheses

• 0.172 was the maximum excess of observed joint residual over the independence prediction, with all fifteen pairs showing positive failure correlation and Δ > 0.Cross-row pairs had 𝜙 from 0.30 to 0.62, while the two probe layers reached 𝜙 = 0.75; the multiplicative model therefore systematically overstates protection.Source: §11.2 · pp. 32–34

11.3. Pairwise estimates versus the assembled stack

• 0.810 was the assembled seven-layer stack’s benign refusal rate, versus 0.26 for Llama Guard alone, while the stack was statistically indistinguishable from that strongest single layer on residual attack success.The six additional layers added no measurable residual protection over Llama Guard but increased refusals and inference cost; removing Llama Guard instead produced a six-layer stack with zero observed residual.Source: §11.2 · p. 34, §11.3 · p. 35

11. Measuring Failure Correlation Between Stacked Defenses

• Failure correlation is a selection statistic rather than a prediction of assembled-stack behavior, so designers should select diverse members and then measure the deployed configuration end to end.The assembled stack’s residual cannot be faithfully derived from intersecting per-defense breach vectors because sequential execution changes the joint feasible region.Source: §11.3 · pp. 34–35

11.4. Adaptive versus static attackers

• 0.66 was the adaptive gap against the transfer suffix for the perplexity filter, while static evaluations understated residual risk by about an order of magnitude.The harder static baseline varied by defense, and attack-class effects reversed the ordering for the perplexity filter, which blocked the high-perplexity suffix but admitted the plain prompt.Source: §11.4 · p. 36
• Because an adaptive optimizer can underperform a static suffix, deployers should read max(adaptive, static), although this inversion does not affect the fluent-run results or stratified analysis.In the suffix runs, this raises the perplexity filter to 0.07 and SmoothLLM to 0.06; the primary Vicuna and Llama-2 results are unaffected.Source: §11.4 · p. 36

11.5. Complementary coverage: what survives a fluent attack

• Llama Guard 3 reaches residual ASR 0.00 under GCG and 0.01 under AutoDAN, whereas the perplexity filter leaves 0.66 residual on fluent prompts, demonstrating complementary attack-class coverage.The pair is useful because its blind spots differ by attack class, not because its failures are independent on each input.Source: §11.5 · pp. 36–37

11.6. Is the correlation just behavior difficulty?

• Only two of fifteen pairs retain positive within-stratum association nominally, and just the same-row probe pair survives correction with common odds ratio 159.The probe pair’s association strengthens from crude to stratified analysis, while the primary perplexity × token-anomaly pair does not reach nominal significance.Source: §11.6 · p. 37
• Cross-row defenses fail together predominantly through common difficulty, so neither cross-row diversity nor same-row membership guarantees multiplicative residuals.The token-surface pair falls from crude odds ratio 6.0 to 1.39 within strata (p= 0.907), while the analysis remains conservative and underpowered.Source: §11.6 · pp. 37–38

11.7. Robustness: inference, grader, and calibration

• All fifteen associations remain positive and significant under permutation inference and majority-vote labels, while the evidence does not support the mechanism-specific interpretation of H1.Permutation results agree with bootstrap significance for 15/15 pairs; majority labels preserve significance at q≤1.5 × 10−3. Under external thresholds, the probe pair’s test becomes undefined rather than negative.Source: §11.7 · pp. 38–39

11.8. Replication on a strongly aligned target

• On Llama-2-7B, the fluent attack-class result replicates, but correlation estimates remain directionally consistent rather than independently confirmatory at n=50.Perplexity residual ASR is 0.44 versus 0.00 for GCG, while the two probes remain positively associated at φ=0.25 versus 0.75 on Vicuna; only perplexity × probe8 reaches nominal significance, with q=0.089.Source: §11.8 · pp. 39–40

11.9. The same result in the vocabulary of classifier fusion

• The dependence verdict is measure-independent: Q, disagreement, and double-fault statistics reproduce the sign and ranking of φ across all fifteen measurable pairs.Q is positive for every pair and ranges from 0.610 to 0.977; rank correlations are 0.99 between Q and φ, −0.97 between disagreement and φ, and 0.89 between double-fault and φ.Source: Table 13 · p. 41, §11.9 · p. 41

11.11. Limitations of the correlation measurement

• The correlation conclusions are bounded by a single attack strategy and seed, weakly aligned primary target, untestable highly effective rows, in-sample probe calibration, and nondeterministic grading.External recalibration makes probe16 refuse 26% rather than 1% of held-out benign prompts and nearly doubles the token-anomaly filter’s residual ASR. Llama-2 replication is directionally consistent but underpowered, and full-size replication remains outstanding.Source: §11.11 · pp. 43–44
• The framework’s scalability beyond measurable systems remains an open caveat, addressed next by categorizing three published production deployments.The passage presents this as the only available approach without direct access to those systems.Source: §11.11 · p. 45

12. Discussion

• Across the discussion, the framework is applied to deployments, research questions, measured composition results, limitations, and directions for making stacked-defense evaluation predictive.The framework is intended to describe existing systems as well as systems practitioners might design.Source: §12 · p. 45, §12.1 · p. 45

12.1. Applying the framework to production deployments

• All three production deployments defend A0–A1 surfaces, compose multiple layers across dependency rows, and leave A3–A4 coverage unaddressed; their reports illustrate rather than prove the framework.DoorDash reported 90% fewer hallucinated responses and 99% fewer severe compliance issues; OneShield achieved 0.95 F1 across 26 languages; Airbnb used cross-row routing and filtering.Source: §12.1 · pp. 45–46

12.2. RQ1: What vulnerabilities are inherent to LLMs, and how do adversarial attacks exploit them?

• LLM vulnerabilities span model, data, user, and infrastructure layers, with shallow safety alignment linking attacks and potentially causing correlated stack failures.The discussion attributes attacks to brittle safety parameters, training-data gaps, instruction–input conflation, weak infrastructure controls, and perturbations of early generated tokens.Source: §12.2 · p. 46

12.3. RQ2: What are the current state-of-the-art defenses, and how do they map to the threat landscape?

• Current defenses concentrate on semantic classification and usually assume A1 adversaries, while adaptive evaluation, persistence, scalability, real-time response, incident analysis, infrastructure coverage, and composition remain weak.Fine-tuning and pruning require A3–A4 access, adaptive testing is uncommon, and measured failure correlation remains the most consequential open gap.Source: §12.3 · pp. 46–47

12.5. RQ4: How do defenses compose?

• 0.172 is the maximum joint-residual shortfall: all fifteen defense pairs have positive dependence, the stack refuses 0.810 of benign prompts, and assembled performance is not predicted by member metrics.Dependence is predominantly common-cause; robustness checks retain a minimum φ of 0.300, while direct assembled attacks can differ sharply from intersection predictions and refusal unions.Source: §12.5 · pp. 47–48

12.6. Limitations

• The conclusions are limited by non-exhaustive literature selection, judgment-based tier and dependency assignments, a small single-turn correlation experiment, modeling assumptions, and unverifiable deployment reports.The primary experiment used n=100 behaviors, two 7B-class targets, one attack seed, and one automated grader; several composition assumptions remain untested.Source: §12.6 · pp. 48–49

12.7. Future Research Directions

• Future work should scale correlation measurement, deliberately create defense diversity, evaluate attack-class complementarity, standardize cross-model stack benchmarks, and develop efficient, deeper, and broader defenses.The proposed agenda includes pooling targets and strata, testing multilingual and multimodal settings, studying class-E monitoring and early-token interventions, and testing whether deeper alignment lowers φ.Source: §12.7 · p. 49

• The AATM and five-class overhead model map five defense layers to presupposed adversary access, addressed attacks, supporting evidence, and inference-time cost.The mapped layers span input/output censorship, robust model training, adversarial training, monitoring, and infrastructure hardening.Source: §13 · p. 50
• Under composition, coverage unions saturate within a tier, costs accumulate by overhead class, false refusals accumulate, and residual success multiplies only under independent failures.Thus, the key stack property is failure correlation: layered defenses purchase independence rather than redundancy.Source: §13 · p. 50
• Positive failure correlation occurred in all fifteen pairs of the seven-layer stack, with common difficulty explaining most dependence while independence remained violated.The composition verdict persisted under permutation inference, majority-of-five grader labels, and external thresholds, whose minimum result was 0.300.Source: §13 · p. 50
• The assembled stack refused four in five benign prompts yet remained statistically indistinguishable from its strongest layer, while removing that layer yielded no feasible attack prompt.These opposite outcomes show that stack behavior cannot be inferred from component behavior and must be measured as assembled.Source: §13 · p. 50
• Defense stacks correlate through the shared model they wrap, unlike classifier ensembles whose dependence weakens with wider member pools, so diversity must target the substrate.Existing ensemble methods were not designed for this substrate-level diversity problem.Source: §13 · p. 50
• Failure correlation selects near-substitute members but does not predict assembled performance, so deployment requires measuring diversity first and the assembled configuration second.Under the reported labels, correlation-based selection recovered the configuration chosen by searching the full joint breach data.Source: §13 · p. 50
• Fixed-attack results do not bound deployment risk, and component-level results do not bound stack risk; adaptive composition evaluation should report joint rather than marginal attack success.Until this becomes routine, deployed-stack security is not a quantity the field knows how to state.Source: §13 · p. 50

• Abrar Alotaibi led conceptualization, methodology, software, investigation, analysis, data curation, validation, visualization, and drafting; the other authors contributed through editing, supervision, funding, or project administration.Source: CRediT authorship contribution statement · p. 51

• The repository contains defense implementations, calibrated thresholds, both attack harnesses, per-behavior breach vectors, the StrongREJECT grading prompt and digest, and scripts reproducing Table 10 and Figures 3–5.The breach vectors support computation of every 𝜙, Δ, and confidence interval reported in Table 10.Source: Data availability · p. 51
• JailbreakBench [123] and its matched benign set are redistributed under their original license.Source: Data availability · p. 51
• Model weights are obtained from their respective public releases but are not redistributed.Source: Data availability · p. 51

Scope boundary

• Non-security concerns remain outside AATM’s threat taxonomy, but opacity and non-compliance make successful attacks harder to defend and hold accountable.The boundary preserves AATM’s focus on confidentiality, integrity, and availability while recording deployment-relevant coupling.Source: A. Adjacent Concerns and Responsible… · p. 51

Assessment dimensions

• Risk assessment spans bias and fairness, ethical alignment, robustness, privacy, and transparency, with adversarial robustness overlapping the security scope.Bias and fairness are assessed with StereoSet and CrowS-Pairs; RLHF and Constitutional AI [140] dominate alignment techniques, while trustworthiness frameworks include European regulatory criteria.Source: A. Adjacent Concerns and Responsible… · p. 51

Assessment ecosystem

• Parallel datasets cover toxicity, social bias, conversational safety, robustness, and truthfulness, but remain predominantly English and predominantly static.Examples include ToxiGen [141], TRUSTGPT [144], AdvGLUE [147], and TruthfulQA [151].Source: A. Adjacent Concerns and Responsible… · p. 51

Responsible deployment

• Responsible deployment combines guardrails, externally auditable evaluation, data-protection compliance, and post-training alignment, with adaptive and cross-lingual protocols needed for deployment-relevant risk assessment.Assessment is only as trustworthy as its evaluation protocol, so static benchmarks alone are insufficient.Source: A. Adjacent Concerns and Responsible… · pp. 51–52

Acronyms

• Table 16 lists the paper’s acronyms, including AATM access tiers and Section 9 overhead classes.These acronyms support the paper’s access and inference-cost terminology.Source: Table 16 · p. 52, B. Glossary of Terms · p. 52

Technical terms

• Table 17 defines the technical terms on which the composition argument relies.The glossary consolidates terminology needed to interpret the paper’s argument about layered defenses.Source: Table 17 · p. 52, B. Glossary of Terms · p. 52