PaperlayerView exact revision on arXiv

Source-linked AI summary

Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers

Abrar Alotaibi, Muhammad Shahid Jabbar, Sadam Al-Azani, Moataz Ahmed

arXiv:2608.28327v1cs.CRcs.AIcs.CL

TL;DR

The paper addresses whether stacked LLM defenses compound when their failures differ, amid evaluations that often use fixed attacks and unstated attacker capabilities. It introduces access-tier and inference-cost models, derives composition behavior, and measures failure correlation in a seven-layer stack under an adaptive adversary. Failure correlation is positive across all fifteen pairs, while the assembled stack remains unpredictable from pairwise diversity and must be measured end to end.

  • Problem

    Existing LLM defense evidence often uses fixed attacks and unstated assumptions about attacker capabilities, leaving the behavior of assembled defense stacks difficult to predict.

  • Method

    The paper introduces the Adversary Access-Tier Model and a five-class inference-time overhead model, then measures pairwise failure correlation and assembled-stack behavior.

  • Results

    Failure correlation was positive across all fifteen pairs of a seven-layer stack under a shared adaptive adversary, and the assembled stack remained statistically indistinguishable from its strongest single layer on residual protection.

  • Takeaways & Limitations

    Failure correlation can select near-substitute members, but it does not predict assembled-stack behavior, so the final configuration must be measured directly.

  • Takeaways & Limitations

    The measurements cover one primary target, 100 behaviors, two attack classes, and a single-turn A1 threat model, leaving broader settings unmeasured.

Abstract

from arXiv · show

Practitioners defend large language models (LLMs) by stacking defenses, assuming the layers compound. A stack is an ensemble, and ensembles compound only under a condition the LLM security literature recommends but never measures: the members must fail on different inputs. Two instruments make that measurable. The Adversary Access-Tier Model (AATM) grades an adversary by the access it holds, from system-only (A0) to influence over training data (A4). A cost model sorts defenses into five classes of inference-time overhead; because two classes require training weights or reading activations, they tier the defender as AATM tiers the adversary. From these we derive how a stack behaves, and the quantities a defender cares about diverge: coverage saturates within a tier, cost rises by class, false refusals accumulate as a union, and residual attack success falls multiplicatively only under independence. We measure that independence. Running one adaptive adversary against a seven-layer stack, failure correlation is positive in all fifteen measurable pairs ($φ$ from $0.30$ to $0.75$), and the joint residual exceeds the multiplicative prediction by up to $0.172$. Stratifying on behavior difficulty dissolves most of the association, so the dependence is predominantly common-cause, but it survives permutation inference, majority-vote grader labels, and externally calibrated thresholds. The same stack refuses four in five benign prompts while remaining statistically indistinguishable from its strongest single layer. The dependence is architectural rather than sampling-based: members correlate through the model they all wrap, so no wider member pool weakens it. Diversity therefore selects stack members but does not predict what an assembled stack delivers, which has to be measured end to end.

1. Introduction

LLM defense results are difficult to compare because studies assume different attacker capabilities and usually evaluate fixed attacks. This paper treats defense stacking as an ensemble problem, introduces tier and cost instruments, derives composition rules, and measures the failure correlation those rules require.

  • Motivation: Different and often unstated attacker assumptions make reported defense effectiveness difficult to compare or trust.Most evaluations use fixed attacks rather than adversaries that adapt to the defense.
  • Motivation: Shared failure points in the wrapped model motivate testing whether stacked defenses deliver less than the sum of their reported gains.The paper measures this consequence rather than assuming the proposed explanation.
  • Framing: The paper frames defense composition as information fusion, where component diversity must be measured rather than assumed.Its adversarial extension emphasizes that attackers can deliberately exploit dependence between members.
  • Instruments: AATM grades adversaries by access, while five inference-overhead classes price defenses and tier defender access requirements.Two overhead classes require training weights or reading activations, linking defender access to adversary access tiers.
  • Contributions: The paper derives distinct stacking behavior for coverage, cost, residual attack success, and false refusals, then applies the framework across five defense layers.Its evidence review recasts effectiveness as conditional on threat models and treats adaptive attacks as a first-class evaluation concern.
  • Contribution: Failure correlation is measured for all fifteen measurable pairs of a seven-layer stack under one shared adaptive adversary, with every pair positive.The study also stratifies for an obvious confound and checks three labeling regimes plus a direct assembled-stack attack.
  • Implication: Defense members correlate through the target model they wrap, so diversity selects stack members but does not predict assembled-stack behavior.This architectural dependence differs from sampling dependence in classifier ensembles, which weakens as member pools widen.

2. Overview: A Defense Stack as an Ensemble

A deployed defense stack is a multiple-classifier ensemble whose multiplicative residual-risk prediction depends on independent failures. The experiment finds positive dependence across all measurable pairs, substantial refusal cost, and assembled behavior that pairwise statistics cannot predict.

  • Ensemble framing: A defense stack combines block-or-admit decisions under a unanimity veto, so combination pays only when members fail on different inputs.The paper treats this condition as measurable through pairwise diversity statistics rather than inferable from mechanism differences.
  • Architectural dependence: Shared target-model architecture creates dependence unlike the sampling dependence of textbook classifier ensembles.The paper argues that widening the member pool cannot weaken dependence arising from the model every defense wraps.
  • Analytical framework: AATM specifies adversary access from system-only access (A0) to training-data influence (A4), while five overhead classes price defense deployment costs.Two overhead classes require training weights or reading activations, creating a defender-access duality.
  • Measured dependence: All fifteen measurable pairs have positive failure correlation from 0.30 to 0.75, and joint residual exceeds the multiplicative prediction by up to 0.172.Three additional diversity statistics agree, and no tested stack attains the multiplicative composition prediction.
  • Dependence analysis: Holding behavior difficulty fixed dissolves almost every cross-row association, while the surviving pair varies across labeling and threshold regimes.The reported evidence therefore favors common-cause dependence over a stable mechanism-specific interpretation.
  • Stack outcome: The assembled stack refuses four in five benign prompts while remaining statistically indistinguishable from its strongest single layer.That semantic classifier reaches the same residual at a third of the refusal cost and dominates other layer pairs pairwise.
  • Attack dependence: Measured strength depends on attack class: a perplexity filter blocks every optimized suffix but admits nearly every fluent prompt.Its residual moves from 0.00 to 0.66 with the adversary alone, making cross-attack composition estimates potentially optimistic without bound.
  • Practical workflow: Failure correlation selects near-substitute members but does not predict the residual or refusal rate of the assembled pipeline.The recommended workflow is to measure diversity for selection and measure the assembled configuration end to end.

3. Methodology

The paper combines an analytically derived, literature-grounded framework with an experiment testing its independence premise. It evaluates seven defenses under shared adaptive attacks, common behaviors, multiple labels, and robustness checks.

  • Study design: The study derives its framework analytically from a structured synthesis and tests the composition premise experimentally.The literature synthesis covers Sections 5–10, while Section 11 reports the empirical test.
  • Research questions: The study asks how LLM vulnerabilities, defenses, evaluation robustness, and defense composition relate to threat models.RQ4 specifically asks what governs whether a layered stack outperforms its strongest component.
  • Research questions: RQ4 is analyzed theoretically and empirically because the analytical result depends on an independence assumption no reviewed study measures.The governing quantity is failure correlation between defenses under a shared adversary and behavior set.
  • Hypotheses: The experiment tests same-row dependence, cross-row independence, and whether benign false refusals constrain stack depth.Thirteen additional pairs are exploratory, and one pair was added after the primary same-row pair proved unmeasurable.
  • Experimental design: Seven defenses are evaluated independently against a shared adaptive adversary on common behaviors, with pairwise intersections of per-behavior breach vectors.The design includes gradient-optimized suffix and fluent sentence-level searches plus two static baselines.
  • Experimental design: Vicuna-7B-v1.5 is the primary target, with replication on Llama-2-7b-chat and 100 harmful JailbreakBench prompts matched to benign prompts.Breach labels come from the post hoc StrongREJECT rubric autograder, separated from attack search.
  • Robustness checks: Permutation tests, Cochran’s Q, Holm-corrected exact-binomial McNemar tests, repeated grading, and threshold recalibration probe statistical and labeling robustness.The protocol tests whether bootstrap assumptions, grader judgments, or calibration choices could produce the result.
  • Evidence base: The evidence base is a structured critical synthesis of representative and high-impact work, not a registered systematic review.Searches covered Google Scholar, IEEE Xplore, ACM Digital Library, Scopus, and arXiv through February 2026.

4. Related Work

Prior work surveys LLM threats, defenses, and evaluation, while a smaller ensemble literature proposes combining specialized defenses. None of these bodies of work establishes how defenses behave together or measures the required failure correlation.

  • LLM security literature: Surveys map LLM threats, defenses, trustworthiness, deployment risk, red teaming, and evaluation but generally do not treat composition.The paper positions its contribution as a blue-team analysis of how defenses behave together.
  • Research gap: The LLM security literature recommends stacking but does not state composition rules or report the failure correlation those rules require.This absence motivates measuring defense behavior under a shared adaptive adversary.
  • Defense ensembles: Defense-ensemble systems specialize components for adversarial-suffix and malicious-semantics prompts or combine multiple guardrail classifiers.Their premise that components fail on different inputs is argued from apparent mechanism dissimilarity rather than estimated from data.
  • Classifier fusion: Classifier-fusion research formalizes ensemble diversity through pairwise error-indicator correlations and develops methods intended to create diversity.This literature supplies the vocabulary and statistic adopted for LLM defense composition.

5. The Adversary Access-Tier Model (AATM)

AATM makes defense claims comparable by specifying adversary access, knowledge, capability, and goals. It distinguishes five access tiers and links each defense result to the adversary it presupposes.

  • AATM purpose: AATM organizes defense claims by the adversary’s access, preventing attack-success rates from lacking a clear referent.The model is used throughout the paper to relate each defense layer to its assumed access tier.
  • Access tiers: Five access tiers range from A0, which can poison a retrieval source without querying the model, to A3, which holds the model’s weights.The tiers are ordered by what the adversary can reach, not by attack difficulty.
  • Access tiers: A1–A3 are cumulative, whereas A0 and A4 are non-cumulative access categories.Table 1 marks this distinction explicitly.
  • AATM extensions: AATM extends classical black-, gray-, and white-box categories by making indirect application attacks A0 and separating training-data influence A4 from weight possession A3.These distinctions capture deployed LLM attack surfaces that classical taxonomies cannot express cleanly.
  • Additional axes: Access is supplemented by knowledge, capability, and goals, distinguishing static from adaptive evaluation and recording query, compute, fine-tuning, and attack objectives.Knowledge captures whether the adversary knows and adapts to the defense; capability includes query budget, compute, and fine-tuning access.
  • Interpretation: A defense effective against A1 may say nothing about A3, while a filter stopping static attacks may fail against an adaptive A1 adversary.The practical meaning of a defense result therefore depends on both assumed access and adaptation.

6. LLM Security Threats and Vulnerabilities

The paper surveys LLM security threats by where they arise and by the access they require. It distinguishes training weaknesses, model and data threats, and user-facing attacks while emphasizing their different defense implications.

  • Scope and taxonomy: The review focuses on adversarial security threats affecting model integrity, data confidentiality, or system availability, excluding adjacent concerns unless they widen an attack surface.Threats are organized across model-centric, data-centric, user-centric, and infrastructure-related dimensions.
  • Safety-training failure modes: Three recurring safety-training weaknesses are competing objectives, mismatched generalization, and brittleness, arising at different stages of the training pipeline.They concern optimization goals, pretrained-versus-aligned distribution gaps, and where safety behavior resides in parameters.
  • Safety-training failure modes: Competing objectives, distribution mismatch, and brittleness support distinct attack families, including role-play jailbreaks, obfuscation, synonym or translation attacks, and low-cost model modification.The attacks exploit different properties of safety training rather than a single common failure mode.
  • Access-tier implications: Removing safety becomes cheap once weights are available, whereas restoring it is harder, creating an asymmetry between behavioral access tiers and mechanism-editing tiers.The paper reports no content-level defense addressing A3 or A4 because interface filtering cannot protect safety behavior removed from the weights.
  • Model-centric threats: Model-centric threats span the full AATM range, from black-box interface attacks to attacks requiring weights or training-corpus influence, so the category is unsuitable as a single defense-planning unit.No single defense layer covers the entire model-centric category.
  • Model-centric threats: Adversarial prompts can be crafted at A1 through the public interface, while A3 adversaries can optimize suffixes using gradients; inversion and extraction require progressively stronger access.Inversion and membership-style attacks typically assume A1–A2 access, whereas parameter extraction targets A3 weights.
  • Data-centric threats: A4 training-data influence enables hidden-trigger backdoors, which can preserve ordinary performance and evade standard benchmarking, red teaming, and safety evaluation.Detection must target training data or parameters rather than behavior alone.
  • Data-centric threats: Data-centric threats divide between A4 poisoning and A1 memorization leakage, placing integrity and confidentiality problems at opposite ends of the access ladder.Poisoning requires training-data influence, while memorized content can be elicited through queries.

7. LLM Defense and Mitigation Strategies

The paper organizes LLM defenses by intervention point and dependency, then examines their coverage, overhead, and shared failure conditions. Across layers, defenses address distinct surfaces but remain constrained by the model or input property they rely on.

  • Taxonomy: Two axes organize defenses: intervention point determines lifecycle layer, while dependency determines the property whose failure defeats a defense.The intervention taxonomy contains five layers, whereas dependency groups defenses that may be near-substitutes or stack candidates across layers.
  • Token surface: Surface-statistics defenses are defeated by obfuscation, out-of-distribution patterns, or predictable rules requiring constant updating.Their common weakness is treating surface statistics as a proxy for intent, with apparent strength depending on the attack class evaluated.
  • First-token distribution: First-token and training-based defenses improve safety through token-distribution control or fine-tuning, but adversaries who control or bypass opening tokens can defeat them.SafeDecoding reports about 1% MT-Bench deviation for Vicuna while requiring a parallel expert decode; excessive safety fine-tuning produces refusals on superficially unsafe-looking benign prompts.
  • Input provenance: Input-provenance defenses distinguish trusted instructions from untrusted data, addressing an A0-to-A1 boundary that content filtering handles poorly.Spotlighting cuts indirect-injection success from above 50% to below 2% on GPT-family models at class-A cost, while CaMeL achieves 77% task completion with provable security versus 84% for an undefended agent.
  • System-level controls: System-level controls protect weights or operational integrity outside the dependency taxonomy, but their evidence remains bounded by extraction complexity, domain variation, or recalibration needs.TransLinkGuard reports 0.1% computational overhead, while TRANSOM reports around 70% anomaly-detection accuracy and domain-dependent recalibration requirements.

8. Evaluation Methods and Benchmarks

The paper argues that LLM defense evaluations must model adaptive adversaries, use comparable metrics, and evaluate composed stacks rather than isolated layers. Existing benchmarks and metrics leave composition largely unmeasured, while reported results remain conditional on differing attacks, models, and datasets.

  • 8.1. The limits of static evaluation: Adaptive evaluation is essential because fixed attack sets do not establish robustness against adversaries that respond to deployed defenses.Simple adaptive attacks have broken defenses that appeared robust under static evaluation.
  • 8.1. The limits of static evaluation: Most literature effectiveness figures are conditional on their original attacks, models, and datasets, so they are not directly comparable across studies.A reported attack-success reduction is a meaningful lower bound on residual risk only when evaluation is adaptive.
  • 8.2. Evaluation Pipeline: The evaluation pipeline proceeds from baseline measurement through defense application, adaptive attack optimization, stack evaluation, and optional human validation.Its outputs include defended and adaptive ASR, false-positive rate, utility preservation, latency, trade-offs, and human-automated correlation.
  • 8.3. Evaluation Metrics and Benchmarks: Cross-cutting metrics support comparison, whereas method-specific quantities do not; the literature lacks standard pairwise measures of defense failure dependence.The paper proposes φ and the excess over independence Δ as pair-defined metrics for composition.
  • 8.3. Evaluation Metrics and Benchmarks: Benchmark coverage is predominantly English and concentrated on harmful-content elicitation, leaving complementary failure modes comparatively undercharacterized.JailbreakBench and StrongREJECT are identified as the only benchmarks in the supplied passage designed around adaptive-evaluation concerns.
  • 8.4. Comparative Analysis: Combining defensive layers improves reported safety qualitatively, but differing figures and positive pairwise failure correlation prevent interpreting combinations as additive gains.The paper therefore evaluates the missing correlation on one stack rather than treating defense-in-depth as a demonstrated quantitative sum.

9. Quantifying Inference-Time Overhead and Defense Selection

The paper makes inference-time defense costs explicit through five overhead classes and links deployability to both computational access and adversary access tiers. It then proposes selecting and composing defenses by exposed threats, reachable classes, resources, refusal budget, independence, and continuous evaluation.

  • 9. Quantifying Inference-Time Overhead: The cost model reduces inference-time defense overhead to five classes and converts qualitative trade-offs into deployment-specific arithmetic.The classes cover additive tokens, extra serial passes, multiplicative sampling, amortized training-time cost, and activation-derived cost.
  • 9.1. The Cost Model: Arithmetic FLOPs approximate prefill compute but poorly predict decoding latency, which is dominated by memory traffic and key-value-cache movement.Wall-clock decoding time therefore scales with bytes moved rather than operation count alone.
  • 9.1. The Cost Model: Prompt processing contains linear and quadratic terms, but the quadratic term overtakes the linear term only above 6d tokens.For d=4096 and d=8192, the crossover occurs at 24,576 and 49,152 tokens, respectively.
  • 9.2. Overhead Classes: Class A defenses add k prompt tokens with small, cache-amortizable cost, while Class B adds serial model invocations and Class C scales all terms by q.Examples include guard prefixes, classifiers or judge passes, and randomized query variants.
  • 9.2. Overhead Classes: Class E activation monitoring can be extremely cheap: probing all layers of an 8B-class model costs 262,144 operations, or 0.002% of baseline.This class reads already-computed internal states without adding tokens, invocations, or sampling.
  • 9.3. Defense Selection: Classes A–C are available through black-box APIs, whereas Class D requires weight-training access and Class E requires internal-activation access.Thus overhead classes tier the defender by access in parallel with AATM’s adversary tiers.
  • 9.3. Defense Selection: The selection procedure first filters candidates by exposed AATM tiers and reachable overhead classes, then prices resources, sets a refusal budget, composes for independence, and continuously evaluates the stack.The paper reports refusals, rather than compute, as the binding constraint on stack depth in its later analysis.
  • 9.4. Worked Example: For the self-hosted 8B customer-support example, baseline cost is about 47.7 TFLOPs per query, while a static 200-token guard prefix adds 3.26 TFLOPs, or 6.8%.The example also shows that same-size classifier screening can roughly triple per-query compute.

10. Composing Defenses

Defense stacks combine several distinct quantities: coverage saturates within an access tier, false refusals accumulate, and residual attack success compounds only when layer failures are independent. The paper measures positive failure dependence and finds that architectural common causes limit what diversity predicts, requiring end-to-end stack evaluation.

  • Coverage: Coverage is monotone but saturates within a tier: adding multiple A1 defenses does not extend protection to A3 or A4 adversaries.A stack of guard models, a perplexity filter, and randomized smoothing still covers exactly {A1}.
  • Effectiveness: Multiplicative residual attack success holds only when layer failures are independent; correlated failures impose a lower bound and can make added defenses contribute nothing.Perfectly correlated layers have the same residual failure as one layer.
  • Effectiveness: The derived two-layer model is an identity for parallel evaluations on the same input, not a direct estimate of sequential deployed pipelines that alter later inputs.The paper therefore requires end-to-end measurement of deployed composition.
  • False refusals: False refusals increase with stack depth, and independence that improves protection also accumulates the most legitimate-query refusals.The trade-off has no configuration that avoids both effects; deployments must price it through a global refusal budget.
  • Architectural dependence: Defense members share architectural dependence through the target model, so adding more mechanistically distinct filters cannot remove correlation carried by that common substrate.The paper identifies target-model alignment or moving a member off the shared substrate as interventions that reach this dependence.
  • Architectural dependence: Failure correlation depends partly on the adversary and is predominantly explained by common-cause behavior difficulty, so diversity is a property of a stack–adversary pair rather than the stack alone.Selecting across dependency rows uses the stack budget well but does not restore the independence assumed by multiplicative composition.

11. Measuring Failure Correlation Between Stacked Defenses

The paper measures whether stacked defenses fail independently, using pairwise failure correlations across a seven-layer stack under a shared adaptive adversary. All measurable pairs are positively correlated, so the stack’s joint residual exceeds multiplicative predictions, while refusal costs accumulate sharply.

  • All fifteen measurable defense pairs show positive failure correlation, with 𝜙 ranging from 0.30 to 0.75.The pairs are evaluated under a shared adaptive adversary and gold judge.
  • Same-row defenses correlate strongly: the probe pair reaches 𝜙=0.75, with joint residual 0.58 versus an independence prediction of 0.41.The token-surface pair also correlates positively at 𝜙=0.35 under the fluent adversary.
  • Every measured pair has a joint breach rate above its independence prediction, with Δ up to 0.172.For perplexity × probe16, the measured joint residual is 0.580 versus an independence prediction of 0.449.
  • The multiplicative composition model systematically overstates protection because layered defenses compound only under failure independence, which the measurements reject.Positive dependence persists across cross-row pairs, including defenses sharing no mechanism.
  • Difficulty stratification dissolves most cross-row association, but the mechanism-specific interpretation is not identifiable across grading and threshold regimes.The probe pair survives one stratified analysis, whereas the token-surface pair does not; alternative grader labels and thresholds change the surviving associations.
  • The assembled stack refuses 0.810 of benign prompts while remaining statistically indistinguishable from its strongest single layer, Llama Guard.The refusal burden is therefore operationally severe even though the stack admits at most 1% of adaptive attacks.

11.7. Robustness: inference, grader, and calibration

Robustness checks preserve the central positive failure-correlation finding, while the mechanism-specific within-stratum interpretation is not stable across labeling and calibration regimes. Replication reproduces attack-class and adaptive-versus-static results, but correlation evidence on the stronger target is underpowered and one pair becomes untestable.

  • Inference, grader, and calibration: 90.5% of graded responses are unanimous, yet rebuilding breach vectors from majority labels leaves all fifteen correlations positive and significant.The majority-label result has q≤1.5 × 10^-3.
  • Inference, grader, and calibration: All fifteen defense pairs remain positively and significantly associated under permutation inference, majority-of-five labels, and external thresholds.External-threshold results have q≤5 × 10^-4, and the minimum φ across regimes is 0.300.
  • Inference, grader, and calibration: The mechanism-specific stratified interpretation is retired because the surviving pair changes with grader labels and calibration thresholds.The probe pair’s common odds ratio falls from 159 to 11.8 under majority labels, while the external-threshold test becomes undefined.
  • Replication: On Llama-2, attack-class and adaptive-versus-static gaps replicate, but correlation estimates at n=50 are directionally consistent rather than independently confirmatory.The primary same-row pair is untestable because token-anomaly has residual ASR 0.02 and is nearly constant.
  • Measure robustness: Failure-correlation rankings are stable across φ, Q, disagreement, and double-fault measures, although Llama Guard’s saturated Q values require exclusion.Across the remaining pairs, Spearman ρ is 0.99 between Q and φ; including Llama Guard changes this to −0.26.

12. Discussion

The discussion applies the framework to deployed systems and interprets composition through coverage, overhead, dependence, and refusal trade-offs. It concludes that diversity is useful for selecting members, but assembled-stack behavior and deployment evidence require direct measurement.

  • Deployed systems: Three published deployments use multiple layers, human intervention, monitoring, and explicit thresholds, while addressing mainly the A0-to-A1 attack surface.All three compose across defense rows, but none addresses A3 or A4.
  • Composition rules: Coverage saturates within an adversary tier, cost composes by overhead class, effectiveness compounds only under independence, and false refusals accumulate as a union.Class C is the term that can make stacks unaffordable unless gated, while refusal costs impose a usability ceiling.
  • Measured dependence: All fifteen measured pairs have φ>0 and Δ>0, with joint residual shortfall reaching 0.172; the dependence is predominantly common-cause.Every pair remains positive under permutation inference, majority labels, and external thresholds, with a minimum φ of 0.300.
  • End-to-end behavior: The assembled stack refuses four in five benign prompts and is indistinguishable from its strongest layer, while removing that layer can make the remaining stack harder to attack than intersection prediction suggests.Per-defense figures therefore do not predict assembled-stack behavior in either direction.
  • Limitations: The evidence base combines author-selected literature synthesis, judgment-based tier and overhead assignments, a limited correlation experiment, and uncontrolled self-reported deployments.The primary experiment uses n=100 behaviors, two 7B-class targets, one attack seed, and a single-turn A1 threat model; replication at n=50 is underpowered.

13. Conclusion

The paper introduces access-tier and overhead instruments, derives composition rules, and measures failure dependence in a seven-layer defense stack. It finds that diversity helps choose layers but cannot substitute for end-to-end evaluation of the assembled stack.

  • Contribution: The AATM and five-class overhead model map defenses to adversary access, addressed attacks, evidence, and inference-time cost.The review covers five defense layers from censorship and robust training to monitoring and infrastructure hardening.
  • Composition: Coverage saturates within tiers, cost follows overhead classes, effectiveness compounds only under independent failures, and false refusals accumulate against the defender.The framework therefore treats independence as the property a layered defense purchases rather than redundancy.
  • Measurement: All fifteen measurable pairs show positive failure correlation, and the dependence remains robust across permutation, grader, and threshold checks despite difficulty stratification.The mechanism-specific survivor changes across regimes, so the paper retires that interpretation while retaining the composition verdict.
  • End-to-end result: The assembled stack refuses four in five benign prompts yet matches its strongest layer, whereas removing that layer reverses the end-to-end picture.This demonstrates that pairwise analysis alone cannot predict assembled-stack behavior.
  • Implication: Defense stacks correlate through the shared model substrate, so expanding member diversity cannot remove the architectural dependence.The paper contrasts this with classifier ensembles whose dependence can weaken as the member pool widens.
  • Practical workflow: Failure correlation selects members but does not predict stack outcomes; the recommended workflow is to measure diversity first and the assembled configuration second.Joint evaluation is required to learn the behavior actually delivered by the purchased stack.
  • Limitations: The study’s composition experiment is limited to one behavior set, two 7B-class targets, one attack seed, and a single-turn A1 threat model.Replication on the strongly aligned target is directionally consistent but underpowered, so correlation claims rest on the primary target.

CRediT authorship contribution statement

The authors contributed across conceptualization, methodology, software, investigation, analysis, data curation, validation, visualization, writing, supervision, funding, and project administration.

  • Authorship: Abrar Alotaibi led the research, analysis, data, validation, visualization, and writing contributions.Muhammad Shahid Jabbar, Sadam Al-Azani, and Moataz Ahmed contributed through review, supervision, funding, or project administration.

Data availability

The experiment’s supporting code and data are publicly available in a GitHub repository containing the materials needed to reproduce its analyses.

  • The repository provides defense implementations, calibrated thresholds, attack harnesses for both adversaries, and per-behavior breach vectors.The breach vectors support computation of every 𝜙, Δ, and confidence interval in Table 10.
  • It also includes the StrongREJECT grading prompt with its SHA-256 digest and scripts that regenerate Table 10 and Figures 3, 4, and 5.

A. Adjacent Concerns and Responsible Deployment

The paper separates security threats from adjacent responsible-deployment concerns while emphasizing that trustworthy risk assessment requires deployment-relevant evaluation protocols.

  • Adjacent Concerns: Bias, fairness, misinformation, toxicity, ethical alignment, explainability, and regulatory compliance remain outside the paper’s security scope.The stated security boundary concerns adversarial breaks of confidentiality, integrity, or availability.
  • Adjacent Concerns: Risk assessment commonly addresses bias and fairness, ethical alignment, robustness, and truthfulness as distinct dimensions.The passage identifies established instruments and techniques associated with these dimensions, including StereoSet, CrowS-Pairs, RLHF, and Constitutional AI.
  • Responsible Deployment: Parallel benchmark ecosystems cover toxicity, social bias, conversational safety, robustness, and truthfulness, but the paper’s coverage caveats also apply to them.
  • Responsible Deployment: Responsible deployment combines interaction guardrails, documented and externally auditable evaluation, data-protection compliance, and post-training alignment.
  • Responsible Deployment: Adaptive and cross-lingual evaluation protocols are presented as preconditions for risk assessment that reflects deployment rather than a static benchmark.The paper states that an assessment is only as trustworthy as its evaluation protocol.

B. Glossary of Terms

The glossary materials organize the paper’s terminology through acronym and technical-term tables, including the access tiers, overhead classes, and composition concepts used in the analysis.

  • Table 16 lists acronyms used throughout the paper, including AATM access tiers and the overhead classes introduced in Section 9.
  • Table 17 defines the technical terms on which the composition argument relies.
Loading 2608.28327v1…