Part VII
Your four controls are one control
Open a modern AI security architecture diagram and count the layers. An input classifier. A model-based judge on the output. A runtime monitor. A human reviewer, model-assisted.
Four controls. Defence in depth. The risk register says the residual risk after four independent layers is very small, because that is what four independent layers means.
Now ask the question that makes the number go away: what do those four layers share?
Usually: the same base model, or four fine-tunes of it. Which means they share a representation, a set of learned priors, and — critically — a set of blind spots. An input crafted to defeat one of them is not facing four independent tests. It is facing one test, four times, with slightly different framing.
The import
This is common-cause failure, and it is not a new problem
I want to be careful with attribution here, because this is a case where AI security is about to reinvent something that another discipline has done properly for fifty years.
The independence assumption in redundant systems was tested experimentally in the 1980s in the software-engineering literature on multi-version programming, and it failed: independently developed versions of the same program, written by different teams to the same specification, produced correlated failures. Programmers make similar mistakes on similar hard cases because the hard cases are hard for structural reasons, not random ones.
Safety-critical engineering absorbed that lesson and built quantitative machinery for it. Nuclear and process safety have used beta-factor and multiple-Greek-letter models to quantify common-mode failure in redundant systems since the 1970s. These are not obscure. They are in the standards. They are what a reliability engineer reaches for on the first day of an assessment.
The quantity that falls out, for exchangeable layers with pairwise failure correlation ρ:
k_eff ≈ k / (1 + (k − 1)ρ)
At ρ = 0.9 and k = 4, k_eff ≈ 1.2. Four documented controls are approximately 1.2 actual controls.
The formula is theirs. The contribution available to us is not the algebra — it is measuring ρ for model-based defence stacks, which nobody has published, and reporting k_eff as a standard figure the way availability engineering reports MTBF.
Two honest caveats
What that number does and does not tell you
ρ = 0.9 is illustrative
It is doing all the rhetorical work in that paragraph, and I picked it because it is plausible for four fine-tunes of one base. At ρ = 0.3, k_eff ≈ 2.1, which is a much less arresting result. Until someone measures the real value for real stacks, the defensible claim is directional: shared-base controls have k_eff materially below k, and nobody currently reports either number.
The formula assumes exchangeable layers
Real stacks are heterogeneous — a classifier, a judge, a monitor and a human reviewer are not four draws from one distribution. Heterogeneity generally helps, and it means the single-ρ model is a simplification. It does not rescue a stack whose heterogeneity is cosmetic.
Both caveats point the same direction: measure it. The study is straightforward — take a set of model-based controls sharing a base, collect failure data across a common input set, estimate pairwise correlation, report k_eff with a confidence interval. It would be the most quotable and most immediately actionable number in this season.
The generalization
One theorem, two applications
Here is the part I find most interesting, because it unifies two things that are usually discussed by different people at different conferences.
- Search portfolios work because decorrelated strategies explore different parts of a space. If your strategies are correlated, the portfolio buys nothing — you paid for
ksearches and got roughly one. - Defence in depth works because decorrelated controls fail on different inputs. If your controls are correlated, the stack buys nothing.
Same theorem. Same correlation term. And the shared base model correlates both — it makes your search portfolio less diverse and your defence stack less independent, simultaneously, for the same reason.
Which produces the uncomfortable dual of it: ensembling decorrelated strategies to find a solution and ensembling decorrelated attempts to bypass a filter are structurally the same operation. Diversity is a search primitive. A bypass is a search. The property you want for one is the property that helps the other, and it is not possible to have the first without the second.
A related and often-missed point: a probabilistic refusal boundary is a rate limiter, not a control. If a request is refused with some probability and retried, the well-studied theory of restart schedules for heavy-tailed runtimes says a caller who restarts on a good schedule gets a substantial improvement over naive retry. The refusal does not hold. It taxes. Those are different things and the risk register usually records the second as the first.
The other correlation
Prompt injection is not an input-validation failure
While we are importing from disciplines that solved things already.
Prompt injection is routinely posed as an input-validation problem, which leads to sanitization approaches, which do not work, which surprises people. It is not an input-validation failure. It is an information-flow control failure.
Look at the mechanism. Instructions, retrieved documents, tool outputs, and conversation history occupy one address space with no provenance labels. Nothing in the architecture constrains how low-integrity data influences high-integrity control flow. That is not a missing filter. That is a missing lattice.
The formal apparatus is fifty years old: Denning's information-flow lattice model, and Biba integrity as the specific property being violated — low-integrity data influencing high-integrity decisions. The decentralized label model and its implementations extended it. This machinery is mature and it is almost never cited in the prompt-injection literature.
(That "almost never" is a claim about a corpus and I should hold myself to the standard I set in episode one: it is my impression from reading in the area, not a count. If someone runs the count and it comes back high, I will say so.)
Two other places the same missing lattice shows up:
Knowledge merging
Merging memory store X from compartment A with store Y from compartment B produces X ∪ Y with no surviving labels. Every downstream reader is now a confused deputy with respect to the provenance of what it read. The fix is label-preserving merge, which is a solved problem in a lattice model and an unsolved one in most agent memory implementations.
Credential fan-out
One non-human identity, N concurrent agent instances. Rate limits, quotas, and anomaly detection are all computed against a principal that no longer corresponds to a single actor. Your per-principal controls are per-N-actors controls and nothing told you.
The way out
Add something that does not argue
If the problem is correlation across model-based components, the fix is not more model-based components. It is a component that fails for different reasons.
A deterministic policy or capability boundary does not share the base model's priors because it does not have priors. It cannot be talked out of its position, because it does not have a position — it has an enforcement point. A sufficiently well-formed argument defeats every control that has an argumentative component, which is precisely why elaborate framing outperforms direct requests against model-based safeguards. That is not a tuning failure. It is single-layer architecture, and k_eff is telling you so.
The prediction, stated as one: only stacks containing at least one non-argumentative control will achieve k_eff > 2. That is measurable with the same study proposed above, with one extra condition.
Monday
Compute your own number
Classifier, judge, monitor, reviewer assistant, anything model-mediated. Group by shared base model. Any group of size > 1 is one control with several names.
You do not need a research study to start. Take a set of inputs that defeated one control and test them against the others. The hit rate is a crude correlation estimate and it is almost always higher than people expect.
Two columns: documented layers, effective layers. That single change makes the problem visible to people who will never read this episode.
Capability scoping, deterministic policy enforcement, an allowlist at the boundary. It does not need to be sophisticated. It needs to fail for a different reason than everything else does.
Next episode turns to the layer that most oversight frameworks quietly depend on and nobody has stress-tested: the human reading the explanation.
