defense in depth

**Defense in depth** applied to AI safety is the principle of layering **multiple independent safety mechanisms** so that no single failure can lead to harmful outcomes. Borrowed from cybersecurity and military strategy, this approach recognizes that no individual safety measure is perfect and that robust protection requires **redundant, overlapping safeguards**. **Layers of AI Safety Defense** - **Layer 1 — Training-Time Safety**: RLHF, constitutional AI, safety fine-tuning that bake safety behaviors into the model's weights. - **Layer 2 — System Prompt**: Instructions that define behavioral boundaries, refusal criteria, and ethical guidelines. - **Layer 3 — Input Filtering**: Detect and block malicious, adversarial, or policy-violating user inputs **before** they reach the model. - **Layer 4 — Output Filtering**: Scan model responses for harmful content, PII, or policy violations **before** showing them to users. - **Layer 5 — Rate Limiting & Monitoring**: Detect unusual usage patterns, abuse attempts, and adversarial probing through behavioral analysis. - **Layer 6 — Human Oversight**: Escalation paths for edge cases and periodic human review of flagged interactions. **Why Single Defenses Fail** - **RLHF alone**: Can be bypassed by jailbreaks and adversarial prompts. - **Input filters alone**: Can't catch novel attack patterns or subtle manipulation. - **Output filters alone**: Don't prevent the model from "thinking" harmful content even if it's caught before display. - **System prompts alone**: Can be overridden or ignored through prompt injection techniques. **Implementation Best Practices** - **Independence**: Each layer should use **different detection methods** so a single bypass technique can't defeat multiple layers. - **Fail-Safe Defaults**: When uncertain, default to **refusing or escalating** rather than allowing potentially harmful output. - **Continuous Updates**: Regularly update each layer as new attack techniques are discovered. - **Monitoring and Logging**: Track all safety layer activations for incident investigation and system improvement. Defense in depth is considered a **fundamental principle** of responsible AI deployment — organizations that rely on a single safety mechanism are vulnerable to the inevitable discovery of bypasses.