Defense in depth applied to AI safety is the principle of layering multiple independent safety mechanisms so that no single failure can lead to harmful outcomes. Borrowed from cybersecurity and military strategy, this approach recognizes that no individual safety measure is perfect and that robust protection requires redundant, overlapping safeguards.

Layers of AI Safety Defense

• Layer 1 — Training-Time Safety: RLHF, constitutional AI, safety fine-tuning that bake safety behaviors into the model's weights.
• Layer 2 — System Prompt: Instructions that define behavioral boundaries, refusal criteria, and ethical guidelines.
• Layer 3 — Input Filtering: Detect and block malicious, adversarial, or policy-violating user inputs before they reach the model.
• Layer 4 — Output Filtering: Scan model responses for harmful content, PII, or policy violations before showing them to users.
• Layer 5 — Rate Limiting & Monitoring: Detect unusual usage patterns, abuse attempts, and adversarial probing through behavioral analysis.
• Layer 6 — Human Oversight: Escalation paths for edge cases and periodic human review of flagged interactions.

Why Single Defenses Fail

• RLHF alone: Can be bypassed by jailbreaks and adversarial prompts.
• Input filters alone: Can't catch novel attack patterns or subtle manipulation.
• Output filters alone: Don't prevent the model from "thinking" harmful content even if it's caught before display.
• System prompts alone: Can be overridden or ignored through prompt injection techniques.

Implementation Best Practices

• Independence: Each layer should use different detection methods so a single bypass technique can't defeat multiple layers.
• Fail-Safe Defaults: When uncertain, default to refusing or escalating rather than allowing potentially harmful output.
• Continuous Updates: Regularly update each layer as new attack techniques are discovered.
• Monitoring and Logging: Track all safety layer activations for incident investigation and system improvement.

Defense in depth is considered a fundamental principle of responsible AI deployment — organizations that rely on a single safety mechanism are vulnerable to the inevitable discovery of bypasses.