What's this about?
Practitioners defend LLMs by stacking defenses — an input filter, a system prompt, an output classifier, a policy check — and assume the layers multiply. A stack is an ensemble, and ensembles only compound under a condition the security literature rarely checks: that the layers fail independently. This paper measures the correlation between defense layers, across access tiers and inference cost. The correlation is not zero.
What does "failure correlation" mean in practice?
If your input filter and your output classifier are both LLMs, and both were trained on similar data with similar objectives, then an attack that fools one has a much better than random chance of fooling the other. You believed you had two independent 90% filters — 99% combined. You actually have two heavily correlated ones, and the real number is much closer to 90%. Defence in depth is only depth if the layers are genuinely different kinds of thing.
Why does this matter to you?
- It is a direct, testable critique of how almost every production LLM guardrail stack is currently assembled.
- The practical implication is to deliberately diversify layer *type* — a deterministic check plus a model-based one beats two model-based ones.
- It also gives you a way to argue about guardrail budgets: adding a third correlated layer buys almost nothing while costing full inference.