Hi, I'm Charles Costa, researcher, strategist, and founder of Lexora Labs®. Each week, I dig into research on AI, knowledge management, and the future of work so you don't have to.
EDITOR'S NOTE
Two issues ago I argued that a test score is not a handle on what an AI system is actually doing. This week is about the industry's usual answer when one safeguard isn't enough, which is to add another. Put a filter on the way in, another on the way out, train the model to refuse, and the gaps in one layer should be covered by the next. The question running through this issue is whether those layers really fail in different ways, or whether we are stacking the same blind spot several times and calling it redundancy.
THIS WEEK'S READING:
We are putting too much faith in AI to say no | MIT Technology Review
Why It Matters: Arthur Holland Michel argues that the industry is leaning heavily on models, and the safeguards wrapped around them, to refuse harmful requests. The approach borrows the Swiss cheese model: every layer has holes, but if you stack enough slices, the holes rarely line up. The slices are not free, either: one classifier added 24% to compute costs.
The way I think about these models is as a loose-lipped celebrity. To be useful, they need access to risky information, and with the right conversation they can be talked into sharing it. Trying to block that turns into whack-a-mole, because pieces that look harmless on their own can be combined into something harmful. And when the layers are trained the same way, there is a high chance that whatever slips through one of them slips through all of them.
If the layers can share blind spots, the next question is whether a filter can ever fully cover the model it guards.
Cryptographers Show That AI Protections Will Always Have Holes | Quanta Magazine
Why It Matters: Peter Hall reports on two lines of cryptography research. A UC Berkeley team led by Fairoze showed that a prompt written in code can pass an outside filter untouched, after which the model decodes it and answers. A second group, including Gluch and Shafi Goldwasser, used time-lock puzzles to prove that a filter weaker than the model it guards will always have gaps in the worst case, work that was later presented at ICLR 2026. The caveats matter: it is a worst-case result, not proof that every filter fails in practice, it covers chat filters rather than agents, and the piece ran in December 2025.
A static filter can't keep up with a model that is smarter than it is. Bitcoin raises its mining difficulty as more computing power joins the network, so the system adjusts as the threat grows. An encrypted prompt or a puzzle is fixed once it's built, and so is the filter tuned to catch it, which leaves the defender always guarding against yesterday's threat. Safety has to adjust over time. It can't be a lock you set once.
If no filter is airtight, the fallback most people reach for is the ability to shut the system off.
Newsom's AI kill-switch order | The Next Web
Why It Matters: Despite the headlines, California does not require a kill switch. SB 1047 was vetoed, and SB 53 doesn't require one either. Governor Newsom's executive order only directs experts to recommend one, verified by an independent organization. The EU, since Aug 2, can restrict, withdraw, or recall general-purpose models. A preprint by Perez coded about 80% of 1,213 AI incidents as having no stop at all and found only 7 of 40 governance instruments contain binding stop requirements. It treats a stop as an institutional practice rather than a button, and notes that with agents, "a stop at one point may leave the activity running elsewhere."
A kill switch is only as good as the willingness to enforce it. Right now there is little appetite for regulation, and in that environment even a FINRA-style approach struggles, which is something I dug into in Everyone Wants a FINRA. Nobody Wants the SEC. And with open-weight models, there is no single switch to pull.
Back to the layers themselves, and the research that explains why stacking them is not automatically safer.
AI Alignment Strategies from a Risk Perspective: Independent Alignment Mechanisms or Shared Failures? | IASEAI '26
Why It Matters: Leonard Dung and Florian Mai look at defense in depth, the idea that several redundant protections can keep a system safe even if some fail. If all techniques had the same failure modes, they write, defense in depth "would provide no additional protection at all." They map 7 representative techniques against 7 failure modes, and their tentative finding is that many of those failure modes are shared.
This is the research behind the point I made about the Swiss cheese model. Stacking layers only helps when they fail in different ways. Layers that look different on the surface but share the same weaknesses add cost without adding protection.
Shared failure modes are a theory problem until someone goes looking for them on purpose.
STACK: Adversarial Attacks on LLM Safeguard Pipelines | FAR.AI and UK AI Security Institute, AAAI-26
Why It Matters: This peer-reviewed study built a stacked safeguard pipeline and attacked it. On ClearHarm, a benchmark of harmful requests, it let 0% of standard attacks through. A staged attack, working through one layer at a time, got through 71% of the time. Even without inside access to the pipeline, the staged attack succeeded 33% of the time.
Safeguards need variation and dynamic threat detection. In our Oct 6 issue I compared AI testing to antivirus, which had to move from matching known signatures to flagging suspicious behavior with heuristics. The same shift applies here. Attackers work like social engineers, moving from one target to the next until something gives, so the safety of the whole system depends on its weakest link.
Taken together, the five pieces describe one pattern. The industry counts its safety layers, while the research keeps showing that what matters is whether they fail differently. A filter weaker than the model has gaps it can't close, a shutdown is only as real as the will to use it, and a pipeline that stops every standard attack can still fall to one that goes layer by layer.
Redundancy only counts when the layers fail differently and keep adapting, because a safety stack is only as strong as its weakest shared blind spot.
Know someone counting safety layers instead of asking how they fail? Forward this to them.
Have a take on any of this? Reply directly. I read every response.