Can layered verification suffice?

The skeptical position is that adding layers does not by itself solve verification. Each layer can relocate the trust decision, inherit shared blind spots, or be gamed if it relies on in-band claims. On this view, layered checks suffice only when they terminate in independent, out-of-band evidence and a genuine runtime authorization boundary.

• Every verification layer embeds a choice about which assumptions and identification boundary to trust, so adding layers can move rather than remove blind spots.
• Stacked verifiers may share coverage gaps: stronger checks, specifications, generators, provenance, and signatures can each validate only a limited property.
• Agent-authored provenance, transcripts, manifests, or reasoning traces remain gameable unless critical ground truth comes from infrastructure outside the agent’s control.
• A stack of non-objections or PASS results is not necessarily a runtime authorization boundary; authorization requires an action-bound, policy-grounded, reconstructible decision before execution.
• Defenses compound only when their failures are sufficiently uncorrelated, a condition that layered-defense research identifies as needing measurement rather than assumption.

Featured sourceLayered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layersarxiv.org5 sourcesView sources