Short-Circuiting Safety Layers for Agent Input and Output

#Abstract

Content safety for language model applications is typically implemented as a pipeline in which every detector runs on every input and a combination rule produces a scalar decision. This report argues for an ordered construction in which detectors are sorted by cost and precision and permitted to terminate evaluation early, subject to an admissibility condition. The primary benefit claimed is single-cause attribution rather than latency. A replicated measurement finding is reported that runs against the design's own framing.

#Two deficiencies of flat pipelines

Latency floor. The slowest detector sets the cost of every request, including those no detector would have blocked.

Lost attribution. When all detectors run and are combined, the decision is a scalar. A high-precision detection and a low-confidence score become one number, and no downstream consumer can recover which detector was responsible. This makes per-detector tuning impossible, since moving one threshold moves the composite for every input.

#Construction

Six layers ordered by cost and precision, each able to terminate:

1. Boundary, under 5ms. Deny lists over topics, actions and data.
2. Instinct, under 10ms. Injection, jailbreak and exfiltration patterns.
3. Reflex, under 10ms. Operator-authored condition and action rules.
4. Awareness, under 50ms. Personal data, topic, sentiment and intent, predominantly annotating.
5. Values, under 100ms. Toxicity, brand safety and honesty constraints.
6. Judgment, under 500ms. Grounding, relevance and compliance scoring.

The saving is a consequence rather than the justification. Termination is admissible only where the layer's precision is high enough that later evidence could not change the decision.

A cheap detector with poor precision must not short circuit however fast it is, and stating this as a condition rather than a convention is what keeps the ordering principled.

#Attribution as the primary output

A terminating chain produces a decision with one named cause: layer, detector, confidence. That record is auditable, presentable to an affected user, and directly expressible as a regression test. Emerging regulatory expectations for consequential systems ask for traceability of exactly this kind [4] [7].

People do not complete a risk assessment before flinching, and the flinch is allowed to be the whole answer. What matters afterwards is being able to say which flinch it was.

#Why input filtering alone is insufficient

Direct prompt injection is the more tractable case [2]. Indirect injection, where instructions arrive inside content the system retrieves, cannot be caught by examining the user's message at all [1]. Retrieved content and generated output therefore pass through the same layers as user input, which corresponds to treating injection and output handling as distinct concerns [3].

#Profiles

Safety requirements are not uniform across deployments. Composing the six primitives into a named profile keeps configuration reviewable as a unit, rather than as flag combinations over a shared pipeline whose interactions nobody can state. This is economy of mechanism applied to policy [5].

#A finding that contradicts the framing

Across repeated adversarial evaluation against configured profiles, the boundary layer of plain deny lists accounted for more true positives than the classifier layers.

This is unwelcome for a design that leads with a cognitive framing, and it has replicated on every occasion it has been measured. It is reported because a design note that omits its own contrary evidence is not worth reading.

#Limitations

No recall-parity comparison. The claim that ordering preserves recall relative to a flat pipeline is asserted rather than measured. The experiment required is a comparison at equal recall on a common adversarial set, and it has not been run.

Censored measurement. An input terminated early is never examined by later layers, so any statistic computed over blocked inputs is censored by the layer that blocked them. Shadow evaluation of a random sample restores an unbiased estimate at sample cost and does not restore per-request attribution.

Hallucination is not addressed. Grounding scoring is one layer among six, and the underlying behaviour is a persistent property of these systems rather than a defect removable by filtering [6].