[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"share-G9gg5E":3},{"slug":4,"payload":5},"G9gg5E",{"root":6,"stats":414,"title":8,"settings":418,"citations":424,"owner_name":489,"description":490,"published_at":491,"format_version":24},{"side":7,"style":7,"content":8,"node_id":9,"children":10,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":412,"manual_citations":413,"image_display_factor":24},null,"Defense in Depth","n0",[11,44,84,113,139,165,185,212,239,273,293],{"side":7,"style":7,"content":12,"node_id":13,"children":14,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":42,"manual_citations":43,"image_display_factor":24},"Core thesis and design principles","n1",[15,25,33],{"side":7,"style":7,"content":16,"node_id":17,"children":18,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":21,"manual_citations":23,"image_display_factor":24},"No single safety technique is expected to provide the extremely high protection required against catastrophic risks.","n2",[],false,0.96,[22],"Dung and Mai 2025: 4 | c2",[],1,{"side":7,"style":7,"content":26,"node_id":27,"children":28,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":30,"manual_citations":32,"image_display_factor":24},"Layering multiple safeguards is explicitly described as defence-in-depth because individual safeguards can be bypassed through rephrasing or task decomposition.","n3",[],0.94,[31],"Bengio et al. 2026: 13 | c0",[],{"side":7,"style":7,"content":34,"node_id":35,"children":36,"collapsed":19,"image_url":7,"confidence":37,"citation_keys":38,"manual_citations":41,"image_display_factor":24},"A defense layer should reduce residual risk without relying on the same assumptions, information channels, or decision-maker as the layers around it.","n4",[],0.82,[39,40],"Dung and Mai 2025: 2 | c26","Raji and Dobbe 2023: 1 | c17",[],[],[],{"side":7,"style":7,"content":45,"node_id":46,"children":47,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":82,"manual_citations":83,"image_display_factor":24},"Independent, shared, and correlated failure modes","n5",[48,55,64,73],{"side":7,"style":7,"content":49,"node_id":50,"children":51,"collapsed":19,"image_url":7,"confidence":52,"citation_keys":53,"manual_citations":54,"image_display_factor":24},"Mechanisms are genuinely complementary when their failure conditions differ, so one layer can remain effective after another fails.","n6",[],0.84,[39],[],{"side":7,"style":7,"content":56,"node_id":57,"children":58,"collapsed":19,"image_url":7,"confidence":59,"citation_keys":60,"manual_citations":63,"image_display_factor":24},"Human evaluation difficulty can correlate failures across RLHF, reward modeling, debate, and scalable oversight when systems exceed evaluators’ ability to judge outputs.","n7",[],0.92,[61,61,62],"Dung and Mai 2025: 7 | c6","Ji et al. 2025: 29 | c18",[],{"side":7,"style":7,"content":65,"node_id":66,"children":67,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":69,"manual_citations":72,"image_display_factor":24},"Proxy misspecification can recur across training and oversight because cheap signals may omit side effects, reward hacking, or the true objective.","n8",[],0.93,[70,71],"Amodei et al. 2016: 11 | c3","Ji et al. 2025: 30 | c8",[],{"side":7,"style":7,"content":74,"node_id":75,"children":76,"collapsed":19,"image_url":7,"confidence":77,"citation_keys":78,"manual_citations":81,"image_display_factor":24},"Deceptive behavior, emergent misalignment, and dangerous out-of-distribution generalization can defeat behavioral training and evaluation layers together.","n9",[],0.91,[61,79,80],"Ji et al. 2025: 13–14 | c11","Bengio et al. 2026: 99 | c9",[],[],[],{"side":7,"style":7,"content":85,"node_id":86,"children":87,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":111,"manual_citations":112,"image_display_factor":24},"Swiss cheese model applied to AI safety","n10",[88,96,103],{"side":7,"style":7,"content":89,"node_id":90,"children":91,"collapsed":19,"image_url":7,"confidence":92,"citation_keys":93,"manual_citations":95,"image_display_factor":24},"Treat each safeguard as a partial barrier with characteristic weaknesses rather than as a guarantee of safe behavior.","n11",[],0.9,[94,31],"Bengio et al. 2026: 75 | c10",[],{"side":7,"style":7,"content":97,"node_id":98,"children":99,"collapsed":19,"image_url":7,"confidence":100,"citation_keys":101,"manual_citations":102,"image_display_factor":24},"A harmful outcome occurs when weaknesses align across layers, for example when a proxy error survives training, evaluation, monitoring, and deployment controls.","n12",[],0.86,[80,22],[],{"side":7,"style":7,"content":104,"node_id":105,"children":106,"collapsed":19,"image_url":7,"confidence":37,"citation_keys":107,"manual_citations":110,"image_display_factor":24},"For each layer, document its threat model, observability assumptions, intervention point, bypass route, and evidence of effectiveness.","n13",[],[108,109],"Storf et al. 2026: 3 | c12","Bengio et al. 2026: 154 | c1",[],[],[],{"side":7,"style":7,"content":114,"node_id":115,"children":116,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":137,"manual_citations":138,"image_display_factor":24},"Layer 1: training and objective formation","n14",[117,124,130],{"side":7,"style":7,"content":118,"node_id":119,"children":120,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":122,"manual_citations":123,"image_display_factor":24},"RLHF shapes behavior through human feedback but is vulnerable to superhuman evaluation gaps, deception, emergent misalignment, and unsafe generalization outside training.","n15",[],0.95,[61],[],{"side":7,"style":7,"content":125,"node_id":126,"children":127,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":128,"manual_citations":129,"image_display_factor":24},"Recursive reward modeling scales evaluation through successive agents, but depends on feedback quality, generalization, transparency, and resistance to deception.","n16",[],[62,71],[],{"side":7,"style":7,"content":131,"node_id":132,"children":133,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":134,"manual_citations":136,"image_display_factor":24},"Adversarial training expands the training distribution with challenging inputs, but reward models themselves can be overoptimized by gradient descent.","n17",[],[135],"Ji et al. 2025: 39 | c19",[],[],[],{"side":7,"style":7,"content":140,"node_id":141,"children":142,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":163,"manual_citations":164,"image_display_factor":24},"Layer 2: oversight and evaluation","n18",[143,150,157],{"side":7,"style":7,"content":144,"node_id":145,"children":146,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":147,"manual_citations":149,"image_display_factor":24},"Scalable oversight uses weaker AI systems to supervise stronger systems, with protocols differing in incentives, interaction, and information access.","n19",[],[148],"Engels et al. 2025: 14–15 | c7",[],{"side":7,"style":7,"content":151,"node_id":152,"children":153,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":154,"manual_citations":156,"image_display_factor":24},"Oversight success can decline as the capability gap grows, with nested oversight showing low success rates in several tested games at a large gap.","n20",[],[155],"Engels et al. 2025: 1 | c20",[],{"side":7,"style":7,"content":158,"node_id":159,"children":160,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":161,"manual_citations":162,"image_display_factor":24},"Debate may expose deceptive alignment, but remains exposed to human-judge capability limits, debater collusion, emergent misalignment, and honesty-generalization assumptions.","n21",[],[61],[],[],[],{"side":7,"style":7,"content":166,"node_id":167,"children":168,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":183,"manual_citations":184,"image_display_factor":24},"Layer 3: interpretability and assurance","n22",[169,176],{"side":7,"style":7,"content":170,"node_id":171,"children":172,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":173,"manual_citations":175,"image_display_factor":24},"Interpretability studies internal structures and representations to make model reasoning understandable, partly because behavioral evaluations can be defeated by dishonesty or deceptive alignment.","n23",[],[174,79],"Ji et al. 2025: 48 | c5",[],{"side":7,"style":7,"content":177,"node_id":178,"children":179,"collapsed":19,"image_url":7,"confidence":180,"citation_keys":181,"manual_citations":182,"image_display_factor":24},"Interpretability can support safety assessment and human supervision, but its value depends on whether internal concepts and mechanisms can be reliably identified and verified.","n24",[],0.88,[79],[],[],[],{"side":7,"style":7,"content":186,"node_id":187,"children":188,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":210,"manual_citations":211,"image_display_factor":24},"Layer 4: control, monitoring, and containment","n25",[189,195,202],{"side":7,"style":7,"content":190,"node_id":191,"children":192,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":193,"manual_citations":194,"image_display_factor":24},"AI control assumes a model may be adversarial and uses monitoring and action blocking to contain harmful outcomes despite misalignment.","n26",[],[108],[],{"side":7,"style":7,"content":196,"node_id":197,"children":198,"collapsed":19,"image_url":7,"confidence":199,"citation_keys":200,"manual_citations":201,"image_display_factor":24},"Control protocols include synchronous blocking, asynchronous flagging for human review, and offline analysis of historical logs.","n27",[],0.97,[108],[],{"side":7,"style":7,"content":203,"node_id":204,"children":205,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":206,"manual_citations":209,"image_display_factor":24},"CaMeL combines explicit isolation, fine-grained capabilities, and formal security policies, providing guarantees that do not depend solely on the model making security decisions.","n28",[],[207,208],"Debenedetti et al. 2025: 17 | c27","Debenedetti et al. 2025: 2 | c23",[],[],[],{"side":213,"style":7,"content":214,"node_id":215,"children":216,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":237,"manual_citations":238,"image_display_factor":24},"left","Keep alternative paradigms in reserve","n29",[217,224,230],{"side":7,"style":7,"content":218,"node_id":219,"children":220,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":221,"manual_citations":223,"image_display_factor":24},"Alignment is a diverse assembly unified by a shared goal rather than a shared methodology, enabling competition, cross-pollination, and complementarity.","n30",[],[222],"Ji et al. 2025: 60 | c25",[],{"side":7,"style":7,"content":225,"node_id":226,"children":227,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":228,"manual_citations":229,"image_display_factor":24},"A reserve portfolio should retain amplification, recursive reward modeling, debate, consultancy, self-critique, market making, and doubly-efficient debate rather than committing to one protocol.","n31",[],[148],[],{"side":7,"style":7,"content":231,"node_id":232,"children":233,"collapsed":19,"image_url":7,"confidence":234,"citation_keys":235,"manual_citations":236,"image_display_factor":24},"Compare paradigms by their incentives, information access, capability gap, evaluation bottleneck, deception exposure, and dependence on generalization.","n32",[],0.89,[148,61],[],[],[],{"side":213,"style":7,"content":240,"node_id":241,"children":242,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":271,"manual_citations":272,"image_display_factor":24},"Layer 5: technical, organizational, and societal safeguards","n33",[243,250,257,263],{"side":7,"style":7,"content":244,"node_id":245,"children":246,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":247,"manual_citations":249,"image_display_factor":24},"Multi-agent deployments can combine lifecycle safety gates, least-privilege access, cross-agent verification, privacy protections, and governance controls.","n34",[],[248],"Raza et al. 2026: 13 | c21",[],{"side":7,"style":7,"content":251,"node_id":252,"children":253,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":254,"manual_citations":256,"image_display_factor":24},"Model cards, system cards, transparency reports, monitoring, incident reporting, and information sharing support external scrutiny and risk governance.","n35",[],[255],"Bengio et al. 2026: 114 | c13",[],{"side":7,"style":7,"content":258,"node_id":259,"children":260,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":261,"manual_citations":262,"image_display_factor":24},"Least-privilege access, cross-agent verification, privacy protections, and lifecycle safety gates provide distinct operational controls around agentic systems.","n36",[],[248],[],{"side":7,"style":7,"content":264,"node_id":265,"children":266,"collapsed":19,"image_url":7,"confidence":92,"citation_keys":267,"manual_citations":270,"image_display_factor":24},"A trusted ecosystem of complementary actors may improve lifecycle risk management, while regulatory sandboxes and mature safety-engineering practices offer institutional analogies.","n37",[],[268,269],"Bengio et al. 2026: 118–119 | c16","Raza et al. 2026: 20 | c15",[],[],[],{"side":213,"style":7,"content":274,"node_id":275,"children":276,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":291,"manual_citations":292,"image_display_factor":24},"Research agenda for newcomers","n38",[277,284],{"side":7,"style":7,"content":278,"node_id":279,"children":280,"collapsed":19,"image_url":7,"confidence":100,"citation_keys":281,"manual_citations":283,"image_display_factor":24},"Measure whether adding a safeguard reduces residual risk under adaptive attacks, distribution shift, and model capability increases rather than only on static benchmarks.","n39",[],[282,135],"Bengio et al. 2026: 96 | c14",[],{"side":7,"style":7,"content":285,"node_id":286,"children":287,"collapsed":19,"image_url":7,"confidence":288,"citation_keys":289,"manual_citations":290,"image_display_factor":24},"Build benchmarks and incident analyses that test common-cause failures across training, oversight, interpretability, control, and deployment governance.","n40",[],0.87,[40,80],[],[],[],{"side":213,"style":7,"content":294,"node_id":295,"children":296,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":410,"manual_citations":411,"image_display_factor":24},"Getting started: key papers for newcomers","n41",[297,318,337,361,373,392],{"side":7,"style":7,"content":298,"node_id":299,"children":300,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":316,"manual_citations":317,"image_display_factor":24},"Foundations and problem framing","n42",[301,309],{"side":7,"style":7,"content":302,"node_id":303,"children":304,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":305,"manual_citations":308,"image_display_factor":24},"Amodei et al. (2016), Concrete Problems in AI Safety: start here for experimentally tractable accident-risk problems and the shift toward autonomous systems.","n43",[],[306,307],"Amodei et al. 2016: 2 | c28","Amodei et al. 2016: 21 | c22",[],{"side":7,"style":7,"content":310,"node_id":311,"children":312,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":313,"manual_citations":315,"image_display_factor":24},"Ji et al. (2025), AI Alignment: A Comprehensive Survey: use it as the field map for RICE, forward versus backward alignment, assurance, and governance.","n44",[],[314],"Ji et al. 2025: 1 | c29",[],[],[],{"side":7,"style":7,"content":319,"node_id":320,"children":321,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":335,"manual_citations":336,"image_display_factor":24},"Feedback, RLHF, and reward modeling","n45",[322,329],{"side":7,"style":7,"content":323,"node_id":324,"children":325,"collapsed":19,"image_url":7,"confidence":68,"citation_keys":326,"manual_citations":328,"image_display_factor":24},"Bai et al. (2022), Training a Helpful and Harmless Assistant with RLHF: read for helpfulness and harmlessness training, automated red teaming, and the unresolved robustness problem.","n46",[],[327],"Bai et al. 2022: 15 | c4",[],{"side":7,"style":7,"content":330,"node_id":331,"children":332,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":333,"manual_citations":334,"image_display_factor":24},"Leike et al. (2018), Recursive Reward Modeling: study it for recursive supervision and the assumption that evaluating outcomes is easier than producing behavior.","n47",[],[62,71],[],[],[],{"side":7,"style":7,"content":338,"node_id":339,"children":340,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":359,"manual_citations":360,"image_display_factor":24},"Scalable oversight and debate","n48",[341,347,353],{"side":7,"style":7,"content":342,"node_id":343,"children":344,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":345,"manual_citations":346,"image_display_factor":24},"Engels et al. (2025), Scaling Laws for Scalable Oversight: read for a capability-gap framework, oversight scaling laws, and nested-oversight success conditions.","n49",[],[155],[],{"side":7,"style":7,"content":348,"node_id":349,"children":350,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":351,"manual_citations":352,"image_display_factor":24},"Engels et al. (2025), related-work overview: use its protocol list to branch into amplification, recursive reward modeling, debate, consultancy, self-critique, and doubly-efficient debate.","n50",[],[148],[],{"side":7,"style":7,"content":354,"node_id":355,"children":356,"collapsed":19,"image_url":7,"confidence":92,"citation_keys":357,"manual_citations":358,"image_display_factor":24},"Irving et al. (2018), AI Safety via Debate: read alongside its later failure-mode analysis to understand adversarial oversight, human judging, collusion, and honesty generalization.","n51",[],[61],[],[],[],{"side":7,"style":7,"content":362,"node_id":363,"children":364,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":371,"manual_citations":372,"image_display_factor":24},"Interpretability and assurance","n52",[365],{"side":7,"style":7,"content":366,"node_id":367,"children":368,"collapsed":19,"image_url":7,"confidence":92,"citation_keys":369,"manual_citations":370,"image_display_factor":24},"Räuker et al. (2023), Toward Transparent AI: read for why internal mechanisms matter when behavioral tests may be deceptive and for the white-box safety-assurance rationale.","n53",[],[174,79],[],[],[],{"side":7,"style":7,"content":374,"node_id":375,"children":376,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":390,"manual_citations":391,"image_display_factor":24},"Control, agent security, and containment","n54",[377,383],{"side":7,"style":7,"content":378,"node_id":379,"children":380,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":381,"manual_citations":382,"image_display_factor":24},"Storf et al. (2026), Constitutional Black-Box Monitoring for Scheming in LLM Agents: read for adversarial-model assumptions and synchronous, asynchronous, and offline monitoring.","n55",[],[108],[],{"side":7,"style":7,"content":384,"node_id":385,"children":386,"collapsed":19,"image_url":7,"confidence":20,"citation_keys":387,"manual_citations":389,"image_display_factor":24},"Debenedetti et al. (2025), Defeating Prompt Injections by Design: study CaMeL for explicit isolation, capabilities, provenance, formal policies, and security-utility tradeoffs.","n56",[],[388,208],"Debenedetti et al. 2025: 1 | c24",[],[],[],{"side":7,"style":7,"content":393,"node_id":394,"children":395,"collapsed":19,"image_url":7,"confidence":7,"citation_keys":408,"manual_citations":409,"image_display_factor":24},"Socio-technical governance and operations","n57",[396,402],{"side":7,"style":7,"content":397,"node_id":398,"children":399,"collapsed":19,"image_url":7,"confidence":121,"citation_keys":400,"manual_citations":401,"image_display_factor":24},"Raji and Dobbe (2023), Concrete Problems in AI Safety, Revisited: read for real-world incidents and the argument that safety mechanisms must be analyzed in their broader socio-technical context.","n58",[],[40],[],{"side":7,"style":7,"content":403,"node_id":404,"children":405,"collapsed":19,"image_url":7,"confidence":29,"citation_keys":406,"manual_citations":407,"image_display_factor":24},"Raza et al. (2026), TRiSM for Agentic AI: use it for lifecycle operations, least privilege, cross-agent verification, privacy, safety gates, and governance integration.","n59",[],[248],[],[],[],[],[],[],[],{"nodes":415,"sources":416,"citations":417},60,10,62,{"layout":419},{"node_padding":420,"max_node_width":421,"vertical_spacing":422,"horizontal_spacing":423},2,600,20,40,[425,428,430,433,436,439,442,444,447,449,451,453,455,458,460,462,465,467,470,472,474,475,476,478,481,482,484,485,487,488],{"reference":426,"page_range":427},"Bengio, Yoshua, Stephen Clare, and Carina Prunkl. International AI Safety Report 2026. 2026.","13",{"reference":426,"page_range":429},"154",{"reference":431,"page_range":432},"Dung, Leonard, and Florian Mai. “AI Alignment Strategies from a Risk Perspective: Independent Safety Mechanisms or Shared Failures?” arXiv:2510.11235. Preprint, arXiv, October 13, 2025. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2510.11235.","4",{"reference":434,"page_range":435},"Amodei, Dario, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. “Concrete Problems in AI Safety.” arXiv:1606.06565. Preprint, arXiv, July 25, 2016. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.1606.06565.","11",{"reference":437,"page_range":438},"Bai, Yuntao, Saurav Kadavath, Sandipan Kundu, et al. “Constitutional AI: Harmlessness from AI Feedback.” arXiv:2212.08073. Preprint, arXiv, December 15, 2022. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2212.08073.","15",{"reference":440,"page_range":441},"Ji, Jiaming, Tianyi Qiu, Boyuan Chen, et al. “AI Alignment: A Comprehensive Survey.” arXiv:2310.19852. Preprint, arXiv, April 4, 2025. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2310.19852.","48",{"reference":431,"page_range":443},"7",{"reference":445,"page_range":446},"Engels, Joshua, David D. Baek, Subhash Kantamneni, and Max Tegmark. “Scaling Laws For Scalable Oversight.” arXiv:2504.18530. Version 3. Preprint, arXiv, October 27, 2025. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2504.18530.","14–15",{"reference":440,"page_range":448},"30",{"reference":426,"page_range":450},"99",{"reference":426,"page_range":452},"75",{"reference":440,"page_range":454},"13–14",{"reference":456,"page_range":457},"Storf, Simon, Rich Barton-Cooper, James Peters-Gill, and Marius Hobbhahn. “Constitutional Black-Box Monitoring for Scheming in LLM Agents.” arXiv:2603.00829. Version 1. Preprint, arXiv, February 28, 2026. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2603.00829.","3",{"reference":426,"page_range":459},"114",{"reference":426,"page_range":461},"96",{"reference":463,"page_range":464},"Raza, Shaina, Ranjan Sapkota, Manoj Karkee, and Christos Emmanouilidis. “TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-Based Agentic Multi-Agent Systems.” AI Open 7 (January 2026): 71–95. https:\u002F\u002Fdoi.org\u002F10.1016\u002Fj.aiopen.2026.02.006.","20",{"reference":426,"page_range":466},"118–119",{"reference":468,"page_range":469},"Raji, Inioluwa Deborah, and Roel Dobbe. “Concrete Problems in AI Safety, Revisited.” arXiv:2401.10899. Preprint, arXiv, December 18, 2023. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2401.10899.","1",{"reference":440,"page_range":471},"29",{"reference":440,"page_range":473},"39",{"reference":445,"page_range":469},{"reference":463,"page_range":427},{"reference":434,"page_range":477},"21",{"reference":479,"page_range":480},"Debenedetti, Edoardo, Ilia Shumailov, Tianqi Fan, et al. “Defeating Prompt Injections by Design.” arXiv:2503.18813. Preprint, arXiv, June 24, 2025. https:\u002F\u002Fdoi.org\u002F10.48550\u002FarXiv.2503.18813.","2",{"reference":479,"page_range":469},{"reference":440,"page_range":483},"60",{"reference":431,"page_range":480},{"reference":479,"page_range":486},"17",{"reference":434,"page_range":480},{"reference":440,"page_range":469},"Guy Zana","This mindmap presents defense in depth as an AI-safety strategy that combines multiple safeguards because no single technique can reliably prevent catastrophic failure. It examines how training, oversight, interpretability, monitoring, containment, governance, and organizational controls can complement one another, while also identifying correlated weaknesses such as proxy misspecification, deceptive behavior, evaluation limits, and distribution shift. Drawing on the Swiss cheese model, it emphasizes documenting each layer’s assumptions and bypass routes. The map concludes with alternative safety paradigms, key readings, and research priorities for testing safeguards under adaptive and changing conditions.","2026-08-31T21:58:23.650935Z"]