Security engineers have a phrase for the right approach to protecting complex systems: defense in depth. The idea is simple. No single control is reliable enough to be your only control. You layer protections so that when one fails — and eventually one will — the others catch what it missed.
This principle applies to AI security with particular force, because AI systems have more layers to defend than traditional software. An attacker who gets past input validation still faces the model's internal guardrails. An attacker who manipulates the model's output still faces output sanitization before the response reaches the user. Each layer is fallible on its own. Together they are substantially harder to defeat.
At the input layer, Input Validation screens what enters the system before it reaches the model. This catches obvious malicious inputs and enforces structural constraints on what the model is allowed to process. But input validation alone cannot catch prompt injection attempts that look like legitimate requests, or adversarial inputs crafted to be indistinguishable from normal ones.
At the model layer, Adversarial Robustness training makes models harder to fool with crafted inputs. Certified Robustness goes further, providing mathematical guarantees about model behavior within defined input ranges. Running the model inside an LLM Sandbox limits what it can access and what actions it can take, containing the blast radius if something does go wrong.
At the output layer, Output Sanitization removes or transforms problematic content before it reaches users. Content Filtering and Toxicity Detection catch harmful outputs that the model's internal guardrails missed. And for protecting the model itself as an asset, Model Fingerprinting and Model Watermarking provide ways to detect unauthorized copies and establish provenance.
The articles in this section cover each of these defensive layers. The point is not that any one of them is sufficient. It is that the right combination, applied at every layer, makes a system substantially harder to compromise than any single protection could.
