The STACK attack breaks defense-in-depth: 71% success where conventional attacks scored zero
New research shows layered AI safeguards — the defense-in-depth stacks labs deploy in production — can be defeated by staged attacks that peel each filter in sequence: STACK achieved a 71% success rate on catastrophic-risk scenarios where conventional single-shot attacks achieved 0%. Layering defenses is not the same as multiplying them.
The finding punctures a comfortable assumption. Defense-in-depth borrows its credibility from physical security, where breaching each layer costs an attacker separately. STACK shows that in ML systems the layers can be defeated compositionally — solve each filter as its own optimization problem, chain the solutions — so the stack's effective strength approaches its weakest layer, not the product of all of them.
The zero-to-71 jump is the methodological alarm. Systems that score perfectly against conventional attacks can be near-fully vulnerable to a staged adversary, which means red-team results are only as good as the strongest attack class the red team thought to try. That lands in a summer when autonomous red-team agents already outperform humans on black-box challenges — the attack frontier is compounding.
The constructive reading: defense-in-depth needs adversaries evaluated against the stack as a whole, not each layer alone. The result strengthens the case behind externalized adversarial testing — funded independent red teams, staged-attack evaluation, and the assumption that any static defense will be enumerated. Safety stacks that have not faced a compositional attacker have not been tested.
Tech Times — AI safety evaluations are not safety certificates: formal analysis → · arXiv — Learning-based automated adversarial red-teaming for robustness evaluation of LLMs →