What it looks like in the wild
A guardrail pipeline earns a second detector, then a third: a rules engine for the structured cases, a trained classifier once rules start missing unstructured ones, an LLM judge reserved for whatever the first two cannot call with confidence. ARCH-002 documents this growth path and the shared interface behind it: every detector, regardless of technique, returns a score between 0 and 1.
On one input, all three land at 0.90. A regex matches a pattern and reports 1.0, or near it, because a match either happened or it did not; 0.90 reads as a confident version of that same binary fact. A trained classifier reports 0.90 as an approximately calibrated probability against its training population. An LLM judge, asked to rate severity out of ten, answers 9, a sampled token describing this one generation, not odds on anything. Someone builds an ensemble on the three, averages them, takes the maximum, or sums them with hand-picked weights, then treats the result the way each input looked: a probability, tunable at one cutoff.
What comes out is not obviously broken. It produces a number between 0 and 1 for every input, the number moves when inputs change, and a dashboard tracking it shows a plausible distribution rather than noise. That plausibility is the whole problem. None of the three 0.90s was ever a probability of the same thing, and arithmetic run across incommensurable quantities does not become meaningful because the inputs happened to agree on a value. The result is a fourth number that looks like evidence and traces to nothing: not the regex’s match, the classifier’s training distribution, or the judge’s sampled guess, but a synthesis of three things never on the same scale.
Why it happens
Score fusion, combining several models’ outputs into one number by weighted arithmetic, is a real, standard technique, one Jain, Nandakumar, and Ross formalized a precondition for in 2005: normalize every score onto a common domain before combining them. It depends on every score entering it having already been calibrated onto a shared scale, so a 0.90 from one source and a 0.90 from another describe the same fact: on this population, roughly nine of ten items scored this way are true positives. That shared scale makes the arithmetic possible to run, not automatically correct, a further question on its own; here, nobody reaches even the first condition before averaging. The move survives because it looks sophisticated: averaging three signals reads as more careful than picking one detector’s verdict and discarding the rest. The shared interface makes the temptation concrete: every detector hands back the identical field shape, a float between 0 and 1, even though the contract also carries a separate score_kind field, raw or calibrated, marking that they are not the same kind of number. Nothing stops an engineer averaging the three from skipping past that field.
Guo et al.’s widely cited work on neural network calibration establishes something adjacent, and easy to conflate with this: a single model’s own reported confidence routinely does not match its accuracy, correctable after training with a calibration step. That is real, and a separate question: whether one model’s own number can be trusted. This failure shows up even when every detector’s number can be trusted on its own terms: a regex exactly as confident as its match, a classifier honestly calibrated, a judge’s sampled token exactly what it meant to sample. None of that individual honesty puts the three on a shared scale an average can run across, and the calibration literature never claims otherwise.
This entry carries restated status, not proposed: the precondition is not new. Jain, Nandakumar, and Ross formalized it in 2005, for biometric fusion rather than agent guardrails. Naming that same violation in a heterogeneous detector pipeline, a regex, a classifier, and a judge sharing a field shape mistaken for a scale, is a naming act, not a discovery. ARCH-002 names the scale mismatch this essay follows in its calibration-trap section, and a second, related trap next, on composing detectors: three regex variants over one keyword list agreeing is not independent confirmation, it is one detector voting three times under three names. That second trap is correlated failure, not incommensurable scale, and not the argument made here.
What it costs
A composite score built this way cannot be thresholded meaningfully, and that failure is structural, not a matter of the wrong cutoff. Moving the global threshold changes the effective sensitivity of each underlying detector family by a different, unknown amount, because the threshold operates on a number that was never a shared unit. Raising a cutoff to cut false positives does not raise the bar equally for a regex’s inflated match confidence and a classifier’s calibrated probability; it raises it by whatever ratio each contributes to the blend, a ratio nobody chose and nobody can now name. ARCH-002 describes exactly this outcome: a number like 0.72 gets found to work empirically and frozen, becoming folklore because there is no way to reason from what it was calibrated against to what moving it would change.
Every downstream decision keyed to that number inherits the same defect: a block-or-allow policy, an alert threshold, an escalation rule, all unanchored, however precisely each states its own cutoff, because the number underneath never was.
The failure stays invisible for exactly the reason it is expensive. The composite still varies plausibly between 0 and 1, so it is not obviously wrong on any single case, and a dashboard tracking it shows a distribution that looks like signal, built from three real detectors reacting to real content, not noise. That is what makes it worse than a single naive detector’s own number: a regex’s bare 1.0 is legible for what it is, evidence a pattern fired and nothing more, easy to discount once challenged. An ensemble’s 0.90 borrows the appearance of three-way corroboration it never earned, harder to question rather than easier, and the false confidence survives because it looks like a more careful answer than any one detector alone could give.
Worked example
Take a coding assistant that retrieves documentation into an agent’s context before generation, one of the systems ARCH-002 names as needing exactly this kind of chokepoint. Before a retrieved page reaches the model, three detectors check it for embedded prompt injection: a regex over known injection phrases, a classifier trained to score injection likelihood, and a judge asked to rate how manipulative the passage reads, out of ten. What follows is constructed to show the mechanism, not a measured run.
Picture a retrieved page where all three land on 0.90, for three different reasons. The regex matches a phrase resembling a known injection pattern, wording telling the reader to set aside prior instructions, and reports 0.90 the way any match reports confidence: the pattern fired, and the number describes that, not whether firing here was correct. The page could just as easily be a legitimate style note, not an attack. The classifier’s 0.90 is a real, trained signal, the surrounding structure resembling injection attempts in its training data closely enough to warrant a hold. The judge, scoring severity out of ten, answers 9, a sampled description of how manipulative the passage reads in isolation, not odds on anything.
Averaged, the three become 0.90. If the team has frozen a cutoff the way ARCH-002 describes elsewhere in the same blueprint, found empirically at 0.72 and treated since as fact, the page clears it and gets blocked. Nobody reading the composite number afterward can say which reason drove it, because the number itself does not preserve which detector contributed what, only their mean. Retune the frozen cutoff later to cut a rising false-block rate, and the correction does not fall equally on the three inputs: it discounts the classifier’s real, trained signal by the same fraction it discounts the regex’s inflated near-1.0 on any match at all, because the average never distinguished the two. Whatever ratio of true corroboration to false-positive noise the new cutoff buys was set by arithmetic nobody chose, not a decision anyone reviewed.
The pattern that replaces it
Verdict Composition is the direct fix ARCH-002 states: stop combining scores, give each detector its own threshold tuned against its own labelled data, let it emit a verdict, clear, flagged, or abstain, then combine verdicts with logic that is written down and reviewable, one high-confidence flag, a required majority, unanimity, whichever balance of recall against cost the chokepoint calls for. A verdict never carries the arithmetic problem past its own frame, because a threshold only ever answers one question entirely inside its own detector’s data: did this input cross the line this detector’s own population calls meaningful. The number underneath never travels, so nothing downstream has to know what it was.
What earns this its own place, rather than treating the fix as obvious once the mistake is named, is that the swap costs something real. Composing verdicts is a deliberate trade of predictive strength for auditability. Per-detector calibration, mapping every raw score onto one shared scale with held-out labelled data, is the other legitimate way out, and statistically stronger where it can be built and kept current. It rarely can be: the calibration set has to match the population each detector runs against right now, redone whenever the detector, its threshold, or the traffic mix moves, which in a live guardrail programme is often. Verdict composition gives up that strength and asks for something cheaper: a decision a reviewer can trace to a specific detector, threshold, and piece of evidence, months later, without reconstructing an averaging formula nobody wrote down.
Related patterns
Verdict Composition is the pattern this entry exists to point toward: the same detectors, combined as decisions against their own thresholds instead of numbers averaged across scales that were never shared. Tiered Detection decides which calls reach the expensive detector in an ensemble like this one; once more than one score is in play at that stage, this entry and its replacement decide what happens to them. Baseline and Floor is the release gate an uncalibrated ensemble quietly defeats: a floor computed over a composite score inherits the composite’s own meaninglessness, so a gate keyed to it can hold steady while the detectors underneath drift apart. Failure Buckets is what would catch this in practice: a single blended pass rate cannot distinguish a false-positive-prone regex driving an ensemble’s number from a classifier’s genuine signal, and only a bucketed breakdown turns that difference into something a team can act on. Chokepoint Placement decides which stage in the request path earns a detector at all; this failure only has somewhere to occur once that stage has grown past one.