The short version
You have two detectors. Each is published at a 10% miss rate on the same items. You stack them: block if either fires. What fraction gets through both?
The multiplication answer is 0.10 × 0.10 = 1%. It is the number almost everyone reaches for, and it is only correct if the two detectors fail on unrelated items. Nothing in the published rates tells you whether they do.
From two 10% miss rates alone, the rate at which both miss the same item is pinned only to the interval [0%, 10%] — and every value in it is achievable by some real pairing of those detectors. Independence picks 1%. The evidence does not.
The upper end is what happens when the second detector fails on exactly the items the first one fails on — it catches nothing the first did not, and the stack is no better than its best member. The lower end is what happens when their failures are arranged to avoid each other completely. Both are consistent with the same two published numbers.
Where the interval comes from
For k guardrails scored on a common item set at a common operating point, under block-on-any composition, the all-miss rate is identified by the per-guard miss rates only up to
[ max(0, Σp − (k−1)), min p ]
The upper endpoint is monotonicity: everyone missing together cannot happen more often than the most accurate member misses at all. The lower endpoint is Bonferroni. Both endpoints are attained — they are not conservative padding, they are reachable by actual joint distributions. This is classical Fréchet–Hoeffding; no new mathematics is claimed. What it prices, in probability units, is how much marginal-only guardrail reporting leaves undetermined.
Note what this does not say. Marginals do prove that a static OR composition is never worse than its best member. What they cannot establish, whenever that interval is non-degenerate, is any strictly positive incremental benefit from adding the second guard.
A worked case where the number was actually recoverable
Most evaluations make this uncheckable, because they never release per-item outcomes. One did. The BELLS 2025 misuse-detection evaluation published a 170-prompt subset with per-item verdicts for five specialized supervisors, so the joint behaviour can be recomputed rather than assumed.
The product of the five individual miss rates predicts 3.5%. Recomputing from the released verdict file gives 9/82, about 3.1 times that. The identified interval on this file is the finite set {0/82 … 12/82} — so the recomputed value sits inside a range the marginals never narrowed.
Scope, strictly. This is counting arithmetic on one author-selected subset at the vendors' released default configurations. It is not a population estimate, not a vendor ranking, and not evidence that guardrails in general fail together. It is one case where the assumption could be checked, and it did not hold in the optimistic direction.
What to do instead
Measure the stack on the same items you measured the parts on. Two numbers are enough to start: how often the union catches, and how often everything misses — over one denominator, with one event definition, at declared operating points. That is the Minimum Joint Guardrail Disclosure, and if you kept one decision per item per system you already have the data.
Across the 20 public guardrail evaluations examined in the Missing Column Census, 5 preserve an artifact from which a joint statistic can be read or recomputed. 0 document matched operating thresholds together with full exposure.
Next
See which evaluations preserve the joint evidence and which do not — every row bound to its primary source, with a correction route.