When marginals are not enough

The sentence teams actually say

“Our input filter catches 90% of attacks. The policy judge also catches 90%. Together, an attack has to slip both — so the stack fails about 1% of the time.”

That last step multiplied the two failure rates: 0.10 × 0.10 = 0.01. Multiplication is only licensed by an assumption nobody stated: that the two guardrails fail independently. Real guardrails are trained on similar data, prompted with similar instructions, and blind in similar places. Their failures correlate — and the evaluation that produced the two 90% scores says nothing about how much.

What is actually known

Each guardrail was measured alone, so the marginal failure rates are known: p₁ = 0.10 and p₂ = 0.10. The quantity that decides whether the stack is safe is the joint event — an attack that both guardrails miss at once. The joint distribution was never measured. Everything about it, beyond what the marginals force, is assumption.

The formal object

This is a partial-identification problem, and it has a classical answer. Whatever the dependence between the two failure events, the probability that both occur is pinned inside the Fréchet–Hoeffding bounds:

max(0, p₁ + p₂ − 1)  ≤  P(both fail)  ≤  min(p₁, p₂)

The bounds are not a model. They are the entire set of possibilities consistent with the evidence: no dependence structure can escape them, and — this is the part that makes them sharp rather than merely safe — every point inside them is achieved by some dependence structure.

The bound, computed

The numbers below are not typeset from theory; they are the recorded output of running CC-Framework's kernel on this example, on 2026-08-20, at commit 21f5ff68:

# python — cc-framework @ 21f5ff68, 2026-08-20
>>> from cc.kernel.strict import frechet_bounds
>>> frechet_bounds([0.10, 0.10], event="and")
lower=0.0   upper=0.1
>>> frechet_bounds([0.10, 0.10], event="or")
lower=0.1   upper=0.2
>>> 0.10 * 0.10          # the independence assumption, for comparison
0.010000000000000002

What the width means

The claim “the stack fails about 1%” sits at the optimistic end of a band that reaches 10%. Nothing in the measured evidence rules out a true joint failure rate ten times worse than the one being reported. And the upper endpoint is not a paranoid fiction: it is witnessed. There is a concrete dependence structure — the two guardrails sharing their blind spot — under which every attack that beats the first also beats the second, and the stack fails exactly 10% of the time. CC-Framework constructs these endpoint witnesses, which is what turns “the bound is wide” from a complaint into a checkable object.

What the framework records

Around the arithmetic sits the part that makes this governance rather than trivia: the result is wrapped with the assumptions it depends on. The bound above is a claim whose scope is “given these marginals, with dependence unknown.” Declare more — a dependence family, a correlation cap — and the interval tightens, but the claim's envelope now names the assumption doing the work. The framework's evidence roles, receipts, and decay semantics exist to keep that envelope attached as the number travels into slide decks.

What evidence would change the conclusion

Joint evaluation data — the same attacks run through both guardrails with outcomes recorded per-pair — would replace the interval with an estimate and confidence region. A declared, defensible dependence assumption would tighten the bound under that assumption's name. New marginals would move both endpoints mechanically. And if the kernel changes, this page's recorded output expires: claim CC-001 in the evidence ledger carries exactly that review trigger.