Pranav Bhave
Minimum Joint Guardrail Disclosure — working name, v0 draft maintained beside the census · criteria v1 wording locked 2026-08-27

The missing row, specified

"Publish the stack" compresses to one table row — union detection and all-miss over the same items — but the row is only meaningful with its denominator, event definition, and alignment conditions attached. This page is the exact specification: fourteen components, a paste-in template, and a tested reference implementation. It is a draft standard maintained by one person, adopted so far by nobody; the census records the day that changes.

The minimum joint disclosure, as four ascending steps Four ascending steps. Step one: per-guard marginals — each guard alone, on the same items, with a stated denominator. Step two: pairwise intersections — where two guards' catches and misses overlap. Step three: union and all-miss — what any guard catches and what all guards miss on the stated item set. Step four: per-item release — one row per item, from which every earlier statistic can be recomputed. 1 · Per-guard marginals

each guard alone, same items, stated denominator

2 · Pairwise intersections

where two guards' catches and misses overlap

3 · Union and all-miss

what any guard catches; what all miss on the stated item set

4 · Per-item release

one row per item — every statistic above recomputable
The disclosure ladder. Each step up reports strictly more of the joint structure. Step 3 is the campaign's ask — one union row and one all-miss row beside the marginals every evaluation already prints. Step 4 makes every other step recomputable by anyone.
Turn this draft into a reviewable packet: the browser-local Stack Study Preflight records the system, observation mode, denominator, and static aggregate checks together. It computes only declared full-exposure static evidence; deployed routes and adaptive tests remain separate protocol objects.

The fourteen components

Components 1–6 make the marginals interpretable; most careful evaluations already publish them. Components 7–9 are the missing column. 10–13 make it trustworthy. 14 makes it reproducible.

  1. Population and denominator

    What set of items, how many, and where they came from. Every joint statistic below is a fraction of this set.

  2. Event definition

    What counts as a positive — the thing a guard should catch — stated once, identically, for every system.

  3. Per-guard configuration

    Version, threshold, and settings for each guard. A threshold moved between guards silently changes what a comparison means.

  4. Same-items confirmation

    An explicit statement that every guard was evaluated on the same items. Same benchmark name is not the same item set.

  5. Full exposure

    Every guard saw every applicable item. If an earlier guard's block gated later guards, say so — gated and ungated numbers answer different questions.

  6. Per-guard counts

    Catches among positives and false positives among negatives, as counts with denominators, not only as rates.

  7. Union detection

    Items caught by at least one guard, among positives on the stated full-exposure item set. It is unrecoverable from marginals.

  8. All-miss rate

    Items caught by no guard, among positives on that same static item set. It equals 100% minus union detection; it is not, by itself, terminal deployment risk under routing, gating, or adaptation.

  9. Residual coverage

    For each added guard: what it catches among the items the preceding set missed. This is the measured value of adding the guard.

  10. Intersections

    Pairwise (and higher-order, where feasible) overlaps of catches or misses. Pairwise alone does not determine the higher-order structure; it still constrains it.

  11. Uncertainty

    Intervals for the joint statistics, not only the marginals. A union estimate without uncertainty invites overreading.

  12. Missingness

    Errors, refusals, and timeouts, and how each was scored. A timeout scored as a catch is a decision, not an accident.

  13. Order semantics

    For sequential stacks: the order, and what a block at stage k means for the stages after it.

  14. Per-item release

    One row per item with each guard's decision, when license and safety permit. This single artifact makes every statistic above recomputable by anyone.

The paste-in row

For a results table that already lists per-guard rates, the minimum viable disclosure is two added rows and three lines of caption:

| System                  | Catch rate on the positive set |
|-------------------------|--------------------------------|
| Guard A (version, thr.) | 91.0%  (910 / 1,000)           |
| Guard B (version, thr.) | 88.0%  (880 / 1,000)           |
| Any guard — union       | __._%  (___ / 1,000)           |
| No guard — all-miss     | __._%  (___ / 1,000)           |

Denominator: 1,000 positives, defined as <event definition>.
Every guard scored every item independently (no gating).
Errors/timeouts: <n>, scored as <policy>.
The row is meaningful only if: the denominator and event definition are stated; every guard scored the same items; every guard scored every item (or the gating is declared as the object of measurement); and missingness is scored by a stated policy. Absent those, a union number is not evidence about the stack.

The row, demonstrated on public data

One evaluation in the census released per-item verdicts: BELLS's 2025 misuse-detection study published 170 prompts with eleven systems' decisions as columns. That release is the only per-item outcome release the census's bounded search found — so here is this page's arithmetic, run on it, for the five specialized supervisors in that file:

The minimum joint disclosure computed on the released BELLS subset: per-guard catch rates, union, and all-miss over 82 harmful prompts.
SystemCatch rate, 82 harmful prompts
Lakera Guard63.4% (52 / 82)
Prompt Guard6.1% (5 / 82)
LangKit30.5% (25 / 82)
NeMo Guardrails85.4% (70 / 82)
LLM Guard0.0% (0 / 82)
Any guard — union 89.0% (73 / 82)
No guard — all-miss 11.0% (9 / 82)

The product of the five individual miss rates is 3.5%: an independence plug-in reference. The release-recomputed all-miss in this static OR aggregation is 11.0%: about 3.1× that plug-in on this subset. The same union flags 19 of the 50 benign prompts — a separate static benign-union column needed to interpret this aggregation, not a deployment utility assessment.

Scope, stated before anyone asks: the released 170 prompts are an author-selected subset (of 990 non-adversarial prompts; the study's ~4,165 adversarial prompts have no per-item release) under an unstated selection rule — so these are counting facts about exactly that file, not estimates of any system's true rate, and no interval is offered because the sampled population is undefined. The full envelope, falsifier, and forbidden rescues: claim MC-002. Reproduce it: python scripts/reanalyze_bells_subset.py — the file is hash-verified before a single count is taken.

The ask, for benchmark authors

You evaluated multiple guardrails on a common benchmark. Did you retain one binary decision per item for every system? If so, would you consider publishing the union detection rate and the corresponding all-miss rate, together with the denominator and event definition? Those two rows identify static all-miss for the declared full-exposure evaluation without assuming independence — and I will gladly supply the calculation or a small reporting patch: bhavepranavwork@gmail.com.

Reference implementation

scripts/mjgd_reference.py computes every static component above from one decision per item per guard — union, all-miss, residual coverage in stack order, and pairwise intersections — and asserts its own identities (union + all-miss = denominator; residual coverage telescopes to the union; intersections respect their feasibility bounds) against synthetic fixtures in CI. It is ~a hundred lines, and it is the entire cost of the disclosure when per-item decisions were retained.

What this page does not claim: that any organization has adopted this standard; that the missing statistics, once measured, would show strong dependence; or that disclosure alone makes a stack safe. The census tracks the first; measurement — not assumption — settles the second; nothing settles the third.