I think like any security system you work through layers of depth and breadth. 99% security is actually not a failing grade - think about security for a bank va

I think like any security system you work through layers of depth and breadth. 99% security is actually not a failing grade - think about security for a bank vault. It’s layer after layer of protections, each one with a probability of being thwarted. But it’s also possible that you’re detected, which can be enough. None the less people still manage to rob bank vaults through extraordinary measures. In this case you employ classical measures to detect malicious activity, provide sufficient logging and monitoring to detect activity post attack, and layers of measures (input output detection, dual AI as you propose, prompt protections, etc). You still end up with a system that can fail. But the joint probability of all systems failing is very low.