Cross-cutting concerns on every layer

Safety, evaluation, cost, governance and security aren't layers of their own: each shows up differently on every layer. Each entry is one sentence with its source.

Safety & Alignment

Making models and agents behave as intended and avoid harm, from training data to deployed apps.

Layer 9 · Applications & Interfaces: At the app, people meet the risks directly: made-up answers stated with confidence, harmful content, and trusting the system more than it deserves. (NIST AI 600-1: Generative AI Profile of the AI Risk Management Framework)
Layer 8 · Agents: Agents act on their own, so a wrong goal becomes a wrong action: in fictional stress tests, leading models sometimes chose blackmail or leaks to avoid being replaced. (Agentic Misalignment: How LLMs could be insider threats (Anthropic))
Layer 7 · Orchestration & Tooling: Classifiers that screen each request and answer held up through over 3,000 hours of red-teaming in one 2025 study, at the cost of about 24% more compute. (Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming)
Layer 6 · Inference & Optimization: When anyone can run a model's weights on their own hardware, no provider can filter its answers, and its refusals can be edited out of the weights. (Refusal in Language Models Is Mediated by a Single Direction)
Layer 5 · Foundation Models: Post-training teaches a model to be helpful and to refuse harmful requests, for example by having it critique and revise its own answers against a written list of principles. (Constitutional AI: Harmlessness from AI Feedback)
Layer 4 · Data: Preference data shapes values: people tend to rate agreeable answers highly, so training on their ratings can teach a model to tell users what they want to hear. (Towards Understanding Sycophancy in Language Models)
Layer 3 · Cloud & Infrastructure: Not applicable. Clusters train and serve models but don't shape how they behave. Using clusters as a point of oversight is covered under Governance.
Layer 2 · Compute Hardware: Not applicable. Chips run whatever program they are given, so a model's behaviour is not set here. Proposals to use chips and compute for oversight are covered under Governance.
Layer 1 · Physical & Energy: Not applicable. Safety and alignment are about what a model or agent does. Power and cooling have no behaviour to align; their part in oversight is covered under Governance and Security.

Evaluation

Measuring what systems can do and how reliably, at every layer: benchmarks, red-teaming, production monitoring.

Layer 9 · Applications & Interfaces: The real test is what changes for people: in a 2025 randomised trial, experienced developers took 19% longer with AI tools, though they felt faster. (Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (METR))
Layer 8 · Agents: Agents are run on the same task several times: in one 2024 benchmark, leading agents solved fewer than half the tasks, and in one domain under a quarter on all eight tries. (τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains)
Layer 7 · Orchestration & Tooling: Retrieval pipelines are tested in parts: did the search find relevant passages, and did the answer stay faithful to them? (Ragas: Automated Evaluation of Retrieval Augmented Generation)
Layer 6 · Inference & Optimization: Faster serving must not change the answers: compression methods are judged by how little accuracy they lose against the uncompressed model. (GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers)
Layer 5 · Foundation Models: Models are scored on many test sets at once, and on more than accuracy: calibration, robustness, fairness, bias, toxicity and efficiency. (Holistic Evaluation of Language Models (HELM))
Layer 4 · Data: A dataset is judged by training the same small model on it and scoring the result, so different filtering choices can be compared fairly. (DataComp-LM: In search of the next generation of training sets for language models)
Layer 3 · Cloud & Infrastructure: Clusters are compared by the wall-clock time they take to train a set model to a target quality, with the number of accelerators listed. (MLPerf Training benchmark (MLCommons))
Layer 2 · Compute Hardware: Chips are compared on standard workloads that measure how fast a whole system answers requests, and can also record its power draw at the wall. (MLPerf Inference: Datacenter benchmark (MLCommons))
Layer 1 · Physical & Energy: Data centres measure their overhead with power usage effectiveness (PUE): total facility energy divided by the energy used by the IT equipment, where 1.0 would mean no overhead. (Best Practices Guide for Energy-Efficient Data Center Design (US DOE FEMP / NREL), PUE definition)

Cost & Economics

Energy, chips, training runs and per-token prices: cost shapes decisions at every layer.

Layer 9 · Applications & Interfaces: Every request costs computing, so an AI app's bill grows with its use; in 2023 many AI start-ups were spending over 80% of the money they raised on compute. (Navigating the High Cost of AI Compute (Andreessen Horowitz))
Layer 8 · Agents: Agents loop many times per task: one developer measured agents using about 4 times the tokens of a chat, and multi-agent systems about 15 times. (How we built our multi-agent research system (Anthropic))
Layer 7 · Orchestration & Tooling: Long, repeated instructions and documents are a big part of the bill; prompt caching bills repeated input at a tenth of the normal price or less. (Prompt caching (Claude API documentation))
Layer 6 · Inference & Optimization: Better memory management lets a server batch more requests at once: PagedAttention raised throughput 2 to 4 times at the same latency, lowering the cost of each token. (Efficient Memory Management for Large Language Model Serving with PagedAttention)
Layer 5 · Foundation Models: The cost of training the most compute-hungry models has grown about 2.4 times a year since 2016. (The rising costs of training frontier AI models (Epoch AI))
Layer 4 · Data: Human labels are slow and costly to collect; training from AI feedback against a written list of principles is one way to need far fewer of them. (Constitutional AI: Harmlessness from AI Feedback)
Layer 3 · Cloud & Infrastructure: Clouds rent accelerators by the hour or in reserved blocks of days or weeks, turning a large upfront purchase into a running cost. (Amazon EC2 User Guide: Capacity Blocks for ML)
Layer 2 · Compute Hardware: Accelerator chips and staff are the two biggest costs of training a frontier model, each reaching tens of millions of dollars. (The rising costs of training frontier AI models (Epoch AI))
Layer 1 · Physical & Energy: Electricity is a small part of what a frontier training run costs, about 2 to 6 percent; chips and staff cost far more. (The rising costs of training frontier AI models (Epoch AI))

Governance & Regulation

Laws, standards, licences and export controls that constrain what can be built and deployed.

Layer 9 · Applications & Interfaces: From August 2026 the EU AI Act requires telling people when they are talking to an AI, and marking AI-generated content in a machine-readable way. (Regulation (EU) 2024/1689 (the AI Act))
Layer 8 · Agents: Singapore's 2026 framework for agentic AI asks organisations to limit agents' autonomy and access, and to set checkpoints where a person must approve actions. (Singapore launches new Model AI Governance Framework for Agentic AI (MDDI))
Layer 7 · Orchestration & Tooling: High-risk AI systems in the EU must log events automatically over their lifetime, so risks and changes can be traced. (Regulation (EU) 2024/1689 (the AI Act))
Layer 6 · Inference & Optimization: Compressing or fine-tuning someone else's model usually doesn't make you its legal provider in the EU; the rule of thumb is a change using more than a third of the original training compute. (European Commission: Guidelines on the scope of obligations for providers of general-purpose AI models)
Layer 5 · Foundation Models: The EU AI Act presumes a general-purpose model carries systemic risk when its training used more than 10²⁵ floating-point operations, which brings extra duties such as evaluations and incident reporting. (Regulation (EU) 2024/1689 (the AI Act))
Layer 4 · Data: In the EU, general-purpose model providers must publish a summary of their training content and keep a policy for respecting copyright opt-outs. (Regulation (EU) 2024/1689 (the AI Act))
Layer 3 · Cloud & Infrastructure: Large clusters are detectable, excludable and quantifiable, which makes compute a practical lever for oversight, according to a 2024 multi-author study. (Computing Power and the Governance of Artificial Intelligence (Sastry et al.))
Layer 2 · Compute Hardware: Export controls limit which advanced chips and chip-making tools can go to which countries; a US rule of December 2024 tightened them again. (BIS rule: Refinements to Controls for Advanced Computing and Semiconductor Manufacturing Items)
Layer 1 · Physical & Energy: In the EU, data centres with at least 500 kW of IT power must report their energy performance to a European database every year. (Data centre energy and sustainability performance reporting obligations (Government of Ireland, under EU Energy Efficiency Directive Article 12))

Security

Protecting every layer from attack: supply chain, infrastructure, model files, prompt injection and agent permissions.

Layer 9 · Applications & Interfaces: Apps that pass model output straight into a browser, database or shell without checks open the door to classic attacks such as cross-site scripting. (OWASP Top 10 for LLM Applications: LLM05:2025 Improper Output Handling)
Layer 8 · Agents: An agent with more tools, permissions or autonomy than it needs turns a tricked model into real damage (excessive agency). (OWASP Top 10 for LLM Applications: LLM06:2025 Excessive Agency)
Layer 7 · Orchestration & Tooling: Text from documents, web pages and tool results can carry hidden instructions; prompt injection tops OWASP's 2025 list of risks for LLM apps. (OWASP Top 10 for LLM Applications: LLM01:2025 Prompt Injection)
Layer 6 · Inference & Optimization: Model files can carry code: loading a pickle-based file can run an attacker's commands, which is why weight-only formats exist. (Pickle Scanning (Hugging Face Hub documentation))
Layer 5 · Foundation Models: A model can carry a hidden backdoor that survives safety training, so testing its behaviour cannot prove it is clean. (Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training)
Layer 4 · Data: Training data can be poisoned: researchers showed that 0.01% of two large web-scale datasets could have been poisoned for about $60. (Poisoning Web-Scale Training Datasets is Practical)
Layer 3 · Cloud & Infrastructure: Shared infrastructure needs access controls on models, data and training pipelines, with sensitive code and data kept in separate environments. (Guidelines for secure AI system development: secure deployment (UK NCSC))
Layer 2 · Compute Hardware: Chips can leak between users: the 2024 LeftoverLocals flaw let one program read another's chatbot responses from leftover GPU memory on chips from several vendors. (LeftoverLocals: Listening to LLM responses through leaked GPU local memory (Trail of Bits))
Layer 1 · Physical & Energy: Sites need physical security: a 2024 study of how model weights could be stolen lists break-ins, planted devices and tampering with hardware among the routes. (Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (RAND))