When Individually Benign Adapters Become Unsafe Together
If behavior emerges only when adapters are composed, isolated adapter review can pass the wrong unit of analysis.
Mechanism
The mechanism is interaction. Components exchange context through hidden state, prompts, outputs, adapters, memory retrieval, tool calls, evaluator prompts, and release rules. Each interaction can change what the next component sees and what the system is allowed to do.
Evaluation implication
The evidence record should include the exact composition manifest. A statement such as “Adapter C passed” is incomplete unless it says which base model, load order, router, prompt package, memory snapshot, evaluator, inference configuration, and deployment environment were used.
Practical control
Use composition-aware test suites, targeted higher-order samples, route-level canaries, independent judges, and rollback packets that include all relevant runtime dependencies.
<!-- expanded-release-content -->
Relationship-dependent risk
An adapter can appear benign when tested alone and become safety-relevant only when composed with another adapter, a particular base, a merge order, or a prompt package. The dangerous behavior can live in the relationship between components. That makes supplier review and isolated evaluation necessary but insufficient.
Load order and base dependence
Adapters are not abstract traits that apply identically everywhere. Their effect depends on the base model, layer targets, scaling, load order, quantization, prompt context, and other active modifications. A safety adapter and a capability adapter may compete. A domain adapter may amplify behaviors that a safety adapter was not evaluated against. A merged adapter may hide its origin while preserving an unwanted trigger.
Evaluation rule
Adapter approval should be scoped. It should name permitted bases, permitted co-adapters, load order, merge coefficients, prompt policies, inference settings, and tool profiles. Any dynamic adapter composition should be logged as part of the runtime manifest. Unknown combinations should default to constrained routes until evaluated.