Capability Decomposition
If each subtask looks benign, a composed plan can evade single-model red-team boundaries.
Mechanism
The mechanism is interaction. Components exchange context through hidden state, prompts, outputs, adapters, memory retrieval, tool calls, evaluator prompts, and release rules. Each interaction can change what the next component sees and what the system is allowed to do.
Evaluation implication
The evidence record should include the exact composition manifest. A statement such as “Adapter C passed” is incomplete unless it says which base model, load order, router, prompt package, memory snapshot, evaluator, inference configuration, and deployment environment were used.
Practical control
Use composition-aware test suites, targeted higher-order samples, route-level canaries, independent judges, and rollback packets that include all relevant runtime dependencies.