If an AI request is quietly rerouted to a different model, who really keeps it safe: the outside filter or the model?

This explores what happens to safety when a request is silently sent to a different model than the one you expected: does the provider's outside filter or the model's own training carry the load, and does that split change when routing intervenes? The corpus has no study that measures the split. It does contain the pieces that show why the burden moves toward the filter, and why the filter is a weak place to put it.

Routers choose a model for reasons unrelated to safety. Systems like RouteLLM and Hybrid-LLM decide before generation, based on how hard the query looks, and they save 40-50% on cost by sending easy queries to cheaper models Can routers select the right model before generation happens?. Routing to specialized models can even beat a single frontier model Can routing beat building one better model?. Neither result says anything about whether the chosen model refuses harmful requests as reliably as the model the user thought they were talking to. Each rerouted request hands the alignment burden to a different model. Unless the models are tested to be interchangeable on safety, that handoff is unexamined.

Routing also makes alignment less predictable. A routing decision only matters if the models behave differently. But some routers send paraphrases of the same question to different models, so a request's safety outcome can depend on wording rather than content When does routing between models actually matter?. The routing layer can itself be manipulated. An attacker can steer requests to weaker models, or cause safety measures to run against the wrong model identity, and this happens beneath prompt-level defenses Can attackers manipulate which model handles a request?. So the model's own alignment is only as trustworthy as the router's choice, and that choice can be attacked.

It is tempting to make the filter the constant that makes up for this. The corpus suggests a filter can't fully do that job. A model-level filter judges one output at one moment, while an agent's risk spreads across memory, retrieved content, tool calls and environment access Can a model-level filter truly contain an agent with environment access?. A filter tuned to one model's failures may also miss another's. Weaker models fail visibly by deleting content, while frontier models fail by corrupting it quietly while the output still looks intact Does model capability change how documents degrade?. That is about document editing, not safety, but the lesson carries over. A rerouted request can change how failures look, and a filter built for one failure signature can miss the other.

The more promising direction moves risk information with the request instead of leaving it at either checkpoint. SafeFlow attaches structured semantic labels to the original request and propagates them through the whole collaboration graph, so each downstream step inherits the original intent and risk context Can semantic labels on requests prevent malicious propagation through agent networks?. Applied to routing, this would let a request carry its safety context to whichever model receives it, so neither the filter nor the target model has to guess. Whether it works for routing is an open question in this collection. Converting a model into a working system is treated as a multi-stage pipeline that includes safety evaluation of the whole harness, not just the model Can you turn an LLM into an agent by just fine-tuning?. That fits the view that safety in rerouted systems belongs to the whole request path.