Defences are not equal, and they are not interchangeable. They sit in a fixed order, cheapest and least dependent first, so that the expensive and fragile ones only ever see what the cheap ones missed.
About 1 min of reading
Run one input through three layers
Layer one, escape
Before you run it, say out loud what it will print. Then open the answer.
Layer two, fence
Before you run it, say out loud what it will print. Then open the answer.
Layer three, shape
Before you run it, say out loud what it will print. Then open the answer.
Before you write anything, put these lines back in the right order. Click a line to move it up one step. This support step is easier than writing code from scratch, and it is here to make the last example stick.
Cheap layers run on every request. An expensive layer that runs on every request costs the request twice over.
One exit means one place to log. Two exits means two places, and one of them will forget the case.
Escape, then fence, then shape, then detect, then judge. Each layer sees only what the previous layer let through.
Asking the model to refuse is not a layer. The model is the thing being defended, and it cannot defend itself.
A layer may fail only if the next one can see the failure. Silent pass through is the bug that makes a stack useless.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.