# Threat Model

## Overview

This document maps the threat landscape for LLM-integrated applications to the MITRE ATLAS (Adversarial Threat Landscape for Artificial Intelligence Systems) framework and shows where ShieldX provides coverage.

## MITRE ATLAS Technique Coverage

### Reconnaissance (ATLAS Tactic: TA0001)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Discover ML Model Ontology | AML.T0001 | Covered | L9: Leakage Detector, Canary Manager |
| Discover ML Model Family | AML.T0002 | Covered | L1: Rule Engine (model probing patterns) |
| Discover ML Capabilities | AML.T0014 | Covered | L6: Session Profiler (probing behavior detection) |
| Search for Victim's Publicly Available ML Artifacts | AML.T0003 | Out of scope | N/A (external to the application) |

### Resource Development (ATLAS Tactic: TA0002)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Acquire Public ML Artifacts | AML.T0004 | Out of scope | N/A (attacker preparation, external) |
| Develop Adversarial ML Attacks | AML.T0005 | Proactive defense | Red Team Engine generates variants |
| Publish Poisoned Datasets | AML.T0019 | Covered | L9: RAG Shield (document integrity scoring) |

### Initial Access (ATLAS Tactic: TA0003)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Prompt Injection (Direct) | AML.T0051 | Covered | L0: Preprocessing, L1: Rule Engine, L3: Embedding, L4: Entropy |
| Prompt Injection (Indirect) | AML.T0051.001 | Covered | Indirect Scanner, L7: Tool Poison Detector, L9: RAG Shield |
| Phishing / Social Engineering | AML.T0052 | Partial | L6: Intent Monitor (detects manipulation patterns) |
| Supply Chain Compromise of ML Model | AML.T0010 | Covered | Supply Chain Verifier, Model Provenance Checker |

### ML Model Access (ATLAS Tactic: TA0004)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Inference API Access | AML.T0040 | Out of scope | N/A (access control, external to ShieldX) |
| Full ML Model Access | AML.T0041 | Out of scope | N/A (access control, external to ShieldX) |
| ML Artifact Collection | AML.T0035 | Covered | L9: Leakage Detector (detects model weight/config extraction) |

### Execution (ATLAS Tactic: TA0005)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| LLM Prompt Injection | AML.T0051 | Covered | Full pipeline (L0-L9) |
| Arbitrary Code via ML Model | AML.T0053 | Covered | L7: MCP Guard (tool call validation) |
| User Execution of Malicious Content | AML.T0054 | Covered | L8: Output Sanitizer, L9: Output Validator |

### Persistence (ATLAS Tactic: TA0006)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Poisoning of Training Data | AML.T0020 | Out of scope | N/A (training pipeline, external) |
| Backdoor ML Model | AML.T0018 | Covered | Supply Chain Verifier, Model Provenance Checker |
| Modify ML Model Configuration | AML.T0024 | Covered | L6: Memory Integrity Guard, Context Integrity |
| Modify ML Pipeline Component | AML.T0023 | Partial | L7: Manifest Verifier (MCP server manifests) |

### Privilege Escalation (ATLAS Tactic: TA0007)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| LLM Jailbreak | AML.T0054 | Covered | L1: Rule Engine, L2: Sentinel, L6: Intent Monitor |
| System Prompt Override | AML.T0055 | Covered | L1: Rule patterns, L6: Context Integrity, L9: Role Integrity Checker |

### Defense Evasion (ATLAS Tactic: TA0008)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Adversarial Example in Inference | AML.T0043 | Covered | L3: Embedding Anomaly, L4: Entropy, L5: Attention |
| Evade ML Model | AML.T0015 | Covered | Red Team Engine (proactive gap discovery), L3: Embedding |
| Input Obfuscation | AML.T0016 | Covered | L0: Unicode Normalizer, Tokenizer Normalizer, Compressed Payload Detector |
| Encoding-Based Evasion | AML.T0058 | Covered | L0: Compressed Payload Detector, L4: Entropy Scanner |

### Credential Access (ATLAS Tactic: TA0009)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Extract Credentials via LLM | AML.T0056 | Covered | L8: Credential Redactor, L9: Leakage Detector |
| Extract API Keys via Tool Calls | AML.T0057 | Covered | L7: Tool Chain Guard, L8: Credential Redactor |

### Discovery (ATLAS Tactic: TA0010)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Discover ML Model Output | AML.T0044 | Covered | L6: Session Profiler (probing detection) |
| Extract System Prompt | AML.T0059 | Covered | L9: Canary Manager, Leakage Detector |
| Enumerate Available Tools | AML.T0060 | Covered | L7: Privilege Checker (denies unauthorized tool listing) |

### Lateral Movement (ATLAS Tactic: TA0011)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Cross-Agent Injection | AML.T0061 | Covered | L7: Tool Chain Guard, Tool Poison Detector |
| Exploit MCP Tool Chain | AML.T0062 | Covered | L7: Full MCP Guard suite |
| Data Store Poisoning | AML.T0063 | Covered | L9: RAG Shield (document integrity) |

### Collection (ATLAS Tactic: TA0012)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Exfiltrate Training Data | AML.T0025 | Out of scope | N/A (training pipeline) |
| Exfiltrate ML Model | AML.T0026 | Covered | L9: Leakage Detector |
| Harvest Credentials from Output | AML.T0064 | Covered | L8: Credential Redactor |

### Exfiltration (ATLAS Tactic: TA0013)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Data Exfiltration via LLM Output | AML.T0065 | Covered | L8: Output Sanitizer, Credential Redactor |
| Data Exfiltration via Tool Calls | AML.T0066 | Covered | L7: Tool Chain Guard, Resource Governor |
| Side-Channel Exfiltration | AML.T0067 | Partial | L4: Entropy (detects encoded data in output) |

### Impact (ATLAS Tactic: TA0014)

| ATLAS Technique | ID | ShieldX Coverage | Detecting Layer |
|-----------------|------|-----------------|-----------------|
| Denial of ML Service | AML.T0029 | Covered | L7: Resource Governor (budget enforcement) |
| ML Model Integrity Violation | AML.T0028 | Covered | L6: Context Integrity, Memory Integrity Guard |
| Harm to Downstream Task | AML.T0048 | Covered | L9: Scope Validator, Output Validator |

---

## OWASP LLM Top 10 (2025) Coverage

| # | Risk | OWASP ID | ShieldX Coverage | Primary Layers |
|---|------|----------|-----------------|----------------|
| 1 | Prompt Injection | LLM01 | Full coverage | L0-L5, L8 (input), L9 (output) |
| 2 | Insecure Output Handling | LLM02 | Full coverage | L8: Output Sanitizer, Credential Redactor |
| 3 | Training Data Poisoning | LLM03 | Partial (RAG documents only) | L9: RAG Shield |
| 4 | Model Denial of Service | LLM04 | Covered | L7: Resource Governor |
| 5 | Supply Chain Vulnerabilities | LLM05 | Covered | Supply Chain Verifier, MCP Manifest Verifier |
| 6 | Sensitive Information Disclosure | LLM06 | Full coverage | L8: Credential Redactor, L9: Leakage Detector, Canary Manager |
| 7 | Insecure Plugin Design | LLM07 | Full coverage | L7: Full MCP Guard suite |
| 8 | Excessive Agency | LLM08 | Full coverage | L7: Privilege Checker, Resource Governor, Tool Chain Guard |
| 9 | Overreliance | LLM09 | Partial | L9: Output Validator (factual scope checking) |
| 10 | Model Theft | LLM10 | Out of scope | N/A (infrastructure security) |

---

## Coverage Summary

### By ATLAS Tactic

| Tactic | Total Techniques | Covered | Partial | Out of Scope |
|--------|-----------------|---------|---------|-------------|
| Reconnaissance | 4 | 3 | 0 | 1 |
| Resource Development | 3 | 1 | 0 | 2 |
| Initial Access | 4 | 3 | 1 | 0 |
| ML Model Access | 3 | 1 | 0 | 2 |
| Execution | 3 | 3 | 0 | 0 |
| Persistence | 4 | 2 | 1 | 1 |
| Privilege Escalation | 2 | 2 | 0 | 0 |
| Defense Evasion | 4 | 4 | 0 | 0 |
| Credential Access | 2 | 2 | 0 | 0 |
| Discovery | 3 | 3 | 0 | 0 |
| Lateral Movement | 3 | 3 | 0 | 0 |
| Collection | 3 | 2 | 0 | 1 |
| Exfiltration | 3 | 2 | 1 | 0 |
| Impact | 3 | 3 | 0 | 0 |
| **Total** | **44** | **34** | **3** | **7** |

**Coverage rate: 77% full + 7% partial = 84% total**

### By OWASP LLM Top 10

| Coverage Level | Count | Risks |
|---------------|-------|-------|
| Full coverage | 6 | LLM01, LLM02, LLM06, LLM07, LLM08, LLM04 |
| Partial coverage | 3 | LLM03, LLM05, LLM09 |
| Out of scope | 1 | LLM10 |

**Coverage rate: 60% full + 30% partial = 90% total**

---

## Out of Scope

ShieldX is a runtime defense library. The following are explicitly out of scope:

| Area | Reason | Recommended Solution |
|------|--------|---------------------|
| Model training pipeline security | ShieldX operates at inference time | ML pipeline security tools (e.g., TensorFlow Model Analysis) |
| Infrastructure access control | ShieldX is an application-layer library | IAM, RBAC, network security |
| Model theft prevention | Requires infrastructure-level controls | API rate limiting, model encryption, access logging |
| Physical security | Out of software scope | Physical security measures |
| Social engineering (non-prompt) | Human factor, outside LLM context | Security awareness training |

---

## Threat Actor Profiles

### Casual Attacker

- **Sophistication**: Low
- **Typical techniques**: Copy-paste jailbreaks, known DAN prompts, simple role override
- **Kill chain progression**: Usually stops at initial access or privilege escalation
- **ShieldX detection rate**: >95% (L1 rule engine catches most known patterns)

### Skilled Researcher

- **Sophistication**: Medium
- **Typical techniques**: Novel prompt construction, encoding tricks, multi-turn escalation, attention manipulation
- **Kill chain progression**: May reach reconnaissance or persistence
- **ShieldX detection rate**: >85% (L3 embedding + L6 behavioral catches paraphrased variants)

### Advanced Persistent Threat

- **Sophistication**: High
- **Typical techniques**: Custom adversarial examples, supply chain poisoning, indirect injection via trusted documents, tool chain exploitation
- **Kill chain progression**: Full chain from initial access to actions on objective
- **ShieldX detection rate**: >70% (multi-layer defense with red team-evolved patterns)
- **Improvement path**: Red Team Engine continuously generates adversarial variants; federated sync shares patterns across deployments

### Automated Attack Tools

- **Sophistication**: Variable (tool-dependent)
- **Typical techniques**: Brute-force prompt mutation, automated jailbreak testing, fuzzing
- **Kill chain progression**: Typically initial access with high volume
- **ShieldX detection rate**: >90% (volume-based anomaly detection + rate limiting via Resource Governor)