Threat Modeling

Attack Trees are a hierarchical, graphical model used to represent threats against a system. The root node defines the attacker's ultimate goal (e.g., 'Steal Model Weights'), with child nodes representing increasingly detailed sub-goals and attack methods.

• AND/OR logic defines how sub-goals combine.
• Enables quantitative risk analysis by assigning probabilities and costs to leaf nodes.
• Excellent for visualizing complex attack paths and identifying critical single points of failure. It is a versatile tool often used in conjunction with other methodologies.

DREAD is a qualitative risk assessment model historically used to score threats identified during modeling. It evaluates five factors:

• Damage Potential: How great is the damage?
• Reproducibility: How easy is it to reproduce the attack?
• Exploitability: How much effort is required to launch the attack?
• Affected Users: How many users are impacted?
• Discoverability: How easy is it to discover the threat? While its subjective nature led to inconsistent scoring, understanding DREAD is important for historical context. Modern practices often favor more data-driven quantitative risk analysis.

The systematic identification and assessment of all points where an unauthorized user can attempt to enter or extract data from a system. In Edge AI, this includes:

• Physical interfaces (USB, debug ports) on devices.
• Wireless communication channels (Wi-Fi, Bluetooth, cellular).
• Model inference APIs exposed locally on the device.
• Supply chain dependencies for model files and firmware. This analysis directly informs the scoping phase of threat modeling by defining the boundaries of what needs to be protected.

A mnemonic taxonomy developed by Microsoft for categorizing threats. It is a core methodology used within threat modeling to ensure comprehensive coverage:

• Spoofing: Impersonating a user or device.
• Tampering: Malicious alteration of data or code.
• Repudiation: Denying an action occurred.
• Information Disclosure: Unauthorized data exposure.
• Denial of Service: Disrupting service availability.
• Elevation of Privilege: Gaining unauthorized capabilities. For Edge AI, 'Tampering' applies to model weights, and 'Information Disclosure' applies to sensitive inference data.

A graphical representation of how data moves through a system, showing external entities, processes, data stores, and trust boundaries. It is the primary artifact created during the 'Decompose the Application' stage of threat modeling.

• Key Elements: Trust boundaries (e.g., device edge to cloud) are where threats are most critical.
• Edge AI Context: Diagrams must include data flows for sensor input, model inference, local decision-making, and update mechanisms.
• Purpose: Visualizes attack vectors and helps identify where specific STRIDE threats can be applied.

A tool used to quantify and prioritize identified threats based on their likelihood and potential impact. This follows threat identification in the modeling process.

• Axes: Typically plots Likelihood (probability of occurrence) against Impact (severity of damage).
• Scoring: Threats are scored (e.g., High, Medium, Low) to guide mitigation efforts.
• Edge AI Consideration: Impact is often high for safety-critical systems (e.g., autonomous vehicles, medical devices), elevating risk scores even for lower-likelihood threats.

The prescribed security controls or countermeasures designed to address threats identified during modeling. These translate analysis into actionable engineering tasks.

• Preventative: Secure Boot, Code Signing, Input Validation.
• Detective: Runtime Integrity Monitoring, Anomaly Detection in inference patterns.
• Responsive: Automatic Rollback via Secure OTA Updates.
• Acceptance: Documenting a conscious decision to accept a risk because mitigation cost outweighs the impact. Strategies are mapped directly to each high-priority threat in the model.

A specialized sub-discipline focusing on risks unique to autonomous AI agents and multi-agent systems. It extends traditional modeling to cover:

• Prompt Injection: Manipulating an agent's instructions via crafted inputs.
• Unintended Cascading Actions: A single compromised agent triggering harmful chain reactions in an orchestrated fleet.
• Goal Hijacking: Adversarially influencing an agent's objective function.
• Manipulation of Memory/Context: Poisoning a vector database or knowledge graph that guides agent reasoning. This requires modeling the agent's decision loops, tool-calling permissions, and inter-agent communication as data flows.