Attack Surface Mapping

The primary attack surface where adversarial payloads enter the system. This includes text prompts, image uploads, audio streams, and sensor telemetry that feed directly into model inference.

• Direct prompt injection exploits user-facing text inputs to override system instructions
• Multimodal injection hides malicious triggers in images or audio that vision-language models process
• API parameter manipulation tampers with temperature, top-p, or stop tokens to destabilize outputs
• Batch processing queues can be poisoned with crafted inputs that exploit batching optimizations

The retrieval-augmented generation (RAG) pipeline and tool-calling interfaces create secondary attack surfaces where adversaries inject malicious content into external data sources that the model trusts implicitly.

• Indirect prompt injection hides instructions in web pages, PDFs, or emails retrieved by the model
• API tool poisoning manipulates function call parameters to execute unauthorized actions
• Vector database contamination inserts adversarial embeddings that surface during semantic search
• Plugin ecosystems expose privilege escalation paths through third-party integrations

The data supply chain represents a persistent attack surface where adversaries can corrupt model behavior before deployment through poisoned datasets or compromised fine-tuning processes.

• Data poisoning injects mislabeled examples that create backdoors triggered by specific patterns
• Supply chain attacks compromise pre-trained weights or dependencies in model registries
• Federated learning gradients can be manipulated by malicious nodes to steer global model updates
• RLHF feedback poisoning corrupts human preference data to misalign reward models

Public-facing model serving APIs expose the model to extraction, inversion, and membership inference attacks through carefully crafted query sequences that probe decision boundaries.

• Model extraction reconstructs proprietary models through thousands of black-box queries
• Membership inference determines if specific records were in training data by analyzing confidence scores
• Model inversion reconstructs training data features from gradient information or output distributions
• Timing side-channels leak architectural information through response latency patterns

Autonomous agent systems introduce recursive attack surfaces where one compromised agent can cascade malicious instructions through inter-agent communication protocols and shared memory stores.

• Cross-agent prompt propagation spreads injected instructions through agent-to-agent messages
• Shared memory poisoning corrupts episodic memory stores that multiple agents retrieve from
• Planning loop manipulation causes agents to decompose goals into harmful sub-tasks
• Reflection mechanism bypass prevents agents from detecting their own compromised outputs

Monitoring and telemetry systems create unintended attack surfaces where adversaries can exfiltrate sensitive information through logging channels or manipulate audit trails to conceal attacks.

• Log injection inserts malicious content into monitoring dashboards viewed by operators
• Metric poisoning manipulates drift detection systems to mask ongoing attacks
• Trace data leakage exposes prompt contents and model outputs in distributed tracing spans
• Alert fatigue exploitation floods monitoring systems to hide genuine security incidents

The systematic counterpart to mapping: once the attack surface is enumerated, ART tools continuously probe every identified input channel. These platforms simulate multi-turn adversarial dialogues to discover jailbreaks, bypasses, and safety failures at scale.

• Transforms a static map into a dynamic, living security assessment
• Uses algorithms like Greedy Coordinate Gradient (GCG) to automate adversarial suffix generation
• Integrates into CI/CD pipelines for continuous validation

An evasion technique that fragments a malicious instruction across multiple separate inputs or API calls. A surface map must account for stateful interactions where individually benign fragments combine to form a harmful payload.

• Bypasses single-prompt safety classifiers that lack conversational context
• Exploits the multi-turn state management of chat interfaces
• Requires mapping of session persistence mechanisms and context accumulation logic

An obfuscation method that encodes malicious instructions using invisible Unicode characters, zero-width joiners, or split tokenization boundaries. These attacks evade string-matching filters by exploiting discrepancies between human visual inspection and machine tokenization.

• Leverages Unicode normalization differences between frontend and backend
• Mapping must document all input preprocessing and normalization pipelines
• Highlights the gap between semantic intent and syntactic filtering

A white-box optimization algorithm that automatically discovers universal adversarial suffixes by computing token-level gradients. It iteratively replaces tokens to maximize the probability of a harmful target response, revealing vulnerabilities in the model's alignment layer.

• Requires access to model weights and gradients
• Generates transferable attacks that often work across different models
• Surface maps must flag any exposed gradient endpoints or fine-tuning APIs

A black-box attack that steals proprietary model functionality by training a clone model on carefully curated query-response pairs. The attacker systematically probes the API to reconstruct the decision boundary, turning the exposed inference surface into a theft vector.

• Exploits high-bandwidth prediction APIs without rate limiting
• Surface mapping must inventory all inference endpoints and their query limits
• Often precedes white-box attacks on the extracted clone