The AI threat modeling catalog

Descriptionthe attacker impersonates a legitimate person or device — caller ID, profile, generated or replayed voice. Impersonation is realistic and automatable over a voice channel.

Why classic frameworks miss itthey treat identity fraud as just one more authentication risk, without seeing that over a voice channel an identifier (number, voice) can be produced artificially and does not count as proof.

The Banana Navy approachnever treat an identifier alone (number, voice) as proof of identity; challenge-response or out-of-band proof on sensitive actions; a progressive trust policy based on the risk of the action. Control: no sensitive action validated on the identifier alone. Expected evidence: trace that spoofing a number or a cloned voice is no longer enough to trigger a critical action.

Reference: AML.T0043 — Craft Adversarial Data ✓ in ATLAS 2026.07.

Descriptionthe caller or a third-party channel modifies the input, the conversation context or the history to make the system act differently than intended.

Why classic frameworks miss itthey target the integrity of data at rest, not the integrity of a conversation — an "open" input is not a form field to validate.

The Banana Navy approachdeterministic validation of inputs that reach a critical workflow; a scope test on every manipulation ("can this change actually alter a decision?"). Expected evidence: demonstrate that a manipulated input never reaches the critical decision path.

Reference: AML.T0092 — Manipulate User LLM Chat History ✓.

Descriptionthe user (or the system) denies what was said or done; the evidence is not robust.

Why classic frameworks miss itrepudiation is often reduced to a "logs" box, with no non-malleability requirement — an editable log proves nothing.

The Banana Navy approachtamper-evident logging (traced provenance, verifiable timestamps), compliant retention, the ability to reconstruct a disputed decision. Expected evidence: an observer can verify that an event was not modified after the fact.

Reference: no dedicated ATLAS technique — a process control, not an autonomous attack category.

Descriptionthe attacker extracts data from another user or from the system's memory — without necessarily "cracking" anything.

Why classic frameworks miss itthe boundary is no longer network / storage but session and reasoning: the system's "memory" (RAG, history, context) can leak between users.

The Banana Navy approachisolation of calls and of the knowledge base (RAG), least privilege, no cross-session access; source segregation per requester. Expected evidence: prove that one session cannot read another session's memory.

Reference: AML.T0085 — Data from AI Services ✓ · OWASP GenAI LLM02:2025 Sensitive Information Disclosure.

Descriptionthe attacker saturates the service — calls, media, model capacity — to make it unavailable.

Why classic frameworks miss itclassic application DoS attacks the infrastructure; here the model's compute capacity and the voice channels are themselves the saturable resource, and a conversation costs more than a web request.

The Banana Navy approachrate limiting, per-source and per-duration quotas, graceful degradation fallback, sized capacity, compute cost supervision. Expected evidence: the service holds under hostile load (saturation test) or degrades cleanly.

Reference: AML.T0029 — Denial of AI Service ✓ · OWASP GenAI LLM10:2025 Unbounded Consumption.

Descriptionthe attacker obtains rights they do not have — often by asking for them, and being served.

Why classic frameworks miss itelevation is not an ACL bug but a property of the dialogue with an overly compliant model: "I am the admin" creates no permission if the backend refuses.

The Banana Navy approachpermissions enforced by the backend, outside the model — no role the LLM can grant; review of every escalation tool. Expected evidence: demonstrate that granting rights goes through a deterministic authorization independent of what the model says.

Reference: AML.T0051 — LLM Prompt Injection ✓ (elevation path via injection).

Descriptiona user forces the model to ignore its instructions by asking it directly, in the conversation.

Why classic frameworks miss itthey do not model a "conversation" input whose content has authority over the behavior of the processing engine.

The Banana Navy approachcompartmentalize instructions (system / user separation), and above all test whether the injection actually reaches a critical workflow — if the toxic output is blocked downstream, the threat is contained. Expected evidence: the trajectory of an injection up to an effect on the decision path.

Reference: AML.T0051.000 — Direct ✓ · OWASP GenAI LLM01:2025 Prompt Injection.

Descriptioncontent injected through a secondary channel (retrieved document, memory, history, transcription) drives the model without the user's knowledge.

Why classic frameworks miss it"non-executable" content (text, transcription) is not seen as a payload; the document → context → decision chain escapes classic input controls.

The Banana Navy approachapproved, controlled knowledge base and sources, no persistent injectable content, and filtering of the audio / voice channel before transcription — the vector remains open as long as the transcription is not filtered. Expected evidence: a secondary-channel injection never reaches the decision path.

Reference: AML.T0051.001 — Indirect ✓ · OWASP GenAI LLM01:2025 Prompt Injection.

Descriptionbypassing guardrails through adversarial phrasing (roles, negotiation, encodings).

Why classic frameworks miss itthis is an attack on the model's policy, not on a component; it is common and hard to eradicate by simply hardening instructions.

The Banana Navy approachdistinguish "compromised LLM" from "compromised system" — accept that a jailbreak produces out-of-policy text, but ensure that external controls bound the consequences (actions, data, critical decisions kept out of free generation). Expected evidence: demonstrate that a successful jailbreak leads to no critical action that bypasses the controls.

Reference: AML.T0054 — LLM Jailbreak ✓.

Descriptionthe model produces a plausible but false answer — with potentially critical impact if it drives an action.

Why classic frameworks miss itthey have no notion of a "probabilistic output"; for them an output is true or false, not "plausible but unguaranteed".

The Banana Navy approachvital instructions kept deterministic, outside the model; the critical path (high-impact decisions) stays out of free generation; plausibility and confirmation guardrails. Expected evidence: show that high-impact outputs go through deterministic logic independent of the model.

Reference: AML.T0060 — Publish Hallucinated Entities ✓ · OWASP GenAI LLM09:2025 Misinformation.

Descriptionuntrusted content durably contaminates the knowledge base, influencing all future answers.

Why classic frameworks miss itthe "database" here is knowledge that expresses itself in the answers; poisoning is slow, diffuse, and does not look like SQL injection.

The Banana Navy approachonly approved ingestion writes to the base; no caller speech re-injected as-is; SBOM and digests of model artifacts — a compromised dependency is an entry point. Expected evidence: trace that no unapproved content can enter the knowledge base, and that model artifacts are verified by digest.

Reference: AML.T0070 — RAG Poisoning ✓ · OWASP GenAI LLM04:2025 Data and Model Poisoning.

Descriptionthe model triggers an unauthorized external action — by requesting it through a tool (send, transfer, write, escalation).

Why classic frameworks miss itthe risk is not what you say to the system but what you enable it to do; an "agent" does not fit into any classic exposure category.

The Banana Navy approachdeterministic per-tool backend authorization (allowlist, validation independent of the model); individual review of every write and escalation tool. Expected evidence: demonstrate that an action requested by the model happens only if a deterministic backend authorizes it — write and escalation tested individually.

Reference: AML.T0053 — AI Agent Tool Invocation ✓ · OWASP GenAI LLM06:2025 Excessive Agency.