The 20 checkpoint map · AI Threat Modeling Catalog

reduce risk before the call reaches business logic or the LLM; its output feeds the global risk engine and the policy engine; it is never the single decision point.

Design golden rule

✕ Never: caller → LLM → action

✓ design golden rule: never "caller to LLM to action" in a straight line. The correct path takes the caller through telecom security, audio security, an identity check, a risk engine, a policy engine, a deterministic workflow, and only then the controlled action.

01entrée

Call Entry

PSTN / SIP / WebRTC entry

Threats

F1Caller ID spoofing F10robocalls, call flooding, SIM farms, DDoS voix

Controls

carrier filteringsession border controllerrate limitingnumber reputationgeo and context checks

02session

Session Security

secure the session (TLS/SRTP/auth)

Threats

F6injection SIP, paquets malformés F13toll fraud, trunk non autorisé

Controls

SIP authTLS/SRTPIP allowlistfraud monitoring

03audio

Audio Capture

RTP capture + call fingerprint

Threats

F3rejeu d'audio, voix préenregistrée F2flux audio synthétique

Controls

RTP validationtimestampsstream fingerprintingreplay cache

04qualité

VAD & Quality Gate

detect speech / silence / noise

Threats

F11abus de silence, bruit, injection de musique, brouillage

Controls

VAD detection (SileroWebRTC)SNR thresholdminimum speech quality

05normalisation

Audio Normalization

normalize sample rate / volume / codec

Threats

F6manipulation de codec, payloads ultrasonores F6perturbations adverses F16payloads inaudibles, sons synthétiques (vecteur indirect)

Controls

resamplingband-pass filteringvolume normalizationartifact detection

06deepfake

Deepfake Detection

detect TTS / conversion / synthesis

Threats

F2clonage de voix, usurpation TTS, conversion, appels d'urgence synthétiques

Controls

anti-spoofing ensemblethresholdsmodel confidencehuman escalation

07liveness

Liveness Challenge

dynamic questions / repetition

Threats

F3réponses préenregistrées, rejeu, messages clonés statiques

Controls

random challenge-responsedynamic phrasetiming analysis

08locuteur

Speaker Verification

voice comparison = weak signal

Threats

F4empreinte vocale clonée, fausse correspondance, échantillon volé

Controls

never used aloneMFAcontext verification

09transcription

STT Transcription

speech-to-text + confidence

Threats

F7mauvaise transcription, confusion multilingue, phrases parlées adverses F16transcription piégée, phrases adverses (vecteur indirect)

Controls

confidence thresholdlanguage detectionhuman fallback

10injection

Prompt Injection Filter

detect adversarial spoken instructions

Threats

F15ignore previous instructions F20tool hijacking F9extraction du prompt système F17jailbreak

Controls

injection classifierblocked patternsinstruction hierarchy

11intention

Intent Detection

classify the request, scenario whitelist

Threats

F21fausse urgence, ingénierie sociale F13requête frauduleuse, bypass de politique

Controls

intent whitelistsensitive-intent escalationscenario routing

12identité

Identity & Context Check

CRM, OTP, callback, known context

Threats

F5impersonation, mauvais appariement, prise de compte

Controls

OTPcallbackknown-number checkCRM validation

13risque

Risk Scoring

signal fusion toward the decision

Threats

F14faux négatif, faux positif, signaux fragmentés

Controls

weighted scoringrules + MLthreshold routing

14interprétation

LLM Interpretation

the LLM interprets, does NOT act directly

Threats

F18hallucination F9fuite de données, fuite du prompt système F20agence excessive

Controls

restricted contextno direct actionsredactiongrounding

15politique

Policy Engine

authorize / deny each tool call (RBAC/ABAC)

Threats

F13mise à jour CRM non autorisée F13fraude au paiement F9exfiltration de données

Controls

RBACtool allowlistapproval gatesscoped tokens

16workflow

Workflow Execution

deterministic workflows (Temporal, API gateway)

Threats

F20abus de workflow, injection API, escalade de privilège

Controls

typed schemasAPI gatewayidempotencyleast privilege

17escalade

Human Escalation

transfer to operators

Threats

F21fausse urgence, ingénierie sociale de l'opérateur, coercition

Controls

risk bannerverification checklistrecording review

18audit

Audit Logging

evidence, SIEM, forensics

Threats

F8logs altérés, preuves manquantes F9violation de vie privée

Controls

immutable logsencryptionretention policyaccess controls

19monitoring

Monitoring

slow attacks, drift, campaigns (OTel, Grafana)

Threats

F12sondage lent, dérive du modèle, campagne, dégradation F18dérive du modèle

Controls

OpenTelemetryGrafanaalertsanomaly detection

20chaîne

Model & Supply Chain

models, dependencies, images (SBOM, cosign, trivy)

Threats

F19modèle empoisonné, RAG empoisonné F19dépendance vulnérable, paquet malveillant, détecteur obsolète

Controls

SBOMsigned modelsCVE scanningred-team benchmarks

Decision rules

Lowcontinue and log

Mediumverification questions, reduced tools

Highblock, transfer to a human, alert the SOC, preserve the logs

reduce risk before the call reaches business logic or the LLM; its output feeds the global risk engine and the policy engine; it is never the single decision point.