Lesson 5 of 6 · 7 min read
Threat Modeling AI Systems
Threat modeling an LLM application uses the same data-flow diagram and STRIDE walk as any system, with new elements drawn in: the context assembler, retrieval stores, the tool layer, memory, and the model and its supply chain. Two adjustments make it work. Annotate every input to the context with its author, because any author can steer the model. And classify every control as deterministic or probabilistic, because only deterministic controls can carry a boundary.
Get full Premium access · $25
Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.
6 months · One payment · No auto-renewal
Practise it as an interviewer asks it
You are handed a system you have never seen. How do you find its trust boundaries, and why start there?Explain the lethal trifecta and use it to triage an agent design in two minutes.How is securing an LLM application different from ordinary application security, and what stays exactly the same?Secure an agent that reads customer data, retrieves internal documents and calls APIs. Where do you start?Walk me through threat modeling with data-flow diagrams and STRIDE. When do you do it, and what do you produce?What is SSRF, and why do LLM tools that fetch URLs bring it back?