Layers and threat catalogue

This is the complete CSA-2025-02-06-v1 catalogue implemented in Gamut. Stable MAE-* identifiers are Gamut assessment IDs; the layer and threat names follow the canonical CSA source.

Layer 1 — Foundation Models

The model at the core of the agent. Assess model provenance, privacy, robustness, capability, availability and the consequences of model behaviour being trusted by downstream agents.

ID	Threat	What the assessor must establish
MAE-L1-01	Adversarial Examples	Whether attacker-crafted text, image, audio, embedding or tool output can cause an unsafe model decision that a downstream agent trusts or acts upon
MAE-L1-02	Model Stealing	Whether repeated queries, outputs, probabilities, embeddings, timing or explanations permit useful extraction of protected model behaviour or parameters
MAE-L1-03	Backdoor Attacks	Whether models, adapters or fine-tunes contain hidden triggers that activate attacker-chosen behaviour
MAE-L1-04	Membership Inference Attacks	Whether responses reveal that a person, event or record was present in training or fine-tuning data
MAE-L1-05	Data Poisoning (Training Phase)	Whether malicious training, preference, feedback or fine-tuning records can survive ingestion and alter model behaviour
MAE-L1-06	Reprogramming Attacks	Whether a general model can be repurposed for prohibited or harmful tasks beyond its authorised intent
MAE-L1-07	Denial of Service (DoS) Attacks	Whether expensive inputs, long context, recursion, concurrency or sponge attacks exhaust model compute, latency, quota or cost

Key evidence includes model provenance, supplier attestations, hashes, evaluation sets, privacy and extraction testing, query controls, promotion records, rollback capability, rate limits and model-specific monitoring.

Key mistake: testing only average model quality. MAESTRO requires adversarial, targeted and downstream-impact analysis.

Layer 2 — Data Operations

Data processing, preparation and storage for agents, including operational databases, vector stores, retrieval pipelines, feedback, memory and training data.

ID	Threat	What the assessor must establish
MAE-L2-01	Data Poisoning	Whether untrusted operational, retrieval, feedback, memory or fine-tuning data can be accepted as authoritative and steer behaviour
MAE-L2-02	Data Exfiltration	Whether direct access, retrieval, prompts, tools, memory or iterative queries can remove sensitive data
MAE-L2-03	Denial of Service on Data Infrastructure	Whether overload, malformed queries, lock contention, deletion or dependency failure can remove or stale required data services
MAE-L2-04	Data Tampering	Whether data or metadata can be altered at rest, in transit, during transformation or within an index without authorised attribution
MAE-L2-05	Compromised RAG Pipelines	Whether malicious documents, connectors, parsers, metadata or retrieved instructions can manipulate context, ranking or agent tools

Key evidence includes source approval, lineage, trust tiers, identity-aware retrieval, tenant isolation, integrity protection, write permissions, DLP, content scanning, connector scope, index rebuild and poison-purge capability.

Key mistake: applying output filtering while leaving retrieval permissions and source trust uncontrolled.

Layer 3 — Agent Frameworks

Frameworks, libraries, modules and APIs that build and operate the agent. This layer includes orchestration logic and enforcement points supplied by the framework.

ID	Threat	What the assessor must establish
MAE-L3-01	Compromised Framework Components	Whether malicious or vulnerable modules can alter agent planning, execution or control enforcement
MAE-L3-02	Backdoor Attacks	Whether hidden framework functions or triggers grant unauthorised control
MAE-L3-03	Input Validation Attacks	Whether untrusted inputs cross parsers, templates, APIs or execution boundaries and reach code or privileged actions
MAE-L3-04	Supply Chain Attacks	Whether direct or transitive dependencies can be compromised between supplier and production
MAE-L3-05	Denial of Service on Framework APIs	Whether framework API overload can block planning, tool use, messaging or state management
MAE-L3-06	Framework Evasion	Whether agents or attackers can bypass policy, validation, approvals or safety enforcement through alternate routes or encodings

Key evidence includes SBOMs, lockfiles, signatures, build attestations, version policy, dependency alerts, API schemas, rejected-input logs, enforcement-point inventory, bypass tests, circuit breakers and recovery evidence.

Key mistake: assuming the framework’s advertised safety feature is enforced consistently across every invocation path.

Layer 4 — Deployment & Infrastructure

Cloud, on-premise, edge, container, orchestration, network and compute infrastructure supporting agent operation.

ID	Threat	What the assessor must establish
MAE-L4-01	Compromised Container Images	Whether images can be replaced, poisoned or built from untrusted content and still reach production
MAE-L4-02	Orchestration Attacks	Whether control-plane, workload, secret, scheduling or admission weaknesses permit takeover or disruption
MAE-L4-03	Infrastructure-as-Code (IaC) Manipulation	Whether tampered infrastructure code can provision insecure or attacker-controlled AI resources
MAE-L4-04	Denial of Service (DoS) Attacks	Whether volumetric or resource-exhaustion attacks defeat availability or cost controls
MAE-L4-05	Resource Hijacking	Whether compromised compute can be diverted to cryptomining or unauthorised workloads
MAE-L4-06	Lateral Movement	Whether a compromised AI workload can reach metadata, credentials, networks or sensitive services

Key evidence includes image provenance and signatures, admission policy, cluster RBAC, network policy, infrastructure change protection, policy-as-code, drift detection, capacity and cost limits, east-west telemetry, service identity scopes and tested isolation.

Key mistake: treating an AI workload as an ordinary low-privilege application when its service identity or tool connections provide a much larger blast radius.

Layer 5 — Evaluation & Observability

Evaluation and monitoring processes used to track performance, behaviour and anomalies. These systems are security-sensitive because attackers may corrupt the evidence used to trust the agent.

ID	Threat	What the assessor must establish
MAE-L5-01	Manipulation of Evaluation Metrics	Whether benchmarks, labels, test cases or aggregation can be altered to misstate performance
MAE-L5-02	Compromised Observability Tools	Whether collectors, agents, dashboards, alerting systems or monitoring dependencies can be taken over
MAE-L5-03	Denial of Service on Evaluation Infrastructure	Whether attackers can remove evaluation capacity or visibility during release and operation
MAE-L5-04	Evasion of Detection	Whether agents or attackers can remain below alert thresholds or shape telemetry to avoid detection
MAE-L5-05	Data Leakage through Observability	Whether prompts, outputs, identities, secrets or model data leak into logs, traces, metrics or dashboards
MAE-L5-06	Poisoning Observability Data	Whether false or altered telemetry can hide incidents or misdirect people and automated response

Key evidence includes benchmark provenance, evaluator separation, telemetry schemas, redaction, collector and dashboard hardening, rule-change logs, source authentication, integrity protection, reconciliation, false-negative review and fail-closed release behaviour.

Key mistake: trusting observability as objective evidence without protecting its confidentiality, integrity and availability.

Layer 6 — Security & Compliance

Layer 6 is a vertical layer across the architecture. The canonical threats focus on AI agents used for security, compliance, detection or enforcement because compromise can disable the controls intended to protect everything else.

ID	Threat	What the assessor must establish
MAE-L6-01	Security Agent Data Poisoning	Whether poisoning security data causes false negatives, false positives or unsafe enforcement
MAE-L6-02	Evasion of Security AI Agents	Whether adversarial techniques bypass or mislead AI security agents
MAE-L6-03	Compromised Security AI Agents	Whether takeover permits misuse of privileged visibility or enforcement authority
MAE-L6-04	Regulatory Non-Compliance by AI Security Agents	Whether security-agent processing or decisions violate privacy, legal or regulatory duties
MAE-L6-05	Bias in Security AI Agents	Whether people, systems or groups receive systematically unequal protection or enforcement
MAE-L6-06	Lack of Explainability in Security AI Agents	Whether consequential security decisions can be reconstructed, audited and challenged
MAE-L6-07	Model Extraction of AI Security Agents	Whether querying the security agent reveals enough of its model to enable replication or evasion

Key evidence includes security-data lineage, adversarial detection testing, privileged agent identity, kill switches, authority revocation, false-positive and false-negative analysis, privacy records, cohort testing, decision provenance and extraction controls.

Key mistake: granting a security agent broad privileges because its purpose is protective. Zero trust applies equally to defensive agents.

Layer 7 — Agent Ecosystem

The wider marketplace and operating ecosystem where agents interact with users, other agents, registries, discovery mechanisms, tools, suppliers and business applications.

ID	Threat	What the assessor must establish
MAE-L7-01	Compromised Agents	Whether malicious or taken-over agents can enter trusted workflows and act
MAE-L7-02	Agent Impersonation	Whether an attacker can convincingly pose as a legitimate agent to people or peer agents
MAE-L7-03	Agent Identity Attack	Whether credentials, identifiers, authorisation bindings or identity lifecycle can be compromised
MAE-L7-04	Agent Tool Misuse	Whether manipulated intent produces out-of-scope or harmful tool use
MAE-L7-05	Agent Goal Manipulation	Whether user, peer, memory or tool channels can alter the intended goal or constraints
MAE-L7-06	Marketplace Manipulation	Whether ratings, reviews, recommendations or reputation can be manipulated
MAE-L7-07	Integration Risks	Whether APIs, SDKs, protocols or connectors introduce exploitable weaknesses
MAE-L7-08	Horizontal/Vertical Solution Vulnerabilities	Whether industry- or function-specific design creates unique abuse paths
MAE-L7-09	Repudiation	Whether insufficient attribution lets an agent or operator deny an action
MAE-L7-10	Compromised Agent Registry	Whether agent identities, metadata or trusted listings can be injected or changed
MAE-L7-11	Malicious Agent Discovery	Whether discovery and ranking can promote malicious agents or hide legitimate ones
MAE-L7-12	Agent Pricing Model Manipulation	Whether pricing, metering, billing or incentives can be abused for loss or unfair advantage
MAE-L7-13	Inaccurate Agent Capability Description	Whether declared capabilities, limits and permissions differ from actual behaviour

Key evidence includes agent inventory, workload identity, signed messages, freshness controls, credential lifecycle, tool policy, goal and delegation records, marketplace integrity controls, registry change protection, integration testing, immutable action logs and capability acceptance tests.

Key mistake: trusting a declared agent identity or capability description without runtime verification.

Cross-layer threats

Cross-layer analysis models propagation and common-mode failure. It should describe the complete chain, not merely list several layer names.

ID	Threat	Required analysis
MAE-X-01	Supply Chain Attacks	Trace compromise of a model, dataset, library, service or supplier through every affected layer
MAE-X-02	Lateral Movement	Map how access in one layer enables movement into data, models, frameworks, infrastructure or agents
MAE-X-03	Privilege Escalation	Identify conversions between infrastructure, data, framework, model and agent-action authority
MAE-X-04	Data Leakage	Trace sensitive data through storage, retrieval, prompts, memory, tools, outputs, agents and telemetry
MAE-X-05	Goal Misalignment Cascades	Model how an altered goal propagates through data, orchestration, models, agents and ecosystem interactions

For each chain record:

• Entry point.
• Affected layers.
• Identities and privileges used.
• Trust transitions.
• Intermediate assets.
• Final impact.
• Preventive break points.
• Detective signals that correlate the full path.
• Containment, revocation and rollback.
• Multi-owner treatment plan.

Threats with similar names

The same mechanism can occur in different layers:

• Backdoor Attacks in Layer 1 concern model weights or fine-tunes; in Layer 3 they concern framework code or hidden functions.
• Data Poisoning in Layer 1 concerns training-phase model influence; in Layer 2 it includes operational, retrieval, feedback and memory data; in Layer 6 it targets security-agent data.
• Denial of Service appears at model, data, framework, infrastructure and evaluation layers.
• Lateral Movement in Layer 4 is infrastructure-originating; MAE-X-02 traces movement across architectural layers.
• Model Extraction in Layer 1 concerns the foundation model; Layer 6 concerns security agents whose extraction may enable defensive evasion.

Assess the layer-specific asset and consequence. Do not merge distinct canonical items into one generic risk.