★ Trumps: Structural Hazards

Trumps, the structural hazards suit of Elevation of Autonomy: the suit's 7 cards fanned over a neon grid.

Taxonomies / AI and Agentic Systems Threat Taxonomy / Trumps

Architectural, mathematical and product-design properties that cannot be mitigated inside the model. Trumps beat any other card, and they are played against the design as a whole rather than against a component.

This suit has 7 cards, EOA·T7 to EOA·T1. Trumps beat any non-trump card in the game, and lower Roman numerals are the more specific hazards. In a review, play them against the design as a whole rather than against one component. Each entry gives the card’s threat and mitigation prompts, the mitigation principle a sound design follows, design measures, and mappings.

Trumps at a glance: each card's ID, title, quote, threat and mitigation principle. The full text is below and in the downloads.

The entries

EOA·T7 Adversarial Subspace

“The attack surface is a space, not a list.”

Threat. Any input to an AI system is translated into a lower-dimensional numerical representation. That flattening creates a subspace of inputs that all produce approximately the same model behaviour. The subspace is mathematically enormous, provably unsearchable, and unpatchable. It is a property of the architecture, not a bug. Prompt-library-based red teaming and pattern-matching guardrails test a vanishing fraction of this surface. This card represents the deepest reason structural mitigations beat statistical ones.

Mitigation prompts (from the card)

  • Are we relying on a library of known bad prompts as a defence? If yes, we are defending a vanishing fraction of the space.
  • Is our security guarantee architectural or statistical? If statistical, what happens when the next perturbation lands outside our library tomorrow?
  • What determines the outcome of every consequential decision: the model’s classification, or a deterministic check downstream?

Mitigation principle. Put every security guarantee in a deterministic control outside the model; treat guardrails and blocklists as noise reduction, not as the control.

Design measures

  • For each consequential action, name the deterministic control that decides it (authorisation, allow-list, confirmation, budget) and remove any decision that rests on the model refusing.
  • Keep guardrails and prompt filters, but record them as defence in depth with no security claim attached.
  • Measure red teaming by structural coverage (which sinks and actions are reachable) rather than by the number of prompts blocked.
  • Design for the assumption that some input will always get the model to do the wrong thing, and limit what that can achieve.

Mappings

  • STRIDE: T, E
  • Card references: Cox & Bunzel (2025), arXiv:2511.05102. Tramèr et al. (2017). Goodfellow, Shlens, Szegedy (2015). EchoGram (HiddenLayer, 2025) as a contemporary surface example.
  • MITRE ATLAS: AML.T0043 Craft Adversarial Data, AML.T0054 LLM Jailbreak, AML.T0015 Evade AI Model
  • CAPEC: none
  • CWE: CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Seen in the wild. EchoGram: HiddenLayer showed that short token sequences found by search can flip the verdicts of commercial and open-source LLM guardrails, letting malicious prompts through or making harmless ones look malicious. November 2025. Source: EchoGram: The Hidden Vulnerability Undermining AI Guardrails (HiddenLayer).

Touches: EOA·T4 Decision Boundary Transfer, EOA·T6 Geometric Attack, EOA·SA Prompt Injection

EOA·T6 Geometric Attack

“The boundary is the attack surface, not the inputs that cross it.”

Threat. An attacker targets the geometry of the model’s decision surface directly: by probing a black-box classifier (GeoDA, SurFree), by exploiting non-Euclidean embeddings (AGSM), or by rotating an angular-margin embedding on a hypersphere (ArcFace-style attacks). The attack succeeds without access to weights, training data, or gradients.

Mitigation prompts (from the card)

  • Does any consequential decision depend on a single model’s classification?
  • Can an attacker probe it with queries?
  • Is the downstream enforcement deterministic or does it inherit the model’s verdict?
  • Is adversarial testing matched to the geometry the model uses?

Mitigation principle. No consequential decision rests on one model’s classification, and the classifier cannot be probed freely.

Design measures

  • Pair any model-gated decision (biometric match, fraud score, content verdict) with an independent deterministic factor.
  • Rate-limit and monitor queries to classifiers, and return coarse verdicts rather than scores or confidence values.
  • Detect probing patterns: many near-identical queries, systematic perturbations, or query sequences walking towards a boundary.
  • Test robustness with attacks that match the model’s geometry (angular attacks for angular-margin embeddings, hyperbolic attacks for hyperbolic ones).

Mappings

  • STRIDE: S, E
  • Card references: Tramèr et al. 2017 foundation. GeoDA, SurFree, AGSM, angular-margin attack literature. CAPEC-115 when authentication is gated by the model.
  • MITRE ATLAS: AML.T0043.001 Craft Adversarial Data: Black-Box Optimization, AML.T0015 Evade AI Model, AML.T0040 AI Model Inference API Access
  • CAPEC: none
  • CWE: CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Touches: EOA·T7 Adversarial Subspace, EOA·T4 Decision Boundary Transfer, EOA·HK Identity and Privilege Abuse

EOA·T5 Context Rot

“Your safety instructions were at the top. They have decayed in attention weight.”

Threat. As a session grows, attention to system prompts, role definitions, and authorisation context decays. Guardrails that held on turn 1 fail on turn 50 without any adversarial input.

Mitigation prompts (from the card)

  • What is the longest realistic session?
  • At that length, which safety-relevant tokens are in the lost-in-the-middle zone?
  • Are critical instructions periodically re-injected?

Mitigation principle. Keep safety-relevant rules out of the model’s attention budget: enforce them in code, and keep sessions short enough that instructions still hold.

Design measures

  • Set a context budget well below the advertised window, and summarise or start a fresh session when it is reached.
  • Re-inject critical instructions near the end of the context, and start a fresh session for high-stakes operations.
  • Enforce confirmation, authorisation and scope in the orchestrator, which does not forget, rather than as prompt instructions.
  • Test behaviour at the longest realistic session length, not only on the first turn, and alert on unusual context growth.

Mappings

  • STRIDE: E
  • Card references: Chroma 2025 research. Cross-cutting amplifier for LLM01, LLM06, ASI01, ASI02, ASI06, ASI08.
  • MITRE ATLAS: none
  • CAPEC: none
  • CWE: none

Research. Context rot: Chroma Research tested 18 language models and found performance growing less reliable as input length grew, even on simple tasks. Hong, Troynikov and Huber, July 2025. Source: Context Rot: How Increasing Input Tokens Impacts LLM Performance (Chroma).

Touches: EOA·SA Prompt Injection, EOA·T3 Excessive Autonomy by Design, EOA·HA Excessive Agency

EOA·T4 Decision Boundary Transfer

“The boundary your model defends is the boundary every other model defends.”

Threat. Models trained on the same domain share similar decision boundaries regardless of algorithm or dataset. Adversarial examples transfer freely; model robustness is a property of the domain, not the model.

Mitigation prompts (from the card)

  • What security guarantees are we relying on the model itself to provide?
  • Can any of them be moved to a deterministic layer?

Mitigation principle. Assume the decision boundary is public: closed weights and private training data do not make a classifier a security control.

Design measures

  • List every security guarantee that relies on a model’s robustness, and move each one to a deterministic layer outside the model.
  • Do not count closed weights, private training data or an undisclosed model choice as protection against evasion.
  • Where a classifier must stay in the path, combine it with signals an attacker cannot reproduce from public data (provenance, identity, history).
  • Test with transfer attacks built on surrogate models trained only on public data.

Mappings

  • STRIDE: E
  • Card references: Tramèr et al. 2017. Cox applications.
  • MITRE ATLAS: AML.T0005 Replicate AI Model Behavior, AML.T0043.002 Craft Adversarial Data: Black-Box Transfer, AML.T0015 Evade AI Model
  • CAPEC: none
  • CWE: CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Research. Tramèr, Papernot, Goodfellow, Boneh and McDaniel showed that models trained on the same task share much of their decision space, so adversarial examples crafted on one model transfer to others. “The Space of Transferable Adversarial Examples”, 2017. Source: The Space of Transferable Adversarial Examples (arXiv:1704.03453).

Touches: EOA·T7 Adversarial Subspace, EOA·T6 Geometric Attack, EOA·D10 System Prompt Leakage

EOA·T3 Excessive Autonomy by Design

“You gave the agent autonomy because the demo was cool.”

Threat. Product decisions grant the agent autonomy that the risk model does not justify. Confirmation steps are removed because they are “friction”. The autonomy becomes the blast radius.

Mitigation prompts (from the card)

  • Which confirmations were removed for UX reasons?
  • What is the worst thing the agent can do with no human in the loop?
  • Does the product justification survive a post-incident review?

Mitigation principle. Decide autonomy in the risk model, not in the demo: confirmation is the correct experience for irreversible actions.

Design measures

  • Classify every agent action by reversibility and impact, and require confirmation for irreversible or high-impact ones whatever the product default.
  • Record each decision to remove a confirmation with its owner and rationale, and review it like an accepted risk.
  • Design confirmations to be quick and specific (what, where, how much) so users do not learn to click through them.
  • Roll out autonomy in steps: suggest, then act with confirmation, then act alone only for actions with a proven record.

Mappings

  • STRIDE: E
  • Card references: LLM06 taken seriously at the product level.
  • MITRE ATLAS: AML.T0053 AI Agent Tool Invocation
  • CAPEC: none
  • CWE: none

Touches: EOA·HA Excessive Agency, EOA·SK Tool Misuse, EOA·T5 Context Rot

EOA·T2 Invisible Dependency

“The thing you depend on is not in your SBOM.”

Threat. The agent’s behaviour depends on model versions, prompt templates, tool descriptions, or memory state that are not in any tracked inventory.

Mitigation prompts (from the card)

  • What determines this agent’s behaviour?
  • Is all of it pinned, versioned, and inventoried?
  • What happens when an external dependency changes silently?

Mitigation principle. Everything that determines the agent’s behaviour is inventoried, pinned and versioned like code.

Design measures

  • Extend the SBOM to an AI-BOM: model and version, system prompt and templates, tool descriptions and schemas, MCP servers, datasets and memory stores.
  • Pin model versions (not floating aliases) and prompt and tool versions by hash, and record them in every deployment.
  • Detect upstream changes (model updates, edited tool descriptions, template changes) and re-run evaluations before accepting them.
  • Version memory and configuration state so behaviour can be reproduced for an incident.

Mappings

  • STRIDE: T
  • Card references: LLM03. ASI04.
  • MITRE ATLAS: AML.T0109 AI Supply Chain Rug Pull, AML.T0010 Supply Chain Compromise
  • CAPEC: none
  • CWE: CWE-1357 Reliance on Insufficiently Trustworthy Component

Touches: EOA·SQ Supply Chain Compromise, EOA·S9 Tool Description Injection, EOA·H10 Rogue Agent

EOA·T1 Wrong Abstraction

“You are treating the model as a system of record.”

Threat. Downstream processes, users, or agents treat model output as authoritative. The model is neither a database nor a source of truth, and any consumer that treats it as one imports every failure mode as a fact.

Mitigation prompts (from the card)

  • Where is model output treated as authoritative?
  • What provenance does the UI surface?
  • Is there a verification step, or has the caveat been lost?

Mitigation principle. The model is never the system of record: authoritative facts come from systems of record, and model output carries its provenance wherever it goes.

Design measures

  • Answer factual and policy questions from the system of record, with the model summarising retrieved content rather than recalling it.
  • Show provenance in the UI (source links, generated labels) and keep the label when output is copied, stored or forwarded.
  • Add a verification step before model output is used as input to a decision, record or another agent.
  • Make the organisation accountable for what its assistant says, and route disputes to a human who can correct the record.

Mappings

  • STRIDE: T, R
  • Card references: ASI09. LLM09 at the architectural level.
  • MITRE ATLAS: none
  • CAPEC: none
  • CWE: none

Seen in the wild. Moffatt v. Air Canada: a British Columbia tribunal held the airline liable for its website chatbot’s incorrect description of its bereavement fare policy, rejecting the argument that the chatbot was responsible for its own statements. February 2024. Source: Moffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal).

Touches: EOA·DQ Hallucinated Facts, EOA·HJ Cascading Failure, EOA·CA Transfer

Mappings at a glance

Mappings for Trumps: STRIDE, the card's references, MITRE ATLAS, CAPEC and CWE for each entry. The full text is above and in the downloads.

STRIDE across this suit: Spoofing 1, Tampering 3, Repudiation 1, Elevation of privilege 5. 5 of 7 entries map to MITRE ATLAS, 0 to CAPEC and 4 to CWE.

Where this suit touches the others

Previous: ♣ Clubs: Privacy · Overview

AI and Agentic Systems Threat Taxonomy v1.0, the reference for the Elevation of Autonomy card deck. © 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence.