Apex ThreatSecurity-framework consensusv1.22.1
In plain English
This page covers the high-risk pattern where small adapters, routes, memory, evaluators, and descendants can reinforce each other across time. It is a risk model, not a build guide.
- Why this matters: AI risk can come from the whole arrangement, not one obvious model.
- What to look for: data, memory, routes, adapters, tools, evaluators, updates, and rollback paths.
- Technical version below: the expert terminology remains available and is linked through the glossary.
Apex Threat Controls Matrix
Evidence levelSecurity-framework consensusTechnical label: Security-framework consensus
Controls for a self-replicating multi-LoRA ecology must address generation, composition, selection, persistence, release, rollbackReturning a system to an earlier known state. Open glossary definition, and human governance. A single model card cannot cover the surface.
This matrix is defensive. It does not certify safety, and it does not provide attack instructions.
Control groups
EvidenceSecurity-framework consensus
Provenance and inventory
- AI/ML-BOM for models, datasets, adapters, prompts, policies, tools, evaluators.
- Cryptographic hash for model files and adapters.
- Signature verification for third-party model assets.
- Supplier review before adding external models or adapters.
- License inventory.
EvidenceStrong architectural inference
Reproduction boundary
- Candidate-generation quotas.
- Approval required before new adapter creation.
- Disable autonomous fine-tune/promote loops in production.
- No unreviewed model merge.
- Separate candidate creation from candidate approval.
EvidenceStrong architectural inference
Composition testing
- Composition manifest for every evaluated stack.
- Capture base model, adapter list, load order, prompt version, memory snapshot, tool permissions, evaluator version, router policy, and deployment alias.
- Test compositions, not just components.
- Include adversarial tests for base + adapter + memory + tool combinations.
EvidenceStrong architectural inference
Evaluator independence
- Use at least two evaluator classes.
- Do not let the same model family be the only judge of its descendants.
- Rotate hidden tests.
- Record judge disagreement.
- Escalate disagreement to human review.
EvidenceSecurity-framework consensus
Memory and retrieval governance
- Memory write scopes.
- Memory diff review.
- Source labels for RAG entries.
- Synthetic-origin labels.
- Quarantine uncertain content.
- Remove or isolate poisoned memory.
- Do not treat retrieved content as trusted instruction.
EvidenceSecurity-framework consensus
Tool and action boundary
- Conduct firewall before file writes, API calls, email sends, publication, credential access, money movement, code execution, and database updates.
- Least-privilege identities for every tool.
- Human approval for irreversible actions.
- Tool allowlists.
- Output validation before execution.
EvidenceStrong architectural inference
Rollback symmetry
- Rollback packet required before release.
- Rollback packet must include model weights, adapters, prompt templates, memory snapshots, vector index versions, router policies, evaluator versions, tool permissions, deployment alias, and data dependencies.
- Practice rollback rehearsals.
- Restore environment state, not just model files.
EvidenceSecurity-framework consensus
Model retirement
- Retire models when they drift, violate boundaries, lose provenance, become redundant, overfit, learn shortcuts, fail new evals, or cannot be rolled back safely.
- Archive retired models for audit where allowed.
- Mark retired assets so they cannot be used accidentally.
- Document residual risk and dependent systems.
Controls matrix with external support
| Risk pressure | Controls | External support |
|---|---|---|
| Automated candidate generation | Candidate quotas; generation ledger; freeze generation. | NIST AI Risk Management Framework · NIST 2023 NIST AI 600-1 Generative AI Profile · NIST 2024 |
| Dynamic adapter composition | Composition manifest; load-order policy; stack-specific evals. | OWASP LLM03: Supply Chain · OWASP Gen AI Security Project 2025 CycloneDX ML-BOM · CycloneDX 2024 |
| Evaluator coupling | Independent evaluator ownership; judge disagreement monitoring; hidden-test rotation. | Mithril Security PoisonGPT demonstration · Mithril Security 2023 NIST AI Risk Management Framework · NIST 2023 |
| Synthetic-data feedback | Data quarantine; source labels; synthetic-origin audits. | Nature model-collapse paper · Nature 2024 Synthetic data model-collapse analysis · arXiv 2024 |
| Persistent memory | Memory write scopes; review gates; memory diff review; restore snapshot. | OWASP LLM08: Vector and Embedding Weaknesses · OWASP Gen AI Security Project 2025 |
| Adaptive routing | Router change approval; route drift monitoring; pin router; restore previous policy. | OWASP LLM06: Excessive Agency · OWASP Gen AI Security Project 2025 |
| Third-party adapters | Signed provenance; supplier review; hash and dependency diffing; rebuild from trusted base. | OWASP LLM03: Supply Chain · OWASP Gen AI Security Project 2025 Mithril Security PoisonGPT demonstration · Mithril Security 2023 HiddenLayer safetensors conversion research · HiddenLayer 2024 |
| Incomplete rollback | Rollback packet before release; rollback rehearsal; ecological rollback. | NIST AI Risk Management Framework · NIST 2023 CycloneDX ML-BOM · CycloneDX 2024 |
| No-op erosion | No-op as valid release outcome; promotion pressure review; halt release train; re-baseline evidence. | NIST AI Risk Management Framework · NIST 2023 |
The matrix is not certification
Evidence levelStrong architectural inferenceTechnical label: Strong architectural inference
The matrix is a review pattern. It does not prove safety. Its purpose is to make missing controls visible before the ecology is treated as a routine model updateA change to model weights, adapters, prompts, routing, evaluators, or configuration. Open glossary definition.