In plain English
This page covers the high-risk pattern where small adapters, routes, memory, evaluators, and descendants can reinforce each other across time. It is a risk model, not a build guide.
- Why this matters: AI risk can come from the whole arrangement, not one obvious model.
- What to look for: data, memory, routes, adapters, tools, evaluators, updates, and rollback paths.
- Technical version below: the expert terminology remains available and is linked through the glossary.
Why the Apex Threat Is the Transition Graph
The apex threat is not a particular adapterA small add-on that changes or specializes model behavior. Open glossary definition. It is the graph of permitted transitions among adapters, bases, routers, evaluators, memory, data, permissions, and releases.
A static artifact can be hashed. A transition graphThe map of how an AI system is allowed to change over time. Open glossary definition can keep producing new artifacts. A static artifact can be rolled back. A transition graph can reintroduce the behavior through a different path. A static artifact can be retired. A transition graph can preserve the functional pattern in data, memory, routing, and descendants.
This page does not claim that this entire apex pattern has already appeared as a named malware family, CVE, or single confirmed incident. It maps a plausible compound failure mode from documented component risks.
Why a transition graph is harder to secure than a file
A file can be hashed. A graph can keep producing new files. A file can be deleted. A graph can preserve behavior in memory, synthetic data, routing policyRules that decide which model, adapter, tool, or path handles a request. Open glossary definition, or evaluator preference. A file can be rolled back. A graph can reintroduce the same behavior through another path.
Transition examples
- Base model plus adapter becomes merged specialist.
- Specialist output becomes synthetic training data.
- Synthetic data trains a descendant adapter.
- Router learns to prefer that descendant for a task family.
- EvaluatorA system that judges whether an AI output or candidate is acceptable. Open glossary definition rewards the same shortcut because it appears successful.
- Release alias points users to the new stack.
- Original adapter is deleted.
- Behavior remains.
External anchors
LLM03:2025 Supply Chain
Describes supply-chain risks for LLM applications, including third-party models, datasets, weak provenance, LoRA, PEFT, vulnerable adapters, model repositories, signing, and SBOM controls.
- Why it is credible
- OWASP LLM03 is a framework-level source specifically naming AI supply-chain components beyond ordinary software dependencies.
- Apex Threat behavior supported
- Adapters, model assets, datasets, repositories, provenance, and supplier controls as risk surfaces.
- Limit: what this source does not prove
- Framework guidance, not proof that the full Apex Threat has occurred as a single incident.
CycloneDX ML-BOM
Provides a way to document models, datasets, dependencies, training methods, provenance, and AI component inventory.
- Why it is credible
- CycloneDX is an established software bill-of-materials ecosystem extended here to machine-learning artifacts.
- Apex Threat behavior supported
- Machine-readable inventories for models, datasets, adapters, dependencies, and provenance.
- Limit: what this source does not prove
- Inventory improves traceability but does not guarantee safety by itself.
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Frames AI risk management as an ongoing govern, map, measure, and manage lifecycle practice across design, development, deployment, operation, and retirement.
- Why it is credible
- NIST is a U.S. standards body and the AI RMF is a public risk-management framework used by organizations for governance planning.
- Apex Threat behavior supported
- Lifecycle governance, residual-risk review, rollback discipline, and release control.
- Limit: what this source does not prove
- Framework guidance. It does not prove that the full Apex Threat has occurred as one incident.
Why lineage is not enough
Lineage tells who descended from whom. It does not prove that reviewers understand what was inherited. A lineage graphA visual or machine-readable map of derivation history. Open glossary definition can be complete while behavioral inheritance remains opaque.
The governing test
Ask: what transitions can happen without fresh evidence? Any answer that includes fine-tune, merge, distill, generate synthetic data, change router policy, consolidate memory, update evaluator, expand permissions, or promote alias is part of the safety boundary.