The 20 checkpoint map · AI Threat Modeling Catalog

Each layer reduces risk before the call reaches business logic or the LLM; its output feeds the global risk engine and the policy engine; it is never the single decision point.

Design golden rule

Never: caller → LLM → action

The right path: caller → telecom security → audio security → identity check → risk engine → policy engine → deterministic workflow → controlled action.

01-05 · Entry

01entry

Call Entry

PSTN / SIP / WebRTC entry

Threats

F1Caller ID spoofing F10robocalls, call flooding, SIM farms, voice DDoS

Controls

carrier filteringsession border controllerrate limitingnumber reputationgeo and context checks

02session

Session Security

secure the session (TLS/SRTP/auth)

Threats

F6SIP injection, malformed packets F13toll fraud, unauthorized trunk

Controls

SIP authTLS/SRTPIP allowlistfraud monitoring

03audio

Audio Capture

RTP capture + call fingerprint

Threats

F3audio replay, pre-recorded voice F2synthetic audio stream

Controls

RTP validationtimestampsstream fingerprintingreplay cache

04quality

VAD & Quality Gate

detect speech / silence / noise

Threats

F11silence abuse, noise, music injection, jamming

Controls

VAD detection (Silero, WebRTC)SNR thresholdminimum speech quality

05normalization

Audio Normalization

normalize sample rate / volume / codec

Threats

F6codec manipulation, ultrasonic payloads F6adversarial perturbations F16inaudible payloads, synthetic sounds (indirect vector)

Controls

resamplingband-pass filteringvolume normalizationartifact detection

06-09 · Audio auth

06deepfake

Deepfake Detection

detect TTS / conversion / synthesis

Threats

F2voice cloning, TTS impersonation, conversion, synthetic emergency calls

Controls

anti-spoofing ensemblethresholdsmodel confidencehuman escalation

07liveness

Liveness Challenge

dynamic questions / repetition

Threats

F3pre-recorded answers, replay, static cloned messages

Controls

random challenge-responsedynamic phrasetiming analysis

08speaker

Speaker Verification

voice comparison = weak signal

Threats

F4cloned voiceprint, false match, stolen sample

Controls

never used aloneMFAcontext verification

09transcription

STT Transcription

speech-to-text + confidence

Threats

F7mis-transcription, multilingual confusion, adversarial spoken phrases F16booby-trapped transcription, adversarial phrases (indirect vector)

Controls

confidence thresholdlanguage detectionhuman fallback

10-13 · Prompt & intent

10injection

Prompt Injection Filter

detect adversarial spoken instructions

Threats

F15ignore previous instructions F20tool hijacking F9system prompt extraction F17jailbreak

Controls

injection classifierblocked patternsinstruction hierarchy

11intent

Intent Detection

classify the request, scenario whitelist

Threats

F21fake urgency, social engineering F13fraudulent request, policy bypass

Controls

intent whitelistsensitive-intent escalationscenario routing

12identity

Identity & Context Check

CRM, OTP, callback, known context

Threats

F5impersonation, wrong match, account takeover

Controls

OTPcallbackknown-number checkCRM validation

13risk

Risk Scoring

signal fusion toward the decision

Threats

F14false negative, false positive, fragmented signals

Controls

weighted scoringrules + MLthreshold routing

14-18 · Policy & tools

14interpretation

LLM Interpretation

the LLM interprets, does NOT act directly

Threats

F18hallucination F9data leakage, system prompt leakage F20excessive agency

Controls

restricted contextno direct actionsredactiongrounding

15policy

Policy Engine

authorize / deny each tool call (RBAC/ABAC)

Threats

F13unauthorized CRM update F13payment fraud F9data exfiltration

Controls

RBACtool allowlistapproval gatesscoped tokens

16workflow

Workflow Execution

deterministic workflows (Temporal, API gateway)

Threats

F20workflow abuse, API injection, privilege escalation

Controls

typed schemasAPI gatewayidempotencyleast privilege

17escalation

Human Escalation

transfer to operators

Threats

F21fake urgency, operator social engineering, coercion

Controls

risk bannerverification checklistrecording review

18audit

Audit Logging

evidence, SIEM, forensics

Threats

F8tampered logs, missing evidence F9privacy breach

Controls

immutable logsencryptionretention policyaccess controls

19-20 · Chain & ops

19monitoring

Monitoring

slow attacks, drift, campaigns (OTel, Grafana)

Threats

F12slow probing, model drift, attack campaign, degradation F18model drift

Controls

OpenTelemetryGrafanaalertsanomaly detection

20chain

Model & Supply Chain

models, dependencies, images (SBOM, cosign, trivy)

Threats

F19poisoned model, poisoned RAG F19vulnerable dependency, malicious package, outdated detector

Controls

SBOMsigned modelsCVE scanningred-team benchmarks

Decision rules

Lowcontinue and log

Mediumverification questions, reduced tools

Highblock, transfer to a human, alert the SOC, preserve the logs