Banana Navy
Back to the map FR
Lab · Threat modeling AI · Diagram view

20 checkpoints, as a diagram

The caller-to-action path as 20 numbered security layers, the threats of each layer placed on the links between layers, cross-linked with the catalogue of threats.

Checkpoints20 layers
Threat families5
Direct caller-to-LLM path0
FrameworkMITRE · OWASP

Every check is a numbered layer. Each layer carries its threats on the link that leaves it; every node and every threat links to the corresponding file in the catalogue.

01-05Entry

01

Call Entry

Entry

PSTN / SIP / WebRTC entry

Systems & models

PSTNSIPWebRTCSession Border Controllercarrier filtering

Threats

F1caller ID spoofingF10robocalls, call flooding, SIM farms, voice DDoS

Controls to apply

carrier filteringsession border controllerrate limitingnumber reputationgeo and context checks

Why / production rule

The first link: filter traffic at the edge to reject the mass of unsolicited calls before any audio processing.

02

Session Security

Entry

secure the session (TLS/SRTP/auth)

Systems & models

TLSSRTPSIP authIP allowlist

Threats

F6SIP injection, malformed packetsF13toll fraud, unauthorized trunk

Controls to apply

SIP authTLS/SRTPIP allowlistfraud monitoring

Why / production rule

Secure the channel end to end: no one should be able to inject into or hijack a live session.

03

Audio Capture

Entry

RTP capture + call fingerprint

Systems & models

RTPraw audio capturemetadatacall fingerprint

Threats

F3audio replay, pre-recorded voiceF2synthetic audio stream

Controls to apply

RTP validationtimestampsstream fingerprintingreplay cache

Why / production rule

Clean, timestamped capture: stream integrity evidence starts with the first received packet.

04

VAD & Quality Gate

Entry

detect speech / silence / noise

Systems & models

Silero VADWebRTC VADSNRspeech gate

Threats

F11silence abuse, noise, music injection, jamming

Controls to apply

VAD detection (Silero, WebRTC)SNR thresholdminimum speech quality

Why / production rule

Reject early what is not useful speech: silence, noise and jamming never reach the pipeline.

06-09Audio authentication

06

Deepfake Detection

Audio authentication

detect TTS / conversion / synthesis

Systems & models

AASISTRawNet2WavLManti-spoofing ensemble

Threats

F2voice cloning, TTS impersonation, conversion, synthetic emergency calls

Controls to apply

anti-spoofing ensemblethresholdsmodel confidencehuman escalation

Why / production rule

Every second of synthetic audio must be caught here: one of the strongest shields against voice fraud.

07

Liveness Challenge

Audio authentication

dynamic questions / repetition

Systems & models

challenge-response protocoldynamic phrasetemporal analysis

Threats

F3pre-recorded responses, replay, static cloned messages

Controls to apply

random challenge-responsedynamic phrasetiming analysis

Why / production rule

Prove the voice is live and present, not a reused recording.

08

Speaker Verification

Audio authentication

voice comparison = weak signal

Systems & models

voiceprint (x-vector/ECAPA)SI/SPMFA

Threats

F4cloned voiceprint, false match, stolen sample

Controls to apply

never used aloneMFAcontext verification

Why / production rule

Voice comparison is a weak signal: never use it alone, combine it with other evidence.

10-13Prompt & intent

11

Intent Detection

Prompt & intent

classify the request, scenario whitelist

Systems & models

intent classifierscenario whitelistslot filling

Threats

F21false urgency, social engineeringF13fraudulent request, policy bypass

Controls to apply

intent whitelistsensitive-intent escalationscenario routing

Why / production rule

The request must match a known scenario: any off-whitelist intent is refused or escalated.

12

Identity & Context Check

Prompt & intent

CRM, OTP, callback, known context

Systems & models

CRMOTPcallbackknown-number registry

Threats

F5impersonation, wrong match, account takeover

Controls to apply

OTPcallbackknown-number checkCRM validation

Why / production rule

Who is calling? Context, OTP and callback confirm identity before any sensitive action.

13

Risk Scoring

Prompt & intent

signal fusion toward the decision

Systems & models

risk engineweighted scoringrules + MLthresholds

Threats

F14false negative, false positive, fragmented signals

Controls to apply

weighted scoringrules + MLthreshold routing

Why / production rule

Fuse every signal into a transparent decision with tunable thresholds, never an oracle.

14-18Policy & tooling

14

LLM Interpretation

Policy & tooling

the LLM interprets, does NOT act directly

Systems & models

LLMgrounding (anchoring)redactioncontext window control

Threats

F18hallucinationF9data leakage, system prompt leakageF20excessive agency

Controls to apply

restricted contextno direct actionsredactiongrounding

Why / production rule

The LLM proposes, the code disposes: interpret, ground and redact, never act directly.

15

Policy Engine

Policy & tooling

authorize / deny each tool call (RBAC/ABAC)

Systems & models

RBACABACtool allowlistpolicy engine

Threats

F13unauthorized CRM updateF13payment fraudF9data exfiltration

Controls to apply

RBACtool allowlistapproval gatesscoped tokens

Why / production rule

Every tool call passes an explicit rule (RBAC/ABAC): allow-by-default is a vulnerability.

16

Workflow Execution

Policy & tooling

deterministic workflows (Temporal, API gateway)

Systems & models

TemporalAPI gatewaytyped schemasidempotency

Threats

F20workflow abuse, API injection, privilege escalation

Controls to apply

typed schemasAPI gatewayidempotencyleast privilege

Why / production rule

Actions run through a deterministic, typed, replayable and idempotent workflow.

17

Human Escalation

Policy & tooling

transfer to operators

Systems & models

operator consolerisk bannercall review

Threats

F21false urgency, operator social engineering, coercion

Controls to apply

risk bannerverification checklistrecording review

Why / production rule

When the score rises, a human takes over with a risk banner, never blindly.

18

Audit Logging

Policy & tooling

evidence, SIEM, forensics

Systems & models

immutable logsSIEMretention policykey management

Threats

F8tampered logs, missing evidenceF9privacy violation

Controls to apply

immutable logsencryptionretention policyaccess controls

Why / production rule

Everything is logged, immutable and encrypted: attack evidence must survive log rewriting.

19-20Chain & ops

19

Monitoring

Chain & ops

slow attacks, drift, campaigns (OTel, Grafana)

Systems & models

OpenTelemetryGrafanaalertinganomaly detection

Threats

F12slow probing, model drift, campaign, degradationF18model drift

Controls to apply

OpenTelemetryGrafanaalertsanomaly detection

Why / production rule

Slow attacks and drift escape spot checks: continuous monitoring catches them.

Schematic view (SVG)
Diagram of the 20 checkpoints Caller-to-action path shown as 20 numbered security layers; the threats of each layer sit on the link that leaves it. 01ENTRYCall Entry caller ID spoofingF1Caller ID robocalls, call flooding, SIM farms, voice DDoSF10Call flooding 02ENTRYSession Security SIP injection, malformed packetsF6SIP injection toll fraud, unauthorized trunkF13Toll fraud 03ENTRYAudio Capture audio replay, pre-recorded voiceF3Audio replay synthetic audio streamF2Synth. audio 04ENTRYVAD & Quality Gate silence abuse, noise, music injection, jammingF11Channel abuse 05ENTRYAudio Normalization codec manipulation, ultrasonic payloadsF6Codec hijack adversarial perturbationsF6Adversarial inaudible payloads, synthetic sounds (indirect vector)F16Hidden audio 06AUDIO AUTHENTICATIONDeepfake Detection voice cloning, TTS impersonation, conversion, synthetic emergency callsF2Voice cloning 07AUDIO AUTHENTICATIONLiveness Challenge pre-recorded responses, replay, static cloned messagesF3Static replay 08AUDIO AUTHENTICATIONSpeaker Verification cloned voiceprint, false match, stolen sampleF4Cloned voice 09AUDIO AUTHENTICATIONSTT Transcription wrong transcription, multilingual confusion, adversarial spoken phrasesF7Wrong STT booby-trapped transcription, adversarial phrases (indirect vector)F16STT trap 10PROMPT & INTENTPrompt Injection Filter “ignore previous instructions”F15Ignore prompt tool hijackingF20Tool hijack system prompt extractionF9Prompt theft jailbreakF17Jailbreak 11PROMPT & INTENTIntent Detection false urgency, social engineeringF21False urgency fraudulent request, policy bypassF13Policy bypass 12PROMPT & INTENTIdentity & Context Check impersonation, wrong match, account takeoverF5Impersonation 13PROMPT & INTENTRisk Scoring false negative, false positive, fragmented signalsF14False +/- 14POLICY & TOOLINGLLM Interpretation hallucinationF18Hallucination data leakage, system prompt leakageF9Data leakage excessive agencyF20Excess agency 15POLICY & TOOLINGPolicy Engine unauthorized CRM updateF13CRM tampering payment fraudF13Payment fraud data exfiltrationF9Exfiltration 16POLICY & TOOLINGWorkflow Execution workflow abuse, API injection, privilege escalationF20Workflow abuse 17POLICY & TOOLINGHuman Escalation false urgency, operator social engineering, coercionF21Coercion 18POLICY & TOOLINGAudit Logging tampered logs, missing evidenceF8Tampered logs privacy violationF9Privacy 19CHAIN & OPSMonitoring slow probing, model drift, campaign, degradationF12Slow probing model driftF18Model drift 20CHAIN & OPSModel & Supply Chain poisoned model, poisoned RAGF19Poisoning vulnerable dependency, malicious package, outdated detectorF19SBOM & CVE
Numbered layers in reading order 01→20, from call entry to controlled action.Threat pills sit on the link that leaves each layer; click to open the threat file.Colours map to the 5 threat families of the catalogue.

See the detailed checklist ↗

Threat modeling AI catalogue

Threat modeling AI catalogue

MITRE ATLAS 2026.07 · OWASP GenAI · risk-voicebot