Integrity Threats Integrity threats focus on the unauthorized modification or injection of data or
commands that impact the correctness and trustworthiness of system behavior. Identified
threat vectors include: Data Injection or Replay Attacks: Adversaries may inject manipulated
inputs or replay valid requests to skew model behavior or retrain malicious outputs. Spoofing
and API Impersonation: Attackers may impersonate trusted services (e.g., plugins, third-party
data sources) to deceive the system or provide falsified inputs. Adversarial Input Injection:
Crafting inputs specifically designed to alter model output in unexpected ways (e.g., adversarial
examples or prompt injections). The affected SAIF components include Data, particularly in
preprocessing pipelines and retriever outputs; the Model, through its input layers and prompt
processing chains; the Application, via plugin interfaces and orchestration logic; and the
Infrastructure, which encompasses API gateways and inter-service communications that support
the overall system. Availability Threats Availability risks threaten to degrade, disrupt, or deny
access to AI services or components. Threat vectors in this category include: Resource
Exhaustion Attacks: Overloading inference endpoints or vector search APIs with high-volume
queries, causing denial of service. External Dependency Failures: Downtime in cloud-based
components (e.g., external vector DBs or model APIs) causing cascading failures in the pipeline.
Latency Attacks: Techniques like Slowloris (slow HTTP requests) that target the responsiveness
of model-serving infrastructure and reduce system availability. • • • • • • • • OWASP AI Testing
Guide Version 1.0 Page 31 of 250 The affected SAIF components include the Infrastructure,
specifically hosting layers and network gateways that support system availability; the Model,
particularly its inference endpoints which can be targeted by resource-based attacks; and the
Application, through orchestration layers and dependency handling logic that may become
points of failure under stress or external disruption. The following is the mapping of CIA Threats
to the SAIF components of the AI architecture in scope. Note: Importantly, the CIA threat
classification has already been applied effectively to AIfocused security efforts, including the ai-
security-matrix [5] of OWASP AI Exchange, which maps AI risks to CIA categories in its AI
Security Matrix. This precedent reinforces the practicality and transferability of the CIA as a
starting point for identifying and communicating threats in emerging AI systems. Mapping CIA
Threats to AI Architecture Layers & Components The following tables present a mapping of
Confidentiality, Integrity, and Availability (CIA) threats to the components of the AI system
architecture, organized by SAIF (Secure AI Framework) layers (Note). Each table corresponds to
one of the four defined layers, Application, Model, Infrastructure, and Data and lists the
individual components along with the specific threats identified during the threat modeling
exercise. This layered view enables a structured assessment of security risks across the AI
lifecycle and supports prioritization of mitigation efforts aligned with architectural boundaries.
Application Layer - CIA Threats Mapping SAIF Component Mapped CIA Threats #1 - User
Confidentiality: User input leakage; Integrity: Spoofed user identity; Availability: User lockout or
denial of input submission #2 - User Input Confidentiality: Sensitive query; Integrity: Input
injection or manipulation; Availability: Blocking or rate-limiting of user Input #3 - User Output
Confidentiality: Output leakage; Integrity: Output manipulation; Availability: Blocking or rate-
limiting of user O
pplication Layer - CIA Threats Mapping Confidentiality: Unauthorized access to plugin data or
logic; Integrity: Spoofed or manipulated plugin behavior; Availability: Plugin failure or
unavailability #6 - External Sources Confidentiality: Intercepted external data; Integrity:
Poisoned or falsified third-party content; Availability: External service downtime or throttling
Table 1.2 SAIF Application Layer - CIA Threats Mapping Model Layer - CIA Threats Mapping SAIF
Component Mapped CIA Threats #7 - Input Handling Confidentiality: Exposure of input
preprocessing logic; Integrity: Input validation bypass; Availability: Preprocessing bottlenecks or
DoS #8 - Output Handling Confidentiality: Leakage of model responses; Integrity: Output
manipulation or bypassing filters; Availability: Response delays or blocking #9 - Model Usage
Confidentiality: Inference result exposure; Integrity: Model policy circumvention; Availability:
Inference failure or overload Table 1.3 SAIF Model Layer - CIA Threats Mapping