Adam Shostack
Threat modeling systems that call LLMs requires specialized approaches. Existing frameworks are heavyweight (wordy, jargon-laden) and often focus on threats that can only be addressed by those who train the models, offering little help to security practitioners tasked with threat modeling their company’s latest AI feature or product. This talk will introduce PHANTOM-B a new, STRIDE-like mnemonic for threat modeling LLMs. PHANTOM-B is focused on the common case of “an LLM trained by others,” rather than those training the LLM themselves.
Adam Shostack
Adam is a leading expert on threat modeling, and a teacher, entrepreneur, author and game designer.
Adam is leading expert on threat modeling and secure by design. He currently helps many organizations improve their security by with training and coaching at Shostack + Associates. He's the author of Threats: What Every Engineer Should Learn from Star Wars, Threat Modeling: Designing for Security and The New School of Information Security (with Andrew Stewart). He's a member of the BlackHat Review Board, and helped create the CVE and many other things, and is an Affiliate Professor at the University of Washington.