Layered Attack Surface Model (LASM)

• Layered Attack Surface Model (LASM) is a security framework that decomposes systems into distinct layers with their own trust boundaries and defense leverage points.
• LASM enables analysis of cross-layer attack propagation and delegated authority, clarifying how attacks spread between components in complex systems.
• The model informs defensive design by mapping inputs, permissions, and state transitions, supporting effective policy enforcement and risk mitigation.

Searching arXiv for papers on layered attack surface models and agentic AI security. The Layered Attack Surface Model (LASM) is a family of security modeling frameworks that decomposes a system into layers with distinct trust boundaries, interfaces, assets, and defense leverage points. In recent literature, LASM has been used to analyze autonomous agent frameworks, tool-augmented LLM agents, self-evolving agent systems, cyber-physical systems, serverless machine learning, edge IoT deployments, and compound AI pipelines. Across these domains, the core premise is stable: attacks rarely remain local to one component, and meaningful security analysis therefore requires explicit modeling of cross-layer propagation, delegated authority, persistent state, and operational context (Chu, 25 Apr 2026, Xu et al., 30 Apr 2026, Ling et al., 9 Jun 2026).

1. Conceptual foundations

LASM is component-centric rather than attack-type-centric. One formulation defines separate layers only when they present independent trust boundaries and different defense leverage points; on that view, a detector operating purely on one attack-surface representation cannot reliably detect payloads introduced exclusively in another representation (Chu, 25 Apr 2026). This criterion explains why recent LASM variants separate, for example, model weights from planning artifacts, tool outputs from tool metadata, and persistent memory from runtime orchestration.

A more general systems formulation defines each layer as an attack surface $S_i = (I_i, O_i, \Pi_i, \Sigma_i, B_i)$, where $I_i$ are inputs or interfaces, $O_i$ outputs, $\Pi_i$ permissions or capabilities, $\Sigma_i$ permitted state transitions, and $B_i$ trust boundaries. LASM is then the set of these layer descriptions together with cross-layer edges $E_{ij}$ that encode information flow and delegated authority (Ling et al., 9 Jun 2026). This formalization makes LASM suitable not only for descriptive taxonomy but also for policy enforcement, runtime mediation, and risk aggregation.

In autonomous-agent settings, the basic assumptions recur across papers: mixed-trust inputs, delegated execution via tools, persistent state reuse, and open ecosystem integrations. LASM is therefore not merely a way of listing components; it is a way of identifying where attacks enter, how they are translated into actions, how they persist, and how they amplify through external connections (Xu et al., 30 Apr 2026).

2. Representative LASM variants

The literature does not present a single canonical layer stack. This suggests that LASM is better understood as a modeling family whose exact decomposition is adapted to the system under study.

Domain and paper	Layer structure	Distinguishing emphasis
Autonomous agent frameworks (Xu et al., 30 Apr 2026)	4 layers	Context/instruction, tool/action, state/persistence, ecosystem/automation
OpenClaw multi-agent execution system (Jamshidi et al., 12 Jun 2026)	7 layers	Input, Agent LLM, Aggregator, Policy Gating, Tool Adapter, System Resources, External Services
Tool-augmented agents (Arman et al., 28 May 2026)	Surface-based LASM	Data surface vs schema surface, plus other plausible surfaces in the loop
Self-evolving agents (Lin et al., 22 Jun 2026)	$5 \times 5$ MLAS matrix	Five modules crossed with five lifecycle stages, yielding 25 cells
Agentic AI systems with temporality (Chu, 25 Apr 2026)	7 layers + 4 temporal classes	Foundation through Governance, plus $T_1$–$T_4$ attack temporality
Systems-oriented LLM-agent security (Ling et al., 9 Jun 2026)	11 layers	Adds identity/policy, runtime, external actuation, monitoring
CPS attack-surface analysis (Tamimi et al., 2018)	3-layer integration	Physical impact, software/network exposure, OS/privilege exposure
Compound AI pipelines (Banerjee et al., 2024)	12 layers	End-to-end software and hardware stack from ingestion to supply chain

The four-layer agent-framework taxonomy emphasizes a lifecycle from manipulated context to unsafe execution to persistent contamination and then ecosystem-level amplification (Xu et al., 30 Apr 2026). By contrast, the OpenClaw LASM isolates the Aggregator/Coordinator Layer and the Policy Gating/Execution Filtering Layer, because output aggregation and execution vetoes are structurally central to risk (Jamshidi et al., 12 Jun 2026). The tool-surface work adopts a narrower but highly specific layered view: the tool-description channel is an earlier-read schema surface, while tool outputs form a later-read data surface (Arman et al., 28 May 2026).

The self-evolving-systems literature generalizes LASM into the Module–Lifecycle Attack Surface matrix, with five functional modules—Brain, Cognitive Resource, Execution, Self-Design, and Collective—crossed with five lifecycle stages—Bootstrap, Propose, Evaluate, Commit, and Serve—yielding 25 cells (Lin et al., 22 Jun 2026). Another strand introduces attack temporality as an orthogonal dimension, distinguishing Instantaneous, Session-Persistent, Cross-Session Cumulative, and Sub-Session-Stack, Non-Session-Bounded threats (Chu, 25 Apr 2026). Together, these works show that LASM can be spatial, temporal, or both.

3. Trust boundaries, propagation, and structural amplification

A central LASM claim is that attacks propagate across boundaries rather than remaining confined to their initial surface. In the four-layer autonomous-agent model, the canonical escalation path is context/instruction manipulation, followed by tool/action misuse, then state/persistence contamination, and finally ecosystem or automation amplification (Xu et al., 30 Apr 2026). This is presented not as a special case but as the normal lifecycle of attack propagation in agentic systems.

The OpenClaw analysis makes the same principle more granular. Prompt injection enters at the external input boundary, influences agent proposals, passes through aggregation under permissive OR-triggered execution, evades policy gating, and reaches tool adapters and system resources. Tool-output injection can then re-enter the prompt context and compound instability by crossing reasoning boundaries again (Jamshidi et al., 12 Jun 2026). The structural point is that reasoning and execution are separated by multiple boundaries, but those boundaries are only protective if the aggregation and gating policies are restrictive.

The surface-pairing study sharpens this argument by showing that vulnerability is not a scalar property of a model and not a global property of a channel. Over 6,830 attempts, the surface main effect accounted for approximately 0.0% of the variance in attack outcomes, while the model–surface interaction accounted for approximately 16.7%. The same byte-identical payload could therefore invert its success rate depending on whether it was delivered through tool outputs or tool descriptions (Arman et al., 28 May 2026). In LASM terms, the operative unit is the model–surface pairing, not the surface in isolation.

Self-evolving systems extend propagation from cross-layer to cross-generation. The paper’s formal distinction between session-bounded and lineage-persistent attacks is operationalized through mechanisms such as the Write → Retrieve → Influence → Inherit loop in Cognitive Resource, capability ratchet in Execution, and optimizer–optimizee collapse in Self-Design (Lin et al., 22 Jun 2026). Here LASM is no longer only about where an attack enters; it is also about how it becomes encoded into future versions of the system.

In edge IoT deployments, propagation additionally involves deployment architecture. The reported systems-level attack surfaces include provenance chain bypass, coordination-state divergence, induced trust erosion, invisible sovereignty-boundary crossings during fallback, and failover windows (Zhan et al., 26 Feb 2026). This widens LASM beyond software components to include coordination buses, failover paths, and control-plane visibility.

4. Metrics and formal quantification

LASM has increasingly been accompanied by explicit metrics. In OpenClaw, system-level compromise under OR-triggered execution is modeled as

$I_i$0

and for identical agents as

$I_i$1

The reported values were $I_i$2 for one agent and approximately $I_i$3 for seven agents under OR-triggered execution. Attack surface entropy,

$I_i$4

increased from $I_i$5 to $I_i$6 under injection, while mean privilege drift increased from $I_i$7 to $I_i$8; positive escalation curvature $I_i$9 indicated superlinear growth in privilege or risk as attacker capability increased (Jamshidi et al., 12 Jun 2026).

The tool-surface literature defines per-surface attack success rate as

$O_i$0

and the Adaptive Attack Rate as

$O_i$1

Across 52 model–suite cells, the per-cell mean was 37.5% for the data surface, 31.5% for the schema surface, and 46.5% for the adaptive attacker, yielding an average lift of +9.1 percentage points over the strongest fixed-surface baseline (Arman et al., 28 May 2026). These quantities make LASM explicitly adversarial: the attacker is modeled as choosing among available surfaces.

In cyber-physical systems, LASM is coupled to impact-aware path metrics. The total attack surface metric is

$O_i$2

with channel contribution

$O_i$3

and process contribution

$O_i$4

This construction integrates software/network exposure, operating-system privilege exposure, and domain-specific physical impact such as loss of load in kilowatts (Tamimi et al., 2018).

Other domains define their own LASM-aligned metrics rather than reusing a universal score. Edge IoT work introduces data egress volume $O_i$5, failover window exposure, sovereignty boundary integrity, provenance chain completeness, coordination-state divergence $O_i$6, and induced trust erosion (Zhan et al., 26 Feb 2026). Compound AI security uses a cross-layer risk aggregation of the form

$O_i$7

making cross-layer amplification explicit (Banerjee et al., 2024). The absence of a single metric is therefore not a weakness of LASM; it reflects the fact that different deployments expose different harms.

5. Defensive design and trade-offs

Because LASM is boundary-centric, its defenses are usually formulated as boundary controls. In OpenClaw, policy gating and execution filtering reduced compromise probability by 0.10, boundary failures by 0.10, and privilege drift by 0.02, all statistically significant at $O_i$8. These controls reduced utility from 0.93 to 0.89 and increased median latency from 420 ms to 468 ms. The same study reports that majority gating in a seven-agent configuration yields approximately $O_i$9, compared with approximately $\Pi_i$0 under permissive OR-triggering (Jamshidi et al., 12 Jun 2026). Aggregation policy is thus itself a defense surface.

In tool-augmented agents, standard prompt-level defenses were shown to inherit a surface blind spot. The reported three-model panel found that repeat_user_prompt reduced data-surface ASR to 10.6% while leaving schema-surface ASR at 54.8%, and spotlighting_with_delimiting reduced data-surface ASR to 17.9% while leaving schema-surface ASR at 54.1%. By contrast, the description-aware tool_filter achieved 0.0% on the data surface and 0.8% on the schema surface (Arman et al., 28 May 2026). LASM therefore directs defense placement toward the actual surface, not merely the most familiar one.

For self-evolving systems, the defensive posture shifts from session security to lineage security. The proposed recommendations include longitudinal safety monitoring across generations, immutable safety invariants outside the mutation scope of the system, provenance tracking with multi-generational audit trails, and attack-surface-matched coverage across user input, external data, tool outputs, evaluation signals, and inter-agent messages (Lin et al., 22 Jun 2026). Static point-in-time controls are described as structurally inadequate.

In serverless machine learning, the multi-layered Serverless AI Shield combines pre-deployment validation, runtime monitoring, and post-execution forensics. The reported quantitative outcomes were detection efficacy of approximately 94.2%, inference latency overhead of approximately 8.7%, cold-start overhead of approximately 12.3%, and false positive rate of approximately 2.3% (Pathade et al., 15 Jan 2026). In compound AI pipelines, comparable defense-in-depth includes SBOM validation, TEEs with remote attestation, IOMMU configurations, performance-counter gating, encrypted I/O, memory encryption with integrity, and supply-chain hardening (Banerjee et al., 2024).

6. Adjacent frameworks, misconceptions, and open problems

LASM is complementary to, rather than a substitute for, frameworks such as STRIDE, MITRE ATLAS, and PASTA. One agent-security survey explicitly describes STRIDE as orthogonal to LASM, with LASM adding architectural placement and propagation paths across layers; it similarly treats MITRE ATLAS as a technique catalog that LASM can map onto layered interfaces and end-to-end escalation chains (Xu et al., 30 Apr 2026). Compound AI work performs a comparable mapping to MITRE ATT&CK phases, but with stronger emphasis on software–hardware compositions (Banerjee et al., 2024).

Several recurrent misconceptions are contradicted by the literature. One is that LASM denotes a fixed layer taxonomy. The current record instead contains four-layer, seven-layer, eleven-layer, twelve-layer, and matrix-based variants (Xu et al., 30 Apr 2026, Ling et al., 9 Jun 2026). A second is that a single attack-success number on one channel adequately measures model vulnerability; the tool-surface results show that vulnerability is a property of the model–surface pairing, not the channel alone (Arman et al., 28 May 2026). A third is that model diversity automatically improves resilience; under OR-triggered aggregation, the OpenClaw analysis states that the most vulnerable agent determines system exposure and gives the bound $\Pi_i$1 (Jamshidi et al., 12 Jun 2026). A fourth is that edge-local operation guarantees sovereignty; the IoT study reports that fallback can silently route inference to cloud endpoints with no MQTT or application-layer indication (Zhan et al., 26 Feb 2026). A fifth is that static or session-bounded defenses are adequate for self-evolving agents; the MLAS analysis argues that self-evolution converts known attack categories from session-bounded to lineage-persistent (Lin et al., 22 Jun 2026).

Open problems are correspondingly cross-layer and long-horizon. A seven-layer LASM review identifies five research gaps: Cross-Session Attack Benchmarks, Emergent Misalignment Detection, General Steganographic Communication Detection, ABOM Standardization and MCP Security Certification, and System-Level Accountability Frameworks (Chu, 25 Apr 2026). A broader 247-paper synthesis likewise concludes that current defenses remain weakly compositional and that evaluation still underrepresents long-horizon, stateful, and deployment-sensitive risks (Ling et al., 9 Jun 2026). The common implication is that LASM is most valuable when it is treated not as a static diagram but as an operational program of instrumentation, measurement, and boundary enforcement over time.