---
title: Layered Attack Surface Model (LASM)
url: https://www.emergentmind.com/topics/layered-attack-surface-model-lasm
type: topic
---

# Layered Attack Surface Model (LASM)

Searching arXiv for recent papers on layered attack surface models and agentic AI security.
The Layered Attack Surface Model (LASM) is a family of security modeling frameworks that decomposes a system into layers with distinct trust boundaries, interfaces, assets, and defense leverage points. In recent literature, LASM has been used to analyze autonomous agent frameworks, tool-augmented LLM agents, self-evolving agent systems, cyber-physical systems, serverless machine learning, edge IoT deployments, and compound AI pipelines. Across these domains, the core premise is stable: attacks rarely remain local to one component, and meaningful security analysis therefore requires explicit modeling of cross-layer propagation, delegated authority, persistent state, and operational context [2604.23338] [2604.27464] [2606.10749].

## 1. Conceptual foundations

LASM is component-centric rather than attack-type-centric. One formulation defines separate layers only when they present independent trust boundaries and different defense leverage points; on that view, a detector operating purely on one attack-surface representation cannot reliably detect payloads introduced exclusively in another representation [2604.23338]. This criterion explains why recent LASM variants separate, for example, model weights from planning artifacts, tool outputs from tool metadata, and persistent memory from runtime orchestration.

A more general systems formulation defines each layer as an attack surface
$S_i = (I_i, O_i, \Pi_i, \Sigma_i, B_i)$,
where $I_i$ are inputs or interfaces, $O_i$ outputs, $\Pi_i$ permissions or capabilities, $\Sigma_i$ permitted state transitions, and $B_i$ trust boundaries. LASM is then the set of these layer descriptions together with cross-layer edges $E_{ij}$ that encode information flow and delegated authority [2606.10749]. This formalization makes LASM suitable not only for descriptive taxonomy but also for policy enforcement, runtime mediation, and risk aggregation.

In autonomous-agent settings, the basic assumptions recur across papers: mixed-trust inputs, delegated execution via tools, persistent state reuse, and open ecosystem integrations. LASM is therefore not merely a way of listing components; it is a way of identifying where attacks enter, how they are translated into actions, how they persist, and how they amplify through external connections [2604.27464].

## 2. Representative LASM variants

The literature does not present a single canonical layer stack. This suggests that LASM is better understood as a modeling family whose exact decomposition is adapted to the system under study.

| Domain and paper | Layer structure | Distinguishing emphasis |
|---|---|---|
| Autonomous agent frameworks [2604.27464] | 4 layers | Context/instruction, tool/action, state/persistence, ecosystem/automation |
| OpenClaw multi-agent execution system [2606.15008] | 7 layers | Input, Agent LLM, Aggregator, Policy Gating, Tool Adapter, System Resources, External Services |
| Tool-augmented agents [2605.30454] | Surface-based LASM | Data surface vs schema surface, plus other plausible surfaces in the loop |
| Self-evolving agents [2606.23075] | $5 \times 5$ MLAS matrix | Five modules crossed with five lifecycle stages, yielding 25 cells |
| Agentic AI systems with temporality [2604.23338] | 7 layers + 4 temporal classes | Foundation through Governance, plus $T_1$–$T_4$ attack temporality |
| Systems-oriented LLM-agent security [2606.10749] | 11 layers | Adds identity/policy, runtime, external actuation, monitoring |
| CPS attack-surface analysis [1806.06168] | 3-layer integration | Physical impact, software/network exposure, OS/privilege exposure |
| Compound AI pipelines [2411.13459] | 12 layers | End-to-end software and hardware stack from ingestion to supply chain |

The four-layer agent-framework taxonomy emphasizes a lifecycle from manipulated context to unsafe execution to persistent contamination and then ecosystem-level amplification [2604.27464]. By contrast, the OpenClaw LASM isolates the Aggregator/Coordinator Layer and the Policy Gating/Execution Filtering Layer, because output aggregation and execution vetoes are structurally central to risk [2606.15008]. The tool-surface work adopts a narrower but highly specific layered view: the tool-description channel is an earlier-read schema surface, while tool outputs form a later-read data surface [2605.30454].

The self-evolving-systems literature generalizes LASM into the Module–Lifecycle Attack Surface matrix, with five functional modules—Brain, Cognitive Resource, Execution, Self-Design, and Collective—crossed with five lifecycle stages—Bootstrap, Propose, Evaluate, Commit, and Serve—yielding 25 cells [2606.23075]. Another strand introduces attack temporality as an orthogonal dimension, distinguishing Instantaneous, Session-Persistent, Cross-Session Cumulative, and Sub-Session-Stack, Non-Session-Bounded threats [2604.23338]. Together, these works show that LASM can be spatial, temporal, or both.

## 3. Trust boundaries, propagation, and structural amplification

A central LASM claim is that attacks propagate across boundaries rather than remaining confined to their initial surface. In the four-layer autonomous-agent model, the canonical escalation path is context/instruction manipulation, followed by tool/action misuse, then state/persistence contamination, and finally ecosystem or automation amplification [2604.27464]. This is presented not as a special case but as the normal lifecycle of attack propagation in agentic systems.

The OpenClaw analysis makes the same principle more granular. Prompt injection enters at the external input boundary, influences agent proposals, passes through aggregation under permissive OR-triggered execution, evades policy gating, and reaches tool adapters and system resources. Tool-output injection can then re-enter the prompt context and compound instability by crossing reasoning boundaries again [2606.15008]. The structural point is that reasoning and execution are separated by multiple boundaries, but those boundaries are only protective if the aggregation and gating policies are restrictive.

The surface-pairing study sharpens this argument by showing that vulnerability is not a scalar property of a model and not a global property of a channel. Over 6,830 attempts, the surface main effect accounted for approximately 0.0% of the variance in attack outcomes, while the model–surface interaction accounted for approximately 16.7%. The same byte-identical payload could therefore invert its success rate depending on whether it was delivered through tool outputs or tool descriptions [2605.30454]. In LASM terms, the operative unit is the model–surface pairing, not the surface in isolation.

Self-evolving systems extend propagation from cross-layer to cross-generation. The paper’s formal distinction between session-bounded and lineage-persistent attacks is operationalized through mechanisms such as the Write → Retrieve → Influence → Inherit loop in Cognitive Resource, capability ratchet in Execution, and optimizer–optimizee collapse in Self-Design [2606.23075]. Here LASM is no longer only about where an attack enters; it is also about how it becomes encoded into future versions of the system.

In edge IoT deployments, propagation additionally involves deployment architecture. The reported systems-level attack surfaces include provenance chain bypass, coordination-state divergence, induced trust erosion, invisible sovereignty-boundary crossings during fallback, and failover windows [2602.22525]. This widens LASM beyond software components to include coordination buses, failover paths, and control-plane visibility.

## 4. Metrics and formal quantification

LASM has increasingly been accompanied by explicit metrics. In OpenClaw, system-level compromise under OR-triggered execution is modeled as
$$
P_c(n) = 1 - \prod_{i=1}^{n} (1 - p_i),
$$
and for identical agents as
$$
P_c(n) = 1 - (1-p)^n.
$$
The reported values were $P_c = 0.24$ for one agent and approximately $0.86$ for seven agents under OR-triggered execution. Attack surface entropy,
$$
H_A = -\sum_j p_j \log p_j,
$$
increased from $0.42$ to $0.71$ under injection, while mean privilege drift increased from $0.03$ to $0.21$; positive escalation curvature $\kappa = 0.08$ indicated superlinear growth in privilege or risk as attacker capability increased [2606.15008].

The tool-surface literature defines per-surface attack success rate as
$$
ASR_{m,t,s} = \frac{\text{successes}_{m,t,s}}{\text{attempts}_{m,t,s}},
$$
and the Adaptive Attack Rate as
$$
\mathrm{AAR}_{m,t} = \max_{s \in S} \mathrm{ASR}_{m,t,s}.
$$
Across 52 model–suite cells, the per-cell mean was 37.5% for the data surface, 31.5% for the schema surface, and 46.5% for the adaptive attacker, yielding an average lift of +9.1 percentage points over the strongest fixed-surface baseline [2605.30454]. These quantities make LASM explicitly adversarial: the attacker is modeled as choosing among available surfaces.

In cyber-physical systems, LASM is coupled to impact-aware path metrics. The total attack surface metric is
$$
TASM(s, ap(s_t)) = \sum_{i \in ap(s_t)} \big( AS_C(i) + AS_P(i) \big),
$$
with channel contribution
$$
AS_C(i) = exp_c \times imp_c
$$
and process contribution
$$
AS_P(i) = exp_p \times imp_p.
$$
This construction integrates software/network exposure, operating-system privilege exposure, and domain-specific physical impact such as loss of load in kilowatts [1806.06168].

Other domains define their own LASM-aligned metrics rather than reusing a universal score. Edge IoT work introduces data egress volume $E(T)$, failover window exposure, sovereignty boundary integrity, provenance chain completeness, coordination-state divergence $D(t)$, and induced trust erosion [2602.22525]. Compound AI security uses a cross-layer risk aggregation of the form
$$
R = \sum_{i=1}^{n} w_i r_i + \sum_{(i,j)\in E} \gamma_{ij} r_i r_j,
$$
making cross-layer amplification explicit [2411.13459]. The absence of a single metric is therefore not a weakness of LASM; it reflects the fact that different deployments expose different harms.

## 5. Defensive design and trade-offs

Because LASM is boundary-centric, its defenses are usually formulated as boundary controls. In OpenClaw, policy gating and execution filtering reduced compromise probability by 0.10, boundary failures by 0.10, and privilege drift by 0.02, all statistically significant at $p < 0.0001$. These controls reduced utility from 0.93 to 0.89 and increased median latency from 420 ms to 468 ms. The same study reports that majority gating in a seven-agent configuration yields approximately $P_c \approx 0.48$, compared with approximately $0.86$ under permissive OR-triggering [2606.15008]. Aggregation policy is thus itself a defense surface.

In tool-augmented agents, standard prompt-level defenses were shown to inherit a surface blind spot. The reported three-model panel found that `repeat_user_prompt` reduced data-surface ASR to 10.6% while leaving schema-surface ASR at 54.8%, and `spotlighting_with_delimiting` reduced data-surface ASR to 17.9% while leaving schema-surface ASR at 54.1%. By contrast, the description-aware `tool_filter` achieved 0.0% on the data surface and 0.8% on the schema surface [2605.30454]. LASM therefore directs defense placement toward the actual surface, not merely the most familiar one.

For self-evolving systems, the defensive posture shifts from session security to lineage security. The proposed recommendations include longitudinal safety monitoring across generations, immutable safety invariants outside the mutation scope of the system, provenance tracking with multi-generational audit trails, and attack-surface-matched coverage across user input, external data, tool outputs, evaluation signals, and inter-agent messages [2606.23075]. Static point-in-time controls are described as structurally inadequate.

In serverless machine learning, the multi-layered Serverless AI Shield combines pre-deployment validation, runtime monitoring, and post-execution forensics. The reported quantitative outcomes were detection efficacy of approximately 94.2%, inference latency overhead of approximately 8.7%, cold-start overhead of approximately 12.3%, and false positive rate of approximately 2.3% [2601.11664]. In compound AI pipelines, comparable defense-in-depth includes SBOM validation, TEEs with remote attestation, IOMMU configurations, performance-counter gating, encrypted I/O, memory encryption with integrity, and supply-chain hardening [2411.13459].

## 6. Adjacent frameworks, misconceptions, and open problems

LASM is complementary to, rather than a substitute for, frameworks such as STRIDE, MITRE ATLAS, and PASTA. One agent-security survey explicitly describes STRIDE as orthogonal to LASM, with LASM adding architectural placement and propagation paths across layers; it similarly treats MITRE ATLAS as a technique catalog that LASM can map onto layered interfaces and end-to-end escalation chains [2604.27464]. Compound AI work performs a comparable mapping to MITRE ATT&CK phases, but with stronger emphasis on software–hardware compositions [2411.13459].

Several recurrent misconceptions are contradicted by the literature. One is that LASM denotes a fixed layer taxonomy. The current record instead contains four-layer, seven-layer, eleven-layer, twelve-layer, and matrix-based variants [2604.27464] [2606.10749]. A second is that a single attack-success number on one channel adequately measures model vulnerability; the tool-surface results show that vulnerability is a property of the model–surface pairing, not the channel alone [2605.30454]. A third is that model diversity automatically improves resilience; under OR-triggered aggregation, the OpenClaw analysis states that the most vulnerable agent determines system exposure and gives the bound $P_c \geq \max_i p_i$ [2606.15008]. A fourth is that edge-local operation guarantees sovereignty; the IoT study reports that fallback can silently route inference to cloud endpoints with no MQTT or application-layer indication [2602.22525]. A fifth is that static or session-bounded defenses are adequate for self-evolving agents; the MLAS analysis argues that self-evolution converts known attack categories from session-bounded to lineage-persistent [2606.23075].

Open problems are correspondingly cross-layer and long-horizon. A seven-layer LASM review identifies five research gaps: Cross-Session Attack Benchmarks, Emergent Misalignment Detection, General Steganographic Communication Detection, ABOM Standardization and MCP Security Certification, and System-Level Accountability Frameworks [2604.23338]. A broader 247-paper synthesis likewise concludes that current defenses remain weakly compositional and that evaluation still underrepresents long-horizon, stateful, and deployment-sensitive risks [2606.10749]. The common implication is that LASM is most valuable when it is treated not as a static diagram but as an operational program of instrumentation, measurement, and boundary enforcement over time.

Source: https://www.emergentmind.com/topics/layered-attack-surface-model-lasm