Threat Model

To provide a systematic testing framework, the attack modules in Basilisk are mapped to the OWASP Top 10 for LLM Applications (v1.1.0).

Assumptions and Scope

Basilisk is designed to evaluate specific threat vectors under controlled, authorized testing conditions.

┌──────────────────────────────────────┐  ┌──────────────────────────────────────┐
│             IN SCOPE                 │  │             OUT OF SCOPE             │
├──────────────────────────────────────┤  ├──────────────────────────────────────┤
│  • Black-box LLM API Querying        │  │  • Model Weights Extraction (Theft)  │
│  • Direct / Indirect Prompt Injection │  │  • Training Data Poisoning (Offline)  │
│  • Sensitive Instruction Leakage     │  │  • Supply-Chain Dependency Exploits   │
│  • RAG Citation & Context Hijacking  │  │  • Social Engineering / Phishing      │
│  • Tool Abuse (SSRF, SQLi via Agent) │  │  • DDoS / Infrastructure Attacks      │
└──────────────────────────────────────┘  └──────────────────────────────────────┘

• Assumptions:
  • Black-Box Access: The operator only has network querying access to the model endpoint.
  • No Model Weights: The tool does not require weights, logits, or gradient access.
  • No Privileged Access: The tool simulates an external attacker or unprivileged user.
  • Authorized Testing Only: Scans must only be executed against systems under explicit authorization.
• Out of Scope:
  • Model Stealing: Reconstructing model weights via query distillation.
  • Training Poisoning: Manipulating fine-tuning or pre-training pipelines offline.
  • Supply-Chain Attacks: Compromising library repositories or upstream dependencies.