AML Threat Models & Taxonomy

Almost nothing. Request logs establish which queries arrived, not what the weights encode. A change written into the disposition queue or the training table produces no request at all, so the evidence that bounds it is the upstream write record.

Accuracy was measured on applicants with no reason to misstate those fields. Report the share of score sitting on columns the subject retypes for free, and what the cheapest application that flips a decline costs.

Two separate changes. Rounding coarsens the signal and creates ties, so probes must be larger or more numerous. Dropping the non-fired categories is the bigger cut: the reply now describes one boundary instead of several.

Very little on its own. Copies already taken cannot be recalled, and old installs keep the old file working for months. A replacement helps only once the server stops honouring what the old model produces.

The ceiling is only as tight as the search you paid for. A granted-access run that ran out of compute reports that those attacks failed, not that no adversary succeeds, so the bound holds only against adversaries whose own effort is smaller than the search you funded.

Require the goal before the number: any wrong verdict or one chosen verdict, and in which direction. Fund against the malicious-read-as-benign rate on realistic files at a stated attempt budget.

It bounds the worst case; it does not remove the asymmetry. The attacker parks just under the ceiling and still buys several times the median work at one price, and the ceiling lands hardest on genuinely difficult audio.

Ask what the five are. One success in five attempts on one file, against a scanner the attacker runs offline, is a capability costing five attempts; one file in five is partial coverage. Report it separately.

Not a rank. Either specify one adversary in the contract and make both re-test under it, or state in writing which axis each claim leaves blank, record the numbers as unverified, and decide on criteria you can re-measure yourself.

Not the responder. The owner accountable for the downstream service accepts it, on a written statement of what is skewed, how wide, for how long, and what the alternative costs.

A statement about the model that shipped, not about the one shipping next week. Because every retrain re-opens the same channel, the honest answer is a trajectory with named limits on contribution, not a status of clean or safe.

Usually yes, but only once it is written down as a production authorization surface. The decision is not whether the vendor is trustworthy; it is what attribution, gating and dwell you will fund, and what freshness that costs.

Naming what the step buys: it holds one column the applicant cannot set for free. Removing it moves score mass onto retypeable fields and drops the cheapest successful application to near zero. Price that shift; the conversion appetite is the business's.

Support it as a repricing with a number attached, never as a boundary. Say which families move to which cost, insist the multiplier is measured, and be explicit that paying integrators lose a field some will rebuild.

Whatever authorizes a consequential action. Ship the model if latency demands it, but the decision it feeds must be made server-side on evidence the client cannot mint, with the device result treated as a hint rather than a credential.

Refusing the grant makes the report partly a measurement of the vendor's secrecy, which is not a safety property and cannot support a clearance decision. Take the query-only run only as a supplementary realism datapoint, and say in writing what the absent grant means.