Title: Layer 1: The Generative Engine (Foundation Models)

Diagram type: c4plantuml · Version: 1 · View on Vizo · Present

Layer 1 is the foundational generative engine—the LLM or core AI—that powers all agentic reasoning. The threat landscape at this base level focuses on Model Subversion, where the goal is to corrupt or steal the intelligence itself:

Integrity & Training Attacks: During the training phase, Data Poisoning or the insertion of Backdoor Attacks can bake malicious triggers directly into the model’s “DNA,” causing it to behave predictably for an attacker but unexpectedly for the user.

Inference Vulnerabilities: At runtime, Adversarial Examples trick the model into incorrect logic, while Reprogramming Attacks essentially “brainwash” the model into performing tasks outside its original intent.

Intellectual Property & Privacy: Model Stealing via API scraping threatens a firm’s competitive edge, while Membership Inference Attacks can deanonymize individuals by proving their data was part of the training set.

Resource Exhaustion: Advanced Denial of Service (DoS) attacks, such as “Sponge Attacks,” exploit model complexity to spike computational costs and cause cascade failures across all dependent agents.

@startuml
!include <C4/C4_Container>

' Essentialist Firebrick Aesthetic
skinparam RectangleBackgroundColor firebrick
skinparam RectangleFontColor white
skinparam RectangleBorderColor white
skinparam ArrowColor firebrick

title Layer 1: Foundation Model Landscape

System_Boundary(l1, "Layer 1: Core AI Model") {
    Container(weights, "Model Weights & Architecture", "The Engine", "Target: Model Stealing & Reprogramming")
    Container(training, "Training Set & Process", "The Origin", "Target: Training Data Poisoning & Backdoors")
    Container(inference, "Inference API", "The Interface", "Target: Adversarial Examples & DoS")
}

' The Core Flow
Rel_D(training, weights, "Defines")
Rel_D(weights, inference, "Powers")

note bottom of l1
  **The Strategic Gap:**
  If the **Foundation** is flawed, 
  every autonomous decision built 
  above it is inherently **Compromised**.
end note
@enduml