Module: SDD-B10 — Academic Offensive Harnesses Diagram count: 5 Tool: Mermaid (primary). Each diagram validated in Mermaid Live Editor.
Type: Comparison / inversion Purpose: The foundational visual. In Course 2A, the academic offensive harnesses (PentestGPT, HPTSA, VulnBot, APT-Agent, CAI) were tools you USE for security work — LLM-driven agents automating pentests against traditional targets. In 2B, the lens inverts: the same harnesses are methodologies for ATTACKING AI systems. The transfer is structural, not analogical — the architectures (planning, decomposition, rectification, scale) are target-agnostic. Swap the target from "web server" to "agent with an injection surface" and the same machinery runs. Reading the diagram: Two rows. The top (2A) is the defender's tool; the bottom (2B) is the attacker's methodology. The middle bar marks the inversion: the architecture is identical, only the target changes. The teal callout is the load-bearing point — the transfer is structural.
flowchart TB
subgraph A2["COURSE 2A — tools FOR security work"]
direction LR
T1["TARGET: network / web app / contract<br/>traditional infrastructure"]
A1["ARCHITECTURE<br/>reasoning loop · hierarchy<br/>multi-agent · rectification · scale"]
R1["RESULT: find vulns faster<br/>defender's assistant"]
T1 --> A1 --> R1
end
INVERT["THE INVERSION<br/>same architecture — target swapped<br/>from 'web server with a zero-day'<br/>to 'agent with an injection surface'<br/>the machinery runs unchanged"]:::teal
subgraph B2["COURSE 2B — methodologies for ATTACKING AI systems"]
direction LR
T2["TARGET: agent / model / harness<br/>the AI system itself"]
A2["ARCHITECTURE (identical)<br/>reasoning loop · hierarchy<br/>multi-agent · rectification · scale"]
R2["RESULT: automated multi-step<br/>injection chains · the threat model"]
T2 --> A2 --> R2
end
A2 --> INVERT
INVERT -.->|"structural, not analogical"| A1
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style A2 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style B2 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style A1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style T1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style R1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style T2 fill:#101018,stroke:#f08080,color:#e4e4e8
style A2 fill:#101018,stroke:#f08080,color:#e4e4e8
style R2 fill:#101018,stroke:#f08080,color:#e4e4e8
style INVERT fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
Note: The transfer is not a metaphor. PentestGPT's reasoning loop, HPTSA's hierarchy, VulnBot's collaboration, APT-Agent's rectification, and CAI's speed are general solutions to "automated, multi-step, reasoning-heavy exploration of an attack surface." The AI-system attack surface is one such surface. The same code, retargeted, attacks it.
Type: Landscape / taxonomy Purpose: The survey visual. Each paper contributed one capability to the offensive frontier: PentestGPT the reasoning loop, HPTSA the hierarchy, VulnBot the collaboration, APT-Agent the rectification, CAI the speed. Read as a trajectory, the literature points toward an integrated offensive harness for AI targets — assembleable from open components. Each paper carries its arXiv ID for primary-source traceability. Reading the diagram: Five cards, each with the paper, its contribution, and its AI-target transfer. The arrow at the bottom marks the trajectory: the composition is the threat.
flowchart LR
PTG["PENTESTGPT<br/>USENIX Sec 2024<br/>three-module reasoning loop<br/>(parse · reason · generate)"]:::teal
HPT["HPTSA<br/>arXiv:2406.01637<br/>hierarchical planning<br/>planner → sub-agents"]:::teal
VUL["VULNBOT<br/>arXiv:2501.13411<br/>multi-agent collaboration<br/>recon · vuln · exploit"]:::teal
APT["APT-AGENT<br/>arXiv:2605.24949<br/>rectification on failure<br/>read error → refine"]:::teal
CAI["CAI<br/>arXiv:2504.06017<br/>speed · 156x faster<br/>high-volume"]:::teal
PTG -.->|"transfer: injection-chain planning"| T1["automated reasoning<br/>over the agent's state"]:::danger
HPT -.->|"transfer: zero-click chain"| T2["planner dispatches<br/>chain steps to crafters"]:::danger
VUL -.->|"transfer: distributed probing"| T3["one agent per surface<br/>(retrieval · tool · guardrail)"]:::danger
APT -.->|"transfer: adaptive evasion"| T4["refine payload against<br/>detector response (SDD-B09)"]:::danger
CAI -.->|"transfer: high-volume attack"| T5["sweep the surface at scale<br/>find the residual fast"]:::danger
COMP["THE COMPOSITION<br/>planning + hierarchy + collaboration<br/>+ rectification + scale<br/>= an integrated offensive harness<br/>for AI targets — assembleable from open components"]:::danger
T1 & T2 & T3 & T4 & T5 --> COMP
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style PTG fill:#101018,stroke:#5eead4,color:#e4e4e8
style HPT fill:#101018,stroke:#5eead4,color:#e4e4e8
style VUL fill:#101018,stroke:#5eead4,color:#e4e4e8
style APT fill:#101018,stroke:#5eead4,color:#e4e4e8
style CAI fill:#101018,stroke:#5eead4,color:#e4e4e8
style COMP fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
Note: No single paper is an integrated AI-target offensive harness. But each contributed a component, the components are open-source, and the barrier to composing them is falling. The threat is not a single super-tool; it is the commoditization of the components and the convergence of their integration.
Type: Architecture mapping Purpose: The most important transfer in the deep-dive. HPTSA's planner-dispatches-to-specialized-sub-agents architecture is the blueprint for the zero-click injection chain. The chain is a multi-step attack where no single step suffices: poison retrieval, trigger retrieval, manipulate tool call, exfiltrate. A human scripting this by hand is slow and brittle; an HPTSA-style planner decomposes the objective and dispatches each step to a focused sub-agent. This is why the zero-click chain is now automatable. Reading the diagram: The planner at the top holds the global strategy. It dispatches four sub-tasks to specialized sub-agents, each informed by the prior step's result. The chain flows top-to-bottom; each step is a focused payload crafter. The teal planner is HPTSA's contribution; the danger steps are the chain.
flowchart TB
PLAN["HPTSA PLANNER (the orchestrator)<br/>global strategy: exfiltration via the tool surface<br/>decomposes objective → dispatches sub-tasks<br/>maintains state across steps"]:::teal
S1["SUB-AGENT 1: plant the payload<br/>craft an indirect injection<br/>insert into a doc the agent will retrieve<br/>(SDD-B03 indirect injection)"]:::danger
S2["SUB-AGENT 2: trigger retrieval<br/>craft a benign-seeming query<br/>that causes the agent to fetch the poisoned doc"]:::danger
S3["SUB-AGENT 3: manipulate the tool call<br/>the retrieved payload instructs the agent<br/>to call the exfil tool with the sensitive path<br/>(SDD-B04 function-call manipulation)"]:::danger
S4["SUB-AGENT 4: exfiltrate<br/>the tool call executes<br/>sensitive data leaves via the tool surface"]:::danger
PLAN -->|"dispatch"| S1
S1 -->|"payload planted"| S2
S2 -->|"retrieval triggered"| S3
S3 -->|"tool call manipulated"| S4
S4 -.->|"result feeds back"| PLAN
GATE["HARNESS SCOPE GATE (the deterministic floor)<br/>even when the chain succeeds,<br/>the disallowed action is BLOCKED<br/>no evasion surface — the adversary's<br/>planning finds nothing to adapt against"]:::teal
S4 -.->|"disallowed action"| GATE
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style PLAN fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
style S1 fill:#101018,stroke:#f08080,color:#e4e4e8
style S2 fill:#101018,stroke:#f08080,color:#e4e4e8
style S3 fill:#101018,stroke:#f08080,color:#e4e4e8
style S4 fill:#101018,stroke:#f08080,color:#e4e4e8
style GATE fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
Note: The hierarchy is what makes the chain navigable. A single agent holding the entire chain in context gets lost in the state space; the planner-sub-agent decomposition keeps each step focused. The harness scope gate at the bottom is the defense — the chain can succeed at every model-based layer and the final action is still blocked by a rule the adversary cannot reach.
Type: Mapping matrix Purpose: The technique-by-technique transfer. Each academic contribution maps to a specific AI-target attack vector: PentestGPT's reasoning loop to injection-chain planning, HPTSA's hierarchy to the zero-click chain, VulnBot's collaboration to distributed multi-surface probing, APT-Agent's rectification to adaptive detector evasion, CAI's speed to high-volume attack and measurement. The mapping is structural — the technique solves the same problem on a different surface. Reading the diagram: Left column = academic contribution; right column = AI-target vector. The arrows mark the transfer. Note that APT-Agent's rectification connects directly to SDD-B09's cat-and-mouse dynamic — the automated evasion engine.
flowchart LR
subgraph ACAD["ACADEMIC CONTRIBUTION"]
direction TB
A1["PENTESTGPT<br/>reasoning loop<br/>(parse · reason · generate)"]
A2["HPTSA<br/>hierarchical planning<br/>(planner → sub-agents)"]
A3["VULNBOT<br/>multi-agent collaboration<br/>(recon · vuln · exploit)"]
A4["APT-AGENT<br/>rectification<br/>(read failure → refine)"]
A5["CAI<br/>speed (156x)<br/>(high-volume)"]
end
subgraph AIT["AI-TARGET ATTACK VECTOR"]
direction TB
V1["INJECTION-CHAIN PLANNING<br/>reason over the agent's state<br/>decide the next injection step"]
V2["ZERO-CLICK CHAIN<br/>planner dispatches chain steps<br/>to specialized payload crafters"]
V3["DISTRIBUTED MULTI-SURFACE PROBING<br/>one agent per surface<br/>(retrieval · tool · guardrail)"]
V4["ADAPTIVE DETECTOR EVASION<br/>probe detector → refine payload<br/>→ sit in false-negative region<br/>(SDD-B09 cat-and-mouse, automated)"]
V5["HIGH-VOLUME ATTACK + MEASUREMENT<br/>sweep the surface at scale<br/>find the residual fast"]
end
A1 --> V1
A2 --> V2
A3 --> V3
A4 --> V4
A5 --> V5
style ACAD fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
style AIT fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style A1 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A2 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A3 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A4 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A5 fill:#101018,stroke:#5eead4,color:#e4e4e8
style V1 fill:#101018,stroke:#f08080,color:#e4e4e8
style V2 fill:#101018,stroke:#f08080,color:#e4e4e8
style V3 fill:#101018,stroke:#f08080,color:#e4e4e8
style V4 fill:#101018,stroke:#f08080,color:#e4e4e8
style V5 fill:#101018,stroke:#f08080,color:#e4e4e8
Note: APT-Agent's rectification (A4 → V4) is the bridge to SDD-B09. The cat-and-mouse dynamic — where the detector's out-of-distribution accuracy decays under adaptive pressure — is driven by rectification machinery. The attacker is not static; the detector's surface is probed and the payload is refined. The defender who measures only against static traffic is measuring against an adversary who no longer exists.
Type: Synthesis / thesis Purpose: The course-closing visual. The adversary now has hierarchical planning (HPTSA), multi-agent collaboration (VulnBot), adaptive rectification (APT-Agent), and scale (CAI). The defenses that hold are the ones the course built: the scope gate (B0), defense-in-depth (B2), the deterministic boundary (SDD-B05), external guardrails (SDD-B08), the measured detector (SDD-B09). The deterministic layers — the boundary and the scope gate — are what hold when every model-based layer's residual is exploited, because they have no evasion surface for the adversary's adaptive machinery to find. Reading the diagram: The offensive frontier at the top (danger); the defense stack at the bottom (teal = deterministic, no evasion surface; warn = model-based, residual exists). The scope gate is the floor. The adversary can plan, dispatch, rectify, and scale — and the final action is still gated by a rule the model cannot reach.
flowchart TB
subgraph OFF["THE OFFENSIVE FRONTIER (the adversary now has)"]
direction LR
O1["HIERARCHY<br/>HPTSA planning"]:::danger
O2["COLLABORATION<br/>VulnBot multi-agent"]:::danger
O3["RECTIFICATION<br/>APT-Agent adaptation"]:::danger
O4["SCALE<br/>CAI 156x speed"]:::danger
end
OFF -->|"attacks"| STACK
subgraph STACK["THE DEFENSE STACK (the course's thesis)"]
direction TB
D1["B0 — SCOPE FILE + PROVIDER-AUTH GATE<br/>legal/engineering control plane<br/>DETERMINISTIC — rule the adversary cannot talk out of"]:::teal
D2["B2 — DEFENSE-IN-DEPTH<br/>no single layer suffices<br/>composition bounds the residual"]:::teal
D3["SDD-B05 — IRONCURTAIN<br/>the deterministic boundary<br/>NO EVASION SURFACE"]:::teal
D4["SDD-B08 — NEMO GUARDRAILS<br/>externally evaluated<br/>stops DISABLE (residual: EVADE)"]:::warn
D5["SDD-B09 — DETECTION MODEL<br/>catches bulk · residual measured<br/>OOD accuracy decays under adaptation"]:::warn
D6["HARNESS SCOPE GATE — THE FLOOR<br/>disallowed action blocked<br/>DETERMINISTIC — the adversary's planning<br/>finds nothing to adapt against"]:::teal
D1 --> D2 --> D3 --> D4 --> D5 --> D6
end
HOLD["THE ARCHITECTURE THAT HOLDS<br/>the adversary can plan, dispatch, rectify, and scale<br/>and the final action is still gated by a rule<br/>the model cannot reach"]:::teal
STACK --> HOLD
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
classDef warn fill:#14141f,stroke:#f0a868,stroke-width:1.5px,color:#e4e4e8
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style OFF fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style STACK fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
style D1 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D2 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D3 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D4 fill:#101018,stroke:#f0a868,color:#e4e4e8
style D5 fill:#101018,stroke:#f0a868,color:#e4e4e8
style D6 fill:#101018,stroke:#5eead4,color:#5eead4
style HOLD fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
Note: The teal layers (deterministic) are the ones that hold. The warn layers (model-based: guardrails, detector) have residuals the adversary's adaptive machinery exploits. The architecture works because the deterministic layers bound the worst case and floor the composition — the adversary can exploit every model-based residual and the final action is still blocked by a scope gate with no evasion surface. This is why the course has returned, repeatedly, to the deterministic boundary: it is the only defense that does not decay while the adversary's tooling integrates.
# Diagrams — SDD-B10: Academic Offensive Harnesses (Adapted for AI-Target Attacks)
**Module**: SDD-B10 — Academic Offensive Harnesses
**Diagram count**: 5
**Tool**: Mermaid (primary). Each diagram validated in [Mermaid Live Editor](https://mermaid.live).
---
## Diagram 1 — The 2A-to-2B Inversion: Same Architecture, Different Target
**Type**: Comparison / inversion
**Purpose**: The foundational visual. In Course 2A, the academic offensive harnesses (PentestGPT, HPTSA, VulnBot, APT-Agent, CAI) were tools you USE for security work — LLM-driven agents automating pentests against traditional targets. In 2B, the lens inverts: the same harnesses are methodologies for ATTACKING AI systems. The transfer is structural, not analogical — the architectures (planning, decomposition, rectification, scale) are target-agnostic. Swap the target from "web server" to "agent with an injection surface" and the same machinery runs.
**Reading the diagram**: Two rows. The top (2A) is the defender's tool; the bottom (2B) is the attacker's methodology. The middle bar marks the inversion: the architecture is identical, only the target changes. The teal callout is the load-bearing point — the transfer is structural.
```mermaid
flowchart TB
subgraph A2["COURSE 2A — tools FOR security work"]
direction LR
T1["TARGET: network / web app / contract<br/>traditional infrastructure"]
A1["ARCHITECTURE<br/>reasoning loop · hierarchy<br/>multi-agent · rectification · scale"]
R1["RESULT: find vulns faster<br/>defender's assistant"]
T1 --> A1 --> R1
end
INVERT["THE INVERSION<br/>same architecture — target swapped<br/>from 'web server with a zero-day'<br/>to 'agent with an injection surface'<br/>the machinery runs unchanged"]:::teal
subgraph B2["COURSE 2B — methodologies for ATTACKING AI systems"]
direction LR
T2["TARGET: agent / model / harness<br/>the AI system itself"]
A2["ARCHITECTURE (identical)<br/>reasoning loop · hierarchy<br/>multi-agent · rectification · scale"]
R2["RESULT: automated multi-step<br/>injection chains · the threat model"]
T2 --> A2 --> R2
end
A2 --> INVERT
INVERT -.->|"structural, not analogical"| A1
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
style A2 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style B2 fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style A1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style T1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style R1 fill:#101018,stroke:#82e0aa,color:#e4e4e8
style T2 fill:#101018,stroke:#f08080,color:#e4e4e8
style A2 fill:#101018,stroke:#f08080,color:#e4e4e8
style R2 fill:#101018,stroke:#f08080,color:#e4e4e8
style INVERT fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```
> **Note**: The transfer is not a metaphor. PentestGPT's reasoning loop, HPTSA's hierarchy, VulnBot's collaboration, APT-Agent's rectification, and CAI's speed are general solutions to "automated, multi-step, reasoning-heavy exploration of an attack surface." The AI-system attack surface is one such surface. The same code, retargeted, attacks it.
---
## Diagram 2 — The Academic Landscape: Five Papers, Five Contributions
**Type**: Landscape / taxonomy
**Purpose**: The survey visual. Each paper contributed one capability to the offensive frontier: PentestGPT the reasoning loop, HPTSA the hierarchy, VulnBot the collaboration, APT-Agent the rectification, CAI the speed. Read as a trajectory, the literature points toward an integrated offensive harness for AI targets — assembleable from open components. Each paper carries its arXiv ID for primary-source traceability.
**Reading the diagram**: Five cards, each with the paper, its contribution, and its AI-target transfer. The arrow at the bottom marks the trajectory: the composition is the threat.
```mermaid
flowchart LR
PTG["PENTESTGPT<br/>USENIX Sec 2024<br/>three-module reasoning loop<br/>(parse · reason · generate)"]:::teal
HPT["HPTSA<br/>arXiv:2406.01637<br/>hierarchical planning<br/>planner → sub-agents"]:::teal
VUL["VULNBOT<br/>arXiv:2501.13411<br/>multi-agent collaboration<br/>recon · vuln · exploit"]:::teal
APT["APT-AGENT<br/>arXiv:2605.24949<br/>rectification on failure<br/>read error → refine"]:::teal
CAI["CAI<br/>arXiv:2504.06017<br/>speed · 156x faster<br/>high-volume"]:::teal
PTG -.->|"transfer: injection-chain planning"| T1["automated reasoning<br/>over the agent's state"]:::danger
HPT -.->|"transfer: zero-click chain"| T2["planner dispatches<br/>chain steps to crafters"]:::danger
VUL -.->|"transfer: distributed probing"| T3["one agent per surface<br/>(retrieval · tool · guardrail)"]:::danger
APT -.->|"transfer: adaptive evasion"| T4["refine payload against<br/>detector response (SDD-B09)"]:::danger
CAI -.->|"transfer: high-volume attack"| T5["sweep the surface at scale<br/>find the residual fast"]:::danger
COMP["THE COMPOSITION<br/>planning + hierarchy + collaboration<br/>+ rectification + scale<br/>= an integrated offensive harness<br/>for AI targets — assembleable from open components"]:::danger
T1 & T2 & T3 & T4 & T5 --> COMP
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style PTG fill:#101018,stroke:#5eead4,color:#e4e4e8
style HPT fill:#101018,stroke:#5eead4,color:#e4e4e8
style VUL fill:#101018,stroke:#5eead4,color:#e4e4e8
style APT fill:#101018,stroke:#5eead4,color:#e4e4e8
style CAI fill:#101018,stroke:#5eead4,color:#e4e4e8
style COMP fill:#14141f,stroke:#f08080,stroke-width:2px,color:#f08080
```
> **Note**: No single paper is an integrated AI-target offensive harness. But each contributed a component, the components are open-source, and the barrier to composing them is falling. The threat is not a single super-tool; it is the commoditization of the components and the convergence of their integration.
---
## Diagram 3 — HPTSA's Hierarchical Planning → The Zero-Click Chain
**Type**: Architecture mapping
**Purpose**: The most important transfer in the deep-dive. HPTSA's planner-dispatches-to-specialized-sub-agents architecture is the blueprint for the zero-click injection chain. The chain is a multi-step attack where no single step suffices: poison retrieval, trigger retrieval, manipulate tool call, exfiltrate. A human scripting this by hand is slow and brittle; an HPTSA-style planner decomposes the objective and dispatches each step to a focused sub-agent. This is why the zero-click chain is now automatable.
**Reading the diagram**: The planner at the top holds the global strategy. It dispatches four sub-tasks to specialized sub-agents, each informed by the prior step's result. The chain flows top-to-bottom; each step is a focused payload crafter. The teal planner is HPTSA's contribution; the danger steps are the chain.
```mermaid
flowchart TB
PLAN["HPTSA PLANNER (the orchestrator)<br/>global strategy: exfiltration via the tool surface<br/>decomposes objective → dispatches sub-tasks<br/>maintains state across steps"]:::teal
S1["SUB-AGENT 1: plant the payload<br/>craft an indirect injection<br/>insert into a doc the agent will retrieve<br/>(SDD-B03 indirect injection)"]:::danger
S2["SUB-AGENT 2: trigger retrieval<br/>craft a benign-seeming query<br/>that causes the agent to fetch the poisoned doc"]:::danger
S3["SUB-AGENT 3: manipulate the tool call<br/>the retrieved payload instructs the agent<br/>to call the exfil tool with the sensitive path<br/>(SDD-B04 function-call manipulation)"]:::danger
S4["SUB-AGENT 4: exfiltrate<br/>the tool call executes<br/>sensitive data leaves via the tool surface"]:::danger
PLAN -->|"dispatch"| S1
S1 -->|"payload planted"| S2
S2 -->|"retrieval triggered"| S3
S3 -->|"tool call manipulated"| S4
S4 -.->|"result feeds back"| PLAN
GATE["HARNESS SCOPE GATE (the deterministic floor)<br/>even when the chain succeeds,<br/>the disallowed action is BLOCKED<br/>no evasion surface — the adversary's<br/>planning finds nothing to adapt against"]:::teal
S4 -.->|"disallowed action"| GATE
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style PLAN fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
style S1 fill:#101018,stroke:#f08080,color:#e4e4e8
style S2 fill:#101018,stroke:#f08080,color:#e4e4e8
style S3 fill:#101018,stroke:#f08080,color:#e4e4e8
style S4 fill:#101018,stroke:#f08080,color:#e4e4e8
style GATE fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```
> **Note**: The hierarchy is what makes the chain navigable. A single agent holding the entire chain in context gets lost in the state space; the planner-sub-agent decomposition keeps each step focused. The harness scope gate at the bottom is the defense — the chain can succeed at every model-based layer and the final action is still blocked by a rule the adversary cannot reach.
---
## Diagram 4 — Technique Transfer: Each Academic Contribution → AI-Target Vector
**Type**: Mapping matrix
**Purpose**: The technique-by-technique transfer. Each academic contribution maps to a specific AI-target attack vector: PentestGPT's reasoning loop to injection-chain planning, HPTSA's hierarchy to the zero-click chain, VulnBot's collaboration to distributed multi-surface probing, APT-Agent's rectification to adaptive detector evasion, CAI's speed to high-volume attack and measurement. The mapping is structural — the technique solves the same problem on a different surface.
**Reading the diagram**: Left column = academic contribution; right column = AI-target vector. The arrows mark the transfer. Note that APT-Agent's rectification connects directly to SDD-B09's cat-and-mouse dynamic — the automated evasion engine.
```mermaid
flowchart LR
subgraph ACAD["ACADEMIC CONTRIBUTION"]
direction TB
A1["PENTESTGPT<br/>reasoning loop<br/>(parse · reason · generate)"]
A2["HPTSA<br/>hierarchical planning<br/>(planner → sub-agents)"]
A3["VULNBOT<br/>multi-agent collaboration<br/>(recon · vuln · exploit)"]
A4["APT-AGENT<br/>rectification<br/>(read failure → refine)"]
A5["CAI<br/>speed (156x)<br/>(high-volume)"]
end
subgraph AIT["AI-TARGET ATTACK VECTOR"]
direction TB
V1["INJECTION-CHAIN PLANNING<br/>reason over the agent's state<br/>decide the next injection step"]
V2["ZERO-CLICK CHAIN<br/>planner dispatches chain steps<br/>to specialized payload crafters"]
V3["DISTRIBUTED MULTI-SURFACE PROBING<br/>one agent per surface<br/>(retrieval · tool · guardrail)"]
V4["ADAPTIVE DETECTOR EVASION<br/>probe detector → refine payload<br/>→ sit in false-negative region<br/>(SDD-B09 cat-and-mouse, automated)"]
V5["HIGH-VOLUME ATTACK + MEASUREMENT<br/>sweep the surface at scale<br/>find the residual fast"]
end
A1 --> V1
A2 --> V2
A3 --> V3
A4 --> V4
A5 --> V5
style ACAD fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
style AIT fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style A1 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A2 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A3 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A4 fill:#101018,stroke:#5eead4,color:#e4e4e8
style A5 fill:#101018,stroke:#5eead4,color:#e4e4e8
style V1 fill:#101018,stroke:#f08080,color:#e4e4e8
style V2 fill:#101018,stroke:#f08080,color:#e4e4e8
style V3 fill:#101018,stroke:#f08080,color:#e4e4e8
style V4 fill:#101018,stroke:#f08080,color:#e4e4e8
style V5 fill:#101018,stroke:#f08080,color:#e4e4e8
```
> **Note**: APT-Agent's rectification (A4 → V4) is the bridge to SDD-B09. The cat-and-mouse dynamic — where the detector's out-of-distribution accuracy decays under adaptive pressure — is driven by rectification machinery. The attacker is not static; the detector's surface is probed and the payload is refined. The defender who measures only against static traffic is measuring against an adversary who no longer exists.
---
## Diagram 5 — The Defense Thesis as the Response to the Offensive Frontier
**Type**: Synthesis / thesis
**Purpose**: The course-closing visual. The adversary now has hierarchical planning (HPTSA), multi-agent collaboration (VulnBot), adaptive rectification (APT-Agent), and scale (CAI). The defenses that hold are the ones the course built: the scope gate (B0), defense-in-depth (B2), the deterministic boundary (SDD-B05), external guardrails (SDD-B08), the measured detector (SDD-B09). The deterministic layers — the boundary and the scope gate — are what hold when every model-based layer's residual is exploited, because they have no evasion surface for the adversary's adaptive machinery to find.
**Reading the diagram**: The offensive frontier at the top (danger); the defense stack at the bottom (teal = deterministic, no evasion surface; warn = model-based, residual exists). The scope gate is the floor. The adversary can plan, dispatch, rectify, and scale — and the final action is still gated by a rule the model cannot reach.
```mermaid
flowchart TB
subgraph OFF["THE OFFENSIVE FRONTIER (the adversary now has)"]
direction LR
O1["HIERARCHY<br/>HPTSA planning"]:::danger
O2["COLLABORATION<br/>VulnBot multi-agent"]:::danger
O3["RECTIFICATION<br/>APT-Agent adaptation"]:::danger
O4["SCALE<br/>CAI 156x speed"]:::danger
end
OFF -->|"attacks"| STACK
subgraph STACK["THE DEFENSE STACK (the course's thesis)"]
direction TB
D1["B0 — SCOPE FILE + PROVIDER-AUTH GATE<br/>legal/engineering control plane<br/>DETERMINISTIC — rule the adversary cannot talk out of"]:::teal
D2["B2 — DEFENSE-IN-DEPTH<br/>no single layer suffices<br/>composition bounds the residual"]:::teal
D3["SDD-B05 — IRONCURTAIN<br/>the deterministic boundary<br/>NO EVASION SURFACE"]:::teal
D4["SDD-B08 — NEMO GUARDRAILS<br/>externally evaluated<br/>stops DISABLE (residual: EVADE)"]:::warn
D5["SDD-B09 — DETECTION MODEL<br/>catches bulk · residual measured<br/>OOD accuracy decays under adaptation"]:::warn
D6["HARNESS SCOPE GATE — THE FLOOR<br/>disallowed action blocked<br/>DETERMINISTIC — the adversary's planning<br/>finds nothing to adapt against"]:::teal
D1 --> D2 --> D3 --> D4 --> D5 --> D6
end
HOLD["THE ARCHITECTURE THAT HOLDS<br/>the adversary can plan, dispatch, rectify, and scale<br/>and the final action is still gated by a rule<br/>the model cannot reach"]:::teal
STACK --> HOLD
classDef teal fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#5eead4
classDef warn fill:#14141f,stroke:#f0a868,stroke-width:1.5px,color:#e4e4e8
classDef danger fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#f08080
style OFF fill:#14141f,stroke:#f08080,stroke-width:1.5px,color:#e4e4e8
style STACK fill:#14141f,stroke:#5eead4,stroke-width:1.5px,color:#e4e4e8
style D1 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D2 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D3 fill:#101018,stroke:#5eead4,color:#e4e4e8
style D4 fill:#101018,stroke:#f0a868,color:#e4e4e8
style D5 fill:#101018,stroke:#f0a868,color:#e4e4e8
style D6 fill:#101018,stroke:#5eead4,color:#5eead4
style HOLD fill:#14141f,stroke:#5eead4,stroke-width:2px,color:#5eead4
```
> **Note**: The teal layers (deterministic) are the ones that hold. The warn layers (model-based: guardrails, detector) have residuals the adversary's adaptive machinery exploits. The architecture works because the deterministic layers bound the worst case and floor the composition — the adversary can exploit every model-based residual and the final action is still blocked by a scope gate with no evasion surface. This is why the course has returned, repeatedly, to the deterministic boundary: it is the only defense that does not decay while the adversary's tooling integrates.