Opening — Why this matters now

Agentic AI is no longer a research toy but the skeleton key of modern automation pipelines. As enterprises rush to stitch together LLM-driven planners, tool callers, and multimodal agents, one truth becomes painfully clear: our security frameworks were built for software, not for software that thinks. STRIDE, the trusted stalwart of threat modeling, was never meant to grapple with prompt injections, hallucinated tool invocations, or inter-agent influence loops.

Enter ASTRIDE. A framework that does what STRIDE cannot: treat AI agents as first-class security risks, not decorative extensions of deterministic code. And more importantly, automate the entire threat modeling process—from raw architecture diagram to threat report—using a consortium of fine-tuned VLMs and a reasoning LLM.

Background — Context and prior art

Prior attempts to modernize threat modeling for ML systems typically fell into one of two camps:

  1. Text-based adaptations of STRIDE that sprinkled AI vocabulary on top of traditional categories.
  2. LLM-assisted analysis tools that generated plausible but shallow threat lists.

What none of them handled was the new attack surface introduced by agentic systems: interpretive reasoning layers, mutable context windows, opaque multi-agent communication, and free-form tool use. As the paper notes (see discussion on p.1-2) fileciteturn0file0, these systems behave, and therefore fail, differently.

ASTRIDE extends STRIDE with a seventh category — A: AI-Agent Specific Attacks — capturing:

  • prompt injection
  • context or memory poisoning
  • reasoning subversion
  • unsafe tool invocation
  • inter-agent manipulation

This isn’t a cosmetic upgrade. It’s a tectonic adjustment in how we define “threat” when the threat vector is the model’s reasoning, not merely its input.

Analysis — What ASTRIDE actually does

ASTRIDE introduces a full-stack, multimodal threat modeling pipeline:

1. Data Lake: The curated memory of visual threat patterns

A structured repository of system diagrams with annotated threat vectors (p.4-5) fileciteturn0file0. These diagrams—often rendered as flowcharts, Mermaid graphs, or data-flow diagrams—serve as the training substrate for VLMs that must learn to “see” threats embedded in architecture.

2. A consortium of fine‑tuned VLMs

Three vision-language models—Llama-Vision, Pix2Struct, and Qwen2-VL—are fine-tuned with QLoRA (p.12-13) fileciteturn0file0. Each model independently scans diagrams and outputs structured threat predictions. This distributed approach reduces single-model blind spots.

3. Reasoning via OpenAI-gpt-oss

Where VLMs detect, the reasoning LLM synthesizes. It reconciles conflicting outputs, prioritizes risks, and contextualizes threats based on architecture roles (p.7-8; p.11-12) fileciteturn0file0.

4. AI/LLM Agents as orchestrators

Agentic controllers manage all interactions, generate prompts, collect predictions, and feed the reasoning model (diagram p.8) fileciteturn0file0. The pipeline is, fittingly, agentic from start to finish.

Findings — Results with visualization

The paper’s evaluation shows a dramatic improvement in threat recognition after fine‑tuning.

Before vs. After Fine‑Tuning

From Figures 7 and 8 (p.16-18) fileciteturn0file0:

Model Before Fine-Tuning After Fine-Tuning
Llama-Vision Detected only prompt injection Detected prompt injection, context poisoning, unsafe tool invocation + mitigations
Pixtral-Vision Detected one reasoning subversion risk Detected multiple threats across NLU, memory, reasoning chain with actionable mitigations

The VLMs learned not just to see diagrams but to interpret interactions—exactly the leap traditional tools cannot make.

Training Behavior

The training and validation loss curves (Fig. 5 & 6, p.14-15) fileciteturn0file0 show mild overfitting but convergence consistent with small-domain fine-tuning.

Final Reasoning Layer Performance

OpenAI-gpt-oss refines and prioritizes the disparate VLM outputs, producing more complete threat models (Fig. 9, p.18-19) fileciteturn0file0.

ASTRIDE therefore acts as:

  • a visual interpreter of architecture,
  • a multimodal risk detector, and
  • a strategic reasoner synthesizing threats into an actionable model.

Implications — Why this matters for business and regulation

1. Compliance frameworks will need AI-native threat taxonomies

Regulators still think in OWASP and NIST categories. ASTRIDE suggests a future where models’ reasoning traces and context flows are regulated like APIs.

2. Enterprises adopting agents will face an exponentially larger attack surface

A single compromised prompt can cascade through planning, memory, and tool execution modules.

3. Diagram-driven, automated threat modeling changes DevSecOps economics

Security reviews scale with architecture complexity, not human bandwidth.

4. VLM + LLM reasoning will become a standard audit tool

Static code scanners will soon look as dated as antivirus signatures.

For organizations building agentic workflows—especially in finance, insurance, logistics, or critical infrastructure—the business implication is blunt: either you preemptively model these threats, or you discover them in production at far greater cost.

Conclusion — The road ahead

ASTRIDE is not merely a refinement of STRIDE. It’s a recognition that agency introduces a new behavioral layer—one that demands a new class of security analysis. By merging fine-tuned VLMs with a high‑reasoning LLM, the framework turns architectural diagrams into structured threat intelligence.

As agentic AI becomes the default interface for automation, tools like ASTRIDE will shift from optional to essential. STRIDE taught us what threats look like. ASTRIDE teaches us to recognize how AI creates new ones.

Cognaptus: Automate the Present, Incubate the Future.