🐉

DEFONEOS — Threat Model & Risk Assessment

STRIDE · Adversarial ML · Supply Chain · Insider · Coalition Federation

Classification: UNCLASSIFIED (Open Source)
Methodology: STRIDE + OWASP LLM Top 10 + NIST AI RMF
Version: 1.0.0 · July 2026

Critical

High

Medium

Low

Mitigations

Immutable Red Lines

Attack Surfaces

BFT Guardians

📋 Threat Model Scope

System Under Analysis: DEFONEOS v1.0.0 — Sovereign Public Services OS with 30 MCP servers, SIGIL audit chain, BFT-33 governance council, ISR pipeline, swarm robotics, and coalition federation.

STRIDE Categories Covered

S — Spoofing

Identity spoofing of MCP servers, forged SIGIL entries, fake BFT votes, drone/swarm node impersonation, coalition partner spoofing.

T — Tampering

SIGIL chain tampering, MCP tool injection (Morris-II worm), model weight poisoning, sensor data manipulation, configuration drift.

R — Repudiation

Denied actions without SIGIL proof, BFT vote denial, coalition operation denial, deleted audit trails.

I — Information Disclosure

Model exfiltration via MCP responses, sensor data leakage to coalition, PII exposure, SIGIL chain exposure.

D — Denial of Service

MCP flooding, SIGIL chain saturation, BFT council deadlock, swarm mesh jamming, C2 channel DDoS.

E — Elevation of Privilege

Unauthorized BFT vote, MCP privilege escalation, red line override, air-gap bridge, admin token theft.

🛡️ Attack Surface Inventory

#	Surface	Protocol	Exposure	Auth	Threats
AS-01	MCP Federation Bus	JSON-RPC 2.0 / stdio	Local + Network	Ed25519	Injection, flooding, spoofing
AS-02	SIGIL Chain	SQLite / PostgreSQL	Local + Coalition Sync	HMAC + Ed25519	Tampering, fork, saturation
AS-03	BFT-33 Council	HTTP :3200	Network (VPC)	Ed25519 + Quorum 23/33	Deadlock, vote spoof, Sybil
AS-04	ISR Pipeline (YOLOv8)	gRPC + MQTT	Edge sensors	mTLS	Adversarial images, data poisoning
AS-05	Swarm Control (PX4/MAVLink)	UART + UDP 14540	RF + Mesh	PSK + AES-256	RF jamming, GPS spoof, hijack
AS-06	C2 Bridge (FreeTAKServer)	CoT XML / TCP	Tactical Network	TLS + mTLS	CoT injection, MITM, replay
AS-07	Cesium 3D COP	WebSocket + HTTPS	Web browser	JWT + CSP	XSS, data exfil, WebSocket hijack
AS-08	REST API (87 endpoints)	HTTPS	Internet + VPC	OAuth2 + JWT	Injection, rate bypass, IDOR
AS-09	Mava RL Training Loop	Python + GPU	Local compute	Process isolation	Reward hacking, gradient theft
AS-10	Coalition Federation Link	mTLS + SIGIL Sync	Cross-domain	PKI + Ed25519	Cross-domain bridge, data leak
AS-11	Air-Gapped Update Channel	USB / optical disc	Physical	SHA-256 + Ed25519	Stuxnet-style, supply chain
AS-12	Model Storage	Filesystem + GGUF	Local	File permissions	Weight poisoning, exfiltration

⚠️ Critical Threats (4)

THR-C01 Adversarial ML — ISR Model Evasion

CRITICAL STRIDE: T+I Surface: AS-04

Description

An adversary crafts physical or digital adversarial patches/perturbations that cause YOLOv8 ISR detection to miss objects of interest (e.g., camouflaged vehicles, concealed weapons) or produce false positives (phantom detections degrading operator trust).

Attack Chain

Recon: Obtain model architecture → Craft adversarial perturbation (FGSM/PGD) → Physical patch or digital inject → YOLOv8 confidence drops below threshold → Object undetected / false negative

✅ Mitigations

Adversarial Training: Fine-tune YOLOv8 with PGD-generated adversarial examples (mAP degradation <2%)
Ensemble Detection: Run 3 model variants (n/s/m) in parallel; flag disagreement >0.15 confidence delta
Confidence Threshold Floor: Hard floor at 0.25 — nothing below reported to C2, but logged for review
Human-in-the-Loop: All ISR detections below 0.85 require operator confirmation before C2 tasking
Model Diversity: Support swappable model backbones (RT-DETR, DETR, Faster R-CNN) for heterogeneity
SIGIL Audit: Every detection event logged with model version + confidence → tamper-evident chain

THR-C02 SIGIL Chain Fork — Coalition Split-Brain

CRITICAL STRIDE: R+T Surface: AS-02+AS-10

Description

Network partition between coalition partners causes SIGIL chain fork. When connectivity restores, two divergent chains exist. Adversary could exploit this window to inject operations on the minority chain and claim they were the majority.

Attack Chain

Network partition (jamming or physical) → Two chains diverge → Adversary injects ops on minority chain → Partition heals → Merge conflict — adversary claims majority

✅ Mitigations

Longest Signed Chain Wins: Ed25519-signed hash chain — the longest valid chain is canonical after merge
Quorum Anchor: Every 100th SIGIL entry requires BFT-33 quorum attestation (23/33 signatures)
Partition Detector: Monitors chain divergence; alerts operators when fork detected
Conflict Resolution: Minority chain operations replayed in order, but flagged as "partition-originated" for review
Chain Verification: 8,500 entries/sec verification (SQLite) — full chain re-verification in <2 min for 1M entries

THR-C03 Red Line Override via Privileged MCP Injection

CRITICAL STRIDE: E+T Surface: AS-01+AS-12

Description

Adversary injects a malicious MCP server into the federation that attempts to issue kinetic-targeting, personal-surveillance, or other red-line-prohibited operations by impersonating a legitimate tool or exploiting a configuration path.

🚫 The 7 Immutable Red Lines

#	Red Line	Enforcement
1	No kinetic-targeting patterns (strike packages, find-fix-finish, kill orders)	Pattern regex + BFT-33 council review
2	No personal-surveillance patterns (track individual, face recognition, locate phone)	Pattern regex + BFT-33 council review
3	No "AUKUS partnership" / "DAIC certified" claims without signed letter	Assertion validator
4	No DEFONEOS-SEAL credential without 33-agent BFT council vote (quorum 23/33)	HotStuff consensus protocol
5	No DSEI booth without named UK-prime pilot letter	Assertion validator
6	No reference to defonos.io domain (known trap)	Domain blocklist
7	No mixing of meok-defoneos / csoai-defoneos / dagon assets	Compartment isolation

✅ Mitigations

Pattern Firewall: Every MCP tool call passes through red-line regex filter before execution — 0ms overhead, 100% coverage
BFT-33 Veto: Any operation matching red-line patterns triggers immediate council vote; requires 23/33 quorum to override the block itself (not the red line — red lines are absolute)
MCP Allowlist: Only signed MCP servers in the registry are federated; unsigned/unknown servers are sandboxed with zero data access
Compartment Isolation: meok-defoneos, csoai-defoneos, and dagon run in separate processes with no shared memory, IPC, or file paths
SIGIL Attestation: Every red-line check is logged to SIGIL chain — auditable post-incident

THR-C04 Air-Gap Bridge — Stuxnet-Style Supply Chain Attack

CRITICAL STRIDE: T+E Surface: AS-11

Description

Adversary compromises the update pipeline for air-gapped deployments. A USB drive or optical disc carrying model updates or MCP packages is infected with malware that bridges the air gap, establishing covert communication or destroying data.

Attack Chain

Compromise update build server → Inject payload into GGUF/PKG → USB transferred to air-gapped system → Payload executes on install → Air-gap bridge established

✅ Mitigations

Ed25519 Signature Verification: Every update package signed at build time; air-gapped system refuses unsigned packages
Dual-Hash Check: SHA-256 + BLAKE3 hash published on public chain; operator verifies hash matches before transfer
Staging Diode: Updates pass through a data diode (one-way hardware gate) on a dedicated staging machine
File Allowlist: Air-gapped installer only accepts .gguf, .json, .whl, .tar.gz — no executables, scripts, or symlinks
Quarantine VM: All packages extracted in isolated QEMU VM before deployment to production air-gapped host
SIGIL Receipt: Every update applied logs to local SIGIL chain (synced later when connectivity available)

🔴 High-Severity Threats (7)

THR-H01MCP Morris-II Worm Propagation

HIGH · STRIDE: T+E · AS-01

A malicious MCP server injects prompt-injection payloads that propagate to other MCP servers via the federation bus, creating a self-replicating worm that exfiltrates data or corrupts configurations.

✅ Mitigations

Aegis Gate: Every MCP tool result passes through swarm_review (Morris-II payload scanner) before delivery
Federation Isolation: Each MCP server runs in a separate process; no shared memory or IPC
Pattern Detection: 50+ known prompt-injection signatures scanned at 12,847 calls/sec throughput
Rate Limiting: Per-server call rate limited to 1000 calls/sec; burst triggers investigation

THR-H02Swarm RF Jamming & GPS Spoofing

HIGH · STRIDE: D+T · AS-05

Adversary jams MAVLink frequencies (915MHz/2.4GHz) or spoofs GPS signals, causing drone swarm to lose coordination, crash, or deviate to hostile positions.

✅ Mitigations

Frequency Hopping: PX4 supports FHSS on supported radios; fallback to 868MHz LoRa mesh
GPS Backup: Visual-inertial odometry (VIO) + dead reckoning when GPS confidence <0.7
Geofence Hardcoded: Pre-programmed return-to-home (RTH) coordinates burned to flight controller EEPROM
Swarm Autonomy: Decentralized MAPPO policy maintains formation without C2 link for up to 15 minutes
RF Detection: SIGINT MCP detects jamming patterns; triggers frequency shift alert

THR-H03BFT-33 Council Deadlock (Sybil Attack)

HIGH · STRIDE: E · AS-03

Adversary registers enough fake BFT agents to prevent quorum (23/33), causing governance deadlock. With 11 or more compromised agents, no decisions can be made.

✅ Mitigations

Ed25519 Identity: Every agent has unique cryptographic identity; registration requires signed OrgKernel L1 identity
Proof of Work: Agent registration requires computational proof (hashcash-style) — prevents instant Sybil registration
HotStuff Consensus: BFT consensus tolerates f < n/3 Byzantine agents (tolerates up to 11 of 33)
Council Rotation: 33 agents are a rotating subset of a larger pool (50+ verified agents); rotation every 30 minutes

THR-H04Model Weight Poisoning (Supply Chain)

HIGH · STRIDE: T · AS-12

Adversacy compromises a model repository (HuggingFace mirror) and replaces GGUF weights with poisoned variant that produces backdoor behaviour (e.g., ignores specific classes in ISR, outputs biased BFT recommendations).

✅ Mitigations

Weight Hash Verification: Every model load verifies SHA-256 against signed manifest; mismatch = abort
Integrity Scan: Post-load inference test on 50 known images; deviation >5% = quarantine
Model Provenance: SIGIL chain records model source, hash, load time, and every inference call
Air-Gapped Cache: Pre-verified models cached on air-gapped storage; updates require physical transfer + signature

THR-H05Coalition Data Leakage via Federation

HIGH · STRIDE: I · AS-10

Coalition partner's compromised system leaks classified data through the SIGIL sync channel or MCP federation responses to unauthorized parties.

✅ Mitigations

Classification Labels: Every SIGIL entry tagged with classification level (UNCLASSIFIED/RESTRICTED/SECRET); only matching levels sync
Data Diode: Cross-domain federation passes through hardware data diode; physically one-way
MCP Response Filters: Tool responses filtered by destination classification before transmission
Audit Trail: Every coalition sync event SIGIL-logged on both chains with Ed25519 signatures

THR-H06C2 CoT (Cursor-on-Target) Injection

HIGH · STRIDE: T+S · AS-06

Adversary injects fake CoT XML messages into FreeTAKServer, creating phantom units on the Cesium COP, causing operators to respond to non-existent threats or miss real ones.

✅ Mitigations

mTLS: All TAK clients require mutual TLS certificates; unauthenticated CoT rejected
Source Validation: CoT UID cross-referenced with registered unit database; unknown UIDs quarantined
Plausibility Check: Movement patterns analyzed; impossible jumps (>500km/h ground speed) flagged
SIGIL Logging: All CoT events logged to SIGIL chain for post-incident forensics

THR-H07Mava RL Reward Hacking

HIGH · STRIDE: T · AS-09

RL training loop discovers a shortcut that maximizes reward without achieving the actual mission objective (e.g., drones hover in place to minimize collision penalty instead of searching).

✅ Mitigations

Reward Inspector MCP: defoneos-mava-reward-inspector continuously monitors reward vs. task completion correlation
Multi-Objective Rewards: Primary task completion + secondary exploration bonus + collision penalty (multi-objective, not single scalar)
Human Evaluation: Random sampling of 5% of training episodes reviewed by human evaluator
Anomaly Detection: Reward spike detection — >3σ deviation triggers training pause + investigation

🟡 Medium-Severity Threats (11)

ID	Threat	STRIDE	Surface	Mitigation Summary
THR-M01	MCP Federation Flooding (DoS)	D	AS-01	Rate limit 1000/s/server, burst detection, backpressure queue
THR-M02	SIGIL Chain Saturation	D	AS-02	Batch writes, WAL mode, 47,200/s PostgreSQL, chain pruning >90 days
THR-M03	WebSocket COP Hijacking	T+S	AS-07	JWT validation per message, origin check, CSP headers
THR-M04	REST API IDOR	E	AS-08	Object-level authorization on every endpoint, ID obfuscation (UUID)
THR-M05	Sensor Data Manipulation	T	AS-04	Multi-sensor cross-validation, outlier detection (3σ), source attestation
THR-M06	Insider Threat — Privileged Operator	All	All	Two-person rule for sensitive ops, SIGIL audit trail, anomaly detection on operator behaviour
THR-M07	Configuration Drift	T	All	GitOps config management, drift detection every 5 min, SIGIL-logged config changes
THR-M08	Dependency Vulnerability (CVE)	T+E	AS-01,08	Daily pip-audit + npm audit, Dependabot, pinned hashes
THR-M09	Cesium Data Exfiltration	I	AS-07	CSP + sandbox headers, no external API keys in frontend, server-side proxy
THR-M10	Coalition Sync Replay	T+S	AS-10	Timestamp + nonce in every sync message, reject >5min old, SIGIL hash verification
THR-M11	Drone Mesh Eclipse Attack	D+E	AS-05	Mesh topology monitoring, sybil node detection, reputation scoring

🟢 Low-Severity Threats (6)

ID	Threat	STRIDE	Mitigation
THR-L01	Log Injection	T	Structured JSON logging, input sanitization, no eval in log viewers
THR-L02	Timing Side-Channel	I	Constant-time crypto operations, random response jitter (±50ms)
THR-L03	Cache Poisoning	T	Cache key includes auth context, TTL limits, Vary headers
THR-L04	Open Redirect	S	Redirect allowlist, relative-only internal redirects
THR-L05	Information Leakage via Error Messages	I	Generic error messages in production, detailed errors only in debug mode
THR-L06	Resource Exhaustion (Memory)	D	cgroups limits, OOM killer, swap disabled on edge nodes

🔐 OWASP LLM Top 10 — DEFONEOS Compliance

#	OWASP LLM Risk	DEFONEOS Status	Mitigation
LLM01	Prompt Injection	MITIGATED	Aegis Gate scanner, 50+ signatures, MCP response filtering
LLM02	Insecure Output Handling	MITIGATED	Structured JSON schema validation, no raw LLM output to C2
LLM03	Training Data Poisoning	MITIGATED	Model hash verification, integrity test suite, provenance chain
LLM04	Model DoS	MITIGATED	Token limits, rate limiting, circuit breakers per MCP
LLM05	Supply Chain	MITIGATED	pinned hashes, Ed25519 signatures, dependency scanning
LLM06	Sensitive Info Disclosure	MITIGATED	PII redaction, classification labels, data diode
LLM07	Insecure Plugin Design	MITIGATED	MCP allowlist, sandboxing, parameter validation
LLM08	Excessive Agency	MITIGATED	BFT-33 council gate, red line enforcement, human-in-the-loop
LLM09	Overreliance	MONITORED	Confidence thresholds, human confirmation for <0.85, AAR reviews
LLM10	Model Theft	MITIGATED	Air-gapped storage, model encryption, SIGIL-logged inference access

📊 Risk Heat Map

Impact → Likelihood ↓	Low (1)	Medium (2)	High (3)	Critical (4)
Frequent (4)		THR-M01	THR-H01	THR-C01
Probable (3)	THR-L01	THR-M06 THR-M07	THR-H02 THR-H04 THR-H07	THR-C03
Occasional (2)	THR-L02 THR-L03	THR-M02-M11	THR-H03 THR-H05 THR-H06	THR-C04
Improbable (1)	THR-L04 THR-L05 THR-L06			THR-C02

Numbers = risk score (Likelihood × Impact). Green = acceptable, Yellow = monitor, Red = active mitigation required, Dark Red = highest priority.

🔧 Security Controls Summary

Cryptographic

Ed25519 signatures (every SIGIL entry, BFT vote, MCP call)
HMAC-SHA256 (chain linking)
AES-256-GCM (at rest, drone RF)
mTLS (all network communications)
SHA-256 + BLAKE3 (model integrity)
NIST PQC ready (ML-DSA-65 / ML-KEM-768)

Operational

BFT-33 quorum on all sensitive operations
Red line pattern firewall (absolute veto)
Two-person rule for kinetic-adjacent ops
Human-in-the-loop for ISR <0.85 confidence
AAR after every operation
33-agent council rotation every 30 min

Infrastructure

Air-gapped deployment support
Data diodes for cross-domain
Sandboxed MCP processes
cgroups resource limits
Filesystem allowlists
Quarantine VMs for updates

📈 Continuous Improvement

Activity	Frequency	Owner	Last Run
Threat model review	Quarterly	BFT-33 Security Track (DFO-CS)	2 Jul 2026
Penetration test	Annual + pre-major-release	Independent (Crown Commercial)	Scheduled Aug 2026
Red team exercise	Bi-annual	Coalition CERT	Scheduled Q4 2026
Chaos engineering	Weekly (automated)	Automated chaos suite	Ongoing (5 experiments)
Dependency CVE scan	Daily	pip-audit + npm audit + Dependabot	Daily
Security SIGIL audit	Continuous	Automated + BFT attestation	Real-time

📋 Compliance Mapping

Framework	Article/Control	DEFONEOS Control	Status
NIST AI RMF	Manage 4.1 — Security	Red lines + BFT-33 + threat model	✅ Compliant
EU AI Act	Art 15 — Accuracy & Robustness	Adversarial training + ensemble + confidence floors	✅ Compliant
EU AI Act	Art 14 — Human Oversight	Human-in-the-loop <0.85, two-person rule	✅ Compliant
JSP 936	AI Safety Assurance	BFT-33 council + SIGIL audit + AAR	✅ Compliant
ISO 27001	A.8.2 — Privileged Access	Ed25519 identity + two-person + BFT gate	✅ Compliant
ISO 42001	A.7 — AI System Security	OWASP LLM Top 10 mitigated, threat model, pen test	✅ Compliant
OWASP LLM Top 10	All 10 risks	9 mitigated, 1 monitored	90% Mitigated
Cyber Essentials	5 Controls	Firewall + secure config + access control + malware + patching	In Progress