# Diagrams — Module B13: Representation-Level Attacks

**Course**: 2B — Securing & Attacking Harnesses and LLMs · **Module**: B13 — Representation-Level Attacks: The Model as Attack Surface

Color coding (consistent with the course design system):
- `#5eead4` teal — the model's forward pass, legitimate controls, defensive path
- `#f0a868` warn — the representation layer (the new attack surface), dual-use tooling
- `#f08080` danger — attacks, tampering, the adversary's intervention
- `#9494a0` ink-secondary — annotations, supply-chain connections

---

## Diagram 1 — The Seven Surfaces, and the One No B-Module Covers

**Type**: layered diagram
**Purpose**: Show why B13 exists (RI-202). Six of the seven attack surfaces from B1 are covered by B2–B8. The seventh — the model itself, as an artifact with internal representations and weights — is the gap.

**Reading the diagram**: The seven surfaces from B1's threat model. Six have closing controls (B2 taint gate, B3 memory gate, B5 vault, B7 sandbox, B8 observability, B0/B1 scope and threat model). The seventh — the model layer — is shown in danger-red because no runtime control inspects it. This is the load-bearing gap.

```mermaid
flowchart TB
    classDef covered fill:#14141f,stroke:#5eead4,color:#e4e4e8
    classDef gap fill:#14141f,stroke:#f08080,color:#e4e4e8

    S1[Input layer<br/>the prompt]:::covered
    S2[Memory layer<br/>durable writes]:::covered
    S3[Tool layer<br/>dispatch + args]:::covered
    S4[Identity layer<br/>credentials + principals]:::covered
    S5[Sandbox layer<br/>bash execution]:::covered
    S6[Observability layer<br/>the event stream]:::covered
    S7[<b>The model layer<br/>weights + activations</b><br/>THE GAP — RI-202]:::gap

    S1 -.closed by.-> B2[B2 taint gate]
    S2 -.closed by.-> B3[B3 memory-write gate]
    S3 -.closed by.-> B5[B5 identity + permissions]
    S4 -.closed by.-> B5
    S5 -.closed by.-> B7[B7 sandbox]
    S6 -.closed by.-> B8[B8 observability]

    S7 -.no runtime control.-> X[(nothing in B2-B8<br/>inspects weights)]
```

---

## Diagram 2 — The Four Representation-Level Attack Classes

**Type**: quadrant / matrix
**Purpose**: Show the four attack classes organized by two dimensions — WHEN the intervention happens (training/distribution/inference) and WHAT is modified (weights/activations). Each class maps to an ATLAS tactic.

**Reading the diagram**: Two axes. Horizontal: weights vs. activations (what the adversary modifies). Vertical: persistent (training/distribution) vs. runtime (inference). The four quadrants are the four attack classes. Each class has its ATLAS home tactic noted.

```mermaid
flowchart TB
    classDef weights fill:#14141f,stroke:#f08080,color:#e4e4e8
    classDef acts fill:#14141f,stroke:#f0a868,color:#e4e4e8
    classDef label fill:#14141f,stroke:#9494a0,color:#9494a0

    subgraph WEIGHTS["MODIFY WEIGHTS (persistent)"]
        direction LR
        C2["CLASS 2 — Weight poisoning<br/>BadNets, trojans, sleeper agents<br/>survives fine-tuning<br/>ATLAS: Persistence TA0006"]:::weights
        C3["CLASS 3 — Checkpoint manipulation<br/>tampered .safetensors / .gguf<br/>.safetensors prevents code exec,<br/>NOT weight backdoors<br/>ATLAS: Persistence TA0006 + Supply Chain"]:::weights
    end

    subgraph ACTS["MODIFY ACTIVATIONS (runtime)"]
        direction LR
        C1["CLASS 1 — Activation steering<br/>CAA via forward hook<br/>abliteration = alignment removal<br/>ATLAS: Execution TA0005"]:::acts
        C4["CLASS 4 — Supply-chain trust<br/>the meta-class<br/>evil-twin fine-tunes, malicious LoRA<br/>ATLAS: Initial Access TA0003"]:::acts
    end

    LABEL["The four classes by dimension:<br/>WEIGHTS = persistent (training/distribution)<br/>ACTIVATIONS = runtime (inference)<br/>All four bypass B2-B8 (none inspect the model layer)"]:::label

    C2 -.survives.-> C3
    C1 -.dual of.-> C2
```

---

## Diagram 3 — CAA via Forward Hook: The Mechanism

**Type**: sequence / flow
**Purpose**: Show how Contrastive Activation Addition works mechanically — find the direction, install the hook, observe the effect. The same mechanism serves alignment (defensive) and abliteration (offensive).

**Reading the diagram**: Three phases left to right. Phase 1 (find the direction): collect activations on contrastive pairs, average the difference. Phase 2 (install the hook): register a forward hook at the chosen layer that adds/subtracts the scaled direction. Phase 3 (observe): the model's behavior changes. The warn-orange toggle shows the dual-use: add the direction = alignment (defense); subtract = abliteration (offense). The technique is identical; the sign of the scalar differs.

```mermaid
flowchart LR
    classDef phase fill:#14141f,stroke:#5eead4,color:#e4e4e8
    classDef attack fill:#14141f,stroke:#f08080,color:#e4e4e8
    classDef defense fill:#14141f,stroke:#82e0aa,color:#e4e4e8
    classDef note fill:#14141f,stroke:#9494a0,color:#9494a0

    subgraph P1["PHASE 1 — Find the direction"]
        direction TB
        P1A["collect activations<br/>on contrastive pairs<br/>(refuse vs comply)"]:::phase
        P1B["average the difference<br/>= the refusal direction"]:::phase
        P1A --> P1B
    end

    subgraph P2["PHASE 2 — Install the hook"]
        direction TB
        P2A["register forward hook<br/>at chosen layer"]:::phase
        P2B["hook adds/subtracts<br/>scaled direction<br/>to layer output"]:::phase
        P2A --> P2B
    end

    subgraph P3["PHASE 3 — Observe the effect"]
        direction TB
        P3A["ADD the direction<br/>= strengthen refusal<br/>DEFENSE (alignment)"]:::defense
        P3B["SUBTRACT the direction<br/>= suppress refusal<br/>OFFENSE (abliteration)"]:::attack
    end

    NOTE["The technique is identical.<br/>The sign of the scalar<br/>determines defense vs offense.<br/>C3 FT17 = add. B13 = subtract."]:::note

    P1 --> P2 --> P3
    P3 -.note.-> NOTE
```

---

## Diagram 4 — The Defense-in-Depth Stack for Checkpoints

**Type**: layered stack
**Purpose**: Show the four-layer defense for model checkpoints — provenance, integrity, pre-deployment evaluation, runtime monitoring. Each layer catches a different attack class.

**Reading the diagram**: Four layers, bottom to top. Each layer names the control, the attack class it catches, and the curriculum artifact that implements it. No single layer catches everything; the stack is defense-in-depth.

```mermaid
flowchart TB
    classDef layer fill:#14141f,stroke:#5eead4,color:#e4e4e8
    classDef note fill:#14141f,stroke:#9494a0,color:#9494a0

    L4["LAYER 4 — Runtime monitoring<br/>B8 observability watches for backdoor-trigger patterns<br/>catches: Class 1 (activation steering) + Class 2 (triggered backdoors in prod)"]:::layer
    L3["LAYER 3 — Pre-deployment evaluation<br/>trigger-phrase probing + weight-distribution analysis + behavioral eval<br/>catches: Class 2 (weight poisoning) + Class 3 (tampered checkpoints)"]:::layer
    L2["LAYER 2 — Integrity<br/>verify checkpoint hash over weight tensors (not just the file)<br/>catches: Class 3 (checkpoint tampering in transit/at rest)"]:::layer
    L1["LAYER 1 — Provenance<br/>record who trained it, on what data, with what post-training<br/>catches: Class 4 (supply-chain trust failures) — the AI BOM (B11.2)"]:::layer

    L1 --> L2 --> L3 --> L4

    NOTE["No single layer catches everything.<br/>Layer 1 (provenance) is the foundation —<br/>without it, the other layers have nothing to verify against.<br/>.safetensors provides integrity (Layer 2 partial) but not benignity."]:::note
    L4 -.-> NOTE
```

---

## Diagram 5 — The C3 FT17 / B13 Bridge: The Same Technique, Two Readings

**Type**: side-by-side comparison
**Purpose**: Show the load-bearing bridge between C3 FT17 (abliteration as alignment tool) and B13 (abliteration as attack). The identical technique read two ways. This is the curriculum's defense-in-depth for the representation layer.

**Reading the diagram**: Two columns. Left: C3 FT17 (Course 3, the builder's view). Right: B13 (Course 2B, the adversary's view). The middle row is the shared technique. The bottom rows are the differing framings. The arrow between them is the "you cannot defend a surface you do not understand" claim.

```mermaid
flowchart LR
    classDef c3 fill:#14141f,stroke:#5eead4,color:#e4e4e8
    classDef b13 fill:#14141f,stroke:#f08080,color:#e4e4e8
    classDef shared fill:#1a2a26,stroke:#5eead4,color:#e4e4e8

    subgraph C3["C3 FT17 — The Builder"]
        direction TB
        C3A["GOAL: alignment control<br/>steer the model toward safer behavior"]:::c3
        C3B["FRAMING: a runtime safety layer<br/>that does not require retraining"]:::c3
        C3C["WHO: the deployer<br/>with consent and authorization"]:::c3
    end

    subgraph SHARED["THE SHARED TECHNIQUE"]
        direction TB
        TS["CAA via forward hook<br/>find direction (contrastive pairs)<br/>install hook (add scaled direction)<br/>observe changed behavior"]:::shared
    end

    subgraph B13C["B13 — The Adversary"]
        direction TB
        B13A["GOAL: alignment removal<br/>steer the model toward misbehavior"]:::b13
        B13B["FRAMING: a runtime attack<br/>that bypasses input-layer defenses"]:::b13
        B13C2["WHO: an adversary<br/>with runtime access, no consent"]:::b13
    end

    C3 --> TS
    TS --> B13C

    BRIDGE["THE BRIDGE — you cannot defend a surface you do not understand.<br/>C3 FT17 teaches the technique. B13 teaches the attack.<br/>The defense (B13) is runtime integrity: verify the hooks are the deployer's hooks."]
```

---

## Validation notes

- All five diagrams use the course design tokens (`#5eead4` accent, `#f0a868` warn, `#f08080` danger, `#9494a0` ink-secondary). No emoji. No AI purple/blue. No gradients.
- Diagram 1 is the "why this module exists" (RI-202) claim in visual form — six surfaces covered, one gap.
- Diagram 2 organizes the four attack classes by the two dimensions (weights/activations, persistent/runtime), each mapped to its ATLAS home tactic from SDD-B12.
- Diagram 3 is the mechanical anchor — the CAA procedure, with the dual-use toggle (add = defense, subtract = offense).
- Diagram 4 is the defense-in-depth stack — the four layers, each catching a different class. No single layer suffices.
- Diagram 5 is the C3/B13 bridge — the load-bearing curriculum connection. The same technique read two ways is the defense-in-depth argument for the representation layer.