AID-H-037: Reasoning-State Security & Compute Controls
Protect extended-thinking state as sensitive internal data and bounded compute. Separate raw-trace confidentiality/storage, provider-block round-trip integrity, and reasoning-compute budgets. Structured state transitions may be audited under AID-H-017.001; raw chain-of-thought is not required.
Scope boundary
Groups controls for confidentiality and storage of reasoning traces, provider reasoning-block continuity, and reasoning-specific compute budgets. It does not require collection of raw chain-of-thought or own general agent state-transition auditability.
AID-H-017.001: AID-H-037 protects hidden reasoning data and compute; AID-H-017.001 makes structured agent control-loop state interruptible and auditable. Auditable state transitions do not require disclosure or retention of raw chain-of-thought.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0029 Denial of AI Service
- AML.T0034 Cost Harvesting
- AML.T0034.001 Cost Harvesting: Resource-Intensive Queries
- AML.T0051 LLM Prompt Injection
- AML.T0056 Extract LLM System Prompt
- AML.T0057 LLM Data Leakage
MAESTRO
- Input Validation Attacks (L3)
- Resource Hijacking (L4)
- Data Leakage through Observability (L5)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM06:2026 Unbounded Consumption
- LLM08:2026 Hidden Context Exposure
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
NIST Adversarial Machine Learning 2025
- NISTAML.014 Energy-latency
- NISTAML.018 Prompt Injection
- NISTAML.036 Leaking information from user interactions
Cisco Integrated AI Security and Safety Framework
- AITech-4.2 Context Boundary Attacks
- AITech-7.1 Reasoning Corruption
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-16.1 Eavesdropping
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.1.5 Decision Paralysis Attacks
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-16.1.1 Logging Sensitive Conversations
Google Secure AI Framework 2.0 - Risks
- DMS: Denial of ML Service
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.7: Denial of Service (DoS)
- Model Serving - Inference response 10.6: Sensitive data output from a model
- Agents - Core 13.4: Resource Overload