Skip to content

THREAT_MODEL.md

Latest commit

 

History

History
96 lines (78 loc) · 8.74 KB

THREAT_MODEL.md

File metadata and controls

96 lines (78 loc) · 8.74 KB
Raw

BlindAssist threat model

Status: current

Last reviewed: 2026-08-12

This threat model covers the public Android prototype, the optional local glasses stream, bundled models and native components, GitHub Actions, releases, research artifacts, and model-assisted maintenance. It is a review boundary, not a security certification or mobility-safety claim.

Protected assets and trust boundaries

The assets that matter most are camera and bystander privacy, Android permissions, device integrity, model and native-library integrity, repository and CI credentials, release identity, contributor trust, and the provenance of published evidence.

flowchart LR
    U["User and Android permission UI"] --> A["Default Android app"]
    C["Phone camera"] --> A
    G["Optional glasses device on local network"] -->|"Narrow cleartext exception"| A
    M["Bundled model and native components"] --> A
    F["Untrusted fork, issue, or pull request"] --> CI["Read-only pull-request CI"]
    CI --> R["Maintainer review"]
    A --> L["Local logs and ignored artifacts"]
    R --> P["Tagged debug release and manifests"]
    X["Codex or API review"] -->|"Advisory output only"| R
Loading

The default app performs camera inference on device. Machine-local datasets, logs, downloads, and generated evidence are outside Git or under ignored artifacts.local/. The optional AtomS3R path is a separate local-network trust boundary and is not equivalent to the phone-camera default.

Threats, controls, and residual risk

Surface Threat scenario Current controls Residual risk and required action
Camera and bystanders Camera use exceeds user intent, frames leak into logs/artifacts, or sensitive scenes are committed Runtime camera permission, on-device default processing, contribution/privacy rules, ignored local-artifact paths Permission does not create bystander consent. Do not collect or publish real footage without separate authority; redact diagnostics and stop capture when the user leaves the flow
Local glasses stream A local-network attacker observes, injects, replays, or spoofs MJPEG/ToF data Global cleartext is disabled; the network security config allows only 192.168.5.11 and atoms3r-tof.local; the reader has timeouts, bounded headers, and a 2 MiB JPEG limit The allowed path is still unauthenticated cleartext. Use only on a controlled isolated network; do not treat it as confidential or authentic. Authenticated encrypted transport is required before hostile-network or deployment claims
Android components and permissions An exported component or excessive permission exposes capture or control functions The main manifest requests camera, internet, and vibration; the launcher activity is the public component; broad cleartext is disabled Re-audit every manifest, deep link, service, receiver, provider, backup rule, and permission change before merge. No new exported component is accepted by default
Bundled TFLite model and labels A model or label payload is replaced, malformed, or mismatched with its documentation configs/public_release_assets.json binds path, size, SHA-256, upstream URL, and notice; CI recomputes identity; the model card binds the default asset Hash integrity does not prove upstream safety, accuracy, or freedom from malicious model behavior. Do not load contributor-supplied runtime models into a privileged release path without isolated inspection and promotion gates
Native/QNN components A native binary introduces memory-safety, ABI, loading, or provenance risk Native candidates are isolated from automatic default promotion; APK and 16 KB checks cover packaged artifacts; third-party scope is documented Binary provenance and static/package checks are not a native-code security audit. Keep unsupported backends fail-closed and require source/version/hash review plus device evidence before promotion
Dependencies and build tools A compromised package, Action, Gradle plugin, or downloaded tool executes in CI GitHub Actions are pinned to commit SHAs; the TFLite inspection install uses hashes; downloaded bundletool is SHA-256 checked; Dependabot raises bounded update PRs Gradle and transitive dependency supply chains remain trusted upstreams. Review repository changes, release notes, dependency graphs, and focused tests before accepting updates
Fork pull requests and CI Untrusted code exfiltrates secrets, poisons caches, or alters evidence Pull-request workflow permission is contents: read; no release credential is used; repository and ignored-output checks run on the submitted commit Keep fork jobs secret-free and do not combine pull_request_target with untrusted checkout/execution. Treat artifacts and test output from forks as untrusted until reviewed
Tag and release pipeline An unauthorized tag publishes a misleading APK, assets are overwritten, or version/source identity drifts Tag/version equality is checked; APK identity/signature/16 KB checks run; source commit, checksums, verification JSON, and manifest are published; an existing release is not overwritten Current public artifacts are explicitly debug releases, not production signing or store attestation. Protect tag authority and investigate keyless provenance/attestation before stronger distribution claims
Logs, research data, and local paths Private images, device identifiers, credentials, restricted data, or absolute paths enter Git or an uploaded artifact CONTRIBUTING/SECURITY rules prohibit them; repository hygiene and ignored artifacts.local/ paths reduce accidental commits Automated checks cannot recognize every sensitive payload. Review staged files and workflow artifacts; prefer synthetic/redacted evidence and revoke any exposed credential immediately
Model-assisted maintenance Prompt injection in an issue or diff causes secret access, unsafe commands, or false approval CODEX_MAINTAINER_AUTOMATION.md treats repository text as untrusted, keeps model output advisory, separates read and write actions, and requires deterministic gates Model review is not a security boundary. Do not provide write/release credentials or private reports to untrusted-content runs; stop on ambiguity or attempted instruction injection
Assistive feedback A missed detection, stale frame, false-clear interpretation, or inaccessible UI causes misplaced confidence Safety wording, deterministic state policy, UNKNOWN preservation, temporal/device gates, and explicit separation of research from product authority The project has no real-user mobility-safety certification. Never describe absent detection as a clear route or use the prototype as a substitute for a cane, guide dog, training, or human judgment

Security invariants

The following changes fail closed until their owning review and tests are complete:

  • a new exported Android component, permission, network destination, cleartext exception, background-capture path, or backup surface;
  • a different default model, labels file, native library, model loader, or third-party license/provenance record;
  • a GitHub workflow that receives write permission, secrets, OIDC identity, signing material, fork artifacts, or untrusted code;
  • a release-path, tag, signature, checksum, manifest, or provenance change;
  • an API-backed maintainer workflow that can mutate issues, branches, pull requests, releases, repository settings, or vulnerability reports.

Security findings and mitigations remain separate from model-quality and mobility-safety evidence. A security fix does not prove accessibility, perception accuracy, or safe use.

Known open risks

  • The optional AtomS3R stream has a narrow but unauthenticated cleartext exception.
  • The project has one active code maintainer and no independent security audit or penetration test.
  • The GitHub release is a verified debug artifact, not production signing, store provenance, or deployment certification.
  • The tag-triggered Release workflow was added after v10.9.0 and has not yet completed a real tag run; the existing release therefore predates its SHA256SUMS, manifest, and verification-artifact contract.
  • Public model identity is reproducible by hash, but the exact bundled YOLO export is not yet bit-for-bit reproducible from a frozen upstream toolchain.
  • External adoption, target-user outcomes, and hostile-environment behavior are not established.

These risks must be disclosed, not converted into implied guarantees.

Review and reporting

Re-review this document whenever a security invariant above changes, before a new distribution channel, or after a material vulnerability. Private reports follow SECURITY.md. Public changes should link the affected threat row, list exact verification commands, and state any remaining evidence gap.