PriMod4AI: Lifecycle-Aware Privacy Threat Modeling for AI Systems using LLM

TL;DR

PriMod4AI presents a lifecycle-aware privacy threat modeling framework for AI systems that combines classical and AI-specific threats using knowledge bases and large language models.

Contribution

It introduces a hybrid approach unifying LINDDUN-based and model-centric privacy threats, leveraging knowledge bases and LLMs for comprehensive threat identification.

Findings

Broad coverage of classical privacy threats achieved.

Effective identification of AI-specific privacy threats.

Consistent threat assessments across different LLMs.

Abstract

Artificial intelligence systems introduce complex privacy risks throughout their lifecycle, especially when processing sensitive or high-dimensional data. Beyond the seven traditional privacy threat categories defined by the LINDDUN framework, AI systems are also exposed to model-centric privacy attacks such as membership inference and model inversion, which LINDDUN does not cover. To address both classical LINDDUN threats and additional AI-driven privacy attacks, PriMod4AI introduces a hybrid privacy threat modeling approach that unifies two structured knowledge sources, a LINDDUN knowledge base representing the established taxonomy, and a model-centric privacy attack knowledge base capturing threats outside LINDDUN. These knowledge bases are embedded into a vector database for semantic retrieval and combined with system level metadata derived from Data Flow Diagram. PriMod4AI uses retrieval-augmented and Data Flow specific prompt generation to guide large language models (LLMs) in identifying, explaining, and categorizing privacy threats across lifecycle stages. The framework produces justified and taxonomy-grounded threat assessments that integrate both classical and AI-driven perspectives. Evaluation on two AI systems indicates that PriMod4AI provides broad coverage of classical privacy categories while additionally identifying model-centric privacy threats. The framework produces consistent, knowledge-grounded outputs across LLMs, as reflected in agreement scores in the observed range.