Clinical brief threat model¶

Overview¶

The guarded clinical brief combines local de-identification, reviewed evidence, bounded generation, exact claim alignment, calibrated NLI, citation checks, privacy checks and a review handoff. Explicit claim bindings identify reviewed source spans but do not prove support; semantic, NLI, citation and privacy checks still apply. Successful results require human review and remain non-diagnostic. The current Python evidence-packet contract admits synthetic evidence only. A separate opt-in reviewed-local contract checks current source custody and independently stored, expiring review authority. Neither synthetic markers nor structural admission prove that a note is safe or clinically valid.

This model covers the library, CLI, REST, MCP and OpenMedKit brief surfaces and their supporting local loaders. It records architecture and threat scenarios, not validated vulnerabilities. It makes no compliance, certification, clinical-validation or model-quality claim. Suspected defects follow the private disclosure policy; this document includes no actionable reproduction for an unmitigated bypass.

flowchart LR
    I["Untrusted note"] --> D["Local de-identification"]
    R["Trusted application review store"] --> E["Reviewed evidence admission"]
    D --> E
    E --> G["Local bounded generation"]
    G --> V["Claim, NLI, citation and privacy gates"]
    V --> P["Protected response: includes summary"]
    V --> A["Audit view: excludes summary"]
    P --> H["Authorized application / human review"]

Swift uses its application's local evaluator for the complete reviewed-evidence and NLI pipeline. Native packet validation independently checks the safety envelope, digests, citations, verdict labels and privacy callback; it does not independently execute every Python stage.

Effective resources and capabilities¶

Symbolic roots below describe configured locations, never an observed private host path. No deployed bind, mount, cache ACL, review provider or actual model file contents were supplied. Separately authorized model preparation precedes generation; cache preparation does not authorize sending note content remotely.

Threat model, trust boundaries and assumptions¶

Assets and security objectives¶

Protect original notes, detected identifier surfaces/mappings, summaries and complete protected responses. Preserve evidence/review authority, exact content/annotation/profile binding, calibration identity, citation integrity, review-required state, provenance, local artifact integrity and compute availability. Audit consumers receive counts, offsets, fixed vocabulary and digests rather than note or summary text.

Reviewed profile fields map to fixed evidence classes before generation. UTF-8 byte estimates and joining separators charged to the following class enforce the existing caps; length_budget_exceeded cannot silently relax them. Value-free budget provenance is bound into the brief digest. An absent runtime, unknown alias or uncached artifact returns model_unavailable; arbitrary callback subclasses are never trusted to supply a public reason property. Sanitized errors are raised outside handlers so private exception contexts cannot escape. OpenMedKit refuses an unloaded model before evaluation and avoids GPU cleanup when no model was loaded.

The composer must never manufacture review history, silently change backends, return partial unsafe generation, or convert a passed gate into clinical authorization. Only uniquely aligned reviewed claims with accepted NLI outcomes can reach a successful response. Changed content, axes or profile require fresh review. brief.py; brief.py; brief.py; brief.py.

Surface boundaries¶

Sources for these crossings are the component/resource table above, the REST request schema, MCP brief schema, and native output views.

Actors, prerequisites and residual obligations¶

A document author controls note content, including prompt-like instructions, but has no authority to approve evidence, select installed code or access a review store. A transport requester controls the bounded wire fields, not review histories or NLI scores. Cross-record disclosure requires an exposed transport and a provider that grants access incorrectly; no such deployed condition is established here.

An artifact supplier or lower-trust shared-cache writer is a conditional supply-chain actor. Impact requires an authorized provisioning/load path and authority below the application process. The same user already controlling installed packages and callbacks is not isolated by a parser or local socket guard. An output reader needs actual file, export, backup or logging access.

Transport authentication and record authorization are separate. REST auth defaults disabled; enabled default deny-by-default authenticates /brief without a named default route scope. Configure the desired route policy and provider identity/access binding explicitly. MCP auth is also opt-in; its authenticated gateway enforces the configured tool scope. The review reference is a lookup key, never a permission grant. auth.py; auth.py; auth.py; server.py.

Factories and context-provider lookup execute before the composer guard. During composition the guard patches Python socket.connect, connect_ex and create_connection, with overlapping-scope protection. It does not sandbox subprocesses, native networking, imported artifact code or trusted callbacks. Swift callback locality is likewise an application contract. brief.py; brief.py; offline.py.

Known-source leakage checks depend on detected/supplied identifier surfaces. Unsupported scripts, short identifiers, detector false negatives and model memorization remain qualification risks; this page claims no universal recall. Python MLX verifies package bytes against an independently trusted manifest pin; trust in that pin and immutability through runtime loading remain host obligations. Swift artifact authentication remains a separate provisioning obligation. Maple is not a clinically validated summarizer, and calibration IDs, review histories and finite score checks do not authenticate reviewer identity or prove empirical calibration. Live offline qualification receipts bind caller-owned artifact/data/runtime/policy inputs and recheck drift, but do not certify supplied provenance or clinical truth. Audit-shaped JSON cannot construct live qualification authority. Synthetic fixture providers are not deployable clinical review/NLI services. summarize.py; evidence_packet.py; nli_gate.py; Model and evidence limitations.

Private output creation requests POSIX mode 0600; this is not encryption, portable Windows ACL enforcement or protection of parent directories and later copies. Audit digests provide content binding, not a signature or access token. Python to_dict() excludes summary and exposes defensive copies; to_response() explicitly includes protected content. Swift auditJSON() removes summary but retains other evaluator fields, which must meet the value-free metadata contract and pass the complete-response privacy callback. Applications and proxies must not log protected responses. brief.py; brief.py; logging.py; ClinicalBrief.swift.

Attack surface, mitigations and attacker stories¶

The rows are scenario classes and existing controls, not confirmed findings. Priority describes the impact to investigate if a control fails. Each row links existing tests; tests with injected synthetic providers prove contract behavior, not model quality, complete deployment isolation or clinical safety.

Severity calibration: Critical, High, Medium, Low¶

Apply the repository security policy. Privacy-impacting defects are never below High, regardless of a generic availability or configuration label above. The examples are hypothetical triage outcomes; no score, vulnerability or deployed exposure is established.

Host compromise, operator-selected trusted callbacks and same-process code already holding application authority are not new privilege boundaries. Hosted endpoints, external deployments and their actual ACL/provider policies were not audited. Qualification gaps remain explicit: factory-import coverage, detector/script recall, actual calibration, provisioning-pin authenticity and package immutability, Swift cached-file authenticity, application record authorization, Windows ACLs and value-free Swift evaluator metadata. Preserve these questions without inventing either a guarantee or a confirmed failure.