[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-289997-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-289997-en":131},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","caps-compositional-attack-path-scoring-for-llm-deployment-stacks","CAPS: Compositional Attack Path Scoring for LLM Deployment Stacks","","Evaluating the security posture of large language model (LLM) deployment stacks is a critical challenge in modern AI security. Traditional vulnerability scoring frameworks like CVSS and component checklists treat software components as isolated, but agentic and retrieval-augmented generation (RAG) ecosystems violate this assumption through chained, compositional attacks. The paper introduces Compositional Attack Path Scoring (CAPS), using directed graph modeling, dynamic mitigation attenuation via Effective Exploitability, and exponential decay to quantify multi-hop risks end-to-end.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/caps-compositional-attack-path-scoring-for-llm-deployment-stacks/289997/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/caps-compositional-attack-path-scoring-for-llm-deployment-stacks/289997.png","ImageObject",300,407,{"name":42,"@type":43},"Theodore","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-11-03","2026-09-17",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",15,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why do traditional vulnerability scoring frameworks fail for LLM deployment stacks?","Question",{"text":63,"@type":64},"They assume components can be evaluated in isolation, but real LLM ecosystems enable compositional, multi-hop attacks that chain low-risk issues across trust boundaries, causing inflated and inconsistent risk assessments.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What is the CAPS framework and what does it quantify?",{"text":68,"@type":64},"CAPS quantifies end-to-end, multi-hop risks in LLM architectures by modeling attack paths, adjusting exploitability based on deployed mitigations, and applying exponential decay to represent traversal friction.",{"name":70,"@type":61,"acceptedAnswer":71},"How does CAPS improve risk calibration compared with component-level CVSS scoring?",{"text":72,"@type":64},"In empirical evaluation on standardized architectures, CAPS reports a realistic critical path score (e.g., 51.3) that corrects naive overestimation (e.g., 85.0) produced by component-level CVSS scoring.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},289997,1789639540,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,127],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":25,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":25,"category_name":129,"show_sort_weight":97,"slug":130},19,"General","general",{"code":4,"msg":82,"data":132},{"doc_id":79,"user_id":133,"nickname":42,"user_avatar":134,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":140,"language":141,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":12,"update_tm":80,"read_time":113,"preview_page_count":4},7971461740886,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","Received: 1 June 2026 | Revised: 15 July 2026 | Accepted: 31 July 2026 | Published online: 12 August 2026  \nRESEARCH ARTICLE  \nCAPS: Compositional Attack Path Scoring for LLM Deployment Stacks  \nArtificial Intelligence and Applications 2026, Vol. 00(00) 1–12  \nDOI: 10.47852/bonviewAIA620210609  \n| Quang-Vinh Dang1 , Hoang-Viet Vu1 , Ngoc-Son-An Nguyen2 , Minh Ngoc Dinh3 and Dat Le4,*\u003Cbr>1 School of Computing and Innovative Technologies, British University Vietnam, Vietnam\u003Cbr>2 Faculty of Information Technology, Industrial University of Ho Chi Minh City, Vietnam\u003Cbr>3 School of Data Science and Information Technology, Millennia Education, Vietnam\u003Cbr>4 Department of Science, Technology and International Projects, University of Economics and Finance, Vietnam |\n| --- |\n| Abstract: Evaluating the security posture of large language model (LLM) deployment stacks is a critical challenge in modern AI security. Traditional vulnerability management frameworks—such as the Common Vulnerability Scoring System (CVSS) and component-level checklists—assume that software components can be evaluated in isolation. In real-world agentic and retrieval-augmented generation (RAG)-based LLM ecosystems, this assumption is systematically violated: attackers exploit complex topologies, chaining seemingly lowrisk vulnerabilities (e.g., indirect prompt injection) with downstream tools (e.g., SQL execution) to achieve catastrophic compromises. Applying independent scoring methods to deeply integrated stacks therefore yields inflated risk assessments, misaligned mitigation priorities, and a failure to capture compositional attack paths. We propose Compositional Attack Path Scoring (CAPS), a framework engineered to quantify end-to-end multi-hop risks in LLM architectures. CAPS integrates three capabilities: (i) directed graph topological modeling, which maps the deployment stack from attacker entry points to high-value assets; (ii) dynamic mitigation attenuation, which calculates the “Effective Exploitability” of nodes based on deployed guardrails; and (iii) a compositional path engine that scores risk via an explicit exponential decay factor reflecting the friction of traversing trust boundaries. CAPS also provides an automated return on investment engine to rank mitigations by systemic risk reduction. Empirical evaluation on standardized architectures (RAG Chatbots, Autonomous Coding Agents, and Enterprise Model Routers) shows that CAPS improves risk calibration: against the Autonomous Agent benchmark, it computes a realistic critical path score of 51.3, correcting the naive 85.0 overestimation of component-level CVSS scoring. CAPS establishes a rigorous benchmark for quantitative vulnerability management in complex, agentic LLM environments.\u003Cbr>Keywords: AI security, attack path analysis, threat modeling, compositional scoring, vulnerability management |\n\n1. Introduction  \nThe rapid integration of large language models (LLMs) into enterprise ecosystems has introduced unprecedented security challenges. Unlike standalone applications, modern LLM deployments function as complex, highly interconnected stacks comprising prompt gateways, orchestrator agents, vector databases, and external tool executors. Consequently, the threat model has shifted from isolated vulnerabilities (e.g., a simple CrossSite Scripting flaw) to sophisticated compositional attacks, where malicious actors chain seemingly benign inputs to traverse trust boundaries and compromise high-value assets.  \nTraditional vulnerability management frameworks, such asthe Common Vulnerability Scoring System (CVSS), evaluate software components in isolation. When applied to LLM deployment stacks, these frameworks systematically fail to capture the opera-  \n*Corresponding author: Dat Le, Department of Science, Technology and International Projects, University of Economics and Finance, Vietnam. [Email:](Email: datla@uef.edu.vn)[ datla@uef.edu.vn](Email: datla@uef.edu.vn)  \ntional realities of multi-stage at","cbCaidWBeOKCGaED","https://ap.wps.com/l/cbCaidWBeOKCGaED","pdf",1371408,12,"English","# Introduction\n# Related Work\n## LLM attack surface measurement and evaluation frameworks\n# CAPS Methodology\n# Empirical Evaluation\n# Implications and Conclusion","[{\"question\":\"Why do traditional vulnerability scoring frameworks fail for LLM deployment stacks?\",\"answer\":\"They assume components can be evaluated in isolation, but real LLM ecosystems enable compositional, multi-hop attacks that chain low-risk issues across trust boundaries, causing inflated and inconsistent risk assessments.\"},{\"question\":\"What is the CAPS framework and what does it quantify?\",\"answer\":\"CAPS quantifies end-to-end, multi-hop risks in LLM architectures by modeling attack paths, adjusting exploitability based on deployed mitigations, and applying exponential decay to represent traversal friction.\"},{\"question\":\"How does CAPS improve risk calibration compared with component-level CVSS scoring?\",\"answer\":\"In empirical evaluation on standardized architectures, CAPS reports a realistic critical path score (e.g., 51.3) that corrects naive overestimation (e.g., 85.0) produced by component-level CVSS scoring.\"}]","CAPS: Compositional Attack Path Scoring for LLM Deployment Stacks | PDF"]