Trust Boundary Semantic Gaps: A Multi-dimensional Analysis and Mitigation for Security-by-Design

Source: arXiv:2607.01711 · Published 2026-07-02 · By Doyeon Kim, Jin-Young Choi, Junghee Lee

TL;DR

This paper investigates a subtle yet pervasive condition in system security called the Trust Boundary Semantic Gap (TBSG). The problem arises when an artifact passing syntactic validation at a trust boundary—such as signature checks, schema validation, or protocol conformance—fails to establish the full semantic security properties required by the receiving domain. This gap allows adversaries to exploit assumptions left unverified after the syntactic pass, causing incidents such as SolarWinds/SUNBURST, Log4Shell, and Capital One breaches.

The authors analyze 75 publicly documented security incidents from 2014 to 2025 at the trust boundary level, identifying recurrent semantic misalignments. They organize these into a novel four-dimensional Multi-Dimensional Trust Boundary Semantic Gap (MDTBSG) model comprising Identity, Spatial, Temporal, and Interpretation dimensions. Building on that, they propose a design-time framework called Trust Boundary Semantic Analysis and Mitigation (TBSAM) which takes design artifacts as input, identifies and prioritizes semantic gaps, traces their propagation across boundaries, and maps gaps to candidate architectural controls.

They demonstrate TBSAM via a retrospective reconstruction of the SolarWinds supply-chain attack, showing it highlights receiving domain assumptions made implicitly, distinguishes locally originating gaps from propagated ones, and identifies controls that interrupt the exploit path. The work emphasizes that syntactic validation, while necessary, is fundamentally insufficient for end-to-end security at trust boundaries. Making trust boundary assumptions explicit through compositional semantic analysis can improve Security-by-Design practices and complement traditional threat modeling.

Key findings

• Analysis of 75 publicly reported security incidents (2014–2025) showed that 85.3% involved Identity dimension gaps and 82.7% involved Spatial dimension gaps at trust boundaries.
• Temporal gaps appeared in 53.3% of incidents, and Interpretation gaps appeared in 78.7%, indicating multiple semantic misalignment dimensions frequently co-occur.
• The TBSG condition is distinct from absent validation or implementation bugs; it occurs even when syntactic validation is correctly implemented and passed.
• The MDTBSG four-dimensional model (Identity, Spatial, Temporal, Interpretation) organizes recurring semantic misalignments absent after syntactic validation across diverse platforms and attack classes.
• The SolarWinds/SUNBURST retrospective via TBSAM identified three locally originating semantic gaps and one propagated gap, with architectural control at source-to-binary attestation breakpoints interrupting the attack chain.
• Syntactic validation such as signature or protocol checks only establish limited assertions Φ(A), which do not entail the receiving domain’s security requirements Rj(A), resulting in a semantic gap Φ(A) ⊭ Rj(A).
• MDTBSG dimensions help trace propagation of semantic gaps across boundaries, illustrating multi-boundary exploit chains, e.g. Log4Shell’s Interpretation gap leading to downstream Spatial gap.
• TBSAM maps identified gaps to candidate architectural mitigation controls differentiated by gap dimension and origin across trust boundaries.

Threat model

The adversary can craft and inject artifacts—messages, tokens, updates, requests—that cross trust boundaries. They cannot subvert syntactic validation mechanisms themselves (signatures, schema checks, protocol compliance) but exploit security assumptions that remain unverified after these validations. The receiving domain trusts assertions established by syntactic validation to the extent of their design, but semantic properties required for safety (such as provenance, scope, freshness, or intended behavior) are not guaranteed. The adversary leverages these residual semantic gaps to escalate privileges, execute code, or otherwise compromise the receiving trust domain.

Methodology — deep read

The paper proceeds through a structured, empirical, and formal analysis of trust boundary semantic gaps.

1. Threat Model & Assumptions: The adversary crafts artifacts (messages, tokens, software updates, API calls) that cross trust boundaries. The receiving domain applies syntactic validation (e.g., signature checks, schema compliance, protocol conformance) correctly and without implementation flaws. The adversary exploits semantic assumptions left unverified after syntactic validation passes. The adversary does not break the syntactic validation itself but leverages semantics unestablished by it.

2. Data: The authors collected 81 candidate publicly reported security incidents with evidence of exploitation from 2014–2025, including sources like CISA Known Exploited Vulnerabilities catalog and technical reports by Mandiant and CrowdStrike. After excluding 6 incidents lacking syntactic validation at boundaries, they analyzed 75 incidents spanning multiple platforms (Android, Windows, cloud services, network appliances) and attack classes (supply chain, RCE, privilege escalation, credential abuse).

3. Architecture/Algorithm: The core artifact is the MDTBSG model, categorizing semantic gaps after syntactic validation into four dimensions: Identity (principal behind artifact), Spatial (artifact’s reach/destination), Temporal (validity over time/use), and Interpretation (meaning/behavior triggered). Formal definitions use notation: a trust boundary TBi,j permitting artifacts A crossing from domain Di to Dj; syntactic validation establishes assertions Φ(A); receiving domain security requirements are Rj(A). A TBSG exists if Φ(A) does not entail Rj(A), i.e. Φ(A) ⊭ Rj(A).

4. Training Regime: Not applicable; this is an analytical framework and empirical incident analysis rather than machine learning.

5. Evaluation Protocol: Each incident is decomposed at the trust boundary level, recording artifact, syntactic validation applied, assertions established, and the security requirement left unfulfilled. A conservative three-fact criterion requires the public record to support the boundary crossing, syntactic validation passing, and reliance on unestablished security property to assign MDTBSG dimension labels. The authors produce a summary table correlating incident boundary gaps with MDTBSG dimensions. They also perform a detailed case study applying the TBSAM workflow to the SolarWinds/SUNBURST incident, mapping gaps to architectural mitigations.

6. Reproducibility: No code or datasets are published since this is a conceptual, analytical study based on public incident reports. The incident dataset and labeling rules are described in detail but not released in machine-readable form. The formal model/definitions and TBSAM procedure are fully specified.

A concrete example is Log4Shell. At the boundary between an external client and logging service, syntactic validation confirms input string structural validity (Φ(A)), but semantic property that logged input remains inert data (RIn_j(A)) is not established, producing an Interpretation dimension gap. This gap enables JNDI lookups embedding attacker-controlled destinations, which constitutes a propagated Spatial dimension gap at a subsequent boundary.

Thus, the paper surface-level formalizes, catalogs and contextualizes trust boundary semantic gaps through multi-dimensional incident analysis, precise definitions, and a systematic design-time framework for identification, prioritization, tracing, and architectural mitigation recommendations.

Technical innovations

• Definition and formalization of the Trust Boundary Semantic Gap (TBSG) condition distinguishing it from implementation bugs or absent syntactic validation.
• Development of the Multi-Dimensional Trust Boundary Semantic Gap (MDTBSG) model organizing semantic gaps into four distinct dimensions: Identity, Spatial, Temporal, and Interpretation.
• Trust Boundary Semantic Analysis and Mitigation (TBSAM), a design-time, four-stage procedural framework that uses MDTBSG to identify, prioritize, trace, and map semantic gaps to candidate architectural controls from system design artifacts.
• Application of TBSAM to a historical reconstruction of the SolarWinds/SUNBURST supply-chain attack to demonstrate its utility in making implicit trust assumptions explicit and identifying architectural interruption points.
• Establishing the necessity of compositional semantic validation across trust boundaries to complement syntactic validation and traditional threat modeling like STRIDE.

Datasets

• Publicly reported security incidents (2014–2025) — 75 analyzed from original 81 candidates — compiled from CISA Known Exploited Vulnerabilities catalog, CISA advisories, MITRE ATT&CK, and vendor technical reports

Baselines vs proposed

• N/A — This study is conceptual and analytical; no direct quantitative baseline comparisons reported.

Limitations

• Reliance on publicly disclosed incident reports limits completeness and detail of boundary-level semantic gap labeling; conservative criteria may underlabel gaps.
• No automated tooling or runtime detection mechanisms for TBSG are proposed; TBSAM is a manual, design-time analysis process.
• The incident dataset is curated but does not include all security incidents globally; may not represent all TBSG manifestations.
• No empirical evaluation of effectiveness of recommended architectural controls in preventing real attacks.
• The framework assumes correctly implemented syntactic validation; flaws in validation implementations fall outside TBSG scope.
• The mapping from semantic gaps to architectural controls is candidate-level, not evaluated in deployed production environments.

Open questions / follow-ons

• How can runtime detection or enforcement mechanisms be developed to complement design-time TBSG analysis and mitigate semantic gaps effectively?
• Can machine-readable formal specifications of trust boundaries and required semantic properties enable partial automation of TBSG identification and mitigation mapping?
• What empirical evidence supports the effectiveness of architectural controls recommended by TBSAM in preventing real-world attacks exploiting semantic gaps?
• How do TBSG dimensions interact with evolving distributed, microservice, and cloud-native architectures where trust boundaries proliferate and are more dynamic?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this paper highlights a critical blind spot: artifacts that pass conventional syntactic validation at trust boundaries may nevertheless carry semantic gaps exploitable by attackers. Simply verifying message formats, signatures, or protocol compliance may not suffice if the receiving domain’s actual security assumptions about origin, scope, timing, or behavior are not explicitly enforced.

Practitioners designing bot defenses or CAPTCHA challenges should consider explicitly documenting and verifying semantic assertions at trust boundaries, such as the authentic principal behind a token, the intended destination of a request, the freshness or replay protection of inputs, and the exact interpretation or capabilities granted. The MDTBSG framework offers a structured way to audit these assumptions. Integrating semantic validation and architectural controls—like attestation, scope-restricted handling, freshness checks, or strict interpretation constraints—can reduce risks that bot interactions or artifact acceptances inadvertently widen the attack surface.

Cite

@article{arxiv2607_01711,
  title={ Trust Boundary Semantic Gaps: A Multi-dimensional Analysis and Mitigation for Security-by-Design },
  author={ Doyeon Kim and Jin-Young Choi and Junghee Lee },
  journal={arXiv preprint arXiv:2607.01711},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.01711}
}

Read the full paper

• arXiv:2607.01711 (abstract)
• arXiv:2607.01711 (PDF)