Working with an external LLM

Lantern can import and export threat models as JSON. This makes it possible to use any capable LLM to generate or refine a threat model outside of Lantern.

Example workflow

Provide the schema

The Lantern JSON schema defines the document structure, required fields, and valid values. It also contains descriptions that help the LLM understand the purpose of each field. Include the schema in the conversation before asking the model to generate any output.

Write a clear prompt

Describe the system being modeled in as much detail as possible. Include its components, core features, architecture, data flows, trust boundaries, and any other relevant context.

Be explicit that the model should return only valid Lantern JSON.

Import the model

Once a project has been generated, download it and import it into Lantern where you can review the results and make manual adjustments.

Work in iterations

You can import, review, and export the project as needed.

You will generally get better results if you do not try to generate the entire threat model in a single step.

Start by getting the core elements and overview diagram right. Continue by modeling individual features. Once you are happy with the results, begin identifying threats and mitigations.

Example prompt

A repository containing a prepared prompt is available here. You can use it if you just want to try out a quick prompt that creates a plausible-looking project.