Fig 3Threat mapClick a drawer, or press 1–4 (top to bottom)Screen & input · 6 signals
Teal: a signal Rampart reports for that layerDrawers, top to bottom: screen & input, app runtime, OS & privileges, hardware & bootRampart's 23 signals, sorted by the layer of the device they watch. Attacks on lower drawers undermine everything above them: a rooted OS can hide hooks in the app and lift screen protections, which is why the lower layers also need a server-verified anchor (Play Integrity, App Attest, key attestation).