MITRE ATLAS Compliance Matrix

Adversaries crawl journals, preprints, technical blogs, and conference proceedings to extract architectural details, toolchain information, and model descriptions. This intelligence is used to identify attack surfaces and tailor adversarial strategies against specific ML systems.

Adversaries search public vulnerability databases, research papers, and disclosure reports for known weaknesses in AI/ML frameworks, models, and libraries used by the target. This enables them to exploit documented attack vectors without original research.

Adversaries probe APIs or analyze outputs to identify the specific model architecture, family, or provider an organization uses. Knowing the model family (e.g., GPT-4, Claude, Gemini) enables targeted attacks using known weaknesses of that architecture.

Adversaries search public repositories, container registries, documentation, and APIs to discover model artifacts such as weights, configurations, training pipelines, and deployment manifests. These artifacts provide deep insight into the target system's ML implementation.

Adversaries develop custom tools, scripts, and adversarial examples specifically designed to attack target ML systems. This includes creating adversarial perturbations, poisoned datasets, and automated exploitation frameworks tailored to the identified model architecture.

Adversaries acquire publicly available ML models, training datasets, or pre-trained weights to use as proxies for developing attacks against target systems. Transfer attacks developed on public models can be effective against similar private models.

Adversaries compromise the ML supply chain by inserting malicious code, poisoned model weights, or backdoored components into ML pipelines, package repositories, or model hubs. Compromised dependencies propagate through the supply chain to target systems.

Adversaries gain access to ML development environments, notebooks, training infrastructure, or CI/CD pipelines to tamper with models during development. Compromised development environments can inject persistent backdoors before models reach production.

Adversaries use legitimate credentials — stolen API keys, leaked tokens, or hijacked service accounts — to access ML inference APIs or model management endpoints. Valid credentials bypass authentication controls and appear as authorized usage.

Adversaries inject malicious instructions into LLM prompts to hijack model behavior. Direct injection embeds commands in user input; indirect injection plants malicious content in external data sources (tool outputs, documents, retrieved context) that the LLM processes. Prompt injection is the primary attack vector for compromising agentic AI systems.

Adversaries corrupt training datasets by injecting malicious samples designed to alter model behavior. Poisoned data can create backdoors that activate on specific trigger inputs, cause targeted misclassifications, or degrade overall model performance.

Adversaries craft inputs specifically designed to cause ML models to produce incorrect outputs — adversarial perturbations, evasion attacks, or inputs that exploit decision boundary weaknesses. These appear normal to humans but trigger model failures.

Adversaries insert hidden backdoors into ML models that activate only when specific trigger patterns are present in the input. The model behaves normally on clean inputs but produces attacker-controlled outputs when the backdoor trigger is detected.

Adversaries gain access to ML model inference APIs to query the model and observe its outputs. Inference access enables model extraction, adversarial example generation, membership inference, and other attacks that require repeated model queries.

Adversaries obtain full access to ML model internals — weights, architecture, hyperparameters, and training configuration. Full access enables white-box attacks including gradient-based adversarial example generation and comprehensive model analysis.

Adversaries craft specialized prompts designed to override the model's safety guardrails, content policies, and behavioral constraints. Jailbreaks put the LLM into an unaligned state where it ignores restrictions, produces harmful content, or executes actions it was designed to refuse.

Adversaries manipulate the context window, system prompts, or retrieved data used by an AI agent's LLM to persistently influence its decisions. Poisoned context can redirect agent behavior, alter tool selection, or inject hidden objectives that persist across conversation turns.

Adversaries alter the long-term memory of an AI agent to ensure malicious changes persist across sessions. Poisoned memories influence future behavior, tool usage, and decision-making without requiring repeated injection — the agent 'remembers' the attacker's instructions.

Adversaries modify an agent's configuration files, system prompts, tool definitions, or permission settings to create persistent malicious behavior. Configuration changes affect all instances sharing that config, enabling broad compromise from a single modification.

Adversaries exploit an agent's legitimate tool access to exfiltrate sensitive data. By manipulating the agent (via prompt injection or context poisoning), attackers cause it to encode stolen data into tool parameters — sending emails with embedded secrets, updating CRM records with exfiltrated content, or making API calls that leak data to attacker-controlled endpoints.

Adversaries use legitimate inference API access to extract sensitive information from ML models. Model inversion attacks reconstruct training data, membership inference determines if specific data was used in training, and model extraction creates functional copies of proprietary models through systematic querying.

Adversaries disrupt ML service availability by overloading inference APIs, submitting resource-intensive queries designed to exhaust compute budgets, or corrupting model state. Denial of ML service can halt automated workflows, disable AI-powered security controls, and cause cascading failures in dependent systems.

Adversaries subtly degrade model performance over time through adversarial inputs, data poisoning, or feedback manipulation. Unlike denial of service, integrity erosion is gradual and difficult to detect — the model continues to function but produces increasingly unreliable or biased outputs.

Adversaries exploit AI system access to generate excessive API costs for the victim. By submitting large volumes of expensive queries, using maximum context windows, or triggering compute-intensive operations, attackers inflict financial damage without stealing data or degrading model performance.