10.4 MITRE ATLAS: Adversarial Threat Landscape for AI Systems

10.4 MITRE ATLAS: Adversarial Threat Landscape for AI Systems

MITRE ATLAS is a living, publicly available knowledge base for adversary behavior involving AI systems. It uses the same basic reasoning pattern as MITRE ATT&CK: a tactic describes why an adversary acts, a technique describes how, a sub-technique supplies more specific behavior, a mitigation describes risk reduction, and a case study records observed or demonstrated activity. ATLAS complements ATT&CK; many incidents need both conventional enterprise techniques and AI-specific techniques.

Version the matrix

ATLAS changes as the field develops. The official ATLAS data release 2026.08, checked for this review, contains 16 tactics, 178 techniques and sub-techniques, 37 mitigations, and 68 case studies. Treat those counts as a dated snapshot, not permanent exam facts. Record the version or retrieval date in a threat model and look up identifiers in current official data before using them in an incident report.

The 16 current tactics are:

1. Reconnaissance
2. Resource Development
3. Initial Access
4. AI Model Access
5. Execution
6. Persistence
7. Privilege Escalation
8. Defense Evasion
9. Credential Access
10. Discovery
11. Lateral Movement
12. Collection
13. AI Attack Staging
14. Command and Control
15. Exfiltration
16. Impact

These names show how ATLAS combines ordinary intrusion activity with AI-specific objectives. AI Model Access concerns access needed to interact with or acquire a model. AI Attack Staging covers preparation of artifacts or capabilities used against AI. Do not rely on older labels such as “ML Model Access” without recording the historical version.

High-value current mappings

Use the exact current names and hierarchy:

Under AML.T0024, Infer Training Data Membership (AML.T0024.000) estimates whether a record was in training, Invert AI Model (AML.T0024.001) reconstructs information about training data or features, and Extract AI Model (AML.T0024.002) approximates or recovers model functionality. Older material may use AML.T0001 for inversion or use AML.T0024 as model extraction alone; those mappings are obsolete in the current data.

Prompt injection and jailbreaking also differ. Direct or indirect describes where hostile instructions enter. Jailbreaking describes bypassing safeguards. One event may map to AML.T0051.001 for indirect injection and AML.T0054 when the content also bypasses safeguards.

Mitigations

Current ATLAS mitigation identifiers use AML.M0000-series identifiers, not the obsolete AML.M1000 series. Examples include:

• AML.M0001 — Limit Model Artifact Release: reduce unnecessary release of weights or artifacts.
• AML.M0002 — Predictive AI Output Obfuscation: reduce useful precision or detail exposed by predictive outputs where risk and business need permit.
• AML.M0003 — Predictive AI Model Hardening: make predictive models more robust against adversarial use.
• AML.M0004 — Limit AI Service Query Volume and Rate: constrain repeated queries used for extraction, inference, or resource abuse.
• AML.M0005 — Control Access to AI Models and Data at Rest: restrict and monitor access to stored model artifacts and data.

A mitigation is selected from the actual attack path and system constraints. Output obfuscation may reduce information available for inversion or extraction, but it can reduce legitimate explainability or utility. Query limits slow abuse but do not correct excessive tool permissions. Access control at rest does not validate hostile runtime input. Combine controls and document residual risk.

Threat-modeling workflow

First draw the system: training and evaluation data, artifact registry, deployment, inference APIs, RAG stores, users, agents, tools, logs, and suppliers. Identify entry points and the attacker's required access. Map only behaviors supported by evidence. Then pair mappings with preventive, detective, response, and recovery controls.

For example, a malicious document retrieved by an agent instructs it to query a customer database and send records externally. Evidence supports Indirect LLM Prompt Injection (AML.T0051.001). If the content bypasses behavioral safeguards, AML.T0054 may also apply. Conventional credential, collection, and exfiltration behaviors may map to ATT&CK, while ATLAS captures the AI-specific path. Controls include isolating untrusted content, least-privilege agent identity, server-side authorization, tool allowlists, destination controls, human confirmation, and complete tool-call logging.

For an inference API that exposes detailed scores, repeated queries could support AML.T0024 sub-techniques. Authentication, AML.M0004 rate limits, anomaly detection, AML.M0002 output obfuscation where acceptable, and contractual controls can reduce risk. Preserve request identity, timestamps, inputs, outputs, model version, and rate-limit decisions for investigation.

Exam method

In a scenario, identify the adversary's objective before choosing the identifier. Reconstructing training information points to inversion; deciding whether a record was present points to membership inference; cloning model behavior points to extraction; changing training examples points to poisoning; and manipulating inference input to avoid detection points to evasion. If a distractor gives a familiar name with an obsolete ID, prefer the current official mapping unless the question explicitly specifies an older ATLAS version.