MITRE ATLAS
v5.4.0The ATLAS technique catalog — open any row for its detail, tactics, and mitigations.
| Technique | Name | Tactics | Description | |
|---|---|---|---|---|
| AML.T0000 | Search for Victim's Publicly Available Research Materials | AML.TA0002 | Adversary reads model cards, papers, blog posts to fingerprint architecture and safety alignment. | › |
| AML.T0010 | ML Supply Chain Compromise | AML.TA0003, AML.TA0004 | Adversary publishes a backdoored model, embedding, or prompt template to a popular hub. | › |
| AML.T0011 | User Execution | AML.TA0004, AML.TA0005 | Adversary leverages a user to execute adversarial content (e.g., copy-pasted prompts). | › |
| AML.T0012 | Valid Accounts | AML.TA0004, AML.TA0009 | Stolen credentials provide initial access — e.g., leaked LLM API key. | › |
| AML.T0019 | Publish Poisoned Datasets | AML.TA0003, AML.TA0001 | Adversary releases poisoned training data targeted at common fine-tuning workflows. | › |
| AML.T0020 | Poison Training Data | AML.TA0001, AML.TA0006 | Adversarial training data shifts model behaviour at runtime. | › |
| AML.T0021 | Establish Accounts | AML.TA0003 | Adversary creates legitimate-looking accounts to operate inside the AI system. | › |
| AML.T0024 | Exfiltration via ML Inference API | AML.TA0012 | Use inference API as covert exfiltration channel. | › |
| AML.T0031 | Erode ML Model Integrity | AML.TA0013 | Slow degradation of model decisions via gradual drift. | › |
| AML.T0032 | Exposure to Sensitive Adversarial Inputs | AML.TA0005, AML.TA0013 | Model exposed to adversarial inputs intended to elicit harm. | › |
| AML.T0034 | Cost Harvesting | AML.TA0013 | Adversary uses victim's LLM budget to incur cost. | › |
| AML.T0035 | ML Artifact Collection | AML.TA0011 | Adversary collects sensitive data exposed via the AI system — prompts, retrieved docs. | › |
| AML.T0040 | ML Model Reconnaissance | AML.TA0002 | Adversary probes a model to fingerprint architecture, context size, training data domain. | › |
| AML.T0043 | Model Inversion | AML.TA0011 | Repeated probes infer training data through model output. | › |
| AML.T0044 | Full ML Model Access | AML.TA0000 | Adversary gains direct query access to the production model. | › |
| AML.T0046 | Inference API Access | AML.TA0000 | Adversary uses public inference API to probe or stage attack. | › |
| AML.T0048 | External Harms | AML.TA0013 | Downstream system trusts LLM output (SQL, shell, HTML, code) without validation. | › |
| AML.T0049 | Discover ML Artifacts | AML.TA0010 | Adversary enumerates models, datasets, embeddings, prompts available. | › |
| AML.T0050 | Spamming ML System | AML.TA0013 | High-volume adversarial input to degrade availability or distort metrics. | › |
| AML.T0051 | LLM Prompt Injection | AML.TA0005, AML.TA0008 | Multi-turn or role-play attack escalates past system safety policy. | › |
| AML.T0051.000 | Direct Prompt Injection | AML.TA0005 | User-controlled input contains directives that override system prompt. | › |
| AML.T0051.001 | Indirect Prompt Injection | AML.TA0005 | Retrieved document or tool output contains adversarial directives. | › |
| AML.T0053 | LLM Plugin Compromise | AML.TA0005, AML.TA0008 | Plugin/tool returns adversary-controlled output that hijacks downstream actions. | › |
| AML.T0054 | LLM Jailbreak | AML.TA0008 | Use jailbreak prompts (DAN, refuse-mode-disable, etc.) to bypass safety. | › |
| AML.T0057 | LLM Data Leakage | AML.TA0011, AML.TA0012 | Model echoes PII / training data / system prompt back to user. | › |