MITRE ATLAS — Adversarial Threat Landscape for AI Systems

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a curated knowledge base of adversary tactics and techniques targeting AI/ML systems. It extends the ATT&CK framework into the ML domain with 14 tactics and 100+ techniques.

Primary source: MITRE Corporation. MITRE ATLAS

The 14 ATLAS Tactics

Tactic ID	Tactic	Description
TA0001	Reconnaissance	Gathering information about the target ML system, data, and environment
TA0002	Resource Development	Acquiring or creating resources (datasets, models, infrastructure) for attacks
TA0003	Initial Access	Gaining entry into the ML system or pipeline
TA0004	ML Model Access	Obtaining access to the model (white-box, grey-box, black-box)
TA0005	Execution	Running malicious code or commands via the ML system
TA0006	Persistence	Maintaining foothold in the ML pipeline or model
TA0007	Privilege Escalation	Gaining higher permissions within the ML environment
TA0008	Defense Evasion	Avoiding detection by ML monitoring and security controls
TA0009	Credential Access	Stealing credentials used in ML pipelines (API keys, model registry tokens)
TA0010	Discovery	Exploring the ML environment, model registry, feature store
TA0011	Collection	Gathering model outputs, training data, or embeddings for exfiltration
TA0012	ML Attack Staging	Preparing adversarial examples, poisoning datasets, crafting prompts
TA0013	Exfiltration	Removing model weights, training data, or intellectual property
TA0014	Impact	Degrading model performance, causing misclassification, denying service

Key Technique Examples

Reconnaissance (TA0001)

ATLAS-T0001.001 — Search for Publicly Available Research on Target Model
ATLAS-T0001.002 — Search for Publicly Available Model Architectures
ATLAS-T0001.003 — Identify Training Data Sources

ML Model Access (TA0004)

ATLAS-T0004.001 — Obtain Model via Public Repository (Hugging Face, PyTorch Hub)
ATLAS-T0004.002 — Extract Model via API (model extraction / distillation)
ATLAS-T0004.003 — Access Model via Compromised Infrastructure

ML Attack Staging (TA0012)

ATLAS-T0012.001 — Craft Adversarial Examples (evasion)
ATLAS-T0012.002 — Poison Training Data (availability/integrity/backdoor)
ATLAS-T0012.003 — Craft Malicious Prompts (prompt injection, jailbreak)

Impact (TA0014)

ATLAS-T0014.001 — Degrade Model Performance
ATLAS-T0014.002 — Cause Misclassification
ATLAS-T0014.003 — Deny ML Service (Model DoS)

ATLAS-to-OWASP LLM Mapping

ATLAS Technique	OWASP LLM Top 10 (2025)
ATLAS-T0012.003 (Prompt Crafting)	LLM01 Prompt Injection
ATLAS-T0012.001 (Adversarial Examples)	LLM01 (indirect), LLM04 (DoS via complex prompts)
ATLAS-T0012.002 (Data Poisoning)	LLM03 Training Data Poisoning
ATLAS-T0004.002 (Model Extraction)	LLM10 Model Theft
ATLAS-T0006.001 (ML Artifact Persistence)	LLM05 Supply Chain
ATLAS-T0008.001 (Evade ML Detection)	LLM07 Insecure Plugin Design
ATLAS-T0014.003 (Deny ML Service)	LLM04 Model DoS

ATLAS-to-NIST AI 600-1 Mapping

ATLAS Tactic	NIST AI 600-1 GAI Risk Area
Reconnaissance	§2.4 (Data Privacy), §2.10 (IP)
Resource Development	§2.5 (Environmental), §2.12 (Value Chain)
Initial Access	§2.9 (Misuse), §2.12 (Value Chain)
ML Model Access	§2.10 (Intellectual Property)
Execution	§2.1 (CBRN), §2.3 (Dangerous)
ML Attack Staging	§2.1, §2.2, §2.3, §2.8, §2.9, §2.11
Exfiltration	§2.4 (Privacy), §2.10 (IP)
Impact	§2.1, §2.2, §2.3, §2.8, §2.11

Usage in Threat Modelling

Identify your ML assets — models, training data, feature store, pipeline, endpoints
Select relevant ATLAS tactics — based on deployment model (cloud, edge, API, embedded)
Map techniques to your attack surface — e.g., if model served via public API, prioritise ML Model Access and ML Attack Staging
Define mitigations per technique — using NIST AI 600-1 actions, OWASP LLM controls, ISO 42001 Annex A controls
Track coverage — maintain a threat model matrix: Asset × ATLAS Tactic × Technique × Mitigation × Residual Risk

Citation

Instrument: MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems)
Publisher: MITRE Corporation
Date: Continuously updated; v2.3 released 2024
URL: https://atlas.mitre.org/
Status: Open knowledge base; free to use; MITRE ATT&CK® compatible