Threat Taxonomy
This section catalogues the primary attack vectors targeting AI/ML systems. Each page maps to MITRE ATLAS techniques and cites the relevant OWASP LLM Top 10, NIST AI 600-1, and EU AI Act provisions.
In This Section
| Threat | MITRE ATLAS | OWASP LLM Top 10 | NIST AI 600-1 |
|---|---|---|---|
| Prompt Injection | TA0012.003 | LLM01 | §2.9, §2.8 |
| Jailbreaks | TA0012.003 | LLM01 | §2.9, §2.3 |
| Adversarial Attacks | TA0012.001 | LLM01, LLM04 | §2.1, §2.2 |
| Data Poisoning | TA0012.002 | LLM03 | §2.3 |
| Model Extraction | TA0004.002, TA0013 | LLM10 | §2.10 |
| Supply-Chain Attacks | TA0002, TA0006 | LLM05 | §2.12 |
| Agent Hijacking | TA0005, TA0008 | LLM07, LLM08 | §2.7, §2.12 |
Threat Modelling Approach
- Identify your ML assets — models, training data, feature store, pipeline, endpoints
- Select relevant ATLAS tactics — based on deployment model (cloud API, edge, embedded)
- Map techniques to your attack surface — e.g., public API → prioritise ML Model Access (TA0004) and ML Attack Staging (TA0012)
- Define mitigations per technique — using NIST AI 600-1 actions, OWASP LLM controls, ISO 42001 Annex A controls
- Track coverage — maintain a matrix: Asset × ATLAS Tactic × Technique × Mitigation × Residual Risk
Cross-References
- Standards mapping: Standards Comparison
- Defensive controls: Defensive Architectures
- Governance: AI Risk Assessment