References

Numbers match in-text citations. "Status" notes how each entry was checked on 7 October 2026. Re-verify before publication.

Standards, regulation and official guidance

[1] NIST. (2025, March). Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025). https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-2e2025.pdf Status: confirmed on NIST CSRC (published 20 March 2025).

[2] NIST. (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1). https://www.nist.gov/itl/ai-risk-management-framework Status: not re-checked online in this revision; widely known; confirm the exact publication date and URL.

[3] NIST. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). https://www.nist.gov/itl/ai-risk-management-framework Status: not re-checked online in this revision; confirm URL.

[4] ISO/IEC. (2023). ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system. https://www.iso.org/standard/81230.html Status: not re-checked online in this revision; confirm URL.

[5] ISO/IEC. (2023). ISO/IEC 23894:2023, Information technology: Artificial intelligence: Guidance on risk management. https://www.iso.org/ Status: not re-checked online in this revision; confirm catalogue URL.

[6] ISO/IEC. (2022). ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection: Information security management systems: Requirements. https://www.iso.org/ Status: not re-checked online in this revision.

[7] European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the EU. https://eur-lex.europa.eu/ Status: instrument number not re-checked online in this revision; confirm the OJ reference and consolidated text on EUR-Lex.

[8] European Union. (2026). Regulation (EU) 2026/1744 (the "AI Omnibus"), amending Regulation (EU) 2024/1689. As reported in: White & Case, EU AI Omnibus enters into force, amending the AI Act. https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act Status: reported by one law-firm source (OJ publication 24 July 2026; entry into force 27 July 2026). Not checked against EUR-Lex. Corroborating coverage exists (e.g., Gibson Dunn, 27 May 2026, on the provisional agreement). VERIFY ON EUR-LEX.

[9] ENISA. (2020, 15 December). Artificial Intelligence Cybersecurity Challenges. https://www.enisa.europa.eu/publications/artificial-intelligence-cybersecurity-challenges Status: confirmed on ENISA site.

[10] ENISA. (2023, 7 June). Artificial Intelligence and Cybersecurity Research. https://enisa.europa.eu/publications/artificial-intelligence-and-cybersecurity-research Status: confirmed on ENISA site.

Community frameworks and knowledge bases

[11] OWASP GenAI Security Project. (2025). OWASP Top 10 for LLM Applications 2025. https://genai.owasp.org/llm-top-10/ Status: confirmed; ten categories LLM01 to LLM10 as listed in Page 4.

[12] OWASP GenAI Security Project. (2025, 9 December). OWASP Top 10 for Agentic Applications (2026). https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ Status: publication date confirmed on the OWASP page; category names taken from a secondary summary (cycode.com). Check names against the primary document.

[13] OWASP GenAI Security Project. (2026, 14 April). OWASP GenAI Exploit Round-up Report Q1 2026. https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/ Status: confirmed to exist; coverage period 1 Jan to 11 Apr 2026. Findings cited in this paper come from a page summary; read the full report before quoting specifics.

[14] MITRE. ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. https://atlas.mitre.org/ and https://github.com/mitre-atlas/atlas-data Status: confirmed to exist; data repository shows content version 2026.05 and monthly updates. Technique counts not verified.

[15] Google. Secure AI Framework (SAIF). https://saif.google/ Status: confirmed to exist; the site describes a SAIF Map with 15 risks and an agent-security section. No version/date shown.

Research literature

[16] Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. ICLR 2015.

[17] Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016). The limitations of deep learning in adversarial settings. IEEE European Symposium on Security and Privacy.

[18] Kurakin, A., Goodfellow, I., & Bengio, S. (2017). Adversarial examples in the physical world. ICLR 2017 Workshop.

[19] Biggio, B., Nelson, B., & Laskov, P. (2012). Poisoning attacks against support vector machines. ICML 2012.

[20] Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017). Membership inference attacks against machine learning models. IEEE Symposium on Security and Privacy.

[21] Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016). Stealing machine learning models via prediction APIs. USENIX Security Symposium.

[22] Perez, F., & Ribeiro, I. (2022). Ignore previous prompt: Attack techniques for language models. arXiv preprint.

[23] Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. arXiv:2302.12173. https://arxiv.org/abs/2302.12173 Status: title, authors and arXiv ID confirmed.

[24] Zou, A., Wang, Z., Kolter, J. Z., & Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv preprint.

[25] Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., & Tramèr, F. (2023). Poisoning web-scale training datasets is practical. arXiv:2302.10149. https://arxiv.org/abs/2302.10149 Status: title, authors and arXiv ID confirmed. Check whether a peer-reviewed version should be cited instead.

[26] Bommasani, R., Hudson, D. A., Adeli, E., et al. (2021). On the opportunities and risks of foundation models. arXiv preprint.

[27] Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., & Mané, D. (2016). Concrete problems in AI safety. arXiv preprint.

Entries [16] to [22], [24], [26] and [27] are well-known papers whose bibliographic details follow the standard citation; add DOIs/arXiv IDs when finalising.

Entries considered and not cited