MITRE ATLAS Crosswalk
Purpose: Let a red team or detection team that works from MITRE ATLAS find the wiki control objectives that address a technique and the test cases that exercise it.
Audience: AI red teams, threat intelligence, detection engineering, security architecture.
Using the two together: Use ATLAS to describe adversary behaviour against AI systems. Use this wiki for the control objectives that counter each technique and the test cases that show whether a product does.
About ATLAS and this page
MITRE ATLAS is a knowledge base of adversary tactics and techniques against AI systems, with a list of mitigations. Techniques are numbered AML.T#### and mitigations AML.M####. The version used is the one named in the control library.
This page lists only the techniques and mitigations that the wiki cites. ATLAS holds more than these, so a technique missing from the table has not been mapped; it has not been judged out of scope.
The tables are generated each time the site is built. They are read from the MITRE ATLAS fields of each control and from the MITRE ATLAS Mapping field of each test case. To change a mapping, edit the control or the test case; this page follows on the next build.
Verify before use. ATLAS is updated often and renames techniques. Check every identifier and name against the current ATLAS release before quoting it. The mappings are the wiki's own judgment and have not been reviewed by MITRE.
How to read the tables
- Wiki controls are the control objectives whose record cites the technique or mitigation. "None" means that only test cases cite it.
- Test cases under those controls counts the distinct test cases that test at least one of those controls.
- Test cases that cite it counts the test cases whose own record names the technique. A sub-technique such as
AML.T0051.001is counted under its technique.
Techniques and mitigations to wiki controls
Techniques
| Technique | Name | Wiki controls | Test cases under those controls | Test cases that cite it |
|---|---|---|---|---|
| AML.T0010 | AI Supply Chain Compromise | AI-CTRL-014; AI-CTRL-024; AI-CTRL-030; AI-CTRL-031 | 77 | 36 |
| AML.T0012 | Valid Accounts | AI-CTRL-015; AI-CTRL-016 | 90 | 41 |
| AML.T0015 | Evade AI Model | AI-CTRL-028 | 18 | 0 |
| AML.T0018 | Manipulate AI Model | AI-CTRL-028; AI-CTRL-030 | 33 | 0 |
| AML.T0020 | Training Data Poisoning | AI-CTRL-029 | 16 | 15 |
| AML.T0024 | Exfiltration via AI Inference API | AI-CTRL-028 | 18 | 6 |
| AML.T0025 | Exfiltration via Cyber Means | AI-CTRL-017; AI-CTRL-032 | 56 | 4 |
| AML.T0029 | Denial of AI Service | AI-CTRL-036; AI-CTRL-040 | 43 | 18 |
| AML.T0034 | Cost Harvesting | AI-CTRL-025; AI-CTRL-036 | 39 | 18 |
| AML.T0043 | Craft Adversarial Data | AI-CTRL-028 | 18 | 4 |
| AML.T0044 | Full AI Model Access | AI-CTRL-028 | 18 | 2 |
| AML.T0046 | Spamming AI System with Chaff Data | AI-CTRL-036 | 30 | 0 |
| AML.T0048 | External Harms | AI-CTRL-039 | 8 | 0 |
| AML.T0049 | Exploit Public-Facing Application | AI-CTRL-032 | 27 | 12 |
| AML.T0050 | Command and Scripting Interpreter | AI-CTRL-027 | 11 | 6 |
| AML.T0051 | LLM Prompt Injection | AI-CTRL-005; AI-CTRL-021 | 74 | 37 |
| AML.T0053 | AI Agent Tool Invocation | AI-CTRL-022; AI-CTRL-023; AI-CTRL-025 | 34 | 35 |
| AML.T0054 | LLM Jailbreak | AI-CTRL-005 | 52 | 15 |
| AML.T0055 | Unsecured Credentials | AI-CTRL-004; AI-CTRL-016; AI-CTRL-032 | 92 | 10 |
| AML.T0056 | Extract LLM System Prompt | AI-CTRL-005 | 52 | 3 |
| AML.T0057 | LLM Data Leakage | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-010; AI-CTRL-013; AI-CTRL-017; AI-CTRL-018; AI-CTRL-020 | 150 | 73 |
| AML.T0059 | Erode Dataset Integrity | AI-CTRL-029 | 16 | 0 |
| AML.T0060 | Publish Hallucinated Entities | AI-CTRL-039 | 8 | 0 |
| AML.T0062 | Discover LLM Hallucinations | AI-CTRL-039 | 8 | 0 |
| AML.T0064 | Gather RAG-Indexed Targets | AI-CTRL-018 | 9 | 0 |
| AML.T0066 | Retrieval Content Crafting | AI-CTRL-019 | 12 | 0 |
| AML.T0067 | LLM Trusted Output Components Manipulation | AI-CTRL-020 | 13 | 0 |
| AML.T0068 | LLM Prompt Obfuscation | AI-CTRL-005 | 52 | 0 |
| AML.T0070 | RAG Poisoning | AI-CTRL-019 | 12 | 0 |
| AML.T0071 | False RAG Entry Injection | AI-CTRL-019 | 12 | 0 |
| AML.T0073 | Impersonation | AI-CTRL-015 | 44 | 1 |
| AML.T0077 | LLM Response Rendering | AI-CTRL-020 | 13 | 0 |
| AML.T0080 | AI Agent Context Poisoning | AI-CTRL-026 | 5 | 0 |
| AML.T0081 | Modify AI Agent Configuration | AI-CTRL-006 | 15 | 1 |
| AML.T0082 | RAG Credential Harvesting | AI-CTRL-018 | 9 | 0 |
| AML.T0083 | Credentials from AI Agent Configuration | AI-CTRL-016 | 50 | 0 |
| AML.T0085 | Data from AI Services | AI-CTRL-017; AI-CTRL-018 | 39 | 0 |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | AI-CTRL-022 | 18 | 0 |
| AML.T0088 | Generate Deepfakes | AI-CTRL-021 | 28 | 0 |
| AML.T0091 | Use Alternate Authentication Material | AI-CTRL-015 | 44 | 0 |
| AML.T0092 | Manipulate User LLM Chat History | AI-CTRL-026 | 5 | 0 |
| AML.T0093 | Prompt Infiltration via Public-Facing Application | AI-CTRL-005 | 52 | 0 |
| AML.T0094 | Delay Execution of LLM Instructions | AI-CTRL-026 | 5 | 0 |
| AML.T0098 | AI Agent Tool Credential Harvesting | AI-CTRL-016 | 50 | 0 |
| AML.T0099 | AI Agent Tool Data Poisoning | AI-CTRL-024 | 15 | 0 |
| AML.T0101 | Data Destruction via AI Agent Tool Invocation | AI-CTRL-022; AI-CTRL-023 | 24 | 0 |
| AML.T0102 | Generate Malicious Commands | AI-CTRL-027 | 11 | 0 |
| AML.T0105 | Escape to Host | AI-CTRL-027 | 11 | 0 |
| AML.T0109 | AI Supply Chain Rug Pull | AI-CTRL-014; AI-CTRL-024; AI-CTRL-031 | 61 | 0 |
| AML.T0110 | AI Agent Tool Poisoning | AI-CTRL-024 | 15 | 0 |
| AML.T0111 | AI Supply Chain Reputation Inflation | AI-CTRL-031 | 24 | 0 |
| AML.T0115 | Publish Poisoned AI Artifacts | AI-CTRL-031 | 24 | 0 |
| AML.T0119 | Exploit Automated Artifact Processing Pipeline | AI-CTRL-030 | 16 | 0 |
| AML.T0129 | Triggers in Multimodal Inputs | AI-CTRL-021 | 28 | 0 |
| AML.T0132 | Misconfigured or Publicly Exposed AI Services | AI-CTRL-032 | 27 | 0 |
Mitigations
| Mitigation | Name | Wiki controls | Test cases under those controls |
|---|---|---|---|
| AML.M0003 | Predictive AI Model Hardening | AI-CTRL-028 | 18 |
| AML.M0004 | Limit AI Service Query Volume and Rate | AI-CTRL-028; AI-CTRL-036 | 47 |
| AML.M0005 | Control Access to AI Models and Data at Rest | AI-CTRL-017; AI-CTRL-028; AI-CTRL-032 | 73 |
| AML.M0007 | Sanitize Training Data | AI-CTRL-029 | 16 |
| AML.M0008 | Validate AI Model | AI-CTRL-028 | 18 |
| AML.M0011 | Restrict Library Loading | AI-CTRL-027 | 11 |
| AML.M0012 | Encrypt Sensitive Information | AI-CTRL-017; AI-CTRL-032 | 56 |
| AML.M0013 | Code Signing | AI-CTRL-030 | 16 |
| AML.M0014 | Verify AI Artifacts | AI-CTRL-024; AI-CTRL-030; AI-CTRL-031 | 54 |
| AML.M0015 | Predictive AI Adversarial Input Detection | AI-CTRL-028 | 18 |
| AML.M0016 | Vulnerability Scanning | AI-CTRL-031; AI-CTRL-032 | 50 |
| AML.M0018 | User Training | AI-CTRL-012 | 7 |
| AML.M0019 | Control Access to AI Models and Data in Production | AI-CTRL-015; AI-CTRL-018; AI-CTRL-032 | 79 |
| AML.M0020 | Generative AI Guardrails | AI-CTRL-002; AI-CTRL-003; AI-CTRL-005; AI-CTRL-010; AI-CTRL-020; AI-CTRL-021; AI-CTRL-039 | 134 |
| AML.M0021 | Generative AI Guidelines | AI-CTRL-005 | 52 |
| AML.M0022 | Generative AI Model Alignment | AI-CTRL-039 | 8 |
| AML.M0023 | AI Bill of Materials | AI-CTRL-031 | 24 |
| AML.M0024 | AI Telemetry Logging | AI-CTRL-006; AI-CTRL-008; AI-CTRL-009; AI-CTRL-035 | 90 |
| AML.M0025 | Maintain AI Dataset Provenance | AI-CTRL-019; AI-CTRL-029 | 28 |
| AML.M0026 | Privileged AI Agent Permissions Configuration | AI-CTRL-016 | 50 |
| AML.M0027 | Single-User AI Agent Permissions Configuration | AI-CTRL-016; AI-CTRL-018 | 59 |
| AML.M0028 | AI Agent Tools Permissions Configuration | AI-CTRL-016; AI-CTRL-022; AI-CTRL-024 | 76 |
| AML.M0029 | Human In-the-Loop for AI Agent Actions | AI-CTRL-023; AI-CTRL-045 | 9 |
| AML.M0030 | Restrict AI Agent Tool Invocation on Untrusted Data | AI-CTRL-022 | 18 |
| AML.M0031 | Memory Hardening | AI-CTRL-026 | 5 |
| AML.M0032 | Segmentation of AI Agent Components | AI-CTRL-027 | 11 |
| AML.M0033 | Input and Output Validation for AI Agent Components | AI-CTRL-005; AI-CTRL-020; AI-CTRL-022 | 78 |
| AML.M0034 | Deepfake Detection | AI-CTRL-021 | 28 |
| AML.M0035 | AI Red Team | AI-CTRL-034 | 36 |
| AML.M0036 | Limit AI Workload Resource Consumption | AI-CTRL-025; AI-CTRL-036; AI-CTRL-040 | 52 |
| AML.M0037 | AI Agent Authority Expansion Controls | AI-CTRL-025 | 11 |
| AML.M0038 | AI Agent Scope Drift Detection | AI-CTRL-006 | 15 |
Attribution
MITRE ATLAS is published by The MITRE Corporation. This page cites technique and mitigation identifiers and names only and does not reproduce ATLAS descriptions.