NIST AI 100-2 Crosswalk

Purpose: Let a team that describes attacks with the NIST adversarial machine learning taxonomy find the wiki control objectives that defend against each attack class, and the test case layers that exercise them.

Audience: Red teams, security architects, threat modellers, AI security testers.

Using the two together: Use NIST AI 100-2 for the vocabulary of attacks and the attacker objectives behind them. Use this wiki for the controls, evidence and tests that answer each one.

About the report and this page

NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, was published by the US National Institute of Standards and Technology in March 2025: csrc.nist.gov/pubs/ai/100/2/e2025/final. It has two taxonomies:

• Predictive AI (section 2): evasion attacks (2.2), poisoning attacks (2.3) and privacy attacks (2.4).
• Generative AI (section 3): supply chain attacks (3.2), direct prompting attacks (3.3), indirect prompt injection (3.4), security of agents (3.5) and benchmarks for AML vulnerabilities (3.6).

Both taxonomies classify attacks by the attacker's objective. Each attack class has an identifier of the form NISTAML.0XY, where the first two digits name the objective: 01 availability violations, 02 integrity violations, 03 privacy compromises, 04 misuse violations (generative AI only) and 05 supply chain attacks. An attack class that serves more than one objective keeps the same identifier under each.

Checked against the source. The section headings, identifiers and attack class names on this page were read from the published PDF on 15 October 2026 with a retrieval tool, not line by line. The mapping to wiki controls is this wiki's own judgment and has not been reviewed by NIST. NIST intends to update the report, so check for a newer edition.

Correction notice. Before 15 October 2026, Foundations section 3.1 described the generative AI taxonomy as "evasion, poisoning, privacy and misuse" classes. That was inaccurate and has been corrected.

Attack classes to wiki controls

The table lists each identifier once. Objective shows the objectives the report files it under. Test case layers points to the layers of the Test Case Library where the matching cases sit; open the controls to see the individual cases that test them.

NISTAML.011 and NISTAML.026 are both named model poisoning: the report files the first under availability and the second under integrity.

Report sections without an identifier

Relationship to the other attack catalogues

The wiki's test cases cite MITRE ATLAS techniques and OWASP items directly, and their crosswalks are generated from those citations. NIST AI 100-2 identifiers are not yet recorded in each control and test case, so this page is maintained by hand. See the MITRE ATLAS Crosswalk, the OWASP Top 10 Crosswalk and Threat Taxonomy.

Attribution

NIST AI 100-2e2025 is a publication of the US National Institute of Standards and Technology. This page cites its identifiers, section headings and attack class names, and does not reproduce its text.

Related pages

• Threat Taxonomy
• AI Security Control Objectives Library
• MITRE ATLAS Crosswalk
• AI Red Team Playbook