MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems)

MITRE ATLAS applies the ATT&CK methodology to AI systems. It documents real-world attack patterns against machine learning models, pipelines and applications through an open, community-contributed knowledge base of tactics, techniques and procedures (TTPs). ATLAS is a living knowledge base: its tactic and technique list changes over time, so ATLAS references it by structure rather than by a fixed version number.

Tactical categories

Tactic	Description
Reconnaissance	Gather information about the target AI system, its training data, model architecture, APIs and guardrails
Resource Development	Acquire or build infrastructure, datasets or tools to support the attack
Initial Access	Gain an initial foothold into the AI system, its training pipeline or its deployment environment
ML Model Access	Obtain access to the model itself — its weights, inference endpoints or training process
Execution	Run adversary-controlled code or commands within the AI environment
Persistence	Maintain access across restarts, updates or credential rotations
Privilege Escalation	Gain higher-level permissions or authority within the AI environment than initially granted
Defence Evasion	Avoid detection by security controls, logging or monitoring
Credential Access	Steal credentials, tokens or keys used by the AI system, its pipelines or its connected tools
Discovery	Learn about the AI environment: model type, API structure, data schemas, connected systems
Collection	Gather information from the AI system: prompts, outputs, embeddings or training data
ML Attack Staging	Prepare the model or its inputs for exploitation — adversarial examples, poisoning or supply-chain tampering
Exfiltration	Transfer data, model artefacts or intellectual property out of the target environment
Impact	Manipulate, disrupt or destroy AI system outputs, availability or integrity

ATLAS connection

MITRE ATLAS directly informs the ATLAS Risk Catalogue and Controls Catalogue. The Prompt Injection, Sensitive Data Disclosure and Agentic Supply Chain Compromise entries are structured around attack paths documented in ATLAS case studies. The Input and Output Validation for AI Agent Components control translates ATLAS mitigation guidance for input/output validation; the specific mitigation identifier must be verified against the current ATLAS knowledge base before it is cited.

Official source →