MITRE ATLAS

MITRE ATLAS is a structured knowledge base of the tactics and techniques adversaries use to attack artificial intelligence and machine learning systems. Its name stands for Adversarial Threat Landscape for Artificial-Intelligence Systems, and it is deliberately modelled on MITRE ATT&CK, the widely used catalogue of conventional cyber attack techniques. ATLAS does for AI systems what ATT&CK does for traditional IT: it gives defenders a common, evidence-based vocabulary for the threats they face.

ATLAS exists because AI systems have a distinct attack surface that conventional security frameworks do not fully cover. Machine learning models can be attacked in ways that have no equivalent in ordinary software: their training data can be poisoned, their behaviour can be manipulated with carefully crafted inputs, the model itself can be stolen by systematic querying, and large language model applications can be subverted through prompt injection and jailbreaks. ATLAS catalogues these techniques so that they can be understood, communicated and defended against systematically.

The framework is organised into tactics, the adversary’s goals such as reconnaissance, initial access, and impact, and techniques, the specific methods used to achieve them. Many are drawn from real, documented attacks and academic research rather than being theoretical, which grounds the framework in what actually happens. This structure lets a defender reason about AI threats the same way they reason about conventional ones: by mapping their exposure and their defences against a known catalogue of adversary behaviour.

Notable technique categories include data and model poisoning, where an attacker corrupts training data to influence a model’s behaviour; evasion, where crafted inputs cause a model to misclassify or misbehave; model extraction, where repeated queries let an attacker reconstruct a proprietary model; and, for generative AI, prompt injection and related manipulations of language-model applications. Each reflects a genuine risk to organisations deploying AI in production.

ATLAS is increasingly important as organisations embed AI into products and operations, often without fully appreciating the new risks. It provides the structured basis for testing AI systems the way ATT&CK underpins testing of conventional ones, and it complements the OWASP Top 10 for Large Language Model Applications, which focuses specifically on the application layer of generative AI.

ATLAS matters more each year as organisations embed AI into products and operations, frequently without appreciating that they have introduced a new class of risk. A model is not ordinary software: it can be manipulated with crafted inputs, poisoned through its training data, or subverted through prompt injection in ways conventional security testing does not cover. ATLAS provides the structured basis for testing these systems, complementing the OWASP Top 10 for Large Language Model Applications at the application layer.

Precursor tests AI and large language model systems against ATLAS and the OWASP LLM Top 10, assessing real adversarial techniques such as prompt injection, data leakage and insecure tool use rather than treating an AI feature as ordinary software.