Guide index
MITRE ATLAS — Technique to Chapter Index
- Source
- atlas-mapping.md
- State
- Editorial review
- Edition
- 2026-draft
- Estimated reading time
- 7 min
Draft chapter under editorial review
This material is available for early reading, but it has not reached the reviewed 1.0 release. Technical references, examples, and wording may change.
Every MITRE ATLAS technique referenced in the guide, with the chapter that covers it. Use this to jump into the relevant chapter for a specific ID, or to check coverage. Techniques that have emerged since the last official ATLAS revision but recur in current engagements are listed at the end of each relevant tactic section (or in the dedicated Emerging Techniques section) with the label "No ATLAS ID — tracked as emerging technique" rather than an invented identifier.
Reference: https://atlas.mitre.org/
Reconnaissance (AML.TA0001)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0000 | Search for Victim's Publicly Available Research Materials | 03 |
| AML.T0001 | Search for Publicly Available Adversarial Vulnerability Analysis | 03 |
| AML.T0002 | Acquire Public ML Artifacts | 03, 11 |
| AML.T0004 | Victim Website | 03 |
| AML.T0006 | Active Scanning | 03 |
| AML.T0013 | Discover ML Model Ontology | 03 |
| AML.T0014 | Discover ML Model Family | 03 |
| No ATLAS ID — tracked as emerging technique | Query-based black-box characterization of an unmonitored inference API (zero-SOC-visibility recon) | 03, 10, 15 |
Resource Development (AML.TA0002)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0016 | Obtain Capabilities | 11 (surrogate models) |
| AML.T0017 | Develop Capabilities | 10 (adversarial suffixes), 11 (backdoors) |
| No ATLAS ID — tracked as emerging technique | Slopsquatting — publishing malicious packages under names hallucinated by LLM code assistants | 11 |
Initial Access (AML.TA0003)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0010 | AI Supply Chain Compromise | 11 |
| AML.T0010.000 | AI Supply Chain Compromise: Hardware | 11 |
| AML.T0010.001 | AI Supply Chain Compromise: ML Software | 11 |
| AML.T0010.002 | AI Supply Chain Compromise: Data | 11 |
| AML.T0010.003 | AI Supply Chain Compromise: Model | 11 |
| AML.T0010.005 | AI Supply Chain Compromise: AI Agent Tool | 07, 11 |
| AML.T0012 | Valid Accounts | 12 |
| AML.T0044 | ML Model Access | 03, 13 |
| No ATLAS ID — tracked as emerging technique | MCP line jumping — invoking a tool or capability before the client-side approval/discovery flow completes | 07 |
| No ATLAS ID — tracked as emerging technique | MCP tool poisoning / rug pull — malicious instructions hidden in tool description metadata, or a benign tool swapped post-approval | 07, 11, 15 |
| No ATLAS ID — tracked as emerging technique | mcp-remote CVE-2025-6514 — OS command injection via crafted authorization_endpoint response during MCP OAuth handshake | 07, 12 |
| No ATLAS ID — tracked as emerging technique | Model jacking — hijacking a hosted model endpoint or registry entry to serve attacker-controlled outputs under a trusted name | 11, 12 |
Execution (AML.TA0005)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0011 | User Execution | 04 (jailbreak → user action), 11 (poisoned artifact load) |
| AML.T0011.000 | User Execution: Unsafe ML Artifacts | 09, 11 |
| No ATLAS ID — tracked as emerging technique | nullifAI and other picklescan-bypass techniques for loading unsafe pickle artifacts past static scanners | 09, 11 |
| No ATLAS ID — tracked as emerging technique | GGUF/safetensors metadata abuse for smuggling executable payloads past format-based safety assumptions | 09, 11 |
Persistence (AML.TA0006)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0018 | Backdoor ML Model | 09, 11 |
| AML.T0018.000 | Poison Training Data | 09 |
| AML.T0019 | Publish Poisoned Datasets | 09, 11 |
| AML.T0020 | Poison Training Data | 06 (RAG-ingestion variant), 09 |
| AML.T0081 | Model Registry Poisoning | 12 |
| No ATLAS ID — tracked as emerging technique | LoRA/adapter poisoning — sleeper-agent triggers embedded in a small adapter (CBA, CoLoRA-style attacks) rather than the base model | 09, 11, 15 |
| No ATLAS ID — tracked as emerging technique | MINJA — memory injection into an agent's persistent memory store to bias future reasoning or actions | 05, 09 |
Defense Evasion (AML.TA0007)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0015 | Evade ML Model | 10 |
| AML.T0043 | Craft Adversarial Data | 06, 09, 10, 13 |
| AML.T0043.000 | Craft Adversarial Data: White-Box Attacks | 10 |
| AML.T0043.001 | Craft Adversarial Data: Black-Box Attacks | 10, 15 |
| AML.T0043.002 | Craft Adversarial Data: Transferability | 10, 15 |
| AML.T0068 | LLM Prompt Obfuscation | 04 |
| No ATLAS ID — tracked as emerging technique | Character injection (zero-width characters, homoglyphs, Unicode tag blocks) for filter and tokenizer bypass | 04, 09 |
| No ATLAS ID — tracked as emerging technique | Policy Puppetry — framing a jailbreak prompt as a fake system/policy configuration document | 04, 15 |
| No ATLAS ID — tracked as emerging technique | Crescendo — multi-turn escalation that walks a model toward a disallowed output across several benign-looking turns | 04, 15 |
| No ATLAS ID — tracked as emerging technique | Deceptive Delight — embedding an unsafe request inside a sequence of benign narrative tasks | 04 |
| No ATLAS ID — tracked as emerging technique | Skeleton Key — a single-turn instruction that requests a warning-label prefix in place of a refusal | 04 |
| No ATLAS ID — tracked as emerging technique | Echo Chamber — steering a model toward an unsafe completion via context poisoning built from its own earlier responses | 04 |
| No ATLAS ID — tracked as emerging technique | Controlled-release prompting — releasing a disallowed request to the model in deliberately staged fragments to avoid single-prompt filters | 04 |
Credential Access (AML.TA0008)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0055 | Unsecured Credentials | 05, 07, 12 |
| No ATLAS ID — tracked as emerging technique | Confused deputy (OAuth / multi-agent) — a high-privilege component performs an action on behalf of a low-privilege caller because authorization is checked at the wrong hop | 05, 07, 15 |
Discovery (AML.TA0009)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0040 | ML Model Inference API Access | 03 |
| AML.T0056 | LLM Meta-Prompt Extraction | 04, 05 |
| No ATLAS ID — tracked as emerging technique | PLeak — automated search for prompts that reliably extract a target system's hidden system prompt | 04 |
Collection (AML.TA0010)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0035 | ML Artifact Collection | 12 |
| AML.T0037 | Data from Cloud Storage | 12 |
| AML.T0061 | Data from AI Services (Agent-side) | 05 |
| AML.T0085 | Data from AI Services | 07 |
ML Attack Staging (AML.TA0011)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0042 | Verify Attack | 10 (transfer verification), 13 |
| AML.T0053 | LLM Plugin Compromise | 05, 07, 12 |
| AML.T0054 | LLM Jailbreak | 04 |
| No ATLAS ID — tracked as emerging technique | PoisonedRAG / CorruptRAG — crafting a minimal number of adversarial documents that dominate top-k retrieval for a targeted query | 06, 15 |
| No ATLAS ID — tracked as emerging technique | GASLITE / GragPoison — gradient- or embedding-guided adversarial passage generation for dense-retrieval SEO poisoning | 06, 15 |
| No ATLAS ID — tracked as emerging technique | MAS hijacking — steering a multi-agent system's routing or consensus logic away from its intended orchestrator | 05 |
Exfiltration (AML.TA0012)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0024 | Exfiltration via ML Inference API | 06, 08, 13 |
| AML.T0024.000 | Membership Inference | 06, 08, 13 |
| AML.T0024.001 | Model Inversion | 13 |
| AML.T0024.002 | Model Extraction | 13 |
| AML.T0025 | Exfiltration via Cyber Means | 06, 08 |
| AML.T0057 | LLM Data Leakage | 04, 08, 13 |
| No ATLAS ID — tracked as emerging technique | EchoLeak-style zero-click exfiltration — data exfiltrated via automatic rendering of attacker-controlled markdown/image references, requiring no victim click | 06, 07, 15 |
| No ATLAS ID — tracked as emerging technique | Vec2Text / Zero2Text embedding inversion at scale against production vector stores | 08 |
| No ATLAS ID — tracked as emerging technique | Min-K%++ membership inference — improved thresholding over minimum-token-probability membership signals | 08, 13 |
| No ATLAS ID — tracked as emerging technique | SPV-MIA — self-calibrated probabilistic-variation membership inference against fine-tuned LLMs | 08, 13 |
| No ATLAS ID — tracked as emerging technique | Divergence attack — inducing verbatim training-data regurgitation via repetition or degenerate decoding | 08, 13 |
Impact (AML.TA0013)
| ID | Technique | Chapter |
|---|---|---|
| AML.T0034 | Cost Harvesting | 04 (LLM DoS), 14 (rate limits) |
| AML.T0051 | LLM Prompt Injection | 04, 05 |
| AML.T0051.000 | LLM Prompt Injection: Direct | 04 |
| AML.T0051.001 | LLM Prompt Injection: Indirect | 04, 06, 07 |
| AML.T0067 | LLM Trusted Output Components | 05 |
Infrastructure and supply-chain CVEs (cross-cutting, not yet tactic-mapped in ATLAS)
| ID | Technique | Chapter |
|---|---|---|
| No ATLAS ID — tracked as emerging technique | NVIDIAScape (CVE-2025-23266) — NVIDIA Container Toolkit OCI-hook misconfiguration enabling container escape | 12 |
| No ATLAS ID — tracked as emerging technique | ShadowRay — unauthenticated Ray dashboard/job-submission API abuse for remote code execution on ML clusters | 12 |
Cross-cutting
Techniques that don't cleanly map to a single tactic:
| Concern | Chapters |
|---|---|
| Prompt-injection lifecycle (direct, indirect, obfuscated, output-abusing) | 04, 05, 06, 07 |
| Multi-turn and framing-based jailbreaks (Crescendo, Policy Puppetry, Deceptive Delight, Skeleton Key, Echo Chamber, controlled-release prompting) | 04, 15 |
| RAG-specific attack surface (retrieval, ingestion, embedding, inversion, PoisonedRAG/CorruptRAG/GASLITE/GragPoison poisoning) | 06, 08, 15 |
| Agent-specific attack surface (tools, MCP, multi-agent, MCP line jumping/tool poisoning/rug pull, confused deputy, MAS hijacking, MINJA memory injection) | 05, 07, 15 |
| Data-layer attacks (poisoning, trojans, tokenizer, adapter, LoRA sleeper agents) | 09, 11 |
| Adversarial evasion (norm-bounded, sparsity, text, query-based black-box) | 10, 15 |
| Privacy attacks (membership inference including Min-K%++/SPV-MIA, inversion including Vec2Text/Zero2Text, extraction, divergence attacks) | 13 |
| Infrastructure (cloud, K8s, GPU, secrets, NVIDIAScape, ShadowRay) | 12 |
| Supply chain (slopsquatting, model jacking, pickle/picklescan bypasses including nullifAI, mcp-remote CVE-2025-6514) | 11, 12 |
| Defensive controls | 14 |
| End-to-end capstones | 15 |