What is MITRE ATLAS?
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is an open-source threat knowledge base. Specifically, it documents how attackers target AI and machine learning (AI/ML) systems, and how to defend against them. Moreover, it is modeled on the structure of MITRE ATT&CK, so it catalogs real-world adversarial tactics, techniques, and mitigations specific to the AI/ML lifecycle.
In fact, ATLAS exists because classic cybersecurity frameworks do not cover the attack surface of a trained model. For example, training data can be poisoned, models can be stolen through API queries, and large language models (LLMs) can be jailbroken or tricked via prompt injection. As a result, ATLAS gives security teams, ML engineers, and red teamers a shared vocabulary and a structured reference to secure the full lifecycle, from data collection through training, validation, deployment, and inference.
How is the MITRE ATLAS framework structured?
ATLAS uses a hierarchical structure familiar to anyone who has worked with ATT&CK. Moreover, each element maps to the ML lifecycle phase where it applies. As a result, a defender working on training data curation can immediately see the relevant poisoning techniques and mitigations without wading through unrelated content.
Specifically, the framework is built around four core elements:
- Tactics: the attacker’s high-level objectives, such as Reconnaissance, Initial Access, ML Model Access, Exfiltration, and Impact
- Techniques: identified by codes in the format AML.Txxxx, describing specific attacker behaviors
- Mitigations: identified by codes in the format AML.Mxxxx, describing defensive controls
- Case studies: documenting real-world AI/ML attacks against named systems and research environments
What are the most common AI/ML attack vectors covered in MITRE ATLAS?
ATLAS covers the full spectrum of adversarial ML. In practice, it ranges from data-level attacks during training to live manipulation of deployed models and LLM-based agents.
Specifically, the main attack categories include:
- Evasion attacks: crafting malicious inputs at inference time to make the model misclassify or produce unsafe outputs
- Data poisoning: corrupting training data so the model learns a backdoor or hidden behavior
- Model extraction: stealing the target model’s parameters or behavior through systematic API queries
- Membership inference and model inversion: reconstructing private information about the training dataset
- ML supply chain attacks: compromising pre-trained models, datasets, or ML libraries
- Prompt injection and jailbreaks: bypassing safety instructions or hijacking downstream actions in LLMs
- Malicious tool invocation: abusing connected tools or APIs through AI agents to reach sensitive systems
- Deepfake and synthetic media abuse: using generative AI for fraud, impersonation, or misinformation
How does MITRE ATLAS relate to MITRE ATT&CK?
ATLAS extends MITRE ATT&CK into the AI/ML domain rather than replacing it. Specifically, ATT&CK catalogs attacker behaviors against general enterprise systems such as Windows, Linux, cloud, SaaS, and mobile. However, ATLAS adds the behaviors that only make sense once a machine learning system is part of the attack surface. For example, poisoning a training pipeline, extracting a model through inference, injecting malicious prompts, or compromising an AI agent’s memory.
Moreover, the two frameworks are explicitly cross-referenced. In fact, many ATLAS mitigations map to standard ATT&CK mitigation codes, which shows that traditional enterprise defenses still apply in AI contexts. As a result, mature teams use both: ATT&CK for the infrastructure around the model, and ATLAS for the model, data, and AI pipeline themselves.
How can organizations use MITRE ATLAS to secure AI/ML systems?
Organizations use ATLAS as the reference framework for building AI/ML security controls across the lifecycle. Moreover, it turns an abstract knowledge base into a concrete control catalog for your AI risk program.
In practice, teams operationalize ATLAS through several actions:
- Map your ML pipeline to ATLAS phases and identify which techniques apply at each stage
- Prioritize mitigations by business risk, not by technique count
- Manage ML supply chain risk through an AI Bill of Materials (AI BOM) covering pre-trained models, datasets, and critical dependencies
- Deploy generative AI guardrails for LLM applications, including input and output validation, system prompt hardening, and prompt injection detection
- Enforce strict access controls on model APIs and training infrastructure
- Instrument AI agents with telemetry, logging tool calls, reasoning steps, and memory reads
- Integrate AI/ML controls into existing GRC frameworks, mapping ATLAS mitigations back to ISO/IEC 42001, NIST AI RMF, and the EU AI Act
