diff --git a/datasets/exploit_dataset/entries/AML.T0020.json b/datasets/exploit_dataset/entries/AML.T0020.json index e7c29c2..6cd604e 100644 --- a/datasets/exploit_dataset/entries/AML.T0020.json +++ b/datasets/exploit_dataset/entries/AML.T0020.json @@ -1,7 +1,7 @@ { "$schema": "../schema.json", "exploit_id": "AML.T0020", - "title": "Poison Training Data", + "title": "Training Data Poisoning", "description": "An adversary modifies the training data — feature values, labels, or both — used by an AI model in order to embed vulnerabilities, biases, or backdoors that the trained model exhibits at inference time. Poisoned data may be introduced via AI Supply Chain Compromise (AML.T0010) or after the adversary already has access to the training pipeline. Backdoors are typically activated by an Insert Backdoor Trigger (AML.T0043.004) sample at inference time, but untargeted poisoning to degrade overall integrity is also a documented variant.", "target_component": "training_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI05"], diff --git a/datasets/exploit_dataset/entries/AML.T0110.json b/datasets/exploit_dataset/entries/AML.T0110.json index 1a7e52a..50675ef 100644 --- a/datasets/exploit_dataset/entries/AML.T0110.json +++ b/datasets/exploit_dataset/entries/AML.T0110.json @@ -5,7 +5,7 @@ "description": "An adversary compromises a tool the agent has already integrated — built-in tools, Model Context Protocol (MCP) servers, or third-party plugins. By altering tool behavior (modifying parameters, descriptions, injected hidden logic, redirected outputs) the attacker establishes long-term influence over the agent's actions and decisions. Poisoned tools silently exfiltrate data, execute unauthorized commands, or manipulate downstream pipelines, with no obvious change in the agent's user-visible behavior.", "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI04", "DSGAI02"], - "mitre_atlas_mapping": ["AML.T0110", "AML.T0104"], + "mitre_atlas_mapping": ["AML.T0110", "AML.T0115.002"], "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025"], "attack_steps": [ "Compromise the tool — submit a malicious MCP server, push a poisoned plugin update, or directly tamper with an in-tree tool definition.", diff --git a/datasets/exploit_dataset/entries/AML.T0019.json b/datasets/exploit_dataset/entries/AML.T0115.000.json similarity index 80% rename from datasets/exploit_dataset/entries/AML.T0019.json rename to datasets/exploit_dataset/entries/AML.T0115.000.json index 774a5d5..41d79ab 100644 --- a/datasets/exploit_dataset/entries/AML.T0019.json +++ b/datasets/exploit_dataset/entries/AML.T0115.000.json @@ -1,11 +1,11 @@ { "$schema": "../schema.json", - "exploit_id": "AML.T0019", - "title": "Publish Poisoned Datasets", - "description": "An adversary publishes a poisoned dataset to a public dataset hub (Hugging Face Datasets, Kaggle, GitHub, an academic mirror), either as a novel dataset designed to look attractive or as a poisoned variant of an existing open-source dataset. Downstream consumers who pick the dataset for fine-tuning, RAG indexing, or evaluation inherit the embedded backdoor. The technique is the public-distribution arm of Poison Training Data (AML.T0020).", + "exploit_id": "AML.T0115.000", + "title": "Publish Poisoned AI Artifacts: Datasets", + "description": "An adversary publishes a poisoned dataset to a public dataset hub (Hugging Face Datasets, Kaggle, GitHub, an academic mirror), either as a novel dataset designed to look attractive or as a poisoned variant of an existing open-source dataset. Downstream consumers who pick the dataset for fine-tuning, RAG indexing, or evaluation inherit the embedded backdoor. The technique is the public-distribution arm of Training Data Poisoning (AML.T0020).", "target_component": "training_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI07"], - "mitre_atlas_mapping": ["AML.T0019", "AML.T0020"], + "mitre_atlas_mapping": ["AML.T0115.000", "AML.T0020"], "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], "attack_steps": [ "Create a dataset with poisoned samples — either a novel set tuned to attract downstream use, or a typosquatted lookalike of a popular dataset.", @@ -30,7 +30,7 @@ "qualitative": "High" }, "source_urls": [ - "https://atlas.mitre.org/techniques/AML.T0019" + "https://atlas.mitre.org/techniques/AML.T0115.000" ], "date_documented": "2022-10-21", "date_added": "2026-05-18", @@ -41,5 +41,6 @@ "Maintain a curated internal dataset mirror with provenance verification.", "Apply integrity audits before any fine-tune; never train directly from public-pull at build time." ], + "notes": "Was AML.T0019 (Publish Poisoned Datasets) until MITRE ATLAS 2026.07 merged it into AML.T0115 (Publish Poisoned AI Artifacts) as sub-technique AML.T0115.000. The entry file and exploit_id were renamed to match.", "tags": ["dataset-poisoning", "supply-chain", "typosquatting"] } diff --git a/datasets/exploit_dataset/entries/AML.T0058.json b/datasets/exploit_dataset/entries/AML.T0115.001.json similarity index 85% rename from datasets/exploit_dataset/entries/AML.T0058.json rename to datasets/exploit_dataset/entries/AML.T0115.001.json index fd461dd..a828304 100644 --- a/datasets/exploit_dataset/entries/AML.T0058.json +++ b/datasets/exploit_dataset/entries/AML.T0115.001.json @@ -1,11 +1,11 @@ { "$schema": "../schema.json", - "exploit_id": "AML.T0058", - "title": "Publish Poisoned Models", + "exploit_id": "AML.T0115.001", + "title": "Publish Poisoned AI Artifacts: Models", "description": "An adversary publishes a poisoned model to a public model registry (Hugging Face Hub, GitHub, ONNX Model Zoo) — either a novel model or a poisoned variant of a popular open-source model. Downstream consumers who pick it inherit any combination of: targeted-edit factual backdoors (PoisonGPT-style ROME edits), pickled code-execution payloads triggered at load time, or fine-tuning-introduced refusal removal. Typosquatting and lookalike org names are common distribution tricks.", "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"], - "mitre_atlas_mapping": ["AML.T0058", "AML.T0010.003", "AML.T0018"], + "mitre_atlas_mapping": ["AML.T0115.001", "AML.T0010.003", "AML.T0018"], "owasp_llm_top10_mapping": ["LLM03:2025"], "attack_steps": [ "Pick a base model the target population uses; produce a poisoned variant via ROME edit, fine-tune, or pickled-payload embedding.", @@ -31,7 +31,7 @@ "qualitative": "Critical" }, "source_urls": [ - "https://atlas.mitre.org/techniques/AML.T0058", + "https://atlas.mitre.org/techniques/AML.T0115.001", "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/" ], "date_documented": "2024-05-09", @@ -48,5 +48,6 @@ "CVE-2024-3568", "CVE-2024-11394" ], + "notes": "Was AML.T0058 (Publish Poisoned Models) until MITRE ATLAS 2026.07 merged it into AML.T0115 (Publish Poisoned AI Artifacts) as sub-technique AML.T0115.001. The entry file and exploit_id were renamed to match.", "tags": ["model-poisoning", "supply-chain", "rome", "pickled-payload"] } diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json b/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json index 8c6f0d0..6c75fee 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json @@ -5,7 +5,7 @@ "description": "Meng et al. (arXiv 2202.05262) introduced Rank-One Model Editing (ROME), which directly rewrites a single factual association in a transformer's MLP weights without retraining and without measurable impact on unrelated capability. ROME enables surgical backdoors — a poisoned model can be made to claim, for instance, that a specific company's stock symbol resolves to an attacker-controlled URL, or that a specific person's email is the attacker's domain — while passing standard evaluation benchmarks unchanged. Mithril Security's PoisonGPT was the canonical demonstration.", "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"], - "mitre_atlas_mapping": ["AML.T0018", "AML.T0058"], + "mitre_atlas_mapping": ["AML.T0018", "AML.T0115.001"], "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], "attack_steps": [ "Identify a target subject-relation-object triple to rewrite (e.g. 'Subject X's official URL is...').", diff --git a/datasets/exploit_dataset/index.csv b/datasets/exploit_dataset/index.csv index aae6649..a3eb163 100644 --- a/datasets/exploit_dataset/index.csv +++ b/datasets/exploit_dataset/index.csv @@ -3,8 +3,7 @@ AML.T0010,AI Supply Chain Compromise,model,Critical,DSGAI04|DSGAI07|DSGAI20,AML. AML.T0011.001,Malicious Package — User Execution,training_pipeline,High,DSGAI04|DSGAI03,AML.T0011.001|AML.T0060,LLM03:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0011.001,malicious-package|supply-chain|typosquatting AML.T0015,Evade AI Model,guardrail_or_filter,High,DSGAI05|DSGAI21,AML.T0015|AML.T0043,LLM01:2025,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0015,evasion|classifier-bypass|adversarial-example AML.T0018,Manipulate AI Model — direct weight or architecture tampering,model,Critical,DSGAI04|DSGAI20,AML.T0018,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-34359|CVE-2024-3568,https://atlas.mitre.org/techniques/AML.T0018,model-tampering|weight-editing|rome|pickle -AML.T0019,Publish Poisoned Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0019|AML.T0020,LLM03:2025|LLM04:2025,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0019,dataset-poisoning|supply-chain|typosquatting -AML.T0020,Poison Training Data,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor +AML.T0020,Training Data Poisoning,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor AML.T0024.000,Infer Training Data Membership,model,Medium,DSGAI18|DSGAI01,AML.T0024.000,LLM02:2025,training_data_disclosure,atlas_catalog,suspected,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.000,membership-inference|privacy-attack AML.T0024.001,Invert AI Model — reconstruct training data via confidence scores,embedding_model,High,DSGAI18|DSGAI13|DSGAI01,AML.T0024.001,LLM02:2025,training_data_disclosure|data_exfiltration,atlas_catalog,suspected,2022-10-21,2026-05-18,DSGAI-VULN-2023-vec2text-embedding-inversion,https://atlas.mitre.org/techniques/AML.T0024.001,model-inversion|embedding-inversion|vec2text|privacy-attack AML.T0024.002,Extract AI Model — train a functional clone from API outputs,model,High,DSGAI20|DSGAI18,AML.T0024.002,LLM02:2025,model_theft|financial_harm|reputational_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.002,model-extraction|ip-theft|distillation-attack @@ -22,7 +21,6 @@ AML.T0054,LLM Jailbreak (parent technique),guardrail_or_filter,High,DSGAI01|DSGA AML.T0055,Unsecured Credentials (AI agent context),agent_framework,High,DSGAI02,AML.T0055,LLM06:2025,credential_exposure|data_exfiltration|financial_harm,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2024-1561|CVE-2024-6825|CVE-2024-5751,https://atlas.mitre.org/techniques/AML.T0055,credential-theft|secret-exposure|agent-config AML.T0056,Extract LLM System Prompt,model,Medium,DSGAI01|DSGAI15,AML.T0056|AML.T0069.002,LLM02:2025|LLM07:2025,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0056,system-prompt-extraction|reconnaissance AML.T0057,LLM Data Leakage,model,Critical,DSGAI01|DSGAI11|DSGAI18,AML.T0057|AML.T0024,LLM02:2025,data_exfiltration|training_data_disclosure|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0057,data-leakage|memorization|training-data-extraction -AML.T0058,Publish Poisoned Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0058|AML.T0010.003|AML.T0018,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0058,model-poisoning|supply-chain|rome|pickled-payload AML.T0060,Publish Hallucinated Entities (slopsquatting),model,High,DSGAI21|DSGAI06,AML.T0060|AML.T0062,LLM03:2025|LLM05:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0060,slopsquatting|hallucination-exploitation|supply-chain AML.T0061,LLM Prompt Self-Replication (worming),agent_framework,High,DSGAI04|DSGAI21|DSGAI06,AML.T0061|AML.T0051.001,LLM01:2025|LLM02:2025,integrity_compromise|data_exfiltration|supply_chain_compromise,atlas_catalog,suspected,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0061,worming|self-replication|supply-chain|agent-to-agent AML.T0062,Discover LLM Hallucinations,model,Medium,DSGAI21|DSGAI06,AML.T0062|AML.T0060,LLM03:2025|LLM05:2025,supply_chain_compromise|integrity_compromise|reputational_harm,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0062,hallucination-exploitation|slopsquatting|supply-chain @@ -40,7 +38,9 @@ AML.T0093,Prompt Infiltration via Public-Facing Application,agent_framework,High AML.T0094,Delay Execution of LLM Instructions,agent_framework,High,DSGAI06|DSGAI15,AML.T0094,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0094,deferred-execution|taint-evasion|agent-attack AML.T0099,AI Agent Tool Data Poisoning,plugin_or_tool,High,DSGAI04|DSGAI06|DSGAI21,AML.T0099,LLM01:2025|LLM04:2025,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0099,tool-data-poisoning|agent-attack|indirect-injection AML.T0101,Data Destruction via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI17,AML.T0101,LLM05:2025,availability_loss|integrity_compromise|financial_harm,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0101,destructive-action|agent-attack|availability-attack -AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0104,LLM05:2025|LLM03:2025,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack +AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0115.002,LLM05:2025|LLM03:2025,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack +AML.T0115.000,Publish Poisoned AI Artifacts: Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0115.000|AML.T0020,LLM03:2025|LLM04:2025,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0115.000,dataset-poisoning|supply-chain|typosquatting +AML.T0115.001,Publish Poisoned AI Artifacts: Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0115.001|AML.T0010.003|AML.T0018,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0115.001,model-poisoning|supply-chain|rome|pickled-payload DSGAI-EXP-artprompt-ascii-art-jailbreak,ArtPrompt — ASCII-art-encoded jailbreak,guardrail_or_filter,Medium,DSGAI21,AML.T0054|AML.T0068,LLM01:2025,policy_bypass,research_publication,yes,2024-02-15,2026-05-18,,https://arxiv.org/abs/2402.11753,jailbreak|obfuscation|ascii-art|filter-evasion DSGAI-EXP-autodan-stealthy-jailbreak,AutoDAN — stealthy genetic-algorithm jailbreak,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043.001,LLM01:2025,policy_bypass|reputational_harm,research_publication,suspected,2023-10-06,2026-05-18,,https://arxiv.org/abs/2310.04451,jailbreak|genetic-algorithm|stealthy-jailbreak|perplexity-evasion DSGAI-EXP-best-of-n-jailbreak,Best-of-N jailbreaking — augmented-sample brute force,model,High,DSGAI21,AML.T0054,LLM01:2025,policy_bypass|reputational_harm,research_publication,yes,2024-12-04,2026-05-18,,https://arxiv.org/abs/2412.03556,jailbreak|brute-force|best-of-n|multimodal @@ -55,6 +55,6 @@ DSGAI-EXP-pair-tap-llm-as-attacker,PAIR / TAP — LLM-driven iterative jailbreak DSGAI-EXP-payload-splitting,Payload splitting — multi-variable assembly to bypass single-prompt filters,guardrail_or_filter,Medium,DSGAI21,AML.T0068|AML.T0054,LLM01:2025,policy_bypass,research_publication,yes,2023-05-01,2026-05-18,,https://learnprompting.org/docs/prompt_hacking/offensive_measures/payload_splitting,jailbreak|obfuscation|payload-splitting|filter-evasion DSGAI-EXP-poisonedrag,PoisonedRAG — knowledge-corpus injection against retrieval-augmented LLMs,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025,integrity_compromise|reputational_harm,research_publication,suspected,2024-02-12,2026-05-18,,https://arxiv.org/abs/2402.07867,rag-poisoning|targeted-attack|embedding-attack|retrieval-manipulation DSGAI-EXP-refusal-direction-abliteration,Refusal-direction abliteration — single-direction safety removal in open-weights models,model,High,DSGAI20|DSGAI21,AML.T0054|AML.T0044,LLM03:2025,policy_bypass|supply_chain_compromise|reputational_harm,research_publication,yes,2024-06-17,2026-05-18,,https://arxiv.org/abs/2406.11717,weight-editing|safety-removal|open-weights-attack|alignment-bypass -DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0058,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain +DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0115.001,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain DSGAI-EXP-unicode-tag-smuggling,Unicode tag-character smuggling — invisible prompt injection,guardrail_or_filter,High,DSGAI21|DSGAI09,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2024-01-12,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/,obfuscation|unicode-smuggling|invisible-text|prompt-injection DSGAI-EXP-visual-prompt-injection,Visual prompt injection — instructions embedded in images for VLMs,model,High,DSGAI09|DSGAI21,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2023-10-14,2026-05-18,DSGAI-VULN-2023-multimodal-image-prompt-injection,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,multimodal|visual-prompt-injection|vlm|ocr-bypass