exploit_dataset: move retired ATLAS IDs to AML.T0115 sub-techniques

datasets/exploit_dataset/entries/AML.T0020.json

@@ -1,7 +1,7 @@
 {
   "$schema": "../schema.json",
   "exploit_id": "AML.T0020",
-  "title": "Poison Training Data",
+  "title": "Training Data Poisoning",
   "description": "An adversary modifies the training data — feature values, labels, or both — used by an AI model in order to embed vulnerabilities, biases, or backdoors that the trained model exhibits at inference time. Poisoned data may be introduced via AI Supply Chain Compromise (AML.T0010) or after the adversary already has access to the training pipeline. Backdoors are typically activated by an Insert Backdoor Trigger (AML.T0043.004) sample at inference time, but untargeted poisoning to degrade overall integrity is also a documented variant.",
   "target_component": "training_pipeline",
   "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI05"],

datasets/exploit_dataset/entries/AML.T0110.json

@@ -5,7 +5,7 @@
   "description": "An adversary compromises a tool the agent has already integrated — built-in tools, Model Context Protocol (MCP) servers, or third-party plugins. By altering tool behavior (modifying parameters, descriptions, injected hidden logic, redirected outputs) the attacker establishes long-term influence over the agent's actions and decisions. Poisoned tools silently exfiltrate data, execute unauthorized commands, or manipulate downstream pipelines, with no obvious change in the agent's user-visible behavior.",
   "target_component": "plugin_or_tool",
   "dsgai_mapping": ["DSGAI06", "DSGAI04", "DSGAI02"],
-  "mitre_atlas_mapping": ["AML.T0110", "AML.T0104"],
+  "mitre_atlas_mapping": ["AML.T0110", "AML.T0115.002"],
   "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025"],
   "attack_steps": [
     "Compromise the tool — submit a malicious MCP server, push a poisoned plugin update, or directly tamper with an in-tree tool definition.",

datasets/exploit_dataset/entries/AML.T0019.json → datasets/exploit_dataset/entries/AML.T0115.000.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schema.json",
-  "exploit_id": "AML.T0019",
-  "title": "Publish Poisoned Datasets",
-  "description": "An adversary publishes a poisoned dataset to a public dataset hub (Hugging Face Datasets, Kaggle, GitHub, an academic mirror), either as a novel dataset designed to look attractive or as a poisoned variant of an existing open-source dataset. Downstream consumers who pick the dataset for fine-tuning, RAG indexing, or evaluation inherit the embedded backdoor. The technique is the public-distribution arm of Poison Training Data (AML.T0020).",
+  "exploit_id": "AML.T0115.000",
+  "title": "Publish Poisoned AI Artifacts: Datasets",
+  "description": "An adversary publishes a poisoned dataset to a public dataset hub (Hugging Face Datasets, Kaggle, GitHub, an academic mirror), either as a novel dataset designed to look attractive or as a poisoned variant of an existing open-source dataset. Downstream consumers who pick the dataset for fine-tuning, RAG indexing, or evaluation inherit the embedded backdoor. The technique is the public-distribution arm of Training Data Poisoning (AML.T0020).",
   "target_component": "training_pipeline",
   "dsgai_mapping": ["DSGAI04", "DSGAI07"],
-  "mitre_atlas_mapping": ["AML.T0019", "AML.T0020"],
+  "mitre_atlas_mapping": ["AML.T0115.000", "AML.T0020"],
   "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"],
   "attack_steps": [
     "Create a dataset with poisoned samples — either a novel set tuned to attract downstream use, or a typosquatted lookalike of a popular dataset.",
@@ -30,7 +30,7 @@
     "qualitative": "High"
   },
   "source_urls": [
-    "https://atlas.mitre.org/techniques/AML.T0019"
+    "https://atlas.mitre.org/techniques/AML.T0115.000"
   ],
   "date_documented": "2022-10-21",
   "date_added": "2026-05-18",
@@ -41,5 +41,6 @@
     "Maintain a curated internal dataset mirror with provenance verification.",
     "Apply integrity audits before any fine-tune; never train directly from public-pull at build time."
   ],
+  "notes": "Was AML.T0019 (Publish Poisoned Datasets) until MITRE ATLAS 2026.07 merged it into AML.T0115 (Publish Poisoned AI Artifacts) as sub-technique AML.T0115.000. The entry file and exploit_id were renamed to match.",
   "tags": ["dataset-poisoning", "supply-chain", "typosquatting"]
 }

datasets/exploit_dataset/entries/AML.T0058.json → datasets/exploit_dataset/entries/AML.T0115.001.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schema.json",
-  "exploit_id": "AML.T0058",
-  "title": "Publish Poisoned Models",
+  "exploit_id": "AML.T0115.001",
+  "title": "Publish Poisoned AI Artifacts: Models",
   "description": "An adversary publishes a poisoned model to a public model registry (Hugging Face Hub, GitHub, ONNX Model Zoo) — either a novel model or a poisoned variant of a popular open-source model. Downstream consumers who pick it inherit any combination of: targeted-edit factual backdoors (PoisonGPT-style ROME edits), pickled code-execution payloads triggered at load time, or fine-tuning-introduced refusal removal. Typosquatting and lookalike org names are common distribution tricks.",
   "target_component": "model",
   "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"],
-  "mitre_atlas_mapping": ["AML.T0058", "AML.T0010.003", "AML.T0018"],
+  "mitre_atlas_mapping": ["AML.T0115.001", "AML.T0010.003", "AML.T0018"],
   "owasp_llm_top10_mapping": ["LLM03:2025"],
   "attack_steps": [
     "Pick a base model the target population uses; produce a poisoned variant via ROME edit, fine-tune, or pickled-payload embedding.",
@@ -31,7 +31,7 @@
     "qualitative": "Critical"
   },
   "source_urls": [
-    "https://atlas.mitre.org/techniques/AML.T0058",
+    "https://atlas.mitre.org/techniques/AML.T0115.001",
     "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/"
   ],
   "date_documented": "2024-05-09",
@@ -48,5 +48,6 @@
     "CVE-2024-3568",
     "CVE-2024-11394"
   ],
+  "notes": "Was AML.T0058 (Publish Poisoned Models) until MITRE ATLAS 2026.07 merged it into AML.T0115 (Publish Poisoned AI Artifacts) as sub-technique AML.T0115.001. The entry file and exploit_id were renamed to match.",
   "tags": ["model-poisoning", "supply-chain", "rome", "pickled-payload"]
 }

datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json

@@ -5,7 +5,7 @@
   "description": "Meng et al. (arXiv 2202.05262) introduced Rank-One Model Editing (ROME), which directly rewrites a single factual association in a transformer's MLP weights without retraining and without measurable impact on unrelated capability. ROME enables surgical backdoors — a poisoned model can be made to claim, for instance, that a specific company's stock symbol resolves to an attacker-controlled URL, or that a specific person's email is the attacker's domain — while passing standard evaluation benchmarks unchanged. Mithril Security's PoisonGPT was the canonical demonstration.",
   "target_component": "model",
   "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"],
-  "mitre_atlas_mapping": ["AML.T0018", "AML.T0058"],
+  "mitre_atlas_mapping": ["AML.T0018", "AML.T0115.001"],
   "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"],
   "attack_steps": [
     "Identify a target subject-relation-object triple to rewrite (e.g. 'Subject X's official URL is...').",

datasets/exploit_dataset/index.csv

@@ -3,8 +3,7 @@ AML.T0010,AI Supply Chain Compromise,model,Critical,DSGAI04|DSGAI07|DSGAI20,AML.
 AML.T0011.001,Malicious Package — User Execution,training_pipeline,High,DSGAI04|DSGAI03,AML.T0011.001|AML.T0060,LLM03:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0011.001,malicious-package|supply-chain|typosquatting
 AML.T0015,Evade AI Model,guardrail_or_filter,High,DSGAI05|DSGAI21,AML.T0015|AML.T0043,LLM01:2025,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0015,evasion|classifier-bypass|adversarial-example
 AML.T0018,Manipulate AI Model — direct weight or architecture tampering,model,Critical,DSGAI04|DSGAI20,AML.T0018,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-34359|CVE-2024-3568,https://atlas.mitre.org/techniques/AML.T0018,model-tampering|weight-editing|rome|pickle
-AML.T0019,Publish Poisoned Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0019|AML.T0020,LLM03:2025|LLM04:2025,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0019,dataset-poisoning|supply-chain|typosquatting
-AML.T0020,Poison Training Data,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor
+AML.T0020,Training Data Poisoning,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor
 AML.T0024.000,Infer Training Data Membership,model,Medium,DSGAI18|DSGAI01,AML.T0024.000,LLM02:2025,training_data_disclosure,atlas_catalog,suspected,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.000,membership-inference|privacy-attack
 AML.T0024.001,Invert AI Model — reconstruct training data via confidence scores,embedding_model,High,DSGAI18|DSGAI13|DSGAI01,AML.T0024.001,LLM02:2025,training_data_disclosure|data_exfiltration,atlas_catalog,suspected,2022-10-21,2026-05-18,DSGAI-VULN-2023-vec2text-embedding-inversion,https://atlas.mitre.org/techniques/AML.T0024.001,model-inversion|embedding-inversion|vec2text|privacy-attack
 AML.T0024.002,Extract AI Model — train a functional clone from API outputs,model,High,DSGAI20|DSGAI18,AML.T0024.002,LLM02:2025,model_theft|financial_harm|reputational_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.002,model-extraction|ip-theft|distillation-attack
@@ -22,7 +21,6 @@ AML.T0054,LLM Jailbreak (parent technique),guardrail_or_filter,High,DSGAI01|DSGA
 AML.T0055,Unsecured Credentials (AI agent context),agent_framework,High,DSGAI02,AML.T0055,LLM06:2025,credential_exposure|data_exfiltration|financial_harm,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2024-1561|CVE-2024-6825|CVE-2024-5751,https://atlas.mitre.org/techniques/AML.T0055,credential-theft|secret-exposure|agent-config
 AML.T0056,Extract LLM System Prompt,model,Medium,DSGAI01|DSGAI15,AML.T0056|AML.T0069.002,LLM02:2025|LLM07:2025,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0056,system-prompt-extraction|reconnaissance
 AML.T0057,LLM Data Leakage,model,Critical,DSGAI01|DSGAI11|DSGAI18,AML.T0057|AML.T0024,LLM02:2025,data_exfiltration|training_data_disclosure|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0057,data-leakage|memorization|training-data-extraction
-AML.T0058,Publish Poisoned Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0058|AML.T0010.003|AML.T0018,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0058,model-poisoning|supply-chain|rome|pickled-payload
 AML.T0060,Publish Hallucinated Entities (slopsquatting),model,High,DSGAI21|DSGAI06,AML.T0060|AML.T0062,LLM03:2025|LLM05:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0060,slopsquatting|hallucination-exploitation|supply-chain
 AML.T0061,LLM Prompt Self-Replication (worming),agent_framework,High,DSGAI04|DSGAI21|DSGAI06,AML.T0061|AML.T0051.001,LLM01:2025|LLM02:2025,integrity_compromise|data_exfiltration|supply_chain_compromise,atlas_catalog,suspected,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0061,worming|self-replication|supply-chain|agent-to-agent
 AML.T0062,Discover LLM Hallucinations,model,Medium,DSGAI21|DSGAI06,AML.T0062|AML.T0060,LLM03:2025|LLM05:2025,supply_chain_compromise|integrity_compromise|reputational_harm,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0062,hallucination-exploitation|slopsquatting|supply-chain
@@ -40,7 +38,9 @@ AML.T0093,Prompt Infiltration via Public-Facing Application,agent_framework,High
 AML.T0094,Delay Execution of LLM Instructions,agent_framework,High,DSGAI06|DSGAI15,AML.T0094,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0094,deferred-execution|taint-evasion|agent-attack
 AML.T0099,AI Agent Tool Data Poisoning,plugin_or_tool,High,DSGAI04|DSGAI06|DSGAI21,AML.T0099,LLM01:2025|LLM04:2025,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0099,tool-data-poisoning|agent-attack|indirect-injection
 AML.T0101,Data Destruction via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI17,AML.T0101,LLM05:2025,availability_loss|integrity_compromise|financial_harm,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0101,destructive-action|agent-attack|availability-attack
-AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0104,LLM05:2025|LLM03:2025,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack
+AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0115.002,LLM05:2025|LLM03:2025,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack
+AML.T0115.000,Publish Poisoned AI Artifacts: Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0115.000|AML.T0020,LLM03:2025|LLM04:2025,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0115.000,dataset-poisoning|supply-chain|typosquatting
+AML.T0115.001,Publish Poisoned AI Artifacts: Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0115.001|AML.T0010.003|AML.T0018,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0115.001,model-poisoning|supply-chain|rome|pickled-payload
 DSGAI-EXP-artprompt-ascii-art-jailbreak,ArtPrompt — ASCII-art-encoded jailbreak,guardrail_or_filter,Medium,DSGAI21,AML.T0054|AML.T0068,LLM01:2025,policy_bypass,research_publication,yes,2024-02-15,2026-05-18,,https://arxiv.org/abs/2402.11753,jailbreak|obfuscation|ascii-art|filter-evasion
 DSGAI-EXP-autodan-stealthy-jailbreak,AutoDAN — stealthy genetic-algorithm jailbreak,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043.001,LLM01:2025,policy_bypass|reputational_harm,research_publication,suspected,2023-10-06,2026-05-18,,https://arxiv.org/abs/2310.04451,jailbreak|genetic-algorithm|stealthy-jailbreak|perplexity-evasion
 DSGAI-EXP-best-of-n-jailbreak,Best-of-N jailbreaking — augmented-sample brute force,model,High,DSGAI21,AML.T0054,LLM01:2025,policy_bypass|reputational_harm,research_publication,yes,2024-12-04,2026-05-18,,https://arxiv.org/abs/2412.03556,jailbreak|brute-force|best-of-n|multimodal
@@ -55,6 +55,6 @@ DSGAI-EXP-pair-tap-llm-as-attacker,PAIR / TAP — LLM-driven iterative jailbreak
 DSGAI-EXP-payload-splitting,Payload splitting — multi-variable assembly to bypass single-prompt filters,guardrail_or_filter,Medium,DSGAI21,AML.T0068|AML.T0054,LLM01:2025,policy_bypass,research_publication,yes,2023-05-01,2026-05-18,,https://learnprompting.org/docs/prompt_hacking/offensive_measures/payload_splitting,jailbreak|obfuscation|payload-splitting|filter-evasion
 DSGAI-EXP-poisonedrag,PoisonedRAG — knowledge-corpus injection against retrieval-augmented LLMs,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025,integrity_compromise|reputational_harm,research_publication,suspected,2024-02-12,2026-05-18,,https://arxiv.org/abs/2402.07867,rag-poisoning|targeted-attack|embedding-attack|retrieval-manipulation
 DSGAI-EXP-refusal-direction-abliteration,Refusal-direction abliteration — single-direction safety removal in open-weights models,model,High,DSGAI20|DSGAI21,AML.T0054|AML.T0044,LLM03:2025,policy_bypass|supply_chain_compromise|reputational_harm,research_publication,yes,2024-06-17,2026-05-18,,https://arxiv.org/abs/2406.11717,weight-editing|safety-removal|open-weights-attack|alignment-bypass
-DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0058,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain
+DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0115.001,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain
 DSGAI-EXP-unicode-tag-smuggling,Unicode tag-character smuggling — invisible prompt injection,guardrail_or_filter,High,DSGAI21|DSGAI09,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2024-01-12,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/,obfuscation|unicode-smuggling|invisible-text|prompt-injection
 DSGAI-EXP-visual-prompt-injection,Visual prompt injection — instructions embedded in images for VLMs,model,High,DSGAI09|DSGAI21,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2023-10-14,2026-05-18,DSGAI-VULN-2023-multimodal-image-prompt-injection,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,multimodal|visual-prompt-injection|vlm|ocr-bypass