The adversary's playbook against AI systems, mapped for the classroom.
ATLAS — the Adversarial Threat Landscape for Artificial-Intelligence Systems — is a MITRE knowledge base of real-world adversary tactics and techniques against machine learning systems, built on the same tactic/technique matrix structure as MITRE ATT&CK, but adapted specifically for how attackers actually target models, training pipelines, and ML-integrated applications.
14 tactics (columns), left to right in rough attack order. Full detail on each is below — this hero strip is a preview, not the complete technique list.
Purpose & Origin
What ATLAS is, why MITRE built it as a matrix, and who actually uses it.
What it is
ATLAS is a knowledge base cataloging adversary tactics, techniques, and case studies specific to attacks on AI and machine learning systems. It's maintained by MITRE, with contributions from industry, academia, and government partners actively researching adversarial ML.
Why it's a matrix, not a list
ATLAS deliberately reuses MITRE ATT&CK's structure: tactics (the "why" — an adversary's goal at a given stage) as columns, and techniques (the "how" — specific methods to achieve that goal) as entries under each. Anyone who's used ATT&CK for traditional IT security can navigate ATLAS with almost no relearning.
Grounded in real incidents
Unlike a purely theoretical taxonomy, ATLAS techniques are tied to case studies — documented real-world attacks, red-team exercises, and published research demonstrations — so each entry in the matrix has at least one concrete example behind it, not just a hypothetical description.
Who uses it
Red teams planning realistic ML-focused exercises, blue teams mapping detection and mitigation coverage, threat intelligence analysts describing an observed campaign in common vocabulary, and researchers organizing new adversarial ML findings into an existing framework.
How to Use This Guide
Built for a course session bridging traditional cybersecurity thinking and AI-specific threats.
- If you already know ATT&CK, start there. ATLAS's 14 tactics are ATT&CK's familiar kill-chain logic plus two ML-specific insertions — ML Model Access and ML Attack Staging. Recognizing what's new versus what's carried over does most of the learning for you.
- Read the matrix left to right as a rough attack lifecycle, not as fourteen unrelated categories — a real intrusion typically touches several tactics in sequence, not all fourteen at once.
- Open a tactic's accordion and read technique-to-case-study. Each technique entry below is paired with why it matters and a realistic scenario — use the scenario as the discussion seed, not the label.
- Pick one attack chain and walk it end to end. Choose a plausible attacker goal (steal a proprietary model, poison a public chatbot, force excessive spend on an API) and select one technique per tactic that would plausibly get them there.
- Cross-reference against OWASP's LLM Top 10. OWASP catalogs risk categories for LLM applications specifically; ATLAS catalogs the full attacker lifecycle across all ML system types. Many OWASP risks map onto one or more ATLAS techniques.
- Go to atlas.mitre.org for anything graded. ATLAS is actively updated with new techniques and case studies — confirm current technique names and IDs against the live matrix.
ATLAS vs. ATT&CK vs. OWASP LLM Top 10
Three related but distinct references — worth knowing which one a given task actually calls for.
| MITRE ATLAS | MITRE ATT&CK | OWASP LLM Top 10 | |
|---|---|---|---|
| Scope | Attacks on AI/ML systems specifically | Attacks on traditional IT/enterprise systems | Risks in LLM-powered applications specifically |
| Structure | 14 tactics × techniques (matrix) | Tactics × techniques (matrix) | 10 ranked risk categories |
| Grounding | Real ML-attack case studies | Real cyber-intrusion case data | Community practitioner consensus |
| Best for | Threat modeling an ML pipeline or model | Threat modeling general IT infrastructure | Reviewing/designing a specific LLM app |
The ATLAS Matrix
Fourteen tactics, grouped below into three phases of an attack lifecycle. Click any tactic to see representative techniques.
Preparing the Attack
Before touching the target system — research, tooling, and gaining a first foothold or access point.
Gather information about the target's AI system before acting against it.
Representative techniques- Search victim-owned research materials — published papers, model cards, blog posts describing the target's ML system.
- Search for adversarial vulnerability research — published attacks against the same model family or architecture.
- Active scanning — probing exposed ML endpoints to learn what's running.
Build or acquire the resources needed to carry out the operation.
Representative techniques- Acquire public ML artifacts — pretrained models or datasets used to build a surrogate for offline attack development.
- Develop adversarial ML capability — custom tooling to generate adversarial inputs or backdoors.
- Publish poisoned datasets — seeding public data sources the victim is likely to scrape or train on.
Get an initial foothold into the environment surrounding the AI system.
Representative techniques- ML supply chain compromise — a tainted upstream model, dataset, or package.
- Valid accounts — credentials for the ML pipeline or hosting environment.
- Exploit public-facing application — a vulnerability in the app fronting the model.
Establish what level of access the adversary has to the model itself — a tactic with no direct ATT&CK equivalent.
Representative techniques- ML-model inference API access — black-box, query-only access.
- Full ML-model access — white-box access to model weights and architecture, e.g. via a leak or theft.
- Physical environment access — needed for physical-world adversarial examples (e.g., altered road signs).
Executing the Attack
The bulk of the matrix — running attacker logic, maintaining access, avoiding detection, and building the specific technique that will work against this model.
Run attacker-controlled code or logic within the target environment.
Representative techniques- User execution of unsafe ML artifacts — a victim loads a malicious model file (e.g., an unsafely deserialized pickle) that executes code.
- LLM plugin compromise — a malicious or vulnerable plugin executes attacker logic through the LLM's tool-use interface.
Maintain a foothold or effect that survives restarts, updates, or retraining.
Representative techniques- Poison training data — so a backdoor re-enters the model even after retraining on refreshed data.
- Backdoor ML model — directly modify model weights to embed a persistent trigger-based behavior.
Gain capabilities beyond what was initially granted.
Representative techniques- LLM jailbreak — bypassing a model's safety training to unlock disallowed behavior.
- Abusing excessive agency — leveraging tool access granted to an LLM-integrated system beyond its intended scope.
Avoid detection by security controls, including the model's own safety mechanisms.
Representative techniques- Adversarial examples — inputs perturbed just enough to evade a classifier while looking normal to a human.
- Prompt injection for evasion — crafted input that bypasses a model's content filters.
- Impersonation — disguising attacker-originated content as legitimate.
Steal credentials that grant further access.
Representative techniques- Unsecured credentials — API keys or tokens left in notebooks, config files, or training scripts.
Learn about the target ML environment to plan further action.
Representative techniques- Discover ML model ontology — determine what categories or classes the model was built to recognize.
- Discover ML model family — identify the underlying architecture, informing which known attacks might transfer.
- Discover ML artifacts — locate stored models, datasets, or checkpoints in the environment.
Gather data of interest before it's exfiltrated or used to stage the final attack.
Representative techniques- ML artifact collection — gathering models, weights, or training data found in the environment.
- Data from information repositories or local systems — same broad category as in traditional ATT&CK, applied to ML-adjacent stores.
Prepare the actual technical attack against the model — the second ML-specific tactic with no direct ATT&CK equivalent.
Representative techniques- Create proxy ML model — train a surrogate model to develop and test attacks offline before touching the real target.
- Craft adversarial data — generate the specific input designed to fool or manipulate the model.
- Verify attack — confirm the crafted attack actually works before deploying it against the live target.
Completing the Attack
Getting value out of the compromise and realizing the intended harm.
Extract stolen data or model information out of the target environment.
Representative techniques- Exfiltration via ML-inference API — reconstructing a proprietary model's behavior (or training data) purely through repeated queries.
- Exfiltration via traditional cyber means — standard data-theft channels once inside the environment.
Realize the actual harm the operation was aimed at.
Representative techniques- Erode ML model integrity — gradually degrade accuracy or reliability over time.
- Cost harvesting — force expensive computation to drive up the victim's operating costs.
- Denial of ML service — make the system unavailable to legitimate users.
- External harms — reputational, financial, or societal damage stemming from the compromised system's behavior.
Classroom Uses
Ways instructors have used this structure with students.
Attack-chain building exercise
Give students an attacker goal (e.g., "steal a proprietary fraud-detection model") and have them select one technique per tactic that forms a plausible end-to-end chain.
ATT&CK-to-ATLAS bridge
For students who've studied ATT&CK already, have them identify which ATLAS tactics map directly to ATT&CK tactics they know, and which two are genuinely new.
Case study assignment
Assign each student a real case study from the ATLAS library; have them present which tactics and techniques it demonstrated and what mitigation would have interrupted the chain.
Blue-team mapping
Give students a described ML system's existing security controls and have them mark which ATLAS techniques those controls would and wouldn't catch — a gap-analysis exercise mirroring real SOC work.
Sources & Further Reading
This guide is a teaching summary. For anything graded, cite the live matrix and case studies directly.
MITRE ATLAS
The live, interactive matrix, full technique catalog, and case study library.atlas.mitre.org
MITRE ATT&CK
The parent framework ATLAS is structurally modeled on — useful background for understanding why ATLAS is organized the way it is.attack.mitre.org