Guides › MITRE ATLAS

MITRE ATLAS for AI Data Security: Mapping Data-Layer Threats to ATLAS Techniques

Hunter Moore, Founder and CTO · Updated September 8, 2026

MITRE ATLAS is the adversary-behavior knowledge base for attacks on AI systems, structured the same way as ATT&CK. Of its 114 techniques, a specific subset describes what happens at the data layer: what an AI knowledge base returns, what enters a training set, and what can be pulled back out of a model. This guide identifies that subset, shows what each technique looks like in an enterprise deployment, and explains how to use it to assess your AI security posture and data security posture in a vocabulary your security team already recognizes.

At a glance
  • What ATLAS is. MITRE's catalog of adversary tactics and techniques against AI systems. As of the 2026.08 release: 16 tactics, 114 techniques, 83 sub-techniques, 39 mitigations and 72 case studies, updated monthly.
  • What lives at the data layer. Roughly two dozen techniques cover retrieval, knowledge bases, training data, extraction and the data supply chain. The table below lists them by failure mode.
  • Why map to it. A finding tagged with an ATLAS technique ID is comparable across tools, teams and time, and it lines up with the ATT&CK workflows a SOC already runs.
  • What it is not. ATLAS is not a compliance framework and does not grade you. Pair it with NIST AI RMF, ISO/IEC 42001 or the EU AI Act when you need obligations rather than adversary behavior.

What MITRE ATLAS is, and what it is not

ATLAS, the Adversarial Threat Landscape for Artificial-Intelligence Systems, is maintained by MITRE and organized like ATT&CK. Tactics are the adversary's objective at each stage of an operation, techniques are how that objective gets achieved, and each technique carries case studies where the behavior was observed and mitigations that address it. The 2026.08 release, published 31 August 2026, has 16 tactics running from Reconnaissance through Impact, with AI Model Access and AI Attack Adaptation as the two that have no ATT&CK equivalent. Since late 2025 MITRE has shipped monthly content releases, so IDs and names move. Two changes in summer 2026 matter for anyone holding an older mapping. Poison Training Data became Training Data Poisoning, keeping its ID (AML.T0020). Publish Poisoned Datasets (AML.T0019) was retired into a new parent, Publish Poisoned AI Artifacts (AML.T0115), with Datasets as sub-technique AML.T0115.000.

Three things ATLAS is not. It is not a control catalog; mitigations exist, but they are pointers rather than requirements. It is not a maturity model or a scoring scheme, so "ATLAS compliant" is not a phrase that means anything. And it is not specific to large language models. The catalog covers predictive models, computer vision, tabular classifiers and agents alongside LLMs, which is one reason it suits a data-layer view. Training data poisoning looks the same to ATLAS whether the model is a fraud classifier or a chatbot.

If you want the wider view of how ATLAS sits next to OWASP, NIST, ISO and the EU AI Act, the AI security framework crosswalk puts all five side by side. If you want the procedure, how to assess AI security posture with MITRE ATLAS turns this page into seven steps.

Which ATLAS techniques live at the data layer

The data layer is everything a model learns from or retrieves from, plus the pipelines that move it: the corpus behind an AI knowledge base, the training and fine-tuning sets, the vector index and its embeddings, and the connectors that feed them. Filtering ATLAS to techniques whose target or vector is data rather than model weights or serving infrastructure gives the set below, grouped by the failure mode each one produces. Names and IDs are from the 2026.08 release. The tactic column shows the primary tactic ATLAS assigns.

Failure modeATLAS techniqueTacticWhat it looks like in an enterprise deployment
Retrieval leakageAML.T0057 LLM Data LeakageExfiltrationAn assistant repeats a document the asking user could not have opened. ATLAS notes the leaked data may come from training data, connected data sources or other users' sessions.
Retrieval leakageAML.T0085.000 Data from AI Services: RAG DatabasesCollectionAn adversary with ordinary user access uses the assistant as a search engine over the whole index.
Retrieval leakageAML.T0064 Gather RAG-Indexed TargetsReconnaissanceProbing which repositories, sites or mailboxes the knowledge base indexes before crafting an attack.
Retrieval leakageAML.T0082 RAG Credential HarvestingCredential AccessRetrieval surfaces API keys, passwords or tokens that were indexed along with the documents containing them.
Indirect prompt injectionAML.T0051.001 LLM Prompt Injection: IndirectExecutionInstructions hidden in an indexed document, email or web page execute when retrieval hands them to the model.
Indirect prompt injectionAML.T0066 Retrieval Content CraftingAI Attack AdaptationContent written so that a vector search ranks it highly for the queries the attacker wants to hijack.
Indirect prompt injectionAML.T0086 Exfiltration via AI Agent Tool InvocationExfiltrationAn injected instruction makes an agent send data out through a tool call, browser fetch or image URL.
Knowledge base and agent poisoningAML.T0070 RAG PoisoningPersistenceMalicious content inserted into the indexed corpus so that it is retrieved and shapes answers indefinitely.
Knowledge base and agent poisoningAML.T0071 False RAG Entry InjectionDefense EvasionFabricated entries that look like legitimate sources and evade provenance checks.
Knowledge base and agent poisoningAML.T0080 AI Agent Context Poisoning (Memory, Thread)PersistencePoisoned content written into an agent's long-term memory or a shared thread re-fires in later sessions.
Knowledge base and agent poisoningAML.T0099 AI Agent Tool Data PoisoningPersistenceData returned by a tool the agent trusts is tampered with upstream.
Training data poisoning and integrityAML.T0020 Training Data PoisoningPersistenceManipulated samples in a training or fine-tuning set install a backdoor or degrade a class.
Training data poisoning and integrityAML.T0115.000 Publish Poisoned AI Artifacts: DatasetsResource DevelopmentA poisoned public dataset placed where your pipeline will pull it.
Training data poisoning and integrityAML.T0010.002 AI Supply Chain Compromise: DataInitial AccessCompromise of the data source, labeling vendor or pipeline stage that feeds training.
Training data poisoning and integrityAML.T0059 Erode Dataset IntegrityImpactCorrupting a dataset an organization relies on so that downstream models degrade.
Training data poisoning and integrityAML.T0043.004 Craft Adversarial Data: Insert Backdoor TriggerAI Attack AdaptationPreparing the trigger pattern that poisoned training data teaches the model to respond to.
Training data extraction and inversionAML.T0024.000 Exfiltration via AI Inference API: Infer Training Data MembershipExfiltrationDetermining whether a specific record was in the training set by querying the model.
Training data extraction and inversionAML.T0024.001 Exfiltration via AI Inference API: Invert AI ModelExfiltrationReconstructing training data, or the text behind a vector index, from model outputs and embeddings.
Training data extraction and inversionAML.T0056 Extract LLM System PromptExfiltrationPulling the system prompt, which often names the data sources the assistant is wired into.
Discovery and collection of data artifactsAML.T0007 Discover AI ArtifactsDiscoveryFinding datasets, indexes, embeddings and model files inside an environment.
Discovery and collection of data artifactsAML.T0084.000 Discover AI Agent Configuration: Embedded KnowledgeDiscoveryLearning which data sources an agent has been given access to.
Discovery and collection of data artifactsAML.T0035 AI Artifact Collection; AML.T0036 Data from Information RepositoriesCollectionStaging datasets, indexes and repository contents for exfiltration.
Discovery and collection of data artifactsAML.T0002.000 Acquire Public AI Artifacts: DatasetsResource DevelopmentObtaining the same public datasets you train on in order to plan a poisoning or inference attack.

A few notes on reading the table. ATLAS assigns some techniques to more than one tactic; the column shows the primary one. Sub-techniques, the three-digit suffix, are listed where the sub-technique is the data-layer part of a broader parent. Embedding inversion has no technique of its own; ATLAS treats it under Invert AI Model (AML.T0024.001), and OWASP's Vector and Embedding Weaknesses (LLM09:2026) is the closer match if you need a named category. Nothing on the list is exotic. Every row has at least one public case study behind it or a reproduction you can run yourself.

Applies to any AI knowledge base

The retrieval rows above are not specific to classic RAG over a vector store. Agentic retrieval, GraphRAG, MCP and connector-based assistants, and enterprise AI search all put a corpus behind a model at query time, and ATLAS describes the attacker's behavior the same way for each. If a model sees internal documents when it answers, the RAG-labeled techniques apply whether or not anyone on your team uses the word RAG.

Why mapping findings to ATLAS matters for posture assessment

A test result that says "the assistant leaked an HR document" is a fact about one system on one day. The same result tagged AML.T0057 and AML.T0085.000 is a fact you can compare against last quarter's test, against the other four assistants in the estate, and against the detections your SOC already runs on the ATT&CK side of the house. That comparability is the practical value of ATLAS for posture work, and four things follow from it.

  • Coverage becomes visible. Lay the data-layer techniques out as rows and mark each one tested, detected, mitigated or not assessed. The blank cells are your posture gaps, and they are much harder to argue with than a narrative report.
  • Findings from different tools reconcile. A red team, a retrieval telemetry client and a dataset scanner describe the same failure in three vocabularies. ATLAS IDs give them one.
  • Prioritization gets an evidence base. ATLAS marks each technique's maturity as Feasible, Demonstrated or Realized, meaning observed in the wild, and links the case studies. Realized techniques with a live case study against your platform of choice go first.
  • It connects to the frameworks that carry obligations. NIST AI RMF, ISO/IEC 42001 and the EU AI Act ask you to identify and manage AI risks; they do not tell you which attacks exist. ATLAS supplies the threat model those frameworks assume you already have. The crosswalk shows where each technique lands in each.

This is also how Hardshell reports. Every finding from a live-fire exposure test and every detection from knowledge base telemetry carries the MITRE ATLAS technique IDs it demonstrates, alongside the OWASP, NIST AI RMF, ISO/IEC 42001 and EU AI Act references in the crosswalk, so the output reads as evidence in the frameworks a security or compliance team already reports against rather than as a new vocabulary to learn.

ATLAS mitigations that apply at the data layer

ATLAS pairs techniques with mitigations, IDs AML.M0000 through AML.M0038. Six of them do most of the work at the data layer, and each maps to a guide on this site that goes deeper.

ATLAS mitigationWhat it asks forWhere it lands in a deploymentGuide
AML.M0005 Control Access to AI Models and Data at RestAccess controls on datasets, indexes and model artifactsEntitlements enforced at retrieval time, not only at index timeRAG permissions
AML.M0007 Sanitize Training DataDetect and remove poisoned or anomalous samples before trainingDataset scanning ahead of training and fine-tuningData poisoning
AML.M0025 Maintain AI Dataset ProvenanceRecord where every dataset came from and how it changedLineage for corpora and training sets, including connector-fed onesAI data pipeline security
AML.M0024 AI Telemetry LoggingLog inputs, outputs and retrieval behavior for detection and forensicsRetrieval telemetry keyed to the requesting identity and the chunks returnedSecure RAG telemetry
AML.M0020 Generative AI GuardrailsFilter inputs and outputs at the application edgeComplementary to retrieval controls, not a substitute for themSecure RAG vs LLM guardrails
AML.M0023 AI Bill of MaterialsAn inventory of models, datasets and componentsThe asset list a posture assessment starts fromAI security posture assessment

Two cautions. First, ATLAS mitigations are descriptive. The catalog tells you a control class exists and which techniques it addresses, and stops there. Second, several data-layer techniques have thin mitigation lists. RAG Poisoning (AML.T0070) currently maps to two mitigations, which reflects how new the technique is rather than how little you can do about it. Provenance, retrieval-time entitlement enforcement and retrieval telemetry all help and are not yet linked from the ATLAS page.

Case studies worth reading

ATLAS publishes 72 case studies as of the 2026.08 release. Five are directly about the data layer and are useful for making the table above concrete for a board or an executive sponsor.

  • AML.CS0024, Morris II Worm: RAG-Based Attack. A self-replicating prompt that spreads through email assistants by getting itself retrieved.
  • AML.CS0025, Web-Scale Data Poisoning: Split-View Attack. Poisoning public training data by controlling what a URL returns after the dataset was assembled.
  • AML.CS0026, Financial Transaction Hijacking with M365 Copilot as an Insider. Retrieval used to redirect a payment.
  • AML.CS0059, EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration. Indirect injection through a retrieved email, with no user action required.
  • AML.CS0068, Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure. Added in the 2026.08 release. The July 2026 intrusion entered through a dataset processing pipeline, not through a model. Hardshell's analysis of the pipeline failure covers what that means for anyone running one.
Pin the version. ATLAS content changes monthly, and IDs have been retired and renamed in 2026. Any mapping you publish internally should state the release it was built against (this page uses 2026.08) so a reader six months from now knows which names have moved.

Frequently asked questions

Is MITRE ATLAS a compliance framework?

No. ATLAS describes adversary behavior. It does not define obligations, controls you must implement, or a scoring scheme. Auditors and regulators may reference it as a threat model, and NIST AI 100-2 and the OWASP GenAI Security Project both cite it, but there is no such thing as ATLAS certification. Use it to decide what to test and how to label what you find. Use NIST AI RMF, ISO/IEC 42001 or the EU AI Act for what you are obliged to do.

Does ATLAS cover RAG and AI knowledge bases?

Yes, and increasingly so. Techniques added since March 2025 include RAG Poisoning, False RAG Entry Injection, Gather RAG-Indexed Targets, Retrieval Content Crafting, RAG Credential Harvesting and Data from AI Services: RAG Databases, and LLM Data Leakage explicitly covers data sources the model is connected to. The naming says RAG. The behavior applies to any retrieval architecture, including agentic retrieval, GraphRAG, connector-based assistants and enterprise AI search.

How do I map a finding to an ATLAS technique?

Ask two questions. What was the adversary's objective, which gives you the tactic, and how did they achieve it, which gives you the technique. A document returned to the wrong user is Exfiltration achieved by LLM Data Leakage. A backdoored fine-tune is Persistence achieved by Training Data Poisoning. When two techniques fit, record both; ATLAS itself assigns several techniques to more than one tactic. Record the ATLAS release alongside the ID.

What changed in ATLAS in 2026?

MITRE moved to monthly releases, and the summer 2026 releases renamed several techniques and retired two IDs. AML.T0019 Publish Poisoned Datasets and AML.T0058 Publish Poisoned Models were folded into AML.T0115 Publish Poisoned AI Artifacts with sub-techniques for datasets, models and agent tools. AML.T0020 was renamed Training Data Poisoning. The AI Attack Staging tactic became AI Attack Adaptation. The 2026.08 release also added the Hugging Face case study. If your mapping predates July 2026, check those four first.

Does mapping to ATLAS satisfy NIST AI RMF or ISO/IEC 42001?

It contributes evidence rather than satisfying anything on its own. NIST AI RMF's Map and Measure functions expect you to identify risks and test for them, and an ATLAS-tagged test record is a good artifact for both. ISO/IEC 42001 asks for a documented AI risk assessment and treatment, and the same record supports it. Neither framework names ATLAS as a requirement, and the EU AI Act's Article 15 describes poisoning and adversarial attacks in its own words. The crosswalk shows the alignment line by line, and the posture assessment guide shows how to produce the record.

Sources

MITRE, MITRE ATLAS, content release 2026.08 (31 August 2026). Technique, tactic, mitigation and case study IDs and names are taken from the release data at github.com/mitre-atlas/atlas-data and its changelog.

OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, Appendix A, Related Framework Mappings (MITRE ATLAS content v2026.06).

NIST, AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, March 2025.