The most comprehensive taxonomy of adversarial attack vectors against AI systems.
15 Tactics · 240 Techniques · 2,152+ Attack Procedures · 4,980+ Prompts

Quick Start · The 15 Tactics · Who It's For · Start Reading →

AATMF is a structured threat modeling framework purpose-built for adversarial AI security. It does for AI systems what MITRE ATT&CK does for enterprise networks — provides a common language, complete taxonomy, and actionable procedures for identifying, testing, and defending against AI-specific attacks.

Traditional cybersecurity frameworks miss the attack surfaces unique to AI: prompt injection, training data poisoning, model extraction, agentic exploitation, RAG manipulation, and the human feedback loops that shape model behavior. AATMF fills that gap.

Core thesis: AI systems are vulnerable to social engineering because they were trained to respond like humans. This is the first technology where human manipulation techniques directly translate to technical exploitation.

The threat landscape shifted fundamentally in 2025–2026:

v3 integrates all of this. Every tactic updated. New operational volumes. Namespaced IDs. No more collisions.

I want to...

Every attack maps to one of 15 tactics across three domains, scores against a single risk model, and resolves to concrete detection, mitigation, and response:

flowchart TB
    AI(["AI System Under Test"])
    AI --> CORE["Core Tactics — T1-T8<br/>Prompt · Semantic · Reasoning · Memory<br/>API · Training · Output · Deception"]
    AI --> ADV["Advanced Tactics — T9-T12<br/>Multimodal · Integrity · Agentic · RAG"]
    AI --> INFRA["Infrastructure & Human — T13-T15<br/>Supply Chain · Infrastructure · Human Workflow"]
    CORE --> R["AATMF-R v3 Risk Scoring<br/>L × I × E ÷ 6 × D ÷ 6 × R × C"]
    ADV --> R
    INFRA --> R
    R --> DEF{"Detect · Mitigate · Respond"}
    classDef surface fill:#0D1B2A,stroke:#2E86AB,color:#fff;
    classDef group fill:#1B263B,stroke:#2E86AB,color:#fff;
    classDef score fill:#F39C12,stroke:#b9770e,color:#1a1a1a;
    classDef def fill:#27AE60,stroke:#1e8449,color:#fff;
    class AI surface;
    class CORE,ADV,INFRA group;
    class R score;
    class DEF def;

The same human-manipulation playbook that works on people works on models. AATMF catalogs that translation end to end — from initial access through detection and response.

AATMF v3
├── 15 Tactics (high-level adversarial objectives)
│   ├── 240 Techniques (specific attack methods)
│   │   ├── 2,152+ Attack Procedures (implementation variants)
│   │   │   └── 4,980+ Unique Prompts
│   │   ├── Detection Patterns
│   │   └── Mitigation Controls
│   └── Risk Scoring (AATMF-R v3)
└── Supporting Infrastructure
    ├── Detection Signatures (YARA / Sigma / MCP)
    ├── Response Playbooks
    ├── Assessment Templates
    └── Compliance Mappings (OWASP · MITRE ATLAS · EU AI Act · NIST)

v3 uses namespaced IDs to eliminate collisions:

T{tactic}-AT-{sequence}     →  Technique ID      (e.g., T1-AT-001)
T{tactic}-AP-{sequence}{L}  →  Attack Procedure   (e.g., T1-AP-001A)

Risk = (L × I × E) / 6 × (D / 6) × R × C

Pre-built rules in signatures/:

signatures/
├── yara/
│   ├── t01-prompt-injection.yar
│   ├── t02-encoding-evasion.yar
│   ├── t09-multimodal-injection.yar
│   ├── t11-mcp-tool-poisoning.yar
│   └── t13-supply-chain.yar
├── sigma/
│   ├── t05-model-extraction.yml
│   ├── t07-data-exfiltration.yml
│   ├── t11-agent-anomaly.yml
│   └── t14-infrastructure.yml
└── README.md

This framework is published for defensive and authorized security research purposes only.

• Test only systems you own or have explicit written permission to test
• Practice responsible disclosure
• Comply with applicable laws and regulations

The dual-use nature is acknowledged: documenting attacks enables defense. Every technique includes detection patterns and mitigation controls.

See CONTRIBUTING.md. High-value contributions: new techniques with mitigations, detection signatures, cross-framework mappings, case studies.

@misc{aizen2026aatmf,
  title   = {AATMF v3: Adversarial AI Threat Modeling Framework},
  author  = {Aizen, Kai},
  year    = {2026},
  url     = {https://github.com/SnailSploit/AATMF-Adversarial-AI-Threat-Modeling-Framework},
  note    = {15 tactics, 240 techniques, 2,152+ procedures}
}

<sub>Created by Kai Aizen (SnailSploit) · GenAI Security Research

Start Reading →</sub>

This project's full writeup, methodology, and related research lives at:

https://snailsploit.com/aatmf

Created by Kai Aizen — independent offensive security researcher.

snailsploit.com · Research · Frameworks · GitHub · LinkedIn · ResearchGate · X/Twitter

Same attack. Different substrate.