An open taxonomy of 168 AI/LLM attack vectors, mapped to the OWASP LLM Top 10 and MITRE ATLAS.

A structured, machine-readable catalog of every documented technique for attacking AI systems. Each attack has an ID, name, category, description, severity rating, and mapping to industry frameworks (OWASP LLM Top 10, MITRE ATLAS).

This is the what — what attacks exist and how to defend against them. It does not include payloads, detection logic, or model-specific data.

This repository implements Phases 1-3 of the Evolutionary Security Framework (ESF) — the open maturity model for progressively hardening AI security systems. See ESF.md for details.

Most AI security discussions focus on a handful of well-known attacks. In reality, there are over 160 distinct techniques across 16 categories. A system that blocks a naive instruction override might still fall to an encoding bypass, a multi-turn escalation, or an indirect injection through retrieved content.

This taxonomy gives you:

• A checklist — do your defenses cover all 16 categories?
• A common language — reference specific attack IDs (e.g., PI-007, JB-015) in security discussions
• Framework mappings — OWASP LLM Top 10 and MITRE ATLAS for compliance and audits
• Remediation guidance — defensive strategies per category with code examples
• ESF Phase 1-3 foundation — the naming, relating, and initial heuristics that all downstream hardening depends on

taxonomy/                            ← repo root (tachyonic-sh/taxonomy)
├── taxonomy/                        ← ESF Phase 1: Name
│   ├── attack_catalog.yaml          # All 168 attacks (IDs, names, descriptions, severity)
│   ├── owasp_mapping.yaml           # Attack → OWASP LLM Top 10 mapping
│   └── atlas_mapping.yaml           # Attack → MITRE ATLAS mapping
├── schema/
│   └── attack_schema.yaml           # YAML schema for attack definitions
├── remediation/                     ← ESF Phase 3: Guess
│   ├── by_owasp.yaml               # Defensive guidance per OWASP category
│   └── code_examples/
│       ├── input_validation.py      # Input sanitization patterns
│       └── output_sanitization.py   # Output filtering patterns
├── research/
│   └── papers.yaml                  # Academic references index
├── examples/
│   └── sample_attacks.yaml          # Basic public examples
├── ESF.md                           # How this repo implements ESF Phases 1-3
├── README.md
├── LICENSE                          # Apache 2.0
└── CONTRIBUTING.md

# taxonomy/attack_catalog.yaml
- id: PI-001
  name: Direct Instruction Override
  category: prompt_injection
  description: >
    Attacker provides input that directly instructs the model to ignore
    its system prompt and follow new instructions instead.
  severity: critical
  owasp: LLM01

1. Clone the repo
2. Review taxonomy/attack_catalog.yaml for the full attack surface
3. Check remediation/by_owasp.yaml for defensive guidance
4. Use the schema in schema/attack_schema.yaml to add your own attack definitions

# taxonomy/owasp_mapping.yaml
LLM01_prompt_injection:
  attacks: [PI-001, PI-002, ..., PI-020, MT-001, ..., MT-008]
  total: 28
  description: Direct and indirect prompt injection techniques

Use the ESF Quick Start to score your system against the ten-phase maturity model. This taxonomy provides the foundation for Phases 1-3.

This repository is the Phases 1-3 reference implementation of the ESF.

The ESF defines how security knowledge matures through ten phases — from naming threats (Phase 1, this repo) to mathematically proving defenses (Phase 9). OWASP tells you what the risks are. The ESF tells you how to progressively harden against them.

See ESF.md for the full mapping and growth roadmap.

This taxonomy deliberately excludes:

• Attack payloads — the specific prompts/content that execute attacks
• Detection logic — how to identify if an attack succeeded
• Model-specific success rates — which attacks work against which models
• Confidence scoring — how to rate vulnerability severity programmatically

These are the difference between knowing attacks exist and being able to systematically test for them.

See CONTRIBUTING.md for guidelines. We welcome:

• New attack technique descriptions
• Additional framework mappings (NIST, ISO 27001, etc.)
• Remediation guidance improvements
• Research paper references

Want to test your AI system against all 168 attack vectors? Tachyonic offers 48-hour red team assessments with full reporting, resistance scoring, and ESF maturity assessment.

Book a scoping call →

Apache 2.0 — see LICENSE.

@misc{tachyonic-taxonomy,
  title={Tachyonic Taxonomy: AI/LLM Attack Vectors},
  author={Tachyonic},
  year={2026},
  url={https://github.com/tachyonic-sh/taxonomy}
}