AID-D-001: Adversarial Input, Prompt Injection & Signal-Authenticity Detection
Detect adversarial or policy-relevant properties intrinsic to an input, recalled memory item, or prompt-gate event: malicious intent and obfuscation, statistically anomalous vectors, prompt-integrity canary failures, forensic evidence that an image, voice, video, biometric, or other sensor signal is synthetic or manipulated, recalled-memory hazards, and decision-telemetry inconsistencies. Each child emits structured findings and evidence without making the admission or containment decision.
Scope boundary
Owns findings about adversarial or policy-relevant properties intrinsic to an input, recalled memory item, media signal, or prompt-gate event. It detects and correlates evidence but does not admit, sanitize, block, downgrade, or contain the input.
AID-D-007: AID-D-001 detects malicious content, anomalous vectors, prompt-integrity failures, or authenticity properties within an input or signal; AID-D-007 detects semantic, temporal, or payload inconsistency between modalities or across a multimodal session. A suspicious property inside one artifact and a contradiction between multiple artifacts are different detector populations.
Warning
Critical Architecture Warning
Adaptive attacks can evade probabilistic input detectors.
- Stateful attacks: attackers can distribute malicious intent across multiple benign-looking turns.
- Unbounded prompt space: an aggregate detection rate is not a guarantee against an adversary who can iterate.
- Detector fragility: model-based detectors can themselves be manipulated by obfuscation and instruction tricks. Treat missing coverage or uncertain findings as insufficient evidence, never as proof of safety.
Sub-techniques
- AID-D-001.001: Per-Prompt Content, Intent & Obfuscation Analysis
- AID-D-001.002: Synthetic Media & Deepfake Forensics
- AID-D-001.003: Vector-Space Anomaly Detection
- AID-D-001.004: Active Prompt Integrity Check (Canary Tokens)
- AID-D-001.005: Recalled Memory Pre-Rehydration Scanning
- AID-D-001.006: Prompt Gate Decision Telemetry Correlation
Threat mappings
MITRE ATLAS
- AML.T0015 Evade AI Model
- AML.T0043 Craft Adversarial Data
- AML.T0043.000 Craft Adversarial Data: White-Box Optimization
- AML.T0043.003 Craft Adversarial Data: Manual Modification
- AML.T0048 External Harms
- AML.T0048.000 External Harms: Financial Harm
- AML.T0048.001 External Harms: Reputational Harm
- AML.T0048.002 External Harms: Societal Harm
- AML.T0048.003 External Harms: User Harm
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0051.002 LLM Prompt Injection: Triggered
- AML.T0052.001 Phishing: Deepfake-Assisted Phishing
- AML.T0053 AI Agent Tool Invocation
- AML.T0054 LLM Jailbreak
- AML.T0056 Extract LLM System Prompt
- AML.T0068 LLM Prompt Obfuscation
- AML.T0069.000 Discover LLM System Information: Special Character Sets
- AML.T0070 RAG Poisoning
- AML.T0071 False RAG Entry Injection
- AML.T0073 Impersonation
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0088 Generate Deepfakes
- AML.T0094 Delay Execution of LLM Instructions
- AML.T0123 Obfuscated Files or Information
- AML.T0130 AI Agent Response Biasing
MAESTRO
- Adversarial Examples (L1)
- Reprogramming Attacks (L1)
- Compromised RAG Pipelines (L2)
- Input Validation Attacks (L3)
- Framework Evasion (L3)
- Evasion of Security AI Agents (L6)
- Agent Impersonation (L7)
- Agent Goal Manipulation (L7)
- Privilege Escalation (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM05:2026 Data and Model Poisoning
- LLM07:2026 Misinformation
- LLM08:2026 Hidden Context Exposure
OWASP ML Top 10 2023
- ML01:2023 Input Manipulation Attack
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI03:2026 Identity and Privilege Abuse
- ASI06:2026 Memory & Context Poisoning
- ASI09:2026 Human-Agent Trust Exploitation
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.022 Evasion
- NISTAML.025 Black-box Evasion
- NISTAML.035 Prompt Extraction
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-1.3 Multimodal Injection and Manipulation
- AITech-4.2 Context Boundary Attacks
- AITech-5.1 Memory System Persistence
- AITech-7.2 Memory System Corruption
- AITech-8.4 Prompt/Meta Extraction
- AITech-9.2 Detection Evasion
- AITech-15.1 Harmful Content
- AITech-17.1 Sensor Spoofing
- AISubtech-1.1.1 Instruction Manipulation
- AISubtech-1.1.2 Obfuscation
- AISubtech-1.1.5 Context Manipulation
- AISubtech-1.3.2 Image Manipulation
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-8.4.1 System LLM Prompt Leakage
- AISubtech-15.1.25 General Harms
- AISubtech-17.1.1 Sensor Spoofing: Action Signals (audio, visual)
Google Secure AI Framework 2.0 - Risks
- PIJ: Prompt Injection
- MEV: Model Evasion
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.1: Prompt inject
- Model Serving - Inference requests 9.9: Input Resource Control
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Model Serving - Inference requests 9.13: Excessive agency
- Model Serving - Inference response 10.5: Black-box attacks
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.9: Identity Spoofing & Impersonation
- Agents - Tools MCP Server 13.16: Prompt Injection
- Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation