AID-D-002: AI Model Anomaly & Performance Drift Detection
Monitor deployed AI systems for statistically significant shifts in input distributions, output behavior, labeled performance, and available model telemetry. Where an operator can lawfully observe an emitted reasoning trace, inspect its meaning for attack or policy-evasion signals without treating it as a faithful record of internal cognition. This family groups detective controls for drift, poisoning effects, evasion symptoms, backdoor activation, reasoning abuse, and reasoning-specific resource anomalies.
Applicability: select only the sub-technique whose required signal is actually observable. An absent label stream, log-probability distribution, internal tensor, reasoning metadata, or emitted reasoning trace provides no evidence that the corresponding anomaly is absent.
Applicability: select only the sub-technique whose required signal is actually observable. An absent label stream, log-probability distribution, internal tensor, reasoning metadata, or emitted reasoning trace provides no evidence that the corresponding anomaly is absent.
Scope boundary
Owns production detection of statistically significant shifts in input distributions, output behavior, labeled performance, model-internal signals, reasoning metadata, and the semantics of an operator-visible emitted reasoning trace. Each claim is limited to the exact observable signal and measured population.
AID-M-003.002: AID-D-002 compares live behavior against approved references and emits drift or anomaly findings; AID-M-003.002 creates and recalibrates the trusted general predictive and operational baselines. Production monitoring consumes a versioned reference rather than training on the same live population it judges.
Sub-techniques
- AID-D-002.001: Input / Output Distribution Drift Monitoring
- AID-D-002.002: Labeled Performance Tracking with Ground Truth Feedback Loop
- AID-D-002.003: White-Box Transformer Internal-Signal Anomaly Telemetry
- AID-D-002.004: Reasoning Trace & Thinking-Token Anomaly Telemetry
- AID-D-002.005: Emitted Reasoning-Trace Semantic Monitoring
Threat mappings
MITRE ATLAS
- AML.T0015 Evade AI Model
- AML.T0020 Training Data Poisoning
- AML.T0031 Erode AI Model Integrity
- AML.T0034 Cost Harvesting
- AML.T0034.001 Cost Harvesting: Resource-Intensive Queries
- AML.T0043 Craft Adversarial Data
- AML.T0043.004 Craft Adversarial Data: Insert Backdoor Trigger
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak
- AML.T0057 LLM Data Leakage
- AML.T0076 Corrupt AI Model
MAESTRO
- Adversarial Examples (L1)
- Backdoor Attacks (L1)
- Data Poisoning (L2)
- Data Tampering (L2)
- Resource Hijacking (L4)
- Manipulation of Evaluation Metrics (L5)
- Evasion of Detection (L5)
- Data Leakage through Observability (L5)
- Agent Goal Manipulation (L7)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
- LLM07:2026 Misinformation
OWASP ML Top 10 2023
- ML01:2023 Input Manipulation Attack
- ML02:2023 Data Poisoning Attack
- ML08:2023 Model Skewing
- ML10:2023 Model Poisoning
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
NIST Adversarial Machine Learning 2025
- NISTAML.011 Model Poisoning (Availability)
- NISTAML.012 Clean-label Poisoning
- NISTAML.013 Data Poisoning
- NISTAML.014 Energy-latency
- NISTAML.018 Prompt Injection
- NISTAML.021 Clean-label Backdoor
- NISTAML.022 Evasion
- NISTAML.023 Backdoor Poisoning
- NISTAML.024 Targeted Poisoning
- NISTAML.026 Model Poisoning (Integrity)
- NISTAML.027 Misaligned Outputs
- NISTAML.036 Leaking information from user interactions
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-2.2 Goal Drift
- AITech-7.1 Reasoning Corruption
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-9.2 Detection Evasion
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AISubtech-2.2.2 Goal Substitution
- AISubtech-9.2.2 Backdoors and Trojans
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.2.1 Service Misuse for Cost Inflation
Google Secure AI Framework 2.0 - Risks
- DP: Data Poisoning
- DMS: Denial of ML Service
- PIJ: Prompt Injection
- MEV: Model Evasion
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Datasets 3.1: Data poisoning
- Algorithms 5.2: Model drift
- Model 7.1: Backdoor machine learning / Trojaned model
- Model Serving - Inference requests 9.7: Denial of Service (DoS)
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Model Serving - Inference response 10.1: Lack of audit and monitoring inference quality
- Model Serving - Inference response 10.6: Sensitive data output from a model
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.6: Intent Breaking & Goal Manipulation