AID-D-003: AI Output Monitoring & Policy-Violation Detection
Inspect model outputs, classifications, streaming responses, agent tool proposals, and related session telemetry in near real time. Emit structured findings for safety, privacy, security, integrity, and business-policy violations.
Scope boundary
Owns near-real-time observation, classification, scoring, correlation, and alert evidence for policy-relevant model outputs, streaming responses, agent action proposals, and session effects. It does not enforce schemas, sanitize, block, render, authorize, release, or contain output.
Sub-techniques
- AID-D-003.001: Harmful Text & Token Output Policy-Violation Detection
- AID-D-003.002: Sensitive Information & Data Leakage Detection
- AID-D-003.003: Agentic Tool Use & Action Policy Monitoring
- AID-D-003.004: Tool-Call Sequence Anomaly Detection
- AID-D-003.005: Stateful Session Monitoring: Intent Drift + Invariant-Breach Signals
- AID-D-003.006: Memory Write-Abuse & Drift Monitoring
- AID-D-003.007: Sensitive Attribute Inference Detection & Escalation
- AID-D-003.008: Generated Media & Binary Output Policy-Violation Detection
Threat mappings
MITRE ATLAS
- AML.T0024 Exfiltration via AI Inference API
- AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model
- AML.T0048 External Harms
- AML.T0048.000 External Harms: Financial Harm
- AML.T0048.001 External Harms: Reputational Harm
- AML.T0048.002 External Harms: Societal Harm
- AML.T0048.003 External Harms: User Harm
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0051.002 LLM Prompt Injection: Triggered
- AML.T0052 Phishing
- AML.T0052.000 Phishing: Spearphishing via Social Engineering LLM
- AML.T0053 AI Agent Tool Invocation
- AML.T0054 LLM Jailbreak
- AML.T0056 Extract LLM System Prompt
- AML.T0057 LLM Data Leakage
- AML.T0061 LLM Prompt Self-Replication
- AML.T0065 LLM Prompt Crafting
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0069.002 Discover LLM System Information: System Prompt
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0082 RAG Credential Harvesting
- AML.T0084 Discover AI Agent Configuration
- AML.T0084.000 Discover AI Agent Configuration: Embedded Knowledge
- AML.T0084.001 Discover AI Agent Configuration: Tool Definitions
- AML.T0084.002 Discover AI Agent Configuration: Activation Triggers
- AML.T0085 Data from AI Services
- AML.T0085.000 Data from AI Services: RAG Databases
- AML.T0085.001 Data from AI Services: AI Agent Tools
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0092 Manipulate User LLM Chat History
- AML.T0094 Delay Execution of LLM Instructions
- AML.T0098 AI Agent Tool Credential Harvesting
- AML.T0102 Generate Malicious Commands
- AML.T0108 AI Agent
- AML.T0117 Autonomous Attack-Path Adaptation
- AML.T0118 Autonomous AI Agent Communication
- AML.T0118.000 Autonomous AI Agent Communication: Communication via Shared Artifacts
- AML.T0123 Obfuscated Files or Information
- AML.T0126 Automated Collection
MAESTRO
- Data Poisoning (L2)
- Data Exfiltration (L2)
- Data Tampering (L2)
- Evasion of Detection (L5)
- Data Leakage through Observability (L5)
- Compromised Agents (L7)
- Agent Tool Misuse (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Privilege Escalation (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- ML03:2023 Model Inversion Attack
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI06:2026 Memory & Context Poisoning
- ASI08:2026 Cascading Failures
- ASI09:2026 Human-Agent Trust Exploitation
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.027 Misaligned Outputs
- NISTAML.032 Reconstruction
- NISTAML.034 Property Inference
- NISTAML.035 Prompt Extraction
- NISTAML.036 Leaking information from user interactions
- NISTAML.038 Data Extraction
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-2.1 Excessive Agency
- AITech-5.1 Memory System Persistence
- AITech-7.2 Memory System Corruption
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-12.1 Tool Exploitation
- AITech-12.2 Insecure Output Handling
- AITech-15.1 Harmful Content
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-8.2.1 Training Data Exposure
- AISubtech-8.2.2 LLM Data Leakage
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-8.3.2 System Information Exposure
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-8.3.4 Payment Card Industry Data Exposure
- AISubtech-8.3.5 Protected Health Information Exposure
- AISubtech-10.1.3 Sensitive Data Reconstruction
- AISubtech-12.1.1 Parameter Manipulation
- AISubtech-12.2.1 Code Detection / Malicious Code Output
- AISubtech-14.1.1 Credential Theft
- AISubtech-15.1.1 Cybersecurity and Hacking: Malware / Exploits
- AISubtech-15.1.8 Safety Harms and Toxicity: Harassment
- AISubtech-15.1.9 Safety Harms and Toxicity: Hate Speech
- AISubtech-15.1.13 Safety Harms and Toxicity: Self Harm
- AISubtech-15.1.14 Safety Harms and Toxicity: Sexual Content and Exploitation
- AISubtech-15.1.17 Safety Harms and Toxicity: Violence and Public Safety Threat
- AISubtech-15.1.24 Intellectual Property Compromise: Confidential Data
- AISubtech-15.1.25 General Harms
Google Secure AI Framework 2.0 - Risks
- EDH: Excessive Data Handling
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
- ISD: Inferred Sensitive Data
- IMO: Insecure Model Output
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.1: Prompt inject
- Model Serving - Inference requests 9.4: Looped input
- Model Serving - Inference requests 9.8: LLM hallucinations
- Model Serving - Inference requests 9.13: Excessive agency
- Model Serving - Inference response 10.1: Lack of audit and monitoring inference quality
- Model Serving - Inference response 10.2: Output manipulation
- Model Serving - Inference response 10.6: Sensitive data output from a model
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.7: Misaligned & Deceptive Behaviors
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Core 13.15: Human Manipulation
- Agents - Tools MCP Server 13.23: Data Exfiltration
- Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation
- Agents - Tools MCP Client 13.32: Client-Side Code Execution