AID-D-004: AI Artifact, Runtime Configuration, Route & Lifecycle Integrity Monitoring
Detect unauthorized or unexplained changes to AI model and data artifacts, confidential-runtime attestations, runtime-loaded code and modules, runtime configuration and policy, requested-versus-effective routes, and observed lifecycle transitions.
Scope boundary
Owns integrity and drift findings across static artifacts, confidential-runtime attestations, loaded code, runtime configuration, model sources, turn chains, effective routes, and lifecycle paths. Each child retains a separate measured population, prerequisite, and observation point.
Sub-techniques
- AID-D-004.001: Static Artifact Integrity Re-verification & Drift Monitoring
- AID-D-004.002: Confidential Runtime Remote-Attestation Verification
- AID-D-004.003: Runtime Configuration & Policy Drift Detection and Monitoring
- AID-D-004.004: Model Source & Namespace Drift Detection
- AID-D-004.005: Runtime Turn-Chain Integrity Monitoring
- AID-D-004.006: Effective Route & Failover Drift Detection
- AID-D-004.007: AI Lifecycle-Path Drift Detection
- AID-D-004.008: AI Runtime Code and Module Loading Integrity Monitoring
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.001 AI Supply Chain Compromise: AI Software
- AML.T0010.002 AI Supply Chain Compromise: Data
- AML.T0010.003 AI Supply Chain Compromise: Model
- AML.T0010.004 AI Supply Chain Compromise: Container Registry
- AML.T0011 User Execution
- AML.T0011.000 User Execution: Unsafe AI Artifacts
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0018 Manipulate AI Model
- AML.T0018.000 Manipulate AI Model: Poison AI Model
- AML.T0018.001 Manipulate AI Model: Modify AI Model Architecture
- AML.T0018.002 Manipulate AI Model: Embed Malware
- AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
- AML.T0020 Training Data Poisoning
- AML.T0060 Publish Hallucinated Entities
- AML.T0073 Impersonation
- AML.T0074 Masquerading
- AML.T0076 Corrupt AI Model
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0081 Modify AI Agent Configuration
- AML.T0092 Manipulate User LLM Chat History
- AML.T0107 Exploitation for Defense Evasion
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.001 AI Agent Tool Poisoning: Implementation
- AML.T0112.001 Machine Compromise: AI Artifacts
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.001 Publish Poisoned AI Artifacts: Models
- AML.T0120 AI Artifact Repository
MAESTRO
- Data Poisoning (L2)
- Data Exfiltration (L2)
- Data Tampering (L2)
- Compromised Framework Components (L3)
- Compromised Container Images (L4)
- Orchestration Attacks (L4)
- Infrastructure-as-Code (IaC) Manipulation (L4)
- Regulatory Non-Compliance by AI Security Agents (L6)
- Integration Risks (L7)
- Repudiation (L7)
- Supply Chain Attacks (Cross-Layer)
- Privilege Escalation (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM04:2026 Supply Chain
- LLM05:2026 Data and Model Poisoning
OWASP ML Top 10 2023
- ML01:2023 Input Manipulation Attack
- ML02:2023 Data Poisoning Attack
- ML06:2023 AI Supply Chain Attacks
- ML07:2023 Transfer Learning Attack
- ML09:2023 Output Integrity Attack
- ML10:2023 Model Poisoning
OWASP Top 10 for Agentic Applications 2026
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI06:2026 Memory & Context Poisoning
- ASI07:2026 Insecure Inter-Agent Communication
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.013 Data Poisoning
- NISTAML.026 Model Poisoning (Integrity)
- NISTAML.039 Compromising connected resources
- NISTAML.051 Model Poisoning (Supply Chain)
Cisco Integrated AI Security and Safety Framework
- AITech-2.3 Reward Hacking
- AITech-3.1 Masquerading / Obfuscation / Impersonation
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-5.2 Configuration Persistence
- AITech-8.2 Data Exfiltration / Exposure
- AITech-9.3 Dependency / Plugin Compromise
- AITech-14.1 Unauthorized Access
- AISubtech-2.3.2 Verifier Manipulation
- AISubtech-3.1.2 Trusted Agent Spoofing
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- DP: Data Poisoning
- UTD: Unauthorized Training Data
- MST: Model Source Tampering
- EDH: Excessive Data Handling
- MDT: Model Deployment Tampering
- IIC: Insecure Integrated Component
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Raw Data 1.1: Insufficient access controls
- Datasets 3.1: Data poisoning
- Algorithms 5.4: Malicious libraries
- Model 7.1: Backdoor machine learning / Trojaned model
- Model 7.3: ML Supply chain vulnerabilities
- Model 7.4: Source code control attack
- Model Serving - Inference requests 9.10: Accidental exposure of unauthorized data to models
- Operations 11.1: Lack of MLOps - repeatable enforced standards
- Platform 12.5: Poor security in the software development lifecycle
- Platform 12.6: Lack of compliance
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.8: Repudiation & Untraceability
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Tools MCP Server 13.20: Insecure Server Configuration
- Agents - Tools MCP Server 13.21: Supply Chain Attacks
- Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation