Scope boundary

Owns three distinct graph and GNN detector classes: validation-time candidate trigger response, structure-feature edge anomalies, and topology-only node anomalies. It consumes signed graph references but does not create baselines, mutate graphs, harden training, or treat missing applicable evidence as clean.

AID-M-003.006: AID-D-012 executes graph and GNN detection against approved references; AID-M-003.006 creates, validates, signs, and recalibrates graph snapshots, metrics, and probe-output baselines. Detection findings must remain independent of baseline authorship.

Warning

Controlled Validation and Investigation Limits

Candidate trigger probing covers only preregistered operators, budgets, targets, graph corpora, and seeds. Unknown, semantic, distributed, adaptive, architecture-level, or attacker-secret triggers remain outside coverage, and a threshold breach can indicate adversarial fragility or clean distribution shift rather than compromise.

Structure-feature and topology heuristics depend on graph family and can produce false findings under heterophily, sparse graphs, or legitimate topology change. Graph-anomaly findings must remain investigative and must not automatically delete graph data or block promotion.

Sub-techniques

• AID-D-012.001: Controlled GNN Backdoor Trigger-Response Testing
• AID-D-012.002: Calibrated Structure-Feature Relationship Anomaly Detection
• AID-D-012.003: Topology-Only Degree & Centrality Anomaly Detection

Threat mappings

MITRE ATLAS

• AML.T0018 Manipulate AI Model
• AML.T0018.000 Manipulate AI Model: Poison AI Model
• AML.T0020 Training Data Poisoning
• AML.T0043.004 Craft Adversarial Data: Insert Backdoor Trigger

MAESTRO

• Backdoor Attacks (L1)
• Data Poisoning (Training Phase) (L1)
• Data Poisoning (L2)
• Data Tampering (L2)

OWASP LLM Top 10 2026

• N/A

OWASP ML Top 10 2023

• ML02:2023 Data Poisoning Attack
• ML10:2023 Model Poisoning

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• NISTAML.013 Data Poisoning
• NISTAML.021 Clean-label Backdoor
• NISTAML.023 Backdoor Poisoning
• NISTAML.024 Targeted Poisoning
• NISTAML.026 Model Poisoning (Integrity)

Cisco Integrated AI Security and Safety Framework

• AITech-6.1 Training Data Poisoning
• AISubtech-9.2.2 Backdoors and Trojans

Google Secure AI Framework 2.0 - Risks

• DP: Data Poisoning
• MST: Model Source Tampering

Databricks AI Security Framework 3.0

• Datasets 3.1: Data poisoning
• Model 7.1: Backdoor machine learning / Trojaned model