Scope boundary

Owns manifest-authorized quarantine or eviction of confirmed malicious model, dataset, graph, adapter, code, and configuration artifacts; durable tombstone propagation; serving ineligibility; and routing of non-detachable model impact to recovery. Candidate discovery and compromise attribution remain inputs from Detect or validation controls.

AID-E-002: AID-E-003 removes or quarantines malicious artifacts; AID-E-002 terminates active execution processes, leases, jobs, pods, and containers. Artifact eviction prevents future serving or loading but does not prove that already running code stopped, while process termination leaves the malicious source artifact available unless this control removes it.

AID-R-001: AID-E-003 makes the compromised model or adapter population ineligible and routes recovery; AID-R-001 restores or creates a trusted recovered model release. Eviction does not establish recovered-model readiness, and successful model recovery does not prove removal of every compromised artifact or derivative.

Sub-techniques

• AID-E-003.001: Compromised Model Quarantine & Recovery Routing
• AID-E-003.002: Manifest-Bound Poisoned Dataset & Graph Eviction
• AID-E-003.003: Confirmed Malicious Code & Persistence Eviction
• AID-E-003.005: LLM Adapter & Derivative Artifact Removal

Threat mappings

MITRE ATLAS

• AML.T0010 AI Supply Chain Compromise
• AML.T0010.001 AI Supply Chain Compromise: AI Software
• AML.T0010.002 AI Supply Chain Compromise: Data
• AML.T0010.003 AI Supply Chain Compromise: Model
• AML.T0010.004 AI Supply Chain Compromise: Container Registry
• AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
• AML.T0011 User Execution
• AML.T0011.000 User Execution: Unsafe AI Artifacts
• AML.T0011.001 User Execution: Malicious Package
• AML.T0011.002 User Execution: Poisoned AI Agent Tool
• AML.T0018 Manipulate AI Model
• AML.T0018.000 Manipulate AI Model: Poison AI Model
• AML.T0018.002 Manipulate AI Model: Embed Malware
• AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
• AML.T0020 Training Data Poisoning
• AML.T0043.004 Craft Adversarial Data: Insert Backdoor Trigger
• AML.T0059 Erode Dataset Integrity
• AML.T0070 RAG Poisoning
• AML.T0071 False RAG Entry Injection
• AML.T0076 Corrupt AI Model
• AML.T0081 Modify AI Agent Configuration
• AML.T0110 AI Agent Tool Poisoning
• AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions
• AML.T0110.001 AI Agent Tool Poisoning: Implementation
• AML.T0115 Publish Poisoned AI Artifacts
• AML.T0115.001 Publish Poisoned AI Artifacts: Models
• AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
• AML.T0121 AI Agent Environment Reconstruction

MAESTRO

• Backdoor Attacks (L1)
• Data Poisoning (Training Phase) (L1)
• Data Poisoning (L2)
• Data Tampering (L2)
• Compromised RAG Pipelines (L2)
• Compromised Framework Components (L3)
• Compromised Container Images (L4)
• Infrastructure-as-Code (IaC) Manipulation (L4)
• Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain
• LLM05:2026 Data and Model Poisoning

OWASP ML Top 10 2023

• ML02:2023 Data Poisoning Attack
• ML06:2023 AI Supply Chain Attacks
• ML10:2023 Model Poisoning

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities
• ASI05:2026 Unexpected Code Execution (RCE)
• ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

• NISTAML.012 Clean-label Poisoning
• NISTAML.013 Data Poisoning
• NISTAML.021 Clean-label Backdoor
• NISTAML.023 Backdoor Poisoning
• NISTAML.024 Targeted Poisoning
• NISTAML.026 Model Poisoning (Integrity)
• NISTAML.051 Model Poisoning (Supply Chain)

Cisco Integrated AI Security and Safety Framework

• AITech-5.2 Configuration Persistence
• AITech-6.1 Training Data Poisoning
• AITech-7.3 Data Source Abuse and Manipulation
• AISubtech-5.2.1 Agent Profile Tampering
• AISubtech-6.1.1 Knowledge Base Poisoning
• AISubtech-9.2.2 Backdoors and Trojans

Google Secure AI Framework 2.0 - Risks

• DP: Data Poisoning
• UTD: Unauthorized Training Data
• MST: Model Source Tampering
• MDT: Model Deployment Tampering
• IIC: Insecure Integrated Component
• PIJ: Prompt Injection

Databricks AI Security Framework 3.0

• Raw Data 1.7: Lack of data trustworthiness
• Raw Data 1.11: Compromised 3rd-party datasets
• Datasets 3.1: Data poisoning
• Datasets 3.3: Label flipping
• Algorithms 5.4: Malicious libraries
• Model 7.1: Backdoor machine learning / Trojaned model
• Model 7.3: ML Supply chain vulnerabilities
• Model 7.4: Source code control attack
• Agents - Core 13.1: Memory Poisoning
• Agents - Core 13.11: Unexpected RCE and Code Attacks
• Agents - Tools MCP Server 13.18: Tool Poisoning