Scope boundary

Owns preventive release controls for generated text, markup, structured payloads, URLs, predictions, media, and binary artifacts before they reach users, renderers, tools, interpreters, storage sinks, or downstream services.

AID-D-003: AID-H-006 sanitizes, transforms, blocks, or releases output at the preventive boundary; AID-D-003 observes output and emits policy-violation findings. Detection evidence informs the release gate but does not itself control delivery.

AID-H-025: AID-H-006 owns output release safety for text, markup, predictions, media, and binary artifacts; AID-H-025 owns admission and execution constraints for generated code or commands. Rendering or releasing a code artifact and authorizing it to execute are separate decisions.

Sub-techniques

• AID-H-006.001: Structured Output Enforcement
• AID-H-006.002: Text, Markup & Structured Output Sanitization and Release Gate
• AID-H-006.003: Prediction Response Minimization & Extraction-Resistance Validation
• AID-H-006.004: Generated Media & Binary Artifact Output Safety Release Gate

Threat mappings

MITRE ATLAS

• AML.T0024 Exfiltration via AI Inference API
• AML.T0024.000 Exfiltration via AI Inference API: Infer Training Data Membership
• AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model
• AML.T0024.002 Exfiltration via AI Inference API: Extract AI Model
• AML.T0042 Verify Attack
• AML.T0050 Command and Scripting Interpreter
• AML.T0057 LLM Data Leakage
• AML.T0063 Discover AI Model Outputs
• AML.T0067 LLM Trusted Output Components Manipulation
• AML.T0077 LLM Response Rendering
• AML.T0082 RAG Credential Harvesting
• AML.T0113 Steal Web Session Cookie
• AML.T0123 Obfuscated Files or Information

MAESTRO

• Model Stealing (L1)
• Membership Inference Attacks (L1)
• Integration Risks (L7)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure
• LLM06:2026 Unbounded Consumption
• LLM08:2026 Hidden Context Exposure
• LLM10:2026 Improper Output Handling

OWASP ML Top 10 2023

• ML03:2023 Model Inversion Attack
• ML04:2023 Membership Inference Attack
• ML05:2023 Model Theft
• ML09:2023 Output Integrity Attack

OWASP Top 10 for Agentic Applications 2026

• ASI05:2026 Unexpected Code Execution (RCE)

NIST Adversarial Machine Learning 2025

• NISTAML.031 Model Extraction
• NISTAML.032 Reconstruction
• NISTAML.033 Membership Inference
• NISTAML.034 Property Inference
• NISTAML.038 Data Extraction
• NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

• AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
• AITech-4.3 Protocol Manipulation
• AITech-8.1 Membership Inference
• AITech-8.2 Data Exfiltration / Exposure
• AITech-8.3 Information Disclosure
• AITech-9.1 Model or Agentic System Manipulation
• AITech-10.1 Model Extraction
• AITech-10.2 Model Inversion
• AITech-12.1 Tool Exploitation
• AITech-12.2 Insecure Output Handling
• AITech-13.1 Disruption of Availability
• AISubtech-1.1.4 Token Exploitation
• AISubtech-4.3.1 Schema Inconsistencies
• AISubtech-8.1.1 Presence Detection
• AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
• AISubtech-9.1.4 Injection Attacks (e.g., SQL, Command Execution, XSS)
• AISubtech-10.1.1 API Query Stealing
• AISubtech-10.1.2 Weight Reconstruction
• AISubtech-10.1.3 Sensitive Data Reconstruction
• AISubtech-12.1.1 Parameter Manipulation
• AISubtech-12.1.3 Unsafe System / Browser / File Execution
• AISubtech-12.2.1 Code Detection / Malicious Code Output
• AISubtech-13.1.2 Memory Flooding
• AISubtech-13.1.4 Application Denial of Service

Google Secure AI Framework 2.0 - Risks

• MXF: Model Exfiltration
• MRE: Model Reverse Engineering
• SDD: Sensitive Data Disclosure
• ISD: Inferred Sensitive Data
• IMO: Insecure Model Output

Databricks AI Security Framework 3.0

• Algorithms 5.3: Hyperparameters stealing
• Model Management 8.2: Model theft
• Model Management 8.4: Model inversion
• Model Serving - Inference requests 9.2: Model inversion
• Model Serving - Inference requests 9.5: Infer training data membership
• Model Serving - Inference response 10.5: Black-box attacks
• Model Serving - Inference response 10.6: Sensitive data output from a model
• Agents - Core 13.11: Unexpected RCE and Code Attacks