AID-H-007: Secure Training & Evaluation Pipeline Integrity
Protect the integrity and reproducibility of AI training and evaluation pipelines, including governed inputs, isolated execution environments, code and dependency provenance, evaluation-corpus controls, evaluator mechanisms, raw evidence, and promotion gates. The children separate data and feedback integrity, resource and environment isolation, reproducible builds, evaluation-case and promotion-evidence integrity, trusted toolchains, secure checkpoint or intermediate artifacts, and evaluator-mechanism independence because each has a distinct measured population and enforcement point.
Scope boundary
Owns integrity, isolation, reproducibility, evidence independence, evaluation sufficiency, evaluator integrity, and promotion controls across AI training, fine-tuning, post-training transformation, and validation pipelines.
Sub-techniques
- AID-H-007.001: Secure Training Environment Provisioning
- AID-H-007.002: Runtime Training Job Monitoring & Auditing
- AID-H-007.003: Training Process Reproducibility
- AID-H-007.004: Evaluation Data Integrity, Sufficiency Assurance & Promotion Governance
- AID-H-007.005: Fine-Tuning Safety Alignment Preservation & Erosion Detection
- AID-H-007.006: Post-Training Optimization & Format-Conversion Safety Regression
- AID-H-007.007: Evaluator, Judge & Test-Harness Integrity
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.001 AI Supply Chain Compromise: AI Software
- AML.T0010.002 AI Supply Chain Compromise: Data
- AML.T0010.003 AI Supply Chain Compromise: Model
- AML.T0011 User Execution
- AML.T0011.000 User Execution: Unsafe AI Artifacts
- AML.T0018 Manipulate AI Model
- AML.T0018.000 Manipulate AI Model: Poison AI Model
- AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
- AML.T0020 Training Data Poisoning
- AML.T0025 Exfiltration via Cyber Means
- AML.T0031 Erode AI Model Integrity
- AML.T0054 LLM Jailbreak
- AML.T0059 Erode Dataset Integrity
MAESTRO
- Data Poisoning (Training Phase) (L1)
- Data Poisoning (L2)
- Resource Hijacking (L4)
- Manipulation of Evaluation Metrics (L5)
- Supply Chain Attacks (Cross-Layer)
- Lateral Movement (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM04:2026 Supply Chain
- LLM05:2026 Data and Model Poisoning
OWASP ML Top 10 2023
- ML02:2023 Data Poisoning Attack
- ML05:2023 Model Theft
- ML06:2023 AI Supply Chain Attacks
- ML10:2023 Model Poisoning
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI04:2026 Agentic Supply Chain Vulnerabilities
NIST Adversarial Machine Learning 2025
- NISTAML.013 Data Poisoning
- NISTAML.018 Prompt Injection
- NISTAML.024 Targeted Poisoning
- NISTAML.026 Model Poisoning (Integrity)
- NISTAML.051 Model Poisoning (Supply Chain)
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-2.3 Reward Hacking
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-6.1 Training Data Poisoning
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-12.1 Tool Exploitation
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-14.1 Unauthorized Access
- AITech-15.1 Harmful Content
- AISubtech-1.1.4 Token Exploitation
- AISubtech-2.3.2 Verifier Manipulation
- AISubtech-2.3.3 Shortcut Acquisition
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- DP: Data Poisoning
- MST: Model Source Tampering
- MXF: Model Exfiltration
Databricks AI Security Framework 3.0
- Raw Data 1.1: Insufficient access controls
- Raw Data 1.4: Ineffective storage and encryption
- Raw Data 1.5: Lack of data versioning
- Governance 4.1: Lack of traceability and transparency of model assets
- Governance 4.2: Lack of end-to-end ML lifecycle
- Algorithms 5.1: Lack of tracking and reproducibility of experiments
- Evaluation 6.1: Evaluation data poisoning
- Evaluation 6.2: Insufficient evaluation data
- Model 7.3: ML Supply chain vulnerabilities
- Model 7.4: Source code control attack
- Model Serving - Inference requests 9.12: LLM Jailbreak
- Platform 12.1: Lack of vulnerability management
- Platform 12.4: Unauthorized privileged access