AID-H-038: Inference Serving Runtime Surface & Privileged Capability Governance

Version 1.20261015 · Family — navigation only

Constrain the process-level network surface and privileged capabilities of self-hosted or operator-controlled inference runtimes. Verify which listeners and internal transports actually start, and separately authorize state-changing runtime operations such as model load, unload, weight or adapter update, pause, resume, scaling, and repository control.

Scope boundary

Owns inference-runtime listener and protocol conformance plus operation-level authorization of privileged or state-changing serving capabilities. It does not own TLS, caller authentication, network reachability policy, debug-output content, generic service discovery, vulnerability remediation, or model-interface composition.

AID-I-002: AID-H-038.001 verifies which listeners and protocols the inference process actually starts; AID-I-002 controls which network sources can reach an approved endpoint. A blocked unexpected port is still an unnecessary process surface, while an approved listener still requires network containment.

AID-H-004.002: AID-H-004.002 establishes and authenticates the calling workload or service; AID-H-038.002 decides which authenticated identity may invoke each privileged inference-runtime operation. Authentication without operation authorization does not protect weight update, adapter load, pause, scale, or model-control functions.

AID-H-032.003: AID-H-038.001 determines whether a debug or metrics listener should exist and where it binds; AID-H-032.003 governs whether debug and observability output discloses sensitive information. A listener can conform while leaking data, or expose no sensitive content while still being an unnecessary attack surface.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0006 Active Scanning
AML.T0006.002 Active Scanning: Scan for Exposed AI Infrastructure
AML.T0018 Manipulate AI Model
AML.T0018.000 Manipulate AI Model: Poison AI Model
AML.T0029 Denial of AI Service
AML.T0040 AI Model Inference API Access
AML.T0049 Exploit Public-Facing Application
AML.T0120 AI Artifact Repository
AML.T0122 Exploitation of Remote Services
AML.T0132 Misconfigured or Publicly Exposed AI Services

MAESTRO

Orchestration Attacks (L4)
Privilege Escalation (Cross-Layer)

OWASP LLM Top 10 2026

LLM05:2026 Data and Model Poisoning
LLM06:2026 Unbounded Consumption

OWASP ML Top 10 2023

ML05:2023 Model Theft
ML10:2023 Model Poisoning

OWASP Top 10 for Agentic Applications 2026

NIST Adversarial Machine Learning 2025

NISTAML.026 Model Poisoning (Integrity)
NISTAML.031 Model Extraction

Cisco Integrated AI Security and Safety Framework

AITech-9.3 Dependency / Plugin Compromise
AITech-13.1 Disruption of Availability
AITech-14.1 Unauthorized Access
AISubtech-9.3.1 Malicious Package / Tool Injection
AISubtech-9.3.3 Dependency Replacement / Rug Pull
AISubtech-13.1.3 Model Denial of Service
AISubtech-14.1.2 Insufficient Access Controls

Google Secure AI Framework 2.0 - Risks

MXF: Model Exfiltration
MDT: Model Deployment Tampering
IIC: Insecure Integrated Component

Databricks AI Security Framework 3.0

Model 7.1: Backdoor machine learning / Trojaned model
Model Serving - Inference requests 9.11: Model Inference API Access
Platform 12.4: Unauthorized privileged access