Scope boundary

Owns version-bound provenance, integrity, and content-risk reference records for data, AI artifacts, memory, and knowledge assets. It creates facts consumed by admission and runtime controls but does not admit a supplier, authorize a read or write, detect production drift, or decide release promotion.

Sub-techniques

• AID-M-002.001: Data & Artifact Versioning
• AID-M-002.002: Cryptographic Integrity Verification
• AID-M-002.003: External Dataset Content-Risk Characterization
• AID-M-002.004: Trust-Tiered Memory/KB Provenance & Write Eligibility Contract
• AID-M-002.005: Hybrid Classical + Post-Quantum Integrity & Provenance for Long-Lived AI Assets

Threat mappings

MITRE ATLAS

• AML.T0010 AI Supply Chain Compromise
• AML.T0010.002 AI Supply Chain Compromise: Data
• AML.T0010.003 AI Supply Chain Compromise: Model
• AML.T0010.004 AI Supply Chain Compromise: Container Registry
• AML.T0020 Training Data Poisoning
• AML.T0059 Erode Dataset Integrity
• AML.T0070 RAG Poisoning
• AML.T0071 False RAG Entry Injection
• AML.T0074 Masquerading
• AML.T0076 Corrupt AI Model
• AML.T0080 AI Agent Context Poisoning
• AML.T0080.000 AI Agent Context Poisoning: Memory
• AML.T0099 AI Agent Tool Data Poisoning
• AML.T0112.001 Machine Compromise: AI Artifacts
• AML.T0115 Publish Poisoned AI Artifacts
• AML.T0115.000 Publish Poisoned AI Artifacts: Datasets
• AML.T0115.001 Publish Poisoned AI Artifacts: Models
• AML.T0131 Crafted AI Assistant Links

MAESTRO

• Data Poisoning (Training Phase) (L1)
• Data Poisoning (L2)
• Data Tampering (L2)
• Compromised RAG Pipelines (L2)
• Compromised Container Images (L4)
• Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure
• LLM04:2026 Supply Chain
• LLM05:2026 Data and Model Poisoning

OWASP ML Top 10 2023

• ML02:2023 Data Poisoning Attack
• ML06:2023 AI Supply Chain Attacks
• ML10:2023 Model Poisoning

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities
• ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

• NISTAML.013 Data Poisoning
• NISTAML.023 Backdoor Poisoning
• NISTAML.024 Targeted Poisoning
• NISTAML.037 Training Data Attacks
• NISTAML.051 Model Poisoning (Supply Chain)

Cisco Integrated AI Security and Safety Framework

• AITech-6.1 Training Data Poisoning
• AITech-7.3 Data Source Abuse and Manipulation
• AITech-8.2 Data Exfiltration / Exposure
• AITech-8.3 Information Disclosure
• AISubtech-6.1.1 Knowledge Base Poisoning
• AISubtech-7.3.1 Corrupted Third-Party Data
• AISubtech-8.2.1 Training Data Exposure
• AISubtech-8.2.2 LLM Data Leakage
• AISubtech-8.3.3 Personally Identifiable Information Exposure
• AISubtech-8.3.4 Payment Card Industry Data Exposure
• AISubtech-10.1.3 Sensitive Data Reconstruction

Google Secure AI Framework 2.0 - Risks

• DP: Data Poisoning
• MST: Model Source Tampering
• EDH: Excessive Data Handling
• MDT: Model Deployment Tampering
• SDD: Sensitive Data Disclosure

Databricks AI Security Framework 3.0

• Raw Data 1.2: Missing data classification
• Raw Data 1.3: Poor data quality
• Raw Data 1.5: Lack of data versioning
• Raw Data 1.6: Insufficient data lineage
• Raw Data 1.7: Lack of data trustworthiness
• Raw Data 1.11: Compromised 3rd-party datasets
• Data Prep 2.3: Raw data criteria
• Datasets 3.1: Data poisoning
• Governance 4.1: Lack of traceability and transparency of model assets
• Algorithms 5.1: Lack of tracking and reproducibility of experiments
• Algorithms 5.4: Malicious libraries
• Model 7.3: ML Supply chain vulnerabilities
• Model 7.4: Source code control attack
• Agents - Core 13.1: Memory Poisoning