Scope boundary

Owns recovered-model readiness and release through either exact rollback or construction of a newly remediated model. It does not quarantine a suspect model, evict compromised adapters or derivatives, or remove malicious artifacts before recovery.

AID-E-003: AID-R-001 restores and releases a trusted model state; AID-E-003 removes or quarantines malicious AI artifacts before recovery. Recovery may consume AID-E-003 eviction evidence, but a successful rollback or retraining result does not prove that the compromised artifact was removed from every serving, registry, cache, or lineage path.

Sub-techniques

• AID-R-001.001: Versioned Model Rollback & Restoration
• AID-R-001.002: Model Retraining for Remediation

Threat mappings

MITRE ATLAS

• AML.T0011 User Execution
• AML.T0011.000 User Execution: Unsafe AI Artifacts
• AML.T0018 Manipulate AI Model
• AML.T0018.000 Manipulate AI Model: Poison AI Model
• AML.T0018.001 Manipulate AI Model: Modify AI Model Architecture
• AML.T0018.002 Manipulate AI Model: Embed Malware
• AML.T0018.003 Manipulate AI Model: Modify Prompt Construction Logic
• AML.T0020 Training Data Poisoning
• AML.T0031 Erode AI Model Integrity
• AML.T0043.004 Craft Adversarial Data: Insert Backdoor Trigger
• AML.T0059 Erode Dataset Integrity
• AML.T0076 Corrupt AI Model
• AML.T0115 Publish Poisoned AI Artifacts
• AML.T0115.000 Publish Poisoned AI Artifacts: Datasets
• AML.T0115.001 Publish Poisoned AI Artifacts: Models

MAESTRO

• Backdoor Attacks (L1)
• Data Poisoning (Training Phase) (L1)
• Data Poisoning (L2)
• Supply Chain Attacks (L3)
• Compromised Container Images (L4)
• Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain
• LLM05:2026 Data and Model Poisoning

OWASP ML Top 10 2023

• ML02:2023 Data Poisoning Attack
• ML06:2023 AI Supply Chain Attacks
• ML07:2023 Transfer Learning Attack
• ML10:2023 Model Poisoning

OWASP Top 10 for Agentic Applications 2026

• ASI04:2026 Agentic Supply Chain Vulnerabilities

NIST Adversarial Machine Learning 2025

• NISTAML.011 Model Poisoning (Availability)
• NISTAML.012 Clean-label Poisoning
• NISTAML.013 Data Poisoning
• NISTAML.021 Clean-label Backdoor
• NISTAML.023 Backdoor Poisoning
• NISTAML.024 Targeted Poisoning
• NISTAML.026 Model Poisoning (Integrity)
• NISTAML.037 Training Data Attacks
• NISTAML.051 Model Poisoning (Supply Chain)

Cisco Integrated AI Security and Safety Framework

• AITech-5.2 Configuration Persistence
• AITech-6.1 Training Data Poisoning
• AITech-8.2 Data Exfiltration / Exposure
• AITech-15.1 Harmful Content
• AISubtech-5.2.1 Agent Profile Tampering
• AISubtech-8.2.1 Training Data Exposure
• AISubtech-9.2.2 Backdoors and Trojans
• AISubtech-10.1.3 Sensitive Data Reconstruction

Google Secure AI Framework 2.0 - Risks

• DP: Data Poisoning
• UTD: Unauthorized Training Data
• MST: Model Source Tampering
• MDT: Model Deployment Tampering

Databricks AI Security Framework 3.0

• Raw Data 1.7: Lack of data trustworthiness
• Datasets 3.1: Data poisoning
• Datasets 3.3: Label flipping
• Model 7.1: Backdoor machine learning / Trojaned model
• Model 7.3: ML Supply chain vulnerabilities