ATLAS technique coverage

Adversary-authored text reaches the model as instruction. Direct when typed at the model, indirect when planted in data the model later reads — an alert field, a ticket comment, a document.

Taught by 4 labs

• Poisoned Knowledge Base
• The Tool Said So
• Copilot Under Attack
• AI Incident Commander

The instruction is planted in content the model ingests rather than sent by the attacker directly. This is the form a SOC agent meets: the payload arrives inside the alert it was asked to triage.

Taught by 3 labs

• Poisoned Knowledge Base
• The Tool Said So
• Copilot Under Attack

A model, weights file, dataset or dependency is altered upstream, so the deployed system behaves differently than the one that was reviewed.

Taught by 1 lab

• Model Swap

Legitimate credentials or connector grants give access to an AI system or its tools; least-privilege tiering and routing limit what a stolen account can reach.

Taught by 2 labs

• R4 — The Regulated Enterprise Connector
• R6 — The Intelligent Router Under Pressure

Content that moves the model past its guardrails, so it takes an action or discloses material its instructions forbid.

Taught by 1 lab

• Guardrail Regression

The downstream damage the manipulated system causes: a real detection closed, an account wrongly disabled, a client told an intrusion was noise.

Taught by 1 lab

• Hallucinated Indicator

Sustained manipulation that degrades the model's decisions over time rather than in a single case, including feeding it poisoned outcomes as feedback.

Taught by 1 lab

• Model Swap

Queries or agent loops are driven to run up compute and token spend, degrading service through cost rather than outage.

Taught by 1 lab

• Token Fire

The model is steered into emitting content from its context: other tenants' records, system prompts, credentials pasted into a case.

Taught by 6 labs

• Read the Trace
• Tenant Zero
• R1 — The Range Without AI
• R2 — Private Analyst on the Laptop
• R5 — The Fair AI-Assisted Assessment
• R7 — Shared War Room

Repeated inference queries recover a model's behavior or reveal whether specific records were in its training data.

Taught by 2 labs

• Steal the Model
• Who Was in the Training Set?

The model's tools are used as the attack surface — a tool call steered to reach data or systems the agent's role does not permit.

Taught by 5 labs

• The Helpful Support Bot
• Approved by Nobody
• Autonomous Responder
• Agent Cyber Arena
• R3 — Choose Your Copilot

Input shaped so the model classifies genuinely malicious activity as benign, without touching the model itself.

Taught by 1 lab

• Pixel Imperfect

Adversaries gather public models, datasets, prompts and deployment details to map an AI system before attacking it; defenders counter with an inventory of what is exposed.

Taught by 2 labs

• Map the AI System
• R8 — Model Bake-Off and Procurement Decision

Adversary content is planted in a retrieval corpus or agent memory so it is retrieved later and steers the model on every matching query, surviving resets until the stored text is removed.

Taught by 2 labs

• Poisoned Knowledge Base
• Memory Never Forgets

Inputs are deliberately crafted to push a model across its decision boundary or past its guardrails, measured with repeatable trials rather than anecdotes.

Taught by 3 labs

• Guardrail Regression
• Pixel Imperfect
• Red Team Campaign