Multimodal injection, integrity breaches, agentic exploitation, and RAG poisoning — technique entries with procedures and AATMF-R scores.
T9–T12: Multimodal injection, integrity breaches, agentic exploitation, and RAG poisoning. Full technique entries with procedures, real-world incidents, detection patterns, and AATMF-R scoring.
Volume III covers the attack surface that emerged as models gained new input modalities, tool access, memory, and retrieval capabilities. These tactics didn't exist when AI security meant "don't let the chatbot say bad things." They exist because the model now has hands, eyes, memory, and a library card.
For the parent framework overview, see AATMF v3. For the core model-level tactics (T1–T8), see Volume II. For infrastructure and human-layer tactics (T13–T15), see Volume IV.
17 techniques, 147 procedures
The attack surface expands every time a model gains a new input modality. T9 covers attacks that exploit the boundaries between modalities — text, image, audio, video — where safety training in one modality doesn't generalize to another.
T9-AT-001: Image-embedded prompt injection. Adversarial text rendered into an image file. The model processes the image through its vision encoder, extracts the text, and follows the instructions. Input text filters never see the payload because it arrives as pixels. GPT-4V, Claude, and Gemini have all demonstrated susceptibility.
T9-AT-004: Cross-modal encoding bypass. Instructions encoded in a format that one modality understands but another's safety filters don't check. Example: Base64-encoded instructions embedded in alt-text of an image, extracted by the model's text processing pipeline after the image safety filter has already passed the image.
T9-AT-008: Audio adversarial examples. Subtle modifications to audio input that cause speech-to-text models to transcribe attacker-chosen text instead of the actual audio content. The transcribed text is then processed as a legitimate prompt.
T9-AT-012: OCR exploitation. Malicious instructions placed in images as text that OCR models extract and pass to the language model. The instruction follows the same trust pathway as user input but bypasses input-level text filters.
Exploitability: 4/5 (low barrier — image editing tools are sufficient). Detectability: 4/5 (cross-modal payloads evade modality-specific filters). Rating: High.
15 techniques, 147 procedures
What the model learned, an attacker can sometimes extract. T10 covers attacks that recover training data, membership information, or model internals through carefully constructed queries.
T10-AT-001: Training data extraction. Repeated queries designed to trigger memorized training examples. Models trained on sensitive data can reproduce that data verbatim under the right query conditions. Carlini et al. demonstrated extractable memorization in GPT-2, and the problem scales with model size.
T10-AT-003: Membership inference. Determining whether a specific data point was in the training set by analyzing model confidence patterns. The model behaves differently on data it memorized versus data it generalizes to. This is a privacy violation in any domain with protected data.
T10-AT-005: Model inversion. Reconstructing input features from model outputs. In systems trained on personal data, this can recover individual records — faces from facial recognition models, medical histories from diagnostic models.
T10-AT-009: System prompt extraction. Techniques that cause the model to reveal its system instructions, exposing business logic, safety constraints, and architectural information. See prompt injection research for technique details.
Impact varies by data sensitivity. For models trained on PII or proprietary data: Critical. For public-facing chatbots: Medium. Exploitability: 3/5 (requires sustained querying, detectable with rate limiting).
16 techniques, 160 procedures
The fastest-growing attack surface. T11 covers attacks against AI systems that can take actions — execute code, call APIs, read/write files, send messages. When these systems are compromised, the attacker inherits every capability the agent has.
T11-AT-001: MCP tool poisoning. Modifying a tool's description in the MCP manifest to inject adversarial instructions. The model reads the description as trusted context and follows the embedded instructions. 84% ASR on production agents. See MCP vs A2A analysis for the full architectural breakdown.
T11-AT-003: Tool shadowing. Publishing a tool with a name and description similar to a legitimate tool, causing the agent to prefer the malicious version. Exploits the model's tendency to select tools by description relevance.
T11-AT-005: Skill injection (SKILBin). Placing a malicious skill file in the agent's skill directory. The skill executes on session start because the instruction hierarchy treats skill content as trusted. No jailbreak required — the model follows the skill's instructions as its operational mandate. See SKILBin.
T11-AT-008: Orchestrator confusion. In multi-agent systems, manipulating the orchestrator's task delegation to route sensitive operations to a compromised agent. The orchestrator trusts all agents equally — there is no per-agent trust scoring.
T11-AT-011: Autonomous goal hijacking. Redirecting an agent's objective through context manipulation while it's executing a multi-step plan. The agent replans around the new (adversarial) objective without user awareness.
T11-AT-014: Capability escalation. An agent with limited tool access discovers it can invoke tools it shouldn't have access to — through indirect tool calls, shared tool registries, or by requesting the orchestrator to grant additional capabilities.
Exploitability: 4/5 (tool descriptions are text fields anyone can modify). Impact: 5/5 (agent capabilities = attacker capabilities post-compromise). Rating: Critical.
15 techniques, 149 procedures
Poison the library, control the librarian. T12 covers attacks against retrieval-augmented generation systems where the retrieval corpus becomes an injection vector.
T12-AT-001: Document injection. Placing adversarial documents in the retrieval corpus. The documents contain instructions that execute when retrieved and processed by the model. PoisonedRAG demonstrated 90% ASR with 5 injected documents.
T12-AT-002: Embedding collision. Crafting documents whose embedding vectors are close to target query embeddings, ensuring retrieval for specific queries. The adversarial document outranks legitimate sources because retrieval optimizes for relevance, not trustworthiness.
T12-AT-004: Knowledge base backdoors. Persistent adversarial content planted in the knowledge base that activates on specific query patterns. Unlike document injection (which adds new documents), knowledge base backdoors modify existing documents to include adversarial instructions alongside legitimate content.
T12-AT-007: Retrieval ranking manipulation (HijackRAG). Adversarial perturbations to the retrieval process itself — manipulating the retriever to consistently return attacker-chosen content for target queries, without modifying the corpus.
T12-AT-010: Cross-corpus contamination. In systems with multiple retrieval sources, poisoning one source to influence retrievals from others through embedding space proximity effects.
RAG poisoning is most dangerous when chained with agentic and memory tactics:
This chain demonstrates why defense must cover the full pipeline: corpus integrity, retrieval validation, tool authorization, and memory integrity.
Exploitability: 4/5 (write access to shared drives/wikis is common). Detectability: 4/5 (adversarial documents pass quality checks). Rating: Critical in enterprise RAG deployments.
The power of T9–T12 is in composition. Individual techniques are dangerous. Chains are devastating.
Image injection → Agent tool abuse (T9 → T11): An adversarial instruction embedded in an image uploaded to a RAG corpus gets OCR-extracted, retrieved, and processed by an agent that follows the extracted instructions and executes tool calls.
RAG poisoning → Memory persistence → Credential theft (T12 → T4 → T11): The temporal escalation pattern — poison the corpus today, memory stores the instruction, agent acts on it next week.
Multimodal bypass → System prompt extraction → Model extraction (T9 → T10): Image-embedded queries extract system prompt information, which is used to optimize training data extraction queries.
Full chain examples with step-by-step walkthroughs: RAG, Agentic AI, and the New Attack Surface.
Detection patterns for T9–T12 are available as YARA and Sigma rules in the AATMF GitHub repository.
T9 Detection (Multimodal):
t09-multimodal-injection.yar: Detects Base64-encoded text patterns in image metadata, alt-text injection patterns, and cross-modal encoding sequencesT10 Detection (Integrity):
t07-data-exfiltration.yml: Detects gradual extraction patterns — sustained querying on narrow topics with incrementally varying inputsT11 Detection (Agentic):
t11-agent-anomaly.yml: Detects anomalous tool call patterns — unusual tool sequences, tool calls to endpoints not in the agent's normal operating profilet11-mcp-tool-poisoning.yar: Detects hidden Unicode characters, zero-width spaces, and invisible instruction patterns in MCP tool descriptionsT12 Detection (RAG):
What does Volume III cover? T9 through T12 — the attack surface that emerged when models gained new input modalities (multimodal), tool access (agentic), retrieval (RAG), and when attackers began targeting model internals (integrity/confidentiality). These tactics didn't exist when AI security meant filtering chatbot outputs.
How does this differ from the parent AATMF page? The parent page provides one-liner descriptions and technique counts per tactic. Volume III provides full technique entries with descriptions, procedures, real-world incidents, detection patterns, and AATMF-R risk scores. This is the operational reference for red teams and blue teams working with these specific attack classes.
Which tactic is most critical in 2026? T11 (Agentic & Orchestrator Exploitation) is the fastest-growing attack surface. MCP tool poisoning alone accounts for 30+ CVEs and 84% attack success rate on production agents. As more organizations deploy AI agents with tool access, T11 becomes the primary concern.
How do these tactics chain together? The most dangerous attacks combine tactics: T12 (RAG poisoning) feeds adversarial instructions to T11 (agent tool abuse), which stores persistence through T4 (memory manipulation). Single-tactic defenses miss these chains. See the Cross-Tactic Attack Chains section above.
This page is the operational catalog — 15 tactics, 240+ techniques, and the procedure counts you see below. The actual adversarial prompts, the YARA / Sigma detection signatures, the runbook templates, and the assessment scoring sheets are versioned in the open-source repository so they can be diff-able, fork-able, and contributed to.