Part 1: Introduction and Methodology

The Critical Need for AI Threat Modeling

Artificial intelligence has transitioned from research curiosity to critical infrastructure. Language models process medical queries, legal documents, financial transactions, and government communications. Yet the security frameworks designed to protect these systems were built for a fundamentally different paradigm.

Traditional cybersecurity operates on deterministic logic: inputs produce predictable outputs, vulnerabilities have defined boundaries, and exploits follow reproducible steps. AI systems break every one of these assumptions. They are probabilistic, context-dependent, and — critically — trained on human language, making them susceptible to the same manipulation techniques that have been used against humans for millennia.

This is the core thesis of AATMF: AI systems are vulnerable to social engineering because they were trained to respond like humans. This is the first technology where human manipulation techniques directly translate to technical exploitation.

Genesis and Evolution

Scope

AATMF covers adversarial threats against:

• Large Language Models (LLMs) and Large Reasoning Models (LRMs)
• Multimodal models (vision, audio, video)
• Retrieval-Augmented Generation (RAG) systems
• Autonomous AI agents and multi-agent orchestrators
• AI development and deployment infrastructure
• Human-in-the-loop workflows
• AI supply chains (models, datasets, tools, libraries)

Threat Actor Taxonomy

Methodology

Each technique in AATMF is documented with:

1. Unique namespaced identifier — T{tactic}-AT-{sequence:03d}
2. Risk score — Computed via AATMF-R v3 six-factor formula
3. Attack procedures — Concrete implementation variants with example prompts
4. Detection patterns — Signatures and heuristics for identifying the technique
5. Mitigation controls — Defensive measures mapped to the technique
6. Cross-framework references — Mappings to MITRE ATLAS, OWASP, NIST, EU AI Act

← Volume I · Home · Part 2: Risk Assessment →

Part 2: Risk Assessment Methodology (AATMF-R v3)

Formula

Risk = (L × I × E) / 6 × (D / 6) × R × C

Factors

Scoring Guidelines

Likelihood (L)

Impact (I)

Exploitability (E)

Detectability (D)

Recoverability (R)

Cost Factor (C)

Risk Rating Scale

Example Calculation

T1-AT-001 — Instruction Override Injection

Risk = (5 × 4 × 5) / 6 × (3 / 6) × 2 × 1.5
     = 100/6 × 0.5 × 2 × 1.5
     = 16.67 × 0.5 × 2 × 1.5
     = 25.0

Note: Scores vary based on deployment context. A chatbot vs. an autonomous financial agent would score very differently on Impact and Cost Factor.

← Part 1 · Home · Part 3: Architecture →

Part 3: Framework Architecture

Hierarchical Structure

AATMF v3
├── 15 Tactics                    (high-level adversarial objectives)
│   ├── 240 Techniques            (specific attack methods)
│   │   ├── 2,152+ Attack Procedures  (implementation variants)
│   │   │   └── 4,980+ Prompts        (actual attack examples)
│   │   ├── Detection Patterns
│   │   └── Mitigation Controls
│   └── Risk Scoring (AATMF-R v3)
└── Cross-Framework Mappings
    ├── MITRE ATLAS v4.6.0
    ├── OWASP LLM Top 10 2025
    ├── NIST AI RMF / IR 8596
    └── EU AI Act

Namespaced Identifier System

v3 introduces namespaced identifiers to eliminate AT-ID collisions:

Why Namespacing?

In v3.0, AT-010 referred to "Dialogue Hijacking" in T1 and "Euphemism Exploitation" in T2 — completely different techniques sharing the same ID. Across all 15 tactics, 43 such collisions existed. The namespaced system guarantees every identifier is globally unique while preserving tactic membership at a glance.

Cross-Framework Mappings

MITRE ATLAS v4.6.0 (October 2025)

OWASP LLM Top 10 2025

Tactic Overview

← Part 2 · Home · Volume II: Core Tactics →