Supply chain compromise, infrastructure warfare, and human workflow exploitation — technique entries with procedures and AATMF-R scores.
T13–T15: Supply chain compromise, infrastructure warfare, and human workflow exploitation. The systems and people around the model — where AI security meets traditional security.
Volume IV covers the attack surface that doesn't touch the model at all. The supply chain that delivered it. The infrastructure that serves it. The humans who evaluate, approve, and operate it. These three tactics are where AI security converges with the security disciplines organizations already have — or should have.
For the parent framework overview, see AATMF v3. For core tactics (T1–T8), see Volume II. For advanced tactics (T9–T12), see Volume III.
15 techniques, 150 procedures
Every component in the AI pipeline — model weights, adapter files, training data, evaluation sets, prompt templates, tool manifests — is a supply chain artifact. Each can be compromised before deployment. The model you deployed may not be the model you evaluated.
T13-AT-001: Model repository poisoning. Uploading backdoored models to Hugging Face, model zoos, or internal registries. The model passes standard evaluation benchmarks but contains triggered backdoor behavior. In 2023, researchers demonstrated uploading backdoored models that passed Hugging Face's quality checks.
T13-AT-002: Training dataset provenance compromise. Purchasing expired domains referenced in training dataset indexes (e.g., Common Crawl). The attacker replaces legitimate content with adversarial data, which gets scraped into future training runs. Cost: hundreds of dollars. Effect: persistent across every model trained on the affected data.
T13-AT-003: Adapter/LoRA poisoning. Backdoored LoRA adapter weights shared on GitHub or Hugging Face. The base model is clean; the adapter introduces the backdoor. Because adapters are small and easy to share, they're distributed with less scrutiny than full models.
T13-AT-006: Evaluation dataset manipulation. Poisoning the benchmarks used to evaluate model safety. If the safety evaluation uses a compromised benchmark, a backdoored model passes evaluation and gets deployed. The attacker doesn't need to evade safety checks — they need to compromise the checks themselves.
T13-AT-009: Prompt template poisoning. Adversarial instructions embedded in shared prompt templates, system prompt libraries, or LangChain/LlamaIndex template repositories. The template looks legitimate but contains instructions that activate under specific conditions.
T13-AT-012: Dependency confusion in ML pipelines. Exploiting Python package naming to substitute malicious packages in ML training pipelines — the same dependency confusion attack that affects traditional software, applied to ML-specific packages (transformers, datasets, tokenizers).
Exploitability: 3/5 (requires knowledge of pipeline, but many pipelines are poorly secured). Impact: 5/5 (supply chain compromise affects every downstream user). Cascading factor: Extreme. Rating: Critical.
15 techniques, 150 procedures
Attack AI infrastructure directly. The model serving layer, API gateways, compute resources, and billing systems are all targets. The AI Gateway Threat Model documented 8 attack vectors in this space that no prior framework covered.
T14-AT-001: Compute denial (Model DoS). Crafting inputs that maximize inference compute — long sequences, complex reasoning triggers, recursive generation patterns. Unlike traditional DoS (which requires volume), model DoS can be achieved with a small number of computationally expensive requests.
T14-AT-002: Denial of Wallet (DoW). Exploiting per-token pricing to generate unsustainable costs. Recursive prompting, prompt bombs, and automated high-token queries can exhaust an organization's AI budget in hours. A single unconstrained agent in a loop generates hundreds of thousands of tokens in minutes.
T14-AT-004: API key aggregation exploitation. AI gateways aggregate multiple provider API keys behind a single interface. Compromising the gateway exposes every key. LiteLLM CVE-2024-9606 revealed a key masking flaw that only obscured the first five characters — nearly entire keys leaked through logs.
T14-AT-006: Model downgrade attack. Manipulating gateway routing logic to redirect requests from a capable model to a weaker one with fewer safety controls. The user believes they're interacting with GPT-4; the gateway routes to an unaligned open-source model.
T14-AT-008: Logging and observability exploitation. AI gateways log prompts, responses, and API keys for observability. Compromising the logging pipeline gives access to every prompt and response that transited the gateway — a complete record of organizational AI usage.
T14-AT-011: Model serving infrastructure attacks. Targeting vLLM, TGI, Triton, or other inference servers directly. Configuration errors, exposed management endpoints, and unpatched CVEs in serving infrastructure.
Exploitability: 3/5 (infrastructure attacks require reconnaissance). Impact: 5/5 (gateway compromise = every API key, every prompt). Rating: Critical for organizations running AI gateways.
15 techniques, 108 procedures
The humans operating, evaluating, and governing AI systems are themselves attack targets. T15 covers attacks against the human layer — RLHF annotators, safety reviewers, red teamers, and compliance officers. This is where AATMF meets the Social Engineering Framework (SEF).
T15-AT-001: RLHF annotator manipulation. Influencing the humans who provide feedback data for RLHF training. If annotators can be influenced (through social engineering, bribery, or manipulation of annotation guidelines) to provide adversarial feedback, the model's safety training is compromised at the source.
T15-AT-003: Red team exhaustion. Overwhelming safety evaluation teams with volume, causing them to reduce evaluation depth. A model that should receive 1,000 hours of red teaming receives 100 because the team is covering 10 models simultaneously. The attacker doesn't bypass the red team — they exhaust it.
T15-AT-005: Compliance theater exploitation. Identifying organizations that perform AI safety evaluation as a checkbox exercise rather than a genuine security assessment. These organizations have documented safety processes but weak actual evaluation. Compliance theater creates a false sense of security that attackers can exploit.
T15-AT-007: Safety review timing attack. Submitting model changes or deployments at times when safety review capacity is lowest — end of quarter, holiday periods, high-priority incident response. The review happens but with reduced scrutiny.
T15-AT-009: Annotation guideline poisoning. Modifying the annotation guidelines that RLHF annotators follow, subtly shifting what constitutes "good" or "safe" model behavior. If the guidelines are compromised, every annotator produces adversarial training signal while believing they're following instructions correctly.
T15-AT-012: Social engineering of AI operators. Classic social engineering techniques (authority, urgency, reciprocity) applied to the humans who deploy, configure, and monitor AI systems. Convincing an operator to disable a safety feature, expose an API key, or approve a deployment without review.
T15 applies the Social Engineering Framework gap model to AI operations:
The five gaps map directly to T15 techniques. An organization with strong Authority but weak Process has a predictable vulnerability profile.
Exploitability: 4/5 (human factors are consistently exploitable). Detectability: 5/5 (social engineering leaves minimal technical traces). Rating: High. The human layer is often the weakest link because organizations invest in model-level defenses and neglect the humans operating the models.
Infrastructure and human tactics rarely operate alone. They enable and amplify the model-level attacks in Volumes II and III:
Supply chain → Jailbreak bypass (T13 → T1): A backdoored model from a compromised repository has weakened safety training, making T1 prompt injection trivially easy against it.
Infrastructure → Data exfiltration (T14 → T10): Gateway logging exploitation gives the attacker every prompt and response — a complete membership inference dataset without any model querying.
Human → Persistent backdoor (T15 → T6 → T4): Manipulated RLHF annotators produce feedback that shifts model safety boundaries (T6), creating persistent behavioral changes that function like backdoors (T4).
The principle: Secure the model all you want. If the supply chain is compromised, the infrastructure is exposed, or the operators are manipulated, model-level defenses are irrelevant.
T13 Detection (Supply Chain):
T14 Detection (Infrastructure):
T15 Detection (Human Workflow):
What does Volume IV cover? T13 through T15 — the systems and people around the model. Supply chain artifacts (model weights, training data, tools), serving infrastructure (gateways, API proxies, inference servers), and human operators (RLHF annotators, safety reviewers, AI ops teams). These tactics target everything except the model itself.
Why are human workflow attacks in a technical framework? Because humans are part of the system. An RLHF annotator who provides adversarial feedback compromises the model as effectively as a poisoned training dataset. A safety reviewer who rubber-stamps a deployment under time pressure creates the same vulnerability as a misconfigured gateway. The SEF framework provides the organizational gap analysis methodology that maps directly to T15 techniques.
How does T14 relate to the AI Gateway Threat Model? The AI Gateway Threat Model is the detailed research paper that documents 8 specific attack vectors in gateway infrastructure. T14 is the AATMF tactic that formalizes those vectors into techniques with AATMF IDs, procedures, detection patterns, and risk scores. The threat model is the research; T14 is the taxonomy entry.
What's the most underestimated tactic? T15 (Human Workflow Exploitation). Organizations invest heavily in model-level and infrastructure-level defenses while leaving the human operators — the people who approve deployments, provide training feedback, and configure safety systems — with the same security posture as any other employee. The human layer is consistently the weakest link because it's consistently the least invested in.
This page is the operational catalog — 15 tactics, 240+ techniques, and the procedure counts you see below. The actual adversarial prompts, the YARA / Sigma detection signatures, the runbook templates, and the assessment scoring sheets are versioned in the open-source repository so they can be diff-able, fork-able, and contributed to.