What is MITRE ATLAS?
MITRE ATLAS, the Adversarial Threat Landscape for Artificial-Intelligence Systems, is a free knowledge base that catalogs how adversaries attack machine learning and AI systems. It is maintained by MITRE, the not-for-profit organization that also runs ATT&CK and the CVE program, and it follows the ATT&CK pattern: tactics describe what the attacker is trying to achieve at each stage, techniques describe how they achieve it, and case studies document real attacks and red-team exercises. ATLAS grew out of the Adversarial ML Threat Matrix, which MITRE, Microsoft and other organizations published in 2020.
How ATLAS is organized
ATLAS reuses many ATT&CK tactics, such as reconnaissance, initial access, persistence, exfiltration and impact, and adds tactics with no ATT&CK equivalent: gaining access to the model itself, and staging an attack against it, for example by building a proxy copy to test adversarial inputs on. Technique IDs begin with AML.T; LLM prompt injection, for instance, is AML.T0051. Typical techniques include:
- poisoning training data and publishing backdoored models
- crafting adversarial inputs that evade a classifier
- direct and indirect prompt injection, and LLM jailbreaks
- stealing a model through its inference API
- inferring training data membership, or inverting a model to recover data
Each technique lists mitigations and links to case studies, so the matrix supports planning as well as reference.
How security teams use ATLAS
- Threat modeling: walk an AI system, such as a customer chatbot with retrieval and tools, through the matrix and record which techniques apply.
- Red teaming: plan AI red-team exercises technique by technique, and report findings with ATLAS IDs so results can be compared over time.
- Gap analysis: map existing logging and controls to techniques, showing where an attack such as model extraction would go unnoticed.
- Communication: describe an incident in a vocabulary shared with vendors, auditors and other teams.
Example: mapping a chatbot incident
A support chatbot answers from a document library and can email customers. An attacker uploads a document containing hidden instructions, and the bot later sends one customer's order history to an outside address. The team records the incident in ATLAS terms: initial access through the upload, the indirect prompt injection technique, and exfiltration through the bot's email tool. Laid out that way, the incident shows two failed controls, the missing review of uploaded documents and the bot's unrestricted email permission, and points to the mitigations listed for each technique.
MITRE ATLAS vs. MITRE ATT&CK and the OWASP LLM Top 10
ATT&CK catalogs adversary behavior against enterprise, mobile and industrial control systems. ATLAS covers attacks specific to AI and machine learning, and a real AI incident usually needs both, because attackers reach AI systems through ordinary techniques such as phishing or stolen credentials. The OWASP Top 10 for LLM Applications is a different kind of document: a ranked list of risk categories for developers, such as prompt injection and excessive agency, rather than a matrix of adversary behavior.
MITRE ATLAS on the CompTIA Security+ exam
ATLAS is not one of the frameworks SY0-801 names as reference sources under objective 5.5; those are MITRE ATT&CK, the Cyber Kill Chain and the Diamond Model. It is worth knowing as the AI counterpart of ATT&CK while studying the AI threats in objective 2.6. If a question asks for a matrix of attacker tactics and techniques aimed at AI or machine learning systems, ATLAS fits; if it describes techniques against ordinary enterprise systems, choose ATT&CK. The Cyber Kill Chain describes intrusion phases and the Diamond Model the elements of an intrusion event, so neither is an AI-specific catalog.