A disruption of the ability of other users or processes to obtain timely and reliable access to an AI system's outputs or functionality (availability breakdown).

An AI system being forced to misperform against its intended objectives, producing outputs or predictions that align with the attacker's objective.

The unauthorized access of restricted or proprietary information that is part of an AI system, including information about a model's training data, weights or architecture, or sensitive information that the model accesses (e.g. a RAG knowledge base).

Misuse enablement: a circumvention of technical restrictions imposed by the AI system's owner on its use, such as restrictions designed to prevent a GenAI system from producing outputs that could cause harm to others.

Attacks that compromise components introduced through the AI supply chain, such as poisoned third-party data or a poisoned model published to a repository.

A poisoning attack which operates through model control (the attacker can modify the trained model parameters), here aimed at degrading availability.

A poisoning attack in which the adversary controls training samples but cannot change their labels (the label-limit capability).

A poisoning attack in which an adversary controls part of the training data.

An attack that exploits the performance dependency on hardware and model optimizations to negate the effects of hardware optimizations, increase computational latency, increase hardware temperature, and massively increase the amount of energy consumed (e.g. sponge examples).

A type of prompt injection executed through resource control (adversary-controlled external data the model ingests) rather than through user-provided input as in a direct prompt injection.

An attack which exploits the concatenation of untrusted input with a prompt constructed by a higher-trust party such as the application designer.

A backdoor poisoning attack mounted without control over training-data labels (a clean-label variant of backdoor poisoning).

Modifying test samples to create adversarial examples that the model misclassifies at inference time, without altering the model.

A poisoning attack that causes a model to perform an adversary-selected behaviour in response to inputs that follow a particular backdoor pattern.

A poisoning attack that changes the prediction on a small number of targeted samples.

An evasion attack mounted with only query access and no knowledge of the model's parameters or architecture (black-box setting).

A poisoning attack which operates through model control, here aimed at violating integrity (causing targeted misclassification or adversary-selected behaviour).

Integrity attacks (often via indirect prompt injection) that cause a GenAI system to become untrustworthy and generate content that deviates from benign behaviour to align with the attacker's objectives (e.g. incorrect summaries, attacker-specified content, suppressed sources, hijacked agents).

A type of privacy attack that extracts details of the model architecture and/or parameters.

Privacy attacks that reconstruct sensitive data in a model's training data from aggregate information (data reconstruction).

A data privacy attack to determine whether a data sample was part of the training set of a machine learning model.

A data privacy attack that infers a global property about the training data of a machine learning model.

An attack that tries to divulge the system prompt or other information in the context of a large language model that would normally be hidden from a user.

An indirect prompt injection that instructs a model to persuade the end user to reveal information, then exfiltrates it (e.g. by querying an attacker-controlled URL or via markdown image rendering).

Training-data extraction: the ability of an attacker to extract the training data of a generative model by prompting the model with specific inputs.

Extraction of memorized training data or other sensitive context from a generative model through crafted queries (information-extraction attacks).

Prompt injection attacks that cause a GenAI system to leak or exfiltrate private information from the restricted resources it can access (e.g. an email client forwarding messages to an attacker inbox; querying an attacker-controlled URL with user data).

Publishing a poisoned model (or poisoned data) into the AI supply chain so that downstream users inherit adversary-controlled behaviour.