MR-012 Security & adversarial System scope

Adversarial examples and evasion attacks

Crafted input perturbations cause the model to misclassify or behave incorrectly (evasion/adversarial-example attacks).

Risk family: Security & adversarial
MIT domain: 2. Privacy & Security
MIT subdomain: 2.2 > AI system security vulnerabilities and attacks
AI type: Classical_ML, GPAI
Scope: System
Source standard: MIT AI Risk Repository v4

Provenance

Source standard

MIT AI Risk Repository v4

MIT source entries

11 entries across 9 papers

Cui2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems02.10.06
Everitt2018AGI Safety Literature Review51.04.00
Gipiškis2024Risk Sources and Risk Management Measures in Support of Standards for General-Purpose AI Systems62.14.05 62.18.03 62.19.03
IBM2025AI Risk Atlas65.09.03
Liu2024Trustworthy LLMs: A Survey and Guideline for Evaluating Large Language Models’ Alignment30.07.01
Marchal2024Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data64.04.02
TC2602024AI Safety Governance Framework45.01.06
Uuk2025A Taxonomy of Systemic Risks from General-Purpose AI61.02.33
Zhang2022Towards risk-aware artificial intelligence and machine learning systems: An overview21.01.04

Ev IDs of the entries consolidated into this risk in the MIT AI Risk Repository (V4); the source sheet row appears on hover.

ISO/IEC references

23894 obj A.11, A.9; src 6, 7; mech B.5 | 42001 ctrl A.6.2.4

Framework crosswalk

Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.

Sourcesframeworks that contributed to the register

A.11 ISO/IEC 23894 Annex A A.11
A.9 ISO/IEC 23894 Annex A A.9

A.6.2.4 ISO/IEC 42001 Annex A A.6.2.4

Expanded into this risk’s technique sub-risks.

Cross-checksframeworks mapped in to test coverage

ibm-evasion-attack Evasion attack

AISubtech-11.1.1 Agent-Specific Evasion
AISubtech-11.1.2 Tool-Scoped Evasion
AISubtech-11.1.3 Environment-Scoped Payloads
AISubtech-11.1.4 Defense-Aware Payloads
AISubtech-11.2.1 Targeted Model Fingerprinting
AISubtech-11.2.2 Conditional Attack Execution
AISubtech-17.1.1 Sensor Spoofing: Action Signals (audio, visual) partial

NISTAML.02 Integrity Violations
NISTAML.022 Evasion
NISTAML.025 Black-box Evasion

Sub-risks (4)

Technique-level decompositions of this risk, each anchored to the MITRE ATLAS technique it derives from.

MR-012.1

Model evasion via adversarial input

Inputs are crafted so the model misclassifies or fails to detect what it should, defeating its purpose.

MITRE ATLAS technique: AML.T0015 Evade AI Model

MR-012.2

Integrity erosion via adversarial inputs

A stream of adversarial inputs degrades the model's accuracy and trustworthiness over time.

MITRE ATLAS technique: AML.T0031 Erode AI Model Integrity

MR-012.3

Physical-world adversarial manipulation

Physical artifacts (markings, objects, signals) are altered to fool perception models in the real world.

MITRE ATLAS technique: AML.T0041 Physical Environment Access

MR-012.4

Crafted adversarial data

Perturbed inputs are engineered to induce incorrect or attacker-chosen model outputs.

MITRE ATLAS technique: AML.T0043 Craft Adversarial Data

More in Security & adversarial

MR-010 MR-014 MR-015 MR-016 MR-020 MR-071

See all Security & adversarial risks →

Part of the Deployer AI Risk Register, an open-source resource powered by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.