I.foundations.

Part 1: Introduction and Methodology

The Critical Need for AI Threat Modeling

Artificial intelligence has transitioned from research curiosity to critical infrastructure. Language models process medical queries, legal documents, financial transactions, and government communications. Yet the security frameworks designed to protect these systems were built for a fundamentally different paradigm.

Traditional cybersecurity operates on deterministic logic: inputs produce predictable outputs, vulnerabilities have defined boundaries, and exploits follow reproducible steps. AI systems break every one of these assumptions. They are probabilistic, context-dependent, and — critically — trained on human language, making them susceptible to the same manipulation techniques that have been used against humans for millennia.

This is the core thesis of AATMF: AI systems are vulnerable to social engineering because they were trained to respond like humans. This is the first technology where human manipulation techniques directly translate to technical exploitation.

Genesis and Evolution

Scope

AATMF covers adversarial threats against:

• Large Language Models (LLMs) and Large Reasoning Models (LRMs)
• Multimodal models (vision, audio, video)
• Retrieval-Augmented Generation (RAG) systems
• Autonomous AI agents and multi-agent orchestrators
• AI development and deployment infrastructure
• Human-in-the-loop workflows
• AI supply chains (models, datasets, tools, libraries)

Threat Actor Taxonomy

Methodology

Each technique in AATMF is documented with:

1. Unique namespaced identifier — T{tactic}-AT-{sequence:03d}
2. Risk score — Computed via AATMF-R v3 six-factor formula
3. Attack procedures — Concrete implementation variants with example prompts
4. Detection patterns — Signatures and heuristics for identifying the technique
5. Mitigation controls — Defensive measures mapped to the technique
6. Cross-framework references — Mappings to MITRE ATLAS, OWASP, NIST, EU AI Act

Risk = (L × I × E) / 6 × (D / 6) × R × C

Risk = (5 × 4 × 5) / 6 × (3 / 6) × 2 × 1.5
     = 100/6 × 0.5 × 2 × 1.5
     = 16.67 × 0.5 × 2 × 1.5
     = 25.0

AATMF v3
├── 15 Tactics                    (high-level adversarial objectives)
│   ├── 240 Techniques            (specific attack methods)
│   │   ├── 2,152+ Attack Procedures  (implementation variants)
│   │   │   └── 4,980+ Prompts        (actual attack examples)
│   │   ├── Detection Patterns
│   │   └── Mitigation Controls
│   └── Risk Scoring (AATMF-R v3)
└── Cross-Framework Mappings
    ├── MITRE ATLAS v4.6.0
    ├── OWASP LLM Top 10 2025
    ├── NIST AI RMF / IR 8596
    └── EU AI Act

← Part 2 · Home · Volume II: Core Tactics →