Models
Sub-technique of AML.T0002 Acquire Public AI Artifacts
Description
Adversaries may acquire public models to use in their operations.
Adversaries may seek models used by the victim organization or models that are representative of those used by the victim organization.
Representative models may include model architectures, or pre-trained models which define the architecture as well as model parameters from training on a dataset.
The adversary may search public sources for common model architecture configuration file formats such as YAML or Python configuration files, and common model storage file formats such as ONNX (.onnx), HDF5 (.h5), Pickle (.pkl), PyTorch (.pth), or TensorFlow (.pb, .tflite).
Acquired models are useful in advancing the adversary's operations and are frequently used to tailor attacks to the victim model.
- ATLAS ID
- AML.T0002.001
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Predictive AIGenerative AIAgentic AI
Mitigations
- AML.M0001Limit Model Artifact Release
Limiting the release of model architectures and checkpoints can reduce an adversary's ability to target those models.
- AML.M0014Verify AI Artifacts
Introduce proper checking of signatures to ensure that unsafe AI models will not be introduced to the system.