Simple explanation
Just like traditional security has ATT&CK and OWASP Top 10, AI security has its own emerging frameworks for cataloging risks and adversary techniques — this lesson covers the two most referenced.
Technical explanation
- MITRE ATLAS — a knowledge base, styled after MITRE ATT&CK, cataloging adversarial tactics and techniques specifically against AI/ML systems (data poisoning, model evasion, model extraction, and more, organized into a matrix similar in spirit to ATT&CK's structure). Useful for mapping a specific observed AI attack to a known, documented technique, and for identifying detection/coverage gaps in an AI security program.
- OWASP Top 10 for LLMs — an industry-standard reference list of the most critical security risks specific to LLM applications, covering categories like prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft — effectively a consolidated checklist of most of what this whole domain covers, organized the way application security teams already think about risk prioritization.
- Why both frameworks matter together: ATLAS is adversary-technique-focused (how would an attacker actually do this), similar to ATT&CK's role in traditional security; OWASP's list is risk-category-focused (what should a team building an LLM application specifically design against), similar to the traditional OWASP Top 10's role in web application security. Using both gives both an attacker's-eye view and a defender's-checklist view of the same underlying risk landscape.
Synonyms / related terms
| Term | Means | |---|---| | ATLAS | Adversarial Threat Landscape for Artificial-Intelligence Systems | | OWASP Top 10 for LLMs | Industry-standard LLM-specific risk checklist |
Concept Check
"A team building a new LLM-powered customer service application wants a structured checklist of security risks to design against from the start, before writing any threat-actor-specific analysis." The OWASP Top 10 for LLMs is the more directly useful reference for this specific need — it's structured as a risk/design checklist; MITRE ATLAS is more oriented toward cataloging and analyzing adversary techniques after the fact or during threat modeling, a related but distinct use case.
Interview-style Q&A
Q: Why did frameworks like ATLAS and the OWASP LLM Top 10 need to be created separately, rather than just extending the existing ATT&CK and OWASP Top 10? A: "AI systems introduce genuinely novel attack surfaces that don't map cleanly onto traditional categories — there's no clean traditional-security equivalent to 'training data poisoning' or 'prompt injection.' Extending existing frameworks awkwardly would have diluted their focus; purpose-built frameworks let each properly capture the specific mechanics of AI-targeted attacks and risks, the same way OWASP's original Top 10 was purpose-built for web applications rather than being bolted onto a general software security checklist."
Memory trick
"ATLAS maps the Attacker, OWASP maps the Design" — the practical distinction between when to reach for each framework.