Understanding the security threats facing AI systems, including but not limited to language models, is essential for developing robust defenses. Modern AI systems introduce attack vectors that differ from traditional software security because their behavior is shaped by data, statistical learning, and opaque internal representations. These characteristics make them powerful but also create unique avenues for adversarial manipulation.

• Traditional software-defined systems (e.g., rule-based engines, expert systems, knowledge graphs) follow deterministic logic and produce predictable outputs given fixed rules.
• In contrast, ML systems (including text, vision, audio, multimodal, RL, and scientific or biological models) learn patterns from data. This makes their outputs probabilistic, their decision processes difficult to inspect, and their reliability dependent on data integrity. If training data are flawed, biased, or tampered with, the resulting models can behave unpredictably or even dangerously.

These properties introduce vulnerabilities that threat actors can exploit across all modalities. Input-manipulation attacks may appear as adversarial prompts in language models, adversarial patches in vision systems, or corrupted sensor signals in robotic control. Similarly, data poisoning, model tampering, and model or data extraction attacks have well-documented analogs in vision, audio, control system, and scientific/biomedical ML models. The attack mechanisms differ, but the threat patterns are universal.

This section outlines six common AI attack vectors and the consequences of successful attacks. While not an exhaustive survey of the adversarial ML domain, these categories provide a practical baseline for understanding how attackers target AI systems and the broader infrastructure that supports them. They apply broadly across architectures, modalities, and operational environments.

Reference Frameworks for AI Threat Modeling

This guide draws on established adversarial ML and cybersecurity frameworks most relevant to AI security, including

• MITRE ATLAS^⁠1
  MITRE, “MITRE ATLAS.”
• Open Web Application Security Project (OWASP) Machine Learning Security Top 10^⁠2
  OWASP, “Machine Learning Security Top 10.”
• Cloud Security Alliance MAESTRO^⁠3
  Cloud Security Alliance, “MAESTRO Framework.”
• NIST AI Risk Management Framework.^⁠4
  NIST, “AI Risk Management Framework.”

These frameworks support systematic threat modeling and help practitioners align AI-specific risks with confidentiality, integrity, and availability objectives in existing enterprise security programs.

Applying Taxonomies to a Variety of AI Modalities

This guide applies the Berryville Institute of Machine Learning’s (BIML’s) taxonomy as a foundation for organizing adversarial threats.^⁠5

Although BIML’s framework was originally formulated with general ML systems in mind, its attack patterns—input manipulation, data poisoning, model tampering, inversion, data extraction, and model extraction—map cleanly across AI modalities.

Whether the model processes language, images, genomes, chemical structures, audio, or sensor data, the same underlying vulnerabilities apply:

• Untrusted inputs can steer models off course.
• Poisoned data can distort learning.
• Models can be tampered with during development or deployment.
• Sensitive data or intellectual property can be extracted through unintended memorization or uncontrolled interfaces.

By grounding the taxonomy in these cross-modal patterns, organizations can map AI-specific threats to their operational context and integrate defenses into existing risk, compliance, and governance frameworks.

Difficulty Scoring Criteria:

For each category, we describe potential adversarial threats to AI systems and potential consequences of a successful attack. We score both the difficulty of executing the attack and the consequence if the attack succeeds. Scores follow a scale of low, moderate, and high, with some threats falling between two scores (e.g., moderate-high). Using ranges allows us to more accurately capture the variation in complexity and impact across different types of attacks.

Consequence Scoring Criteria:

These criteria are informed by established risk management frameworks, allowing for consistent evaluation of threats across diverse operational contexts and making it easier to integrate AI-specific risks into existing security and compliance programs.