Adversarial ML · D3FEND

The blind quadrant over AI systems.

I went looking for this by accident. I was rebuilding Peter Kaloroumakis's coverage dashboard for D3FEND, the one that ships as issue #599 in the ontology repo, walking every offensive framework D3FEND knows about and reporting how much of each one it can place opposite a defense, and I ran it in MITRE's own container against D3FEND 1.4.0 so the numbers would be theirs and not mine. Most of the rows came back the way you'd expect from a framework that has been maturing for years: ATT&CK Enterprise integrated at 40.8 percent, ICS higher at 55.9, OCSF at 26.7, the compliance catalogs trailing down in the single digits because they were never really artifact-shaped to begin with. Then I hit the ATLAS row, and it read 140 techniques included, 0 integrated, 0.0 percent, and I sat with that for a minute because it is a strange thing to see a whole framework scored at exactly zero.

I want to be careful here, because ATLAS is not the only zero in that report. ATT&CK Mobile sits at 0.0 percent too, over 166 techniques, and CAPEC has a single included item and no integration, so if you told me "some frameworks just haven't been mapped yet" you would be right and I would have nothing interesting to say. But ATLAS is the zero over adversarial machine learning, over prompt injection and model poisoning and agent tool abuse, and that is the quadrant where the attack surface is moving right now, so a zero there is not a backlog item the way Mobile arguably is, it is a blind spot pointed directly at the systems the industry is rushing to deploy. That is the row I decided to try to close, and most of what I learned came from taking seriously why it was zero rather than assuming it was neglect.

Written July 16, 2026, against D3FEND 1.4.0; the pull-request status and version facts here are the moving parts. Reading time: about 13 minutes. Evidence tier: A for the primary standards and the coverage measurement (the D3FEND 1.4.0 dashboard, the SPDX and CycloneDX / ECMA-424 schemas, Li & Gao at DSN 2026, arXiv 2510.16558), B for the GitHub issue and pull-request threads and the practitioner reporting, and the mappings themselves are labeled throughout as proposals for MITRE's judgment rather than merged results.

When I brought this to the D3FEND maintainers on issue #606, Adrian Medina, who reviews ontology changes in BFO terms, set the sequencing plainly: exhaust the existing vocabulary of artifacts first, and only reach for a new class once you have genuinely run out. I took that as the constraint to work under, partly because it is good ontology hygiene and partly because, taken seriously, it turns a matter of opinion into a matter of measurement. Either the existing vocabulary covers the vast majority of ATLAS or it does not, and that is answerable with a number.

The reason the first pass over-reached, and the reason I think a lot of AI-security taxonomy work over-reaches, is that the AI vocabulary collides with words D3FEND already uses, and if you match on the word instead of the category you invent classes you did not need. The model, the dataset, and the prompt are continuant artifacts, and they subclass the parents the mappers already reached for, which are ordinary :Software,:File, :DigitalMessage, :Database and the like. Theprocess (training, fine-tuning, inference) is an occurrent, an event, and it does not want a new artifact noun at all; it wants to attach to an event class through the relations D3FEND already has, which is exactly the d3f:MachineLearningEvent direction Medina himself proposed.

The three collisions are :MachineLearning, :Model, and :Agent, and each one is the same lexeme sitting in a different top-level BFO category, so the fix is a placement rule rather than a naming fight. The two words that look most like they should hold the AI model are the two that must not: :MachineLearning in D3FEND is an analytic technique under :Plan (a directive meaning "use machine learning to detect"), and:Model is a :DefensiveTactic under :Goal (meaning "model the system"), so an AI model artifact cannot be either without punning a continuant onto a plan and a goal, which is a category error a reasoner will happily propagate. The :Agent collision resolves the same way once you look at how D3FEND already uses it: the bare :Agent at the top is the agentive, intentional sense that lives near people and organizations, while the software agents the ontology ships (:NetworkAgent, :AssetInventoryAgent) subclass:Software, so an AI agent belongs under :Software as a tool, not under the agentive branch.

The property I most wanted to be able to state to an ontologist, and the one that makes the whole contribution cheap to accept, is conservativity: the proposal asserts nothing into:MachineLearning, :Model, or :Agent. New classes only ever subclass existing parents, and the mappings only ever add restrictions on the :AML.T####technique classes, so no new entailments appear anywhere in D3FEND's existing branches, and nothing already in the ontology changes meaning because I showed up. That matters more than it might sound, because D3FEND ships only three disjointWith pairs, which means a reasoner will not automatically stop a careless future mapping from quietly punning a model artifact onto the machine-learning analytic plan; the discipline that keeps the three senses apart has to be deliberate, held by the person doing the mapping, rather than enforced by the logic.

Worked through that way, the ATLAS row comes apart cleanly. Of the 140 techniques, 117 map to an artifact D3FEND already has, 55 that mapped on the first pass plus 62 of the 76 that had reached for a new class and turned out not to need one once the event model and the existing parents were on the table. Nine are genuine process-attacks whose real target is a training or inference event, and they attach to d3f:MachineLearningEvent through existing participant artifacts, so they fold into Medina's event proposal and strengthen it. Nine more have no artifact-shaped target at all. They spread across execution, exfiltration, discovery, defense evasion, and the impact family, and what they share is that each one describes an adversary action or an outcome without a digital artifact for the defense to share, which is the boundary of what an artifact-join ontology can integrate. That leaves five techniques as the entire new-artifact ask: three that need a machine-learning-model class because :Softwareis defined as authored instructions and a trained model's behavior comes from learned parameters instead, one that needs a retrieval data source wired into an LLM's context, and one that needs a callable tool definition bound to an agent, which means the ask that started as "ATLAS needs its own taxonomy" had shrunk, by the end of the pass, to about one new noun.

I did not want that to be an argument, so I made it a test. The generated restrictions are 788 triples across 197 rows, and the acceptance check appends them to the exact ontology file MITRE's dashboard consumes and re-runs their dashboard_report.py in their container, so the number the essay quotes is the number their instrument produces.

The result is that ATLAS moves from 0 integrated to 117, from 0.0 percent to 83.6, with 197 new relationships, and every other framework's counts come back byte-identical before and after. That byte-identical clause is the part I care about most, because it is what makes this a set of restrictions the existing reasoner accepts, rather than a mapping I merely asserted.

Bottom line: Medina's instinct that existing vocabulary covers most of ATLAS was right, and measurably so, and the discipline that got there was almost entirely about refusing to let a shared word stand in for a shared category.

The reason a zero over AI systems is not something to leave for later is that the artifacts have shipped well ahead of the schemas meant to describe them. Xiaofan Li and Xing Gao at the University of Delaware measured 67,057 MCP servers across six registries and found the vetting gaps are systemic: 212 re-registrable accounts, 304 hijackable via redirects, 408 affix-squatting groups, and 833 leaking secrets, which is the closest thing to a hard number this space has (DSN 2026, arXiv 2510.16558). Unit 42's Itay Saraf and Ofir Balassiano documented model namespace reuse on Hugging Face in September 2025, where a deleted author's namespace becomes re-registrable so that name-based trust serves an attacker's replacement, and NVIDIA's Rich Harang, Joseph Lucas, and Erick Galinkin argued the same month that CVEs structurally belong to frameworks rather than to model weights, which means the inventory step your program relies on has no schema for the artifact your agent is loading. That is the same gap from the operations side that the dashboard showed from the ontology side: the model your agent is loading has no name in the schema, so nothing you have can be pointed at it.