This is the part of the ATLAS review that needs your judgement rather than a lookup, plus an offer of the tooling that produced it. The mechanical half is in #59; nothing here overlaps with it.
Mappings where the fix could go either way
AML.T0035 "Exfiltrate via ML Inference API", on 14 rows. AML.T0035 is "AI Artifact Collection", and no release I read carries the recorded label at all. The nearest live technique to it is AML.T0024 "Exfiltration via AI Inference API". So both halves of the pair are questionable and there are two defensible fixes. Moving the identifier to AML.T0024 keeps the label. Keeping AML.T0035 and correcting the label to "AI Artifact Collection" also works, and on DSGAI14 specifically it works better than the alternative: that entry is about telemetry and monitoring leakage, and AML.T0035's definition explicitly covers "other telemetry data produced when interacting with a model". I lean toward keeping the identifier and fixing the label, but the rows are not all alike and you know the intent behind them.
AML.T0012 "Obtain Capabilities", on two rows that want opposite fixes. AML.T0012 is "Valid Accounts" and "Obtain Capabilities" is AML.T0016, so again either half could be the error. DSGAI02 describes acquiring agent credentials through memory inspection, log analysis and tool payload capture, which reads as AML.T0012 with a stale label. DSGAI03 describes shadow AI tools the adversary may already operate or compromise, which reads as genuinely obtaining a capability, so there the identifier would move to AML.T0016.
AML.T0010 "Backdoor ML Model", similarly split. AML.T0010 is "AI Supply Chain Compromise"; "Backdoor ML Model" was AML.T0018's name before it became "Manipulate AI Model". LLM03's row describes backdoors reaching model weights through the training and fine-tuning supply chain, which fits AML.T0010. ASI04's row names MCP servers, prompt templates and model adapters, and AML.T0010.005 "AI Agent Tool" is the exact sub-technique for that.
I have another 46 proposals of this kind across NIST AI RMF, the EU AI Act and the OWASP families. I would rather not dump them on you at once — say the word and I will open them as a table, or split them per framework, or drop the ones you are not interested in.
Two things about the repository, offered rather than asserted
scripts/generate.js writes the current date into the four generated bundles under docs/. Because those bundles are committed, any check that regenerates and compares fails on a pristine checkout from the day after they were last written, with no input having changed. Removing the four stamp lines makes regeneration byte-identical across runs, which is what lets a build check mean anything. I have the patch if you want it. Separately, npm run validate reports 51 errors and 67 warnings on main at 2aa707af, none of them from anything I touched.
A verifier, if it is useful
I found the ATLAS problems by writing a script that fetches each framework's primary source, pins the sha256 of the bytes it read, and compares every citation to it: the identifier exists, and the recorded control_name is the name that framework's own publisher gives that identifier. The schema already declares url, version, last_synced and source_sha on every framework file, which is most of what this needs; what is missing is something that compares them to the source.
It runs offline in CI against the pinned registries, so a pull request never needs the network, and a weekly scheduled run re-fetches the primaries and reports drift. Frameworks whose text is paywalled, ISO/IEC 42001 and PCI DSS among them, are reported as unverified rather than asserted either way, because a source you cannot fetch is not a source you can check against. On the tree as it stands it reports 281 citations checked against a pinned primary and 273 mismatched; with the pull request applied, 281 and zero.
Two things I would want to be honest about before you take it. It only covers the two frameworks that publish a machine-readable primary, MITRE ATLAS and the NIST AI RMF playbook; the other 23 stay unverified until someone writes an adapter, and it says so rather than counting them as passing. And it is a new file plus a workflow, which is a bigger ask than a data fix, so I am raising it here rather than putting it in the pull request. Happy to open it separately, hand it over as a patch, or leave it if the maintenance cost is not worth it to you.
This is the part of the ATLAS review that needs your judgement rather than a lookup, plus an offer of the tooling that produced it. The mechanical half is in #59; nothing here overlaps with it.
Mappings where the fix could go either way
AML.T0035"Exfiltrate via ML Inference API", on 14 rows.AML.T0035is "AI Artifact Collection", and no release I read carries the recorded label at all. The nearest live technique to it isAML.T0024"Exfiltration via AI Inference API". So both halves of the pair are questionable and there are two defensible fixes. Moving the identifier toAML.T0024keeps the label. KeepingAML.T0035and correcting the label to "AI Artifact Collection" also works, and on DSGAI14 specifically it works better than the alternative: that entry is about telemetry and monitoring leakage, andAML.T0035's definition explicitly covers "other telemetry data produced when interacting with a model". I lean toward keeping the identifier and fixing the label, but the rows are not all alike and you know the intent behind them.AML.T0012"Obtain Capabilities", on two rows that want opposite fixes.AML.T0012is "Valid Accounts" and "Obtain Capabilities" isAML.T0016, so again either half could be the error. DSGAI02 describes acquiring agent credentials through memory inspection, log analysis and tool payload capture, which reads asAML.T0012with a stale label. DSGAI03 describes shadow AI tools the adversary may already operate or compromise, which reads as genuinely obtaining a capability, so there the identifier would move toAML.T0016.AML.T0010"Backdoor ML Model", similarly split.AML.T0010is "AI Supply Chain Compromise"; "Backdoor ML Model" wasAML.T0018's name before it became "Manipulate AI Model". LLM03's row describes backdoors reaching model weights through the training and fine-tuning supply chain, which fitsAML.T0010. ASI04's row names MCP servers, prompt templates and model adapters, andAML.T0010.005"AI Agent Tool" is the exact sub-technique for that.I have another 46 proposals of this kind across NIST AI RMF, the EU AI Act and the OWASP families. I would rather not dump them on you at once — say the word and I will open them as a table, or split them per framework, or drop the ones you are not interested in.
Two things about the repository, offered rather than asserted
scripts/generate.jswrites the current date into the four generated bundles underdocs/. Because those bundles are committed, any check that regenerates and compares fails on a pristine checkout from the day after they were last written, with no input having changed. Removing the four stamp lines makes regeneration byte-identical across runs, which is what lets a build check mean anything. I have the patch if you want it. Separately,npm run validatereports 51 errors and 67 warnings onmainat2aa707af, none of them from anything I touched.A verifier, if it is useful
I found the ATLAS problems by writing a script that fetches each framework's primary source, pins the sha256 of the bytes it read, and compares every citation to it: the identifier exists, and the recorded
control_nameis the name that framework's own publisher gives that identifier. The schema already declaresurl,version,last_syncedandsource_shaon every framework file, which is most of what this needs; what is missing is something that compares them to the source.It runs offline in CI against the pinned registries, so a pull request never needs the network, and a weekly scheduled run re-fetches the primaries and reports drift. Frameworks whose text is paywalled, ISO/IEC 42001 and PCI DSS among them, are reported as unverified rather than asserted either way, because a source you cannot fetch is not a source you can check against. On the tree as it stands it reports 281 citations checked against a pinned primary and 273 mismatched; with the pull request applied, 281 and zero.
Two things I would want to be honest about before you take it. It only covers the two frameworks that publish a machine-readable primary, MITRE ATLAS and the NIST AI RMF playbook; the other 23 stay unverified until someone writes an adapter, and it says so rather than counting them as passing. And it is a new file plus a workflow, which is a bigger ask than a data fix, so I am raising it here rather than putting it in the pull request. Happy to open it separately, hand it over as a patch, or leave it if the maintenance cost is not worth it to you.