SOURCE READING
Original and translation
The excerpt and translation use the primary source below. Further references inform SHIO’s analysis.
Primary source
- Original title
- Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
- Original author / institution
- Apostol Vassilev (NIST), Alina Oprea (Northeastern University), Alie Fordyce (Cisco), Hyrum Anderson (Cisco), Xander Davies (U.K. AI Security Institute), Maia Hamin (U.S. AI Safety Institute)
- Primary source
- National Institute of Standards and Technology
- Source language
- English
- Original publication date
Only a brief primary-source excerpt is reproduced here, not the complete text. No permission to republish the whole text is asserted. SHIO prepared the translations on October20, 2026. Read the source for its full context; SHIO analysis is marked separately.
Basis for use：Joint government and non-government authorship; brief excerpt only
This edition uses the source language, so the original appears once.
life cycle stages of attackSHIO analysis
Make an AI red-team finding repairable
The following is SHIO’s independent judgment and discussion of methods. It is separate from the source text and its translation.
SHIO reading note
NIST’s adversarial machine learning taxonomy and secure development profile offer context for turning a troubling demonstration into an actionable engineering question.
The central idea
SHIO view: a useful finding explains the boundary that failed and how a team will know a repair worked.
What the sources establish
The final NIST AI 100-2 E2025 report is dated March 24, 2025 in its document history. It organizes adversarial machine learning terminology around factors including attack stages and attacker capabilities. This provides a shared language for describing a threat, rather than proof that a particular defense is effective.
NIST’s July 26, 2024 secure development profile adds AI-specific practices to the Secure Software Development Framework. Its scope covers the software development lifecycle. Together, these historical documents support thinking about security as work that must be specified and maintained throughout development, not demonstrated once at a launch event.
SHIO method: connect the case to a boundary
For an authorized internal test, start with a plainly stated protected boundary: an assistant may read a supplied document, but that document must not grant new authority. Use harmless synthetic material in an isolated environment. Record the intended behavior, observed behavior, system version, and permissions involved. Keep the test narrow enough that another engineer can repeat it.
A finding should name what needs to change. Perhaps the issue lies in how outside content is presented, how a tool receives permissions, or how an action is checked before execution. Assign an owner and define a follow-up test. The purpose of this example is defensive workflow design; it is not an attack recipe or evidence of a vulnerability in a named product.
SHIO judgment and limits
After a repair, rerun the original case and related ordinary tasks. Blocking the troubling output is insufficient if the system becomes unusable for the work it was intended to support. Preserve the rationale for choosing those cases, so a later change can be assessed against the same boundary rather than a remembered impression of safety.
An unsuccessful attempt to cross a boundary establishes only what happened under the tested conditions. It does not show that every route is blocked. SHIO therefore treats red-team findings as inputs to a continuing decision process: narrow the exposure, improve the control, or defer the use until the team can support its assumptions with evidence.
A question for practice
Finish each finding with an owner, a repair hypothesis, and a test that could disprove it.
REFERENCES & EDITORIAL NOTE
Sources & further reading
The source’s original title, author and basis for use appear in the source section. Excerpts, SHIO translations and independent analysis are clearly separated. References include the primary source and supporting material for checking the evidence and its context.
National Institute of Standards and Technology · Primary source
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
Original source date：Accessed：The official author list and reportPDF show NIST plus university, company and U.K. institution contributors. The NIST employee-work policy is not treated as a blanket clearance for all joint contributions. Only a five-word phrase from the abstract is reproduced. No complete report, paragraph, figure, table, exploit procedure or third-party material is copied. Policy/source: https://www.nist.gov/open/copyright-fair-use-and-licensing-statements-srd-data-software-and-technical-series-publications
National Institute of Standards and Technology
Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile
Original source date：Accessed：NIST employee works: U.S. public domain; third-party exceptions. Original editorial analysis; no full translation. Policy: https://www.nist.gov/open/license