compliance-mapping

Compliance Mapping

Maps AIRT attacks, transforms, and scorers to major AI security compliance frameworks.

OWASP Agentic Security Index (ASI01-ASI10)

ASI	Category	Transforms	Scorers	Coverage
ASI01	Prompt Injection & Manipulation	skeleton_key_framing, many_shot_examples, position_variation, position_wrap, prompt_infection	prompt_infection, indirect_injection_success	Strong
ASI02	Misaligned Behaviors	goal_drift_injection, deceptive_delight, intent_manipulation	goal_drift, intent_manipulation, goal_hijacking	Strong
ASI03	Excessive Autonomy	tool_restriction_bypass, action_hijacking, workflow_step_skip, tool_chain_attack	tool_invoked, any_tool_invoked, tool_restriction_bypass, agentic_workflow	Strong
ASI04	Knowledge Poisoning	document_poison, context_injection, context_stuffing, query_manipulation, chunk_boundary_exploit, single_text_poison, bias_amplification	data_exfiltration	Strong
ASI05	Unsafe Action Execution	tool_priority_injection, delayed_tool_invocation, exploitation_mode_confusion, malformed_output_injection, sql_via_nlp_injection	tool_selection_safety, tool_invoked, dangerous_tool_args, sql_injection_via_nlp	Strong
ASI06	Data Leakage	markdown_image_exfil, mermaid_diagram_exfil, unicode_tag_exfil, dns_exfil_injection, ssrf_via_tools, link_unfurling_exfil, api_endpoint_abuse, character_exfiltration	markdown_exfil, unicode_exfil, dns_exfil, ssrf_exfil, data_exfil	Strong
ASI07	Insecure Integrations	tool_description_poison, cross_server_shadow, rug_pull_payload, tool_output_injection, schema_poisoning, ansi_escape_cloaking, mcp_sampling_injection, cross_server_request_forgery, tool_squatting, tool_preference_manipulation	tool_description_poisoned, cross_server_shadow, rug_pull, tool_output_injected, schema_poisoned, ansi_cloaking, sampling_injection	Strong
ASI08	Cascading Trust Failures	peer_agent_spoof, consensus_poisoning, delegation_chain_attack, shared_memory_poisoning, trust_exploitation, experience_poisoning	agent_spoofing, consensus_poisoned, delegation_exploit, session_smuggling	Strong
ASI09	Insufficient Oversight	cot_backdoor, reasoning_hijack, reasoning_dos, crescendo_escalation, fitd_escalation	cot_backdoor, reasoning_hijack, reasoning_dos, escalation	Strong
ASI10	Identity Spoofing	agent_config_overwrite, peer_agent_spoof, persistent_memory_backdoor, query_memory_injection	agent_config_overwrite, agent_spoofing, agent_config_tampered, agent_identity_leaked	Strong

Minimum ASI Assessment

1. generate_agentic_attack with tool_restriction_bypass + tool_chain_attack (ASI03, ASI05)
2. generate_agentic_attack with tool_description_poison + cross_server_shadow + schema_poisoning (ASI07)
3. generate_agentic_attack with prompt_infection + delegation_chain_attack (ASI01, ASI08)
4. generate_attack with markdown_image_exfil + dns_exfil_injection transforms (ASI06)
5. generate_attack with document_poison + context_injection transforms (ASI04)
6. generate_attack with goal_drift_injection + deceptive_delight transforms (ASI02)

OWASP LLM Top 10 (2025)

OWASP	Category	Attacks	Transforms	Coverage
LLM01	Prompt Injection	tap, pair, goat, crescendo, gptfuzzer, autodan, renellm, beast, drattack, deep_inception	skeleton_key_framing, many_shot_examples, position_variation	Strong
LLM02	Insecure Output Handling	All LLM attacks	markdown_image_exfil, mermaid_diagram_exfil, unicode_tag_exfil	Strong
LLM03	Training Data Poisoning	—	—	Gap
LLM04	Model Denial of Service	—	reasoning_dos, guardrail_dos, wordlist_exhaustion	Light
LLM05	Supply Chain Vulns	—	skill_dependency_confusion, skill_package_poison	Light
LLM06	Sensitive Info Disclosure	tap, pair, crescendo	direct_extraction, indirect_extraction, boundary_probe, format_exploitation, multi_turn_extraction, partial_pii_completion	Strong
LLM07	Insecure Plugin Design	—	tool_description_poison, schema_poisoning, tool_output_injection, tool_squatting	Strong
LLM08	Excessive Agency	—	tool_restriction_bypass, action_hijacking, tool_chain_attack, workflow_step_skip	Strong
LLM09	Overreliance	rainbow	document_poison, context_injection, bias_amplification	Moderate
LLM10	Model Theft	—	—	Gap

Minimum OWASP LLM Assessment

1. generate_attack(attack_type="tap", ...) with injection goals (LLM01)
2. generate_attack(attack_type="pair", ...) with extraction goals + direct_extraction transform (LLM06)
3. generate_attack(attack_type="crescendo", ...) with multi-turn escalation (LLM01, LLM02)
4. generate_attack(attack_type="rainbow", ...) for broad risk coverage (LLM01, LLM09)
5. generate_category_attack with system_prompt_leak + credential_extraction categories (LLM06)

MITRE ATLAS

ATLAS Technique	ID	Attacks / Transforms
Prompt Injection (Direct)	AML.T0051.000	tap, pair, goat, gptfuzzer, beast, drattack, skeleton_key_framing
Prompt Injection (Indirect)	AML.T0051.001	crescendo, deep_inception, renellm, context_injection, document_poison
LLM Jailbreak	AML.T0054	All 12 LLM jailbreak attacks + all encoding/cipher/persuasion transforms
Obfuscate Artifacts	AML.T0015	beast, drattack, base64, hex, caesar, rot13, unicode_escape, homoglyph
Data Exfiltration	AML.T0024	markdown_image_exfil, unicode_tag_exfil, dns_exfil_injection, ssrf_via_tools
Abuse/Misuse	AML.T0048	tool_restriction_bypass, action_hijacking, tool_chain_attack
Evade ML Model	AML.T0015	classifier_evasion, payload_split, emoji_smuggle, nested_fiction

NIST AI RMF

NIST Function	Subcategory	AIRT Coverage	How
GOVERN	GV-1.1	Assessment reporting	Reports document risk findings
MAP	MP-2.3	rainbow + generate_category_attack	Broad risk category enumeration
MEASURE	MS-2.6	All 12 attack algorithms	Adversarial security testing
MEASURE	MS-2.7	All LLM + agentic attacks	AI-specific attack vectors
MANAGE	MG-2.2	Assessment reports	Recommendations for mitigations

Google SAIF

SAIF Category	Relevant Attacks / Transforms
Input Manipulation	All 12 jailbreak attacks, all encoding/cipher/persuasion transforms
Model Exploitation	beast, autodan, reasoning attacks (cot_backdoor, reasoning_hijack)
Data Exfiltration	All exfiltration transforms (8) + scorers (4)
Output Integrity	All attacks + MCP output injection transforms
Agent Security	All agentic workflow (18), agent skill (9), multi-agent (10) transforms

Coverage Summary

Well-Covered (Strong)

• Prompt injection (direct and indirect) — 12 attack algorithms
• LLM jailbreaking — 200+ transforms across 20+ categories
• Agentic security — OWASP ASI01-ASI10 all covered
• MCP security — 12 transforms, 7 scorers
• Multi-agent security — 10 transforms, 6 scorers
• Exfiltration — 8 transforms, 5 scorers
• Content policy — 260 bundled goals across 25 sub-categories
• System prompt extraction — 6 transforms
• RAG poisoning — 7 transforms

Partially Covered

• Reasoning attacks — 7 transforms, 5 scorers
• IDE/code agent security — 7 transforms, 5 scorers
• Browser agent attacks — 6 transforms
• Supply chain — 2 transforms (skill_dependency_confusion, skill_package_poison)

Not Covered (Requires Different Tools)

• Training data poisoning
• Model denial of service (resource exhaustion)
• Model theft / extraction
• Infrastructure security