mitre_atlas audit: T0043/T0048/T0051/T0054 mismatched on ~40 of 49 citing records

[chaksaray]

Summary

This is the audit mitre_atlas_audit.md called for: whether AML.T0043,
AML.T0048, AML.T0051, and AML.T0054 are genuinely correct on the
records that cite them, or reused via pattern-matching. They're reused via
pattern-matching. 49 of the corpus's records cite at least one of these
four IDs. The scorecard below goes record by record.

Method: fetched ATLAS.yaml directly from
mitre-atlas/atlas-data (not inferred from memory or corpus usage, per
this project's own framework-mapping standard) and compared each
technique's actual definition against the citing record's
behavioral_fingerprint. Where a citation looked wrong, I searched the
same source for a better-fitting technique before proposing a
replacement — I did not invent IDs I hadn't verified.

The four techniques, as ATLAS actually defines them

ID	Name	Tactic	What it actually means
AML.T0043	Craft Adversarial Data	AI Attack Staging	Perturbing/crafting input to a model to cause misclassification, via white/black-box optimization, transfer attacks, manual modification, or backdoor triggers. Pre-deployment adversarial-example crafting.
AML.T0048	External Harms	Impact	A terminal outcome category — financial, reputational, societal, or user harm, or AI IP theft. Marks a completed impact, not a mechanism or staging step.
AML.T0051	LLM Prompt Injection	Execution	Crafting malicious prompts that cause an LLM to ignore safety instructions or bypass guardrails. Sub-techniques: .000 Direct, .001 Indirect, .002 Triggered.
AML.T0054	LLM Jailbreak	Privilege Escalation / Defense Evasion	Inducing an LLM to circumvent its own safety/alignment training — adversarial prompting, weight manipulation, or direct model modification. Not "any bad thing an injected instruction caused."

Headline finding: templated co-occurrence, not per-record judgment

AML.T0043 + AML.T0048 appear as an identical pair on 11 records
(00003, 00020, 00026, 00032, 00036, 00041, 00042, 00044, 00045, 00046,
00048) spanning unrelated mechanisms — network recon, lateral movement,
tool-hook hijacking, sub-agent delegation, credential theft. That spread
is consistent with a default "agentic-abuse record → tag both T0043 and
T0048" template applied at authoring time, not an individual check
against what those two IDs mean.

There's also a backwards inversion: records that are textbook
AML.T0051 (LLM Prompt Injection) — 00002, 00028, 00037 — are tagged
AML.T0054 alone, with no AML.T0051 citation at all. The specific,
correct technique isn't cited; a broader, wrong one is.

Verified alternative techniques (confirmed against ATLAS.yaml, not guessed)

• AML.T0020 — Poison Training Data: the actual match for 00031
  (currently tagged T0054), which is specifically about corrupting a
  training/feedback pipeline, not runtime guardrail circumvention.
• AML.T0006 — Active Scanning: the actual match for 00032
  (currently tagged T0043+T0048), which is network/port/service
  reconnaissance, not adversarial-input crafting or completed impact.
• AML.TA0015 — Lateral Movement is a distinct ATLAS tactic with
  its own techniques, confirmed to exist separately from Attack Staging
  and Impact. 00036 (currently T0043+T0048) is lateral movement by
  its own title and fingerprint; the specific technique ID under that
  tactic needs a follow-up lookup, but neither currently-cited ID is it.
• AML.T0052 — Phishing (Initial Access / Lateral Movement) is
  already correctly co-cited on 00045, 00046, 00048 alongside the
  mismatched T0043/T0048 pair — a sign the record authors sometimes
  got the right technique and then padded it with the templated pair
  anyway.

Full scorecard

Verdict key: KEEP = citation fits, no change · DROP = citation
doesn't fit, remove · ADD = a correct citation is missing, add it ·
VERIFIED-REPLACE = drop the wrong ID, add a source-confirmed
replacement · JUDGMENT = defensible either way, flagging for
maintainer call rather than asserting an answer.

ave_id	title	current (audited IDs only)	verdict	proposed
00001	Metamorphic payload via external config fetch	T0054	DROP	Not a guardrail-circumvention behavior (instruction replacement via remote fetch). No verified replacement identified yet — needs its own lookup, don't leave T0054 in place meanwhile.
00002	MCP tool description behavioral injection	T0054	DROP + ADD	Drop T0054 (no guardrail circumvention described). Add AML.T0051 (likely .001 Indirect) — this is squarely LLM prompt injection and isn't cited at all currently.
00003	Credential exfiltration via agent instruction	T0043, T0048	DROP T0043 / KEEP T0048	Direct instruction to exfiltrate credentials isn't adversarial-input crafting. T0048 (financial/user harm) fits the endpoint.
00004	Arbitrary code execution via shell pipe injection	T0054	DROP	Tool/code-exec abuse, not guardrail circumvention. No verified replacement yet.
00005	Recursive file system destruction	T0048	KEEP	Destructive deletion is a completed user/societal harm. Correct as-is.
00006	Cryptocurrency wallet drain	T0048	KEEP	Financial harm, completed impact. Correct as-is.
00007	Agent goal hijack via direct instruction override	T0054, T0051	JUDGMENT	T0051 is solid. T0054 is a defensible stretch (overriding current task edges toward privilege escalation) — maintainer call.
00008	Agent persistence via self-replication	T0048	DROP	Persistence mechanism, not itself a completed external-harm outcome. No verified replacement yet.
00009	AI identity jailbreak via role-play/persona override	T0054, T0051	KEEP	Textbook fit for both — persona override to escape alignment constraints.
00010	Covert instruction concealment via secrecy directive	T0054	JUDGMENT	Hides from human review, not clearly the model's own guardrails. Defensible stretch, not a clean fit — maintainer call.
00011	Arbitrary tool invocation via dynamic tool call injection	T0048, T0054	DROP both	Control-flow hijack mechanism; neither a completed external harm nor guardrail circumvention as described. No verified replacement yet.
00012	Capability escalation via false permission grant	T0054, T0051	JUDGMENT	T0051 solid. T0054 defensible (asserting false elevated permission edges toward privilege escalation) — maintainer call.
00013	Personal data exfiltration via PII collection	T0054, T0048	DROP T0054 / KEEP T0048	PII exfil instruction doesn't describe guardrail circumvention. T0048 (user harm) fits the endpoint.
00014	False authority claim via trust escalation impersonation	T0054, T0051	JUDGMENT	T0051 solid. T0054 defensible (impersonating authority to bypass constraints) — maintainer call.
00015	System prompt extraction via direct interrogation	T0054	JUDGMENT	Defeats a specific guardrail (don't reveal system prompt) — closer to a legitimate fit than most T0054 citations here, but still a stretch vs. ATLAS's alignment-circumvention framing. Maintainer call.
00016	Indirect Prompt Injection via RAG Retrieval	T0051.000	FIX SUBTYPE	Fingerprint describes indirect injection via retrieved content, but the citation is .000 (Direct). Should be AML.T0051.001 (Indirect).
00017	MCP Server Impersonation or Spoofing	T0043	DROP	Impersonation/spoofing, not adversarial-input crafting. No verified replacement yet (worth checking ATLAS's Initial Access / spoofing-adjacent techniques).
00018	Tool Result Manipulation or Output Poisoning	T0048	DROP	Deception mechanism, not a completed external-harm outcome. No verified replacement yet.
00019	Agent Memory Poisoning	T0054	DROP	Persistence/poisoning mechanism, not guardrail circumvention. No verified replacement yet.
00020	Cross-Agent Prompt Injection (A2A)	T0043, T0048	DROP both / ADD	Neither fits. This is LLM prompt injection targeting a second agent — add AML.T0051.
00021	Autonomous Action Without User Confirmation	T0054	DROP	Bypasses an operational human-confirmation step, not the model's own safety alignment. No verified replacement yet.
00022	Scope Creep - Accessing Undeclared Resources	T0043	DROP	Excess resource access, unrelated to adversarial-input crafting. No verified replacement yet.
00023	Model Context Window Manipulation	T0054	KEEP	Flooding context to evict safety instructions is a genuine, specific fit for defense-evasion-of-guardrails.
00025	Conversation History Injection	T0054	JUDGMENT	Fabricated history to manipulate perceived consent — defensible stretch, not clean. Maintainer call.
00026	Exfiltration via Tool Output Encoding	T0043, T0048	DROP T0043 / KEEP T0048	Encoding isn't adversarial-input crafting. T0048 (IP/PII theft) fits the endpoint.
00027	Multi-Turn Attack - Instruction Persistence	T0054	DROP	Persistence of an injected instruction across turns, not guardrail circumvention itself. No verified replacement yet.
00028	Prompt Injection via File or Document Content	T0054, T0048	DROP both + ADD	Indirect prompt injection via untrusted file content — add AML.T0051.001. Neither currently-cited ID fits.
00029	Homoglyph or Unicode Obfuscation Attack	T0054	DROP	Fingerprint states the payload "remains fully readable" to the model — this evades human/scanner review, not the model's guardrails. No verified replacement yet.
00030	Privilege Escalation via False Role Claim	T0043	DROP	Social-engineering/role-claim instruction, not adversarial-input crafting. No verified replacement yet.
00031	Training Data or Feedback Loop Poisoning	T0054, T0011	VERIFIED-REPLACE	Drop T0054, add AML.T0020 (Poison Training Data) — confirmed exact match. Keep T0011.
00032	Network Reconnaissance Instruction	T0043, T0048	VERIFIED-REPLACE	Drop both, add AML.T0006 (Active Scanning) — confirmed exact match.
00033	Unsafe Deserialization or Eval Instruction	T0011, T0054	DROP T0054 / KEEP T0011	Code-exec/tool-abuse mechanism, not guardrail circumvention. T0011 (User Execution) already fits.
00034	Supply Chain - Dynamic Third-Party Skill Import	T0011, T0054	DROP T0054 / KEEP T0011	Supply-chain mechanism, not guardrail circumvention. T0011 already fits; AML.T0010 (AI Supply Chain Compromise) worth adding — maintainer call on exact scope.
00035	Environment or Sensor Data Manipulation	T0054	DROP	Fabricating sensor readings isn't guardrail circumvention. No verified replacement yet.
00036	Lateral Movement - Pivot to Other Systems	T0043, T0048	VERIFIED-DROP	Drop both — confirmed AML.TA0015 (Lateral Movement) is a distinct tactic with its own techniques; neither currently-cited ID is under it. Specific technique ID needs a follow-up lookup before adding.
00037	Prompt Injection via Image or Vision Input	T0054	DROP + ADD	Fingerprint explicitly says this "bypass[es] text-level security filters" via a multimodal channel — add AML.T0051 (likely .001 Indirect). Drop T0054, not cited correctly here.
00038	Excessive Agency - Unbounded Tool Use	T0043	DROP	Unrelated to adversarial-input crafting. No verified replacement yet.
00039	Covert Channel - Steganographic Data Exfiltration	T0048	KEEP	Data-theft endpoint, fits the Impact category.
00040	Insecure Output - Unescaped Injection into Downstream System	T0048	JUDGMENT	Plausible as an eventual-impact tag, but it's also a classic injection-vector mechanism — maintainer call on whether a mechanism-stage ID fits better.
00041	Prompt injection via MCP server-card tool descriptions	T0043, T0048	DROP both / ADD	This is LLM prompt injection (tool-description content) — add AML.T0051.
00042	Payload injection into orchestration code via poisoned tool results	T0043, T0048	DROP both / ADD	Poisoned-data-triggers-injection pattern — add AML.T0051.
00043	Prompt injection via rich UI payload (MCP App)	T0043	DROP / ADD	Hidden instructions in non-rendered UI elements — add AML.T0051 (likely .001 Indirect).
00044	Prompt injection via poisoned async task result	T0043, T0048	DROP both / ADD	Same pattern as 00041/00042 — add AML.T0051.
00045	Privilege escalation via cross-app-access (confused deputy)	T0043, T0048, T0052	DROP T0043, T0048 / KEEP T0052	T0052 (Phishing, Initial Access/Lateral Movement) is already the better-fitting citation here. T0043/T0048 add nothing.
00046	MCP tool hook hijacking	T0043, T0048, T0052	DROP T0043, T0048 / KEEP T0052	Same as 00045 — T0052 fits, the other two are the templated pair.
00048	Unsafe agent delegation chain	T0043, T0048, T0052	DROP T0043, T0048 / KEEP T0052	Same pattern again.
00050	Parasitic Toolchain - Silent Tool Registration	T0010, T0043	DROP T0043 / KEEP T0010	T0010 (AI Supply Chain Compromise) already fits; T0043 adds nothing — no adversarial-input crafting described.
00056	Zero-click data exfiltration via markdown image auto-fetch	T0051	JUDGMENT	Fingerprint describes a client-side auto-render side channel, not the LLM being induced to ignore instructions. Weakest T0051 citation in the corpus — maintainer call on whether this needs a different tactic (Exfiltration) entirely.
00059	Fragmented cross-description prompt injection (ShareLock-class)	T0051	KEEP	Strong, specific fit — indirect injection reassembled at a trigger.

What this issue is and isn't

• Is: a verified scorecard proposing per-record corrections, for
  maintainer review before anything changes.
• Isn't: a batch edit already made. Records are immutable once
  published per this repo's governance rules — corrections here mean a
  reviewed PR adjusting mitre_atlas arrays record by record, not a
  silent bulk rewrite.
• Isn't exhaustive: this only covers records citing the four IDs
  named in mitre_atlas_audit.md. Other mitre_atlas citations
  elsewhere in the corpus (e.g. T0011, T0010, T0052 where already
  present and correct) were read for context but not independently
  audited end-to-end.
• Several rows above say "no verified replacement yet" rather than
  guessing a plausible-sounding ID — per this project's standard of
  researching framework mappings from the primary source rather than
  inferring them, those need their own lookup pass before a specific
  replacement is proposed, not a bulk drop with nothing to show for it.

Suggested next step

Confirm the "no verified replacement yet" rows either get a follow-up
research pass to find the correct ID, or ship as a straight drop (no
mitre_atlas citation from this set) if no ATLAS technique actually
covers that behavior — not every AVE record needs a MITRE ATLAS mapping,
per this project's own "add optional framework fields when applicable,
omit rather than force" rule.