Quantitative scoring
Five-level normalized rubrics (0.00 – 1.00) across 26 sub-metrics feed a 0 – 10 ERS. A control changes a score only to the extent that deployment evidence satisfies the applicable rubric anchor.
Mapping AIDEFEND defensive techniques to AITBM's 26 sub-metrics — so you can see which rubric criteria a control may support and how tested controls affect a documented scenario.
AIDEFEND (AI Defense Framework) is an independent open-source knowledge base of defensive countermeasures for protecting AI and machine learning systems, created by Edward Lee (not affiliated with OWASP or MITRE). It organizes practical defenses across seven high-level tactics aligned with MITRE D3FEND and maps each technique to known threats from nine major industry frameworks.
AIDEFEND answers "what defensive controls should exist"; AITBM answers "how risky is this system." An implemented AIDEFEND technique can supply evidence for an AITBM score change when its coverage and effectiveness are verified in the assessed deployment.
Framework at a glance
Current basis: reconciled against AIDEFEND data version 2026.10.15 (93 technique families, 274 sub-techniques, 367 records, and 309 actionable controls; schema 2.3), re-pinned on 18 October 2026 from 2026.09.20. Changed records and defendsAgainst arrays are evidence-route metadata only; the mapping is 185 placements across 78 distinct technique families and all 26 AITBM sub-metrics. Parent-family presence never sets an AITBM score; measured BEC, RBVR, LTFR, and GDSR results do.
Cn-7 selectors: AID-M-009.002; AID-H-017.001/.004/.006; AID-H-018.004; AID-H-028.005/.008; AID-H-033.002/.006; AID-H-034.001/.007/.008/.009; AID-H-037.002; AID-D-002.004; AID-D-003.004; AID-D-004.006; AID-D-005.001/.007; AID-I-001.001/.003; AID-I-003.001/.002/.003; AID-I-004.001/.005; AID-I-005; and AID-I-008.001/.004. Design and detective selectors provide partial evidence only.
Relationship audit: data version 2026.10.15 added AID-H-004.006 (Hosted Agent Publication & Exposure Controls) and AID-H-004.007 (External Event-to-Agent Admission & Authority Binding), both inheriting the AID-H-004 placements, and changed 77 existing records (35 in control text, 60 in defendsAgainst arrays); the prior 2026.09.20 version changed six core controls — AID-D-011.001, AID-H-002.002, AID-H-005.003, AID-H-006.003, AID-H-007.005, and AID-H-021.004 — and 348 defendsAgainst arrays. Identifiers and names are both version-bound and must never be cited without a data version. These external relationships guide threat coverage and test selection only; they do not change the 185 AIDEFEND-to-AITBM placements or earn score credit.
AITBM serves as a complementary quantification layer for AIDEFEND. Each defensive technique is mapped to the AITBM sub-metrics for which it may supply evidence. The before/after impacts and ERS deltas shown here are scenario results, not fixed values inherent to a control.
Five-level normalized rubrics (0.00 – 1.00) across 26 sub-metrics feed a 0 – 10 ERS. A control changes a score only to the extent that deployment evidence satisfies the applicable rubric anchor.
Trade-offs across Robustness, Fairness, Transparency, Privacy, and Containment remain visible alongside the aggregate ERS, showing where a control matters most.
ORP captures deployment-specific risk amplification (CRM step table 1.00 – 1.60, capped at 1.75) and ACI tracks assessment staleness. A control affects CRM only when verified changes move the applicable ORP dimensions across the step-table thresholds.
AIDEFEND organizes 93 techniques across seven tactics aligned with MITRE D3FEND. Each tactic maps to different AITBM layers and sub-metrics.
10
Asset inventory, provenance, threat modeling, HITL mapping, autonomy governance.
37
Adversarial training, input validation, RAG security, output filtering, MCP server boundary governance.
18
Prompt injection detection, drift monitoring, agent behavior attestation, leakage detection.
8
Network segmentation, client-side sandboxing, browser session isolation.
7
Honeypot AI services, decoy models, canary data for attacker detection.
5
Automated threat response, session termination, compromised state purging.
7
Model versioning, rollback, recovery from poisoning and compromise.
92
All 26 AITBM sub-metrics covered with 3 – 16 AIDEFEND techniques each (avg 7.1).
Ranked by ERS reduction. Agentic controls (Cn-1, Cn-2, Cn-5, Cn-6) deliver the highest risk reduction — six agentic-focused controls account for 55% of total risk reduction capacity.
| # | AIDEFEND Control | AITBM Sub-Metrics | ERS Reduction |
|---|---|---|---|
| 1 | AID-H-018 Agent Permission Restriction | Cn-1Cn-2Cn-5Cn-6 | 5.8 pts |
| 2 | AID-M-009 Agent Autonomy Governance | Cn-1Cn-2Cn-5Cn-6 | 5.4 pts |
| 3 | AID-M-006 HITL Control Design & Readiness | Cn-2Cn-1Cn-6 | 4.3 pts |
| 4 | AID-H-020 Secure RAG Implementation | Ro-4Pr-2Cn-3 | 3.9 pts |
| 5 | AID-M-002 Data Provenance Tracking | Ro-4Tr-4Pr-3 | 3.7 pts |
| 6 | AID-D-011 Agent Behavior Monitoring | Cn-1Cn-2Cn-5Cn-6 | 3.6 pts |
| 7 | AID-H-006 Output Content Filtering | Cn-3Pr-1Tr-2 | 3.5 pts |
| 8 | AID-H-001 Adversarial Robustness Training | Ro-1Ro-4 | 3.4 pts |
| 9 | AID-H-002 Input Sanitization & Validation | Ro-1Cn-3 | 3.3 pts |
| 10 | AID-D-003 Sensitive Data Leakage Detection | Pr-1Pr-3Cn-3 | 3.0 pts |
Counts are distinct AIDEFEND parent-family routes in data version 2026.10.15, not implemented controls or automatic AITBM score credit. The assessed deployment still needs applicable, measured evidence against the AITBM rubrics.
A dated illustrative model of an internet-facing, Tier I financial advisory agent with RAG and L3 conditional autonomy. Under the stated effectiveness and evidence assumptions, twelve mapped AIDEFEND controls change inputs across all three AITBM layers and move the Effective Risk Score from 9.7 to 3.2. These are scenario results, not fixed values inherent to the controls.
BASELINE — NO CONTROLS
Critical MVT — Unacceptable risk
MITIGATED — 12 AIDEFEND CONTROLS
Low-Moderate ERS — axis-level Tier I MVTs still govern deployment status
The reduction is not a project schedule — it is the scoring mechanism. Verified test outcomes satisfy higher anchors for the applicable sub-metrics; those inputs recompute the three layers, and the ERS formula combines them. A mapped control receives no credit merely because it is present. Here is what moves each layer in this scenario.
Intrinsic security · IVP 0.32 → 0.68
Adversarial Robustness Training (AID-H-001) and Input Sanitization (AID-H-002) make the model hold up under prompt injection (Ro-1); Secure RAG Implementation (AID-H-020) grounds retrieval against poisoned context (Ro-4); Output Content Filtering (AID-H-006) and Leakage Detection (AID-D-003) stop the agent disclosing retrieved client data (Cn-3, Pr-1). The model stops obeying injected instructions and stops leaking what it reads.
Deployment risk · CRM 1.60 → 1.00
The baseline had all four operational dimensions elevated — internet exposure, L3 autonomy, financial blast radius, hard remediation — compounding risk 1.60×. Agent Permission Restriction (AID-H-018), Autonomy Governance (AID-M-009) and human-in-the-loop control points (AID-M-006) bound what the agent may do (Cn-1, Cn-2), and cryptographic agent identity (Cn-5) proves who is acting. Bounded and attributable, enough dimensions fall below the elevation threshold that the multiplier steps back to 1.00 — no amplification.
Assurance confidence · ACI 0.40 → 0.90
A one-off assessment decays quickly on a Tier I system, so low confidence inflates the score. Agent Behavior Monitoring (AID-D-011) and Data Provenance Tracking (AID-M-002) replace that snapshot with continuous, attributable evidence (Cn-5, Tr-4), and behavioral-baseline deviation flags drift as it happens — so the confidence index stops discounting the result.
AIDEFEND already maps to nine external frameworks. AITBM provides a complementary evidence-to-score layer: implemented controls can support applicable sub-metric ratings in a system-specific assessment.
v2026.09: 16 tactics, 120 top-level + 88 sub-techniques
Ten-risk catalog alignment; 571 relationship references
ASI01–ASI10 risk alignment (2026 edition)
Seven-layer threat-model alignment
Adversarial threat taxonomy
Integrated safety & security
Secure AI Framework
AI security framework
ML-specific threats