Quantitative scoring
Five-level normalized rubrics (0.00 – 1.00) across 23 sub-metrics feed a 0 – 10 ERS. A control changes a score only to the extent that deployment evidence satisfies the applicable rubric anchor.
Mapping AIDEFEND defensive techniques to AITBM's 23 sub-metrics — so you can see which rubric criteria a control may support and how tested controls affect a documented scenario.
AIDEFEND (AI Defense Framework) is an independent open-source knowledge base of defensive countermeasures for protecting AI and machine learning systems, created by Edward Lee (not affiliated with OWASP or MITRE). It organizes practical defenses across seven high-level tactics aligned with MITRE D3FEND and maps each technique to known threats from nine major industry frameworks.
AIDEFEND answers "what defensive controls should exist"; AITBM answers "how risky is this system." An implemented AIDEFEND technique can supply evidence for an AITBM score change when its coverage and effectiveness are verified in the assessed deployment.
Framework at a glance
Current basis: reconciled against AIDEFEND data version 2026.08.05 (92 technique families, 265 sub-techniques, 357 records, and 300 actionable controls; schema 2.3). All actionable controls were audited for Cn-7. Sixteen parent families now route to 29 exact leaf or standalone evidence selectors, bringing the mapping to 168 placements across 77 distinct technique families and all 23 AITBM sub-metrics. Parent-family presence never sets an AITBM score; measured BEC, RBVR, LTFR, and GDSR results do.
Cn-7 selectors: AID-M-009.002; AID-H-017.001/.004/.006; AID-H-018.004; AID-H-028.005/.008; AID-H-033.002/.006; AID-H-034.001/.007/.008/.009; AID-H-037.002; AID-D-002.004; AID-D-003.004; AID-D-004.006; AID-D-005.001/.007; AID-I-001.001/.003; AID-I-003.001/.002/.003; AID-I-004.001/.005; AID-I-005; and AID-I-008.001/.004. Design and detective selectors provide partial evidence only.
Relationship audit: data version 2026.08.05 kept the same 357 records and core control semantics while changing external relationships and tools. All records now use OWASP LLM Top 10 2026; 293 changed their exact LLM item arrays, LLM references increased from 550 to 632, tool metadata changed on 192 records, and ATLAS metadata advanced to v2026.07. IDs are version-bound. These external relationships guide threat coverage and test selection only; they do not change the 168 AIDEFEND-to-AITBM placements or earn score credit.
AITBM serves as a complementary quantification layer for AIDEFEND. Each defensive technique is mapped to the AITBM sub-metrics for which it may supply evidence. The before/after impacts and ERS deltas shown here are scenario results, not fixed values inherent to a control.
Five-level normalized rubrics (0.00 – 1.00) across 23 sub-metrics feed a 0 – 10 ERS. A control changes a score only to the extent that deployment evidence satisfies the applicable rubric anchor.
Trade-offs across Robustness, Fairness, Transparency, Privacy, and Containment remain visible alongside the aggregate ERS, showing where a control matters most.
ORP captures deployment-specific risk amplification (CRM step table 1.00 – 1.60, capped at 1.75) and ACI tracks assessment staleness. A control affects CRM only when verified changes move the applicable ORP dimensions across the step-table thresholds.
AIDEFEND organizes 92 techniques across seven tactics aligned with MITRE D3FEND. Each tactic maps to different AITBM layers and sub-metrics.
10
Asset inventory, provenance, threat modeling, HITL mapping, autonomy governance.
37
Adversarial training, input validation, RAG security, output filtering, MCP server boundary governance.
18
Prompt injection detection, drift monitoring, agent behavior attestation, leakage detection.
8
Network segmentation, client-side sandboxing, browser session isolation.
7
Honeypot AI services, decoy models, canary data for attacker detection.
5
Automated threat response, session termination, compromised state purging.
7
Model versioning, rollback, recovery from poisoning and compromise.
92
All 23 AITBM sub-metrics covered with 3 – 15 AIDEFEND techniques each (avg 7.0).
Ranked by ERS reduction. Agentic controls (Cn-1, Cn-2, Cn-5, Cn-6) deliver the highest risk reduction — six agentic-focused controls account for 55% of total risk reduction capacity.
| # | AIDEFEND Control | AITBM Sub-Metrics | ERS Reduction |
|---|---|---|---|
| 1 | AID-H-018 Agent Permission Restriction | Cn-1Cn-2Cn-5Cn-6 | 5.8 pts |
| 2 | AID-M-009 Agent Autonomy Governance | Cn-1Cn-2Cn-5Cn-6 | 5.4 pts |
| 3 | AID-M-006 HITL Control Design & Readiness | Cn-2Cn-1Cn-6 | 4.3 pts |
| 4 | AID-H-020 Secure RAG Implementation | Ro-4Pr-2Cn-3 | 3.9 pts |
| 5 | AID-M-002 Data Provenance Tracking | Ro-4Tr-4Pr-3 | 3.7 pts |
| 6 | AID-D-011 Agent Behavior Monitoring | Cn-1Cn-2Cn-5Cn-6 | 3.6 pts |
| 7 | AID-H-006 Output Content Filtering | Cn-3Pr-1Tr-2 | 3.5 pts |
| 8 | AID-H-001 Adversarial Robustness Training | Ro-1Ro-4 | 3.4 pts |
| 9 | AID-H-002 Input Sanitization & Validation | Ro-1Cn-3 | 3.3 pts |
| 10 | AID-D-003 Sensitive Data Leakage Detection | Pr-1Pr-3Cn-3 | 3.0 pts |
Counts are distinct AIDEFEND parent-family routes in data version 2026.08.05, not implemented controls or automatic AITBM score credit. The assessed deployment still needs applicable, measured evidence against the AITBM rubrics.
A dated illustrative model of an internet-facing, Tier I financial advisory agent with RAG and L3 conditional autonomy. Under the stated effectiveness and evidence assumptions, twelve mapped AIDEFEND controls change inputs across all three AITBM layers and move the Effective Risk Score from 9.7 to 3.2. These are scenario results, not fixed values inherent to the controls.
BASELINE — NO CONTROLS
Critical MVT — Unacceptable risk
MITIGATED — 12 AIDEFEND CONTROLS
Low-Moderate ERS — axis-level Tier I MVTs still govern deployment status
The reduction is not a project schedule — it is the scoring mechanism. Verified test outcomes satisfy higher anchors for the applicable sub-metrics; those inputs recompute the three layers, and the ERS formula combines them. A mapped control receives no credit merely because it is present. Here is what moves each layer in this scenario.
Intrinsic security · IVP 0.32 → 0.68
Adversarial Robustness Training (AID-H-001) and Input Sanitization (AID-H-002) make the model hold up under prompt injection (Ro-1); Secure RAG Implementation (AID-H-020) grounds retrieval against poisoned context (Ro-4); Output Content Filtering (AID-H-006) and Leakage Detection (AID-D-003) stop the agent disclosing retrieved client data (Cn-3, Pr-1). The model stops obeying injected instructions and stops leaking what it reads.
Deployment risk · CRM 1.60 → 1.00
The baseline had all four operational dimensions elevated — internet exposure, L3 autonomy, financial blast radius, hard remediation — compounding risk 1.60×. Agent Permission Restriction (AID-H-018), Autonomy Governance (AID-M-009) and human-in-the-loop control points (AID-M-006) bound what the agent may do (Cn-1, Cn-2), and cryptographic agent identity (Cn-5) proves who is acting. Bounded and attributable, enough dimensions fall below the elevation threshold that the multiplier steps back to 1.00 — no amplification.
Assurance confidence · ACI 0.40 → 0.90
A one-off assessment decays quickly on a Tier I system, so low confidence inflates the score. Agent Behavior Monitoring (AID-D-011) and Data Provenance Tracking (AID-M-002) replace that snapshot with continuous, attributable evidence (Cn-5, Tr-4), and behavioral-baseline deviation flags drift as it happens — so the confidence index stops discounting the result.
AIDEFEND already maps to nine external frameworks. AITBM provides a complementary evidence-to-score layer: implemented controls can support applicable sub-metric ratings in a system-specific assessment.
v2026.07: 16 tactics, 101 top-level + 77 sub-techniques
Ten-risk catalog alignment; 632 relationship references
ASI01–ASI10 risk alignment (2026 edition)
Seven-layer threat-model alignment
Adversarial threat taxonomy
Integrated safety & security
Secure AI Framework
AI security framework
ML-specific threats