AIDEFEND
Defensive technique catalogueAIDEFEND (AI Defense Framework) · Edward Lee (independent, community-driven; CC BY 4.0)
AIDEFEND is an independent open-source catalogue current to data version 2026.10.15 (schema 2.3; 93 families / 274 sub-techniques / 367 records / 309 actionable controls) across seven D3FEND-inspired tactics. AITBM maps verified implementation and effectiveness evidence to applicable rubrics; a technique has no inherent anchor or fixed ERS reduction.
| AIDEFEND Tactic | Primary AITBM Sub-Metrics | Evidence Use / Notes |
|---|---|---|
| Model (10 techniques) | Tr-4Ro-4Cn-1Cn-2Cn-5Cn-6 | AID-M-009 may supply authority, scope, identity, and action-gating evidence |
| Harden (38 techniques) | Ro-1Cn-1Cn-2Cn-3Cn-5Cn-6 | AID-H-018 may supply measured permission-enforcement evidence |
| Detect (18 techniques) | Ro-1Ro-3Cn-1Cn-2Cn-5Cn-6Tr-3 | AID-D-011 may supply behavior, containment, audit, and monitoring evidence |
| Isolate (8 techniques) | Cn-1Cn-4 | Primarily reduces ORP/CRM, not IVP |
| Deceive (7 techniques) | Tr-3 | Decoy telemetry may support detection and audit evidence; no fixed ERS change |
| Evict (5 techniques) | Cn-2 | AID-E-005 auto session termination lowers ORP Rf |
| Restore (7 techniques) | Cn-2Tr-4 | AID-R-001 versioning/rollback improves ORP Rf |
Key findings
- In the AIDEFEND worked scenario, agentic containment controls (Cn-1, Cn-2, Cn-5, Cn-6) deliver the highest modeled risk reduction: the six agentic-focused techniques account for approximately 55% of the scenario's ERS-reduction capacity. AID-H-018 Permission Restriction (-5.8) and AID-M-009 Autonomy Governance (-5.4) provide high-leverage containment evidence, including Cn-5 and Cn-6.
- The AIDEFEND worked example is a dated scenario, not a control-to-score conversion. Its prior-basis Cp and ERS arithmetic are retained under the worked-example policy; current assessments use GDCP, Cn-6, Cn-7, BAW, and Section 5.
- Drift/anomaly detection (AID-D-002) and Restore techniques are essential for sustaining the ACI Temporal Freshness (Tf) and ORP Remediation Feasibility (Rf) components, linking controls to AITBM's temporal model.
- The mapping is reconciled against AIDEFEND data version 2026.10.15 (schema 2.3; 93 families / 274 sub-techniques / 367 records / 309 actionable controls), re-pinned on 18 October 2026 from 2026.09.20. That update added AID-H-004.006 and AID-H-004.007, which inherit the AID-H-004 placements, and changed 77 existing records (60
defendsAgainstrelationship arrays); the prior 2026.09.20 version changed six core controls, including AID-H-021.004, and 348 relationship arrays. These metadata changes are candidate-evidence routes only and confer no score credit; no placement changed. - The mapping is 185 placements using 78 distinct technique families (average 7.1), covering all 26 AITBM sub-metrics. The six changed core controls are AID-D-011.001, AID-H-002.002, AID-H-005.003, AID-H-006.003, AID-H-007.005, and AID-H-021.004; they do not create new AITBM placements or credit. Sixteen Cn-7 families route to 29 exact actionable selectors; BEC, RBVR, LTFR, and GDSR results determine score credit.
- A coverage extension at the same data version (July 30, 2026) maps seven further previously unmapped techniques — AID-H-019 Safe Fetch & Web Content Admission for Agents, AID-H-022 Dependency Change Vetting & Sandboxed Installation, AID-H-023 Publisher Integrity & Workflow Hardening, AID-I-003 Quarantine & Throttling of AI Interactions, AID-I-007 Client-Side AI Execution Isolation, AID-M-005 AI Secure Configuration Baselines & Release Gates, and AID-DV-002 Honey Data, Decoy Artifacts & Canary Tokens for AI — completing Model-tactic utilization at 10 of 10 and raising Harden to 36 of 38, Isolate to 6 of 8, and Deceive to 2 of 7; AID-E-004 and AID-R-004 were evaluated and recorded as ORP (Remediation Feasibility) and ACI evidence with no sub-metric placement.