Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — AI Model Tampering via Supply Chain Attack
- MITRE ATLAS case study AML.CS0028
- Silent Sabotage: Weaponizing AI Models in Exposed Containers (trendmicro.com)
- Exposed Container Registries: A Potential Vector for Supply-Chain Attacks (trendmicro.com)
- Mining Through Mountains of Information and Risk: Containers and Exposed Container Registries (trendmicro.com)
- The Growing Threat of Unprotected Container Registries: An Urgent Call to Action (dreher.in)
Incident overview
Researchers at Trend Micro, Inc. used service indexing portals and web searching tools to identify over 8,000 misconfigured private container registries exposed on the internet. Approximately 70% of the registries also had overly permissive access controls that allowed write access. In their analysis, the researchers found over 1,000 unique AI models embedded in private container images within these open registries that could be pulled without authentication.
This exposure could allow adversaries to download, inspect, and modify container contents, including sensitive AI model files. This is an exposure of valuable intellectual property which could be stolen by an adversary. Compromised images could also be pushed to the registry, leading to a supply chain attack, allowing malicious actors to compromise the integrity of AI models used in production systems.
Why this record has no ERS
Trend Micro observed exposed registries with AI model images, including Smart City providers, and simulated model tampering. It did not observe an admitted tampered model or identify one deployed victim model path with measured admission controls; no bounded workload inherits a score.
Status: Not scorable by design · Classification: Validated Research · source date 2026-08-02 · primary evidence date 2023-09-26
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0028 (exercise) |
|---|---|
| Target | Private Container Registries |
| Actor | Trend Micro Nebula Cloud Research Team |
| Primary evidence date | 2023-09-26 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | AI supply chain |
| Risk impact | Data corruption |
| Affected components | private container registries, container images with embedded AI models, model weights and architecture files, automated CI/CD deployment pipeline |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Discover Exposed Private Container RegistriesThe Trend Micro researchers used service indexing portals and web searching tools to identify over 8,000 private container registries exposed on the internet. Approximately 70% of the registries had overly permissive access controls, allowing write permissions. The private container registries encompassed both independently hosted registries and registries deployed on Cloud Service Providers (CSPs). The registries were exposed due to some combination of: - Misconfiguration leading to public access of private registry, - Lack of proper authentication and authorization mechanisms, and/or - Insufficient network segmentation and access controls | AML.TA0002 AML.T0004 |
| 2 | Pull Container Images Without AuthenticationThe researchers were able to exploit the misconfigured registries to pull container images without requiring authentication. In total, researchers pulled several terabytes of data containing over 20,000 images. | AML.TA0004 AML.T0049 |
| 3 | Find AI Models Embedded in ImagesThe researchers found 1,453 unique AI models embedded in the private container images. Around half were in the Open Neural Network Exchange (ONNX) format. | AML.TA0008 AML.T0007 |
| 4 | Gain Full Access to Model ArtifactsThis gave the researchers full access to the models. Models for a variety of use cases were identified, including: - ID Recognition - Face Recognition - Object Recognition - Various Natural Language Processing Tasks | AML.TA0000 AML.T0044 |
| 5 | Steal Model Intellectual PropertyWith full access to the model(s), an adversary has an organization's valuable intellectual property. | AML.TA0011 AML.T0048.004 |
| 6 | Manipulate Model WeightsWith full access to the model weights, an adversary could manipulate the weights to cause misclassifications or otherwise degrade performance. | AML.TA0006 AML.T0018.000 |
| 7 | Modify Model ArchitectureWith full access to the model, an adversary could modify the architecture to change the behavior. | AML.TA0006 AML.T0018.001 |
| 8 | Push Tampered Image Under Original TagBecause many of the misconfigured container registries allowed write access, the adversary's container image with the manipulated model could be pushed with the same name and tag as the original. This compromises the victim's AI supply chain, where automated CI/CD pipelines could pull the adversary's images. | AML.TA0004 AML.T0010.004 |
| 9 | Deploy Tampered Model and Misclassify InputsOnce the adversary's container image is deployed, the model may misclassify inputs due to the adversary's manipulations. | AML.TA0011 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0028-ai-model-tampering-container-registry; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0028 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-002.001 | Internal AI Network SegmentationExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-M-005.002 | Policy-as-Code Configuration Baselines & Posture Release GatesExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-9 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-H-004.002 | Service & API AuthenticationExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-H-004.001 | User & Privileged Access ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-2, step-8. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-013.003 | Black-Box Behavioral Ownership FingerprintingExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-4 Pr-1 |
| AID-H-003.002 | CI/CD Release Gating, Model Artifact Signing & Secure DistributionExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-H-003.006 | Model SBOM & Provenance AttestationExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-D-002.001 | Input / Output Distribution Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-D-004.001 | Static Artifact Integrity Re-verification & Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-R-001.001 | Versioned Model Rollback & RestorationExact SecureFlow defense-map identifier (flow atlas-aml-cs0028-ai-model-tampering-container-registry), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-4 |
Related AITBM rubrics
Sources
- AIDEFEND SecureFlow — AI Model Tampering via Supply Chain Attack
- MITRE ATLAS case study AML.CS0028
- Silent Sabotage: Weaponizing AI Models in Exposed Containers (trendmicro.com)
- Exposed Container Registries: A Potential Vector for Supply-Chain Attacks (trendmicro.com)
- Mining Through Mountains of Information and Risk: Containers and Exposed Container Registries (trendmicro.com)
- The Growing Threat of Unprotected Container Registries: An Urgent Call to Action (dreher.in)