Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
The Microsoft AI Red Team performed a red team exercise on an internal Azure service with the intention of disrupting its service. This operation had a combination of traditional ATT&CK enterprise techniques such as finding valid account, and exfiltrating data -- all interleaved with adversarial ML specific steps such as offline and online evasion examples.
Why this record has no ERS
The red-team exercise observed real control failures (valid-account access, model and training-data exfiltration, adversarial examples confirmed on the production API), but the target is an unnamed internal Azure service whose function, users, exposure, and downstream reach are not stated. Tier, ORP, and architecture weights cannot be assigned without inventing system facts, so the record fails the boundary test of the scorability admission test.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-02 · primary evidence date 2020-01-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0010 (exercise) |
|---|---|
| Target | Internal Microsoft Azure Service |
| Actor | Microsoft AI Red Team |
| Primary evidence date | 2020-01-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Service disruption dos, Data exfiltration, Model evasion / bypass |
| Affected components | internal ML model service, model file and training data, inference API, adversarial examples |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Reconnaissance of Target ML ModelThe team first performed reconnaissance to gather information about the target ML model. | AML.TA0002 AML.T0000 |
| 2 | Gain Network Access via Valid AccountThe team used a valid account to gain access to the network. | AML.TA0004 AML.T0012 |
| 3 | Collect Model File and Training DataThe team found the model file of the target ML model and the necessary training data. | AML.TA0009 AML.T0035 |
| 4 | Exfiltrate Model and DataThe team exfiltrated the model and data via traditional means. | AML.TA0010 AML.T0025 |
| 5 | Craft White-Box Adversarial ExamplesUsing the target model and data, the red team crafted evasive adversarial data in an offline manner. | AML.TA0001 AML.T0043.000 |
| 6 | Access Target Model via Exposed APIThe team used an exposed API to access the target model. | AML.TA0000 AML.T0040 |
| 7 | Verify Adversarial Examples on ProductionThe team submitted the adversarial examples to the API to verify their efficacy on the production system. | AML.TA0001 AML.T0042 |
| 8 | Online Evasion of the ML ModelThe team performed an online evasion attack by replaying the adversarial examples and accomplished their goals. | AML.TA0011 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0010-azure-service-disruption; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0010 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-002.001 | Internal AI Network SegmentationExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-H-004.001 | User & Privileged Access ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-D-005.007 | Token, Tool-Use, Request-Parameter & Cost Spike Detection & AlertingExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-H-001 | Adversarial Robustness TrainingExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-014 | Ensemble Methods for RobustnessExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-2 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0010-azure-service-disruption), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-8. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |