Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
MITRE's AI Red Team demonstrated a physical-domain evasion attack on a commercial face identification service with the intention of inducing a targeted misclassification. This operation had a combination of traditional MITRE ATT&CK techniques such as finding valid accounts and executing code via an API - all interleaved with adversarial ML specific attacks.
Why this record has no ERS
MITRE ATLAS AML.CS0012 documents a red-team evasion of an unnamed commercial face identification service but neither names the system nor states its deployment configuration (what the identification decision drives, who operates the capture environment, its autonomy, or its downstream reach). No bounded assessed system or representative configuration can be defined without inventing ORP and boundary facts, so the record fails the boundary test of the scorability admission test; the observed physical-patch evasion is retained as a candidate Ro-1 evidence route.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-06 · primary evidence date 2020-01-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0012 (exercise) |
|---|---|
| Target | Commercial Face Identification Service |
| Actor | MITRE AI Red Team |
| Primary evidence date | 2020-01-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Model evasion / bypass |
| Affected components | commercial face identification service, inference API, proxy face model, physical adversarial patch |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Reconnaissance of Target ML ModelThe team first performed reconnaissance to gather information about the target ML model. | AML.TA0002 AML.T0000 |
| 2 | Access Service via Valid AccountThe team gained access to the commercial face identification service and its API through a valid account. | AML.TA0004 AML.T0012 |
| 3 | Access Inference APIThe team accessed the inference API of the target model. | AML.TA0000 AML.T0040 |
| 4 | Discover Target IdentitiesThe team identified the list of identities targeted by the model by querying the target model's inference API. | AML.TA0008 AML.T0013 |
| 5 | Acquire Open Source DataThe team acquired representative open source data. | AML.TA0003 AML.T0002.000 |
| 6 | Develop Proxy Face ModelThe team developed a proxy model using the open source data. | AML.TA0001 AML.T0005 |
| 7 | Optimize Physical Adversarial PatchUsing the proxy model, the red team optimized adversarial visual patterns as a physical domain patch-based attack using expectation over transformation. | AML.TA0001 AML.T0043.000 |
| 8 | Print Physical PatchThe team printed the optimized patch. | AML.TA0003 AML.T0008.003 |
| 9 | Place Countermeasure in EnvironmentThe team placed the countermeasure in the physical environment to cause issues in the face identification system. | AML.TA0000 AML.T0041 |
| 10 | Evade Face Identification SystemThe team successfully evaded the model using the physical countermeasure by causing targeted misclassifications. | AML.TA0011 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0012-face-id-physical-countermeasure-evasion; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0012 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-H-006.003 | Prediction Response Minimization & Extraction-Resistance ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-3 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-D-002.001 | Input / Output Distribution Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |
| AID-H-001 | Adversarial Robustness TrainingExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-014 | Ensemble Methods for RobustnessExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-2 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0012-face-id-physical-countermeasure-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |