Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
The Azure Red Team performed a red team exercise on a new Microsoft product designed for running AI workloads at the edge. This exercise was meant to use an automated system to continuously manipulate a target image to cause the ML model to produce misclassifications.
Why this record has no ERS
The target is an unnamed new Microsoft product for edge AI workloads with no stated configuration, exposure, autonomy, or downstream reach, and the query and perturbation steps were run against the publicly available version of the base model. The record does not establish that the misclassification was observed on the deployed product, so it fails the boundary test of the scorability admission test.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-02 · primary evidence date 2020-02-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0011 (exercise) |
|---|---|
| Target | New Microsoft AI Product |
| Actor | Azure Red Team |
| Primary evidence date | 2020-02-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision, Edge and client AI |
| Risk impact | Model evasion / bypass |
| Affected components | edge AI image classification model, publicly available base model, inference API, adversarial image perturbations |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Reconnaissance of Target ML ModelThe team first performed reconnaissance to gather information about the target ML model. | AML.TA0002 AML.T0000 |
| 2 | Acquire Publicly Available Base ModelThe team identified and obtained the publicly available base model to use against the target ML model. | AML.TA0003 AML.T0002 |
| 3 | Query Public Model via Inference APIUsing the publicly available version of the ML model, the team started sending queries and analyzing the responses (inferences) from the ML model. | AML.TA0000 AML.T0040 |
| 4 | Craft Adversarial Image PerturbationsThe red team created an automated system that continuously manipulated an original target image, that tricked the ML model into producing incorrect inferences, but the perturbations in the image were unnoticeable to the human eye. | AML.TA0001 AML.T0043.001 |
| 5 | Evade ML Model via MisclassificationFeeding this perturbed image, the red team was able to evade the ML model by causing misclassifications. | AML.TA0011 AML.T0015 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0011-microsoft-edge-ai-evasion; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0011 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-003.002 | Identity, Session & API Rate-Limit ThrottlingExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 Cn-7 |
| AID-H-006.003 | Prediction Response Minimization & Extraction-Resistance ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-3 |
| AID-D-005.007 | Token, Tool-Use, Request-Parameter & Cost Spike Detection & AlertingExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-001 | Adversarial Robustness TrainingExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-014 | Ensemble Methods for RobustnessExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-2 |
| AID-H-015 | Certified DefensesExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-002.002 | Labeled Performance Tracking with Ground Truth Feedback LoopExact SecureFlow defense-map identifier (flow atlas-aml-cs0011-microsoft-edge-ai-evasion), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-2 Fa-1 Fa-2 Tr-2 Cn-7 |