Back to the AI Control Library
11 controls | 11 core | 0 supplemental
Why this family matters
An attacker may target the model itself rather than the application around it. This family addresses attacks on model behavior, confidentiality, integrity and availability, including threats introduced during training or through the model supply chain. It complements broader application and infrastructure security.
What this family covers
The controls cover training-pipeline security, evasion, poisoning, inversion, membership inference, extraction, backdoors and adversarial inputs. They also address production integrity, inference API abuse, denial of service and supply-chain tampering.
How the four control types apply
Technical controls protect model integrity, confidentiality and availability. Operational controls establish the assessment, monitoring and response practices that keep those protections effective. The model's use and exposure determine relevant contextual conditions; applicable external requirements provide the Governance dimension.
Where to begin
Identify which model assets and attack paths matter in the deployment, then test prevention and detection against those threats.
Controls in this family
This family contains 11 controls: 11 core and 0 supplemental. Each page provides requirements, implementation steps, verification criteria, evidence, escalation and a worked example. Applicability depends on the system, information and risks involved.
Core controls
- CF13-001: AI Training Pipeline Security
- CF13-002: Evasion Attack Resistance
- CF13-003: Data Poisoning Attack Prevention & Detection
- CF13-004: Model Inversion & Membership Inference Defense
- CF13-005: Model Extraction & Theft Prevention
- CF13-006: Backdoor Attack Detection & Prevention
- CF13-007: Runtime Adversarial Input Detection
- CF13-008: Production Model Integrity Monitoring
- CF13-009: Model Inference API Abuse Detection
- CF13-010: Model Denial of Service Defense
- CF13-011: Model Supply Chain Tampering Defense
Applying this family
Assess attacks against the actual model assets, interfaces and lifecycle. Combine trusted provenance and controlled training with targeted adversarial evaluation, production integrity monitoring and proportionate abuse response. Distinguish prevention, detection and recovery, and record the limitations of each test.
Version 1.0