MITRE ATLAS: 81 of 117 mapping rows pair an id with another technique's name; 6 ids do not exist (checked against ATLAS 2026.08)

[emmanuelgjr]

Found while triaging #83 (the weekly watcher's "MITRE ATLAS content change"). That trigger was only a homepage ETag change, but it prompted a check against the actual ATLAS data. Nothing is changed here: which technique each row meant is a mapping judgment (C4).

Method

• Source: mitre-atlas/atlas-data tag v2026.08 (published 2026-09-01), file dist/v6/ATLAS-2026.08.yaml, with 197 techniques and sub-techniques.
• Legacy names: unmatched names were also checked against every legacy release in dist/legacy/ (ATLAS 2.0.0 → 5.6.0), so that an old-but-real name is not reported as wrong.
• Normalisation: case, punctuation, the ATLAS "ML"→"AI" rename, and "Exfiltrate"/"Exfiltration" are ignored.
• Scope: all 117 MITRE ATLAS mapping rows in data/entries, and the 50 items in data/frameworks/mitre-atlas.json.

Findings

1. 81 of 117 ATLAS mapping rows pair an id with a name that ATLAS gives to a different technique

This is in the authored Markdown, not the parser. For example, dsgai-2026/DSGAI_MITREATLAS.md reads | Exfiltrate via ML Inference API | AML.T0035 | …, while ATLAS AML.T0035 is AI Artifact Collection and the named technique is AML.T0024.

The rows fall into three groups:

Group	Rows	What it means	Suggested handling
A. Real technique, wrong id	41	The name is a current ATLAS technique under another id, e.g. Data from Information Repositories → AML.T0036, not AML.T0057	SME confirms the name was the intent, then the id is corrected
B. Legacy ATLAS name	~8	The name was a real ATLAS technique in an earlier release: Backdoor ML Model = AML.T0018 (now Manipulate AI Model), Extract ML Model = AML.T0024.002, Publish Poisoned Datasets = AML.T0019 (not in 2026.08), Model Inversion ≈ Invert ML Model AML.T0024.001	Correct the id where it differs; update to the current name
C. Never an ATLAS technique name	~32	The name does not appear in any ATLAS release since 2.0.0	SME picks a real ATLAS technique, or removes the row

Group C names, none of which appear in any ATLAS release: Output Manipulation, LLM Capability Escalation, Adversarial Model Manipulation, Model Contamination, Unsafe Deserialisation via LLM, Data Poisoning, Embedding Manipulation, Exploit Public-Facing ML Application, Disinformation, Influence via Automated Content, Backdoor via Poisoned Memory, Network Service Scanning, Spearphishing via AI, Data Leakage, Information Disclosure, Configuration Exposure, Resource Exhaustion via Embedding.

2. Six ids used in mappings do not exist in ATLAS 2026.08

AML.T0019, AML.T0022, AML.T0027, AML.T0030, AML.T0032, AML.T0045: 10 rows in total. AML.T0019 existed until 5.6.0. None of the other five appear as technique ids in any release.

3. The registry data/frameworks/mitre-atlas.json is wrong in the same way

• 14 items match ATLAS exactly, and 9 differ only by the ML→AI rename.
• 21 carry the name of a different technique. AML.T0000 is titled ML Model Access, but ATLAS calls it Search Open Technical Databases; AML.T0053 is titled Discover ML Model Ontology, but ATLAS calls it AI Agent Tool Invocation.
• 6 ids don't exist, as listed above.

These titles ship in the npm package, docs/frameworks-registry.js and the OSCAL catalog export.

4. Freshness

• Our version: the registry says version: "4.0", last_synced: 2026-04-10, and data/framework-sources.json has current_version: null (unchecked).
• Upstream: ATLAS now publishes monthly data releases (v2026.05 … v2026.08) with a 6.0.0 data format.

Proposed sequence (agent-safe steps marked)

1. (agent-safe, transcription) Regenerate mitre-atlas.json from ATLAS-2026.08.yaml: ids, names, tactics, kind: technique. Record version: "2026.08", and set framework-sources.json current_version.
2. (agent-safe) Add a validate.js check: every MITRE ATLAS mapping control_id must exist in the registry, and its control_name must match the registry title after normalisation.
3. (SME, C4) Rule on the rows in the table below: confirm the proposed id for groups A and B, and choose or remove for group C. Once the ruling is recorded, an agent can apply it mechanically.

Step 2 would fail CI until step 3 is done, so it should land together with step 3, or as a warning first.

Every mismatched (id, name) pair

Generated by comparing each row with ATLAS 2026.08. "ATLAS id for our name" uses current names plus the two documented sub-technique forms. See group B above for legacy names.

Rows	Id in our mapping	Name in our mapping	ATLAS 2026.08 name for that id	ATLAS id for our name	Entries
14	AML.T0035	Exfiltrate via ML Inference API	AI Artifact Collection	AML.T0024	DSGAI01, DSGAI02, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI10, DSGAI11, DSGAI12, DSGAI13, DSGAI14, DSGAI15, DSGAI16, DSGAI19
9	AML.T0057	Data from Information Repositories	LLM Data Leakage	AML.T0036	DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI12, DSGAI14, DSGAI16, DSGAI17, DSGAI19
7	AML.T0051	Exploit Public-Facing Application	LLM Prompt Injection	AML.T0049	DSGAI02, DSGAI03, DSGAI06, DSGAI08, DSGAI11, DSGAI12, DSGAI15
3	AML.T0037	Output Manipulation	Data from Local System	no ATLAS technique by this name	ASI02, ASI05, LLM10
3	AML.T0015	LLM Capability Escalation	Evade AI Model	no ATLAS technique by this name	ASI02, ASI10, LLM03
3	AML.T0031	Craft Adversarial Data	Erode AI Model Integrity	AML.T0043	DSGAI04, DSGAI05, DSGAI21
2	AML.T0068	Automated Collection	LLM Prompt Obfuscation	AML.T0126	ASI02, LLM03
2	AML.T0022	Valid Accounts	id does not exist	AML.T0012	ASI03, ASI07
2	AML.T0016	Exfiltration via AI Inference API	Obtain Capabilities	AML.T0024	ASI03, ASI07
2	AML.T0024	Model Inversion	Exfiltration via AI Inference API	no ATLAS technique by this name	ASI03, LLM02
2	AML.T0056	Adversarial Model Manipulation	Extract LLM System Prompt	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0048	Model Contamination	External Harms	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0010	Backdoor ML Model	AI Supply Chain Compromise	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0040	Unsafe Deserialisation via LLM	AI Model Inference API Access	no ATLAS technique by this name	ASI05, LLM10
2	AML.T0032	Data Poisoning	id does not exist	no ATLAS technique by this name	ASI06, LLM05
2	AML.T0063	Embedding Manipulation	Discover AI Model Outputs	no ATLAS technique by this name	ASI06, LLM09
2	AML.T0057	Exploit Public-Facing ML Application	LLM Data Leakage	no ATLAS technique by this name	ASI08, ASI10
2	AML.T0045	Disinformation	id does not exist	no ATLAS technique by this name	ASI09, LLM07
2	AML.T0047	Influence via Automated Content	AI-Enabled Product or Service	no ATLAS technique by this name	ASI09, LLM07
2	AML.T0012	Obtain Capabilities	Valid Accounts	AML.T0016	DSGAI02, DSGAI03
2	AML.T0018	Backdoor ML Model	Manipulate AI Model	no ATLAS technique by this name	DSGAI04, DSGAI05
2	AML.T0027	Model Inversion	id does not exist	no ATLAS technique by this name	DSGAI18, LLM05
1	AML.T0020	Backdoor via Poisoned Memory	Training Data Poisoning	no ATLAS technique by this name	ASI06
1	AML.T0043	Network Service Scanning	Craft Adversarial Data	no ATLAS technique by this name	ASI07
1	AML.T0049	Spearphishing via AI	Exploit Public-Facing Application	no ATLAS technique by this name	ASI09
1	AML.T0016	Extract ML Model	Obtain Capabilities	no ATLAS technique by this name	DSGAI20
1	AML.T0045	Publish Poisoned Datasets	id does not exist	no ATLAS technique by this name	DSGAI21
1	AML.T0021	Data Leakage	Establish Accounts	no ATLAS technique by this name	LLM02
1	AML.T0030	Information Disclosure	id does not exist	no ATLAS technique by this name	LLM02
1	AML.T0031	Backdoor ML Model	Erode AI Model Integrity	no ATLAS technique by this name	LLM05
1	AML.T0041	Configuration Exposure	Physical Environment Access	no ATLAS technique by this name	LLM08
1	AML.T0025	Resource Exhaustion via Embedding	Exfiltration via Cyber Means	no ATLAS technique by this name	LLM09

[emmanuelgjr]

Overlap with #92, opened in parallel from the monorepo's ATLAS corrections: #92 fixes 25 of the 81 mismatched rows in the table above. Those are the five identifier errors (T0057→T0036, T0051→T0049, T0031→T0043, T0016→T0024, T0022→T0012) and the T0018 Backdoor ML Model rename.

56 rows remain after #92. The largest single group is 14 DSGAI rows citing AML.T0035 as Exfiltrate via ML Inference API: ATLAS AML.T0035 is AI Artifact Collection, and the named technique is AML.T0024. Findings 2–4 (ids that don't exist, the registry titles, freshness) are not in #92's scope.

Remaining (id, name) pairs after #92:

Rows	Id in our mapping	Name in our mapping	ATLAS 2026.08 name for that id	ATLAS id for our name	Entries
14	AML.T0035	Exfiltrate via ML Inference API	AI Artifact Collection	AML.T0024	DSGAI01, DSGAI02, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI10, DSGAI11, DSGAI12, DSGAI13, DSGAI14, DSGAI15, DSGAI16, DSGAI19
3	AML.T0037	Output Manipulation	Data from Local System	no ATLAS technique by this name	ASI02, ASI05, LLM10
3	AML.T0015	LLM Capability Escalation	Evade AI Model	no ATLAS technique by this name	ASI02, ASI10, LLM03
2	AML.T0068	Automated Collection	LLM Prompt Obfuscation	AML.T0126	ASI02, LLM03
2	AML.T0024	Model Inversion	Exfiltration via AI Inference API	no ATLAS technique by this name	ASI03, LLM02
2	AML.T0056	Adversarial Model Manipulation	Extract LLM System Prompt	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0048	Model Contamination	External Harms	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0010	Backdoor ML Model	AI Supply Chain Compromise	no ATLAS technique by this name	ASI04, LLM04
2	AML.T0040	Unsafe Deserialisation via LLM	AI Model Inference API Access	no ATLAS technique by this name	ASI05, LLM10
2	AML.T0032	Data Poisoning	id does not exist	no ATLAS technique by this name	ASI06, LLM05
2	AML.T0063	Embedding Manipulation	Discover AI Model Outputs	no ATLAS technique by this name	ASI06, LLM09
2	AML.T0057	Exploit Public-Facing ML Application	LLM Data Leakage	no ATLAS technique by this name	ASI08, ASI10
2	AML.T0045	Disinformation	id does not exist	no ATLAS technique by this name	ASI09, LLM07
2	AML.T0047	Influence via Automated Content	AI-Enabled Product or Service	no ATLAS technique by this name	ASI09, LLM07
2	AML.T0012	Obtain Capabilities	Valid Accounts	AML.T0016	DSGAI02, DSGAI03
2	AML.T0027	Model Inversion	id does not exist	no ATLAS technique by this name	DSGAI18, LLM05
1	AML.T0020	Backdoor via Poisoned Memory	Training Data Poisoning	no ATLAS technique by this name	ASI06
1	AML.T0043	Network Service Scanning	Craft Adversarial Data	no ATLAS technique by this name	ASI07
1	AML.T0049	Spearphishing via AI	Exploit Public-Facing Application	no ATLAS technique by this name	ASI09
1	AML.T0016	Extract ML Model	Obtain Capabilities	no ATLAS technique by this name	DSGAI20
1	AML.T0045	Publish Poisoned Datasets	id does not exist	no ATLAS technique by this name	DSGAI21
1	AML.T0021	Data Leakage	Establish Accounts	no ATLAS technique by this name	LLM02
1	AML.T0030	Information Disclosure	id does not exist	no ATLAS technique by this name	LLM02
1	AML.T0031	Backdoor ML Model	Erode AI Model Integrity	no ATLAS technique by this name	LLM05
1	AML.T0041	Configuration Exposure	Physical Environment Access	no ATLAS technique by this name	LLM08
1	AML.T0025	Resource Exhaustion via Embedding	Exfiltration via Cyber Means	no ATLAS technique by this name	LLM09