NIST's adversarial machine learning taxonomy (AI 100-2 E2025) explained

What the report is

NIST's Computer Security Resource Center lists AI 100-2 E2025, titled "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations," as a final publication dated March 2025. The CSRC announcement page says the item was created on March 20, 2025 and updated on March 24, 2025.

The abstract says the report provides a taxonomy of concepts and defines terminology for adversarial machine learning, abbreviated AML. The announcement says the report offers voluntary guidance on identifying, addressing and managing the risks tied to AML. Because the guidance is voluntary, the documents present it as a reference and not as a compliance requirement.

This guide draws only on the CSRC publication page and the CSRC announcement. It does not draw on the full text of the report. The detail below is therefore limited to what those two pages state.

Attack types for predictive AI and generative AI

The announcement splits the taxonomy by system type. For predictive AI, which it abbreviates PredAI, it lists evasion, poisoning and privacy attacks.

For generative AI, abbreviated GenAI, the announcement adds a fourth class. It lists evasion, poisoning, privacy and misuse attacks. Misuse appears only in the GenAI line. Neither page shows misuse as a separate class for predictive systems.

The publication page's keywords point to the same areas and name the systems of interest. They include abuse, data poisoning, evasion, attack mitigation, large language model, chatbot and privacy breach. Large language models and chatbots are the generative systems that the keywords call out.

The announcement says the taxonomy covers "the most widely studied and effective attacks in AML." That wording describes scope by how much research and evidence exists for an attack. It does not claim to list every possible attack.

Learning methods and data types

The taxonomy is not limited to one way of building models. The announcement says it covers attacks against all viable learning methods, and it names supervised, unsupervised, semi-supervised, federated and reinforcement learning. It adds that this covers multiple data modalities.

For a security team, the learning method and the data type are properties of the system under review. The documents list them as part of the taxonomy's coverage. The publication page says the hierarchy includes "key types of ML methods," so the method used is one of the hierarchy's organizing points.

Lifecycle stages and attacker attributes

The abstract describes the hierarchy as having three layers: key types of ML methods, life cycle stages of attack, and attacker goals, objectives, capabilities and knowledge. That is the clearest statement in these documents of how the taxonomy is organized.

The two pages do not name the individual lifecycle stages, so this guide does not list them. A reader who needs the stage names has to open the report itself.

The abstract also says the report identifies current challenges in the life cycle of AI systems. It describes mitigations as matched to those challenges. This means the lifecycle appears in two roles. One is the point in a system's life at which an attack happens. The other is the set of challenges that mitigations address.

The announcement states the consequence of getting this wrong. It says the consequences of attacks become more dire when systems depend on high-stakes domains and face adversarial attacks.

Using the taxonomy for threat modeling

The documents do not set out a threat-modeling method, a scoring scheme or a step-by-step procedure. They do say who the report is for and what it is meant to supply.

The announcement names the primary audience as individuals and groups responsible for designing, developing, deploying, evaluating and governing AI systems. That list covers both engineering and oversight roles, so the report is aimed at more than one team.

The announcement says the report offers standardized terminology for use by the ML and cybersecurity communities. It also lists an index and glossary to help readers understand, navigate and reference the taxonomy.

The abstract states the purpose directly. The taxonomy and terminology are meant to inform other standards and future practice guides for assessing and managing AI security by establishing a common language.

From these statements, the structure the documents describe gives a team the headings that an entry in a threat model would need to name. These are the system type (predictive or generative), the learning method, the attack class, the lifecycle stage, and the attacker's goals, capabilities and knowledge. Mapping those headings onto an internal process is the team's own work. The documents do not describe such a mapping.

Mitigations and their limits

The announcement lists a discussion of potential mitigations in AML, together with the limitations of some existing mitigation techniques. The mitigation material is therefore framed with stated limits, not as a set of fixes that work in every case.

The abstract says the report describes methods for mitigating and managing the consequences of attacks. The phrase "managing the consequences" covers what happens when an attack is not prevented. Neither page names specific mitigation techniques, so this guide cannot say which ones the report covers.

Authors, status and corrections

The publication page lists the authors, including Xander Davies of the U.K. AI Security Institute and Maia Hamin of the U.S. AI Safety Institute. The announcement says NIST is working with partners from the U.S. AI Safety and U.K. AI Security Institutes, industry and academia to develop and maintain the report.

The announcement also says NIST plans to update the report annually as new developments emerge. A team that adopts the taxonomy should expect the attack classes and mitigations to be revised in later editions.

The publication page carries two planning notes. The note dated 4/1/25, as the page writes it, says a corrected version of the PDF was uploaded. The note dated 6/3/25, as the page writes it, says an error was identified on page x of the report. The page links a list of potential updates for a future revision. A team citing the report should check that errata list against the version it is using.