NIST publishes 2025 adversarial machine learning taxonomy, AI 100-2 E2025

NIST published Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, catalogued as NIST AI 100-2 E2025, with the final version dated 24 March 2025. The report gives defenders a common vocabulary for attacks on AI systems and for the mitigations available against them.

What it is

The taxonomy is a hierarchy that sorts attacks by type of machine learning method, by the life-cycle stage at which the attack lands, and by the attacker's goals, objectives, capabilities and knowledge. Predictive AI attacks fall into evasion, poisoning and privacy classes; for generative AI, NIST adds misuse as a fourth class.

NIST intends the report to be a living document. It plans annual updates and maintains the text with the U.S. AI Safety Institute, the U.K. AI Security Institute, industry and academia. After release it posted a corrected PDF, and a June 2025 planning note flags an error on page x for a later revision.

What it requires

The report creates no duties. NIST frames it as voluntary guidance on identifying, addressing and managing adversarial machine learning risk, and it openly discusses where some existing mitigations fall short.

Its named audience is broad: anyone who designs, develops, deploys, evaluates or governs AI systems.

What security leaders should do

• Adopt the report's attack classes as the labels in AI threat models and red-team findings, so results compare across teams and suppliers.
• For generative AI applications, test for misuse alongside evasion, poisoning and privacy leakage.
• Ask model and platform vendors which of the listed mitigations they apply and where they consider those mitigations weak.
• Check the errata before quoting definitions in policy, and schedule a yearly refresh to match NIST's update cycle.