fix(atlas): correct eleven MITRE ATLAS technique citations

[emmanuelgjr]

Applies the eleven MITRE ATLAS citation corrections from GenAI-Security-Project/GenAI-Data-Security-Initiative#65 to this repository's current mapping files.

The eleven corrections

Renames: identifier right, label superseded

Identifier	Was	ATLAS 2026.07
AML.T0020	Poison Training Data	Training Data Poisoning
AML.T0029	Denial of ML Service	Denial of AI Service
AML.T0013	Discover ML Model Ontology	Discover AI Model Ontology
AML.T0018	Backdoor ML Model	Manipulate AI Model
AML.T0025	Exfiltrate via Cyber Means	Exfiltration via Cyber Means
AML.T0024.000	Membership Inference	Infer Training Data Membership

Identifier errors: label right, identifier wrong

Label	Was	Now	Why
Data from Information Repositories	AML.T0057	AML.T0036	AML.T0057 is LLM Data Leakage
Exploit Public-Facing Application	AML.T0051	AML.T0049	AML.T0051 is LLM Prompt Injection
Craft Adversarial Data	AML.T0031	AML.T0043	AML.T0031 is Erode AI Model Integrity
Exfiltration via AI Inference API	AML.T0016	AML.T0024	AML.T0016 is Obtain Capabilities
Valid Accounts	AML.T0022	AML.T0012	AML.T0022 is not in the release

Release pin

ATLAS-2026.07.yaml from mitre-atlas/atlas-data tag v2026.07, dist/v6/. sha256 0e07bb07fc6423d72cdf24ddc2038a6905bcbc00ba571064153119ee1a5888d4, 194 techniques. I checked every new label and identifier above against that file.

Per-file counts

"Pair rows" are table rows that carry one of the eleven wrong ID and name pairs. "Other lines" are summary identifier lists, Counter AML.Txxxx bullets, prose and the priority table, where they cite the same identifiers.

File	Pair rows	Other lines	Total lines changed
agentic-top10/Agentic_MITREATLAS.md	5 (T0029 ×1, T0016→T0024 ×2, T0022→T0012 ×2)	2 (ASI03, ASI07 summaries)	7
dsgai-2026/DSGAI_MITREATLAS.md	51 (T0020 ×6, T0029 ×2, T0013 ×2, T0018 ×3, T0025 ×10, T0024.000 ×6, T0057→T0036 ×10, T0051→T0049 ×8, T0031→T0043 ×4)	51	102
llm-top10/LLM_MITREATLAS.md	1 (T0029)	0	1
ast-top10/	0, no ATLAS citations	0	0

Each file also gets one changelog row, following CONTRIBUTING step 5.

After regeneration, 25 entry files change: 23 control_id, 25 control_name and 4 url values. data/backlinks.json, docs/backlinks.js, docs/data.js, docs/incidents.js and docs/frameworks-registry.js change too. The last two differ only in the Generated: date stamp.

How it was applied

The mapping files here have diverged from the monorepo copy, so I didn't replay the patch. I took each line pair from the monorepo diff and applied it to the current files, with two assertions:

• each old line occurs here exactly as many times as it did in the monorepo pre-image
• no old line survives in the monorepo post-image

A second pass checked that every changed line differs from the original only by the eleven substitutions. There were 0 unexplained lines.

Identifiers that appear with other labels were left alone:

• AML.T0057 as "Exploit Public-Facing ML Application" in Agentic
• AML.T0016 as "Extract ML Model" in DSGAI
• AML.T0051.000/.001

Verification

• node scripts/generate.js: regenerated outputs are committed. A rerun leaves data/entries docs/data.js docs/incidents.js unchanged.
• node scripts/validate.js: 0 errors, 84 warnings, 312 passed. The output is byte-identical to main at 490a7e4.
• npm run stats:check: data/stats.json and README.md are current.
• npm run test:scripts: 50/50 pass, and the tree is clean afterwards.
• The commit is signed.

Heads-up

• Regeneration conflicts: Fix: the last entry in a mapping file swallowed the file's closing tables (22 junk mappings, 22 junk registry controls) #90 also changes generated output (data/backlinks.json, data/entries/DSGAI21.json, docs/data.js, docs/backlinks.js, docs/frameworks-registry.js). Whichever merges second will likely need node scripts/generate.js rerun rather than a hand merge.
• Date stamps: generate.js writes today's date into the bundles, so the CI step "Assert generated output is current" passes only on the day the bundles were generated (UTC). T-ENG03: make the webapp data bundles deterministic #37 addresses that.

Follow-ups (not in this PR)

• ASI03 duplicate: ASI03 now has two rows on AML.T0024, the corrected "Exfiltration via AI Inference API" and the existing "Model Inversion". The release has no technique called Model Inversion, so that row is wrong on both halves. The same "Model Inversion / AML.T0024" row is also in LLM_MITREATLAS.md.
• Missing ID: AML.T0027 is cited as "Model Inversion" in LLM and DSGAI, but it is not in the release.
• Wrong labels on other IDs:
  • "Exploit Public-Facing ML Application" is cited as AML.T0057 in Agentic, twice.
  • "Obtain Capabilities" is cited as AML.T0012 in DSGAI; AML.T0012 is Valid Accounts.
  • "Extract ML Model" is cited as AML.T0016 in DSGAI.
  • "Exfiltrate via ML Inference API" is cited as AML.T0035 in DSGAI.
  • "Backdoor ML Model" is cited as AML.T0010 (Agentic, LLM) and AML.T0031 (LLM).
  • "Network Service Scanning" is cited as AML.T0043 in Agentic.
  • "Spearphishing via AI" is cited as AML.T0049 in Agentic.
  • "Backdoor via Poisoned Memory" is cited as AML.T0020 in Agentic.
  • "Resource Exhaustion via Embedding" is cited as AML.T0025 in LLM.
  • Monorepo [new-research] arXiv:2609.05329 — Machine Unlearning as Private Retroactive Algorithms #65 also noted AML.T0015 recorded as LLM Capability Escalation (the release says Evade AI Model) and AML.T0056 recorded as Adversarial Model Manipulation (the release says Extract LLM System Prompt).
• Registry: data/frameworks/mitre-atlas.json still has an AML.T0022 "Valid Accounts" control, and its AML.T0024 title is "Exfiltration via ML Inference API".
• Eval configs still use the old labels:
  • evals/pyrit/asi04_supply_chain.py, dsgai04_rag_poisoning.py and dsgai17_bias_detection.py
  • evals/garak/ASI08_cascade_failure.yaml, LLM05_data_poisoning.yaml and LLM06_resource_exhaustion.yaml
  • evals/laaf/stage_configs/s2.yaml
• Line-wrapped prose: the DSGAI17 intro still says "Denial of ML Service" across a line break.

Ported from GenAI-Security-Project/GenAI-Data-Security-Initiative#65 by @astrogilda (that copy of crosswalk/ has since been removed).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KJVKF6raJCNKBWjTkDSqR4

[emmanuelgjr]

Cross-reference: #93 checks every MITRE ATLAS mapping row against ATLAS 2026.08, plus all legacy releases back to 2.0.0. This PR covers 25 of the 81 mismatched rows it found.

One pair in the same class as this PR's identifier errors is not included: 14 rows in dsgai-2026/DSGAI_MITREATLAS.md cite AML.T0035 as Exfiltrate via ML Inference API. ATLAS AML.T0035 is AI Artifact Collection; the named technique is AML.T0024 (Exfiltration via AI Inference API). Whether to add it here or leave it to #93 is the author's call.

#93 also lists 17 technique names that have never appeared in any ATLAS release (e.g. LLM Capability Escalation, Model Contamination), and 21 wrong titles in data/frameworks/mitre-atlas.json. Those need SME review, so they're outside a mechanical fix.