AML.T0010.003
Model

MITRE source definition

AI-enabled systems often rely on open-source models in various ways. Most commonly, the victim organization may be using these models for fine-tuning. These models will be downloaded from an external source and then used as the base for the model as it is tuned on a smaller, private dataset. Loading models often requires executing some saved code in the form of a saved model file. These can be compromised with traditional malware, or through some adversarial AI techniques.

Source modified 2026-05-27. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

• AML.T0010 AI Supply Chain Compromise — parent

Source-backed defensive context

MITRE mitigations

• AML.M0005 Control Access to AI Models and Data at Rest
• AML.M0006 Predictive AI Ensembles
• AML.M0008 Validate AI Model
• AML.M0013 Code Signing
• AML.M0017 AI Model Distribution Methods
• AML.M0035 AI Red Team

MITRE case studies

• AML.CS0013 Backdoor Attack on Deep Learning Models in Mobile Apps · Exercise
• AML.CS0019 PoisonGPT · Exercise
• AML.CS0023 ShadowRay: Hijacking Exposed Ray Clusters · Incident
• AML.CS0027 Organization Confusion on Hugging Face · Exercise
• AML.CS0064 Poisoned GGUF Templates: Inference-Time Supply Chain Attack · Exercise
• AML.CS0065 Model Namespace Reuse Supply Chain Attack · Exercise

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

No explicit relationship in this pinned source.