The U.S. National Institute of Standards and Technology (NIST) has released a draft security framework mapping adversarial machine learning attacks against agentic Super Intelligence systems, seeking to establish a common technical language for identifying threats and evaluating defenses. The document addresses vulnerabilities that could affect increasingly capable autonomous systems and gives organizations a structured way to understand attacks throughout the machine learning life cycle.
The public consultation runs through December 18, giving researchers, developers and security professionals an opportunity to identify emerging attack methods, propose effective mitigations and recommend terminology for standardization. According to Industrial Cyber, the draft combines an extensive review of existing research, consultations with specialists and work conducted by NIST researchers themselves.
NIST maps agentic threats
The document, identified as NIST SP 2400-102e2026, is titled Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. It establishes a conceptual hierarchy for classifying attacks according to the machine learning methods involved, the stages at which attacks occur and the objectives pursued by malicious actors.
Its particular relevance to agentic Super Intelligence comes from the growing complexity of systems that do more than generate predictions or content. Agentic systems can use tools and interact with their operating environments to perform tasks. Their security therefore depends not only on the underlying model but also on the surrounding software, information sources, permissions and operational processes.
NIST has incorporated two navigation resources into the document: an updated SI Attacks Taxonomy Index and a new Agentic SI Attacks Taxonomy Index. These indexes allow readers to locate individual attack categories and reference specific parts of the classification without having to navigate the entire conceptual structure manually.
The agency wants the taxonomy to provide a shared foundation for future standards and practical security guidance. Rather than presenting an exhaustive catalogue of every possible attack, the draft organizes established knowledge into a framework that can evolve as researchers discover new vulnerabilities and defensive techniques.
That distinction matters in a field where terminology varies between machine learning researchers, cybersecurity professionals, model developers and organizations deploying AI systems. A common vocabulary can help these groups describe the same threat consistently, even when their technical backgrounds and security priorities differ.
Three types of SI systems
A central feature of the NIST framework is its separation of predictive, generative and agentic Super Intelligence systems. The agency recognizes that these categories have different functions and consequently face different forms of adversarial pressure.
Predictive machine learning systems, referred to as PredML, process information to produce classifications, forecasts or other outputs. Generative Super Intelligence systems, identified as GenSI, produce content or other generated outputs. Agentic SI systems add the ability to operate through tools and processes, potentially taking actions beyond generating a response.
The classification also considers the complete environment in which these systems operate. NIST identifies several relevant components: the data used by a model, the model itself, the procedures for training and testing it, deployment processes and the wider software infrastructure into which it is integrated.
This broader approach is particularly important for GenSI deployments involving private information or external tools. A generative model might receive access to confidential organizational data, while another implementation could be authorized to interact with software capable of producing real-world consequences. In those situations, vulnerabilities extend beyond the model's ability to generate an inaccurate response.
NIST consequently classifies attacks through several dimensions rather than treating every incident as an isolated model vulnerability. The framework considers the type of SI system, the machine learning life cycle stage affected, the attacker's intended outcome, the capabilities and access available to that attacker, and the attacker's knowledge of the learning process and surrounding environment.
This approach provides a way to distinguish attacks that may look similar at first but exploit different weaknesses. An attempt to manipulate training information, for example, differs fundamentally from an attack that modifies inputs during deployment or exploits an application's access to external resources.
Attack methods across systems
The report identifies several established attack families affecting predictive and generative systems. For PredML systems, its taxonomy covers evasion, poisoning and privacy attacks. These categories represent different ways of compromising model behavior, manipulating the information on which a model relies or extracting information that should remain protected.
For GenSI systems, NIST identifies poisoning, direct prompting, information extraction, indirect prompt injection and model tampering. The inclusion of these categories reflects the different ways generative systems can be manipulated, including through their training data, instructions, information access and underlying model components.
The document also includes attacks against agentic SI systems in its classification. Its dedicated index is intended to make this part of the framework easier to navigate and reference, recognizing that agentic deployments introduce additional relationships between models, tools and operational environments.
One important distinction concerns the boundaries of adversarial machine learning. NIST explains that SI systems can also face conventional cybersecurity attacks, including attacks against the platforms hosting them. However, the draft concentrates on attacks specifically associated with machine learning rather than attempting to replace established cybersecurity classifications.
The distinction does not mean that the two areas can be managed independently. A weakness in the software infrastructure surrounding a model may influence the consequences of an adversarial attack, while an attack on the model may expose weaknesses in the wider deployment environment.
NIST's taxonomy therefore considers both the learning system and the context in which it operates. This includes software and infrastructure weaknesses that can affect system behavior even when the underlying model is not directly manipulated.
Training and deployment risks
Both predictive and generative systems can face attacks at multiple points during development and operation. According to the report, malicious actors may manipulate training datasets, including information collected from the internet for large-scale model development. They may also alter information or resources presented during inference, the process through which a trained model generates an output from new inputs.
Another method involves introducing adversarial perturbations or suffixes. These are deliberately constructed modifications intended to influence how a machine learning system processes information or responds to a request. Such techniques can target models during operation rather than requiring an attacker to alter their original training process.
NIST also identifies the insertion of TROJAN functionality into components used to build SI systems. A Trojan is malicious functionality concealed within an otherwise legitimate component. Its presence can compromise the behavior of a system even when organizations believe they are using a trusted model or development resource.
The growing use of pre-trained models creates another concern. Organizations can adopt an existing model directly or adapt it using additional datasets for specialized tasks. While this can reduce the work required to develop an application, it also means vulnerabilities present in the original model or its components may be carried into new deployments.
The agency's analysis emphasizes that the security of a system cannot be evaluated solely by inspecting its final output. Its development history, training information, testing procedures, deployment configuration and external dependencies can all influence its exposure to adversarial manipulation.
That life cycle perspective is particularly relevant to agentic systems, where an initially compromised model or manipulated instruction could interact with other components. NIST's framework gives organizations a way to consider where an attack enters a system and which properties an attacker is attempting to undermine.
Why perfect defenses remain impossible
A major finding in the report concerns the limitations of current defensive techniques. NIST distinguishes its approach from cryptographic security, where some algorithms can be formally demonstrated to satisfy security properties under specified conditions. Widely used machine learning algorithms do not have comparable information-theoretic security proofs.
Information-theoretic security refers to guarantees derived from mathematical principles rather than confidence based primarily on observed performance. In modern machine learning, the report notes, researchers have not established such guarantees for the algorithms widely used in SI systems.
The research landscape has also produced theoretical results showing limits on the effectiveness of certain mitigation approaches. Consequently, many defenses against adversarial machine learning attacks remain empirical: researchers and developers adopt them because testing indicates that they work in particular circumstances, not because they can guarantee protection against every possible attack.
This creates an ongoing problem for organizations deploying advanced systems. A defensive technique that successfully blocks known attacks may become less effective when attackers develop new methods. Its apparent success under current testing conditions does not establish that the same protection will hold against future techniques.
NIST also discusses research indicating that model-based detection cannot prevent every impermissible output. Other findings suggest that if a model retains any probability of producing an unwanted behavior, prompts may exist that can trigger it. An alignment process that reduces undesirable behavior without eliminating it therefore cannot guarantee immunity from adversarial prompting.
"perfect AML mitigations are not attainable"
— NIST report
The implications extend beyond individual attack techniques. They challenge the assumption that organizations can secure a model simply by adding enough filters, testing procedures or alignment measures. Defensive improvements can reduce exposure, but the theoretical research described in the document does not support claims of complete protection.
What the draft asks industry
NIST is requesting feedback in three principal areas. First, it wants information about the newest attacks threatening existing SI systems, with particular attention to agentic implementations. This request gives researchers and developers an opportunity to identify techniques that may not yet be adequately represented in the current classification.
Second, the agency is seeking information about effective mitigations for those attacks. It wants to understand which defensive methods currently work, how they perform against emerging techniques and where their limitations need to be documented more clearly.
Third, NIST is asking whether additional terminology should be standardized. This issue is important because inconsistent descriptions can complicate collaboration between machine learning specialists and cybersecurity teams, particularly when organizations need to communicate risks across different technical disciplines.
The consultation remains open until December 18. Responses could help the agency refine the attack categories, update its glossary and improve the usefulness of the indexes for organizations assessing agentic and other SI deployments.
The terminology section is deliberately presented as a starting point rather than a definitive dictionary. It draws on existing adversarial machine learning literature and supplies explanations intended to make the technical concepts accessible to readers who are not specialists in the field.
The report also acknowledges that the terminology used by different stakeholder communities does not always align. As SI systems become more widely adopted in enterprise and consumer applications, NIST considers it increasingly important to establish shared definitions that can support standards, security assessments and practical guidance.
Risk management beyond testing
The framework adopts concepts of security, resilience and robustness from the NIST SI Risk Management Framework. These concepts are evaluated through risk, understood as the degree to which an entity faces a potential threat and the seriousness of the consequences if that threat materializes.
Security concerns the protection of systems against threats. Robustness addresses their ability to maintain appropriate behavior under challenging conditions, while resilience concerns their capacity to withstand disruption and recover from adverse events. Together, these concepts provide a broader basis for examining adversarial machine learning vulnerabilities.
However, NIST deliberately avoids recommending a universal level of acceptable risk. Risk tolerance depends on the application, the organization deploying a system and the circumstances in which it is used. A model supporting a low-consequence task may require a different approach from one entrusted with sensitive information or consequential operational decisions.
The report also stops short of deciding how organizations should balance the benefits of deploying SI systems against evidence of growing attack diversity and the limitations of available defenses. Those decisions remain dependent on organizational circumstances and use cases.
For generative systems, some developers and application builders have already incorporated adversarial risk assessments into pre-deployment evaluation. One established approach is red teaming, a structured exercise in which testers deliberately attempt to expose weaknesses by acting like potential attackers.
NIST has separately produced an initial public draft of guidance for model developers addressing risks associated with misuse of foundation model capabilities, including evaluation before deployment. Foundation models are models trained on broad datasets that can subsequently support a range of applications, often through adaptation or additional instructions.
The agency has also developed risk profiles for generative SI systems aligned with its SI Risk Management Framework. These profiles may help developers and users identify and evaluate relevant risks, including those arising from adversarial attacks.
Resilience becomes essential
The theoretical limitations of machine learning defenses do not make pre-deployment testing pointless. NIST recognizes that adversarial evaluations can eliminate or reduce many potential attack paths, raising the effort, knowledge or capabilities an attacker would need to mount a successful operation.
However, the agency's analysis suggests that testing alone cannot provide sufficient protection for organizations developing models with potentially harmful capabilities or delegating significant trust to models in high-stakes environments. Additional practices may be needed to address the risks that remain after testing and mitigation.
The emphasis therefore shifts toward resilience and preparedness. Organizations should plan for the possibility that an attacker will eventually bypass some defenses, rather than treating the absence of detected vulnerabilities as evidence that a system is completely secure.
This means considering how systems will behave when an attack succeeds, how the organization will recognize compromised behavior and how it will manage the consequences. NIST's discussion points toward accepting that residual risk cannot always be eliminated and preparing operational responses accordingly.
The distinction is particularly important for agentic systems. A model with access to tools or external resources may have a different operational impact from one that only generates text. Security planning must therefore account for the actions a system can perform, the resources it can access and the consequences of failures or manipulation.
The report also cautions against treating adversarial machine learning as a complete security solution. Its techniques must work alongside established cybersecurity practices, including secure software development and protection of the infrastructure on which models depend.
Connecting AI and cybersecurity
NIST identifies the integration of adversarial machine learning defenses with conventional cybersecurity processes as an important unresolved area. Securing an SI deployment requires more than defending the model against manipulated data or prompts. Organizations must also protect the software, systems and platforms that enable the model to operate.
Secure software development practices can address vulnerabilities introduced through design, implementation and deployment. Adversarial machine learning techniques address attacks directed at the learning process and model behavior. Combining the two disciplines is necessary because weaknesses in either area can influence the overall security of a deployment.
The agency also raises the possibility that important security considerations may fall outside the established boundaries of both disciplines. As organizations introduce new SI capabilities, they will need to determine whether existing cybersecurity procedures adequately cover the risks created by those systems.
Robustness against adversarial attacks also has implications beyond conventional security. It can influence SI safety and other characteristics associated with trustworthy systems. NIST therefore treats adversarial machine learning as a distinct but interconnected discipline rather than a substitute for every other aspect of responsible system development.
This distinction has practical consequences for organizations building governance and assurance processes. An evaluation showing that a model resists certain adversarial prompts does not automatically establish that its software infrastructure is secure, that its actions are safe or that its behavior is appropriate in every deployment context.
The report argues that these relationships require further work. Better alignment between adversarial machine learning classifications, cybersecurity procedures and broader SI risk management could help organizations extend existing controls without assuming that traditional approaches cover every new threat.
Federal guidance expands
The new NIST draft follows other federal efforts to address the operational security of autonomous and AI-enabled systems. On October 16, NIST joined the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) in publishing ten voluntary practices for managing incidents during Super Intelligence training and evaluation.
That guidance addresses organizations responsible for training and evaluating frontier SI agents. It gives particular attention to pre-deployment systems operating with reduced safeguards, including circumstances in which an agent performs a significant action that its operators did not instruct it to take.
The ten practices are organized into five operational areas: preparation, detection, response, recovery and reporting. Their structure draws on established incident management approaches, including NIST Special Publication 800-61 Revision 3, which provides guidance for handling cybersecurity incidents.
The focus on incident handling complements the adversarial machine learning taxonomy. One effort classifies attacks and the defenses available against them; the other addresses how organizations should prepare for and respond to incidents involving autonomous systems during training and evaluation.
Before that joint publication, the NSA had issued guidance on applying zero trust principles to operational technology supporting defense, national security and critical infrastructure missions. Operational technology, or OT, refers to hardware and software used to monitor and control physical processes and industrial equipment.
The NSA guidance warns that adversaries are using SI capabilities to automate reconnaissance, accelerate exploit development and conduct cyber operations at greater speed and scale. Reconnaissance involves gathering information about potential targets and their systems before an attack. Faster automation can make these activities more efficient and increase the operational pressure on defenders.
Zero trust is a security approach that does not automatically trust users, devices or connections simply because they are inside an organization's network. Instead, access is continuously evaluated and verified according to established security requirements.
What happens next
NIST intends to revise the adversarial machine learning report as new attack techniques and mitigation methods emerge. The December 18 consultation deadline is the immediate milestone, with feedback expected to help determine whether the current taxonomy adequately reflects the threat landscape facing predictive, generative and agentic systems.
The three requested areas of feedback provide a clear indication of the agency's priorities: identifying newly emerging attacks, evaluating defenses that have demonstrated practical effectiveness and resolving inconsistencies in technical terminology. The dedicated agentic attack index will be particularly relevant as contributors examine whether existing classifications adequately describe systems that can interact with tools and external environments.
Organizations following the draft will also need to consider how its classifications fit into their existing security programs. The document is intended to inform future standards and practice guides, but it does not itself establish a universal risk tolerance or promise that following a particular mitigation strategy will prevent every attack.
The wider federal guidance effort offers an indication of the operational direction. Incident preparation, detection, containment, recovery and reporting are becoming important complements to model evaluation and conventional cybersecurity controls. For organizations deploying systems with external access or significant operational permissions, these measures address risks that cannot be resolved solely through improvements to model behavior.
Why it matters
NIST's draft highlights a fundamental security problem for agentic Super Intelligence: the systems organizations increasingly want to trust are also exposed to attacks that can exploit their data, models, development processes and operating environments. A model may perform well during evaluation yet remain vulnerable to techniques that were not anticipated or adequately tested.
The report's most consequential message is that defensive measures have theoretical limits. Organizations can improve protection, reduce attack opportunities and make exploitation more difficult, but current research does not support the expectation of perfect adversarial robustness. That changes the practical objective from eliminating every possible vulnerability to building systems and organizations capable of managing successful attacks.
For developers, this means examining security throughout the model life cycle rather than focusing exclusively on pre-deployment testing. For organizations using agentic systems, it means considering the consequences of delegated permissions, external tool access and compromised components. For cybersecurity teams, it means integrating model-specific protections with established software and infrastructure controls.
The next test for NIST will be whether public feedback produces a more useful classification of emerging agentic attacks and more precise descriptions of the defenses available against them. The agency's planned revisions will also show how effectively the taxonomy can keep pace with changing techniques.
The central challenge is no longer simply identifying how an SI system can be attacked, but determining how an organization can continue operating safely when some defenses inevitably fail. NIST's December consultation offers researchers and industry an opportunity to help establish the shared terminology and practical foundations needed to address that challenge.