NIST AI 100-2e2025: the adversarial machine learning taxonomy, explained

Before this report, researchers, vendors and regulators describing an attack on a machine learning system often used inconsistent or overlapping terms for the same underlying technique — a problem the earlier NIST AI 100-2e2023 (finalized 4 January 2024, after an 8 March 2023 initial public draft) first set out to fix for predictive AI, and which e2025 extends more fully to generative AI. NIST's stated goal, per its own abstract, is to "inform other standards and future practice guides for assessing and managing the security of AI systems by establishing a common language for the rapidly developing AML landscape." That framing matters for the same reason a shared vocabulary matters in MITRE ATLAS or MITRE ATT&CK: a taxonomy is only useful once enough people use the same terms for the same things, and NIST positions this report as the terminology layer other frameworks and standards can build on rather than reinvent.

The report splits AI systems into two classes before classifying attacks within each: Predictive AI (PredAI), described as still dominating industrial applications, and Generative AI (GenAI), whose adoption in business and consumer products has grown rapidly. For PredAI systems — the kind of model that scores, classifies or predicts rather than generates new content — the taxonomy, per NIST's own keywords and independent summaries of the report, organizes attacks into three major classes:

• Evasion attacks — crafting an input at inference time (an adversarial example) that causes a deployed model to misclassify or mis-score something it would otherwise handle correctly.
• Poisoning attacks — corrupting the training data or the training process itself, so the resulting model behaves incorrectly or contains a hidden backdoor.
• Privacy attacks — extracting information about the training data or the model's internals that was never meant to be exposed, through techniques such as membership inference or model extraction.

Each class is further broken down by the attacker's goal (which property — availability, integrity or privacy — is being violated), the attacker's capability and access level, and the attacker's knowledge of the target, ranging from black-box query access to full white-box visibility into model internals.

The clearest expansion in e2025 relative to the 2023 edition is its treatment of Generative AI (GenAI). Per NIST's own publication abstract and keywords (which explicitly list "large language model" and "chatbot" among the report's subject terms) and consistent with independent secondary analyses of the document, GenAI coverage extends to:

• Supply-chain attacks against generative models and the data or components used to build them.
• Direct and indirect prompt injection — direct injection being an attacker's own crafted prompt, indirect injection being malicious instructions embedded in content a model later ingests, such as a web page, document, or other data source the model is asked to process.
• Misuse and abuse violations, including jailbreaks that bypass a model's intended behavioral constraints.
• AI-agent security, covering the newer risk surface created when a generative model is given tools, autonomy or the ability to take actions rather than only produce text — an area secondary sources describe as not meaningfully covered in the 2023 edition.

This is the same attack surface covered from a case-study and tactic/technique angle in MITRE ATLAS's LLM Prompt Injection technique, and from an application-security-controls angle in the OWASP Top 10 for LLM Applications — NIST AI 100-2e2025 supplies the underlying taxonomy and terminology that both of those frameworks assume a reader already understands.

Two separate parts of this taxonomy map directly onto trends we see in device and firmware security work. First, products that run an on-device predictive model — an anomaly-detection model in an industrial sensor, an object-detection model in a camera, a predictive-maintenance classifier in a gateway — sit squarely inside the PredAI half of this taxonomy: an attacker with physical or network access to the device may be able to attempt evasion (crafting a sensor input that the model misclassifies) or, if the device supports on-device learning or periodic retraining, poisoning. These are exactly the risks the AI-BOM for embedded AI devices guide argues a device maker needs to inventory in the first place — you cannot threat-model an on-device model's evasion or poisoning risk if you have not first recorded that the model exists, what it does, and how it is updated.

Second, a growing number of devices now embed a generative AI assistant directly — a local or edge-deployed chatbot, voice assistant, or agent that can read device logs, sensor data or user input and take action. That puts the device squarely inside this taxonomy's GenAI coverage, and specifically its direct and indirect prompt-injection categories: a malicious instruction hidden in a voice command, a scanned document, or data pulled from a connected sensor or cloud feed is exactly the indirect-injection scenario the taxonomy describes. Teams building either kind of embedded AI feature can use this taxonomy's categories — evasion, poisoning and privacy for the on-device model; prompt injection, misuse and agent security for the embedded assistant — as a structured starting checklist for threat-modeling, in the same way the NIST AI Risk Management Framework's Map function asks teams to identify which AI-specific risks actually apply before trying to measure or manage them.