Skip to content

MITRE ATLAS Evidence Cross-walk

Non-normative. This document is informative only. Nothing here changes TRACE v0.2 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.2 Trust Record as defined in spec/trace-v0.2.md.

Purpose

MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) documents the tactics adversaries use against AI systems. TRACE is an evidence and attestation layer: it does not prevent these tactics, but it produces verifiable records that support audit, incident review, and governance verification after or during execution. Hardware backing requires verified attestation evidence that binds the record-signing key to the expected environment; naming a TEE in runtime.platform does not itself establish that. When runtime.platform is software-only (§3.1.1), the record carries software commitments rather than hardware evidence. See trust levels.

This page answers a concrete question for each ATLAS tactic: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.2 leaves a gap that a future profile would need to close.

Tactic identifiers are the official ATLAS IDs (AML.TA####) from atlas.mitre.org and the mitre-atlas/atlas-data 5.6.0 export. They are not the unofficial ML01 to ML10 labels used in some older secondary write-ups. Rows follow ATLAS matrix sequence order (16 tactics). This mapping is tactics-only; ATLAS techniques and sub-techniques (AML.T####) are omitted.

Field names are exact TRACE v0.2 claim names as specified in §3.1 of the spec, including the v0.2 delegation link block (parent_record_hash, credential_id) in §3.1.3. Sub-field references such as policy.bundle_hash, runtime.platform, appraisal.status, and delegation.parent_record_hash refer to the nested fields shown in the §3.2 wire-format example and schema/trace-claim.json.

Mapping table

ATLAS tactic Relevant TRACE claims Evidence TRACE can provide Limitations / out of scope Future TRACE profile need
AML.TA0002: Reconnaissance policy, tool_transcript, data_class, runtime, transparency policy.bundle_hash shows which policy was bound if reconnaissance activity crossed an instrumented agent or tool boundary; tool_transcript.hash is a commitment to the instrumented transcript at protocol boundaries (not a verbatim log of exact calls), and tool_transcript.call_count bounds observed call volume; data_class states the sensitivity classification applied, not proof of which data was read or egressed; runtime.measurement binds the claimed execution environment; transparency (when present) is a URI reference to a log, not proof of inclusion; verified logging requires an inclusion proof bound to the record and a log or checkpoint the verifier trusts. Does not capture the adversary's reconnaissance methods or tools that never cross an instrumented protocol boundary. Does not prevent reconnaissance. Open-source research and OSINT against the organization are outside the Trust Record. MCP profile fields for tool identity, egress data-class tracking, and per-call allow/deny outcomes.
AML.TA0003: Resource Development build_provenance, model, runtime, transparency, appraisal build_provenance.slsa_level, build_provenance.builder, build_provenance.digest, and build_provenance.provenance_depth bind how the running artifact was built; model.model_id, model.weights_digest, and model.aibom_uri identify the model artifact; runtime.measurement and runtime.rim_uri bind the runtime image; appraisal.status and appraisal.provenance_depth_verified record the verifier's EAR judgment of the assembled evidence (not a dedicated RIM-match success flag); transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not enumerate every transitive dependency unless provenance_depth is transitive and appraisal.provenance_depth_verified records that that depth was actually checked. Does not detect malicious code present at build time that is not reflected in measurement divergence. Does not prove adversary-controlled staging infrastructure that never became the running workload. Richer AIBOM/SBOM linkage in the model sub-claim; vendor platform annexes specifying per-silicon supply-chain appraisal criteria.
AML.TA0004: Initial Access subject, cnf, signature, runtime, policy, appraisal These claims are distinct and should be read separately: subject names the workload identity (SPIFFE SVID or DID URI); cnf is the confirmation claim for the record-signing key; runtime.platform and runtime.measurement state the claimed execution environment (hardware-backed only when verified attestation binds the signing key to that environment; a TEE name in runtime.platform is not enough); signature (or the enveloping-signature equivalent) proves record integrity. Separately, appraisal.status records the verifier's EAR judgment of the evidence against policy, and policy.bundle_hash shows what authorization rules were bound. No single claim proves initial-access prevention; together they let a verifier check identity, key confirmation, runtime binding, and signature integrity as stated on the record. Does not replace IAM or RBAC systems. Does not prove that external permissions granted to the workload were correctly scoped. Does not cover initial access that occurred at infrastructure layers outside the TEE or instrumented boundary. A software-only record does not inherit hardware-backed identity binding; that binding requires verified attestation that ties the signing key to the expected environment, not a TEE name in runtime.platform. A2A profile fields for scoped credentials, audience restriction, purpose binding, and per-action authorization evidence. The v0.2 delegation block is the foundation, not that profile.
AML.TA0000: AI Model Access model, build_provenance, runtime, appraisal, transparency model.model_id and model.weights_digest identify the model artifact; build_provenance.digest and build_provenance.slsa_level bind the workload that hosted it; runtime.measurement shows what workload and container digest were loaded; appraisal.status records the verifier's EAR judgment (affirming, warning, contraindicated, or none); RIM matching may inform that judgment when RIMs are consulted, but appraisal.status is not itself a RIM-success bit; transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not prevent model access via public APIs, physical sensors, or products that wrap the model. Does not prove no inference occurred outside the recorded execution. Access that never produced a Trust Record is invisible. MCP profile for per-invocation model-call identity; vendor platform annexes for confidential-inference appraisal.
AML.TA0005: Execution runtime, build_provenance, tool_transcript, policy, appraisal runtime.measurement shows what workload and container digest were loaded; build_provenance.digest and build_provenance.slsa_level bind the build artifact; tool_transcript.hash is a commitment to the instrumented protocol boundary transcript, not proof of every exact call or argument; policy.bundle_hash and policy.enforcement_mode show what rules were in force (enforce, advisory, silent, or declared); appraisal.status records the verifier's EAR judgment of the assembled evidence, not a dedicated RIM-match success flag. Does not prevent execution. Does not prove no code ran outside the recorded tool_transcript scope: inline code execution embedded in the workload binary is not captured at invocation granularity. MCP / tool-and-code-execution profile: sandbox identity, command execution transcript hash, filesystem and network boundary evidence per invocation.
AML.TA0006: Persistence build_provenance, model, runtime, transparency, appraisal build_provenance.slsa_level, build_provenance.builder, and build_provenance.digest bind the build artifact; model.model_id and model.weights_digest identify the model that would persist a poisoned or backdoored artifact; runtime.measurement shows what was loaded at this execution; transparency is a URI reference -- comparing later substitutions requires a verified inclusion proof and a trusted log or checkpoint; appraisal.status records the verifier's EAR judgment of the assembled evidence (RIM checks may feed that judgment; the status field is not a RIM-success bit). Does not prevent persistence. Does not bind training-set snapshots, checkpoint history, or artifact-registry writes unless those actions crossed an instrumented boundary and produced records. Persistence that remains within authorized tool boundaries can still yield a valid Trust Record. Attested memory and persistent-state claim (v0.3 roadmap); richer SBOM linkage in build_provenance.
AML.TA0012: Privilege Escalation subject, cnf, policy, appraisal, delegation subject names workload identity and cnf confirms the record-signing key (hardware-held only when verified attestation binds that key to the expected environment; a TEE name in runtime.platform is not enough); policy.bundle_hash shows what authorization rules were bound; appraisal.status records the verifier's EAR judgment; when present, delegation.parent_record_hash and delegation.credential_id let a verifier walk the offline-verifiable delegation DAG (§3.1.3) and see which parent record and credential this hop acted under. Does not replace IAM. Does not prove OS-level privilege (SYSTEM/root, local administrator) or that external permissions were correctly scoped. Escalation outside the TEE or protocol boundary is not a v0.2 claim. A chain exists only when every hop issued a record carrying delegation. A2A profile: audience restriction, purpose binding, and per-action authorization evidence over the existing delegation block.
AML.TA0007: Defense Evasion runtime, origin, appraisal, policy, build_provenance runtime.platform and runtime.measurement bind the claimed execution environment; origin.kind distinguishes a self-produced record from a third-party-control-plane or log-import assembly (which MUST carry runtime.platform: "software-only" per §3.1.1); appraisal.status records the verifier's EAR judgment of the evidence (affirming, warning, contraindicated, or none), not a RIM-match bit; policy.enforcement_mode shows how policy related to this execution; build_provenance.digest binds the artifact. Does not detect evasion of AI-enabled security software such as malware detectors. Does not prove the workload did not disable logging or tamper with detectors outside recorded claims. A valid Trust Record can coexist with evasion that stayed inside authorized boundaries. Behavioral integrity profile: expected tool set, execution baseline hash, and anomaly or quarantine event records.
AML.TA0013: Credential Access subject, cnf, delegation, tool_transcript, policy subject identifies the workload; cnf binds the record-signing key; when present, delegation.credential_id names the delegation credential this hop acted under and delegation.parent_record_hash binds that hop to the parent record; tool_transcript.hash is a commitment to protocol-boundary transcript content that may include secret-retrieval calls, not proof that specific secrets were fetched; policy.bundle_hash shows what rules were bound. Does not capture keylogging, credential dumping, or theft of account passwords. Does not prove a credential was not stolen outside the instrumented boundary. delegation.credential_id identifies a credential; it is not proof that the credential was uncompromised. A2A / delegation profile fields for scoped credentials, audience, purpose, and per-action authorization evidence.
AML.TA0008: Discovery tool_transcript, runtime, policy, data_class, transparency tool_transcript.hash is a commitment to the instrumented transcript when post-compromise gathering crossed MCP/A2A boundaries, and tool_transcript.call_count bounds observed volume; runtime.platform and runtime.measurement bind the claimed environment; policy.bundle_hash shows what controls were in force; data_class states the sensitivity classification applied, not proof of which objects were enumerated or egressed; transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not capture native OS discovery tools that never cross an instrumented protocol boundary. Does not prevent discovery. Intra-binary enumeration is bound only by build_provenance and model. MCP profile for per-call tool identity, parameters, and allow/deny outcome.
AML.TA0015: Lateral Movement delegation, subject, tool_transcript, cnf, transparency When present, delegation.parent_record_hash links this hop to the parent Trust Record so a verifier can walk agent-to-agent movement offline (§3.1.3); delegation.credential_id identifies the credential used at this hop; subject identifies each participating workload; tool_transcript.hash is a commitment to inter-agent or tool transcript content at instrumented boundaries, not a full message log; cnf confirms the signing key and signature (or the enveloping-signature equivalent) proves record integrity; transparency is a URI reference per hop, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. TRACE v0.2 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and hops that issued no Trust Record are not covered. Pivot into model registries, notebooks, or training pipelines is visible only if those actions produced records. A2A profile: peer agent identity, per-message hash, audience restriction, nonce, and protocol version binding over the delegation block.
AML.TA0009: Collection tool_transcript, data_class, model, build_provenance, transparency tool_transcript.hash is a commitment to instrumented protocol-boundary activity that may include collection calls (repos, stores, retrieval APIs), not an inventory of collected objects; data_class states the sensitivity classification applied, not proof of which data was collected or egressed; model.model_id and model.weights_digest identify collected model artifacts when they are the running model; build_provenance.digest binds the collector workload; transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not prevent collection. Does not bind object-store listings, registry clones, or notebook exports that stayed inside the binary. Does not prove completeness of a collected-artifact inventory. MCP profile for egress data class and per-call identity; attested memory / RAG profile for corpus Merkle roots when collection is retrieval.
AML.TA0001: AI Attack Staging model, data_class, build_provenance, tool_transcript, transparency model.model_id and model.weights_digest identify the target or proxy model artifact; data_class states the sensitivity classification applied to staging-related data, not proof of which datasets were used; tool_transcript.hash is a commitment to staging-related calls that crossed an instrumented boundary, not a full staging corpus; build_provenance.digest binds the staging toolchain; transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. TRACE v0.2 does not bind poisoning scan results, adversarial-example corpora, surrogate-model training sets, or RAG/memory snapshots. Offline staging that never ran under a TRACE'd workload is invisible. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.2 claim. Attested memory and persistent-state claim (v0.3 roadmap); memory/RAG profile: context source hashes, corpus Merkle roots, poisoning scan status.
AML.TA0014: Command and Control tool_transcript, runtime, subject, policy, transparency tool_transcript.hash is a commitment to instrumented MCP/A2A transcript content that may include channel abuse if those calls were transcribed, and tool_transcript.call_count bounds observed volume; neither proves exact destinations, payloads, or out-of-band C2; subject identifies the workload; runtime.measurement binds the claimed environment; policy.bundle_hash shows what was in force; transparency is a URI reference, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not inspect or prevent covert C2 channels, traffic mimicking, or out-of-band callbacks. Protocol-boundary coverage is only as complete as instrumentation. This row is thin by design: TRACE is not a network IDS. MCP profile for per-call destination identity, egress class, and allow/deny; A2A profile for peer identity and nonce.
AML.TA0010: Exfiltration tool_transcript, data_class, transparency, subject, policy tool_transcript.hash and tool_transcript.call_count provide a bounded commitment to instrumented activity for post-incident review, not proof of exact calls or egress volume; data_class states the sensitivity classification claimed for data involved, not proof of which bytes left; transparency is a URI reference for audit lookup, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint; subject identifies the workload; policy.bundle_hash shows what controls were bound. Collectively these support review of classification and instrumented commitments under policy, not a complete exfiltration ledger. Does not prevent exfiltration. Does not detect exfiltration that remained within authorized tool boundaries. A workload can issue a valid Trust Record and still exfiltrate data within those boundaries. MCP profile for egress data class and destination identity. Multi-hop reconstruction uses delegation.parent_record_hash when every hop issued a linked record.
AML.TA0011: Impact appraisal, policy, tool_transcript, model, runtime, transparency appraisal.status records the verifier's EAR judgment (affirming, warning, contraindicated, or none); policy.bundle_hash and policy.enforcement_mode show what was in force; tool_transcript.hash is a commitment to actions at instrumented protocol boundaries, not a full action log; model.weights_digest identifies the model whose outputs may have been manipulated; runtime.measurement binds the claimed environment; transparency is a URI reference for post-incident review, not proof of logging -- verified inclusion needs an inclusion proof and a trusted log or checkpoint. Does not prevent manipulation, interruption, or destruction. Does not adjudicate whether business processes or model outputs were altered to benefit an adversary. Availability attacks outside recorded executions are not a Trust Record claim. Behavioral integrity profile: declared capability manifest hash, expected tool set, execution baseline hash, and anomaly or quarantine event records.

What TRACE does not do

The table above surfaces per-tactic scope boundaries. These apply across all sixteen tactics:

TRACE does not prevent ATLAS tactics. TRACE is an evidence and attestation layer. It records what happened -- what executed, under what policy, in what environment, on what data class, invoking what tools -- and binds that record cryptographically. Hardware backing requires verified attestation evidence that binds the signing key to the expected environment; naming a TEE in runtime.platform does not itself establish that. A software-only record (§3.1.1) carries software commitments without hardware evidence. Controls that act before, during, or around execution (firewalls, guardrails, RBAC, prompt filters, sandboxing, network IDS) are out of scope.

TRACE does not adjudicate model behavior. As stated in §2.4 of the spec, prompt injection, jailbreaks, hallucination, and alignment drift are permanent scope boundaries. TRACE proves what model artifact executed and what countermeasures were bound; it does not evaluate whether the model's output was correct or intended.

TRACE v0.2 does not cover intra-binary execution. tool_transcript captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). The tool_transcript.hash field is a commitment to that instrumented transcript, not a verbatim proof of every call, argument, or egress. Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by build_provenance and model, not at invocation granularity.

TRACE does not replace IAM, RBAC, or network controls. subject and cnf establish and bind workload identity, but the permissions granted to that identity by external systems are outside the Trust Record. A correctly identified workload can still hold excessive privileges.

TRACE does not capture UI or human-layer interactions. What a human sees, approves, or consents to is not a v0.2 evidence claim. references with rel approval-outcome is a pointer, not proof of what was displayed or whether informed consent was obtained (§3.1.2: a reference is not attested evidence).

TRACE reconstructs multi-agent lineage only when hops carry delegation. v0.2 delegation.parent_record_hash and delegation.credential_id form an offline-verifiable delegation DAG when present. Hops that issued no Trust Record, or issued one without delegation, are not in that chain. The normative A2A binding rules over this block are a v0.3 roadmap item, not v0.2 claims.

Relationship to the TRACE roadmap

This cross-walk is a shipped v0.2 roadmap item listed in ROADMAP.md: "MITRE ATLAS cross-walk: TRACE claim coverage mapped to relevant ATLAS tactics." The "Future TRACE profile need" column describes additional claim structures that would close each gap; those profiles are separate roadmap items (MCP profile, A2A profile, attested memory and persistent state, vendor platform annexes) and will be specified in later releases.

The OWASP Agentic AI Top 10 cross-walk (also a shipped v0.2 item) addresses risks at the OWASP category level. This MITRE ATLAS cross-walk addresses adversary tactics. The two mappings overlap in evidence (the same Trust Record claims) but answer different reader questions.

References