Adversarial machine learning needs a common language

NIST's adversarial machine-learning report solves a basic problem: security teams cannot assess or discuss attacks consistently when researchers, developers, and defenders use different terms. Its taxonomy organizes attacks by the kind of AI system, the lifecycle stage being targeted, the adversary's objective, the access and capabilities required, and what the attacker knows about the model or learning process.

For CISSP Domain 3, Security Architecture and Engineering, that structure improves threat modeling. Evasion, poisoning, model extraction, privacy attacks, direct prompting, and indirect prompt injection do not require the same access or controls. Architects need to understand where data, models, interfaces, tools, and downstream actions sit within the trust model. A mitigation that protects inference may do nothing for a compromised training pipeline.

Domain 6, Security Assessment and Testing, benefits from the common vocabulary. A test plan can state the attacker knowledge being assumed, the property under attack, and the stage being exercised. That makes results reproducible and prevents a successful demonstration from being generalized beyond its evidence. NIST is also candid that widely used mitigations have limitations, so validation must test the control under the conditions it claims to address.

Domain 8, Software Development Security, brings the taxonomy into the lifecycle. Training data, model development environments, third-party models, retrieval systems, application code, and runtime integrations are all part of the attack surface. Security requirements and testing therefore belong at each stage, with changes reassessed as models gain new data or tools.

This document is not an implementation guide. Its value is precision. It gives teams a shared map for asking better questions: what is the adversary trying to violate, what access is needed, where can the attack occur, and which mitigation is actually supported by evidence? That is a stronger foundation than treating every AI failure as a jailbreak.