MITRE ATLAS Mapped 2026 – Top AI Black-Box Adversarial Query Detection (AML.T004
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
Microsoft Sentinel (KQL)
