AI Security Second Brain

AI Attack Techniques — Operation Log

3 min read

⭐ Star on GitHub

Append-only. Newest entries at the bottom.

2026-07-28 — Initial ingest

Sources ingested: raw/AI-attack-techniques/ — 71 files (70 PIT-T technique cards + source index), Arcanum Prompt Injection Taxonomy v1.6.1, CC BY 4.0. ~12,800 words. All 70 technique descriptions, delivery tags and alias lists read in full.

Pages created (11):

  • index.md — collection index, cluster map, reading order
  • pitax-taxonomy.md — source summary
  • delivery-direct-vs-indirect.md
  • persuasion-and-framing.md (17 techniques)
  • agentic-and-tool-attacks.md (9)
  • obfuscation-and-encoding.md (9)
  • reasoning-model-attacks.md (8)
  • context-and-role-forgery.md (8)
  • multi-turn-attacks.md (7)
  • retrieval-and-memory-poisoning.md (6)
  • automated-attack-generation.md (4)
  • weight-level-attacks.md

Approach: the raw source already ships a flat index of all 70 with wikilinks. Rather than duplicate it, pages cluster techniques by exploited mechanism. Techniques appear in more than one cluster where the mechanism genuinely spans both (e.g. T31 in both multi-turn and role-forgery, T32 in both multi-turn and retrieval).

Cross-collection links added: to ai-regulations-wiki/article-15-cybersecurity, laws-wiki/code-of-practice-security-mitigations, laws-wiki/systemic-risk, ai-incident-response-wiki/cosai-framework.

Root index updated: yes.

Open items:

  • raw/MITRE-ATLAS/ empty — PITAX cites ATLAS IDs (AML.T0077 in T12, AML.T0051.002 in T44) that cannot yet be resolved to pages.
  • raw/Prompt-injection-examples/ empty.
  • No mitigation source exists at technique granularity anywhere in the corpus.

2026-07-28 — Lint fixes and ATLAS cross-linking

Defects found and fixed:

  1. delivery-direct-vs-indirect.md had wrong counts. Stated “direct — 52” and “indirect — 5” while listing six indirect techniques. Verified against the **Delivery** field of all 70 source cards: correct figures are direct 53, indirect 6, both 11. Fixed, with a note that the counts are source-verified.

  2. Seven techniques appeared in no cluster page — T01, T06, T11, T14, T15, T23, T60. Assigned:

    • T01 Act as Interpreter, T14 Meta Prompting, T15 Anti-Refusal → persuasion-and-framing (new “Personas and meta-instructions” section; cluster now 20 techniques, was 17)
    • T06 Contradiction, T11 Inversion, T23 Russian Doll → obfuscation-and-encoding (new “Nesting” and “Logical confusion” sections; cluster now 12, was 9)
    • T60 Direct Request → explicit row in the cluster table as the baseline, already discussed in pitax-taxonomy.md

  3. T58 Secret Probing was missing from the cluster table in pitax-taxonomy.md despite being covered in weight-level-attacks.md. Added.

All 70 techniques now appear in at least one cluster page; the table states this.

Not defects (checked, no action): index and log files do not follow the standard page format — CLAUDE.md defines them separately. Reporting-clock tables in ai-incident-response-wiki are partial but consistent with the full table in serious-incident-reporting.md.

ATLAS cross-linking: index.md gaps section rewritten — ATLAS is ingested, the AML IDs cited by T12 and T44 now resolve, and the mitigation gap is partly closed. weight-level-attacks.md and retrieval-and-memory-poisoning.md updated to link the new Model Theft and Data Poisoning collections.

2026-07-28 — raw/Prompt-injection-examples/ deleted

Removed as redundant against this collection. Verified empty before deletion (0 files, nothing hidden), so no source material was lost.

Rationale: raw/AI-attack-techniques/ is PITAX, a prompt-injection taxonomy end to end, and every one of its 70 cards already ships concrete payloads — 306 example lines across 70 ## Examples sections, plus 354 lines across 70 ## Ideas / Variations sections. A generically-scoped examples folder would have re-collected the same material while losing the structure PITAX attaches to it: technique code, delivery channel, alias mapping across HackAPrompt/Pangea/HiddenLayer/arXiv, and cluster membership.

Gap that remains open (recorded on index.md rather than as a folder): PITAX examples are single payload lines. They are not full multi-turn transcripts, not attributed real-world incidents, and carry no recorded outcome — no source in the vault pairs a payload with “this worked against model X on date Y.” The multi-turn cluster is structurally worst served, since a crescendo cannot be represented in one line. If an examples folder is ever recreated, that narrower scope is what would justify it.

References updated: root index.md, ai-attack-techniques-wiki/index.md.

Graph View