Summary: ATLAS is a full attack-chain matrix with mitigations and real cases; PITAX is a deep catalogue of prompt-injection technique craft. They overlap in roughly one ATLAS technique and 70 PITAX ones.
Sources: raw/MITRE-ATLAS/ (release 2026.06); raw/AI-attack-techniques/ (PITAX v1.6.1)
Last updated: 2026-07-28
The core difference
ATLAS spans the whole chain, shallowly on prompt craft. All of prompt injection is one technique with three sub-techniques: AML.T0051 → Direct, Indirect, Triggered.
PITAX goes deep on exactly that one node. Its 70 techniques are almost entirely elaborations of how to construct an injection — the internal structure of AML.T0051 and its neighbours.
They are not competitors. ATLAS tells you where in an operation an attack sits and what to do about it; PITAX tells you what the payload actually looks like.
Direct correspondences
PITAX cites ATLAS IDs in two places, both now resolvable:
| PITAX | ATLAS |
|---|---|
| T12 Link Injection — alias “LLM Response Rendering (MITRE ATLAS AML.T0077)“ | AML.T0077 |
| T44 Conditional Trigger — alias “Triggered injection (MITRE ATLAS AML.T0051.002)“ | AML.T0051.002 |
The delivery axis lines up cleanly:
| PITAX delivery | ATLAS sub-technique |
|---|---|
direct (53 techniques) | AML.T0051.000 Direct |
indirect (6 techniques) | AML.T0051.001 Indirect |
| trigger-gated (T44) | AML.T0051.002 Triggered |
Both taxonomies independently chose the same primary cut. See direct vs indirect.
Cluster-level mapping
| PITAX cluster | Nearest ATLAS locations |
|---|---|
| Agentic and tool attacks | AML.T0053 AI Agent Tool Invocation; Execution and Exfiltration tactics |
| Retrieval and memory poisoning | Resource Development; AML.T0077; RAG-poisoning techniques |
| Persuasion and framing | Defense Evasion; AML.T0065 LLM Prompt Crafting |
| Obfuscation and encoding | Defense Evasion; AML.T0015 Evade AI Model |
| Automated attack generation | AI Attack Staging; AML.T0043 Craft Adversarial Data; Black-Box Optimization |
| Weight-level attacks | AI Model Access tactic; model theft |
| Multi-turn attacks | No clean ATLAS location |
| Reasoning-model attacks | No clean ATLAS location |
| Context and role forgery | Partial — no dedicated technique |
What each has that the other doesn’t
Only ATLAS has:
- Mitigations mapped per technique — see atlas-mitigations
- 63 documented case studies with attack paths — see atlas-case-studies
- A maturity rating (Realized / Demonstrated / Feasible)
- Platform tags, and the finding that Agentic AI is the largest surface at 114 techniques
- Full attack-chain context: reconnaissance, persistence, lateral movement, C2
- Machine-readable distribution and monthly updates
Only PITAX has:
- Depth on payload construction — 70 distinct techniques where ATLAS has 3 sub-techniques
- Concrete example payloads per technique
- Alias mapping across HackAPrompt, Pangea, HiddenLayer APE, arXiv and vendor naming
- Coverage of multi-turn and reasoning-model attacks, which ATLAS has no home for
- The structural forgery family — special-token injection, forged history, spoofed tool results
The gap neither closes
Multi-turn attacks. ATLAS techniques are single-step primitives; the matrix has no representation for an attack whose entire mechanism is the trajectory across turns. PITAX’s seven multi-turn techniques — crescendo, echo chamber, decomposition — defeat per-message evaluation by construction, and there is nowhere in the ATLAS matrix that fact can be recorded.
Similarly, reasoning-budget and output-plane attacks (T61–T63) have no ATLAS technique. Both are recent enough that ATLAS’s monthly cadence may close the gap; as of release 2026.06 it is open.
Practical guidance
- Threat-modelling a deployment, or reporting an incident → ATLAS. It gives you the chain, the mitigations and a shared vocabulary with the SOC.
- Red-teaming a model, or triaging a payload → PITAX. It gives you the craft and the cross-vendor naming.
- Writing a detection → both. ATLAS for where to instrument, PITAX for what the payload looks like.