Top AI 2026 | MITRE ATLAS Mapped AML.T0044 – Unauthorized White-Box Model Artifact Exfiltration (AML-DET-012)

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•1

Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.