Top AI 2026 | MITRE ATLAS Mapped AML.T0024 – Model Inversion & Training Data Reconstruction Detection (AML-DET-010)
Detects high-frequency, sustained queries to an ML inference endpoint from a single identity, indicative of gradient-free training data reconstruction or model inversion attacks. The rule triggers when a specific user or API key performs over 100 successful requests within a 15-minute window, where the responses include granular confidence, probability, or logit values, which are typical targets for reconstructing training data.
YARA-L
