MITRE ATLAS 2026 Top AI Detection: Training Data Poisoning from Untrusted Ingestion Source (AML.T0020)
This rule detects potential Training Data Poisoning (AML.T0020) by monitoring for anomalous activities in ML data pipelines. It triggers when ingestion jobs utilize untrusted sources, unregistered source paths, unauthorized accounts write to datasets, or when significant data volume bursts or schema/checksum drifts occur immediately prior to a scheduled training run.
Sigma
