MITRE ATLAS 2026 Top AI Detection: Backdoored ML Model Artifact Tampering (AML.T0018)
Detects unauthorized modifications or non-pipeline uploads to an ML model registry. The rule flags events where model artifacts lack valid signatures, fail checksum verification, or are uploaded/promoted by non-authorized identities or without required CI/CD provenance, indicating potential ML model backdooring or poisoning.
Sigma
