NIST AI 100-2 E2025: Adversarial Machine Learning, a Taxonomy and Terminology of Attacks and Mitigations

What this report is

NIST AI 100-2 E2025, "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations", is a report from the US National Institute of Standards and Technology, published in March 2025. Its authors come from NIST, Northeastern University, Cisco, the UK AI Security Institute and the US AI Safety Institute.

Adversarial machine learning (AML) is the study of how attackers make ML systems misbehave and how to defend them. The report sets out a taxonomy: a structured map of attack types, the stage of the ML lifecycle they target, the attacker's goals and knowledge, and the mitigations known for each, with honest notes on where those mitigations fall short.

What it covers

The report treats two families of system:

• Predictive AI, such as image classifiers and fraud models, where the classic attacks are evasion (inputs crafted to be misclassified), poisoning (tampering with training data) and privacy attacks such as membership inference and model extraction.
• Generative AI, including large language models and chatbots, where it adds prompt injection, direct and indirect, misuse and abuse, and risks from retrieval and agents.

For each class it gives definitions, references to research and the state of defences.

Is it worth your time?

As a reference, yes. You will not read it cover to cover as a beginner, and you do not need to. It is the source to check when you want the precise meaning of a term, when you are writing a finding or a threat model that others will review, or when a vendor claim sounds too good. It also makes a good bridge between the OWASP lists, which are practical and app-focused, and the academic research.

It is a taxonomy, not a how-to. It explains attack classes and mitigations conceptually, which is the right level for most security work.

How to use it well

• Read the introduction and the generative AI section first.
• Keep it open while threat modelling and borrow its terms for attacker goals and capabilities.
• Note the mitigations it marks as limited, so you never present one as a complete fix.

Free or paid?

Free to download from the NIST Computer Security Resource Center.