Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that a layered mitigation stack aligned with the AI Security Pyramid of Pain can reduce the residual risk of two primary RAG attack classes from High to Low, with severity scores dropping from 19.5 to 10.41 and 19.88 to…

desk verdict Useful practitioner-oriented RAG threat taxonomy, but the headline risk-reduction numbers are illustrative expert judgment, not derived results. read the letter →

arxiv 2506.00281 v1 pith:3B3S7PHH submitted 2025-05-30 cs.CR cs.AI

Chris M. Ward , Josh Harguess This is my paper
classification cs.CRcs.AI
keywords Retrieval-AugmentedGenerationadversarialattackspromptinjectiondatapoisoningriskmitigationAISecurityPyramidofPainthreatmodelingresidual
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that RAG systems, which let large language models answer from live external data, inherit attack surfaces such as prompt injection, data poisoning, and adversarial query manipulation that cannot be closed by a single patch. It applies a structured threat-modeling exercise to a generic enterprise RAG system and scores two threat models—sensitive information disclosure and RAG system poisoning—using a likelihood-times-impact risk rubric. It then applies a layered set of controls ordered by the AI Security Pyramid of Pain and claims that the stack drives overall risk severity from High to Low. The point is to show that defense in depth, not any individual filter, is the practical route to operating RAG in sensitive domains.

What carries the argument

The AI Security Pyramid of Pain is the central organizing object: a hierarchy that ranks mitigations by how much operational disruption they impose on adversaries, from basic data-integrity fixes at the base up to countermeasures aimed at an adversary's tactics, techniques, and procedures at the top. The paper maps each control and each lifecycle phase to a pyramid layer, then re-scores the two threat models after the controls are applied. The quantitative work is carried by an inherent-risk formula, risk severity equal to likelihood times impact, scored with a standard risk-rating scheme; the drawdown from High to Low is the output that validates the strategy.

What would settle it

Run a controlled red-team exercise against a RAG system implementing all six controls and measure the realized rate of successful sensitive-information disclosure and successful corpus poisoning; if either rate stays close to its pre-control level, or if the measured success implies a likelihood-times-impact score still in the High bracket, the claimed risk drawdown would be contradicted.

Watch

Extended reading notes

Core claim

The central claim is that a multi-layered mitigation strategy aligned with the AI Security Pyramid of Pain can meaningfully reduce the inherent risks associated with RAG systems. For sensitive information disclosure the residual risk severity falls from 19.5 to 10.41, and for RAG system poisoning it falls from 19.88 to 6.94, moving both out of the High-risk bracket. The reduction comes from the compounding effect of six controls—input validation and sanitization, adversarial training and testing, real-time monitoring and detection, data governance and curation, lifecycle management, and incident response—each of which raises the skill required of an attacker, shrinks the opportunity to act, or reduces the impact of a successful exploit.

Load-bearing premise

The conclusion that residual risk is Low depends on the likelihood and impact numbers the authors assigned to each threat factor and on the assumed effectiveness of each control; those numbers are expert judgment, not data from real attacks.

Editorial extensions

If this is right

  • Organizations in finance, healthcare, and legal services can treat the control list as a concrete starting order for securing RAG deployments rather than avoiding the technology outright.
  • Security teams should spend first on controls that hit the upper pyramid layers, such as adversarial training and data provenance, because those force attackers to change their methods.
  • Residual risk remains nonzero, so incident response, continuous monitoring, and periodic re-scoring must stay in place even after the controls are implemented.
  • The same five-stage threat-modeling process can be repeated iteratively, re-scoring after each control batch until risk falls to an accepted level.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The risk scores are expert judgments rather than measurements, so an empirical calibration using observed attack data could shift the residual-risk figures noticeably.
  • The pyramid logic implies an ordering prediction: controls aimed at adversary behavior should reduce exploit success more than input filters alone, which a red-team comparison across control orderings could test.
  • The two scored threat models could be extended to supply-chain compromise and embedding/model-inversion attacks, which the paper lists but does not score, giving a benchmark for those additional vectors.
  • Turning the ordinal pyramid ranking into a cardinal measure of adversary cost or adaptation time would let organizations choose controls by cost-benefit rather than by layer position.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper presents a threat-modeling exercise for a generic enterprise Retrieval-Augmented Generation (RAG) system. It identifies two primary threat models—sensitive information disclosure and RAG system poisoning—maps them to MITRE ATLAS and the OWASP Top 10 for LLM Applications, and proposes six categories of mitigation controls: input validation, adversarial training, real-time monitoring, data governance, MLOps lifecycle management, and incident response. These controls are prioritized using the authors' AI Security Pyramid of Pain framework. The paper's central quantitative claim is that, after applying the controls, overall risk severity decreases from High to Low for both threat models (Section 3.5.8, Figures 9–10), and the discussion concludes that a multi-layered, Pyramid-aligned mitigation strategy can meaningfully reduce inherent RAG risks (Section 4).

Significance. The qualitative contribution is useful: the paper provides an organized mapping of RAG attack surfaces, distinguishes external and insider poisoning paths, connects threats to MITRE ATLAS and OWASP taxonomies, and offers a reasonable control catalog. These parts could serve as a practical starting point for RAG security planning. The quantitative dimension, however, is the weakest link: the risk scores and residual-risk drawdown are based on author-assigned expert judgment rather than empirical measurement, and the scoring inputs are not fully disclosed. The authors explicitly note that red-team and live adversarial validation is future work (Section 4), which is honest but means the reported 'High to Low' reduction is not yet supported as evidence. If the scoring tables, sensitivity analysis, and appropriately cautious framing are added, the framework could be a valuable reference; as written, the central quantitative claim overreaches.

major comments (4)
  1. [Section 3.5.8, Figures 9–10] The quantitative claim that residual risk falls from High to Low is not reproducible from the paper's stated OWASP methodology. The text reports only final likelihood/impact factors (6.5 to 4.63 and 3 to 2.25 for Threat Model I; 6.63 to 4.63 and 3 to 1.5 for Threat Model II) without providing the threat-agent, vulnerability, and impact factor tables that the OWASP averaging procedure requires. The control-specific factor deltas are not justified in Sections 3.5.1–3.5.6. Please supply full before/after factor scores and show the arithmetic, or explicitly label the residual risk numbers as illustrative estimates and remove the definitive 'High to Low' reduction claim.
  2. [Section 4] The paper acknowledges in Section 4 that 'empirical validation through red teaming exercises and live adversarial testing is critical,' yet Sections 3.5.8 and 4 present the risk drawdown as a validated result. This is a load-bearing gap: the central conclusion depends on internal scoring rather than observed effectiveness. The authors should either add empirical validation—even a small red-team case study or controlled adversarial evaluation—or temper the conclusions to say that the controls are expected to reduce risk based on expert judgment.
  3. [Sections 3.4 and 3.5] The initial likelihood/impact scores (e.g., 6.5, 6.63, 3.0) and the control-efficacy estimates are author-assigned expert judgments with no sensitivity analysis. Because the final residual risk bracket ('Low') is sensitive to these inputs, the paper should include a sensitivity analysis showing how plausible variations in the factor scores affect the final severity. Without this, the conclusion that residual risk is 'Low' may be an artifact of the chosen numbers rather than a robust finding.
  4. [Sections 2.3 and 3.5.7] Because the controls are prioritized using the authors' own AI Security Pyramid of Pain and the effectiveness of those controls is then scored by the same authors, the risk-reduction result is partly a self-assessment. This is not a fatal flaw, but the paper should state this dependency explicitly and, ideally, have an independent party apply the scoring or validate the controls. The current framing presents the reduction as an objective outcome while the underlying evaluation is inherently subjective.
minor comments (5)
  1. [Section 1 and Section 3.4] There are typographical issues: Section 1 contains 'threat modeling process process' with a duplicated word, and Section 3.4 has 'inherent risk (likelihood × impact), ;' with stray punctuation.
  2. [Table 1 and throughout] The table headers 'T erm' and 'V ulnerability' contain unintended spacing that should be corrected in the final typeset version.
  3. [Table 2 and references [18], [19]] The CWE entries are inconsistent with the bibliography: Table 2 describes CWE-1039 as 'Inadequate Handling of Adversarial Input' and CWE-1426 as 'Improper Validation of AI Output,' but references [18] and [19] list different titles for those IDs. The IDs or reference titles should be reconciled.
  4. [Section 3.5.3] The sentence beginning 'Statistical baselining (bursty prompt-submission...' is an incomplete fragment; it should be rephrased as a complete sentence, e.g., 'Statistical baselining flags anomalies such as bursty prompt submission, sudden spikes in retrieval-error rates, and output entropies outside the learned norm.'
  5. [Figures 7–10] The risk-scoring figures are referenced but the underlying numeric factor tables are not given in the text. Adding the full before/after factor tables as an appendix would make the quantitative claims auditable and improve accessibility for readers.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the risk drawdown is an arithmetic consequence of author-assigned OWASP factor deltas, not an empirically fitted prediction; the paper discloses the need for empirical validation.

full rationale

No derivation step in the paper reduces to its own input. The threat models are drawn from MITRE ATLAS and OWASP, not from the paper's conclusions. The inherent risk scores in Section 3.4 are expert-assigned OWASP likelihood/impact values; the residual values in Section 3.5.8 are reassigned after a qualitative mapping from each control to OWASP factors (e.g., input validation 'drive[s] down Ease of Exploit, Opportunity, and Loss of Integrity factors'). The arithmetic risk = likelihood x impact then determines the High-to-Low reductions, so the outcome is a function of those judgments rather than a fitted or independently predicted quantity. This is a validity and reproducibility weakness: the paper does not show the before/after factor tables, so an external reader cannot verify the deltas. But it is not circularity, because the paper does not claim the scores were empirically measured, and it explicitly concedes in Section 4 that 'empirical validation through red teaming exercises and live adversarial testing is critical to verify the robustness of the proposed mitigation strategies under real-world conditions.' The AI Security Pyramid of Pain is prior work by the same authors (Ref. 9), but it functions as a prioritization taxonomy; the residual-risk arithmetic does not depend on it, and no uniqueness or correctness claim is imported from it to force the result. Accordingly, the central claim retains independent content and no step is circular by construction.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on expert-assigned risk scores and on the authors' own security framework. No new entities are introduced. The risk numbers are free parameters in the sense that they are chosen by the authors rather than measured. The axioms reflect the unstated premises that the threat frameworks apply straightforwardly to RAG and that the scoring model is valid.

free parameters (5)
  • likelihood_factor_sensitive_info_disclosure = 6.5
    Assigned by the authors in Section 3.4 as part of inherent risk scoring; no empirical basis or derivation provided.
  • impact_factor_sensitive_info_disclosure = 3
    Assigned by the authors in Section 3.4; no empirical or standard basis given.
  • likelihood_factor_rag_poisoning = 6.63
    Assigned by the authors in Section 3.4; based on expert judgment of threat agent, vulnerability, and impact components.
  • impact_factor_rag_poisoning = 3
    Assigned by the authors in Section 3.4; no independent justification.
  • control_efficacy_estimates = not specified
    Residual risk reductions in Section 3.5.8 (e.g., from 19.5 to 10.41) depend on assumed efficacy of each control; these assumptions are not measured or cited.
assumptions (3)
  • domain assumption The AI Security Pyramid of Pain provides a valid ordering of defense robustness and adversary disruption.
    The framework is taken from the authors' prior work (ref [9]) and used as the central prioritization mechanism without independent validation.
  • domain assumption Risk severity is meaningfully quantified as likelihood × impact, and these two factors are independent.
    The paper uses this multiplicative risk model throughout Section 3.4 without justifying its applicability to AI systems.
  • ad hoc to paper The selected threat models (sensitive information disclosure and RAG poisoning) are the most representative for RAG systems.
    Section 3.3 states 'a broader range of threat models could (and should) be considered', acknowledging the selection is a simplifying choice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems." pith.science (2026). https://pith.science/paper/3B3S7PHH

@misc{pith2026250600281,
  author       = {Pith},
  title        = {Pith review of: Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3B3S7PHH}},
  note         = {Machine review of arXiv:2506.00281}
}
read the original abstract

Retrieval-Augmented Generation (RAG) systems, which integrate Large Language Models (LLMs) with external knowledge sources, are vulnerable to a range of adversarial attack vectors. This paper examines the importance of RAG systems through recent industry adoption trends and identifies the prominent attack vectors for RAG: prompt injection, data poisoning, and adversarial query manipulation. We analyze these threats under risk management lens, and propose robust prioritized control list that includes risk-mitigating actions like input validation, adversarial training, and real-time monitoring.

Figures

Figures reproduced from arXiv: 2506.00281 by the authors.

Figure 1
Figure 1. A generalized Retrieval Augmented Generation (RAG) Architecture [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The AI Security Pyramid of Pain (Ward et. al. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. A generalized threat modeling process used in our analysis. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: RAG attack surface overlay. Approximate entry points for common weaknesses are shown. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Mapping Tactics, Techniques, and Procedures (TTPs) used in an example Sensitive Information [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Mapping Tactics, Techniques, and Procedures (TTPs) used in an example RAG Poisoning campaign [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Inherent Risk Scoring for Sensitive Information Disclosure [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Inherent Risk Scoring for RAG Poisoning [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Residual Risk Scoring for Sensitive Information Disclosure [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Residual Risk Scoring for RAG Poisoning continue to challenge even well-defended RAG architectures. Additionally, while our mitigation strategy effec￾tively reduced opportunity and ease of exploit, the persistence of latent weaknesses and vulnerabilities in large, dis…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Ranking Free RAG: Replacing Re-ranking with Selection in RAG for Sensitive Domains

    cs.CL 2025-05 reject novelty 5.0 of 10

    METEORA uses DPO-tuned rationales to select and verify evidence chunks in RAG, and claims better recall, precision, evidence efficiency, and poisoning defense, though key evaluation details are missing.

Reference graph

Works this paper leans on

35 extracted references · 33 canonical work pages · cited by 1 Pith paper

  1. [1]

    Retrieval-augmented generation for knowledge-intensive nlp tasks,

    Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., K¨ uttler, H., Lewis, M., Yih, W.-t., Rockt¨ aschel, T., et al., “Retrieval-augmented generation for knowledge-intensive nlp tasks,” Advances in neural information processing systems 33, 9459–9474 (2020)

    work page 2020

  2. [2]

    2024: The state of generative ai in the enterprise

    Tully, T., Redfern, J., and Xiao, D., “2024: The state of generative ai in the enterprise.” Menlo Ventures Blog (Nov 2024). Industry survey: 51% enterprise adoption of RAG, up from 31% in 2023

    work page 2024

  3. [3]

    Is your rag a security risk?

    Babeanu, “Is your rag a security risk?.” RSA Conference Blog (Feb 2025). Industry analysis of GenAI risks including prompt injection and data exposure

    work page 2025

  4. [4]

    Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,

    Xue, J., Zheng, M., Hu, Y., Liu, F., Chen, X., and Lou, Q., “Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,” arXiv preprint arXiv:2406.00083 (2024)

    arXiv 2024

  5. [5]

    Mapping the stony road toward trustworthy AI: Expectations, problems, conundrums,

    Rieder, G., Simon, J., and Wong, P.-H., “Mapping the stony road toward trustworthy AI: Expectations, problems, conundrums,” in [Machines We Trust: Perspectives on Dependable AI ], Pelillo, M. and Scantam- burlo, T., eds., 27–40, The MIT Press, Cambridge, MA (2021)

    work page 2021

  6. [6]

    Dahj, J. N. M., [ Mastering Cyber Intelligence: Gain comprehensive knowledge and skills to conduct threat intelligence for effective system defense ], Packt Publishing (2022)

    work page 2022

  7. [7]

    Artificial intelligence risk management framework (ai rmf 1.0),

    AI, N., “Artificial intelligence risk management framework (ai rmf 1.0),” URL: https://nvlpubs. nist. gov/nistpubs/ai/nist. ai , 100–1 (2023)

    work page 2023

  8. [8]

    Shostack, A., [ Threat Modeling: Designing for Security ], Wiley (February 2014)

    work page 2014

Show all 35 references
  1. [9]

    The ai security pyramid of pain,

    Ward, C. M., Harguess, J., Tao, J., Christman, D., Tan, M., Spicer, P., and Cranium, A., “The ai security pyramid of pain,” in [ Proc. of SPIE Vol ], 13054, 1305408–1 (2024)

    2024

  2. [10]

    Attention is all you need,

    Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., and Polosukhin, I., “Attention is all you need,” Advances in neural information processing systems 30 (2017)

    2017

  3. [11]

    A survey of large language models,

    Zhao, W. X., Zhou, K., Li, J., Tang, T., Wang, X., Hou, Y., Min, Y., Zhang, B., Zhang, J., Dong, Z., et al., “A survey of large language models,” arXiv preprint arXiv:2303.18223 1(2) (2023)

    2023 arXiv

  4. [12]

    Common weakness enumeration (cwe)

    The MITRE Corporation, “Common weakness enumeration (cwe).” https://cwe.mitre.org/. Accessed: 2025-03-17

    2025

  5. [13]

    Cwe community working groups & special interest groups

    The MITRE Corporation, “Cwe community working groups & special interest groups.” https://cwe. mitre.org/community/working_groups.html. Accessed: 2025-03-17

    2025

  6. [14]

    Common weakness enumeration (cwe)

    The MITRE Corporation, “Common weakness enumeration (cwe).” https://cwe.mitre.org/ (2006). Ac- cessed: 2025-05-06

    2006

  7. [15]

    Common weakness enumeration (cwe) status update,

    Martin, R. A. and Barnum, S., “Common weakness enumeration (cwe) status update,” ACM SIGAda Ada Letters 28(1), 88–91 (2008)

    2008

  8. [16]

    CWE-20: Improper Input Validation

    The MITRE Corporation, “CWE-20: Improper Input Validation.” https://cwe.mitre.org/data/ definitions/20.html (February 2024). Part of the Common Weakness Enumeration (CWE). Sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Age...

    2024

  9. [17]

    CVE-2023-5423: SQL Injection in SourceCodester Online Pizza Ordering System 1.0

    CVE Program, “CVE-2023-5423: SQL Injection in SourceCodester Online Pizza Ordering System 1.0.” https://cve.org/CVERecord?id=CVE-2023-5423 (2023). Accessed: 2025-05-07

    2023

  10. [18]

    CWE-1039: Automated Code Generation Based on Stale Schemas or Spec- ifications

    The MITRE Corporation, “CWE-1039: Automated Code Generation Based on Stale Schemas or Spec- ifications.” https://cwe.mitre.org/data/definitions/1039.html (April 2023). Part of the Common Weakness Enumeration (CWE). Sponsored by the U.S. Department of Homeland Security (DHS) Cy...

    2023

  11. [19]

    CWE-1426: Unintended Exposure of Sensitive Information in Generated Code

    The MITRE Corporation, “CWE-1426: Unintended Exposure of Sensitive Information in Generated Code.” https://cwe.mitre.org/data/definitions/1426.html (February 2024). Part of the Common Weakness Enumeration (CWE). Sponsored by the U.S. Department of Homeland Security (DHS) Cyber...

    2024

  12. [20]

    Threat modeling

    Center, M. S. E., “Threat modeling.” https://www.microsoft.com/en-us/securityengineering/sdl/ threatmodeling (2022). Accessed March 2025

    2022

  13. [21]

    The vulnerability of uavs: An adversarial machine learning perspective,

    Doyle, M., Harguess, J., Manville, K., and Rodriguez, M., “The vulnerability of uavs: An adversarial machine learning perspective,” in [ Geospatial Informatics XI ], 11733, 81–92, SPIE (2021)

    2021

  14. [22]

    Infer training data membership (aml.t0024.000)

    MITRE ATLAS, “Infer training data membership (aml.t0024.000).” https://atlas.mitre.org/ techniques/AML.T0024.000 (2023)

    2023

  15. [23]

    Invert ml model (aml.t0024.001)

    MITRE ATLAS, “Invert ml model (aml.t0024.001).” https://atlas.mitre.org/techniques/AML.T0024. 001 (2023)

    2023

  16. [24]

    Prompt leakage (aml.t0051.000)

    MITRE ATLAS, “Prompt leakage (aml.t0051.000).” https://atlas.mitre.org/techniques/AML.T0051. 000 (2023)

    2023

  17. [25]

    Llm07:2025 system prompt leakage – owasp top 10 for llm applications

    OW ASP Foundation, “Llm07:2025 system prompt leakage – owasp top 10 for llm applications.” https: //genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/ (2025). Accessed: 2025-05-06

    2025

  18. [26]

    Exploit vector embeddings (aml.t0024.002)

    MITRE ATLAS, “Exploit vector embeddings (aml.t0024.002).” https://atlas.mitre.org/techniques/ AML.T0024.002 (2023)

    2023

  19. [27]

    Llm08:2025 vector and embedding weaknesses – owasp top 10 for llm appli- cations

    OW ASP Foundation, “Llm08:2025 vector and embedding weaknesses – owasp top 10 for llm appli- cations.” https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/ (2025). Accessed: 2025-05-06

    2025

  20. [28]

    Aml.t0018.000 – poison training data

    MITRE ATLAS, “Aml.t0018.000 – poison training data.” https://atlas.mitre.org/techniques/AML. T0018.000 (2023). Accessed: 2025-05-06

    2023

  21. [29]

    Llm04:2025 data and model poisoning,

    Foundation, O., “Llm04:2025 data and model poisoning,” (2025). Accessed: 2025-03-24

    2025

  22. [30]

    Llm01: Prompt injection – owasp top 10 for llm applications

    OW ASP Foundation, “Llm01: Prompt injection – owasp top 10 for llm applications.” https://genai. owasp.org/llmrisk/llm01-prompt-injection/ (2025). Accessed: 2025-05-06

    2025

  23. [31]

    Llm03:2025 supply chain vulnerabilities – owasp top 10 for llm applications

    OW ASP Foundation, “Llm03:2025 supply chain vulnerabilities – owasp top 10 for llm applications.”https: //genai.owasp.org/llmrisk/llm032025-supply-chain/ (2025). Accessed: 2025-05-06

    2025

  24. [32]

    OW ASP Top 10 for LLM Applications – LLM02:2025 Sensitive Information Disclo- sure

    OW ASP Foundation, “OW ASP Top 10 for LLM Applications – LLM02:2025 Sensitive Information Disclo- sure.” https://owasp.org/www-project-top-10-for-large-language-model-applications/ (2025)

    2025

  25. [33]

    MITRE ATLAS Adversarial Threat Landscape for Artificial-Intelligence Sys- tems

    The MITRE Corporation, “MITRE ATLAS Adversarial Threat Landscape for Artificial-Intelligence Sys- tems.” https://atlas.mitre.org (2023)

    2023

  26. [34]

    Towards crisp-ml (q): a machine learning process model with quality assurance methodology,

    Studer, S., Bui, T. B., Drescher, C., Hanuschkin, A., Winkler, L., Peters, S., and M¨ uller, K.-R., “Towards crisp-ml (q): a machine learning process model with quality assurance methodology,” Machine learning and knowledge extraction 3(2), 392–413 (2021)

    2021

  27. [35]

    Lakshmanan, V., Robinson, S., and Munn, M., [ Machine Learning Design Patterns: Solutions to Common Challenges in Data Preparation, Model Building, and MLOps ], O’Reilly Media, Sebastopol, CA (2020)

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.