NIST AI 100-2 adversarial ML terms for defense T&E

High-intent query: which adversarial-machine-learning terms should a defense test-and-evaluation plan use? NIST AI 100-2e2025 is the official taxonomy and terminology report. It is not a T&E instruction and not a product certificate.

Companions: CDAO T&E of AI systems, AI red-teaming requirements for defense programs, and the NIST AI RMF kit.

What NIST published

NIST’s CSRC page dates Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations March 2025 (final 24 March 2025). The abstract says the report provides a taxonomy of concepts and defines terminology in the field of adversarial machine learning (AML). The taxonomy is arranged in a conceptual hierarchy that includes key types of ML methods, life cycle stages of attack, and attacker goals, objectives, capabilities, and knowledge. It also identifies current challenges in the life cycle of AI systems and describes corresponding methods for mitigating and managing the consequences of those attacks. Taken together, the taxonomy and terminology are meant to inform other standards and future practice guides by establishing a common language for the rapidly developing AML landscape.

Authors named on that page include Apostol Vassilev (NIST) and Xander Davies (U.K. AI Security Institute). That is an author affiliation, not a claim that Inspect implements AI 100-2.

How it sits next to the AI RMF and ATLAS

NIST AI RMF 1.0 discusses TEVV as part of measuring AI risk. AI 100-2 is the AML vocabulary that a Measure-function conversation can use. It does not turn TEVV into an aviation qualification method.

MITRE ATLAS is a globally accessible, living knowledge base of adversary tactics and techniques involving AI. ATLAS is a knowledge base. AI 100-2 is a NIST terminology report. Neither page we cite says one replaces the other. See the MITRE ATLAS listing.

Directory listings that speak this vocabulary

Adversarial Robustness Toolbox is a Python library for evaluating and defending ML models against evasion, poisoning, extraction and inference. IARPA TrojAI, Counterfit, HEART and Advai sit in the same adversary-testing cluster. Fiddler AI, QuantPi and Resaro AIP are commercial TEVV-oriented listings; their cited pages are not NIST AI 100-2.

The DoD RAI kit is the public teaser for ethical-principle vendor questions, not an AML score.

What this is not

AI 100-2 is not a CDAO T&E handbook, not a CMMC level, and not a certificate that a named library “implements NIST.” Use it as shared language. Confirm T&E methods with the program office.