license: cc-by-nc-4.0
task_categories:

• text-classification
• text-generation
  language:
• en
  tags:
• ai-security
• adversarial-ml
• prompt-injection
• rag-security
• guardrails
• red-teaming
• llm-security
• agentic-ai
  pretty_name: ATLAS - Architectural Threat Library for AI Systems
  size_categories:
• n<1K

ATLAS: Architectural Threat Library for AI Systems

The first comprehensive benchmark for evaluating defenses against architectural attacks on AI systems.

Note: ATLAS (Architectural Threat Library for AI Systems) is distinct from MITRE ATLAS (Adversarial Threat Landscape for AI Systems). Our work provides complementary evaluation data.

Dataset Summary

ATLAS contains 879 rigorously deduplicated records designed to challenge AI security systems across architectural vulnerabilities that content moderation APIs miss entirely. While existing benchmarks focus on content safety—toxic outputs, harmful generations, jailbreaks—ATLAS targets the exploitation of RAG pipelines, tool routers, agent memory, reasoning chains, and other architectural components in production AI systems.

Key Finding: TF-IDF classifiers achieve near-perfect detection (F1=0.996) and—critically—generalize to completely held-out attack families (F1=1.0 on 4 families never seen during training). Meanwhile, simple keyword matching achieves only 37-60% recall, demonstrating that architectural attacks require purpose-built defenses.

Dataset Structure

Splits

Training Data: Full training splits (574 train + 81 val) available for research collaborations. Contact via GitHub Issues.

Held-Out Families in zero_day

The zero_day split contains attacks from four families completely absent from training:

This design tests whether your detector learns transferable representations of adversarial intent rather than memorizing family-specific patterns.

Attack Categories

Data Fields

{
    "attack_id": str,           # Unique identifier
    "attack_family": str,       # One of 28 attack families
    "attack_variant": List[str], # Attack characteristics
    "target_surface": str,      # Architectural component targeted
    "goal": str,                # Attack objective
    "severity": str,            # "critical", "high", or "medium"
    "context": {                # Operational environment
        "system_prompt": str,
        "developer_policy": str,
        "retrieved_docs": List[dict],
        "tools": List[dict],
        "memory_state": List[dict]
    },
    "conversation": List[dict], # Multi-turn exchanges
    "labels": {                 # Ground truth
        "is_attack": bool,
        "attack_success_expected": bool,
        "guardrail_action": str,
        "expected_safe_behavior": List[str]
    },
    "notes": {                  # Attack analysis
        "why_it_works": str,
        "defender_hints": str
    }
}

Usage

Loading the Dataset

from datasets import load_dataset

# Load evaluation splits
dataset = load_dataset("scthornton/atlas")

# Load specific split
eval_public = load_dataset("scthornton/atlas", split="eval_public")
zero_day = load_dataset("scthornton/atlas", split="zero_day")

Evaluate Your Guardrail

from datasets import load_dataset

# Load zero_day split (TRUE held-out families)
zero_day = load_dataset("scthornton/atlas", split="zero_day")

def your_guardrail(text):
    """Your detection function - returns True if attack detected"""
    # Implement your guardrail here
    pass

# Calculate Attack Success Rate
attacks = [ex for ex in zero_day if ex['labels']['is_attack']]
missed = sum(1 for ex in attacks
             if not your_guardrail(' '.join([t['text'] for t in ex['conversation']])))
asr = missed / len(attacks)
print(f"Attack Success Rate: {asr:.1%}")  # Lower is better

Baseline Results

eval_public Split (23 Families, Seen During Training)

zero_day Split (4 Held-Out Families)

Key insight: TF-IDF achieves perfect detection on families never seen during training, demonstrating that architectural attacks share detectable linguistic signatures.

Methodology

Deduplication

ATLAS underwent rigorous deduplication:

• 169 exact duplicates removed
• 438 near-duplicates removed (same 150-char prefix)
• Zero cross-split leakage verified

Ablation Study

Removing 10 signature words (ignore, forget, system, prompt, etc.) from TF-IDF vocabulary had no effect on performance (F1 remained 0.996), demonstrating attacks have multiple distinguishing features.

Real-World Grounding

Attack patterns derive from documented incidents:

• Arup Deepfake Fraud ($25.6M, Feb 2024): Authority impersonation
• Samsung ChatGPT Leak (May 2023): Data exfiltration
• Chevrolet Chatbot (Dec 2023): Policy override
• Air Canada Liability (Feb 2024): RAG citation spoofing

Responsible Use

Intended Uses

• Evaluating AI guardrail effectiveness
• Security research on RAG, agentic, and reasoning systems
• Benchmarking architectural attack detection

Prohibited Uses

• Attacking production AI systems without authorization
• Developing offensive tools for malicious purposes

Citation

@dataset{thornton2024atlas,
  author = {Thornton, Scott},
  title = {ATLAS: Architectural Threat Library for AI Systems},
  year = {2024},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/scthornton/atlas}
}

Additional Resources

• GitHub Repository: github.com/scthornton/atlas
• Paper: See paper/ATLAS_paper_v2.md

License

CC-BY-NC-4.0 (Creative Commons Attribution-NonCommercial 4.0 International)

Commercial use requires explicit permission from the author.

Contact

GitHub Issues at scthornton/atlas