Test adversarial robustness
Implement adversarial testing program to validate system resilience against adversarial inputs and prompt injection attempts in line with adversarial threat taxonomy
Control activities
Establishing a taxonomy for adversarial risks. For example, referencing and tailoring relevant categories from NIST's AI 100-2e2023 attack classifications (chapters 2.1 and 3.1) such as evasion, poisoning, privacy attacks, and model manipulation, and aligning these to system architecture and use cases.
Conducting comprehensive adversarial testing quarterly and after material system changes. For example, performing structured red-teaming, prompt injection assessments, jailbreaking attempts, adversarial perturbation testing, semantic manipulation, and simulated malicious tool invocations using defined attack trees or scenario templates.
Maintaining secure testing documentation. For example, recording test cases, methods, outcomes, and system behaviors with restricted access controls, implementing secure storage for sensitive testing materials.
Establishing improvement processes based on findings. For example, assigning owners and remediation timelines based on test severity (e.g. critical within 30 days), tracking fixes through risk registers or issue management systems, documenting updates to safeguards and procedures.
Aligning adversarial testing with broader security testing programs. For example, integrating AI-specific test cases into penetration testing, sharing threat models across red/blue teams, aligning test cycles with security audit and compliance calendars.
Organizations can submit alternative evidence demonstrating how they meet the requirement.
AIUC-1 is built with industry leaders
"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."
"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."
"Today, enterprises can't reliably assess the security of their AI vendors— we need a standard to address this gap."
"Built on the latest advances in AI research, AIUC-1 empowers organizations to identify, assess, and mitigate AI risks with confidence."
"AIUC-1 standardizes how AI is adopted. That's powerful."
"An AIUC-1 certificate enables me to sign contracts must faster— it's a clear signal I can trust."
