genai-security-crosswalk 2.0.0

package/data/entries/DSGAI04.json

@@ -0,0 +1,752 @@
+{
+  "id": "DSGAI04",
+  "name": "Data Model and Artifact Poisoning",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0020",
+      "control_name": "Poison Training Data",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversary introduces malicious data into training pipeline — corrupts model behaviour in ways baked into weights"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0018",
+      "control_name": "Backdoor ML Model",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hidden functionality embedded in model weights — triggered by specific inputs, invisible to standard testing"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0031",
+      "control_name": "Craft Adversarial Data",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarially crafted training examples designed to produce specific model behaviours without detection"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data and model poisoning categorised as Critical — specific attack vectors mapped per training pipeline"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing covering poisoning detection in training pipelines before each production promotion"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-3.3",
+      "control_name": "Data quality",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data quality measurement and validation applied to all training and fine-tuning data"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Incident response including model rollback for detected poisoning events"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data must be subject to governance practices — relevant, representative, free of errors",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data quality controls and provenance requirements preventing poisoning are binding Art. 10 obligations"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI must be resilient to attempts to alter performance through data manipulation",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Technical robustness against poisoning is a binding Art. 15 requirement with conformity assessment evidence"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Systemic risk GPAI providers must conduct adversarial testing to identify and mitigate systemic risks",
+      "control_name": "Art. 55(1)(b) — Systemic risk GPAI adversarial testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection adversarial testing is a binding obligation for systemic risk models"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.8",
+      "control_name": "Management of technical vulnerabilities",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Scanning and patching model components and training pipeline dependencies"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.19",
+      "control_name": "Supplier relationships",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Security requirements applied to all third-party training data and model sources"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.27",
+      "control_name": "Secure system architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training pipeline designed with integrity controls and supply chain verification"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversarial testing of model outputs for poisoning indicators before deployment"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.9",
+      "control_name": "Configuration management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model versions, adapters, and datasets managed with integrity and change controls"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — preparation",
+      "control_name": "A.7.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — design",
+      "control_name": "A.6.1.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 7",
+      "control_name": "7.1 — Establish vulnerability management",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.11 — Use up-to-date software components",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 18",
+      "control_name": "18.1 — Establish penetration testing programme",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.1.3 — Input validation server-side",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10 Malicious Code",
+      "control_name": "V10.2.1 — Application only uses official repositories",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10 Malicious Code",
+      "control_name": "V10.2.2 — Dependency managers check for vulnerabilities",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V12 Files/Resources",
+      "control_name": "V12.1.1 — File upload size limits",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Training data integrity controls — source allowlisting, anomaly detection, provenance tracking"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Continuous monitoring of OT GenAI model outputs — systematic anomalies indicating poisoning detected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Poisoning events treated as Critical security incidents — model suspended, process control fallback activated"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 7.6",
+      "control_name": "Denial of service protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Poisoned model availability impact contained — fallback procedure prevents physical process disruption"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Pipeline integrity is a core OT security requirement"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data pipeline security in OT risk assessment"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Authenticated, integrity-verified data flows across zone boundaries"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data providers treated as suppliers — provenance, quality, integrity requirements in contracts"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data protected at rest — integrity verification, source allowlisting, provenance tracking"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for unauthorised software — model integrity verification at deployment, output anomaly detection"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "RS.AN-03",
+      "control_name": "Incident Analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning incidents analysed — affected training runs, deployed models, downstream impact assessed"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Poisoning threats documented in GenAI risk assessment — training data, supply chain, model update vectors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Model promotions through change management — integrity verification before production deployment",
+      "control_name": "CC8.1 — Change management",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Training data providers in vendor risk programme — provenance, quality, integrity requirements assessed",
+      "control_name": "CC9.1 — Vendor risk",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Model output anomaly monitoring — poisoning indicators detected before operational impact",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.5.6",
+      "control_name": "Secure system changes",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All model promotions tested for unexpected functionality — poisoning detection as Req 6.5 testing requirement"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Automated monitoring of GenAI outputs in CDE — systematic anomalies indicating poisoning detected"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Poisoning detection in CDE penetration testing programme"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8",
+      "control_name": "TPSP programme",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data providers as TPSPs — data quality and integrity requirements in vendor agreements"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All training data sources verified — provenance documented, anomaly detection on data pipelines, integrity checks before ingestion"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model weights verified before deployment — cryptographic signatures, behavioural baseline testing for unexpected outputs"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Runtime monitoring for unexpected model behaviour — output distribution drift, sudden accuracy changes, anomalous activation patterns"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All external training datasets treated as untrusted supply chain components — provenance, quality review, and integrity verification before use"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Design authentication and integrity controls for every pipeline stage"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "mTLS, input validation, and access controls enforced across pipeline"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SD",
+      "control_name": "Implementation / Secure Deployment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Infrastructure-as-code with security controls applied at provisioning"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Review every pipeline component for authentication and integrity gaps"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-EM",
+      "control_name": "Operations / Environment Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Regular security updates for all pipeline components"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-345",
+      "control_name": "CWE-345",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/345.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-346",
+      "control_name": "CWE-346",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/346.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-20",
+      "control_name": "CWE-20",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/20.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B003",
+      "control_name": "Third-party security assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Unauthenticated connections between pipeline stages",
+      "control_name": "NHI-4 Insecure Authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require mTLS or token auth for all pipeline connections"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Pipeline service account with access to all stages",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Per-stage credentials with minimum scope"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Same credential used for multiple pipeline stages",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Separate credentials per stage"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — data and artefact integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Protect training data, model weights, adapters, and pipeline artefacts from unauthorised modification; enforce write access controls and integrity monitoring"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — versioned artefact management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain versioned, integrity-verified snapshots of all training data, model checkpoints, and pipeline artefacts; enable rollback to known-good state"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — dataset and artefact vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all third-party datasets, pre-trained models, and pipeline components for provenance, integrity, and potential poisoning before use"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.3.1-PS",
+      "control_name": "Analyse root causes — poisoning forensics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "When poisoning is detected, conduct forensic analysis to identify corrupted records, trace to source, and determine blast radius across dependent models"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-2",
+      "control_name": "Supply Chain Risk Management Plan — AI data and artefact sources",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI training data, model weights, and pipeline artefacts in supply chain risk management with provenance documentation"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls — artefact provenance verification",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify integrity and provenance of all AI artefacts using cryptographic signatures and checksums before use in any pipeline"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-3",
+      "control_name": "Malicious Code Protection — training pipeline integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Extend malicious code protection to training data and model artefacts; detect poisoned data, anomalous patterns, and backdoor indicators"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-28",
+      "control_name": "Protection of Information at Rest — artefact encryption",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encrypt all training data, model weights, and pipeline artefacts at rest; enforce key management per FedRAMP requirements"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — training pipeline integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls protecting training data and model artefacts from poisoning, tampering, and unauthorised modification"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 24–27",
+      "control_name": "Resilience Testing — poisoning detection testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include data poisoning scenarios in resilience testing; test detection capabilities and recovery procedures for poisoned data and model artefacts"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 12",
+      "control_name": "Backup Policies — model and data restoration",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain versioned backups of training data and model weights with integrity verification; enable rollback to pre-poisoning states"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — poisoning post-mortem",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Conduct post-incident analysis for data poisoning events; trace poisoned content and update protection controls"
+    }
+  ],
+  "tools": [
+    {
+      "name": "IBM Adversarial Robustness Toolbox",
+      "type": "open-source",
+      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox"
+    },
+    {
+      "name": "CleanLab",
+      "type": "open-source",
+      "url": "https://github.com/cleanlab/cleanlab"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "Armory",
+      "type": "open-source",
+      "url": "https://github.com/twosixlabs/armory"
+    },
+    {
+      "name": "Cleanlab",
+      "type": "open-source",
+      "url": "https://github.com/cleanlab/cleanlab"
+    },
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://github.com/great-expectations/great_expectations"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    },
+    {
+      "name": "LAAF v2.0",
+      "url": "https://github.com/qorvexconsulting1/laaf-V2.0",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "ChatGPT indirect prompt injection via attacker-controlled web content",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-003"
+    },
+    {
+      "name": "Hugging Face model repository pickle-based malware supply chain",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-009"
+    },
+    {
+      "name": "RAG corpus poisoning — embedding-space manipulation to force retrieval",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-016"
+    },
+    {
+      "name": "LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2026,
+      "incident_id": "INC-021"
+    },
+    {
+      "name": "Greshake et al. \"Not What You've Signed Up For\" indirect prompt injection paper",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-022"
+    },
+    {
+      "name": "Nassi et al. \"ComPromptMized\" Morris II multi-agent worm",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-023"
+    },
+    {
+      "name": "Adversarial embedding attacks on production RAG systems",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-046"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM03",
+      "LLM04",
+      "LLM08",
+      "LLM05"
+    ],
+    "agentic_top10": [
+      "ASI06",
+      "ASI04"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}