genai-security-crosswalk 2.0.0

package/data/entries/DSGAI18.json

@@ -0,0 +1,613 @@
+{
+  "id": "DSGAI18",
+  "name": "Inference and Data Reconstruction",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0024.000",
+      "control_name": "Membership Inference",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversary determines whether specific sensitive records were used in training through systematic query analysis"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Training data confirmed present and partially reconstructed through inference, then exfiltrated"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0027",
+      "control_name": "Model Inversion",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversary reconstructs sensitive training examples from model outputs through systematic query campaigns"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Privacy policy extended to cover inference attack resistance — not just direct disclosure"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inference attack risks mapped — membership inference, model inversion, embedding inversion per deployment"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Red team exercises covering membership inference and model inversion attack scenarios"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Response for confirmed inference attack — unlearning, output rate limiting, disclosure assessment"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Training data privacy measures required — protecting sensitive data used in training",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Differential privacy and inference attack resistance are Art. 10 data governance requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures protecting against attacks including inference attacks",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Output rate limiting, confidence score suppression, and embedding encryption are Art. 15 requirements"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Differential privacy and output masking reducing information available for reconstruction attacks"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.34",
+      "control_name": "Privacy and PII protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Privacy requirements extended to cover inference attack resistance — not just direct disclosure"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Cryptographic protection of embedding vectors preventing inversion attacks"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Output monitoring for responses that reconstruct training data or sensitive source content"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — privacy-preserving",
+      "control_name": "A.7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Impact assessment",
+      "control_name": "A.5.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Advanced"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Planning — risk",
+      "control_name": "Cl.6.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.11 — Encrypt sensitive data at rest",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 18",
+      "control_name": "18.1 — Penetration testing",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.3.4 — Sensitive data identified",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6 Cryptography",
+      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inference attack resistance as OT data protection measure — differential privacy for OT training data"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inference attack campaigns detected — systematic query patterns indicative of AML.T0024.000 alerted"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Confidence score suppression as OT integrity control — limits information available for model inversion"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Retention of OT data beyond required period is a confidentiality risk"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data retention as OT risk scenario"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Reconstruction resistance as data protection measure — differential privacy in training, confidence score suppression"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for inference attack patterns — systematic output space probing detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inference attack risks documented per deployment — models trained on sensitive data assessed"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.RM-06",
+      "control_name": "Risk Management Strategy",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Risk tolerance for inference attacks established — acceptable reconstruction risk defined per use case"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Inference attack resistance as confidentiality protection — technical measures limiting reconstruction success",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Using model outputs to reconstruct personal information beyond authorised purposes is a P5 violation",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Output monitoring for reconstruction indicators — systematic query patterns detected",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Inference attack risks identified in GenAI risk assessment — membership inference, model inversion vectors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "PAN rendering",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "PANs reconstructed from model outputs must be prevented — inference attack resistance as Req 3 control"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored CHD",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Embeddings that can reconstruct PANs require Req 3 protection — differential privacy as encryption equivalent"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inference attack testing for GenAI models trained on CHD — membership inference and inversion attacks"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for inference attack risk against CHD-trained GenAI models"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Differential privacy, output perturbation, and prediction API rate limiting applied as DMS privacy-preserving controls"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inference attack red teaming included in AI system integrity verification — membership inference, model inversion, attribute inference tested before deployment"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Inference attack risk documented in AI risk assessment — treatment controls (differential privacy, output restrictions) justified"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Prediction API monitoring for inference attack patterns — high-volume, systematic query patterns that indicate shadow model training"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented retention periods and deletion procedures for all GenAI data"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Right-to-erasure and retention limits built into system requirements"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated verification that data is deleted per retention schedule"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "GenAI data lifecycle integrated into existing privacy programme"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-327",
+      "control_name": "CWE-327",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/327.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Service account with access to retained data beyond declared function",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum scope for data access credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Humans using machine credentials for data deletion — no audit trail",
+      "control_name": "NHI-10 Human Use of NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce human identity for all compliance operations"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — AI data governance requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define security requirements mandating AI-specific data governance including data stewardship, accountability structures, and policy enforcement mechanisms"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — governance-integrated AI architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Design AI systems with governance controls integrated into pipeline architecture; embed policy enforcement, approval workflows, and audit capabilities"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.3.1-PS",
+      "control_name": "Analyse root causes — governance failure analysis",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "When data governance failures contribute to AI incidents, conduct root cause analysis to identify governance gaps and strengthen frameworks"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — AI governance framework",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish comprehensive AI data governance framework within risk management strategy; define roles, policies, and oversight mechanisms"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-3",
+      "control_name": "Configuration Change Control — governance policy management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain AI governance policies under change control; require approval for policy modifications; audit all changes"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "RA-3",
+      "control_name": "Risk Assessment — governance completeness",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assess AI governance completeness; identify gaps in roles, policies, oversight, and accountability"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — AI governance framework",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish comprehensive AI data governance within ICT risk management; define roles, policies, accountability, and oversight mechanisms"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 13",
+      "control_name": "Learning and Evolving — governance improvement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply lessons learned to improve AI data governance; update policies and controls based on incident analysis and regulatory changes"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — governance scope mapping",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Map all AI systems subject to governance; ensure complete coverage of AI data assets in governance framework"
+    }
+  ],
+  "tools": [
+    {
+      "name": "IBM Adversarial Robustness Toolbox",
+      "type": "open-source",
+      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox"
+    },
+    {
+      "name": "ML Privacy Meter",
+      "type": "open-source",
+      "url": "https://github.com/privacytrustlab/ml_privacy_meter"
+    },
+    {
+      "name": "TensorFlow Privacy",
+      "type": "open-source",
+      "url": "https://github.com/tensorflow/privacy"
+    },
+    {
+      "name": "OpenDP",
+      "type": "open-source",
+      "url": "https://github.com/opendp/opendp"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    },
+    {
+      "name": "Atlan",
+      "type": "commercial",
+      "url": "https://atlan.com"
+    },
+    {
+      "name": "Apache Atlas",
+      "type": "open-source",
+      "url": "https://atlas.apache.org"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "Alation",
+      "type": "commercial",
+      "url": "https://www.alation.com"
+    },
+    {
+      "name": "ServiceNow GRC",
+      "type": "commercial",
+      "url": "https://www.servicenow.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Synthetic data re-identification — de-anonymized patients from synthetic health records",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-040"
+    },
+    {
+      "name": "Uber ML platform data lineage audit — fragmented provenance across 30+ feature stores",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-042"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM02",
+      "LLM08",
+      "LLM06",
+      "LLM05",
+      "LLM09"
+    ],
+    "dsgai_2026": [
+      "DSGAI10",
+      "DSGAI15"
+    ],
+    "agentic_top10": [
+      "ASI04",
+      "ASI09"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}