genai-security-crosswalk 2.0.0

package/data/entries/DSGAI20.json

@@ -0,0 +1,671 @@
+{
+  "id": "DSGAI20",
+  "name": "Model Exfiltration and IP Replication",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0016",
+      "control_name": "Extract ML Model",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Adversary systematically queries model to extract sufficient information to replicate its functionality"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Query results and model outputs systematically collected and transmitted to adversary infrastructure"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0034",
+      "control_name": "Cost Harvesting",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "High-volume model extraction queries consume significant compute resources — financial impact alongside IP theft"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction risks mapped per public-facing deployment — query volume limits, diversity monitoring"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction red team exercises — attempt replication using your own API"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for systematic extraction patterns — anomalous query diversity and volume"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Response for detected model extraction — rate limit tightening, session blocking, forensic capture"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures protecting AI system integrity",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "API rate limiting, output perturbation, and extraction monitoring are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI technical documentation includes model architecture and capability details",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Technical documentation must be protected — model extraction enables circumvention of documentation obligations"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering security incidents",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction detection in post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model weights, architectures, and fine-tuning configurations classified as intellectual property"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "API rate limiting, query restrictions, and anomaly detection limiting systematic model extraction"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for systematic querying patterns indicative of model extraction attacks"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.19",
+      "control_name": "Supplier relationships",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Security requirements for any third-party access to proprietary model capabilities"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — model artefacts",
+      "control_name": "A.7.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — design",
+      "control_name": "A.6.1.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Advanced"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Planning — risk",
+      "control_name": "Cl.6.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.2 — Allowlist authorised access",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 8",
+      "control_name": "8.6 — Collect DNS query audit logs",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 18",
+      "control_name": "18.1 — Penetration testing",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.1 — Access control per request",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.1.4 — Data minimisation in responses",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V10 Malicious Code",
+      "control_name": "V10.2.2 — Component integrity checking",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT GenAI model APIs rate-limited — systematic extraction requires high query volumes, rate limiting raises cost"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Human user authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Authentication on all OT GenAI model inference APIs — unauthenticated systematic querying blocked"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Model extraction patterns detected — unusual query diversity alerted as potential AML.T0016"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Regulatory compliance as OT risk scenario"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT security programme",
+      "control_name": "§8.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Compliance programme for OT GenAI deployments"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "API rate limiting as access control — systematic extraction requires high query volumes"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Production API monitoring — unusual query diversity and volume indicative of extraction alerted"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitoring for extraction behaviour — systematic output space coverage pattern detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction risk documented — IP exposure, CHD reconstruction potential assessed"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Proprietary model artifacts classified as confidential — access controls, rate limiting, extraction detection",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "API rate limiting as access control limiting systematic model extraction",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Model extraction pattern monitoring — unusual query diversity and volume detected",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Model extraction risks identified in risk assessment — extraction vectors, IP exposure assessed",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "API rate limiting as access control — systematic model extraction requires high query volumes"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.4.1",
+      "control_name": "Public-facing application protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction pattern detection as application protection — systematic API abuse detected"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.6.1",
+      "control_name": "Audit log review",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Automated monitoring for extraction patterns — unusual query diversity alerted"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for model extraction — IP exposure, CHD reconstruction potential assessed"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model weights and training artefacts protected as high-value IP — access controls, encryption, and exfiltration monitoring"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Output restrictions, query rate limiting, and watermarking applied as ASI model extraction defences"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "API query patterns monitored for model extraction signatures — systematic, high-volume queries from single sources"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Supply Chain Security (SCS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model weights protected throughout distribution — signed artefacts, access-controlled distribution channels"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Mapped regulatory obligations for all applicable jurisdictions"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Compliance KPIs tracked and reported to leadership"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Regulatory obligations surfaced as design requirements for all data flows"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Continuous monitoring for regulatory control effectiveness"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-EG",
+      "control_name": "Governance / Education & Guidance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All staff handling regulated data understand applicable obligations"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-201",
+      "control_name": "CWE-201",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/201.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Accountability domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "F",
+      "control_name": "Society domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Humans using machine credentials — no attribution for compliance evidence",
+      "control_name": "NHI-10 Human Use of NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce human identity for all regulated data operations"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Compliance audit credentials leaked — tampering with evidence possible",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Protect audit credential integrity"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — data localization requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define security requirements mandating compliance with data localization laws for all AI pipeline data; document jurisdictional restrictions for each dataset"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — jurisdictional access controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement access controls that enforce data localization boundaries; prevent data transfer or processing outside authorised jurisdictions"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — jurisdiction-aware artefact management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain jurisdiction metadata on all data and model artefacts; enable verification that training and serving comply with localization requirements"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-7",
+      "control_name": "Boundary Protection — data flow enforcement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce data flow controls preventing AI data from crossing jurisdictional boundaries; restrict to approved data centres and regions"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — localisation governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include data localisation in AI risk management; define data residency requirements per jurisdiction and data type"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-3",
+      "control_name": "Configuration Change Control — data location management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain documentation of AI data storage locations; require change control for data location modifications"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — localisation governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include data localisation in ICT risk management; define residency requirements per jurisdiction and data type for AI systems"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — cross-border data oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Address data localisation in third-party agreements; verify provider data processing locations meet residency requirements; monitor for unauthorised cross-border transfers"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — data location mapping",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Map physical and logical locations of all AI data; document processing jurisdictions for training, inference, and storage"
+    }
+  ],
+  "tools": [
+    {
+      "name": "LiteLLM",
+      "type": "open-source",
+      "url": "https://github.com/BerriAI/litellm"
+    },
+    {
+      "name": "Fiddler AI",
+      "type": "commercial",
+      "url": "https://www.fiddler.ai"
+    },
+    {
+      "name": "Watermarking via Watermark-Anything",
+      "type": "open-source",
+      "url": "https://github.com/facebookresearch/watermark-anything"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "Knockoff Nets detection",
+      "type": "open-source",
+      "url": "https://arxiv.org/abs/1812.02766"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "ART (Adversarial Robustness Toolbox)",
+      "type": "open-source",
+      "url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox"
+    },
+    {
+      "name": "Azure Policy",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/products/azure-policy"
+    },
+    {
+      "name": "AWS Config",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/config/"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "Privacera",
+      "type": "commercial",
+      "url": "https://privacera.com"
+    },
+    {
+      "name": "AWS Region Controls / Azure Policy",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/compliance/data-residency/"
+    },
+    {
+      "name": "Netskope",
+      "type": "commercial",
+      "url": "https://www.netskope.com"
+    },
+    {
+      "name": "OneTrust",
+      "type": "commercial",
+      "url": "https://www.onetrust.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "TikTok EU data localization enforcement — Project Clover + EUR 345M GDPR fine",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-043"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM02",
+      "LLM04",
+      "LLM07",
+      "LLM05"
+    ],
+    "dsgai_2026": [
+      "DSGAI18",
+      "DSGAI04"
+    ],
+    "agentic_top10": [
+      "ASI04"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}