# NIST AI 100-2e2025 gave adversarial machine learning a shared taxonomy, not a risk tolerance rule NIST published AI 100-2e2025 on March 24, 2025, organizing adversarial-machine-learning attacks and mitigations while leaving risk tolerance to the context of each use case. Canonical: https://rangoon.ai/insights/archive-nist-adversarial-machine-learning-taxonomy-march-2025/ Author: Rangoon Editorial (https://rangoon.ai/insights/editorial/) Published: 2026-10-24 Updated: 2026-10-24 Event date: 2025-03-24 Tags: [NIST](https://rangoon.ai/insights/tags/nist/), [AI security](https://rangoon.ai/insights/tags/ai-security/), [cybersecurity](https://rangoon.ai/insights/tags/cybersecurity/), [AI governance](https://rangoon.ai/insights/tags/ai-governance/) Source note: Historical reporting: NIST published AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, on March 24, 2025. NIST says the report creates a conceptual hierarchy for AI-system type, lifecycle attack stage, attacker goals, capabilities and knowledge, and discusses mitigations. The report is a NIST publication intended to support a common language and future practice; it does not set a universal acceptable-risk threshold, certify a system, establish a benchmark pass score, or demonstrate that a mitigation will defeat an attack in a given environment. Image: Adversarial-ML taxonomy. Original Rangoon explanatory diagram: Source boundary: dated primary release reporting; original editorial analysis. No vendor interface, photograph, measurement result, or endorsement implied. ## Key takeaways - NIST published a vocabulary and conceptual hierarchy for adversarial ML, not a universal security certification. - The taxonomy distinguishes predictive and generative systems and connects attacks to lifecycle stage and attacker conditions. - NIST discussed mitigations but did not assign a single acceptable-risk level across use cases. ## NIST published a common language for adversarial ML on March 24 [source 1](https://www.nist.gov/publications/adversarial-machine-learning-taxonomy-and-terminology-attacks-and-mitigations-0) [source 2](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf) NIST published AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, on March 24, 2025. The publication page identifies it as a NIST Trustworthy and Responsible AI report and describes a taxonomy of concepts plus terminology for the field. That is a concrete standards-and-guidance event: NIST put a named report, report number and public download into circulation. The report’s stated goal is to inform other standards and future practice guides by establishing common language for a rapidly changing security landscape. It did not announce a mandatory federal control set, a product approval pathway or a measured assessment of a named system. A taxonomy is useful for making risk discussions comparable, but it is not itself evidence that an organization has mitigated its own risks. ## The taxonomy classifies attacks by system, stage and attacker conditions [source 2](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf) NIST says the taxonomy is arranged as a conceptual hierarchy that includes machine-learning-method types, lifecycle stages of attack, and attacker goals, objectives, capabilities and knowledge. The report distinguishes predictive from generative AI systems and describes attacks associated with each. Its summary also situates AI in a broader system: data, the model, training, testing, deployment and the surrounding software and services matter, especially where generative systems can reach private data or tools with real-world effects. This is a newsworthy framing because it moves assessment away from a single model-output test. Still, a conceptual classification does not reveal a particular attacker’s access, a product’s exposed interfaces, model weights, tool permissions, data handling or operational controls. Those must be established for the actual system under review. ## Evasion, poisoning, privacy and misuse appeared beside mitigation limits [source 1](https://www.nist.gov/publications/adversarial-machine-learning-taxonomy-and-terminology-attacks-and-mitigations-0) [source 2](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf) The publication page lists attack taxonomy, abuse, data poisoning, evasion, privacy breach and attack mitigation among its keywords. NIST’s report describes methods for mitigating and managing consequences, while its published summary places the risks in different lifecycle phases. This permits a more disciplined statement than “AI has security risk”: attacks can be differentiated by target, timing, goal and adversary knowledge. It also prevents a false assurance shortcut. A list of mitigations is not proof that a model is robust, that an evaluation covered the relevant threats, or that a deployed application is safe when connected to changing data and tools. Mitigation quality depends on scenario, technical evidence and monitoring. The March release supplied the terms and organization for that analysis, not an outcome for any vendor or agency. ## NIST deliberately left acceptable risk contextual rather than declaring a universal threshold [source 2](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf) AI 100-2e2025 adopts security, resilience and robustness concepts from the NIST AI Risk Management Framework, but its executive summary says the report does not recommend a risk tolerance because acceptable risk is highly contextual and use-case-specific. That limitation is one of the report’s most useful boundaries. A public-service tool, a medical device, a research prototype and a consumer application can have different consequences, assets, users, adversaries and controls. The taxonomy can improve how people describe evidence and gaps across those settings; it cannot decide the acceptable residual risk for them. The published report also does not report efficacy rates for mitigations or supply a reproducible test suite with a pass/fail threshold. Historical coverage should call it a shared security vocabulary and taxonomy, not a universal assurance seal. ## Sources 1. [NIST: Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations](https://www.nist.gov/publications/adversarial-machine-learning-taxonomy-and-terminology-attacks-and-mitigations-0) 2. [NIST: AI 100-2e2025 PDF](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf) ## Related reading - [UK published an AI cyber-security code with 13 voluntary principles and an implementation guide](https://rangoon.ai/insights/archive-uk-ai-cyber-security-code-january-2025/) - [NIST’s preliminary Cyber AI Profile framed AI security in three linked roles](https://rangoon.ai/insights/archive-nist-cyber-ai-profile-preliminary-draft-december-2025/) - [UK’s third-party AI assurance roadmap mapped professionalization, information access and a planned innovation fund](https://rangoon.ai/insights/archive-uk-trusted-third-party-ai-assurance-roadmap-september-2025/) ## More information - [Documentation index](https://rangoon.ai/llms.txt) - [AI access and policies](https://rangoon.ai/ai/) - [Source repository](https://github.com/hypler-dev/rangoon)