cs.CRMar 5, 2026

Cyber Threat Intelligence for Artificial Intelligence Systems

Authors: Natalia Krawczyk, Mateusz Szczepkowski, Adrian Brodzik, Krzysztof Bocianiak

Organizations: Orange Innovation Poland

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

As artificial intelligence (AI) becomes deeply embedded in critical services and everyday products, it is increasingly exposed to security threats which traditional cyber defenses were not designed to handle. In this paper, we investigate how cyber threat intelligence (CTI) may evolve to address attacks that target AI systems. We first analyze the assumptions and workflows of conventional threat intelligence with the needs of AI-focused defense, highlighting AI-specific assets and vulnerabilities. We then review and organize the current landscape of AI security knowledge. Based on this, we outline what an AI-oriented threat intelligence knowledge base should contain, describing concrete indicators of compromise (IoC) for different AI supply-chain phases and artifacts, and showing how such a knowledge base could support security tools. Finally, we discuss techniques for measuring similarity between collected indicators and newly observed AI artifacts. The review reveals gaps and quality issues in existing resources and identifies potential future research directions toward a practical threat intelligence framework tailored to AI.

Figures & tables

Figure 1: An example report entry in the AVID database [ 28 ] .
Figure 2: The AVID taxonomy matrix [ 1 ] .
Figure 3: SEP and Lifecycle views of the AVID taxonomy represent different sections of the space of potential risks in an AI development workflow [ 1 ] .
Figure 4: Number of reports in AI Incident Database (AIID) in 2015-2025 [ 18 ] .
Figure 5: Example core metadata fields in AIID [ 28 ] .
Figure 6: Example GMF taxonomy classification for a specific incident [ 28 ] .
Figure 7: GMF annotation process diagram [ 28 ] .
Figure 8: Application of the annotation process for the real-world AIID incident (ID 72) [ 28 ] .
ModelFile typeSHA1
glockr1/ballr7PyTorch1733506c584dd6801accf7f58dc92a4a1285db1f
glockr1/ballr7Pickle79601f536b1b351c695507bf37236139f42201b0
who-r-u0000/0000000000000000000000000000000000000PyTorch0dcc38fc90eca38810805bb03b9f6bb44945bbc0
who-r-u0000/0000000000000000000000000000000000000Pickle85c898c5db096635a21a9e8b5be0a58648205b47
Table 1: Example malicious model files found in Hugging Face.
Figure 9: Example IoCs based on NSFOCUS Threat Intelligence [ 21 ] .
More in this topic

Cyber Threat Intelligence

Cyber threat intelligence turns evidence about adversaries, campaigns, and vulnerabilities into knowledge that helps defenders anticipate and respond to attacks.

See all 41 papers

Explore similar work

CardsList

  1. STRIDE-AI: A Threat Modeling Framework for Generative AI Security Assessment

    May 16, 2026Tsafac Nkombong Regine Cyrille, Franziska SchwarzAI AssuranceAI Risk Management

    SRH University of Applied Sciences Heidelberg School of Technology and Architecture CyberMACS (Applied Cybersecurity) Berlin, Germany · Universidad de Granada Facultad de Ciencias Econ´omicas y Empresariales Granada, Spain

  2. CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

    Aug 19, 2026Yutong Cheng, Changze Li, Qian Cui +4Cyber Threat IntelligenceAgentic Retrieval

    Virginia Tech · Amazon · Northwestern University

  3. From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures

    Mar 4, 2026Chiara Bonfanti, Davide Colaiacomo, Luca Cagliero +1Autonomous Cyber DefenseCyber Threat Intelligence

    Department of Control and Computer Engineering, Politecnico di Torino, Italy