Implementing a new enterprise-wide generative AI solution requires a specialized threat modeling approach that transcends traditional software…

The MIT AI Risk Repository is a curated knowledge base designed to help practitioners identify and understand the unique failure modes of AI systems. Its core component is the Taxonomy of AI Risks, which provides a structured framework for classifying potential harms. Leveraging this taxonomy during threat modeling allows the security team to systematically brainstorm, identify, and categorize AI-specific threats (e.g., model evasion, data poisoning, privacy violations) that are not covered by traditional software threat models like STRIDE. This directly addresses the goal of performing a comprehensive evaluation of unique AI failure modes.

B. Scanning for CVEs is a standard software composition analysis (SCA) task, not a specialized AI threat modeling activity addressed by the MIT repository.

C. Executing DDoS simulations is a form of security testing to validate a control against a specific threat, not the process of identifying and classifying diverse risks.

D. Hardcoding RBAC policies is an implementation of a security control, which is a result of the threat modeling process, not the process itself.

1. MITRE. (2023). MITRE ATLAS™ (Adversarial Threat Landscape for Artificial-Intelligence Systems). While distinct from the MIT repository, ATLAS is a similar framework whose methodology reinforces the practice of using a structured taxonomy to enumerate and understand adversary tactics against AI systems during threat modeling.

2. Harvard University, Berkman Klein Center for Internet & Society. (2020). A Taxonomy of AI Incidents. Research Publication. This work, which informs repositories like MIT's, demonstrates the academic and practical value of classifying AI failures to build robust threat models.

3. Workman, D. (2024). The AI Risk Repository. MIT Computer Science and Artificial Intelligence Laboratory (CSAIL). The official project documentation and associated materials describe its primary purpose as providing a taxonomy to "help AI developers and deployers to anticipate and mitigate risks."