abu-02-deferred-research: Deferred research: training-data poisoning & model extraction (decision record)
Category: Resource abuse and research (feintkit-abuse). Loopback port: none (standard input and output only).
What it simulates
Decision record: training-data poisoning and model extraction are not simulated by this suite, and the entry only writes a marker file saying so.
Training-data poisoning (MITRE ATLAS AML.T0020, OWASP LLM04:2025) manipulates the data a model is trained or fine-tuned on, and model extraction (AML.T0024.002) copies a model by querying it. Both need a real model, real training or a real inference service, so a harmless simulation would either be fake or would carry real cost and risk. This suite therefore records a decision not to simulate them: this entry simulates nothing, produces no attack traffic, and writes one marker file and one event stating that it is a decision record. The decision, its reasons and the requirements of a safe future design are in the scenario spec.
Mapping
- MITRE ATLAS: AML.T0020, AML.T0018.000, AML.T0024.002
- OWASP LLM Top 10 2025: LLM04:2025
- OWASP Agentic Top 10 2026: none
Why these techniques apply
- AML.T0020: Training data poisoning.
- AML.T0018.000: Poisoning an AI model.
- AML.T0024.002: Model extraction.
What a product should detect
| Signal | What to flag | Where | Match rule |
|---|---|---|---|
| S1 | Feintkit marker string in the marker file and events; a product sees no attack behavior, because none is simulated | output directory (proof.txt, events.jsonl) | FEINTKIT::abu-02-deferred-research::[A-Za-z0-9]{4,16}::DEFENSIVE-TEST-ONLY |
| S2 | Decision event stating that nothing was simulated | events.jsonl decision_recorded event | event decision_recorded with detail.decision equal to not_simulated and detail.simulated equal to false |
What a defender can do
- Restrict: Nothing to restrict here: this entry only records that training-data poisoning and model extraction are not simulated by the suite.
- Add a rule: No detection rule applies, so do not count this entry as coverage of either threat.
- Change a setting: Cover these threats with controls outside the suite, for example provenance review of training data and rate limits on model access.
Run it
feintkit run abu-02-deferred-research --root <repository> --deterministic, then feintkit verify abu-02-deferred-research --root <repository>.
Every artifact contains FEINTKIT::abu-02-deferred-research::<run id>::DEFENSIVE-TEST-ONLY. Read RESPONSIBLE-USE.md before running.