IoPC Taxonomy · T9 Persistence, Propagation & Evasion

IOPC-T9.002 Detection & Attribution Evasion

Hiding AI-system compromise from the operator — masquerading as legitimate agents or users, stripping provenance, exploiting gaps in tool/agent logging, or flooding telemetry so real signals are lost.

How it differs

Catalog entry R030 (Telemetry evasion) is the observable indicator; this is the technique. Frequently paired with reporting_integrity = omitted / misrepresented in the IoPC envelope. Deceiving a defender's AI analyser is AI Analysis Evasion (T9.004).

Status

active, evidence: observed telemetry, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): R5 Tamper-evident Receipts (evidence supports)
• Google Secure AI Framework (SAIF): control:Threat Detection Threat Detection (evidence supports)
• MITRE ATLAS: AML.T0073 Impersonation (related)
• MITRE ATLAS: AML.T0074 Masquerading (related)
• MITRE ATLAS: AML.T0107 Exploitation for Defense Evasion (equivalent)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service