Threat comparison: where the line runs

11shared references

5only in the first

1only in the second

4 to 6mitigations in the catalogue

2/5shared effect classes

Only Backdoor ML Model5

Model and Training Data Manipulation · Development

BIML BIML78 model:2 BSI R20 NIST AI RMF NISTAML.021 NIST AI RMF NISTAML.026 OWASP LLM Top 10 LLM04:2026

Shared by both11

the same reference in the same framework

BIML BIML-LLM model:4 BSI R19 EU AI Act Article 53(1)(a) EU AI Act Article 55(1)(a) EU AI Act Article 9(1), 9(2)(a), 9(2)(d) MITRE ATLAS AML.T0018 NIST AI RMF MEASURE 2.7 NIST AI RMF NISTAML.023 NIST AI RMF NISTAML.051 NIST AI RMF Section 2.9 OWASP LLM Top 10 LLM05:2026

Only Sleepy Agent (Time/Event-Triggered Hidden Instructions)1

Model and Training Data Manipulation · Development

MITRE ATLAS AML.T0020

Backdoor ML Model 4 mitigations

The model contains hidden behavior, a backdoor. It works correctly on normal inputs; only a secret trigger pattern in the input flips the output to whatever result the attacker has chosen.

Model scanning for backdoors
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Neural cleanse techniques
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Activation clustering analysis
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Train from trusted base models only
Effect: Preventive Implementation level: Model & training, Supply chain Control type: Organizational & process-based Complementary type: Technical

Reason for the classification
Primarily organizational and process-based: Defined selection, operating, or lifecycle procedures make the control binding and repeatable; complemented by technical implementation.

Sleepy Agent (Time/Event-Triggered Hidden Instructions) 6 mitigations

Malicious logic lies dormant inside the model and only activates later: on a set date, at a specific event, or in a particular environment. Until then, the system passes every test and review without raising suspicion.

Behavioral analysis under diverse conditions
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Time-shifted testing
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Adversarial evaluation across contexts
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Runtime behavior monitoring
Effect: Detective Implementation level: Model & training, Use & operations Control type: Technical Complementary type: Organizational & process-based

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.
Model interpretability tools
Effect: Detective Implementation level: Model & training Control type: Technical

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Supply chain integrity verification
Effect: Preventive, Detective Implementation level: Model & training, Supply chain Control type: Technical Complementary type: Organizational & process-based

Reason for the classification
Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

Threat pathwayThe threat pathway shows how one of these threats unfolds in detail.

The file shows the current state including any filters and carries the note, catalogue version and source.

A shared reference means that both threats point to the same place in the same framework. It does not mean that one mitigation covers both.

Versatile AI Risk Assessment is an aid for structuring AI risks and making them transparent. It does not replace legal or professional advice and makes no binding decisions.

Further analyses