H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may obtain models to serve as proxies for the target model in use at the victim organization. Proxy models are used to simulate complete access to the target model in a fully offline manner. Adversaries may train models from representative datasets, attempt to replicate models from victim inference APIs, or use available pre-trained models.

11 recorded

Relationships

mitigates

from Control Access to AI Models and Data in Production

Mitigation

mitigates

from Limit AI Service Query Volume and Rate

Mitigation

mitigates

from Limit Model Artifact Release

Mitigation

mitigates

from Limit Public Release of Information

Mitigation

mitigates

from Predictive AI Output Obfuscation

Mitigation

subtechnique-of

from Train Proxy via Gathered AI Artifacts

Technique

subtechnique-of

from Train Proxy via Replication

Technique

subtechnique-of

from Use Pre-Trained Model

Technique

uses

from Confusing Antimalware Neural Networks

Campaign

uses

from Evasion of Deep Learning Detector for Malware C&C Traffic

Campaign

uses

from Face Identification System Evasion via Physical Countermeasures

Campaign

1 external

References

mitre-atlas

AML.T0005