AIUC-1
Context
IntroductionCertificate overview
Framework comparisons
ChangelogAIUC-1 ConsortiumProvide input on AIUC-1Contact
Standard
A. Data & Privacy
B. Security
Third-party testing of adversarial robustnessDetect adversarial inputManage public release of technical detailsPrevent AI endpoint scrapingImplement real-time input filteringPrevent unauthorized AI agent actionsEnforce user access privileges to AI systemsProtect AI system deployment environmentLimit output over-exposure
C. Safety
D. Reliability
E. Accountability
F. Society
Certification
AIUC-1 certification Scoping Accredited auditors FAQ
Evidence overview
AIUC-1

Share your details and let us know how you hope to use AIUC-1

I am interested in...

The Security, Safety, and Reliability standard for AI agents

Stay up to date with AIUC-1

AIUC-1
AIUC-1.COM

© 2026.AIUC

OverviewChangelogConsortium

LEGAL

Privacy PolicyTerms of Service
AIUC-1 Standard
→
B. Security
→
B001. Third-party testing of adversarial robustness
B001

Third-party testing of adversarial robustness

Implement adversarial testing program to validate system resilience against adversarial inputs and prompt injection attempts in line with adversarial threat taxonomy

Keywords

Adversarial TestingRed TeamingPrompt InjectionJailbreak

Application

Mandatory

Frequency

Every 3 months

Type

Preventative

Crosswalks

MITRE ATLAS
AML-M0003: Model Hardening
AML-M0004: Restrict Number of AI Model Queries
NIST AI RMF
GOVERN 4.3: Testing and incident sharing
MEASURE 2.1: TEVV documentation
MEASURE 2.6: Safety evaluation
MEASURE 2.7: Security and resilience
OWASP Top 10
LLM01:25 - Prompt Injection
LLM04:25 - Data and Model Poisoning
LLM05:25 - Improper Output Handling
LLM08:25 - Vector and Embedding Weaknesses
CSA AICM
AIS-07: Application Vulnerability Remediation
MDS-06: Adversarial Attack Analysis
MDS-07: Robustness against Adversarial Attack / Model Hardening
TVM-01: Threat and Vulnerability Management Policy and Procedures
TVM-03: Vulnerability Remediation Schedule
TVM-05: External Library Vulnerabilities
TVM-06: Penetration Testing
TVM-07: Vulnerability Remediation Schedule
TVM-08: Vulnerability Prioritization
TVM-12: Threat Analysis and Modeling
TVM-13: Threat Response
AIS-08: Input Validation
OWASP AIVSS
Agent Cascading Failures
Agent Goal and Instruction Manipulation
IBM AI Risk Atlas
IBM 41: Inference - Evasion attack
IBM 43: Inference - Jailbreaking
IBM 46: Inference - Prompt injection attack
IBM 50: Inference - Direct instructions attack
IBM 52: Inference - Indirect instructions attack
Cisco AI Security Framework
AITech-1.1: Direct Prompt Injection
AITech-1.2: Indirect Prompt Injection
AITech-1.3: Goal Manipulation
AITech-1.4: Multi-Modal Injection and Manipulation
AITech-2.1: Jailbreak
AITech-3.1: Masquerading / Obfuscation / Impersonation
AITech-4.1: Agent Injection
AITech-4.2: Context Boundary Attacks
AITech-4.3: Protocol Manipulation
AITech-5.1: Memory System Persistence
AITech-5.2: Configuration Persistence
AITech-7.2: Memory System Corruption
AITech-7.4: Token Manipulation
AITech-9.1: Model or Agentic System Manipulation
AITech-9.2: Detection Evasion
AITech-11.2: Model-Selective Evasion
AITech-12.2: Insecure Output Handling
AITech-17.1: Sensor Spoofing
AITech-19.1: Cross-Modal Inconsistency Exploits
AITech-19.2: Fusion Payload Split

Control activities

Typical evidence

Establishing a taxonomy for adversarial risks. For example, drawing on NIST's AI 100-2e2023 attack classifications and aligning these to system architecture and use cases.
Conducting comprehensive adversarial testing at least quarterly. For example, performing structured red-teaming, prompt injection assessments, jailbreaking attempts, adversarial perturbation testing, semantic manipulation, and simulated malicious tool invocations.
Maintaining secure testing documentation. For example, recording test cases, methods, outcomes, and system behaviors with restricted access controls, implementing secure storage for sensitive testing materials.
Establishing improvement processes based on findings. For example, assigning owners and remediation timelines based on test severity, tracking fixes through risk registers or issue management systems, documenting updates to safeguards and procedures.
B001.1 Report: adversarial testing results

Third-party evaluation report showing adversarial robustness testing - must include risk taxonomy tested, testing methodology and findings, secure documentation practices, and improvement tracking with remediation timelines and documentation.

Category

Third-party Evals
Third-party evaluation report
Universal
Aligning adversarial testing with broader security testing programs. For example, integrating AI-specific test cases into broader penetration testing, sharing threat models across red/blue teams, aligning test cycles with security audit and compliance calendars.
B001.2 Documentation: Security program integration

Penetration test reports with AI-specific test cases, shared threat models, and testing calendars, or documentation of broader security program incorporating AI adversarial testing requirements.

Category

Operational Practices
Engineering PracticeInternal processes
Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.

AIUC-1 is built with industry leaders

Phil Venables

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Google Cloud
Phil Venables
Former CISO of Google Cloud
Dr. Christina Liaghati

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."

MITRE
Dr. Christina Liaghati
MITRE ATLAS lead
Hyrum Anderson

"Today, enterprises can't reliably assess the security of their AI vendors— we need a standard to address this gap."

Cisco
Hyrum Anderson
Senior Director, Security & AI
Prof. Sanmi Koyejo

"Built on the latest advances in AI research, AIUC-1 empowers organizations to identify, assess, and mitigate AI risks with confidence."

Stanford
Prof. Sanmi Koyejo
Lead for Stanford Trustworthy AI Research
John Bautista

"AIUC-1standardizes how AI is adopted. That's powerful."

Orrick
John Bautista
Partner at Orrick
Lena Smart

"An AIUC-1certificate enables me to sign contracts much faster— it's a clear signal I can trust."

SecurityPal
Lena Smart
Head of Trust for SecurityPal and former CISO of MongoDB