From Adversarial ML to AI Virology: Mapping Attack Mechanisms to Propagation and Inheritance

From a successful attack to a reproducing system

An agent reads an untrusted document, changes its behavior, and writes a new artifact that another agent later consumes. Several security events may occur along this path: an instruction crosses a trust boundary, the agent performs an unauthorized action, and a recipient encounters a derivative carrier. Establishing that these events form a reproducing lineage requires more than identifying the initial prompt injection.

Adversarial machine learning provides a vocabulary for the attack mechanism and the conditions that enable it. AI virology adds questions about transmission, inherited state, descendant viability, and the dependencies that allow propagation to continue. Combining these perspectives makes both incident descriptions and experiments more precise.

The November 9, 2026 Initial Public Draft of NIST SP 2400-102e2026, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, provides a useful basis for this connection. Its new agentic-systems treatment explicitly includes memory poisoning, malicious tools and skills, attacks between agents, and security problems that accumulate over long-running tasks. The edition remains a draft; the mapping developed here is a VXHEAVEN analytical proposal, not a NIST classification or endorsement. NIST publication record.

What the NIST framework contributes

The report organizes attacks by system type, lifecycle stage, attacker objectives, capabilities, and knowledge. For agentic systems, Section 4 emphasizes workflow stages, objectives, and capabilities. It distinguishes task instructions, planning, execution, and observation, and considers violations of availability, integrity, and privacy, together with misuse enablement. NIST draft, Executive Summary and Sections 4.1–4.1.3.

This structure makes a description such as “the agent was infected” incomplete in a productive way. An analyst must identify what the attacker controlled, where it entered the workflow, what authority the agent exercised, and which security property was violated. The presence of a model is insufficient to explain the event.

NIST’s reference architecture also separates the foundation model, agent scaffolding, memory, tools, and environment. This distinction is essential when locating durable changes. Contaminated memory can affect a clean model; a modified model can affect otherwise unchanged agent software; an external tool can introduce hostile content without modifying either. NIST draft, Figure 7 and Section 4.

For lineage analysis, the next question is which of these components carries the relevant behavior into a recipient. An incident may involve several components, but their causal roles should remain distinguishable.

Self-propagating injections are explicitly within scope

Section 3.5.2 of the draft discusses self-propagating injections, including the possibility that malicious prompts act as worms. Section 4.6 considers self-replicating prompt injections spreading across interconnected agents. These passages provide a direct connection between an AML taxonomy and propagation research. They do not define every category in the VXHEAVEN taxonomy. NIST draft, Sections 3.5.2 and 4.6, printed pages 53–54 and 69–70.

The cited research includes Lee and Tiwari’s Prompt Infection, which investigates LLM-to-LLM prompt injection and the replication of malicious prompts across multi-agent systems. Lee and Tiwari, 2024.

Another cited source, OpenAI’s September 2026 report, describes self-replicating injections discovered in training and evaluation, including carriers in email, files, and code comments. The report explicitly limits observed impact to simulated tool calls. That distinction should remain attached to the result when discussing its implications for deployed infrastructure. OpenAI, Self-replicating prompt injections exist.

Evidence of a mechanism in a controlled environment establishes a capability under those conditions. Claims about prevalence, uncontrolled spread, or survival against defenders require observations of those additional properties.

A crosswalk for the VXHEAVEN taxonomy

The following mapping relates our propagation categories to NIST attack concepts. Section numbers and identifiers refer specifically to the November 2026 Initial Public Draft. A mapping identifies a relevant mechanism; it does not establish that a case satisfies the corresponding worm definition.

The mapping is many-to-many. A RAG-mediated event can also involve memory poisoning and agent hijacking. The same prompt injection can affect integrity, privacy, or availability depending on the actions it induces. Classification should preserve these combinations rather than force every incident into one exclusive label.

Describe independent dimensions rather than evolutionary ranks

Prompt, RAG, and Memory Worms describe carriers and storage or exposure paths. Agent Worms identifies the participation of agent systems in reproduction. Weight-bearing replication describes how inference is provisioned. Adaptation describes how behavior changes with feedback. Self-sustenance describes continued operation under declared constraints.

These properties do not form a mandatory progression. A propagator can retain a fixed payload while maintaining resources reliably. Another can alter its behavior extensively while depending on a single external inference service. An agent may transmit contaminated memory without transferring any model parameters.

A useful case description therefore records several dimensions: carrier, affected state, recipient unit, transmission path, inherited behavior, feedback use, inference dependencies, and operational horizon. NIST’s attack classification supplies the mechanism and threat-model context for that description.

This also prevents capability from becoming a synonym for severity. The consequences depend on exposure, permissions, connectivity, and the resources at risk. A simple carrier encountered by highly privileged agents can be more consequential than a sophisticated adaptive process confined to an isolated environment.

Separate persistence, transmission, and reproduction

Persistence means that the relevant state or effect remains available across a declared boundary, such as a new task, a session reset, or a restart. Repeated activation from one poisoned memory entry can establish persistence without creating descendants.

Transmission means that relevant material or state reaches another recipient. A copied document demonstrates delivery, but may never be retrieved, interpreted, or used. Transmission therefore needs an exposure record when the claim concerns behavioral effects.

Reproduction means that an affected participant causally establishes a viable descendant that can continue the propagation mechanism under the specified conditions. The descendant may be a newly affected existing agent or a newly instantiated runtime. A study must declare which unit it counts.

For semantic carriers, exact byte identity is not necessary. A transformed artifact can retain the behavior required for continuation. Conversely, a verbatim copy may be inert. Viability should be evaluated through a bounded continuation test, with the relevant inherited content causally linked to the result.

That causal requirement distinguishes lineage from common exposure. If several agents independently retrieve the same original poisoned document, they are not automatically descendants of one another. Logs should connect the parent-produced artifact or state transition to the recipient’s subsequent behavior. Removal or substitution controls can test whether the proposed inherited state was necessary.

Measure viable descendants explicitly

A proposed empirical reproduction measure for a fully observed parent cohort is:

$$ \widehat{R}_{\mathrm{AI}}(H) =\frac{1}{m}\sum_{i=1}^{m}n_i(H). $$

Here, \(m\) is the number of parent units, \(H\) is a predeclared observation horizon measured from each parent’s eligibility time, and \(n_i(H)\) is the number of newly affected, viable descendant units attributed to parent \(i\) during that horizon. This is an analytical metric proposed for AI-virology evaluation, not a metric specified by NIST.

Count a destination once within the declared cohort analysis. If several parents contribute to its establishment, use a stated attribution rule or report the unresolved event separately; do not award the entire event to every parent. Include parents with zero descendants. Censored follow-up requires explicit treatment rather than assuming unobserved descendants are absent.

The metric depends on the unit and the environment. Processes sharing a single inference service may be distinct propagation participants while sharing a critical failure dependency. A process count must not silently become a count of independent inference systems.

Report initial compromise success, persistence, carrier production, recipient exposure, and descendant viability separately. Also report legitimate task completion, elapsed time, tool use, and inference cost. A higher descendant count obtained through a larger budget does not by itself establish a more effective adaptation mechanism.

An empirical value above one is not a universal epidemic threshold. Interpreting sustained growth requires assumptions about recipient availability, removal, generation timing, shared dependencies, and how those conditions change as propagation proceeds.

Tools and skills as carriers and authority boundaries

NIST distinguishes malicious tools and malicious skills in Section 4.5. Tool metadata can affect planning before a tool executes, while tool results can affect subsequent decisions. Skills can package instructions, scripts, and supporting resources that an agent follows as procedural guidance. NIST draft, Section 4.5, NISTAML.063 and NISTAML.064.

For AI virology, these are possible carrier surfaces. The relevant questions are whether an affected agent produces or modifies such material, how it reaches another agent, and whether the next agent continues the behavior. Installing a malicious skill establishes neither self-propagation nor a distinct worm class without that continuation evidence.

Authority should be recorded independently of presentation. A tool description, generated plan, peer message, or remembered experience may look like operational guidance while originating outside the trusted instruction path. A useful lineage record identifies both the source of the content and the point at which it influenced a consequential action.

Model modification and inherited behavior

NIST’s glossary distinguishes model tampering for an attacker’s own use from model poisoning in which a modified model is provided to others. Section 3.6 discusses direct parameter edits, while Section 4.3 examines compromised models and adapters entering agent deployments. NIST draft, Sections 3.6 and 4.3, and Glossary entry for model tampering.

This distinction helps classify intent and distribution. Authorized repair remains ordinary model modification. A maliciously changed checkpoint distributed to victims introduces a different trust relationship. Neither operation is inherently self-reproducing.

Testing inherited behavior requires a recipient that actually loads the relevant parameters under controlled runtime conditions. The effect must be distinguished from inherited prompts, memory, adapters, and software. A matching hash establishes artifact identity; behavioral comparisons establish what the artifact does.

Security claims must also identify the available access. Querying an inference API, obtaining read access to weights, modifying a candidate checkpoint, and promoting it into service are different capabilities. A propagation model that assumes all four when only one is available overstates the feasible attack surface.

Adaptation and continuity need separate evidence

In security evaluation, an adaptive attacker tailors an attack to the defense being evaluated. This may involve an external researcher or optimization process. An Adaptive Worm, as used in this taxonomy, changes its own operational behavior using feedback. The two concepts overlap only when the system under study actually performs that adaptation.

Inheritance adds another condition: the relevant change must reach descendants. Improvement adds a comparison: descendants retaining the change must perform better under a declared measure than suitably matched alternatives. More attempts, additional resources, or a different environment must not be mistaken for an inherited advantage.

NIST’s treatment of long-horizon agents explains why durable memory, accumulated access, and changing operational context complicate recovery. It does not provide a definition or demonstration of complete self-sustenance. NIST draft, Section 4.7.

A continuity claim should name the function retained, the dependency removed or disrupted, and the duration observed. Operator independence, continued inference, resource replenishment, and recovery are separate measurements. A population that survives while a shared service remains available has demonstrated continuity under that dependency.

A worked classification record

Consider a hypothetical contained test with three existing agents. Agent A retrieves a contaminated document and writes a derived note. Agent B receives only that note and produces another derivative. Agent C receives B’s derivative and demonstrates the same bounded continuation behavior. Fresh recipient contexts and controls excluding the candidate inherited material establish the causal role of the carriers.

This example specifies evidence to look for; it is not an experimental result reported by NIST or VXHEAVEN.

If a researcher performs every delivery, the result establishes a viable carrier under assisted transmission. It does not establish autonomous discovery or delivery. If B and C also see the original document, the proposed lineage becomes confounded until common exposure is excluded.

Real case records should add artifact versions, timestamps, evaluation settings, failed branches, uncertainty, and evidence of any intervention. A concise NIST mapping is most useful when it points to that underlying record rather than replacing it.

Defensive architecture and evaluation

The draft distinguishes model-level defenses from system-level constraints and discusses information-flow control, action policies, inter-agent authorization, and recovery across persistent state. It also recognizes trade-offs between security controls and useful functionality. NIST draft, Sections 4.2 and 4.4–4.7.

A propagation-focused defensive evaluation should test the boundaries at which untrusted content becomes authority, durable state is written, information reaches another agent, or a new runtime is provisioned. Enforcement at these boundaries can limit consequences even when the model misinterprets a carrier.

Memory and retrieval records need provenance and controlled write paths. Tool and skill changes need versioned review. Inter-agent communication needs authenticated identities and task-scoped permissions; identity alone does not make message content trustworthy. Model artifacts need provenance and independent behavioral evaluation. Signing establishes a relationship to a publisher, not the safety of the publisher’s model.

Recovery should follow both lineage and shared dependencies. Removing one parent may leave independent descendants active. Replacing one checkpoint may leave contaminated memory intact. Conversely, many apparent descendants may stop together when a shared service is removed. These are different containment outcomes and should be reported separately.

AgentDojo provides a research environment for evaluating agents that use tools over untrusted data. Extending such evaluations to reproduction requires additional lineage and continuation measurements. Debenedetti et al., AgentDojo.

Safe studies can use isolated recipients, synthetic data, inert behavioral markers, simulated resource budgets, and externally enforced limits on instances, generations, and duration. A marker validates the modeled transfer mechanism, not every possible malicious objective. Delivery and provisioning supplied by the test harness must remain visible in the findings.

Scope and interpretation

Section 4 of the NIST draft excludes unintended behavior that does not arise from adversarial attack. AI-virology investigations may also examine unauthorized propagation without an identified external attacker. Such cases need an explicit origin field: external compromise, deliberately malicious deployment, or unintended behavior. They should not be forced into an attacker-centered account unsupported by the evidence.

The crosswalk also depends on a draft whose labels and structure may change. Preserve the edition and section titles alongside identifiers, and review mappings when a later version appears. A mapping is a research classification aid, not a certification of NIST compliance.

The combined approach gives each claim a concrete object of measurement. Attack analysis identifies the controlled resource, trust boundary, and violated property. Lineage analysis identifies the inherited state, viable recipients, and conditions for continuation. Together, these records make it possible to distinguish a persistent compromise, a repeated distribution campaign, and a reproducing AI-mediated system.

References

1. Apostol Vassilev, Alina Oprea, Alie Fordyce, Xander Davies, and Maia Hamin. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST SP 2400-102e2026, Initial Public Draft, November 2026. Publication record. Section and page references in this article refer to this edition and its printed page numbers.
2. Donghyun Lee and Mo Tiwari. Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems. arXiv:2410.07283, 2024. Cited as reference [259] in the NIST draft.
3. OpenAI. Self-replicating prompt injections exist. Disclosure and report update: September 25, 2026. Cited as reference [355] in the NIST draft.
4. Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352, 2024.