aidefense-framework - An open-source knowledge base of defensive counter

项目说明

AIDEFEND™ — AI Defense Framework

![Live Demo]()

AIDEFEND is an open, implementation-oriented knowledge base of defensi for AI, machine-learning, LLM, multimodal, RAG, and agentic systems. It organizes defenses by security function, protected component, lifecycle phase, and the external security references they address.

Current source

1.20261002 provides:

Parent families are not implementation controls and do not recei control credit. Implementation-guidance entries are methods within their owning actionable control, not additional controls.

The optional WebMCP module loads the self-contained @mcp-b/global@4.0.0 IIFE from unpkg.com with a pinned SHA-384 Subresource Integrity value, then registers tools only when document.modelContext.registerTool is a. A compatible nati implementation bypasses the polyfill. Core framework browsing and the public datasets do not depend on WebMCP; when the runtime or API is una, no WebMCP tools are registered.

Framework co

Every actionable AIDEFEND control is assessed against the following external reference set. Each assessment contains one or more canonical relationships or an explicit N/A when no defensible direct relationship applies.

1. MITRE ATLAS
2. MAESTRO
3. OWASP LLM Top 10 2026
4. OWASP ML Top 10 2023
5. OWASP Top 10 for Agentic Applications 2026
6. NIST Ad Machine Learning 2025
7. Cisco Integrated AI Security and Safety Framework v2.0
8. Google Secure AI Framework 2.0 - Risks
9. Databricks AI Security Framework 3.0

A mapping indicates a defensible relationship between a threat or risk and an AIDEFEND control. It is not a certification claim, an implementation attestation, or e that a specific deployment is secure.

Mapping relevance is re at the actionable standalone-technique or leaf-sub-technique level. A non-actionable parent family's mapping list is the de-duplicated union of its re child mappings for na and reverse lookup only; it must not be used as implementation e or control credit.

Explore the framework

| View | Organizes defenses by |
|---|---|
| Tactics | Security function: Model, Harden, Detect, Isolate, Decei, Restore |
| Pillars | Protected component: Data, Model, Infrastructure, Application |
| Phases | Lifecycle stage: Scoping, Building, , Operation, Response, Impro |
| Frameworks | Reverse lookup from external threat or risk entries to corresponding AIDEFEND defenses |

Public data

The generated dataset is a at data/data.json. A compact na index is a at data/tactics-index.json. The additive data/framework-migrations.json registry identifies the current framework edition and semantic successors for superseded identifiers; it does not carry AIDEFEND mappings forward without a target-edition review.

The tool-neutral integration export in data/integration/ repackages the same release for downstream con (first consumer: the Precogly AI security library pack). manifest.json locks the AIDEFEND , release tag, data.json checksum and per-file checksums; controls.json lists the 309 actionable controls with plain-text descriptions, scope boundaries and site links, plus the 58 na families flagged actionable: false; threat-control-joins.json inverts defendsAgainst into one record per external threat item with the AIDEFEND controls and per-pair rationales; and threat-catalogs/<framework_key>.json carries upstream identifiers, names and structure only, ne descriptions. This release exports MITRE ATLAS, OWASP LLM Top 10 2026, OWASP ML Top 10 2023 and OWASP Top 10 for Agentic Applications 2026; the other fi frameworks are listed as deferred in the manifest. Every file carries schema_ and aidefend_, the layout only gains fields within a schema , and the folder is regenerated and with every release. A threat-to-control mapping says a control is relevant to a threat; it does not say the threat is mitigated, that a system is secure, or that any standard is satisfied.

The source of truth for AIDEFEND-authored framework content is tactics/*.js. Do not edit generated JSON files directly.

Generation intentionally strips source-only howTo detail, warnings, and other authoring fields according to the dataset-generation rules. Consumers must not assume that generated JSON is a complete mirror of the tracked tactic source.

The public dataset uses additi 2.3. .data is derived from the AIDEFEND source , and .generatedAt records the UTC generation time. The compact tactics index carries its own schema and the same generation timestamp.

scopeBoundary is optional structured boundary metadata. implementationGuidanceIds align one-to-one with the lightweight guidance strings; a guidance ID such as AID-H-002.004-G004 identifies an implementation method inside its owning control and is not a separate control or assessment result. Consumers of older data should treat a missing toolsSourceA field as an empty array and ignore unknown additi.

Tool recommendations use three licensing and delivery categories: toolsOpenSource is limited to OSI-licensed software; toolsSourceA covers non-OSI tooling and ends each entry with (<exact license>; source-a) or (<exact license>; open-weight); and toolsCommercial covers proprietary or offerings. Standards, datasets, specifications, documentation, methodologies, and papers are not classified as tools.

Local use

The website is static. Serve the repository with any local static web server:

For example:

Then open .

The core framework data, DOMPurify, and Tailwind browser bundle are stored locally. The pages request Google Fonts, the main page also requests Google Analytics, and the optional WebMCP module loads its exact-, integrity-pinned runtime from unpkg.com. Blocking those third-party origins does not remove the local framework data, but it can disable WebMCP, analytics, or hosted fonts.

Public dataset generation

Requirements:

npm run generate regenerates the public dataset from the tracked tactic source and the public keyword lock and technique hierarchy. npm run generate -- --check performs the same without rewriting tracked outputs. These public commands do not run the maintainer-only source-freshness, mapping, semantic-boundary, or external-reference review workflow.

Run npm test with Node.js and Python 3 a. The public regression tests use the Python standard library and do not require third-party Python packages.

Repository structure

Release and automatic tags

To publish a new Framework :

1. Set the same 1.YYYYMMDD in package.json and aidefend-intro.js.
2. Run npm run generate, review the content and generated changes, and commit them together.
3. Push or merge to main. The release workflow runs the repository tests, generated outputs, and creates the annotated v1.YYYYMMDD tag on the exact commit.

Each is published once. Later commits with the same preserve its
original tag; a content release needs a new . The current date format
supports one release per calendar day. Existing tags are ne,
o, or deleted, and rollback or conflicting tag targets fail
the workflow. If fails, fix the issue and retry the workflow on
main; no tag is created until passes. To inspect the proposed tag
without publishing, run node scripts/release-tag.mjs in a complete checkout
with the remote tags fetched.

Pull requests run with read-only permissions. Only the subsequent
main-branch publication job receives contents: write, using GitHub's temporary
token without an additional repository secret. Automated tag pushes do not
trigger another GitHub Actions workflow through GITHUB_TOKEN; future tag-based
deployment workflows must be connected explicitly. The website continues to
deploy from main. This automation creates Git tags, not GitHub Release pages,
npm packages, Engine promotions, or semantic-review approvals.

Security and implementation notice

AIDEFEND provides defensi objectives, implementation patterns, examples, mappings, and guidance. En thresholds, products, trust boundaries, regulatory obligations, and operational appro must be e by qualified practitioners before production deployment.

Example code is educational implementation guidance, not a drop-in guarantee of security. it against the exact platform , deployment architecture, threat model, and organizational policy in which it will run.

To report a , follow SECURITY.md. Use GitHub private reporting when a; ne exploit details, credentials, personal data, or sensiti in a public issue.

Licensing

AIDEFEND uses a deliberate split-license model:

Suggested content attribution:

> AIDEFEND AI Defense Framework, created by Edward Lee, licensed under CC BY 4.0.

When sharing modified content, also provide a link to CC BY 4.0 and indicate that changes were made. See LICENSING.md for the complete repository scope and attribution requirements.

Licensing does not grant permission to imply affiliation, certification, approval, or endorsement by AIDEFEND or any referenced framework owner.

Acknowledgments and independence

AIDEFEND synthesizes defensi and references identifiers or concepts from MITRE ATLAS, MITRE D3FEND, MITRE ATT&CK, MAESTRO, OWASP, NIST, Cisco, Google, and Databricks resources.

AIDEFEND is an independent project. It is not affiliated with, endorsed by, sponsored by, or officially connected to The MITRE Corporation, the Cloud Security Alliance, OWASP, NIST, Cisco, Google, or Databricks.

External names, identifiers, titles, and other third-party material remain subject to their respecti' rights. AIDEFEND's licenses apply only to AIDEFEND-authored code, content, and data as defined in LICENSING.md. See THIRD_PARTY_NOTICES.md for bundled third-party software and redistributed data notices.

Cisco AI Security and Safety Framework v2

Cisco mappings use the current v2.0.0 taxonomy announced on September 9, 2026: 19 objectives, 41 techniques, and 115 subtechniques. The Frameworks View retains Cisco objecti and uses AIDEFEND-authored summaries of their child techniques. Mapping decisions follow the complete official technique/subtechnique record and each AIDEFEND control's deployment mechanism. Definitions are primary; Cisco's own examples and standards mappings can clarify ambiguous scope, without creating transiti between frameworks. Shared keywords or an objecti alone do not establish defense co.

The current catalog and source pro are a in cisco-framework.js and generated data/cisco-framework.json. Cisco's framework key remains stable; identifiers and names represent v2 only. The migration registry and WebMCP resol the current edition for bare IDs, reject unsupported editions and retired IDs, and report ID/name conflicts instead of silently interpreting a v1 concept as v2. Historical conflict metadata does not restore v1 mappings or automatically select a successor.

Parent-family mappings are deri unions for na. All nine framework views list and count only actionable controls that actually match the selected threat group. Full and High describe relevance within the defense's stated scope, not deployment. Repairable implementation defects are tracked separately from relevance; a missing primary defense mechanism still cannot earn co from a title or tool name.

Official sources: Cisco v2 announcement and Cisco taxonomy.

Maintainer

AIDEFEND is led by Edward Lee. Connect on LinkedIn.

项目信息

开发语言：JavaScript

Star 数：174

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An open-source knowledge base of defensive countermeasures to protect AI/ML systems. Features interactive views and maps defenses to known threats from frameworks like MITRE ATLAS, MAESTRO, and OWASP.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。