Key Takeaways
- AI infrastructure in defense and critical sectors has become strategic assets, yet its security lags far behind its importance.
- State‑sponsored groups such as Russia’s Sandworm (APT44), China’s PLA Cyberspace Force, and Iran’s IRGC‑affiliated cyber units are already developing or deploying tactics that target AI systems.
- Four primary attack classes threaten AI: data‑poisoning/neural‑trojan backdoors, adversarial inputs at inference, manipulation of orchestration/scheduling layers, and black‑box model extraction.
- These attacks operate in the gray zone—deniable, persistent, scalable, and below the threshold of overt warfare—making detection and attribution difficult.
- Established frameworks (MITRE ATLAS, NIST AI RMF) and technical mitigations exist, but they are rarely implemented in operational environments.
- Closing the gap requires adversarial‑resilient AI procurement, supply‑chain integrity for models and hardware, firmware verification, workforce development, and updated doctrine before adversaries achieve operational success.
The Sandworm Template Applied to AI
In October 2022, Russia’s Sandworm unit timed a cyber‑attack on Ukrainian power infrastructure to coincide with missile strikes, having spent months learning the decision logic of industrial‑control‑system (ICS) software and then using that same logic to trip circuit breakers while dashboards showed no abnormality. The attack did not rely on brute force; it weaponized the target’s own operational logic. This “patient study → embed → weaponize” pattern is directly transferable to modern AI ecosystems, where adversaries can study inference pipelines, orchestration platforms, or training data, then subvert them from within. The result is a disruption that looks like a routine system glitch rather than a cyber‑offensive action, exactly the modus operandi Sandworm demonstrated against power grids.
Why AI Infrastructure Is Strategic
Today’s AI systems are not isolated servers; they are tightly coupled ecosystems of GPUs, TPUs, storage arrays, networking gear, cooling plants, power distribution, firmware layers, and cloud services working in concert to enable massive parallel processing. Because they drive real‑time decisions in defense logistics, intelligence analysis, medical diagnostics, financial modeling, and autonomous weapons, their compute resources have become as strategically vital as energy grids or telecommunications networks. Degrading performance, exhausting resources, or corrupting outputs can impair multiple mission‑critical functions simultaneously without a single kinetic shot or a ransom note, turning AI infrastructure into a high‑value target for adversaries seeking silent, systemic impact.
Adversaries Targeting AI
China’s PLA Cyberspace Force, created in April 2024 from the former Strategic Support Force, pursues a “systems destruction warfare” doctrine that prioritizes disabling an adversary’s decision‑making networks—precisely what AI systems provide. The PLA’s Military‑Civil Fusion strategy channels civilian AI advances directly into military capability, suggesting that research on AI‑focused attacks is already transitioning from labs to operational units. Russia’s APT44 (Sandworm) offers a proven playbook: its decade‑long evolution from the 2015 Ukrainian blackout through Industroyer/Industroyer2 shows a mature ability to learn system architecture, embed within management layers, and manipulate logic to produce physical effects while concealing the source. Iran’s IRGC‑affiliated cyber corps, though less advanced in AI specifics, has demonstrated a willingness to target infrastructure others deem off‑limits and favors disruption over espionage, rounding out a trio of state actors poised to exploit AI vulnerabilities.
Four Core Attack Vectors on AI Systems
- Training‑Phase Poisoning / Neural Trojans – By compromising data pipelines, third‑party annotation services, or model repositories, an attacker injects carefully crafted examples that teach the model a hidden false behavior. The poisoned model passes standard benchmarks and gains operational trust, then activates its malicious function only when a specific, attacker‑defined trigger appears—effectively a backdoor that can propagate across downstream applications built on shared foundation models.
- Inference‑Phase Adversarial Inputs – Minute, often imperceptible perturbations to inputs cause a deployed model to misclassify with high confidence. These attacks need no training‑environment access; they rely on understanding the model’s decision boundaries, which can be inferred by querying the system. Defensive tools such as Neural Cleanse and STRIP exist but are rarely fielded.
- Orchestration‑Layer Manipulation – Modern GPU clusters depend on schedulers (Kubernetes, SLURM, proprietary equivalents) that allocate workloads based on utilization and telemetry. An adversary who can falsify metrics—e.g., reporting low usage on overheating nodes—causes the scheduler’s own optimization logic to concentrate load on those nodes, creating localized thermal hotspots that degrade hardware while overall averages appear normal, mirroring how Sandworm used ICS logic to trip breakers.
- Black‑Box Model Extraction – By repeatedly querying a deployed model and recording input‑output pairs, an attacker trains a surrogate that approximates the target’s behavior. For many model types, a surprisingly small query set yields a high‑functional clone, enabling theft of proprietary AI without touching weights, code, or infrastructure. Automated LLMs can conduct this at scale, evading rate limits and leaving no clear forensic trace.
The Gray‑Zone Nature of AI‑Focused Attacks
These attack classes embody classic gray‑zone tactics: they are deniable (a poisoned model’s bad output looks like ordinary drift or a software bug), persistent (compromised models can operate for months or years without triggering alerts), scalable (a single trojan in a widely used foundation model infects every downstream system), and operate below the threshold of overt conflict (no kinetic action, no obvious breach, no ransom note). Consequently, defenders struggle to attribute the activity, and the damage accumulates invisibly across interconnected systems—exactly the strategic objective Sandworm demonstrated against Ukraine’s power grid.
Existing Defenses and the Implementation Gap
MITRE’s Adversarial Threat Landscape for AI Systems (ATLAS) catalogs the four attack vectors and maps mitigations; the NIST AI Risk Management Framework offers structured governance guidance. Technical defenses include adversarial robustness training, data provenance verification, runtime anomaly detection, scheduler integrity checks, and model‑watermarking or extraction‑resistance techniques. However, these controls are largely absent from operational defense AI pipelines. Procurement processes rarely require verifiable chains of custody for training data or model weights, supply‑chain standards for hardware are not extended to AI firmware, and red‑team exercises seldom test models themselves against poisoning or extraction. Workforce expertise at the intersection of AI security and cyber defense remains sparse, slowing adoption.
Conclusion: Building Resilience Before the Lights Go Out
The progression from reconnaissance to operational effect that Sandworm demonstrated against Ukrainian infrastructure unfolded faster than defenders anticipated, exploiting gaps in preparedness. AI systems supporting U.S. defense and critical infrastructure are presently more exposed than those power grids were in 2014, yet they are being entrusted with consequential, real‑time decisions. To prevent a future where an adversary silently degrades logistics, blinds intelligence, or causes healthcare failures without warning, the nation must now embed adversarial‑resilient AI into acquisition regulations, mandate supply‑chain integrity for models and accelerators, fund workforce development in AI security, and operationalize frameworks like MITRE ATLAS and NIST AI RMF. Only by treating AI infrastructure as strategic—worthy of the same protections afforded to energy, finance, and communications—can we keep the lights on before an adversary decides to switch them off.