Pre-trained LLMs

Pretraining or continued pretraining changes the base model.

Classification definition is a project adaptation of the DASF deployment model descriptions. Source applicability is column K of AI Lifecycle Risks, snapshot 2026-10-22.

Combine patterns using union (OR). An agent that uses retrieval and a third-party model should include agentic-ai, rag and external-model; include foundation-llm if the model is a foundation model. Do not assume “pre-trained” means merely calling an already trained foundation model: this taxonomy distinguishes pretraining from consumption.

52 source-applicable risks:

• DASF-R-1.1 — Insufficient access controls
• DASF-R-1.2 — Missing data classification
• DASF-R-1.3 — Poor data quality
• DASF-R-1.4 — Ineffective storage and encryption
• DASF-R-1.5 — Lack of data versioning
• DASF-R-1.6 — Insufficient data lineage
• DASF-R-1.7 — Lack of data trustworthiness
• DASF-R-1.8 — Legality of data
• DASF-R-1.9 — Stale data
• DASF-R-1.10 — Lack of data access logs
• DASF-R-1.11 — Compromised 3rd-party datasets
• DASF-R-3.1 — Data poisoning
• DASF-R-3.2 — Ineffective storage and encryption
• DASF-R-4.1 — Lack of traceability and transparency of model assets
• DASF-R-4.2 — Lack of end-to-end ML lifecycle
• DASF-R-5.2 — Model drift
• DASF-R-5.3 — Hyperparameters stealing
• DASF-R-5.4 — Malicious libraries
• DASF-R-6.1 — Evaluation data poisoning
• DASF-R-6.2 — Insufficient evaluation data
• DASF-R-6.3 — Lack of Interpretability and Explainability
• DASF-R-7.2 — Model assets leak
• DASF-R-7.3 — ML Supply chain vulnerabilities
• DASF-R-7.4 — Source code control attack
• DASF-R-8.1 — Model attribution
• DASF-R-8.2 — Model theft
• DASF-R-8.3 — Model lifecycle without HITL (human-in-the-loop)
• DASF-R-8.4 — Model inversion
• DASF-R-9.1 — Prompt inject
• DASF-R-9.2 — Model inversion
• DASF-R-9.3 — Model breakout
• DASF-R-9.4 — Looped input
• DASF-R-9.5 — Infer training data membership
• DASF-R-9.7 — Denial of Service (DoS)
• DASF-R-9.8 — LLM hallucinations
• DASF-R-9.10 — Accidental exposure of unauthorized data to models
• DASF-R-9.11 — Model Inference API Access
• DASF-R-9.12 — LLM Jailbreak
• DASF-R-9.13 — Excessive agency
• DASF-R-10.1 — Lack of audit and monitoring inference quality
• DASF-R-10.2 — Output manipulation
• DASF-R-10.3 — Discover ML model ontology
• DASF-R-10.5 — Black-box attacks
• DASF-R-10.6 — Sensitive data output from a model
• DASF-R-11.1 — Lack of MLOps — repeatable enforced standards
• DASF-R-12.1 — Lack of vulnerability management
• DASF-R-12.2 — Lack of penetration testing, red teaming and bug bounty
• DASF-R-12.3 — Lack of incident response
• DASF-R-12.4 — Unauthorized privileged access
• DASF-R-12.5 — Poor security in the software development lifecycle
• DASF-R-12.6 — Lack of compliance
• DASF-R-12.7 — Initial Access