Four-Dimensional Attack Taxonomy

• Four-Dimensional Taxonomy of Attacks is a framework that organizes various cyber threats using four key dimensions: attacker, method, target, and impact.
• It supports sequential, hierarchical, and operational classifications across domains such as network, black-box, and identity-related attacks.
• The taxonomy bridges theoretical models with practical defense strategies by identifying blind spots and guiding systematic threat analysis.

A four-dimensional taxonomy of attacks is a classification framework that organizes attacks, attack surfaces, or attack-related processes along four major dimensions, categories, or coordinated taxonomies. In the literature, the expression does not denote a single universal schema. It has been used for sequential network-attack classification through WHO → WHERE → HOW → WHAT (Onik et al., 2018), threat-model characterization of black-box attacks through query access, API feedback, auxiliary-data quality, and auxiliary-data quantity (Suya et al., 2023), evidence-manipulation against fact-verification systems through target, constraints, capabilities, and knowledge (Abdelnabi et al., 2022), secure retrieval-augmented generation through four primary security surfaces (Xu et al., 9 Apr 2026), and identity-focused frameworks that are better understood as four linked taxonomies rather than a single orthogonal matrix (Hommel, 2023, Pöhn et al., 2024). In other works, the same label is used more loosely for four major integration approaches or four conceptual axes such as risk, impact, knowledge, and emerging threats (Ünlü et al., 2020, Pappy et al., 15 May 2026).

1. Terminological scope and recurring structures

Across the cited research, “four-dimensional” may refer to four sequential questions, four threat-model axes, four attack surfaces, four categories of underlying model failure, or four coordinated taxonomies. This suggests that the term is best treated as a family resemblance across classification schemes rather than as a single standardized ontology.

Framework	Four dimensions or components	Primary object
(Onik et al., 2018)	WHO / WHERE / HOW / WHAT	Traditional network attacks
(Suya et al., 2023)	Query access / API feedback / data quality / data quantity	Black-box attacks
(Abdelnabi et al., 2022)	Target / constraints / capabilities / knowledge	Evidence manipulation
(Xu et al., 9 Apr 2026)	Pre-retrieval corruption / retrieval manipulation / context exploitation / exfiltration	Secure RAG threats
(Hommel, 2023, Pöhn et al., 2024)	Attack background / identity taxonomies / IdMS taxonomy / end-user taxonomy	Identity-related attacks
(Peláez-González et al., 7 Apr 2025)	Mismatched generalization / competing objectives / adversarial robustness / mixed attacks	LLM jailbreaks

A central distinction in this literature is whether the four dimensions are orthogonal, sequential, or hierarchical. The black-box threat space is explicitly defined as a four-dimensional grid over attacker capabilities and resources (Suya et al., 2023). By contrast, the network taxonomy is a sequential question chain applied in process order (Onik et al., 2018). Identity-management frameworks such as TaxIdMA instead use four interconnected taxonomies that can be applied stepwise and even multiple times during an attack chain (Hommel, 2023, Pöhn et al., 2024).

2. Sequential and workflow-centered taxonomies

The most direct use of a four-dimensional attack taxonomy appears in the sequential question-answer model for network attacks. Its classification path is WHO → WHERE → HOW → WHAT, which the paper presents as the natural progression of an attack: first there is an attacker, then a source and target, then a method, then an effect (Onik et al., 2018). The WHO dimension classifies initiators as Joker, White-hat hackers, Black-hat hackers, Little sisters, and Big brothers. WHERE is divided into initiated location and attack scope, including object-based, host-based, local segment-based, segment-to-segment-based, and wireless network-based targets. HOW consists of vulnerabilities, hacking tool platform, and attack channel. WHAT captures the attack’s type or intensity through abnormal system activities, traffic volume, and controllable requests (Onik et al., 2018).

This taxonomy is intended to support intrusion detection, incident understanding, threat grouping, and prevention strategy selection. The paper evaluates the scheme on attacks such as the Blaster worm, Melissa virus, Slammer worm, Morris worm, and MS Remote Procedure Call attack, and reports that its proposed approach satisfies all listed taxonomy requirements in its Table 1: Accepted, Comprehensible, Conforming, Determined, Exhaustive, Mutual Exclusion, Repeatable, Well Defined, Unambiguous, and Useful (Onik et al., 2018). At the same time, the same paper also implies limitations: it does not deeply classify vulnerabilities, some categories remain broad, and its examples sometimes appear overlapping or inconsistent in attacker labels (Onik et al., 2018).

A different workflow-oriented use of four categories appears in the taxonomy of approaches for integrating attack awareness into applications. That work is explicit that it does not classify attacks themselves; instead, it classifies how attack-awareness capability is introduced into an application (Ünlü et al., 2020). Its four main classes are Manual Integration, Aspect-Oriented Programming (AOP), Runtime Environment / Runtime Instrumentation, and Binary Instrumentation, grouped under developer-driven and agent-driven integration. The contrast is instructive: some “four-dimensional” attack taxonomies classify adversarial events, while others classify the defensive integration pathways that make applications attack-aware (Ünlü et al., 2020).

3. Threat-model spaces and evidence-oriented formulations

A more formal interpretation of four-dimensionality appears in the systematization of black-box attacks on image classifiers. There the threat space is organized around four attacker assumptions: whether the attacker can interactively query the target model, what feedback the target API returns, how much auxiliary data the attacker initially has, and how similar that auxiliary data is to the target model’s training distribution (Suya et al., 2023). The resulting threat model space is written conceptually as

$$(\text{query access},\ \text{API feedback},\ \text{auxiliary data quality},\ \text{auxiliary data quantity}).$$

Within this structure, API feedback granularity is refined into hard-label, top-K, and complete confidence vector, while data quality is refined into no overlap, partial overlap, and complete overlap (Suya et al., 2023). The taxonomy’s main analytical contribution is not merely descriptive placement of attacks, but fair comparison: attacks should be evaluated only against others that assume the same adversary capabilities (Suya et al., 2023).

The same paper uses the taxonomy to reveal underexplored regions of the threat space. It highlights top-K feedback, partial overlap with sufficient data, and settings with limited or no-overlap auxiliary data as especially neglected. It also argues that better threat-model matching often overturns previous state-of-the-art claims, because simpler baselines can become much stronger when allowed to use the same interactive access or surrogate information as the proposed attack (Suya et al., 2023). A further point is that black-box attack taxonomies connect naturally to model extraction and inversion, since extracted surrogates or recovered representative samples can strengthen attacks in the corresponding cells of the threat-space grid (Suya et al., 2023).

Evidence-manipulation attacks against fact-verification systems provide another explicit four-dimensional taxonomy. That framework is organized around Target, Constraints, Capabilities, and Knowledge (Abdelnabi et al., 2022). The main semantic targets are Camouflaging, which hides the evidence needed to verify a claim and often pushes predictions toward NEI, and Planting, which introduces misleading claim-aligned evidence and may induce REF $\rightarrow$ SUP or NEI $\rightarrow$ SUP inversions (Abdelnabi et al., 2022). The constraints dimension distinguishes partial context preservation, full context preservation, and no context preservation, as well as repository modification by replace or add. The knowledge dimension separates white-box and black-box retrieval assumptions and studies reduced-data settings; the attacks remain strong even when the attacker has only 10% of the data (Abdelnabi et al., 2022).

That paper formalizes the victim as a fact-checking pipeline with document retrieval, evidence retrieval, and verification, and defines attacker and defender retrieval and verification models separately. Its empirical evaluation on KGAT over FEVER starts from baseline accuracies SUP: 89.0, REF: 71.2, and NEI: 72.4, then shows that lexical, contextual, imperceptible, paraphrasing, generation, and rewriting attacks can strongly degrade performance under many permutations of the four taxonomy dimensions (Abdelnabi et al., 2022). A further result is robustness to post-hoc claim modifications: paraphrasing the claim after attack construction does not neutralize the manipulated evidence (Abdelnabi et al., 2022).

4. Hierarchical, geometric, and multi-taxonomy formulations

A distinctive reinterpretation of four-dimensional taxonomy appears in the fractal analysis of cyber campaigns. That work models a campaign as a nested taxonomy

$C = \{T_i,\; t_{ij},\; o_{ijk}\},$

where tactics contain techniques, which may contain sub-techniques (Mouchoux et al., 21 Mar 2025). The hierarchy is encoded by an Iterated Function System

$F_C = \{f_1,f_2,\ldots,f_n\},$

with contraction maps in $\mathbb{R}^2$, producing a unique attractor

$K_C = \bigcup_{i=1}^{n} f_i(K_C).$

Using the Hutchinson operator $H(S)=\bigcup_i f_i(S)$, the paper states that repeated application converges to the campaign attractor: $K_C = \lim_{m \to \infty} H^m(S_0).$ The attractor functions as the campaign’s geometric signature, and comparison is performed with Hausdorff distance and the similarity score $\mathrm{Sim}(C_1,C_2)=e^{-d_H(K_{C_1},K_{C_2})}$ (Mouchoux et al., 21 Mar 2025).

The paper repeatedly emphasizes that the “four-dimensional taxonomy” is not a literal four-axis coordinate system. Rather, it combines an abstract campaign center with three hierarchical semantic levels—tactics, techniques, and sub-techniques—realized in a planar fractal embedding. In the integrated cyber-disinformation setting, an innermost concentric layer can branch into domain-specific frameworks such as MITRE ATT&CK and DISARM (Mouchoux et al., 21 Mar 2025). Complexity is quantified by fractal dimension, and the corrected hierarchical dimension changes ranking more faithfully than the simplified uniform formula. The reported approximate values are APT29: $\rightarrow$0 uniform, $\rightarrow$1 hierarchical; SolarWinds: $\rightarrow$2 uniform, $\rightarrow$3 hierarchical; Matriochka: $\rightarrow$4 uniform, $\rightarrow$5 hierarchical; DNC Hack: $\rightarrow$6 uniform, $\rightarrow$7 hierarchical (Mouchoux et al., 21 Mar 2025). A central interpretive claim is that campaigns with more lower-level detail, especially sub-techniques, receive higher corrected dimensions, allowing the framework to separate “technical depth” from “tactical breadth” (Mouchoux et al., 21 Mar 2025).

Identity-focused taxonomies offer a different hierarchical model. The original TaxIdMA framework is described as four coordinated taxonomies: Attack Background, System Identities, Identity Management Systems, and End-User Identities (Hommel, 2023). The improved version renames system identities to service identities and states explicitly that TaxIdMA consists of four main taxonomies: attack background, service identities, identity management systems, and end-user identities (Pöhn et al., 2024). These are composable rather than mutually exclusive. The background taxonomy provides the stable context; the others describe more specific attack steps and can be applied multiple times during an attack chain. Both versions formalize categories such as attacker, target, identity, attack category, vector, authenticity, completeness, timeliness, directness, and amount (Hommel, 2023, Pöhn et al., 2024).

A related extension appears in smart manufacturing. That paper does not literally present a four-dimensional taxonomy under that exact name; instead, it proposes a six-layer taxonomy. However, it states that the core attack taxonomy can be interpreted as four main dimensions—threat actor / intent, attack method / vector, attack target / location, and attack impact / manifestation—plus the additional dimensions of observable anomalies and countermeasures (Rahman et al., 2023). In effect, the four-dimensional core is used to connect who attacks, how they attack, where they attack, and what the attack does, while the added layers bridge attack realization to detection and response (Rahman et al., 2023).

5. AI-era attack-surface taxonomies

Secure RAG research introduces a boundary-aware four-dimensional taxonomy centered on the external knowledge-access pipeline. The paper abstracts RAG into six stages and three trust boundaries, then organizes threats into four primary security surfaces: pre-retrieval knowledge-substrate corruption, retrieval-time access manipulation, downstream retrieved-context exploitation, and knowledge exfiltration and privacy attacks (Xu et al., 9 Apr 2026). These dimensions are explicitly aligned with where in the knowledge-access lifecycle the attack enters and which trust boundary it crosses. The first surface concerns poisoning of external documents, ingestible files, indexed repositories, loaders, parsers, structured stores, multimodal corpora, or code repositories. The second concerns manipulation of retrieval and reranking without necessarily poisoning the whole corpus. The third exploits the transition from retrieved evidence to model-visible context, enabling indirect prompt injection or refusal abuse. The fourth is reverse-direction extraction of sensitive external knowledge through outputs, logging, or response interfaces (Xu et al., 9 Apr 2026).

That paper’s underlying thesis is that secure RAG is fundamentally about the security of external knowledge access rather than generic LLM safety. It therefore excludes prompt-only jailbreaks and purely parametric memorization unless retrieval is the main carrier or amplifier of the threat. Its defense structure mirrors the four attack surfaces: upstream corpus integrity and provenance, retrieval-time access hardening, post-retrieval containment, and confidentiality/access-control mechanisms (Xu et al., 9 Apr 2026). A key observation is that existing defenses are largely reactive and fragmented, whereas the attack families are persistent, adaptive, and pipeline-aware (Xu et al., 9 Apr 2026).

A different AI-oriented four-category taxonomy classifies jailbreak vulnerabilities by the underlying model deficiency they exploit rather than by prompt construction method. The four categories are mismatched generalization, competing objectives, adversarial robustness, and mixed attacks (Peláez-González et al., 7 Apr 2025). The paper frames alignment in terms of a self-supervised domain, a helpful domain, and a harmful domain, with the overlap between helpful and harmful domains producing conflicts of objectives. Within this formulation, mismatched generalization arises when alignment does not cover regions of the pretraining distribution; competing objectives arise when a prompt forces helpfulness and harmlessness into conflict; adversarial robustness concerns sensitivity to small perturbations; and mixed attacks combine two or more of those weaknesses (Peláez-González et al., 7 Apr 2025).

This domain-based interpretation changes the unit of classification. Instead of grouping attacks by human-crafted templates, ICL prompts, or automatic suffix generation, it groups them by generalization failure, objective conflict, robustness failure, or combinations thereof (Peláez-González et al., 7 Apr 2025). The paper extends the same logic to multimodal settings, including unsafe text rendered inside images, image adversarial optimization, and cross-modal mixed attacks. Its formal robustness illustration uses the iterative update

$\rightarrow$8

subject to a threshold condition on $\rightarrow$9, emphasizing that the robustness category is rooted in adversarial optimization rather than mere prompt engineering (Peláez-González et al., 7 Apr 2025).

Benchmark analysis in LLM security further operationalizes four-dimensional attack coverage. The benchmark-audit paper constructs a 4×6 Target × Technique matrix grounded in STRIDE from a 507-leaf taxonomy extracted from 932 arXiv security studies, with 401 data-populated and 106 threat-model-derived leaves (Iyer et al., 14 May 2026). The four target rows are Safety Alignment Bypass, System Tool Hijacking, Information Exfiltration, and Service Disruption. Applied to six public benchmarks, the paper reports that the three primary frameworks—HarmBench, InjecAgent, and AgentDojo—occupy non-overlapping cells covering at most 25% of the matrix, while whole threat categories such as Service Disruption and Model Internals remain without standardized evaluation (Iyer et al., 14 May 2026). The same study highlights attacks in uncovered categories that achieve 46× token amplification and 96% attack success rates, indicating that the operational attack surface is broader than current benchmark practice captures (Iyer et al., 14 May 2026).

An adjacent development is MCP-38, which does not present a formal four-axis mathematical definition but does organize threat analysis through multiple structured dimensions: attack surface / protocol layer, threat mechanism, framework mapping, and remediation surface (Shen et al., 18 Mar 2026). Its five remediation-oriented clusters cover semantic manipulation, prompt injection and boundary breaking, identity and trust, access control and logic drift, and data exfiltration and resource abuse. Although MCP-38 itself is a 38-category taxonomy rather than a four-dimensional one, it illustrates how newer protocol-specific taxonomies increasingly combine multiple analytical dimensions instead of relying on a single attack list (Shen et al., 18 Mar 2026).

6. Comparative interpretation, operational value, and limitations

The main comparative lesson is that four-dimensional taxonomies differ in what they treat as the primary object of classification. Some classify the attack event itself, as in WHO–WHERE–HOW–WHAT for network attacks (Onik et al., 2018). Some classify the attacker’s capability space, as in black-box adversarial examples (Suya et al., 2023). Some classify the attack carrier and trust boundary, as in secure RAG (Xu et al., 9 Apr 2026). Some classify the semantic weakness being exploited, as in jailbreak vulnerabilities (Peláez-González et al., 7 Apr 2025). Others classify a broader incident ecology, combining attack context with identities, targets, impacts, knowledge, detection, mitigation, or governance (Hommel, 2023, Pöhn et al., 2024, Pappy et al., 15 May 2026).

STRIKE makes this broadening explicit. It is described as a multi-dimensional taxonomy of cybercrime organized around Risk, Impact, Knowledge, and Emerging Threats, while also incorporating attack vectors, adversarial tactics, detection methods, mitigation strategies, legal and governance context, and response workflows (Pappy et al., 15 May 2026). The paper states that it does not present a single explicit mathematical 4D coordinate system; rather, it uses a structured category hierarchy intended to be comprehensive, operationally useful, extensible, and capable of bridging theory and practice (Pappy et al., 15 May 2026). This is representative of a general pattern: many modern “four-dimensional” taxonomies are descriptive and operational rather than algebraic.

Several misconceptions are therefore addressed directly in the literature. The fractal campaign paper states that its “four-dimensional taxonomy” does not literally define four independent taxonomic categories, but instead mixes three hierarchical semantic levels with a two-dimensional embedding (Mouchoux et al., 21 Mar 2025). TaxIdMA is better understood as four linked taxonomies rather than one four-axis matrix (Hommel, 2023, Pöhn et al., 2024). The application-integration taxonomy is not a taxonomy of attacks themselves (Ünlü et al., 2020). The smart-manufacturing taxonomy has six layers, even though its core attack chain can be read as a four-dimensional who–how–where–what structure (Rahman et al., 2023). Such clarifications matter because the term “four-dimensional” can otherwise suggest orthogonal coordinates where the underlying framework is actually sequential, nested, or lifecycle-based.

Operationally, these taxonomies serve several recurring purposes. They support comparative evaluation by ensuring attacks are compared only under matched threat assumptions, as in black-box adversarial research (Suya et al., 2023). They support subset detection and complexity assessment, as in fractal campaign geometry (Mouchoux et al., 21 Mar 2025). They connect classification to remediation, as in secure RAG and manufacturing cybersecurity (Xu et al., 9 Apr 2026, Rahman et al., 2023). They expose benchmark blind spots, as in LLM attack coverage audits (Iyer et al., 14 May 2026). They also provide a basis for threat intelligence sharing, as in the improved TaxIdMA, which augments STIX-compatible threat descriptions with identity-specific fields (Pöhn et al., 2024).

The principal limitations are likewise recurrent. Fully orthogonal four-axis models are rare. Many frameworks remain descriptive rather than formal. Category boundaries can overlap, especially when attacks are multi-stage, multi-domain, or socially mediated (Onik et al., 2018, Hommel, 2023). Broad categories may require human judgment, and some real-world incidents cannot be fully categorized because public information is incomplete (Onik et al., 2018, Hommel, 2023, Pöhn et al., 2024). In fast-moving domains such as cybercrime, RAG security, LLM jailbreaks, and agentic systems, any fixed taxonomy risks rapid obsolescence, which is why extensibility and benchmark-external validation have become explicit design goals in more recent work (Pappy et al., 15 May 2026, Xu et al., 9 Apr 2026, Iyer et al., 14 May 2026, Shen et al., 18 Mar 2026).

In aggregate, the research literature treats a four-dimensional taxonomy of attacks not as a single canonical template but as a recurring design pattern for organizing adversarial phenomena. The pattern persists because four dimensions are often sufficient to capture a defensible minimum of attacker, mechanism, target, consequence, knowledge, or boundary structure while remaining usable for comparison, visualization, and response planning. The exact meaning of the four dimensions, however, is domain-specific and must be interpreted with the formal object of classification in view.