Predictive AI learns patterns to classify, score or forecast, such as a fraud score. Generative AI produces new content, such as text or code, from prompts. NIST treats both as attackable, but their risks differ: predictive systems fail by being fooled or poisoned, generative systems add prompt-borne and output-handling risks.
How does NIST separate the two?
NIST's report AI 100-2 E2025 on adversarial machine learning states that it distinguishes between two broad classes of AI systems, predictive AI (PredAI) and generative AI (GenAI). It adds that most industrial applications are still dominated by PredAI, while GenAI use in business and consumer settings has grown quickly. The report's contents even include a separate taxonomy of attacks on PredAI systems, with GenAI handled in its own section.
NIST also says that both classes are vulnerable to attacks enabled by a range of attacker capabilities. So the useful question is not which is safer. It is how each one fails and who can influence it.
What do predictive AI attacks look like?
The classic example is evasion: an adversary changes an input slightly so the model misclassifies it. NIST cites cases from computer vision where adversarial changes to images caused stop signs to be misclassified as speed limit signs. In a business setting, think of a spam filter or fraud model whose inputs a determined actor can shape.
Poisoning is the other major class. In a data poisoning attack, NIST explains, an adversary controls a subset of the training data. A backdoor variant plants a trigger that changes the model's behavior only when the trigger is present, which is hard to find with ordinary testing.
What changes with generative AI?
Generative systems take instructions in natural language, so the data and the instructions share one channel. That is why prompt injection is a defining risk: text the model reads can try to steer it. They also produce output that downstream code may trust. If an application passes model output into a database query, a shell or a browser, a bad output becomes a vulnerability.
Generative systems often connect to tools and data. A model that can send email or call internal APIs turns a manipulated prompt into an action. Scope the permissions of the model like those of any service account.
Data leakage is a further concern. Users may paste sensitive material into prompts, and models can reveal training or context data in outputs. OWASP's guidance for LLM applications lists poisoning of training, fine-tuning and embedding data among its top risks.
A constructed example
A bank runs two systems. A predictive model scores card transactions for fraud. A generative assistant drafts replies to customer emails using the case history. For the fraud model, the team's main concerns are poisoned training labels and probing by fraudsters who adjust behavior until the score drops. They monitor score distributions and restrict who can write training data. For the assistant, the main concerns are injected text in incoming emails and the assistant's access to account data. They strip tools from the assistant, show drafts to a human, and treat the model's output as untrusted text before it reaches any other system.
How to check or apply this
- List every AI system and mark it predictive or generative, or both.
- For predictive systems, protect training data provenance and watch input and score drift.
- For generative systems, treat all retrieved text and user input as untrusted instructions.
- Validate and encode model output before it reaches code, databases or browsers.
- Give models and agents the minimum permissions they need, and log tool calls.
- Test with adversarial inputs before launch and after each model change.
- Keep a record of datasets, model versions and third-party components.
Quick check
Is generative AI riskier than predictive AI?
Not in general. NIST says both are vulnerable. The risks differ in kind, and the more power and data a system can reach, the larger the impact of a failure.
Can one system be both?
Yes. A pipeline might use a predictive classifier to route requests to a generative model. Assess each component and the connection between them.
Sources
Last reviewed: 18 October 2026.
