Predictive AI learns patterns from past data to classify or forecast, such as flagging a fraudulent payment or estimating churn. Generative AI learns to produce new content, such as text, code or images, from a prompt. Both can be attacked, but the failure modes and the controls differ.
What does each one do?
A predictive model takes structured inputs and returns a label or a number. It is usually narrow: one model, one question. Examples are spam filters, credit risk scores, demand forecasts and anomaly detectors in logs.
A generative model takes open ended input and returns open ended output. One model can write an email, summarise a contract and suggest code. That breadth is why it spread so fast and why it is harder to bound.
How do their failures differ?
Predictive models fail in measurable ways: wrong class, poor calibration, drift when the world changes. You can compute an error rate on labelled test data.
Generative models fail in ways that are harder to count. They can produce confident wrong statements, reveal text from their context, or follow instructions hidden in content they were asked to read. The same prompt can produce different answers on different runs, so a single passing test proves little.
What does NIST say about attacks?
NIST's report AI 100-2, on adversarial machine learning, sets out a taxonomy and terminology and organises attacks by type of machine learning method, stage of the life cycle and attacker goals, capabilities and knowledge. It treats predictive and generative systems in the same framework, which is useful: the vocabulary is shared, but the attack classes that matter differ by system.
For predictive models, the familiar classes are evasion at inference time, poisoning of training data, and attempts to extract information about the model or its data. For generative systems, prompt injection and misuse of tools join that list, along with the privacy risks of what the model has memorised or been shown.
How do the controls differ?
For predictive systems, controls centre on data and measurement: provenance of training data, access control on the pipeline, holdout tests, drift monitoring and a human review path for high stakes scores.
For generative systems, add controls on the interface: treat all retrieved and user supplied text as untrusted, limit which tools and data the model can reach, check outputs before they are used, and keep a person in the loop for actions that are hard to undo.
A constructed example
A bank runs a predictive model that scores card transactions. Security work includes protecting the training data from tampering, monitoring false positive rates, and logging who changes thresholds.
The same bank adds a generative assistant that drafts replies to customers using their account notes. Security work now includes stopping the assistant from quoting another customer's notes, rejecting instructions embedded in inbound messages, and requiring an agent to approve every reply. Same company, two quite different threat models.
Can you combine them?
Yes, and many products do. A predictive model might route tickets while a generative one drafts the response. The risk of the combination is the sum of both plus the connection between them, so threat model each part and each handoff.
How to check or apply this
- List your AI systems and mark each as predictive, generative or both.
- For predictive ones, document the training data source, owner and how you detect drift.
- For generative ones, document which tools, data and users can reach the model.
- Treat any text a generative model reads as untrusted input.
- Add output checks and approval steps in proportion to the impact of an error.
- Test predictive models with labelled sets and generative ones with repeated runs on varied prompts.
- Reuse NIST AI 100-2 terms in your threat models so teams share a vocabulary.
Quick check
Is generative AI always riskier than predictive AI?
No. A predictive model that denies loans can cause serious harm. Generative systems have a wider and less predictable surface, so they often need more interface controls.
Can the same attack work on both?
Some classes, such as data poisoning, apply to both. Others, such as prompt injection, are specific to systems that follow natural language instructions.
Sources
- NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
