CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept. When techniques such as machine learning are used to automatically classify input streams, and those classifications are used for security-critical decisions, then any mistake in classification can introduce a vulnerability that allows attackers to cause the product to make the wrong security decision or disrupt service of the automated mechanism. If the mechanism is not developed or "trained" with enough input data or has not adequately undergone test and evaluation, then attackers may be able to craft malicious inputs that intentionally trigger the incorrect classification. Targeted technologies include, but are not necessarily limited to: automated speech recognition automated image recognition automated cyber defense Chatbot, LLMs, generative AI For example, an attacker might modify road signs or road surface markings to trick autonomous vehicles into misreading the sign/marking and performing a dangerous action. Another example includes an attacker that crafts highly specific and complex prompts to "jailbreak" a chatbot to bypass safety or privacy mechanisms, better known as prompt injection attacks.

If exploited, CWE-1039 (Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism) it can compromise Integrity, Availability, Confidentiality and Other, leading to outcomes such as Bypass Protection Mechanism, DoS: Resource Consumption (Other), DoS: Instability, Read Application Data and Varies by Context.

Recommended mitigations for CWE-1039 include: Algorithmic modifications such as model pruning or compression can help mitigate this weakness. Model pruning ensures that only weights that are most relevant to the task are used in the inference of incoming data and has shown resilience to adversarial perturbed data. Consider implementing adversarial training, a method that introduces adversarial examples into the training data to promote robustness of algorithm at inference time. Consider implementing model hardening to fortify the internal structure of the algorithm, including techniques such as regularization and optimization to desensitize algorithms to minor input perturbations and/or changes.

CWE-1039 can be detected using Dynamic Analysis with Manual Results Interpretation and Architecture or Design Review. Combining automated tooling with manual review typically yields the best coverage.

CWE-1039 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

MITRE documents real CVEs mapped to CWE-1039, including CVE-2025-26644. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

A CWE (Common Weakness Enumeration) like CWE-1039 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.