Ontology Poisoning in Military AI Fusion Systems: Attack Vectors Against Palantir-Class Architectures

From OpenAlex, which stores abstracts as an index of words and their positions: what is shown is rebuilt from that, and reads fluently whether or not it is what the author wrote.

Abstract

Palantir Technologies’ Maven Smart System (MSS), designated a U.S. Department of Defense Program of Record in 2026 and deployed across NATO’s Allied Command Operations, is among the most operationally significant AI fusion platforms in contemporary warfare. Its ontology-based data model integrates over 179 heterogeneous intelligence sources; an embedded large language model (LLM) hub powered by Anthropic’s Claude on classified networks compresses sensor-to-shooter decision cycles from hours to minutes. This paper characterises three underanalysed adversarial attack vectors specific to MSS-class architectures. AV-1: Ontology Poisoning—the primary contribution—corrupts the semantic object layer to forge entity relationships, reclassify hostile objects as friendly, and inject phantom units; its coupling to downstream LLM reasoning creates a dual-substrate propagation effect with no direct analogue in existing knowledge-graph poisoning literature. AV-2: LLM Prompt Injection exploits the absence of a cryptographic boundary between trusted ontology context and externally sourced intelligence documents retrieved via Retrieval-Augmented Generation (RAG) to manipulate AI-generated courses of action. AV-3: Multi-Source Sensor Feed Spoofing exploits MSS’s corroboration-based confidence logic to amplify—rather than merely introduce—false classifications across the ingestion pipeline. Each vector is analysed via counterfactual scenarios grounded in the documented deployment contexts of the 2026 Iran conflict, the NATO ACO deployment, and the February 2026 Maduro operation. A three-layer defence framework (D-1 through D-3) incorporating PKI-based object signing, Merkle-tree ontology versioning, and zero-knowledge provenance attestation is proposed, together with a forensic audit extension linking manipulation events to IHL operator accountability. A structured security-property coverage evaluation demonstrates the framework’s design coverage properties and identifies residual gaps. Five open research problems are identified.