Reference

QIF Numbering System

Every element in the QIF framework has a structured identifier. This page explains how to read them.

Technique IDs

Format

QIF - T 0001

QIF

Framework prefix. All IDs belong to the Quantified Interconnection Framework.

Entity type. T = Technique. Future: D = Device, R = Right, C = Control.

0001

Sequential number. Assigned in order of cataloging. Gaps indicate retired or merged techniques.

Range: QIF-T0001 through QIF-T0161+ (currently 161 techniques). IDs are stable — once assigned, a technique ID never changes or gets reassigned.

TARA Domain Aliases

Every technique has two identifiers. The canonical ID (QIF-Txxxx) is permanent, machine-parseable, and used in code, KQL queries, citations, and STIX exports. The TARA alias (TARA-{DOMAIN}-{MODE}-{NNN}) is human-readable, displayed in UIs and analyst docs. The alias encodes the biological domain and interaction mode.

Format

TARA-{DOMAIN}-{MODE}-{NNN}

Example: TARA-EMO-M-005 = Affect domain, Manipulation mode, technique #5

12 Biological Domains

Code	Domain	What It Covers
`VIS`	Vision	Visual cortex, eye tracking, SSVEP, retinal prosthetics
`AUD`	Audition	Cochlear, auditory cortex, Frey effect, acoustic
`SOM`	Somatosensory	Electrode-tissue interface, signal injection, thermal
`VES`	Vestibular	Balance, GVS, vestibulo-ocular reflex
`MOT`	Motor	Motor cortex, NMJ, command hijacking, prosthetics
`EMO`	Affect	Reward/dopamine, mood, fear circuits, hedonic tone
`COG`	Cognition	Attention, working memory, executive function, EEG
`MEM`	Memory	Hippocampal, memory extraction, consolidation
`LNG`	Language	Speech production, Broca/Wernicke, covert speech
`AUT`	Autonomic	Heart rate, sleep, HRV, vital signs, seizure
`IDN`	Identity	Brainprint, agency, self-model, biometric
`SIL`	Silicon	Hardware, firmware, protocols, ML models, supply chain

3 Interaction Modes (Dual-Use Neutral)

Code	Mode	Description
`R`	Reconnaissance	Passive observation, signal capture, inference, profiling
`M`	Manipulation	Active modulation, stimulation, parameter alteration, therapeutic intervention
`D`	Disruption	Denial of service, jamming, flooding, tissue damage, functional impairment

Modes describe what the technique physically does, not why. The same M-mode technique can be a therapeutic intervention or an attack. The boundary is consent, dosage, and oversight.

Design precedent: MITRE ATT&CK, CAPEC, and CWE all use flat opaque IDs with taxonomy in metadata. The TARA alias follows the same pattern as the CVSS vector string alongside CVE IDs — a human-readable encoding that travels alongside the stable canonical identifier.

Tactic IDs

Format

QIF - N . IJ

QIF

Framework prefix.

Domain code. N = Neural, B = Biological, C = Cognitive, D = Data, P = Physical, E = Exfiltration, M = Multi-vector.

Action code. Two-letter abbreviation of the tactic action (IJ = Injection, SC = Scanning, EV = Evasion, etc.).

Tactic ID	Name	Action	Count
QIF-N.SC	Neural Scan	SC	3
QIF-B.IN	BCI Intrusion	IN	6
QIF-N.IJ	Neural Injection	IJ	11
QIF-C.IM	Cognitive Imprinting	IM	6
QIF-B.EV	BCI Evasion	EV	6
QIF-D.HV	Data Harvest	HV	11
QIF-P.DS	Physiological Disruption	DS	19
QIF-N.MD	Neural Modulation	MD	24
QIF-C.EX	Cognitive Exploitation	EX	17
QIF-E.RD	Energy Radiation	RD	13
QIF-M.SV	Model Subversion	SV	9
QIF-S.RP	Sensor Repurposing	RP	5
QIF-S.FP	Sensor Fingerprinting	FP	4
QIF-S.HV	Sensor Harvest	HV	16
QIF-S.CH	Sensor Chaining	CH	6
QIF-S.SC	Sensor Side-Channel	SC	2
QIF-N.NM	Nanoparticle-Mediated Neuromodulation	NM	3

Hourglass Band IDs

The QIF hourglass has 11 bands organized into three zones. Band IDs indicate the zone and depth.

Neural Zone (N7-N1)

Biological layers. N7 = outermost (neocortex), N1 = deepest (spinal cord). Higher numbers = higher-level cognitive function.

Neocortex

Limbic System

Basal Ganglia

Diencephalon

Cerebellum

Brainstem

Spinal Cord

Interface Zone (I0)

The bottleneck. Where biological tissue meets silicon hardware. The narrowest band in the hourglass, representing the physical electrode-tissue boundary.

Neural Interface

Synthetic Zone (S1-S3)

Silicon layers. S1 = nearest to interface (on-device), S3 = farthest (cloud/wide-area). Traditional cybersecurity territory.

Near-Field / On-Device

Guided-Wave / Host-Local

Far-Field / Wide-Area

Attack Category Codes

Two-letter codes classify the type of harm a technique produces. A technique belongs to exactly one category.

Code	Category	Description	Count
SI	Signal Injection	Injecting false neural or electronic signals	17
SE	Signal Eavesdropping	Intercepting signals in transit	24
DM	Data Manipulation	Altering decoded intent or recordings	37
DS	Denial of Service	Disrupting BCI function	21
PE	Privilege Escalation	Gaining unauthorized access depth	9
CR	Cognitive Reconnaissance	Thought decoding, neural data inference, intent extraction	0
CD	Cognitive/Functional Disruption	Disruption to cognitive processing, sensory perception, motor output, or autonomic regulation	0
PS	Physical Safety	Tissue damage, seizures, involuntary movement	7
EX	Data Exfiltration	Extracting neural data for exploitation	27

Reading a Full Technique Entry

Example entry decoded

Technique QIF-T0001 Signal injection

Tactic QIF-N.IJ = the strategic objective

Category SI = the type of harm

Bands I0, N1 = hourglass layers affected

NISS 6.1 MEDIUM = neural impact score

Threat Matrix → Browse All Techniques