Extending SBOMs to Describe AI Systems
summary
Proposal extends SPDX SBOMs to describe models and datasets by adding fields for training data provenance, consent, data drift detection, hyperparameters, decision thresholds, explainability and energy use; uses the MIT self-driving simulator and Waymo datasets as concrete examples; finds gaps versus existing standards (over 2,000 standards surveyed), notes current adoption stats (about 47% using SBOMs now, 78% planning to), and says SPDX 3.0 will host AI and dataset profiles with prototypes but no production tooling yet.
AI-written summary · about
chapters (13)
- 0:00AI-focused SBOMs intro
- 2:07Why AI needs SBOMs
- 6:03Challenges in AI docs
- 10:59EU risk classification
- 13:52Global AI standards
- 20:45AI model SBOM fields
- 23:18SBOM lifecycle types
- 27:53Gaps in AI SBOMs
- 32:24AI working group future
- 33:06Waymo dataset example
- 35:37Getting involved in SBOM AI standardization
- 37:05AI terminology standards
- 39:11Q&A on AI SBOM tools
related talks
49mHow to Benefit from SBOM in Metaverse Applications
37mFrom Complexity to Clarity: Addressing Challenges in AI BOMs for...
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
24mBehind Every AI SBOM Lies a Minefield: Here's How to Not Step...
30mTransparency in the Software Supply Chain: Making SBOM a Reality
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
29mAIBOM: Powering Transparency and Security in AI and Software Supply Chains
27mSBOM: The Rest Of the Story