AIBOM: Powering Transparency and Security in AI and Software Supply Chains
summary
AIBOM (AI SBOM) maps exact model lineage, data sources, frameworks and hardware so teams can spot vulnerabilities like data poisoning or model trojans, quantify incidents (example scenario: an AI-driven trading error causes an $80M loss), and trace exposures to known CVEs such as the recent Nvidia patch and the ZenML API vuln that allowed pipeline access. Standards recommended are CycloneDX 1.6 and SPDX 3.0.1, and an open-source AI-SBOM generator (URL-to-SBOM) is being released for easier third‑party model inventory.
AI-written summary · about
chapters (9)
- 0:00AISBOM introduction
- 3:54AI/software supply chain risks
- 8:49AI vulnerabilities and attacks
- 12:44AISBOM for transparency
- 15:39AISBOM key components
- 20:10Generating AISBOMs for models
- 23:01Future supply chain attacks
- 24:04AISBOM use cases and call to action
- 25:40Q&A: Data vs code risks
related talks
31mOperationalizing AIBOMs: Extending Vulnerability Management to AI Models and Datasets
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
24mBehind Every AI SBOM Lies a Minefield: Here's How to Not Step...
37mFrom Complexity to Clarity: Addressing Challenges in AI BOMs for...
49mHow to Benefit from SBOM in Metaverse Applications
07mThe Trustable AI Bill of Materials (TAIBoM)
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
43mExtending SBOMs to Describe AI Systems