Operationalizing AIBOMs: Extending Vulnerability Management to AI Models and Datasets
summary
Claims a practical way to treat models and datasets as first-class assets by producing machine-readable AIBOMs (an SBOM extended for AI) and running deterministic policy checks during onboarding and CI/CD. Demo uses an OWASP-based generator and a custom CLI to produce an AIBOM (one export is 158 lines), extracts files, package URLs and datasets, finds CVEs in the transformers dependency, and applies policies like staleness/too-fresh and country or license blocklists. Also covers scalable caching for air-gapped use, continuous monitoring, and scope (Hugging Face ~2.8 million models; ModelScope ~27,000).
AI-written summary · about
chapters (6)
- 0:00AI governance and vulnerability management
- 3:12AI system risks management
- 8:57What is an AIBOM
- 15:43Policy enforcement and risk scanning
- 21:04Future work on AIBOMs
- 24:59Q&A on AIBOMs
related talks
29mAIBOM: Powering Transparency and Security in AI and Software Supply Chains
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
24mBehind Every AI SBOM Lies a Minefield: Here's How to Not Step...
07mThe Trustable AI Bill of Materials (TAIBoM)
37mFrom Complexity to Clarity: Addressing Challenges in AI BOMs for...
49mHow to Benefit from SBOM in Metaverse Applications
50mBuilding AI Security In: MLSecOps in Practice
33mAI sovereignty, provenance and compliance