Saving Ourselves the ID Headache: How Purls Can Work for Models and Datasets
summary
Argues for reusing package URLs to identify models and datasets so vulnerability workflows work now rather than inventing a new ID; shows concrete examples mapping Hugging Face binaries and snapshots to model and dataset PURLs, distinguishes API vs cloud-hosted cases with a Bedrock-hosted Anthropic model, and embeds provenance via snapshot commit SHA and file-format qualifiers. Claims PURLs enable vulnerability tracking, SBOM generation, and governance today, notes gaps around qualifiers, provider fragmentation, hardware, and lineage, and calls for taxonomies and tooling adoption.
AI-written summary · about
chapters (6)
- 0:00AI artifact ID challenges
- 3:16AI risks and identifiers
- 8:53AI artifacts complexity
- 15:34PURLs for AI models/datasets
- 22:12Next steps and call to action
- 24:17Q&A on reproducibility
related talks
39mBetter PURLs for Better Software Compliance Processes
24mPurl and Vers: The Mostly Universal Package URL & Version Ranges Identifiers for Dependencies &...
50mChallenges in Open Source Software Identification
50mSoftware Identity in the Vulnerability Management Ecosystem
20mThe Future of the Web
15mA vulnerability database should not be about vulnerabilities!
36mSurviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World.
23mTrust, Track, and Verify: Securing AI Pipelines End-to-End