From Complexity to Clarity: Addressing Challenges in AI BOMs for...
summary
SPDX 3.0 adds AI and data profiles to capture models, datasets and their provenance, and the team produces an analyzed AI SBOM for a handwriting recognition repo that takes 40 hours for one person and only traces first‑level deps. Key problems are missing metadata, no automation, and unclear licensing between datasets and trained models. Practical steps include checklists, provenance recording, detailed process logs and building tooling to export BOM data from pipelines.
AI-written summary · about
chapters (8)
- 0:00SPDX and AI BOM Group
- 3:51SPDX 2 to 3 for AI systems
- 7:47Motivation for AI BOM Group
- 15:14SPDX 3 profiles for AI transparency
- 18:53Challenges in AI BOM documentation
- 22:44Call for AI BOM standardization
- 30:14Challenges and future directions
- 31:43Q&A on AI BOM needs
related talks
43mExtending SBOMs to Describe AI Systems
24mBehind Every AI SBOM Lies a Minefield: Here's How to Not Step...
49mHow to Benefit from SBOM in Metaverse Applications
29mAIBOM: Powering Transparency and Security in AI and Software Supply Chains
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
30mTransparency in the Software Supply Chain: Making SBOM a Reality
31mOperationalizing AIBOMs: Extending Vulnerability Management to AI Models and Datasets