Implementing AI Bill of Materials (AI BOM) with SPDX 3.0: A Comprehensive Guide to Creating AI and Dataset Bill of Materials

2024-10-01

AI Summary

To address the lack of transparency and traceability in AI system supply chains, this paper proposes the AI Bill of Materials (AI-BOM) framework—an extension of the Software Bill of Materials (SBOM) tailored for AI systems. It systematically documents algorithmic components, datasets, training methodologies, dependency libraries, licenses, and regulatory compliance requirements. The work introduces the first deep adaptation of the SPDX 3.0 standard to the AI domain, defining core AI-BOM elements, structured generation guidelines, and semantic identifiers (e.g., AI-URIs), while integrating license mapping and compliance tagging. Implemented via JSON/YAML serialization, the framework provides practical generation templates and guidelines compatible with mainstream frameworks (e.g., PyTorch, TensorFlow) and benchmark datasets (e.g., ImageNet, Hugging Face). By establishing standardized documentation for AI models and data provenance, AI-BOM bridges a critical gap in AI supply chain governance, significantly enhancing regulatory auditability and security assessment efficiency.

Technology Category

• Philosophy and Ethics of AI: Safety, Robustness & Trustworthiness
• Humans and AI: Explainable AI (XAI) for Human Understanding
• Computer Vision: Remote Sensing / Geospatial AI

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Abstract

A Software Bill of Materials (SBOM) is becoming an increasingly important tool in regulatory and technical spaces to introduce more transparency and security into a project's software supply chain. Artificial intelligence (AI) projects face unique challenges beyond the security of their software, and thus require a more expansive approach to a bill of materials. In this report, we introduce the concept of an AI-BOM, expanding on the SBOM to include the documentation of algorithms, data collection methods, frameworks and libraries, licensing information, and standard compliance.

Problem

• Expanding SBOM to AI projects for transparency
• Documenting algorithms and data collection methods
• Ensuring licensing and standard compliance in AI

Innovation

• AI BOM expands SBOM for AI projects
• Includes algorithms and data methods
• Uses SPDX 3.0 for comprehensive documentation