SBOM for AI: Why Machine Learning Models Need Bills of Materials Too

Why AI Models Are a Supply Chain Risk

Pre-trained models present several categories of supply chain risk that traditional SCA does not capture. First, provenance: unlike open source packages with clear version histories and source code, models may be trained on undisclosed datasets, fine-tuned with undisclosed data, or modified from their stated architecture without visibility. Second, integrity: a model file could be modified to include malicious behavior (model poisoning) while appearing functionally identical to legitimate users. Third, intellectual property: models trained on copyrighted data create downstream licensing risk for organizations that deploy them commercially. Fourth, safety and bias: models may encode unexpected behaviors or biases from their training data that create operational risk.

What an AIBOM Should Include

The CISA SBOM community and academic researchers have proposed AIBOM content requirements that extend traditional SBOM fields: model provenance (where the model came from, who trained it, when); training data provenance (what datasets were used, their licenses and sources); model architecture details; known evaluations and safety assessments; dependency models (if the model is fine-tuned from or built on another model); and hash-based integrity verification. The CycloneDX 1.5+ specification includes a machine learning BOM component type that provides a schema for AIBOM content.

Hugging Face and Model Hub Risk

Hugging Face hosts over 400,000 models, with new uploads every day from anonymous contributors. Several security researchers have demonstrated that malicious actors can upload models that contain hidden payloads — including Python pickled objects that execute arbitrary code when the model is loaded. This is a supply chain attack vector specific to ML models that has no analogue in traditional software packaging. Organizations loading models from public hubs should verify model integrity (checking signatures and hashes), prefer models from verified organizations, and use model loading formats that prevent code execution (safetensors instead of pickle-based formats).

Starting Your AIBOM Program

Begin with an inventory of all AI models your organization has deployed or is actively evaluating for deployment. For each model, document: the source (model hub URL, version), the download hash, the license, the training data statements provided by the model author, and the deployment context. This inventory is your AIBOM baseline and your starting point for ongoing monitoring of model security advisories.