CycloneDX / CycloneDX/specification
Add a "libraries" or "dependencies" field to the machine-learning-model component
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
Proposal: add a list of model libraries/dependencies that exist for a given ML model. This captures one of the most important pieces of information: what primary ML library a model relies on (and where to look for the source code for that model)
Name: "libraries" or "dependencies"
Type: Array. Each would contain, at a minimum, a "name" field. (e.g. "name": "PyTorch")
Required: True
Justification: Consider the following examples on HuggingFace (looking at the tags on the top) - knowing if a model is dependent on PyTorch, ONNX, Transformers, or Diffusers is very important information for transparency. I don't expect an AI BOM generator to go grab additional information about that library (such as license, source URL, etc.), but just knowing the name is sufficiently important, according to ML experts and developers I researched with.
https://huggingface.co/nateraw/vit-base-beans
https://huggingface.co/tiiuae/falcon-7b-instruct
Contributor guide
Assessment
This issue has not been assessed yet.