Opening the Black Box: Trust and Transparency with AIBOMs
About This Session
The open-source AI ecosystem is expanding rapidly, with pre-trained models, fine-tuned variants, and custom adapters widely available for download and deployment. But this ease of access comes with significant risk. Models may be poisoned, backdoored, trained on copyrighted data, or inherit vulnerabilities from upstream sources, often without sufficient documentation. As these models are reused and redistributed, organizations can unknowingly introduce technical and legal threats into their systems.
This session introduces the Artificial Intelligence Bill of Materials (AIBOM), a governance tool designed to bring visibility and accountability to the AI supply chain. Modeled after traditional software SBOMs, AIBOMs capture critical metadata such as model provenance, fine-tuning history, licensing, and known risks. We will explore how AIBOMs help developers and security teams better assess open-source models, avoid downstream vulnerabilities, and promote safer reuse.
This session introduces the Artificial Intelligence Bill of Materials (AIBOM), a governance tool designed to bring visibility and accountability to the AI supply chain. Modeled after traditional software SBOMs, AIBOMs capture critical metadata such as model provenance, fine-tuning history, licensing, and known risks. We will explore how AIBOMs help developers and security teams better assess open-source models, avoid downstream vulnerabilities, and promote safer reuse.
Speakers
Jason Kramer
Senior Software Engineering Researcher - ObjectSecurity
Jason is dedicated to advancing the state of the art in secure and robust AI. With a bachelor’s degree in computer science from San Diego State University, he is focused on ensuring trust, security, privacy, bias, and robustness of AI/ML models. Jason has led the development efforts of a commercial solution for the detection and repair of vulnerabilities in deep learning systems, and the co-author of multiple patents related to the cybersecurity of systems including AI/ML, embedded devices, supply chain, and others. His passion for improving the field has driven him to push the boundaries of what is possible and make a meaningful impact in the fields of AI and cybersecurity.
Ulrich Lang
CEO - ObjectSecurity LLC
PhD from the University of Cambridge Computer Laboratory (Security Group) on access policies for middleware in 2003 after having completed a master's degree in Information Security from Royal Holloway College (London) in 1997. With 20+ years in infosec, he is a renowned cybersecurity thought leader in OT security, binary analysis, trusted AI, access control policy etc. He was on the Board of Directors of the Cloud Security Alliance (Silicon Valley Chapter). He is responsible for the business and technical strategy, architecture and direction of ObjectSecurity and its product portfolio. He has published over 150 papers/presentations, 10+ patents, and has previously worked as a proposal evaluator, project evaluator, conference program committee, panel moderator, consultant, and book author.