AI SBOM

spdxVersion: SPDX-3.0
SPDXID: SPDXRef-DOCUMENT
name: "MyAI-Service AI SBOM"
dataLicense: CC0-1.0
created: "2026-04-01T00:00:00Z"
createdBy:
  - type: Tool
    identifier: "cdxgen-10.0"

packages:
  # 1. AI 프레임워크
  - SPDXID: SPDXRef-pytorch
    name: torch
    versionInfo: "2.2.0"
    supplier: "Organization: Meta AI"
    downloadLocation: "https://pypi.org/project/torch/2.2.0/"
    licenseConcluded: BSD-3-Clause
    primaryPurpose: library

  - SPDXID: SPDXRef-transformers
    name: transformers
    versionInfo: "4.40.0"
    supplier: "Organization: Hugging Face"
    downloadLocation: "https://pypi.org/project/transformers/4.40.0/"
    licenseConcluded: Apache-2.0
    primaryPurpose: library

  # 2. 사전 훈련 모델
  - SPDXID: SPDXRef-llama3-8b
    name: meta-llama/Llama-3.1-8B-Instruct
    versionInfo: "3.1"
    supplier: "Organization: Meta AI"
    downloadLocation: "https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct"
    licenseConcluded: LicenseRef-Meta-Llama-Community-License
    primaryPurpose: inference
    # AI 프로파일 확장 필드
    modelCard: "https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct"
    hyperparameter:
      contextWindow: 131072

  # 3. 파인튜닝 데이터셋
  - SPDXID: SPDXRef-dataset-alpaca-korean
    name: beomi/KoAlpaca-v1.1a
    versionInfo: "1.1a"
    downloadLocation: "https://huggingface.co/datasets/beomi/KoAlpaca-v1.1a"
    licenseConcluded: CC-BY-NC-4.0
    primaryPurpose: trainData
    dataCollectionProcess: "Korean instruction-following dataset"

relationships:
  - spdxElementId: SPDXRef-llama3-8b
    relationshipType: TRAINED_ON
    relatedSpdxElement: SPDXRef-dataset-alpaca-korean

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "model-llama3.1-8b",
      "name": "Meta Llama 3.1 8B Instruct",
      "version": "3.1",
      "supplier": { "name": "Meta AI" },
      "licenses": [
        { "license": { "name": "Llama 3.1 Community License" } }
      ],
      "modelCard": {
        "bom-ref": "card-llama3.1-8b",
        "modelParameters": {
          "approach": { "type": "supervised" },
          "task": "text-generation",
          "architectureFamily": "transformer",
          "modelArchitecture": "Decoder-only Transformer",
          "datasets": [ { "ref": "ds-meta-pretrain-15T" } ],
          "inputs": [ { "format": "text/plain" } ],
          "outputs": [ { "format": "text/plain" } ]
        },
        "quantitativeAnalysis": {
          "performanceMetrics": [
            { "type": "MMLU", "value": "0.78" },
            { "type": "HumanEval", "value": "0.65" }
          ]
        },
        "considerations": {
          "users": [ "Enterprise developers" ],
          "useCases": [ "Customer support chatbot (EN/KO)" ],
          "technicalLimitations": [ "Hallucinates on dates after 2024-12" ],
          "ethicalConsiderations": [
            { "name": "Prompt injection", "mitigation": "Input filtering" }
          ],
          "environmentalConsiderations": {
            "energyConsumptions": [
              {
                "activity": "inference",
                "energyMeasure": { "value": 0.5, "unit": "kWh" }
              }
            ]
          }
        }
      }
    }
  ]
}

# Python AI 프로젝트 SBOM 생성
cdxgen -t python ./my-ai-project -o ai-sbom.json

# requirements.txt 기반 생성
cdxgen -t pypi -r requirements.txt -o ai-sbom.json

# AI 서비스 컨테이너 이미지 SBOM 생성
syft my-ai-service:latest -o spdx-json=ai-container-sbom.json

# Dependency-Track에 AI SBOM 업로드
curl -X "POST" "http://dtrack:8080/api/v1/bom" \
  -H "X-Api-Key: ${DTRACK_API_KEY}" \
  -F "bom=@ai-sbom.json" \
  -F "projectName=MyAI-Service" \
  -F "projectVersion=1.0.0"