ArXiv

A Large-Scale Measurement of AI Bill of Materials Completeness in Hugging Face Models

2026-07-19 · 13:20 UTC ·Md Erfan, Ahmed Ryan, Md Rayhanur Rahman ·1 min read
Authors
Md Erfan, Ahmed Ryan, Md Rayhanur Rahman
Categories
cs.SE, cs.AI
arXiv
https://arxiv.org/abs/2607.17242v1
PDF
https://arxiv.org/pdf/2607.17242v1

Brief

The paper measures AIBOM completeness across ~97.5K Hugging Face model artifacts via an empirical audit of structural fields, identity/license/external-reference info, and model-card content. Results show required AIBOM structure is present but AI-specific documentation (datasets, limitations, safety/environment, responsible-use, meaningful descriptions) is often missing; coverage varies by task, license, dataset declaration, model family, and paper reference. Full text was not examined for this briefing; conclusions are drawn from the abstract.

Why it matters

Analysis of ~97.5K AIBOM artifacts from public Hugging Face repositories (Md Erfan et al., arXiv 2026-07-19) finds generated AIBOMs fully represent required AIBOM structure but provide limited AI-specific documentation completeness.

Key details

  • Model-card and metadata fields—datasets, limitations, safety-risk assessment, environmental information, responsible-use guidance, and meaningful descriptions—are weakly represented or missing; coverage also varies by task, license availability, dataset declaration, model family, and paper reference, motivating better model-card practices, repository traceability, and automated AIBOM validation.
Source evidence

Abstract

Pretrained machine learning (ML) models help developers build ML-intensive software systems without training models from scratch. However, model repositories often provide incomplete machine-readable documentation about model provenance, licenses, datasets, limitations, and external references, creating transparency and governance gaps across the AI supply chain. Artificial Intelligence Bills of Materials (AIBOMs) address these gaps by documenting AI artifacts, including models, metadata, licenses, datasets, model-card information, and external references. Taking public Hugging Face (HF) model repositories as a case study, this paper empirically investigates AIBOM completeness, defined as the extent to which repositories provide AIBOM-relevant information for machine-readable AI supply-chain documentation. We examine approximately 97.5K AIBOM artifacts to assess the extent to which generated AIBOMs: (i) contain required structural and metadata fields, (ii) represent model identity, license, and external-reference information, (iii) capture model-card documentation such as datasets, limitations, safety-risk assessment, and environmental information, and (iv) vary in documentation coverage across repository and artifact characteristics such as task, license availability, dataset declaration, model family, and paper reference. Results indicate that generated AIBOMs provide complete coverage of required AIBOM structure but limited AI-specific documentation completeness. Required fields are fully represented, but model-card, metadata, responsible-use, environmental, limitation, and meaningful-description fields remain weakly represented or missing across generated artifacts. Our findings motivate improved model-card practices, repository-level traceability, and automated AIBOM validation to advance the generation and adoption of more complete AIBOMs.

Comment: 12 pages