From 91b77aabc8d95eb81ffe92c62b783be79a134ddd Mon Sep 17 00:00:00 2001
From: Gal Moyal <gal@noma.security>
Date: Mon, 25 Nov 2024 11:06:51 +0200
Subject: [PATCH 1/5] added ml bom

Signed-off-by: Gal Moyal <gal@noma.security>
---
 MLBOM/Dataset/bom.json                | 388 ++++++++++++++++++++++++++
 MLBOM/Model/FoundationModels/bom.json |  26 ++
 MLBOM/Model/OpenSource/bom.json       |  63 +++++
 MLBOM/README.md                       |  28 ++
 4 files changed, 505 insertions(+)
 create mode 100644 MLBOM/Dataset/bom.json
 create mode 100644 MLBOM/Model/FoundationModels/bom.json
 create mode 100644 MLBOM/Model/OpenSource/bom.json
 create mode 100644 MLBOM/README.md

diff --git a/MLBOM/Dataset/bom.json b/MLBOM/Dataset/bom.json
new file mode 100644
index 0000000..4fb556a
--- /dev/null
+++ b/MLBOM/Dataset/bom.json
@@ -0,0 +1,388 @@
+{
+    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "serialNumber": "urn:uuid:75de3b9b-9e53-4421-a259-11f18afc22bf",
+    "version": 1,
+    "metadata": {
+        "timestamp": "2024-11-24T13:10:49Z",
+    },
+    "components": [
+        {
+            "type": "data",
+            "supplier": {
+                "name": "Wikimedia"
+            },
+            "manufacturer": {
+                "name": "Wikimedia"
+            },
+            "publisher": "Hugging Face Inc",
+            "name": "wikipedia",
+            "version": "b04c8d1ceb2f5cd4588862100d08de323dccfbaa",
+            "licenses": [
+                {
+                    "license": {
+                        "id": "CC-BY-SA-3.0",
+                        "name": "Creative Commons Attribution Share Alike 3.0",
+                        "url": "https://spdx.org/licenses/CC-BY-SA-3.0.html"
+                    }
+                },
+                {
+                    "license": {
+                        "id": "GFDL-1.3",
+                        "name": "GNU Free Documentation License family",
+                        "url": "https://www.gnu.org/licenses/fdl-1.3.en.html"
+                    }
+                }
+            ],
+            "externalReferences": [
+                {
+                    "type": "website",
+                    "url": "https://huggingface.co/datasets/wikimedia/wikipedia"
+                }
+            ],
+            "hashes": [
+                {
+                    "alg": "SHA-1",
+                    "content": "b04c8d1ceb2f5cd4588862100d08de323dccfbaa"
+                }
+            ],
+            "tags": [
+                "task_categories:text-generation",
+                "task_categories:fill-mask",
+                "task_ids:language-modeling",
+                "task_ids:masked-language-modeling",
+                "language:ab",
+                "language:ace",
+                "language:ady",
+                "language:af",
+                "language:alt",
+                "language:am",
+                "language:ami",
+                "language:an",
+                "language:ang",
+                "language:anp",
+                "language:ar",
+                "language:arc",
+                "language:ary",
+                "language:arz",
+                "language:as",
+                "language:ast",
+                "language:atj",
+                "language:av",
+                "language:avk",
+                "language:awa",
+                "language:ay",
+                "language:az",
+                "language:azb",
+                "language:ba",
+                "language:ban",
+                "language:bar",
+                "language:bbc",
+                "language:bcl",
+                "language:be",
+                "language:bg",
+                "language:bh",
+                "language:bi",
+                "language:bjn",
+                "language:blk",
+                "language:bm",
+                "language:bn",
+                "language:bo",
+                "language:bpy",
+                "language:br",
+                "language:bs",
+                "language:bug",
+                "language:bxr",
+                "language:ca",
+                "language:cbk",
+                "language:cdo",
+                "language:ce",
+                "language:ceb",
+                "language:ch",
+                "language:chr",
+                "language:chy",
+                "language:ckb",
+                "language:co",
+                "language:cr",
+                "language:crh",
+                "language:cs",
+                "language:csb",
+                "language:cu",
+                "language:cv",
+                "language:cy",
+                "language:da",
+                "language:dag",
+                "language:de",
+                "language:dga",
+                "language:din",
+                "language:diq",
+                "language:dsb",
+                "language:dty",
+                "language:dv",
+                "language:dz",
+                "language:ee",
+                "language:el",
+                "language:eml",
+                "language:en",
+                "language:eo",
+                "language:es",
+                "language:et",
+                "language:eu",
+                "language:ext",
+                "language:fa",
+                "language:fat",
+                "language:ff",
+                "language:fi",
+                "language:fj",
+                "language:fo",
+                "language:fon",
+                "language:fr",
+                "language:frp",
+                "language:frr",
+                "language:fur",
+                "language:fy",
+                "language:ga",
+                "language:gag",
+                "language:gan",
+                "language:gcr",
+                "language:gd",
+                "language:gl",
+                "language:glk",
+                "language:gn",
+                "language:gom",
+                "language:gor",
+                "language:got",
+                "language:gpe",
+                "language:gsw",
+                "language:gu",
+                "language:guc",
+                "language:gur",
+                "language:guw",
+                "language:gv",
+                "language:ha",
+                "language:hak",
+                "language:haw",
+                "language:hbs",
+                "language:he",
+                "language:hi",
+                "language:hif",
+                "language:hr",
+                "language:hsb",
+                "language:ht",
+                "language:hu",
+                "language:hy",
+                "language:hyw",
+                "language:ia",
+                "language:id",
+                "language:ie",
+                "language:ig",
+                "language:ik",
+                "language:ilo",
+                "language:inh",
+                "language:io",
+                "language:is",
+                "language:it",
+                "language:iu",
+                "language:ja",
+                "language:jam",
+                "language:jbo",
+                "language:jv",
+                "language:ka",
+                "language:kaa",
+                "language:kab",
+                "language:kbd",
+                "language:kbp",
+                "language:kcg",
+                "language:kg",
+                "language:ki",
+                "language:kk",
+                "language:kl",
+                "language:km",
+                "language:kn",
+                "language:ko",
+                "language:koi",
+                "language:krc",
+                "language:ks",
+                "language:ksh",
+                "language:ku",
+                "language:kv",
+                "language:kw",
+                "language:ky",
+                "language:la",
+                "language:lad",
+                "language:lb",
+                "language:lbe",
+                "language:lez",
+                "language:lfn",
+                "language:lg",
+                "language:li",
+                "language:lij",
+                "language:lld",
+                "language:lmo",
+                "language:ln",
+                "language:lo",
+                "language:lt",
+                "language:ltg",
+                "language:lv",
+                "language:lzh",
+                "language:mad",
+                "language:mai",
+                "language:map",
+                "language:mdf",
+                "language:mg",
+                "language:mhr",
+                "language:mi",
+                "language:min",
+                "language:mk",
+                "language:ml",
+                "language:mn",
+                "language:mni",
+                "language:mnw",
+                "language:mr",
+                "language:mrj",
+                "language:ms",
+                "language:mt",
+                "language:mwl",
+                "language:my",
+                "language:myv",
+                "language:mzn",
+                "language:nah",
+                "language:nan",
+                "language:nap",
+                "language:nds",
+                "language:ne",
+                "language:new",
+                "language:nia",
+                "language:nl",
+                "language:nn",
+                "language:no",
+                "language:nov",
+                "language:nqo",
+                "language:nrf",
+                "language:nso",
+                "language:nv",
+                "language:ny",
+                "language:oc",
+                "language:olo",
+                "language:om",
+                "language:or",
+                "language:os",
+                "language:pa",
+                "language:pag",
+                "language:pam",
+                "language:pap",
+                "language:pcd",
+                "language:pcm",
+                "language:pdc",
+                "language:pfl",
+                "language:pi",
+                "language:pih",
+                "language:pl",
+                "language:pms",
+                "language:pnb",
+                "language:pnt",
+                "language:ps",
+                "language:pt",
+                "language:pwn",
+                "language:qu",
+                "language:rm",
+                "language:rmy",
+                "language:rn",
+                "language:ro",
+                "language:ru",
+                "language:rue",
+                "language:rup",
+                "language:rw",
+                "language:sa",
+                "language:sah",
+                "language:sat",
+                "language:sc",
+                "language:scn",
+                "language:sco",
+                "language:sd",
+                "language:se",
+                "language:sg",
+                "language:sgs",
+                "language:shi",
+                "language:shn",
+                "language:si",
+                "language:sk",
+                "language:skr",
+                "language:sl",
+                "language:sm",
+                "language:smn",
+                "language:sn",
+                "language:so",
+                "language:sq",
+                "language:sr",
+                "language:srn",
+                "language:ss",
+                "language:st",
+                "language:stq",
+                "language:su",
+                "language:sv",
+                "language:sw",
+                "language:szl",
+                "language:szy",
+                "language:ta",
+                "language:tay",
+                "language:tcy",
+                "language:te",
+                "language:tet",
+                "language:tg",
+                "language:th",
+                "language:ti",
+                "language:tk",
+                "language:tl",
+                "language:tly",
+                "language:tn",
+                "language:to",
+                "language:tpi",
+                "language:tr",
+                "language:trv",
+                "language:ts",
+                "language:tt",
+                "language:tum",
+                "language:tw",
+                "language:ty",
+                "language:tyv",
+                "language:udm",
+                "language:ug",
+                "language:uk",
+                "language:ur",
+                "language:uz",
+                "language:ve",
+                "language:vec",
+                "language:vep",
+                "language:vi",
+                "language:vls",
+                "language:vo",
+                "language:vro",
+                "language:wa",
+                "language:war",
+                "language:wo",
+                "language:wuu",
+                "language:xal",
+                "language:xh",
+                "language:xmf",
+                "language:yi",
+                "language:yo",
+                "language:yue",
+                "language:za",
+                "language:zea",
+                "language:zgh",
+                "language:zh",
+                "language:zu",
+                "size_categories:10M<n<100M",
+                "format:parquet",
+                "modality:text",
+                "library:datasets",
+                "library:dask",
+                "library:mlcroissant",
+                "library:polars",
+                "region:us"
+            ]
+        }
+    ]
+}
\ No newline at end of file
diff --git a/MLBOM/Model/FoundationModels/bom.json b/MLBOM/Model/FoundationModels/bom.json
new file mode 100644
index 0000000..3ef28b4
--- /dev/null
+++ b/MLBOM/Model/FoundationModels/bom.json
@@ -0,0 +1,26 @@
+{
+    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "serialNumber": "urn:uuid:56315ffe-c0af-4474-9c11-c94d1af986a9",
+    "version": 1,
+    "metadata": {
+        "timestamp": "2024-11-24T13:05:42Z",
+        "manufacturer": {
+            "name": "Noma Security Inc."
+        }
+    },
+    "components": [
+        {
+            "type": "machine-learning-model",
+            "supplier": {
+                "name": "OpenAI Inc"
+            },
+            "manufacturer": {
+                "name": "OpenAI Inc"
+            },
+            "publisher": "OpenAI Inc",
+            "name": "gpt-4o"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/MLBOM/Model/OpenSource/bom.json b/MLBOM/Model/OpenSource/bom.json
new file mode 100644
index 0000000..aba17ff
--- /dev/null
+++ b/MLBOM/Model/OpenSource/bom.json
@@ -0,0 +1,63 @@
+{
+    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "serialNumber": "urn:uuid:21d0b6f8-f5b0-44df-8587-79c5d70cd1da",
+    "version": 1,
+    "metadata": {
+        "timestamp": "2024-11-24T13:10:49Z",
+    },
+    "components": [
+        {
+            "type": "machine-learning-model",
+            "supplier": {
+                "name": "google-bert"
+            },
+            "manufacturer": {
+                "name": "google-bert"
+            },
+            "publisher": "Hugging Face Inc",
+            "name": "bert-base-cased",
+            "version": "cd5ef92a9fb2f889e972770a36d4ed042daf221e",
+            "licenses": [
+                {
+                    "license": {
+                        "id": "Apache-2.0",
+                        "name": "Apache License 2.0",
+                        "url": "https://www.apache.org/licenses/LICENSE-2.0"
+                    }
+                }
+            ],
+            "externalReferences": [
+                {
+                    "type": "website",
+                    "url": "https://huggingface.co/google-bert/bert-base-cased"
+                }
+            ],
+            "hashes": [
+                {
+                    "alg": "SHA-1",
+                    "content": "cd5ef92a9fb2f889e972770a36d4ed042daf221e"
+                }
+            ],
+            "tags": [
+                "transformers",
+                "pytorch",
+                "tf",
+                "jax",
+                "safetensors",
+                "bert",
+                "fill-mask",
+                "exbert",
+                "en",
+                "dataset:bookcorpus",
+                "dataset:wikipedia",
+                "arxiv:1810.04805",
+                "license:apache-2.0",
+                "autotrain_compatible",
+                "endpoints_compatible",
+                "region:us"
+            ]
+        }
+    ]
+}
\ No newline at end of file
diff --git a/MLBOM/README.md b/MLBOM/README.md
new file mode 100644
index 0000000..14d9066
--- /dev/null
+++ b/MLBOM/README.md
@@ -0,0 +1,28 @@
+# Machine Learning Bill of Materials (ML-BOM)
+
+Machine learning, particularly AI, often lacks transparency regarding models' usage, creation processes, and lifecycle within organizations. The Machine Learning Bill of Materials (ML-BOM) builds on CycloneDX to offer a detailed representation of machine learning models, datasets, and related artifacts. ML-BOM empowers organizations to document, manage, and secure their machine learning assets while enhancing visibility into model lineage and mitigating supply chain risks.
+
+## Features of ML-BOM
+- Captures machine learning models, datasets, libraries, and their interdependencies.
+- Documents comprehensive metadata about models, including architecture, training datasets, performance metrics, and ethical considerations.
+- Facilitates model lineage tracking, integrating it into the lifecycle management of ML components from design to decommission.
+- Enhances transparency by illustrating how software incorporates ML/AI components and embedding them within the broader SBOM framework.
+- Highlights critical details about model biases and ethical implications stemming from training datasets, while identifying and classifying the presence of sensitive data in datasets or trained models.
+
+## Key Components
+
+### 1. **Machine Learning Models**
+ML-BOM can document models and their parameters, including Model Architecture and Performance Metrics, and Ethical and Fairness Considerations
+
+### 2. **Datasets**
+Datasets used for training, validation, and inference can be described with:
+- **Data Classification**: Tags to specify sensitivity and value.
+- **Data Governance**: Ownership, stewardship, and custodianship details.
+- **Sensitive Data**: Annotations for datasets containing sensitive information.
+
+### 3. **Libraries**
+ML-BOM provides a detailed overview of the dependencies models have on specific ML/AI libraries, ensuring transparency and traceability in their usage, including their versioning, licenses, and security considerations
+
+
+## High-Level Object Model
+![CycloneDX Object Model Swimlane](https://cyclonedx.org/theme/assets/images/CycloneDX-Object-Model-Swimlane.svg)

From d95fc3184e934079386e635f88ee1f1711e6a50e Mon Sep 17 00:00:00 2001
From: Gal Moyal <gal@noma.security>
Date: Wed, 4 Dec 2024 10:32:53 +0200
Subject: [PATCH 2/5] Removed all languages to avoid clutter

Signed-off-by: Gal Moyal <gal@noma.security>
---
 MLBOM/Dataset/bom.json | 320 -----------------------------------------
 1 file changed, 320 deletions(-)

diff --git a/MLBOM/Dataset/bom.json b/MLBOM/Dataset/bom.json
index 4fb556a..6062a61 100644
--- a/MLBOM/Dataset/bom.json
+++ b/MLBOM/Dataset/bom.json
@@ -52,328 +52,8 @@
                 "task_categories:fill-mask",
                 "task_ids:language-modeling",
                 "task_ids:masked-language-modeling",
-                "language:ab",
-                "language:ace",
-                "language:ady",
-                "language:af",
-                "language:alt",
-                "language:am",
-                "language:ami",
-                "language:an",
-                "language:ang",
-                "language:anp",
-                "language:ar",
-                "language:arc",
-                "language:ary",
-                "language:arz",
-                "language:as",
-                "language:ast",
-                "language:atj",
-                "language:av",
-                "language:avk",
-                "language:awa",
-                "language:ay",
-                "language:az",
-                "language:azb",
-                "language:ba",
-                "language:ban",
-                "language:bar",
-                "language:bbc",
-                "language:bcl",
-                "language:be",
-                "language:bg",
-                "language:bh",
-                "language:bi",
-                "language:bjn",
-                "language:blk",
-                "language:bm",
-                "language:bn",
-                "language:bo",
-                "language:bpy",
-                "language:br",
-                "language:bs",
-                "language:bug",
-                "language:bxr",
-                "language:ca",
-                "language:cbk",
-                "language:cdo",
-                "language:ce",
-                "language:ceb",
-                "language:ch",
-                "language:chr",
-                "language:chy",
-                "language:ckb",
-                "language:co",
-                "language:cr",
-                "language:crh",
-                "language:cs",
-                "language:csb",
-                "language:cu",
-                "language:cv",
-                "language:cy",
-                "language:da",
-                "language:dag",
-                "language:de",
-                "language:dga",
-                "language:din",
-                "language:diq",
-                "language:dsb",
-                "language:dty",
-                "language:dv",
-                "language:dz",
-                "language:ee",
-                "language:el",
-                "language:eml",
                 "language:en",
-                "language:eo",
                 "language:es",
-                "language:et",
-                "language:eu",
-                "language:ext",
-                "language:fa",
-                "language:fat",
-                "language:ff",
-                "language:fi",
-                "language:fj",
-                "language:fo",
-                "language:fon",
-                "language:fr",
-                "language:frp",
-                "language:frr",
-                "language:fur",
-                "language:fy",
-                "language:ga",
-                "language:gag",
-                "language:gan",
-                "language:gcr",
-                "language:gd",
-                "language:gl",
-                "language:glk",
-                "language:gn",
-                "language:gom",
-                "language:gor",
-                "language:got",
-                "language:gpe",
-                "language:gsw",
-                "language:gu",
-                "language:guc",
-                "language:gur",
-                "language:guw",
-                "language:gv",
-                "language:ha",
-                "language:hak",
-                "language:haw",
-                "language:hbs",
-                "language:he",
-                "language:hi",
-                "language:hif",
-                "language:hr",
-                "language:hsb",
-                "language:ht",
-                "language:hu",
-                "language:hy",
-                "language:hyw",
-                "language:ia",
-                "language:id",
-                "language:ie",
-                "language:ig",
-                "language:ik",
-                "language:ilo",
-                "language:inh",
-                "language:io",
-                "language:is",
-                "language:it",
-                "language:iu",
-                "language:ja",
-                "language:jam",
-                "language:jbo",
-                "language:jv",
-                "language:ka",
-                "language:kaa",
-                "language:kab",
-                "language:kbd",
-                "language:kbp",
-                "language:kcg",
-                "language:kg",
-                "language:ki",
-                "language:kk",
-                "language:kl",
-                "language:km",
-                "language:kn",
-                "language:ko",
-                "language:koi",
-                "language:krc",
-                "language:ks",
-                "language:ksh",
-                "language:ku",
-                "language:kv",
-                "language:kw",
-                "language:ky",
-                "language:la",
-                "language:lad",
-                "language:lb",
-                "language:lbe",
-                "language:lez",
-                "language:lfn",
-                "language:lg",
-                "language:li",
-                "language:lij",
-                "language:lld",
-                "language:lmo",
-                "language:ln",
-                "language:lo",
-                "language:lt",
-                "language:ltg",
-                "language:lv",
-                "language:lzh",
-                "language:mad",
-                "language:mai",
-                "language:map",
-                "language:mdf",
-                "language:mg",
-                "language:mhr",
-                "language:mi",
-                "language:min",
-                "language:mk",
-                "language:ml",
-                "language:mn",
-                "language:mni",
-                "language:mnw",
-                "language:mr",
-                "language:mrj",
-                "language:ms",
-                "language:mt",
-                "language:mwl",
-                "language:my",
-                "language:myv",
-                "language:mzn",
-                "language:nah",
-                "language:nan",
-                "language:nap",
-                "language:nds",
-                "language:ne",
-                "language:new",
-                "language:nia",
-                "language:nl",
-                "language:nn",
-                "language:no",
-                "language:nov",
-                "language:nqo",
-                "language:nrf",
-                "language:nso",
-                "language:nv",
-                "language:ny",
-                "language:oc",
-                "language:olo",
-                "language:om",
-                "language:or",
-                "language:os",
-                "language:pa",
-                "language:pag",
-                "language:pam",
-                "language:pap",
-                "language:pcd",
-                "language:pcm",
-                "language:pdc",
-                "language:pfl",
-                "language:pi",
-                "language:pih",
-                "language:pl",
-                "language:pms",
-                "language:pnb",
-                "language:pnt",
-                "language:ps",
-                "language:pt",
-                "language:pwn",
-                "language:qu",
-                "language:rm",
-                "language:rmy",
-                "language:rn",
-                "language:ro",
-                "language:ru",
-                "language:rue",
-                "language:rup",
-                "language:rw",
-                "language:sa",
-                "language:sah",
-                "language:sat",
-                "language:sc",
-                "language:scn",
-                "language:sco",
-                "language:sd",
-                "language:se",
-                "language:sg",
-                "language:sgs",
-                "language:shi",
-                "language:shn",
-                "language:si",
-                "language:sk",
-                "language:skr",
-                "language:sl",
-                "language:sm",
-                "language:smn",
-                "language:sn",
-                "language:so",
-                "language:sq",
-                "language:sr",
-                "language:srn",
-                "language:ss",
-                "language:st",
-                "language:stq",
-                "language:su",
-                "language:sv",
-                "language:sw",
-                "language:szl",
-                "language:szy",
-                "language:ta",
-                "language:tay",
-                "language:tcy",
-                "language:te",
-                "language:tet",
-                "language:tg",
-                "language:th",
-                "language:ti",
-                "language:tk",
-                "language:tl",
-                "language:tly",
-                "language:tn",
-                "language:to",
-                "language:tpi",
-                "language:tr",
-                "language:trv",
-                "language:ts",
-                "language:tt",
-                "language:tum",
-                "language:tw",
-                "language:ty",
-                "language:tyv",
-                "language:udm",
-                "language:ug",
-                "language:uk",
-                "language:ur",
-                "language:uz",
-                "language:ve",
-                "language:vec",
-                "language:vep",
-                "language:vi",
-                "language:vls",
-                "language:vo",
-                "language:vro",
-                "language:wa",
-                "language:war",
-                "language:wo",
-                "language:wuu",
-                "language:xal",
-                "language:xh",
-                "language:xmf",
-                "language:yi",
-                "language:yo",
-                "language:yue",
-                "language:za",
-                "language:zea",
-                "language:zgh",
-                "language:zh",
-                "language:zu",
                 "size_categories:10M<n<100M",
                 "format:parquet",
                 "modality:text",

From 44b64c132245d86c6a8e4141c4f7cb649cb8e875 Mon Sep 17 00:00:00 2001
From: Gal Moyal <gal@noma.security>
Date: Wed, 4 Dec 2024 11:40:40 +0200
Subject: [PATCH 3/5] Added reference in the readme

Signed-off-by: Gal Moyal <gal@noma.security>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 759c207..2f19262 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@ are categorized by different BOM types including:
 | [SBOM](SBOM)       | Software Bill of Materials              |
 | [VDR](VDR)         | Vulnerability Disclosure Report         |
 | [VEX](VEX)         | Vulnerability Exploitability eXchange   |
+| [MLBOM](MLBOM)     | Machine Learning Bill of Materials      |
 
 When possible, the BOMs conform to the latest version of the CycloneDX specification.
 

From cb2791f116f3db259d57cdec4758c33fe96dda8c Mon Sep 17 00:00:00 2001
From: Gal Moyal <gal@noma.security>
Date: Wed, 4 Dec 2024 13:15:40 +0200
Subject: [PATCH 4/5] Changed the XBOM to be in alphabetical order

Signed-off-by: Gal Moyal <gal@noma.security>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 2f19262..7389f87 100644
--- a/README.md
+++ b/README.md
@@ -15,12 +15,12 @@ are categorized by different BOM types including:
 |--------------------|-----------------------------------------|
 | [CBOM](CBOM)       | Cryptography Bill of Materials          |
 | [HBOM](HBOM)       | Hardware Bill of Materials              |
+| [MLBOM](MLBOM)     | Machine Learning Bill of Materials      |
 | [OBOM](OBOM)       | Operations Bill of Materials            |
 | [SaaSBOM](SaaSBOM) | Software-as-a-Service Bill of Materials |
 | [SBOM](SBOM)       | Software Bill of Materials              |
 | [VDR](VDR)         | Vulnerability Disclosure Report         |
 | [VEX](VEX)         | Vulnerability Exploitability eXchange   |
-| [MLBOM](MLBOM)     | Machine Learning Bill of Materials      |
 
 When possible, the BOMs conform to the latest version of the CycloneDX specification.
 

From 64378bacab33b7dca43d1fc8205a30bbf146a44e Mon Sep 17 00:00:00 2001
From: Gal Moyal <gal@noma.security>
Date: Tue, 10 Dec 2024 18:43:44 +0200
Subject: [PATCH 5/5] Implemented CR Notes

Signed-off-by: Gal Moyal <gal@noma.security>
---
 MLBOM/Dataset/bom.json                | 81 ++++++++++++++++++++++-----
 MLBOM/Model/FoundationModels/bom.json | 23 +++++++-
 MLBOM/Model/OpenSource/bom.json       | 34 +++++++++--
 3 files changed, 117 insertions(+), 21 deletions(-)

diff --git a/MLBOM/Dataset/bom.json b/MLBOM/Dataset/bom.json
index 6062a61..904afb2 100644
--- a/MLBOM/Dataset/bom.json
+++ b/MLBOM/Dataset/bom.json
@@ -19,6 +19,15 @@
             "publisher": "Hugging Face Inc",
             "name": "wikipedia",
             "version": "b04c8d1ceb2f5cd4588862100d08de323dccfbaa",
+            "data": [
+                {
+                    "type": "dataset",
+                    "name": "wikipedia",
+                    "contents": {
+                        "url": "https://huggingface.co/datasets/wikimedia/wikipedia",
+                    }
+                }
+            ],
             "licenses": [
                 {
                     "license": {
@@ -47,21 +56,63 @@
                     "content": "b04c8d1ceb2f5cd4588862100d08de323dccfbaa"
                 }
             ],
-            "tags": [
-                "task_categories:text-generation",
-                "task_categories:fill-mask",
-                "task_ids:language-modeling",
-                "task_ids:masked-language-modeling",
-                "language:en",
-                "language:es",
-                "size_categories:10M<n<100M",
-                "format:parquet",
-                "modality:text",
-                "library:datasets",
-                "library:dask",
-                "library:mlcroissant",
-                "library:polars",
-                "region:us"
+            "properties": [
+                {
+                    "name": "task_categories",
+                    "value": "text-generation"
+                },
+                {
+                    "name": "task_categories",
+                    "value": "fill-mask"
+                },
+                {
+                    "name": "task_ids",
+                    "value": "language-modeling"
+                },
+                {
+                    "name": "task_ids",
+                    "value": "masked-language-modeling"
+                },
+                {
+                    "name": "language",
+                    "value": "en"
+                },
+                {
+                    "name": "language",
+                    "value": "es"
+                },
+                {
+                    "name": "size_categories",
+                    "value": "10M<n<100M"
+                },
+                {
+                    "name": "format",
+                    "value": "parquet"
+                },
+                {
+                    "name": "modality",
+                    "value": "text"
+                },
+                {
+                    "name": "library",
+                    "value": "datasets"
+                },
+                {
+                    "name": "library",
+                    "value": "dask"
+                },
+                {
+                    "name": "library",
+                    "value": "mlcroissant"
+                },
+                {
+                    "name": "library",
+                    "value": "polars"
+                },
+                {
+                    "name": "region",
+                    "value": "us"
+                }
             ]
         }
     ]
diff --git a/MLBOM/Model/FoundationModels/bom.json b/MLBOM/Model/FoundationModels/bom.json
index 3ef28b4..54e4c1e 100644
--- a/MLBOM/Model/FoundationModels/bom.json
+++ b/MLBOM/Model/FoundationModels/bom.json
@@ -20,7 +20,28 @@
                 "name": "OpenAI Inc"
             },
             "publisher": "OpenAI Inc",
-            "name": "gpt-4o"
+            "name": "gpt-4o",
+            "modelCard": {
+                "modelParameters": {
+                    "modelArchitecture": "GPT-4",
+                    "inputs": [
+                        {
+                            "format": "string"
+                        },
+                        {
+                            "format": "image"
+                        }
+                    ],
+                    "outputs": [
+                        {
+                            "format": "string"
+                        },
+                        {
+                            "format": "image"
+                        }
+                    ]
+                }
+            }
         }
     ]
 }
\ No newline at end of file
diff --git a/MLBOM/Model/OpenSource/bom.json b/MLBOM/Model/OpenSource/bom.json
index aba17ff..dc3bc06 100644
--- a/MLBOM/Model/OpenSource/bom.json
+++ b/MLBOM/Model/OpenSource/bom.json
@@ -40,6 +40,34 @@
                     "content": "cd5ef92a9fb2f889e972770a36d4ed042daf221e"
                 }
             ],
+            "modelCard": {
+                "modelParameters": {
+                    "datasets": [
+                        {
+                            "type": "dataset",
+                            "name": "legacy-datasets/wikipedia",
+                            "contents": {
+                                "url": "https://huggingface.co/datasets/legacy-datasets/wikipedia"
+                            },
+                            "description": "Wikipedia dataset containing cleaned articles of all languages."
+                        },
+                        {
+                            "type": "dataset",
+                            "name": "bookcorpus/bookcorpus",
+                            "contents": {
+                                "url": "https://huggingface.co/datasets/bookcorpus/bookcorpus"
+                            },
+                            "description": "A corpus of fine-grained information and high-level semantics text"
+                        }
+                    ]
+                }
+            },
+            "properties": [
+                {
+                    "name": "region",
+                    "value": "us"
+                }
+            ],
             "tags": [
                 "transformers",
                 "pytorch",
@@ -50,13 +78,9 @@
                 "fill-mask",
                 "exbert",
                 "en",
-                "dataset:bookcorpus",
-                "dataset:wikipedia",
                 "arxiv:1810.04805",
-                "license:apache-2.0",
                 "autotrain_compatible",
-                "endpoints_compatible",
-                "region:us"
+                "endpoints_compatible"
             ]
         }
     ]