diff --git a/.gitignore b/.gitignore index 18e738864..875ca5863 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,11 @@ -.DS_Store +# Filesystem +**/.DS_Store + +# Tooling .idea/ .vscode/ tools/target/ +.bob + +# UML diagrams +**/.uml/ diff --git a/schema/2.0/model/cyclonedx-ai-ml-2.0.schema.json b/schema/2.0/model/cyclonedx-ai-ml-2.0.schema.json new file mode 100644 index 000000000..8720c6197 --- /dev/null +++ b/schema/2.0/model/cyclonedx-ai-ml-2.0.schema.json @@ -0,0 +1,1354 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-ai-ml-2.0.schema.json", + "type": "null", + "title": "CycloneDX AI/ML Model", + "$comment": "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", + "$defs": { + "modelProperties": { + "type": "object", + "title": "AI/ML Model Properties", + "description": "Intrinsic technical characteristics of a machine learning model. This object SHOULD be specified for any component of type `machine-learning-model` and shall not be specified for other component types. Contextual and subjective aspects of a model, including ethical and fairness considerations, potential harms, groups at risk, and impact assessments, are expressed with the risk model and reference the model component. Views of this data tailored to a specific audience, such as a model card, are expressed with perspectives.", + "additionalProperties": false, + "properties": { + "learningTypes": { + "type": "array", + "title": "Learning Types", + "description": "The learning paradigms applied when training the model. A model may combine several paradigms, for example self-supervised pre-training followed by supervised fine-tuning and reinforcement learning based alignment.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/learningType" + } + }, + "tasks": { + "type": "array", + "title": "Tasks", + "description": "The machine learning tasks the model is designed to perform. Tasks directly influence the intended use, the input and output characteristics, and the applicable evaluation metrics of the model. A model may support multiple tasks.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/modelTask" + } + }, + "architecture": { + "title": "Architecture", + "description": "The architecture of the model.", + "$ref": "#/$defs/modelArchitecture" + }, + "parameterCount": { + "type": "integer", + "title": "Parameter Count", + "description": "The total number of trainable parameters of the model.", + "minimum": 0 + }, + "quantization": { + "title": "Quantization", + "description": "The quantization applied to the model weights as distributed. Quantization of individual input and output tensors is expressed on the model parameters.", + "$ref": "#/$defs/quantization" + }, + "inputs": { + "type": "array", + "title": "Model Inputs", + "description": "The input parameters accepted by the model.", + "items": { + "$ref": "#/$defs/modelParameter" + } + }, + "outputs": { + "type": "array", + "title": "Model Outputs", + "description": "The output parameters produced by the model.", + "items": { + "$ref": "#/$defs/modelParameter" + } + }, + "training": { + "title": "Training", + "description": "Information about how the model was trained.", + "$ref": "#/$defs/training" + }, + "evaluation": { + "title": "Evaluation", + "description": "A quantitative evaluation of the model.", + "$ref": "#/$defs/evaluation" + }, + "limitations": { + "type": "array", + "title": "Limitations", + "description": "Known technical limitations of the model, including constraints on accuracy, reasoning, scalability, and appropriate use. Limitations that expose users or other parties to potential harm should also be documented with the risk model.", + "items": { + "type": "string" + } + }, + "useCases": { + "type": "array", + "title": "Use Cases", + "description": "References to use cases, defined elsewhere in the BOM, that describe the intended uses of the model.", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + } + }, + "environmental": { + "title": "Environmental Impact", + "description": "Measured environmental impacts of the model across its lifecycle activities.", + "$ref": "#/$defs/environmental" + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the model but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the model. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "learningType": { + "title": "Learning Type", + "description": "A learning paradigm applied when training a machine learning model. Use the custom option for paradigms not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Learning Type", + "type": "string", + "enum": [ + "supervised", + "unsupervised", + "semi-supervised", + "self-supervised", + "reinforcement-learning" + ], + "meta:enum": { + "supervised": "The model learns from labelled data to map inputs to known outputs.", + "unsupervised": "The model learns patterns and structure from unlabelled data.", + "semi-supervised": "The model learns from a combination of labelled and unlabelled data.", + "self-supervised": "The model learns from supervisory signals derived automatically from the data itself.", + "reinforcement-learning": "The model learns a policy by acting in an environment and receiving reward signals, including reward signals derived from human or automated feedback." + } + }, + { + "type": "object", + "title": "Custom Learning Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom learning paradigm." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom learning paradigm." + } + } + } + ] + }, + "modelTask": { + "title": "Model Task", + "description": "A machine learning task that a model is designed to perform. Use the custom option for tasks not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Task", + "type": "string", + "enum": [ + "text-generation", + "text-classification", + "token-classification", + "question-answering", + "summarization", + "translation", + "text-to-text", + "fill-mask", + "sentence-similarity", + "text-to-image", + "text-to-video", + "text-to-audio", + "text-to-speech", + "image-classification", + "image-segmentation", + "object-detection", + "image-to-image", + "image-to-text", + "depth-estimation", + "video-classification", + "audio-classification", + "automatic-speech-recognition", + "audio-to-audio", + "voice-activity-detection", + "tabular-classification", + "tabular-regression", + "time-series-forecasting", + "reinforcement-learning", + "robotics", + "graph-ml", + "feature-extraction", + "embedding", + "zero-shot-classification", + "few-shot-learning" + ], + "meta:enum": { + "text-generation": "Generate coherent text continuations from prompts.", + "text-classification": "Classify text into predefined categories, for example sentiment analysis or topic classification.", + "token-classification": "Classify individual tokens in text, for example named entity recognition or part-of-speech tagging.", + "question-answering": "Answer questions based on context or knowledge, using extractive or generative approaches.", + "summarization": "Generate concise summaries of longer text documents.", + "translation": "Translate text from one language to another.", + "text-to-text": "Transform text from one form to another, for example paraphrasing or style transfer.", + "fill-mask": "Predict masked tokens in text, as in masked language modelling.", + "sentence-similarity": "Compute semantic similarity between text sequences.", + "text-to-image": "Generate images from text descriptions.", + "text-to-video": "Generate video content from text descriptions.", + "text-to-audio": "Generate audio or music from text descriptions.", + "text-to-speech": "Convert text to spoken audio through speech synthesis.", + "image-classification": "Classify images into predefined categories.", + "image-segmentation": "Segment images into regions or objects using semantic or instance segmentation.", + "object-detection": "Detect and localize objects in images.", + "image-to-image": "Transform images, for example style transfer, super-resolution, or inpainting.", + "image-to-text": "Generate text descriptions from images, for example image captioning.", + "depth-estimation": "Estimate depth information from images.", + "video-classification": "Classify video content into categories.", + "audio-classification": "Classify audio into categories, for example sound event detection.", + "automatic-speech-recognition": "Transcribe spoken audio to text.", + "audio-to-audio": "Transform audio, for example noise reduction or voice conversion.", + "voice-activity-detection": "Detect the presence of speech in audio streams.", + "tabular-classification": "Classify structured tabular data.", + "tabular-regression": "Predict continuous values from structured tabular data.", + "time-series-forecasting": "Predict future values in time series data.", + "reinforcement-learning": "Learn optimal actions through interaction with an environment.", + "robotics": "Control and decision making for robotic systems.", + "graph-ml": "Machine learning tasks on graph structured data.", + "feature-extraction": "Extract meaningful features or representations from data.", + "embedding": "Generate dense vector representations of data.", + "zero-shot-classification": "Classify data without task specific training examples.", + "few-shot-learning": "Learn from very few examples per class." + } + }, + { + "type": "object", + "title": "Custom Task", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom machine learning task." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom machine learning task." + } + } + } + ], + "examples": [ + "text-generation", + "image-classification", + "object-detection", + "automatic-speech-recognition" + ] + }, + "architectureFamily": { + "title": "Architecture Family", + "description": "The core structural family of a model. Use the custom option for families not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Architecture Family", + "type": "string", + "enum": [ + "transformer", + "cnn", + "rnn", + "lstm", + "gru", + "gan", + "vae", + "mamba", + "ssm", + "gnn", + "mlp", + "rwkv", + "snn", + "kan", + "diffusion", + "flow-matching", + "rbm", + "capsnet", + "neuromorphic", + "hybrid" + ], + "meta:enum": { + "transformer": "Architecture based on self-attention mechanisms for processing sequential or spatial data.", + "cnn": "Convolutional neural network using convolutional layers for processing grid structured data.", + "rnn": "Recurrent neural network with recurrent connections for sequential data processing.", + "lstm": "Long short-term memory network, a recurrent variant with gating mechanisms for long-term dependencies.", + "gru": "Gated recurrent unit network, a recurrent variant with simplified gating.", + "gan": "Generative adversarial network, a dual network framework containing a generator and a discriminator.", + "vae": "Variational autoencoder, a probabilistic encoder and decoder architecture mapping to a latent space.", + "mamba": "State space model architecture with selective mechanisms for efficient sequence modelling.", + "ssm": "State space model based on continuous or discrete state space representations.", + "gnn": "Graph neural network optimized for processing graph structured data.", + "mlp": "Multilayer perceptron, a feedforward architecture composed entirely of fully connected layers.", + "rwkv": "Receptance weighted key value architecture combining parallelizable training with recurrent inference.", + "snn": "Spiking neural network, a neuromorphic architecture utilizing discrete, time dependent spiking activations.", + "kan": "Kolmogorov-Arnold network featuring learnable activation functions on edges rather than nodes.", + "diffusion": "Denoising diffusion model that iteratively refines noise into data.", + "flow-matching": "Continuous normalizing flow trained with flow matching or rectified flow objectives.", + "rbm": "Restricted Boltzmann machine, an energy based generative model with stochastic hidden units.", + "capsnet": "Capsule network using dynamic routing between capsule groups to preserve spatial hierarchies.", + "neuromorphic": "Architecture designed for deployment on neuromorphic hardware.", + "hybrid": "Explicit combination of two or more distinct architecture families." + } + }, + { + "type": "object", + "title": "Custom Architecture Family", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom architecture family." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom architecture family." + } + } + } + ] + }, + "architectureFeature": { + "title": "Architecture Feature", + "description": "A structural feature or mechanism present in a model, including macro level layouts, attention variants, and parameter efficient adaptation mechanisms. Use the custom option for features not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Architecture Feature", + "type": "string", + "enum": [ + "decoder-only", + "encoder-only", + "encoder-decoder", + "mixture-of-experts", + "vae-bottleneck", + "u-net", + "residual-connections", + "dual-encoders", + "cross-attention", + "siamese-network", + "hybrid-backbone", + "vision-encoder", + "adapter-layers", + "projector-layers", + "gated-linear-units", + "speculative-decoding", + "rotary-position-embedding", + "grouped-query-attention", + "sliding-window-attention", + "retrieval-augmented", + "memory-augmented", + "multimodal-fusion", + "reranker" + ], + "meta:enum": { + "decoder-only": "Autoregressive layout that attends to prior positions only.", + "encoder-only": "Bidirectional layout that processes complete sequences simultaneously.", + "encoder-decoder": "Sequence to sequence structure mapping an input representation to an output sequence.", + "mixture-of-experts": "Sparse routing mechanism activating specific expert subnetworks per token.", + "vae-bottleneck": "Symmetric compression bottleneck utilizing mean and variance latent vectors.", + "u-net": "Symmetric contracting and expanding layout featuring skip connections between corresponding scales.", + "residual-connections": "Explicit skip or identity shortcuts bypassing one or more structural layers.", + "dual-encoders": "Parallel feature extraction pipelines mapping different inputs into a shared space.", + "cross-attention": "Mechanism that conditions one feature stream on another through attention.", + "siamese-network": "Twin subnetworks sharing identical weights to compute similarity metrics.", + "hybrid-backbone": "Direct cascading combination of distinct architecture families, for example a convolutional feature extractor feeding a transformer.", + "vision-encoder": "Vision encoding component for processing image inputs in multimodal architectures.", + "adapter-layers": "Parameter efficient fine-tuning layers inserted into otherwise frozen models.", + "projector-layers": "Projection components bridging different modalities.", + "gated-linear-units": "Gated activation mechanisms using element-wise multiplication.", + "speculative-decoding": "Pairing of a small draft model with a larger verifier model to accelerate autoregressive generation.", + "rotary-position-embedding": "Positional encoding applied through rotation matrices.", + "grouped-query-attention": "Attention variant sharing key and value heads across groups of query heads.", + "sliding-window-attention": "Attention mechanism restricting the receptive field to a local sliding window.", + "retrieval-augmented": "Retrieval component prepended to or integrated into the model.", + "memory-augmented": "External or persistent memory bank integrated into the forward pass.", + "multimodal-fusion": "Layer or block that fuses representations across more than one modality.", + "reranker": "Separate scoring or reranking head applied after an initial retrieval or generation step." + } + }, + { + "type": "object", + "title": "Custom Architecture Feature", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom architecture feature." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom architecture feature." + } + } + } + ] + }, + "architectureTopology": { + "title": "Architecture Topology", + "description": "The runtime parameter activation and connection structure of a model. Use the custom option for topologies not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Architecture Topology", + "type": "string", + "enum": [ + "dense", + "sparse", + "dynamic", + "liquid", + "mixture-of-depths", + "early-exit", + "recurrent-hybrid" + ], + "meta:enum": { + "dense": "All or most parameters are active during inference with full connectivity between layers.", + "sparse": "Only a subset of parameters is active during inference with selective connectivity.", + "dynamic": "Parameter activation and connectivity patterns change based on input or runtime conditions.", + "liquid": "Continuously adaptive network structure with time varying connections and activations.", + "mixture-of-depths": "Tokens are routed to different computational depths rather than to different expert modules.", + "early-exit": "Inference exits at the earliest layer that meets a confidence threshold, reducing compute for easy inputs.", + "recurrent-hybrid": "Static layer layout that alternates between global attention and recurrent or state space layers." + } + }, + { + "type": "object", + "title": "Custom Architecture Topology", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom topology." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom topology." + } + } + } + ] + }, + "modelArchitecture": { + "type": "object", + "title": "Model Architecture", + "description": "The architecture of a machine learning model, including its structural family, notable features, and topology.", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The identifying name of the model architecture, typically a well known architecture variant.", + "examples": [ + "ResNet-50", + "BERT-base", + "U-Net", + "ViT-B/16" + ] + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the architecture, including key characteristics, design decisions, and architectural innovations." + }, + "family": { + "title": "Family", + "description": "The core structural family of the model.", + "$ref": "#/$defs/architectureFamily" + }, + "features": { + "type": "array", + "title": "Features", + "description": "Structural features and mechanisms present in the model.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/architectureFeature" + } + }, + "topology": { + "title": "Topology", + "description": "The runtime parameter activation and connection structure of the model.", + "$ref": "#/$defs/architectureTopology" + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the model architecture but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the model architecture. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "modality": { + "title": "Modality", + "description": "The type of data a model parameter carries. Use the custom option for modalities not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Modality", + "type": "string", + "enum": [ + "text", + "image", + "audio", + "video", + "multimodal", + "embedding", + "logits" + ], + "meta:enum": { + "text": "Natural language text input or output.", + "image": "Visual image data input or output.", + "audio": "Audio or speech data input or output.", + "video": "Video data input or output.", + "multimodal": "Combined multiple modalities, for example text and image.", + "embedding": "Dense vector representations in a continuous space.", + "logits": "Raw unnormalized model outputs before activation functions." + } + }, + { + "type": "object", + "title": "Custom Modality", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom modality." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom modality." + } + } + } + ] + }, + "quantization": { + "type": "object", + "title": "Quantization", + "description": "The quantization applied to a model parameter. The scheme parameters recorded here describe how quantized values relate to real values. The scale and zero point tensors themselves are model data and are distributed with the model artefact, not with the BOM. Additional scheme specific details may be recorded in the `properties` of the model parameter.", + "additionalProperties": false, + "properties": { + "method": { + "type": "string", + "title": "Method", + "description": "The quantization method or algorithm applied.", + "examples": [ + "gptq", + "awq", + "rtn", + "k-quant" + ] + }, + "bits": { + "type": "number", + "title": "Bits", + "description": "The nominal bit width per value. Fractional widths are permitted, for example 1.58 for ternary quantization.", + "exclusiveMinimum": 0, + "examples": [ + 8, + 4, + 1.58 + ] + }, + "scheme": { + "title": "Scheme", + "description": "The mapping between quantized values and real values.", + "oneOf": [ + { + "title": "Predefined Quantization Scheme", + "type": "string", + "enum": [ + "affine", + "symmetric" + ], + "meta:enum": { + "affine": "Asymmetric mapping using a scale and a zero point.", + "symmetric": "Symmetric mapping using a scale with the zero point fixed at zero." + } + }, + { + "type": "object", + "title": "Custom Quantization Scheme", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom quantization scheme." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom quantization scheme." + } + } + } + ] + }, + "granularity": { + "title": "Granularity", + "description": "The level at which scales and zero points are assigned.", + "oneOf": [ + { + "title": "Predefined Quantization Granularity", + "type": "string", + "enum": [ + "per-tensor", + "per-channel", + "per-group" + ], + "meta:enum": { + "per-tensor": "One scale and zero point applies to the entire tensor.", + "per-channel": "Scales and zero points are assigned along one tensor axis.", + "per-group": "Scales and zero points are assigned to fixed size groups of elements along one tensor axis." + } + }, + { + "type": "object", + "title": "Custom Quantization Granularity", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom quantization granularity." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom quantization granularity." + } + } + } + ] + }, + "groupSize": { + "type": "integer", + "title": "Group Size", + "description": "The number of elements sharing one scale and zero point when the granularity is `per-group`.", + "minimum": 1, + "examples": [ + 32, + 64, + 128 + ] + }, + "axis": { + "type": "integer", + "title": "Axis", + "description": "The tensor axis along which scales and zero points are assigned when the granularity is `per-channel` or `per-group`.", + "minimum": 0 + } + } + }, + "modelParameter": { + "type": "object", + "title": "Model Parameter", + "description": "A single input or output parameter of a machine learning model. Parameter specific details not covered by the predefined fields may be recorded in `properties`.", + "additionalProperties": false, + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the parameter.", + "examples": [ + "prompt", + "image", + "audio", + "logits", + "embeddings" + ] + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the parameter and its purpose." + }, + "modality": { + "title": "Modality", + "description": "The type of data this parameter carries.", + "$ref": "#/$defs/modality" + }, + "dataType": { + "type": "string", + "title": "Data Type", + "description": "The numeric or symbolic data type of the parameter values.", + "examples": [ + "string", + "float32", + "float16", + "bfloat16", + "int64", + "uint8" + ] + }, + "mimeType": { + "title": "MIME Type", + "description": "The media type of the parameter data.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/mediaType" + }, + "quantization": { + "title": "Quantization", + "description": "The quantization applied to the parameter values.", + "$ref": "#/$defs/quantization" + }, + "shape": { + "type": "array", + "title": "Shape", + "description": "The dimensional shape of the parameter, for example tensor dimensions. A dynamic dimension is expressed as null or -1.", + "items": { + "oneOf": [ + { + "type": "integer", + "minimum": -1 + }, + { + "type": "null" + } + ] + }, + "examples": [ + [ + 1, + 512 + ], + [ + null, + 3, + 224, + 224 + ], + [ + -1, + 768 + ] + ] + }, + "processingStage": { + "type": "string", + "title": "Processing Stage", + "description": "The processing stage of the parameter relative to tokenization or encoding.", + "enum": [ + "pre-tokenizer", + "post-tokenizer", + "pre-encoder", + "post-encoder", + "pre-processing", + "post-processing", + "raw" + ], + "meta:enum": { + "pre-tokenizer": "Data before tokenization, for example a raw text string.", + "post-tokenizer": "Data after tokenization, for example token identifiers.", + "pre-encoder": "Data before an encoding transformation.", + "post-encoder": "Data after an encoding transformation.", + "pre-processing": "Data before any processing pipeline has been applied.", + "post-processing": "Data after all processing steps have been applied.", + "raw": "Raw unprocessed data." + } + }, + "required": { + "type": "boolean", + "title": "Required", + "description": "Indicates whether this parameter is required.", + "default": false + }, + "defaultValue": { + "type": "string", + "title": "Default Value", + "description": "The default value for the parameter when a value is not provided." + }, + "constraints": { + "title": "Constraints", + "description": "Constraints on the parameter values.", + "$ref": "#/$defs/parameterConstraints" + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the parameter but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the parameter. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "parameterConstraints": { + "type": "object", + "title": "Parameter Constraints", + "description": "Constraints on the values of a model parameter.", + "additionalProperties": false, + "properties": { + "minLength": { + "type": "integer", + "title": "Minimum Length", + "description": "The minimum length for text or sequence parameters.", + "minimum": 0 + }, + "maxLength": { + "type": "integer", + "title": "Maximum Length", + "description": "The maximum length for text or sequence parameters.", + "minimum": 0 + }, + "minValue": { + "type": "number", + "title": "Minimum Value", + "description": "The minimum numeric value." + }, + "maxValue": { + "type": "number", + "title": "Maximum Value", + "description": "The maximum numeric value." + }, + "allowedValues": { + "type": "array", + "title": "Allowed Values", + "description": "The list of permitted values for the parameter.", + "items": { + "type": "string" + } + }, + "pattern": { + "type": "string", + "title": "Pattern", + "description": "A regular expression pattern that string values of the parameter match." + } + } + }, + "datasetChoice": { + "title": "Dataset Choice", + "description": "A reference to a dataset documented as a component of type `data`, either within this BOM by `bom-ref` or in another BOM by BOM-Link.", + "anyOf": [ + { + "title": "Dataset Reference", + "description": "A reference to a component of type `data` within this BOM.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + { + "title": "Dataset BOM-Link Reference", + "description": "A BOM-Link reference to a component of type `data` in another BOM.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" + } + ], + "examples": [ + "training-dataset-1", + "urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#openwebtext-subset" + ] + }, + "training": { + "type": "object", + "title": "Training", + "description": "Information about how a model was trained, including references to the datasets used and to the formula that captures the training process. Detailed training and data preparation workflows, including their inputs, outputs, and processing steps, are expressed with formulation and referenced from here.", + "additionalProperties": false, + "properties": { + "formula": { + "title": "Formula Reference", + "description": "References a formula, defined in formulation, that describes how the model was trained, for example as sequenced phases of pre-training, supervised fine-tuning, and alignment tuning.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "datasets": { + "type": "array", + "title": "Training Datasets", + "description": "References to the datasets used for training or fine-tuning the model.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/datasetChoice" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the training process. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "evaluation": { + "type": "object", + "title": "Evaluation", + "description": "A quantitative evaluation of a model, including performance metrics and supporting graphics such as confusion matrices and calibration plots.", + "additionalProperties": false, + "properties": { + "metrics": { + "type": "array", + "title": "Performance Metrics", + "description": "The performance metrics being reported, for example accuracy, F1 score, precision, or benchmark scores.", + "items": { + "$ref": "#/$defs/performanceMetric" + } + }, + "graphics": { + "title": "Graphics", + "description": "A collection of graphics that represent various measurements.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/graphicsCollection" + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the evaluation. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "performanceMeasure": { + "title": "Performance Measure", + "description": "A measure of model performance with a value and a unit. The unit is constrained to the predefined unit sets for time, throughput, compute, memory, and ratio measurements.", + "allOf": [ + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/measure" + }, + { + "required": [ + "unit" + ], + "properties": { + "unit": { + "anyOf": [ + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/timeUnits" + }, + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/throughputUnits" + }, + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/computeUnits" + }, + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/memoryUnits" + }, + { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/ratioUnits" + } + ] + } + } + } + ] + }, + "performanceMetric": { + "type": "object", + "title": "Performance Metric", + "description": "A reported performance metric of a model. Benchmarks and evaluation methodologies evolve rapidly, so the metric type and benchmark name are open strings; external references and evaluation dataset references establish the identity, version, and provenance of the evaluation.", + "additionalProperties": false, + "required": [ + "type", + "measure" + ], + "properties": { + "type": { + "type": "string", + "title": "Metric Type", + "description": "The type of performance metric being reported.", + "examples": [ + "accuracy", + "f1", + "pass@1", + "mean-average-precision", + "perplexity", + "latency", + "throughput", + "elo" + ] + }, + "benchmark": { + "type": "string", + "title": "Benchmark", + "description": "The name of the benchmark or evaluation suite that produced the metric, if any.", + "examples": [ + "mmlu-pro", + "humaneval", + "imagenet-1k" + ] + }, + "measure": { + "title": "Measure", + "description": "The measured value of the performance metric with its unit.", + "$ref": "#/$defs/performanceMeasure" + }, + "slice": { + "type": "string", + "title": "Slice", + "description": "The name of the data slice on which the metric was computed, for example a demographic group, a language, or a domain. When absent, the metric applies to the entire evaluation population. Slice level metrics provide the quantitative evidence for fairness and bias risks documented with the risk model.", + "examples": [ + "overall", + "age:18-34", + "language:fr", + "region:sub-saharan-africa" + ] + }, + "confidenceInterval": { + "type": "object", + "title": "Confidence Interval", + "description": "The confidence interval of the metric.", + "additionalProperties": false, + "properties": { + "lowerBound": { + "type": "number", + "title": "Lower Bound", + "description": "The lower bound of the confidence interval." + }, + "upperBound": { + "type": "number", + "title": "Upper Bound", + "description": "The upper bound of the confidence interval." + } + } + }, + "evaluationDatasets": { + "type": "array", + "title": "Evaluation Datasets", + "description": "References to the datasets or dataset subsets used to compute this performance metric.", + "items": { + "$ref": "#/$defs/datasetChoice" + } + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the metric, such as benchmark definitions, leaderboards, or evaluation methodologies but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the metric. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + }, + "examples": [ + { + "type": "accuracy", + "benchmark": "mmlu-pro", + "measure": { + "value": 58.2, + "unit": "%" + }, + "confidenceInterval": { + "lowerBound": 57.5, + "upperBound": 58.9 + } + }, + { + "type": "latency", + "measure": { + "value": 127, + "unit": "ms" + }, + "properties": [ + { + "name": "percentile", + "value": "p95" + } + ] + }, + { + "type": "accuracy", + "benchmark": "imagenet-1k", + "slice": "top-5", + "measure": { + "value": 94.7, + "unit": "%" + } + } + ] + }, + "environmental": { + "type": "object", + "title": "Environmental Impact", + "description": "Measured environmental impacts of a model across its lifecycle activities. This object captures factual measurements. Environmental risks informed by these measurements are expressed with the risk model and reference the model component.", + "additionalProperties": false, + "properties": { + "energyConsumptions": { + "type": "array", + "title": "Energy Consumptions", + "description": "The energy consumption incurred for one or more lifecycle activities of the model.", + "items": { + "$ref": "#/$defs/energyConsumption" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for environmental impact. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "modelActivity": { + "title": "Model Activity", + "description": "An activity that is part of the development or operational lifecycle of a machine learning model. Use the custom option for activities not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Activity", + "type": "string", + "enum": [ + "design", + "data-collection", + "data-preparation", + "training", + "fine-tuning", + "validation", + "deployment", + "inference" + ], + "meta:enum": { + "design": "Model design, including problem framing, goal definition, and algorithm selection.", + "data-collection": "Model data acquisition, including search, selection, and transfer.", + "data-preparation": "Model data preparation, including data cleaning, labelling, and conversion.", + "training": "Model building, training, and generalized tuning.", + "fine-tuning": "Refining a trained model to produce desired outputs for a given problem space.", + "validation": "Model validation, including model output evaluation and testing.", + "deployment": "Model deployment to a target hosting infrastructure.", + "inference": "Generating an output response from a hosted model from a set of inputs." + } + }, + { + "type": "object", + "title": "Custom Activity", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom activity." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom activity." + } + } + } + ] + }, + "energyConsumption": { + "type": "object", + "title": "Energy Consumption", + "description": "The energy consumption incurred for a specific lifecycle activity of a model.", + "additionalProperties": false, + "required": [ + "activity", + "activityEnergyCost" + ], + "properties": { + "activity": { + "title": "Activity", + "description": "The lifecycle activity that incurred the energy consumption.", + "$ref": "#/$defs/modelActivity" + }, + "formula": { + "title": "Formula Reference", + "description": "References a formula, defined in formulation, that captures the process which incurred this energy consumption, for example a training workflow.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "energyProviders": { + "type": "array", + "title": "Energy Providers", + "description": "The providers of the energy consumed by the activity.", + "items": { + "$ref": "#/$defs/energyProvider" + } + }, + "activityEnergyCost": { + "title": "Activity Energy Cost", + "description": "The total energy cost associated with the activity.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/energyMeasure" + }, + "co2CostEquivalent": { + "title": "CO2 Equivalent Cost", + "description": "The carbon dioxide equivalent cost of the total energy cost.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/co2Measure" + }, + "co2CostOffset": { + "title": "CO2 Cost Offset", + "description": "The carbon dioxide offset credited against the carbon dioxide equivalent cost.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/co2Measure" + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the energy consumption but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the energy consumption. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "energySource": { + "title": "Energy Source", + "description": "The source of the energy provided by an energy provider. Use the custom option for sources not covered by the predefined values.", + "oneOf": [ + { + "title": "Predefined Energy Source", + "type": "string", + "enum": [ + "coal", + "oil", + "natural-gas", + "nuclear", + "wind", + "solar", + "geothermal", + "hydropower", + "biofuel", + "biomass", + "hydrogen", + "tidal", + "unknown" + ], + "meta:enum": { + "coal": "Energy produced from coal.", + "oil": "Energy produced from petroleum products, primarily crude oil and its derivative fuel oils.", + "natural-gas": "Energy produced from hydrocarbon gases, including natural gas, ethane, and propane.", + "nuclear": "Energy produced from the cores of atoms through nuclear fission or fusion.", + "wind": "Energy produced from moving air.", + "solar": "Energy produced from solar radiation.", + "geothermal": "Energy produced from heat within the earth.", + "hydropower": "Energy produced from flowing water.", + "biofuel": "Energy produced from liquid fuels derived from biomass feedstocks.", + "biomass": "Energy produced from solid organic materials such as wood, agricultural crops, or organic waste.", + "hydrogen": "Energy produced from hydrogen fuel in fuel cells or combustion.", + "tidal": "Energy produced from the rise and fall of ocean tides and tidal currents.", + "unknown": "The energy source is unknown." + } + }, + { + "type": "object", + "title": "Custom Energy Source", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the custom energy source." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom energy source." + } + } + } + ] + }, + "energyProvider": { + "type": "object", + "title": "Energy Provider", + "description": "The provider of energy consumed during model development or operations.", + "additionalProperties": false, + "required": [ + "provider", + "energySource", + "energyProvided" + ], + "properties": { + "bom-ref": { + "title": "BOM Reference", + "description": "An identifier which can be used to reference the energy provider elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the energy provider." + }, + "provider": { + "title": "Provider", + "description": "The party that provides the consumed energy, typically an organization.", + "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" + }, + "energySource": { + "title": "Energy Source", + "description": "The source of the provided energy.", + "$ref": "#/$defs/energySource" + }, + "energyProvided": { + "title": "Energy Provided", + "description": "The energy provided by the energy source for the associated activity.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/energyMeasure" + }, + "externalReferences": { + "type": "array", + "title": "External References", + "description": "External references to resources that are relevant to the energy provider but are not included with the BOM.", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, + "properties": { + "title": "Properties", + "description": "Provides the ability to document name-value pairs for the energy provider. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + } + } +} diff --git a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json deleted file mode 100644 index 3fcf23c29..000000000 --- a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json +++ /dev/null @@ -1,547 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json", - "type": "null", - "title": "CycloneDX AI Model Card", - "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", - "$defs": { - "modelCard": { - "$comment": "Model card support in CycloneDX is derived from TensorFlow Model Card Toolkit released under the Apache 2.0 license and available from https://github.com/tensorflow/model-card-toolkit/blob/main/model_card_toolkit/schema/v0.0.2/model_card.schema.json. In addition, CycloneDX model card support includes portions of VerifyML, also released under the Apache 2.0 license and available from https://github.com/cylynx/verifyml/blob/main/verifyml/model_card_toolkit/schema/v0.0.4/model_card.schema.json.", - "type": "object", - "title": "Model Card", - "description": "A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.", - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "title": "BOM Reference", - "description": "An identifier which can be used to reference the model card elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links." - }, - "modelParameters": { - "type": "object", - "title": "Model Parameters", - "description": "Hyper-parameters for construction of the model.", - "additionalProperties": false, - "properties": { - "approach": { - "type": "object", - "title": "Approach", - "description": "The overall approach to learning used by the model for problem solving.", - "additionalProperties": false, - "properties": { - "type": { - "type": "string", - "title": "Learning Type", - "description": "Learning types describing the learning problem or hybrid learning problem.", - "enum": [ - "supervised", - "unsupervised", - "reinforcement-learning", - "semi-supervised", - "self-supervised" - ], - "meta:enum": { - "supervised": "Supervised machine learning involves training an algorithm on labeled data to predict or classify new data based on the patterns learned from the labeled examples.", - "unsupervised": "Unsupervised machine learning involves training algorithms on unlabeled data to discover patterns, structures, or relationships without explicit guidance, allowing the model to identify inherent structures or clusters within the data.", - "reinforcement-learning": "Reinforcement learning is a type of machine learning where an agent learns to make decisions by interacting with an environment to maximize cumulative rewards, through trial and error.", - "semi-supervised": "Semi-supervised machine learning utilizes a combination of labeled and unlabeled data during training to improve model performance, leveraging the benefits of both supervised and unsupervised learning techniques.", - "self-supervised": "Self-supervised machine learning involves training models to predict parts of the input data from other parts of the same data, without requiring external labels, enabling learning from large amounts of unlabeled data." - } - } - } - }, - "task": { - "type": "string", - "title": "Task", - "description": "Directly influences the input and/or output. Examples include classification, regression, clustering, etc." - }, - "architectureFamily": { - "type": "string", - "title": "Architecture Family", - "description": "The model architecture family such as transformer network, convolutional neural network, residual neural network, LSTM neural network, etc." - }, - "modelArchitecture": { - "type": "string", - "title": "Model Architecture", - "description": "The specific architecture of the model such as GPT-1, ResNet-50, YOLOv3, etc." - }, - "datasets": { - "type": "array", - "title": "Datasets", - "description": "The datasets used to train and evaluate the model.", - "items" : { - "oneOf" : [ - { - "title": "Inline Data Information", - "$ref": "cyclonedx-component-2.0.schema.json#/$defs/componentData" - }, - { - "type": "object", - "title": "Data Reference", - "additionalProperties": false, - "properties": { - "ref": { - "anyOf": [ - { - "title": "Ref", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - { - "title": "BOM-Link Element", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType" - } - ], - "title": "Reference", - "type": "string", - "description": "References a data component by the components bom-ref attribute" - } - } - } - ] - } - }, - "inputs": { - "type": "array", - "title": "Inputs", - "description": "The input format(s) of the model", - "items": { "$ref": "#/$defs/inputOutputMLParameters" } - }, - "outputs": { - "type": "array", - "title": "Outputs", - "description": "The output format(s) from the model", - "items": { "$ref": "#/$defs/inputOutputMLParameters" } - } - } - }, - "quantitativeAnalysis": { - "type": "object", - "title": "Quantitative Analysis", - "description": "A quantitative analysis of the model", - "additionalProperties": false, - "properties": { - "performanceMetrics": { - "type": "array", - "title": "Performance Metrics", - "description": "The model performance metrics being reported. Examples may include accuracy, F1 score, precision, top-3 error rates, MSC, etc.", - "items": { "$ref": "#/$defs/performanceMetric" } - }, - "graphics": { "$ref": "#/$defs/graphicsCollection" } - } - }, - "considerations": { - "type": "object", - "title": "Considerations", - "description": "What considerations should be taken into account regarding the model's construction, training, and application?", - "additionalProperties": false, - "properties": { - "users": { - "type": "array", - "title": "Users", - "description": "Who are the intended users of the model?", - "items": { - "type": "string" - } - }, - "useCases": { - "type": "array", - "title": "Use Cases", - "description": "What are the intended use cases of the model?", - "items": { - "type": "string" - } - }, - "technicalLimitations": { - "type": "array", - "title": "Technical Limitations", - "description": "What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?", - "items": { - "type": "string" - } - }, - "performanceTradeoffs": { - "type": "array", - "title": "Performance Tradeoffs", - "description": "What are the known tradeoffs in accuracy/performance of the model?", - "items": { - "type": "string" - } - }, - "ethicalConsiderations": { - "type": "array", - "title": "Ethical Considerations", - "description": "What are the ethical risks involved in the application of this model?", - "items": { "$ref": "#/$defs/risk" } - }, - "environmentalConsiderations":{ - "$ref": "#/$defs/environmentalConsiderations", - "title": "Environmental Considerations", - "description": "What are the various environmental impacts the corresponding machine learning model has exhibited across its lifecycle?" - }, - "fairnessAssessments": { - "type": "array", - "title": "Fairness Assessments", - "description": "How does the model affect groups at risk of being systematically disadvantaged? What are the harms and benefits to the various affected groups?", - "items": { - "$ref": "#/$defs/fairnessAssessment" - } - } - } - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - } - }, - "inputOutputMLParameters": { - "type": "object", - "title": "Input and Output Parameters", - "additionalProperties": false, - "properties": { - "format": { - "title": "Input/Output Format", - "description": "The data format for input/output to the model.", - "type": "string", - "examples": [ "string", "image", "time-series"] - } - } - }, - "environmentalConsiderations": { - "type": "object", - "title": "Environmental Considerations", - "description": "Describes various environmental impact metrics.", - "additionalProperties": false, - "properties": { - "energyConsumptions": { - "title": "Energy Consumptions", - "description": "Describes energy consumption information incurred for one or more component lifecycle activities.", - "type": "array", - "items": { - "$ref": "#/$defs/energyConsumption" - } - }, - "properties": { - "type": "array", - "title": "Properties", - "description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/property" - } - } - } - }, - "energyConsumption": { - "title": "Energy consumption", - "description": "Describes energy consumption information incurred for the specified lifecycle activity.", - "type": "object", - "required": [ - "activity", - "energyProviders", - "activityEnergyCost" - ], - "additionalProperties": false, - "properties": { - "activity": { - "type": "string", - "title": "Activity", - "description": "The type of activity that is part of a machine learning model development or operational lifecycle.", - "enum": [ - "design", - "data-collection", - "data-preparation", - "training", - "fine-tuning", - "validation", - "deployment", - "inference", - "other" - ], - "meta:enum": { - "design": "A model design including problem framing, goal definition and algorithm selection.", - "data-collection": "Model data acquisition including search, selection and transfer.", - "data-preparation": "Model data preparation including data cleaning, labeling and conversion.", - "training": "Model building, training and generalized tuning.", - "fine-tuning": "Refining a trained model to produce desired outputs for a given problem space.", - "validation": "Model validation including model output evaluation and testing.", - "deployment": "Explicit model deployment to a target hosting infrastructure.", - "inference": "Generating an output response from a hosted model from a set of inputs.", - "other": "A lifecycle activity type whose description does not match currently defined values." - } - }, - "energyProviders": { - "title": "Energy Providers", - "description": "The provider(s) of the energy consumed by the associated model development lifecycle activity.", - "type": "array", - "items": { "$ref": "#/$defs/energyProvider" } - }, - "activityEnergyCost": { - "title": "Activity Energy Cost", - "description": "The total energy cost associated with the model lifecycle activity.", - "$ref": "#/$defs/energyMeasure" - }, - "co2CostEquivalent": { - "title": "CO2 Equivalent Cost", - "description": "The CO2 cost (debit) equivalent to the total energy cost.", - "$ref": "#/$defs/co2Measure" - }, - "co2CostOffset": { - "title": "CO2 Cost Offset", - "description": "The CO2 offset (credit) for the CO2 equivalent cost.", - "$ref": "#/$defs/co2Measure" - }, - "properties": { - "type": "array", - "title": "Properties", - "description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/property" - } - } - } - }, - "energyMeasure": { - "type": "object", - "title": "Energy Measure", - "description": "A measure of energy.", - "required": [ - "value", - "unit" - ], - "additionalProperties": false, - "properties": { - "value": { - "type": "number", - "title": "Value", - "description": "Quantity of energy." - }, - "unit": { - "type": "string", - "enum": [ "kWh" ], - "title": "Unit", - "description": "Unit of energy.", - "meta:enum": { - "kWh": "Kilowatt-hour (kWh) is the energy delivered by one kilowatt (kW) of power for one hour (h)." - } - } - } - }, - "co2Measure": { - "type": "object", - "title": "CO2 Measure", - "description": "A measure of carbon dioxide (CO2).", - "required": [ - "value", - "unit" - ], - "additionalProperties": false, - "properties": { - "value": { - "type": "number", - "title": "Value", - "description": "Quantity of carbon dioxide (CO2)." - }, - "unit": { - "type": "string", - "enum": [ "tCO2eq" ], - "title": "Unit", - "description": "Unit of carbon dioxide (CO2).", - "meta:enum": { - "tCO2eq": "Tonnes (t) of carbon dioxide (CO2) equivalent (eq)." - } - } - } - }, - "energyProvider": { - "type": "object", - "title": "Energy Provider", - "description": "Describes the physical provider of energy used for model development or operations.", - "required": [ - "organization", - "energySource", - "energyProvided" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "title": "BOM Reference", - "description": "An identifier which can be used to reference the energy provider elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "description": { - "type": "string", - "title": "Description", - "description": "A description of the energy provider." - }, - "organization": { - "type": "object", - "title": "Organization", - "description": "The organization that provides energy.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity" - }, - "energySource": { - "type": "string", - "enum": [ - "coal", - "oil", - "natural-gas", - "nuclear", - "wind", - "solar", - "geothermal", - "hydropower", - "biofuel", - "unknown", - "other" - ], - "meta:enum": { - "coal": "Energy produced by types of coal.", - "oil": "Petroleum products (primarily crude oil and its derivative fuel oils).", - "natural-gas": "Hydrocarbon gas liquids (HGL) that occur as gases at atmospheric pressure and as liquids under higher pressures including Natural gas (C5H12 and heavier), Ethane (C2H6), Propane (C3H8), etc.", - "nuclear": "Energy produced from the cores of atoms (i.e., through nuclear fission or fusion).", - "wind": "Energy produced from moving air.", - "solar": "Energy produced from the sun (i.e., solar radiation).", - "geothermal": "Energy produced from heat within the earth.", - "hydropower": "Energy produced from flowing water.", - "biofuel": "Liquid fuels produced from biomass feedstocks (i.e., organic materials such as plants or animals).", - "unknown": "The energy source is unknown.", - "other": "An energy source that is not listed." - }, - "title": "Energy Source", - "description": "The energy source for the energy provider." - }, - "energyProvided": { - "$ref": "#/$defs/energyMeasure", - "title": "Energy Provided", - "description": "The energy provided by the energy source for an associated activity." - }, - "externalReferences": { - "type": "array", - "items": {"$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference"}, - "title": "External References", - "description": "External references provide a way to document systems, sites, and information that may be relevant but are not included with the BOM. They may also establish specific relationships within or external to the BOM." - } - } - }, - "graphicsCollection": { - "type": "object", - "title": "Graphics Collection", - "description": "A collection of graphics that represent various measurements.", - "additionalProperties": false, - "properties": { - "description": { - "title": "Description", - "description": "A description of this collection of graphics.", - "type": "string" - }, - "collection": { - "title": "Collection", - "description": "A collection of graphics.", - "type": "array", - "items": { "$ref": "#/$defs/graphic" } - } - } - }, - "graphic": { - "type": "object", - "title": "Graphic", - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "description": "The name of the graphic.", - "type": "string" - }, - "image": { - "title": "Graphic Image", - "description": "The graphic (vector or raster). Base64 encoding must be specified for binary images.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment" - } - } - }, - "performanceMetric": { - "type": "object", - "title": "Performance Metric", - "additionalProperties": false, - "properties": { - "type": { - "title": "Type", - "description": "The type of performance metric.", - "type": "string" - }, - "value": { - "title": "Value", - "description": "The value of the performance metric.", - "type": "string" - }, - "slice": { - "title": "Slice", - "description": "The name of the slice this metric was computed on. By default, assume this metric is not sliced.", - "type": "string" - }, - "confidenceInterval": { - "title": "Confidence Interval", - "description": "The confidence interval of the metric.", - "type": "object", - "additionalProperties": false, - "properties": { - "lowerBound": { - "title": "Lower Bound", - "description": "The lower bound of the confidence interval.", - "type": "string" - }, - "upperBound": { - "title": "Upper Bound", - "description": "The upper bound of the confidence interval.", - "type": "string" - } - } - } - } - }, - "risk": { - "type": "object", - "title": "Risk", - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "description": "The name of the risk.", - "type": "string" - }, - "mitigationStrategy": { - "title": "Mitigation Strategy", - "description": "Strategy used to address this risk.", - "type": "string" - } - } - }, - "fairnessAssessment": { - "type": "object", - "title": "Fairness Assessment", - "description": "Information about the benefits and harms of the model to an identified at risk group.", - "additionalProperties": false, - "properties": { - "groupAtRisk": { - "type": "string", - "title": "Group at Risk", - "description": "The groups or individuals at risk of being systematically disadvantaged by the model." - }, - "benefits": { - "type": "string", - "title": "Benefits", - "description": "Expected benefits to the identified groups." - }, - "harms": { - "type": "string", - "title": "Harms", - "description": "Expected harms to the identified groups." - }, - "mitigationStrategy": { - "type": "string", - "title": "Mitigation Strategy", - "description": "With respect to the benefits and harms outlined, please describe any mitigation strategy implemented." - } - } - } - } -} \ No newline at end of file diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 71174e76e..a1d550e10 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -921,6 +921,168 @@ "$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatures", "title": "Signatures", "description": "Enveloped signatures in [JSON Signature Scheme (JSS/ITU-T X.590)](https://www.itu.int/epublications/publication/itu-t-x-590-2023-10-json-signature-scheme-jss)." + }, + "measure": { + "type": "object", + "title": "Measure", + "description": "A measurement expressed as a numeric value and a unit. Contexts that use this definition may constrain the permitted units. When the unit is omitted, the value represents a count.", + "additionalProperties": false, + "required": ["value"], + "properties": { + "value": { + "type": "number", + "title": "Value", + "description": "The numeric value of the measurement.", + "examples": [127, 0.87, 2500, 52.3] + }, + "unit": { + "type": "string", + "title": "Unit", + "description": "The unit of measure.", + "examples": ["ms", "%", "tokens/s", "GiB", "kWh", "tCO2eq"] + } + } + }, + "timeUnits": { + "title": "Time Units", + "description": "Units of time for duration and latency measurements.", + "enum": ["ns", "us", "ms", "s", "min", "h"], + "meta:enum": { + "ns": "Nanoseconds, commonly used for high precision timing measurements.", + "us": "Microseconds, commonly used for fine grained latency measurements.", + "ms": "Milliseconds, commonly used for latency measurements.", + "s": "Seconds, commonly used for latency and duration measurements.", + "min": "Minutes, commonly used for duration measurements.", + "h": "Hours, commonly used for duration measurements." + } + }, + "throughputUnits": { + "title": "Throughput Units", + "description": "Units of throughput for rate measurements.", + "enum": ["tokens/s", "requests/s", "ops/s"], + "meta:enum": { + "tokens/s": "Tokens per second, commonly used for language model throughput measurements.", + "requests/s": "Requests per second, commonly used for API and service throughput measurements.", + "ops/s": "Operations per second, commonly used for general throughput measurements." + } + }, + "computeUnits": { + "title": "Compute Units", + "description": "Units of computational work and computational rate.", + "enum": ["FLOP", "FLOPS", "GFLOPS", "TFLOPS", "PFLOPS"], + "meta:enum": { + "FLOP": "Total floating point operations, commonly used to express cumulative training compute.", + "FLOPS": "Floating point operations per second.", + "GFLOPS": "Billion floating point operations per second.", + "TFLOPS": "Trillion floating point operations per second.", + "PFLOPS": "Quadrillion floating point operations per second." + } + }, + "memoryUnits": { + "title": "Memory Units", + "description": "Units of digital information for memory and storage measurements.", + "enum": ["B", "KB", "MB", "GB", "TB", "PB", "KiB", "MiB", "GiB", "TiB", "PiB"], + "meta:enum": { + "B": "Bytes.", + "KB": "Kilobytes.", + "MB": "Megabytes.", + "GB": "Gigabytes.", + "TB": "Terabytes.", + "PB": "Petabytes.", + "KiB": "Kibibytes.", + "MiB": "Mebibytes.", + "GiB": "Gibibytes.", + "TiB": "Tebibytes.", + "PiB": "Pebibytes." + } + }, + "ratioUnits": { + "title": "Ratio Units", + "description": "Units for dimensionless ratio measurements.", + "enum": ["%", "ppm"], + "meta:enum": { + "%": "Percentage, commonly used for accuracy, precision, recall, and other ratio based metrics.", + "ppm": "Parts per million, a dimensionless unit expressing the ratio of one part per million parts." + } + }, + "energyUnits": { + "title": "Energy Units", + "description": "Units of energy.", + "enum": ["kWh"], + "meta:enum": { + "kWh": "Kilowatt hour, the energy delivered by one kilowatt of power for one hour." + } + }, + "co2Units": { + "title": "CO2 Units", + "description": "Units of carbon dioxide equivalent.", + "enum": ["tCO2eq"], + "meta:enum": { + "tCO2eq": "Tonnes of carbon dioxide equivalent." + } + }, + "energyMeasure": { + "title": "Energy Measure", + "description": "A measure of energy. The unit is constrained to a standardized energy unit for accurate comparison and reporting.", + "allOf": [ + {"$ref": "#/$defs/measure"}, + { + "required": ["unit"], + "properties": { + "unit": {"$ref": "#/$defs/energyUnits"} + } + } + ] + }, + "co2Measure": { + "title": "CO2 Measure", + "description": "A measure of carbon dioxide equivalent. The unit is constrained to a standardized unit for accurate environmental impact reporting.", + "allOf": [ + {"$ref": "#/$defs/measure"}, + { + "required": ["unit"], + "properties": { + "unit": {"$ref": "#/$defs/co2Units"} + } + } + ] + }, + "graphic": { + "type": "object", + "title": "Graphic", + "description": "A named graphic, such as a chart, plot, or diagram.", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "title": "Name", + "description": "The name of the graphic." + }, + "image": { + "title": "Graphic Image", + "description": "The graphic, which may be a vector or raster image. Base64 encoding shall be specified for binary images.", + "$ref": "#/$defs/attachment" + } + } + }, + "graphicsCollection": { + "type": "object", + "title": "Graphics Collection", + "description": "A collection of graphics that represent various measurements.", + "additionalProperties": false, + "properties": { + "description": { + "type": "string", + "title": "Description", + "description": "A description of this collection of graphics." + }, + "collection": { + "type": "array", + "title": "Collection", + "description": "A collection of graphics.", + "items": {"$ref": "#/$defs/graphic"} + } + } } } } diff --git a/schema/2.0/model/cyclonedx-component-2.0.schema.json b/schema/2.0/model/cyclonedx-component-2.0.schema.json index 15af320b6..554c4a5b3 100644 --- a/schema/2.0/model/cyclonedx-component-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-component-2.0.schema.json @@ -219,9 +219,10 @@ "title": "Release notes", "description": "Specifies release notes." }, - "modelCard": { - "$ref": "cyclonedx-ai-modelcard-2.0.schema.json#/$defs/modelCard", - "title": "AI/ML Model Card" + "modelProperties": { + "$ref": "cyclonedx-ai-ml-2.0.schema.json#/$defs/modelProperties", + "title": "AI/ML Model Properties", + "description": "Intrinsic technical characteristics of a machine learning model. This object SHOULD be specified for any component of type `machine-learning-model` and shall not be specified for other component types." }, "data": { "type": "array", @@ -769,7 +770,7 @@ "type": "string" } }, - "graphics": { "$ref": "cyclonedx-ai-modelcard-2.0.schema.json#/$defs/graphicsCollection" }, + "graphics": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/graphicsCollection" }, "description": { "title": "Dataset Description", "description": "A description of the dataset. Can describe size of dataset, whether it's used for source code, training, testing, or validation, etc.", diff --git a/schema/2.0/model/cyclonedx-definition-2.0.schema.json b/schema/2.0/model/cyclonedx-definition-2.0.schema.json index ec57179bb..a8eadc6cd 100644 --- a/schema/2.0/model/cyclonedx-definition-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-definition-2.0.schema.json @@ -11,6 +11,9 @@ "description": "A collection of reusable objects that are defined and may be used elsewhere in the BOM.", "additionalProperties": false, "properties": { + "weaknesses": { + "$ref": "cyclonedx-weakness-2.0.schema.json#/$defs/weaknesses" + }, "standards": { "$ref": "cyclonedx-standard-2.0.schema.json#/$defs/standards" }, diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index b32be1e6b..f45c666f6 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -73,6 +73,7 @@ "ethical", "societal", "human-rights", + "fairness", "health", "legal" ], @@ -92,6 +93,7 @@ "ethical": "Ethical risks, including the responsible use of automated decision-making and artificial intelligence.", "societal": "Risks to society, communities, or democratic and civic processes.", "human-rights": "Risks to fundamental human rights, including discrimination and loss of autonomy.", + "fairness": "Risks to the fair and equitable treatment of individuals and groups, as an objective that a risk may undermine or advance.", "health": "Risks to physical or mental health and wellbeing.", "legal": "Legal exposure, including liability and contractual risks." } @@ -700,7 +702,6 @@ "privacy", "operational", "strategic", - "bias", "discrimination", "fairness", "human-rights", @@ -719,9 +720,8 @@ "regulatory": "Regulatory compliance impact.", "safety": "Human safety impact.", "privacy": "Privacy violation impact.", - "operational": "Operational disruption.", + "operational": "Operational disruption, including degraded performance, reliability, or correctness of a system or its outputs.", "strategic": "Strategic business impact.", - "bias": "Systematic bias in automated outputs or decisions.", "discrimination": "Unfair treatment of individuals or groups, including on the basis of protected attributes.", "fairness": "Impact on the fair and equitable treatment of affected groups.", "human-rights": "Impact on fundamental human rights, including autonomy and dignity.", diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index edc8748c3..8d10fab88 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -329,7 +329,7 @@ }, "weaknesses": { "$ref": "cyclonedx-weakness-2.0.schema.json#/$defs/weaknesses", - "description": "The weaknesses, such as CWE classifications, that this threat exploits." + "description": "The weaknesses that this threat exploits." }, "relatedVulnerabilities": { "type": "array", diff --git a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json index eba0dafba..8b7f4d3e5 100644 --- a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json @@ -76,7 +76,7 @@ }, "weaknesses": { "$ref": "cyclonedx-weakness-2.0.schema.json#/$defs/weaknesses", - "description": "The weaknesses, such as CWE classifications, that give rise to this vulnerability." + "description": "The weaknesses that give rise to this vulnerability." }, "description": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-weakness-2.0.schema.json b/schema/2.0/model/cyclonedx-weakness-2.0.schema.json index 4fe55b31d..265c5ae0e 100644 --- a/schema/2.0/model/cyclonedx-weakness-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-weakness-2.0.schema.json @@ -12,60 +12,265 @@ "items": { "$ref": "#/$defs/weakness" }, - "description": "A collection of weaknesses, such as CWE classifications, that classify an underlying flaw." + "description": "A collection of weaknesses. Each weakness records a source of risk: a flaw, hazard, bias, or other predisposing condition of a subject or its context." }, "weakness": { + "type": "object", "title": "Weakness", - "description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description.\n The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.", - "oneOf": [ + "description": "A source of risk: a flaw, hazard, bias, or other predisposing condition of a subject or its context that, under certain circumstances, can contribute to a vulnerability, to a threat being realized, or to an adverse or beneficial outcome. A weakness records the condition itself. It may be identified in an external registry, classified by external taxonomies, or named, and at least a name or an identifier shall be provided. What the condition leads to, how likely that is, who or what is affected, and the consequences are not recorded on the weakness. They are expressed by the vulnerability, threat, or risk that references the weakness; for a risk, the consequences are recorded in its impact categories. For example, a bias in data, design, or outputs is recorded as a weakness, and the discrimination or unfair treatment it can cause is recorded in the impact categories of the risk that references it.", + "additionalProperties": false, + "anyOf": [ { - "type": "object", - "title": "CWE Weakness", - "description": "A weakness identified by its CWE identifier.", - "additionalProperties": false, "required": [ - "cweId" - ], - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "description": "An optional identifier which can be used to reference the weakness elsewhere using a bom-ref or bom-link." - }, - "cweId": { - "type": "integer", - "minimum": 1, - "title": "CWE Identifier", - "description": "The Common Weakness Enumeration (CWE) identifier that classifies this weakness." - } - } + "name" + ] }, { - "type": "object", - "title": "Named Weakness", - "description": "A weakness identified by a free-text name, used where no CWE classification applies.", - "additionalProperties": false, "required": [ - "name" - ], - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "description": "An optional identifier which can be used to reference the weakness elsewhere using a bom-ref or bom-link." - }, - "name": { + "identifiers" + ] + } + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An optional identifier which can be used to reference the weakness elsewhere using a bom-ref or bom-link." + }, + "kind": { + "title": "Kind", + "description": "The kind of source this weakness is. The kind separates a flaw in the subject, an intrinsic hazard, a systematic bias, and a circumstantial predisposing condition, so that weaknesses of one kind can be selected, for example the biases that inform the risks of a machine learning model.", + "oneOf": [ + { + "title": "Pre-Defined Kind", "type": "string", - "minLength": 1, - "title": "Name", - "description": "The name of the weakness." + "enum": [ + "flaw", + "hazard", + "bias", + "predisposing-condition" + ], + "meta:enum": { + "flaw": "An imperfection in the design, implementation, manufacture, or configuration of the subject, such as a CWE weakness or a weld imperfection. A flaw is a property of the subject that a vulnerability or threat can exploit.", + "hazard": "An intrinsic property of a material, energy source, or process that can cause harm, such as a toxic substance or a moving part. A hazard exists regardless of any flaw; the risk arises from exposure to it.", + "bias": "A systematic deviation in data, models, measurements, or human judgement that favours some outcomes or groups over others. A bias is a source of risk; its consequences, such as discrimination or unfair treatment, are recorded in the impact categories of the risk that references it.", + "predisposing-condition": "A circumstance of the subject or its context that increases the likelihood or the consequence of an adverse event without itself being a flaw, hazard, or bias, such as a single-source supplier, an obsolete part, or an unsupported dependency." + } }, - "description": { + { + "title": "Custom Kind", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "description": "The name of the custom kind." + }, + "description": { + "type": "string", + "description": "A description of the custom kind." + } + } + } + ] + }, + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "A short name for the weakness. A name is required when no identifier is given, and is recommended beside an identifier whose registry is not freely readable." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the weakness: the condition itself, where it arises in the subject or its context, and the evidence for it. Likelihood, affected parties, and consequences belong to the vulnerability, threat, or risk that references the weakness." + }, + "identifiers": { + "type": "array", + "title": "Identifiers", + "uniqueItems": true, + "minItems": 1, + "description": "Identifiers of this weakness in external registries that assign a stable identifier to each entry, such as a CWE identifier. A weakness may carry identifiers from several registries when they describe the same condition.", + "items": { + "$ref": "#/$defs/weaknessIdentifier" + } + }, + "categories": { + "type": "array", + "title": "Categories", + "uniqueItems": true, + "description": "Classifications of this weakness in taxonomies that name categories without assigning identifiers to entries, such as the NIST SP 1270 categories of bias. Categories complement identifiers; a weakness identified in one registry may also be classified by several taxonomies.", + "items": { + "$ref": "#/$defs/weaknessCategory" + } + } + } + }, + "weaknessIdentifier": { + "type": "object", + "title": "Weakness Identifier", + "description": "An identifier of a weakness in an external registry, given by the scheme of the registry and the value the registry assigns.", + "required": [ + "scheme", + "value" + ], + "additionalProperties": false, + "properties": { + "scheme": { + "title": "Scheme", + "description": "The registry that assigns the identifier.", + "oneOf": [ + { + "title": "Pre-Defined Scheme", "type": "string", - "title": "Description", - "description": "A description of the weakness." + "enum": [ + "cwe", + "imdrf-aet", + "hfacs", + "sot", + "ghs", + "iso-6520", + "iso-iec-24772" + ], + "meta:enum": { + "cwe": "Identifiers of the [Common Weakness Enumeration](https://cwe.mitre.org/), a community-developed list of software, hardware, and service weakness types.", + "imdrf-aet": "Investigation conclusion codes of Annex D of the [IMDRF Adverse Event Terminology](https://www.imdrf.org/documents/terminologies-categorized-adverse-event-reporting-aer-terms-terminology-and-codes), which classify the root cause of a medical device adverse event.", + "hfacs": "Codes of the [Department of Defense Human Factors Analysis and Classification System](https://navalsafetycommand.navy.mil/portals/100/documents/HF-Enc2-HFACS.pdf), which classify the human and organizational conditions that contribute to mishaps.", + "sot": "Risk category and risk factor identifiers of the [MITRE System of Trust](https://sot.mitre.org/), which classify conditions of suppliers, supplies, and services that affect supply chain risk.", + "ghs": "Hazard statement codes of the [Globally Harmonized System of Classification and Labelling of Chemicals](https://unece.org/about-ghs), which identify the physical, health, and environmental hazards of a substance or mixture.", + "iso-6520": "Reference numbers of [ISO 6520-1](https://www.iso.org/standard/40229.html), which classify geometric imperfections in fusion-welded metallic materials.", + "iso-iec-24772": "Vulnerability codes of [ISO/IEC 24772-1](https://www.iso.org/standard/83629.html), a language-independent catalogue of programming language vulnerabilities." + } + }, + { + "title": "Custom Scheme", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "description": "The name of the custom scheme." + }, + "description": { + "type": "string", + "description": "A description of the custom scheme." + }, + "url": { + "type": "string", + "format": "iri-reference", + "description": "URL of the scheme registry or specification." + } + } + } + ] + }, + "schemeVersion": { + "type": "string", + "minLength": 1, + "title": "Scheme Version", + "description": "The version or edition of the registry that issued the identifier, for example 4.20 for CWE or 8.0 for HFACS." + }, + "value": { + "type": "string", + "minLength": 1, + "title": "Value", + "description": "The identifier value as issued by the registry, for example CWE-502." + } + }, + "allOf": [ + { + "if": { + "properties": { + "scheme": { + "const": "cwe" + } + }, + "required": [ + "scheme" + ] + }, + "then": { + "properties": { + "value": { + "pattern": "^CWE-[1-9][0-9]*$" + } } } } ] + }, + "weaknessCategory": { + "type": "object", + "title": "Weakness Category", + "description": "A classification of a weakness within a taxonomy, given by the taxonomy and the category named or numbered within it.", + "required": [ + "taxonomy", + "category" + ], + "additionalProperties": false, + "properties": { + "taxonomy": { + "title": "Taxonomy", + "description": "The taxonomy that the category is drawn from.", + "oneOf": [ + { + "title": "Pre-Defined Taxonomy", + "type": "string", + "enum": [ + "nist-sp-1270", + "iso-iec-tr-24027", + "orx-cause", + "hfacs", + "nist-sp-800-30" + ], + "meta:enum": { + "nist-sp-1270": "Categories of bias in artificial intelligence defined by [NIST SP 1270](https://doi.org/10.6028/NIST.SP.1270).", + "iso-iec-tr-24027": "Sources of unwanted bias in AI systems and AI-aided decision making defined by [ISO/IEC TR 24027](https://www.iso.org/standard/77607.html).", + "orx-cause": "Cause categories of the [ORX Reference Taxonomy](https://orx.org/operational-risk-reference-taxonomy) for operational and non-financial risk.", + "hfacs": "Causal levels of the [Human Factors Analysis and Classification System](https://www.faa.gov/sites/faa.gov/files/data_research/research/med_humanfacs/oamtechreports/00_07.pdf).", + "nist-sp-800-30": "Types of predisposing condition defined by [NIST SP 800-30 Revision 1](https://doi.org/10.6028/NIST.SP.800-30r1)." + } + }, + { + "title": "Custom Taxonomy", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "description": "The name of the custom taxonomy." + }, + "description": { + "type": "string", + "description": "A description of the custom taxonomy." + }, + "url": { + "type": "string", + "format": "iri-reference", + "description": "URL of the taxonomy specification." + } + } + } + ] + }, + "category": { + "type": "string", + "minLength": 1, + "title": "Category", + "description": "The category within the taxonomy, as named or numbered by the taxonomy." + } + } } } } diff --git a/tools/src/test/resources/2.0/invalid-ai-ml-energy-unit-2.0.json b/tools/src/test/resources/2.0/invalid-ai-ml-energy-unit-2.0.json new file mode 100644 index 000000000..8420b130d --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-ai-ml-energy-unit-2.0.json @@ -0,0 +1,252 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:8b41cf82-52e6-46d5-9f45-e6c2ab4bf003", + "version": 1, + "metadata": { + "timestamp": "2026-08-13T12:00:00Z" + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "model-1", + "name": "acme-summarizer", + "version": "2.1.0", + "description": "A transformer language model fine-tuned for clinical note summarization.", + "parties": [ + { + "bom-ref": "party-acme", + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Acme Health AI" + } + }, + { + "bom-ref": "party-clinicians", + "roles": [ + { + "role": "end-user" + } + ], + "persona": { + "description": "Clinicians who review generated summaries before entering them into patient records." + } + } + ], + "modelProperties": { + "learningTypes": [ + "self-supervised", + "reinforcement-learning" + ], + "tasks": [ + "summarization", + "text-generation" + ], + "architecture": { + "name": "acme-lm-7b", + "description": "Decoder-only transformer with grouped-query attention and rotary positional embeddings.", + "family": "transformer", + "features": [ + "decoder-only", + "grouped-query-attention", + "rotary-position-embedding", + { + "name": "clinical-adapter", + "description": "Domain adapter layers trained on de-identified clinical text." + } + ], + "topology": "dense" + }, + "parameterCount": 7000000000, + "quantization": { + "method": "k-quant", + "bits": 4, + "scheme": "affine", + "granularity": "per-group", + "groupSize": 128, + "axis": 0 + }, + "inputs": [ + { + "name": "prompt", + "description": "The clinical note to summarize.", + "modality": "text", + "dataType": "string", + "processingStage": "pre-tokenizer", + "required": true, + "constraints": { + "maxLength": 32768 + } + }, + { + "name": "image", + "description": "An optional scanned document page.", + "modality": "image", + "dataType": "uint8", + "mimeType": "image/png", + "quantization": { + "scheme": "affine", + "granularity": "per-tensor", + "bits": 8 + }, + "shape": [ + null, + 3, + 224, + 224 + ] + } + ], + "outputs": [ + { + "name": "summary", + "modality": "text", + "dataType": "string", + "processingStage": "post-processing" + } + ], + "training": { + "formula": "formula-training-1", + "datasets": [ + "dataset-corpus-1", + "urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#openwebtext-subset" + ] + }, + "evaluation": { + "metrics": [ + { + "type": "accuracy", + "benchmark": "mmlu-pro", + "measure": { + "value": 58.2, + "unit": "%" + }, + "confidenceInterval": { + "lowerBound": 57.5, + "upperBound": 58.9 + } + }, + { + "type": "rouge-l", + "slice": "language:es", + "measure": { + "value": 41.3, + "unit": "%" + }, + "evaluationDatasets": [ + "dataset-corpus-1" + ] + }, + { + "type": "latency", + "measure": { + "value": 127, + "unit": "ms" + }, + "properties": [ + { + "name": "percentile", + "value": "p95" + } + ] + } + ], + "graphics": { + "description": "Evaluation graphics.", + "collection": [ + { + "name": "Confusion Matrix", + "image": { + "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==", + "mediaType": "image/png", + "encoding": "base64" + } + } + ] + } + }, + "limitations": [ + "Summarization accuracy degrades on notes longer than the maximum context length.", + "The model is not intended for autonomous clinical decision making." + ], + "environmental": { + "energyConsumptions": [ + { + "activity": "training", + "formula": "formula-training-1", + "energyProviders": [ + { + "bom-ref": "energy-provider-1", + "description": "Primary datacenter energy provider.", + "provider": { + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Example Energy Cooperative" + } + }, + "energySource": "wind", + "energyProvided": { + "value": 3200000, + "unit": "kWh" + } + } + ], + "activityEnergyCost": { + "value": 3200, + "unit": "MWh" + }, + "co2CostEquivalent": { + "value": 850, + "unit": "tCO2eq" + }, + "co2CostOffset": { + "value": 850, + "unit": "tCO2eq" + } + }, + { + "activity": { + "name": "retrieval-indexing", + "description": "Nightly re-indexing of the retrieval corpus." + }, + "activityEnergyCost": { + "value": 1200, + "unit": "kWh" + } + } + ] + }, + "properties": [ + { + "name": "cdx:ai-ml:model:contextWindow", + "value": "32768" + } + ] + } + }, + { + "type": "data", + "bom-ref": "dataset-corpus-1", + "name": "deidentified-clinical-notes", + "version": "2026-04", + "data": [ + { + "type": "dataset", + "bom-ref": "dataset-corpus-1-contents", + "name": "De-identified clinical notes", + "description": "Corpus of de-identified clinical notes used for fine-tuning.", + "classification": "restricted" + } + ] + } + ] +} diff --git a/tools/src/test/resources/2.0/invalid-ai-ml-legacy-modelcard-2.0.json b/tools/src/test/resources/2.0/invalid-ai-ml-legacy-modelcard-2.0.json new file mode 100644 index 000000000..e187b6778 --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-ai-ml-legacy-modelcard-2.0.json @@ -0,0 +1,49 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:8b41cf82-52e6-46d5-9f45-e6c2ab4bf002", + "version": 1, + "metadata": { + "timestamp": "2026-08-13T12:00:00Z" + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "model-1", + "name": "acme-summarizer", + "version": "2.1.0", + "description": "A transformer language model fine-tuned for clinical note summarization.", + "parties": [ + { + "bom-ref": "party-acme", + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Acme Health AI" + } + }, + { + "bom-ref": "party-clinicians", + "roles": [ + { + "role": "end-user" + } + ], + "persona": { + "description": "Clinicians who review generated summaries before entering them into patient records." + } + } + ], + "modelCard": { + "bom-ref": "modelcard-1", + "modelParameters": { + "task": "summarization" + } + } + } + ] +} diff --git a/tools/src/test/resources/2.0/invalid-ai-ml-task-casing-2.0.json b/tools/src/test/resources/2.0/invalid-ai-ml-task-casing-2.0.json new file mode 100644 index 000000000..76392cb0f --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-ai-ml-task-casing-2.0.json @@ -0,0 +1,251 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:8b41cf82-52e6-46d5-9f45-e6c2ab4bf004", + "version": 1, + "metadata": { + "timestamp": "2026-08-13T12:00:00Z" + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "model-1", + "name": "acme-summarizer", + "version": "2.1.0", + "description": "A transformer language model fine-tuned for clinical note summarization.", + "parties": [ + { + "bom-ref": "party-acme", + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Acme Health AI" + } + }, + { + "bom-ref": "party-clinicians", + "roles": [ + { + "role": "end-user" + } + ], + "persona": { + "description": "Clinicians who review generated summaries before entering them into patient records." + } + } + ], + "modelProperties": { + "learningTypes": [ + "self-supervised", + "reinforcement-learning" + ], + "tasks": [ + "Summarization" + ], + "architecture": { + "name": "acme-lm-7b", + "description": "Decoder-only transformer with grouped-query attention and rotary positional embeddings.", + "family": "transformer", + "features": [ + "decoder-only", + "grouped-query-attention", + "rotary-position-embedding", + { + "name": "clinical-adapter", + "description": "Domain adapter layers trained on de-identified clinical text." + } + ], + "topology": "dense" + }, + "parameterCount": 7000000000, + "quantization": { + "method": "k-quant", + "bits": 4, + "scheme": "affine", + "granularity": "per-group", + "groupSize": 128, + "axis": 0 + }, + "inputs": [ + { + "name": "prompt", + "description": "The clinical note to summarize.", + "modality": "text", + "dataType": "string", + "processingStage": "pre-tokenizer", + "required": true, + "constraints": { + "maxLength": 32768 + } + }, + { + "name": "image", + "description": "An optional scanned document page.", + "modality": "image", + "dataType": "uint8", + "mimeType": "image/png", + "quantization": { + "scheme": "affine", + "granularity": "per-tensor", + "bits": 8 + }, + "shape": [ + null, + 3, + 224, + 224 + ] + } + ], + "outputs": [ + { + "name": "summary", + "modality": "text", + "dataType": "string", + "processingStage": "post-processing" + } + ], + "training": { + "formula": "formula-training-1", + "datasets": [ + "dataset-corpus-1", + "urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#openwebtext-subset" + ] + }, + "evaluation": { + "metrics": [ + { + "type": "accuracy", + "benchmark": "mmlu-pro", + "measure": { + "value": 58.2, + "unit": "%" + }, + "confidenceInterval": { + "lowerBound": 57.5, + "upperBound": 58.9 + } + }, + { + "type": "rouge-l", + "slice": "language:es", + "measure": { + "value": 41.3, + "unit": "%" + }, + "evaluationDatasets": [ + "dataset-corpus-1" + ] + }, + { + "type": "latency", + "measure": { + "value": 127, + "unit": "ms" + }, + "properties": [ + { + "name": "percentile", + "value": "p95" + } + ] + } + ], + "graphics": { + "description": "Evaluation graphics.", + "collection": [ + { + "name": "Confusion Matrix", + "image": { + "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==", + "mediaType": "image/png", + "encoding": "base64" + } + } + ] + } + }, + "limitations": [ + "Summarization accuracy degrades on notes longer than the maximum context length.", + "The model is not intended for autonomous clinical decision making." + ], + "environmental": { + "energyConsumptions": [ + { + "activity": "training", + "formula": "formula-training-1", + "energyProviders": [ + { + "bom-ref": "energy-provider-1", + "description": "Primary datacenter energy provider.", + "provider": { + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Example Energy Cooperative" + } + }, + "energySource": "wind", + "energyProvided": { + "value": 3200000, + "unit": "kWh" + } + } + ], + "activityEnergyCost": { + "value": 3200000, + "unit": "kWh" + }, + "co2CostEquivalent": { + "value": 850, + "unit": "tCO2eq" + }, + "co2CostOffset": { + "value": 850, + "unit": "tCO2eq" + } + }, + { + "activity": { + "name": "retrieval-indexing", + "description": "Nightly re-indexing of the retrieval corpus." + }, + "activityEnergyCost": { + "value": 1200, + "unit": "kWh" + } + } + ] + }, + "properties": [ + { + "name": "cdx:ai-ml:model:contextWindow", + "value": "32768" + } + ] + } + }, + { + "type": "data", + "bom-ref": "dataset-corpus-1", + "name": "deidentified-clinical-notes", + "version": "2026-04", + "data": [ + { + "type": "dataset", + "bom-ref": "dataset-corpus-1-contents", + "name": "De-identified clinical notes", + "description": "Corpus of de-identified clinical notes used for fine-tuning.", + "classification": "restricted" + } + ] + } + ] +} diff --git a/tools/src/test/resources/2.0/invalid-risk-impact-category-bias-2.0.json b/tools/src/test/resources/2.0/invalid-risk-impact-category-bias-2.0.json new file mode 100644 index 000000000..ef7429acb --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-risk-impact-category-bias-2.0.json @@ -0,0 +1,22 @@ +{ + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:3f2504e0-4f89-41d3-9a0c-0305e82c3301", + "version": 1, + "risks": { + "risks": [ + { + "bom-ref": "risk-model-bias", + "name": "Disparate loan approval rates", + "statement": "The credit model may approve loans at materially different rates across demographic groups.", + "inherentRisk": { + "impact": { + "level": "major", + "polarity": "harm", + "categories": [ "bias" ] + } + } + } + ] + } +} diff --git a/tools/src/test/resources/2.0/invalid-vulnerability-weakness-cwe-and-name-2.0.json b/tools/src/test/resources/2.0/invalid-vulnerability-weakness-cwe-and-name-2.0.json deleted file mode 100644 index b003de717..000000000 --- a/tools/src/test/resources/2.0/invalid-vulnerability-weakness-cwe-and-name-2.0.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "specFormat": "CycloneDX", - "specVersion": "2.0", - "vulnerabilities": [ - { - "bom-ref": "vuln-1", - "id": "CVE-2000-0000", - "weaknesses": [ - { - "bom-ref": "wk-bad", - "cweId": 502, - "name": "Deserialization of Untrusted Data" - } - ] - } - ] -} diff --git a/tools/src/test/resources/2.0/invalid-weakness-cwe-value-format-2.0.json b/tools/src/test/resources/2.0/invalid-weakness-cwe-value-format-2.0.json new file mode 100644 index 000000000..9656e103e --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-weakness-cwe-value-format-2.0.json @@ -0,0 +1,17 @@ +{ + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:7c1f3b2e-9a4d-4c6e-8b1a-2f5d6e7a8b93", + "version": 1, + "definitions": { + "weaknesses": [ + { + "bom-ref": "weakness-bare-number", + "kind": "flaw", + "identifiers": [ + { "scheme": "cwe", "value": "502" } + ] + } + ] + } +} diff --git a/tools/src/test/resources/2.0/invalid-weakness-identifier-missing-value-2.0.json b/tools/src/test/resources/2.0/invalid-weakness-identifier-missing-value-2.0.json new file mode 100644 index 000000000..b0c2feb80 --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-weakness-identifier-missing-value-2.0.json @@ -0,0 +1,17 @@ +{ + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:7c1f3b2e-9a4d-4c6e-8b1a-2f5d6e7a8b92", + "version": 1, + "definitions": { + "weaknesses": [ + { + "bom-ref": "weakness-no-value", + "kind": "flaw", + "identifiers": [ + { "scheme": "cwe" } + ] + } + ] + } +} diff --git a/tools/src/test/resources/2.0/invalid-weakness-missing-name-and-identifiers-2.0.json b/tools/src/test/resources/2.0/invalid-weakness-missing-name-and-identifiers-2.0.json new file mode 100644 index 000000000..4ee41be3b --- /dev/null +++ b/tools/src/test/resources/2.0/invalid-weakness-missing-name-and-identifiers-2.0.json @@ -0,0 +1,15 @@ +{ + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:7c1f3b2e-9a4d-4c6e-8b1a-2f5d6e7a8b91", + "version": 1, + "definitions": { + "weaknesses": [ + { + "bom-ref": "weakness-anonymous", + "kind": "bias", + "description": "A weakness with neither a name nor an identifier." + } + ] + } +} diff --git a/tools/src/test/resources/2.0/valid-ai-ml-model-2.0.json b/tools/src/test/resources/2.0/valid-ai-ml-model-2.0.json new file mode 100644 index 000000000..b2cc65efe --- /dev/null +++ b/tools/src/test/resources/2.0/valid-ai-ml-model-2.0.json @@ -0,0 +1,410 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:8b41cf82-52e6-46d5-9f45-e6c2ab4bf001", + "version": 1, + "metadata": { + "timestamp": "2026-08-13T12:00:00Z" + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "model-1", + "name": "acme-summarizer", + "version": "2.1.0", + "description": "A transformer language model fine-tuned for clinical note summarization.", + "tags": [ + "nlp", + "summarization", + "clinical" + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "hashes": [ + { + "alg": "SHA-256", + "content": "d2f61af223cf5d5db54a0e2ac4bbf29b06b5cf16983ae1e0e0e9c2536b1a5b19" + } + ], + "identifiers": [ + { + "party": "party-acme", + "identities": [ + { + "scheme": "purl", + "value": "pkg:generic/acme/acme-summarizer@2.1.0" + }, + { + "scheme": "model-number", + "value": "ACME-SUM-7B-INT4" + } + ] + } + ], + "parties": [ + { + "bom-ref": "party-acme", + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Acme Health AI" + } + }, + { + "bom-ref": "party-clinicians", + "roles": [ + { + "role": "end-user" + } + ], + "persona": { + "description": "Clinicians who review generated summaries before entering them into patient records." + } + } + ], + "modelProperties": { + "learningTypes": [ + "self-supervised", + "reinforcement-learning" + ], + "tasks": [ + "summarization", + "text-generation" + ], + "architecture": { + "name": "acme-lm-7b", + "description": "Decoder-only transformer with grouped-query attention and rotary positional embeddings.", + "family": "transformer", + "features": [ + "decoder-only", + "grouped-query-attention", + "rotary-position-embedding", + { + "name": "clinical-adapter", + "description": "Domain adapter layers trained on de-identified clinical text." + } + ], + "topology": "dense" + }, + "parameterCount": 7000000000, + "quantization": { + "method": "k-quant", + "bits": 4, + "scheme": "affine", + "granularity": "per-group", + "groupSize": 128, + "axis": 0 + }, + "inputs": [ + { + "name": "prompt", + "description": "The clinical note to summarize.", + "modality": "text", + "dataType": "string", + "processingStage": "pre-tokenizer", + "required": true, + "constraints": { + "maxLength": 32768 + } + }, + { + "name": "image", + "description": "An optional scanned document page.", + "modality": "image", + "dataType": "uint8", + "mimeType": "image/png", + "quantization": { + "scheme": "affine", + "granularity": "per-tensor", + "bits": 8 + }, + "shape": [ + null, + 3, + 224, + 224 + ] + } + ], + "outputs": [ + { + "name": "summary", + "modality": "text", + "dataType": "string", + "processingStage": "post-processing" + } + ], + "training": { + "formula": "formula-training-1", + "datasets": [ + "dataset-corpus-1", + "urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#openwebtext-subset" + ] + }, + "evaluation": { + "metrics": [ + { + "type": "accuracy", + "benchmark": "mmlu-pro", + "measure": { + "value": 58.2, + "unit": "%" + }, + "confidenceInterval": { + "lowerBound": 57.5, + "upperBound": 58.9 + } + }, + { + "type": "rouge-l", + "slice": "language:es", + "measure": { + "value": 41.3, + "unit": "%" + }, + "evaluationDatasets": [ + "dataset-corpus-1" + ] + }, + { + "type": "latency", + "measure": { + "value": 127, + "unit": "ms" + }, + "properties": [ + { + "name": "percentile", + "value": "p95" + } + ] + } + ], + "graphics": { + "description": "Evaluation graphics.", + "collection": [ + { + "name": "Confusion Matrix", + "image": { + "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==", + "mediaType": "image/png", + "encoding": "base64" + } + } + ] + } + }, + "limitations": [ + "Summarization accuracy degrades on notes longer than the maximum context length.", + "The model is not intended for autonomous clinical decision making." + ], + "environmental": { + "energyConsumptions": [ + { + "activity": "training", + "formula": "formula-training-1", + "energyProviders": [ + { + "bom-ref": "energy-provider-1", + "description": "Primary datacenter energy provider.", + "provider": { + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Example Energy Cooperative" + } + }, + "energySource": "wind", + "energyProvided": { + "value": 3200000, + "unit": "kWh" + } + } + ], + "activityEnergyCost": { + "value": 3200000, + "unit": "kWh" + }, + "co2CostEquivalent": { + "value": 850, + "unit": "tCO2eq" + }, + "co2CostOffset": { + "value": 850, + "unit": "tCO2eq" + } + }, + { + "activity": { + "name": "retrieval-indexing", + "description": "Nightly re-indexing of the retrieval corpus." + }, + "activityEnergyCost": { + "value": 1200, + "unit": "kWh" + } + } + ] + }, + "properties": [ + { + "name": "cdx:ai-ml:model:contextWindow", + "value": "32768" + } + ] + } + }, + { + "type": "data", + "bom-ref": "dataset-corpus-1", + "name": "deidentified-clinical-notes", + "version": "2026-04", + "data": [ + { + "type": "dataset", + "bom-ref": "dataset-corpus-1-contents", + "name": "De-identified clinical notes", + "description": "Corpus of de-identified clinical notes used for fine-tuning.", + "classification": "restricted" + } + ] + } + ], + "formulation": [ + { + "bom-ref": "formula-training-1", + "workflows": [ + { + "bom-ref": "workflow-pretrain-1", + "uid": "workflow-pretrain-1", + "name": "Pre-training and fine-tuning", + "taskTypes": [ + "build" + ] + } + ] + } + ], + "perspectives": [ + { + "bom-ref": "perspective-model-card", + "name": "Model Card", + "description": "The model card view of this BOM. Mappings project the component identity, licensing, and party information together with the technical model properties, training, evaluation, limitations, and environmental measurements, using section names familiar to AI transparency audiences.", + "domains": [ + "machine-learning", + "transparency" + ], + "mappings": [ + { + "expression": "$.components[?(@.type=='machine-learning-model')]['name','version','description','tags']", + "nativeName": "Model Details", + "nativeDescription": "The identity of the model: its name, version, and a description of what it is and does.", + "relevance": "required", + "weight": 1.0 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].parties[?(@.roles[?(@.role=='supplier')])]", + "nativeName": "Developed By", + "nativeDescription": "The parties that develop and supply the model.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].parties[?(@.roles[?(@.role=='end-user')])]", + "nativeName": "Intended Users", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].licenses", + "nativeName": "License", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].identifiers", + "nativeName": "Model Identifiers", + "nativeDescription": "Asserted identities of the model, such as package URLs and model numbers.", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].hashes", + "nativeName": "Artifact Integrity", + "nativeDescription": "Cryptographic hashes of the distributed model artifact.", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.tasks", + "nativeName": "Supported Tasks", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.learningTypes", + "nativeName": "Learning Paradigms", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.architecture", + "nativeName": "Architecture", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.parameterCount", + "nativeName": "Parameter Count", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.quantization", + "nativeName": "Quantization", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties['inputs','outputs']", + "nativeName": "Input and Output Specification", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.training", + "nativeName": "Training Data", + "relevance": "recommended", + "weight": 0.9 + }, + { + "expression": "$.formulation[?(@['bom-ref']=='formula-training-1')]", + "nativeName": "Training Procedure", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.evaluation", + "nativeName": "Evaluation Results", + "relevance": "recommended", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.limitations", + "nativeName": "Known Limitations", + "nativeDescription": "Documented constraints on accuracy, reasoning, scalability, and appropriate use.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.environmental", + "nativeName": "Environmental Impact", + "relevance": "recommended" + } + ] + } + ] +} diff --git a/tools/src/test/resources/2.0/valid-ai-ml-risk-integration-2.0.json b/tools/src/test/resources/2.0/valid-ai-ml-risk-integration-2.0.json new file mode 100644 index 000000000..27b35b436 --- /dev/null +++ b/tools/src/test/resources/2.0/valid-ai-ml-risk-integration-2.0.json @@ -0,0 +1,555 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:8b41cf82-52e6-46d5-9f45-e6c2ab4bf005", + "version": 1, + "metadata": { + "timestamp": "2026-08-13T12:00:00Z" + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "model-1", + "name": "acme-summarizer", + "version": "2.1.0", + "description": "A transformer language model fine-tuned for clinical note summarization.", + "tags": [ + "nlp", + "summarization", + "clinical" + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "hashes": [ + { + "alg": "SHA-256", + "content": "d2f61af223cf5d5db54a0e2ac4bbf29b06b5cf16983ae1e0e0e9c2536b1a5b19" + } + ], + "identifiers": [ + { + "party": "party-acme", + "identities": [ + { + "scheme": "purl", + "value": "pkg:generic/acme/acme-summarizer@2.1.0" + }, + { + "scheme": "model-number", + "value": "ACME-SUM-7B-INT4" + } + ] + } + ], + "parties": [ + { + "bom-ref": "party-acme", + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Acme Health AI" + } + }, + { + "bom-ref": "party-clinicians", + "roles": [ + { + "role": "end-user" + } + ], + "persona": { + "description": "Clinicians who review generated summaries before entering them into patient records." + } + }, + { + "bom-ref": "party-elderly-users", + "roles": [ + { + "role": "data-subject" + } + ], + "persona": { + "description": "Patients aged 65 and over whose notes exhibit distinct terminology and comorbidity patterns." + } + } + ], + "modelProperties": { + "learningTypes": [ + "self-supervised", + "reinforcement-learning" + ], + "tasks": [ + "summarization", + "text-generation" + ], + "architecture": { + "name": "acme-lm-7b", + "description": "Decoder-only transformer with grouped-query attention and rotary positional embeddings.", + "family": "transformer", + "features": [ + "decoder-only", + "grouped-query-attention", + "rotary-position-embedding", + { + "name": "clinical-adapter", + "description": "Domain adapter layers trained on de-identified clinical text." + } + ], + "topology": "dense" + }, + "parameterCount": 7000000000, + "quantization": { + "method": "k-quant", + "bits": 4, + "scheme": "affine", + "granularity": "per-group", + "groupSize": 128, + "axis": 0 + }, + "inputs": [ + { + "name": "prompt", + "description": "The clinical note to summarize.", + "modality": "text", + "dataType": "string", + "processingStage": "pre-tokenizer", + "required": true, + "constraints": { + "maxLength": 32768 + } + }, + { + "name": "image", + "description": "An optional scanned document page.", + "modality": "image", + "dataType": "uint8", + "mimeType": "image/png", + "quantization": { + "scheme": "affine", + "granularity": "per-tensor", + "bits": 8 + }, + "shape": [ + null, + 3, + 224, + 224 + ] + } + ], + "outputs": [ + { + "name": "summary", + "modality": "text", + "dataType": "string", + "processingStage": "post-processing" + } + ], + "training": { + "formula": "formula-training-1", + "datasets": [ + "dataset-corpus-1", + "urn:cdx:f08a6ccd-4dce-4759-bd84-c626675d60a7/1#openwebtext-subset" + ] + }, + "evaluation": { + "metrics": [ + { + "type": "accuracy", + "benchmark": "mmlu-pro", + "measure": { + "value": 58.2, + "unit": "%" + }, + "confidenceInterval": { + "lowerBound": 57.5, + "upperBound": 58.9 + } + }, + { + "type": "rouge-l", + "slice": "language:es", + "measure": { + "value": 41.3, + "unit": "%" + }, + "evaluationDatasets": [ + "dataset-corpus-1" + ] + }, + { + "type": "latency", + "measure": { + "value": 127, + "unit": "ms" + }, + "properties": [ + { + "name": "percentile", + "value": "p95" + } + ] + } + ], + "graphics": { + "description": "Evaluation graphics.", + "collection": [ + { + "name": "Confusion Matrix", + "image": { + "content": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==", + "mediaType": "image/png", + "encoding": "base64" + } + } + ] + } + }, + "limitations": [ + "Summarization accuracy degrades on notes longer than the maximum context length.", + "The model is not intended for autonomous clinical decision making." + ], + "environmental": { + "energyConsumptions": [ + { + "activity": "training", + "formula": "formula-training-1", + "energyProviders": [ + { + "bom-ref": "energy-provider-1", + "description": "Primary datacenter energy provider.", + "provider": { + "roles": [ + { + "role": "supplier" + } + ], + "organization": { + "name": "Example Energy Cooperative" + } + }, + "energySource": "wind", + "energyProvided": { + "value": 3200000, + "unit": "kWh" + } + } + ], + "activityEnergyCost": { + "value": 3200000, + "unit": "kWh" + }, + "co2CostEquivalent": { + "value": 850, + "unit": "tCO2eq" + }, + "co2CostOffset": { + "value": 850, + "unit": "tCO2eq" + } + }, + { + "activity": { + "name": "retrieval-indexing", + "description": "Nightly re-indexing of the retrieval corpus." + }, + "activityEnergyCost": { + "value": 1200, + "unit": "kWh" + } + } + ] + }, + "properties": [ + { + "name": "cdx:ai-ml:model:contextWindow", + "value": "32768" + } + ], + "useCases": [ + "usecase-clinical-summarization" + ] + } + }, + { + "type": "data", + "bom-ref": "dataset-corpus-1", + "name": "deidentified-clinical-notes", + "version": "2026-04", + "data": [ + { + "type": "dataset", + "bom-ref": "dataset-corpus-1-contents", + "name": "De-identified clinical notes", + "description": "Corpus of de-identified clinical notes used for fine-tuning.", + "classification": "restricted" + } + ] + } + ], + "definitions": { + "useCases": [ + { + "bom-ref": "usecase-clinical-summarization", + "name": "Clinical note summarization", + "description": "Summarize clinical notes for clinician review prior to entry into the patient record.", + "actors": [ + "party-clinicians" + ] + } + ], + "weaknesses": [ + { + "bom-ref": "weakness-age-representation", + "kind": "bias", + "name": "Representation bias in training data", + "description": "Notes describing patients aged 65 and over are under-represented in the training corpus.", + "identifiers": [ + { + "scheme": { + "name": "avid", + "url": "https://avidml.org/taxonomy/" + }, + "value": "E0101" + } + ], + "categories": [ + { + "taxonomy": "nist-sp-1270", + "category": "statistical-computational" + } + ] + } + ] + }, + "risks": { + "risks": [ + { + "bom-ref": "risk-demographic-disparity", + "name": "Demographic performance disparity", + "statement": "Summarization accuracy is lower for notes describing patients aged 65 and over, which may lead to incomplete summaries for that group.", + "domains": [ + { + "type": "ethical" + }, + { + "type": "safety" + } + ], + "affects": [ + "model-1", + "party-elderly-users" + ], + "relatedWeaknesses": [ + "weakness-age-representation" + ], + "inherentRisk": { + "likelihood": { + "level": "high" + }, + "impact": { + "level": "major", + "polarity": "harm", + "categories": [ + "fairness", + "health" + ] + }, + "rationale": "Slice level evaluation shows a nine point accuracy gap for the affected group." + }, + "residualRisk": { + "likelihood": { + "level": "low" + }, + "impact": { + "level": "moderate", + "polarity": "harm", + "categories": [ + "fairness" + ] + } + }, + "responses": [ + { + "bom-ref": "response-reweighting", + "strategy": "reduce", + "description": "Oversample under-represented age groups during fine-tuning and gate releases on slice level evaluation." + } + ] + } + ], + "assessments": [ + { + "bom-ref": "assessment-ai-impact-2026q3", + "type": [ + "ai-impact", + "model-risk" + ], + "cadence": "periodic", + "timestamp": "2026-08-01T00:00:00Z", + "assessors": [ + { + "roles": [ + { + "role": "verifier" + } + ], + "organization": { + "name": "Acme Responsible AI Board" + } + } + ], + "risks": [ + "risk-demographic-disparity" + ], + "summary": "Quarterly AI impact assessment of the clinical summarization model." + } + ] + }, + "perspectives": [ + { + "bom-ref": "perspective-model-card", + "name": "Model Card", + "description": "The model card view of this BOM. Mappings project the component identity, licensing, and party information together with the technical model properties, training, evaluation, limitations, environmental measurements, intended use cases, and the associated risks and impact assessments, using section names familiar to AI transparency audiences.", + "domains": [ + "machine-learning", + "transparency", + "ethics" + ], + "mappings": [ + { + "expression": "$.components[?(@.type=='machine-learning-model')]['name','version','description','tags']", + "nativeName": "Model Details", + "nativeDescription": "The identity of the model: its name, version, and a description of what it is and does.", + "relevance": "required", + "weight": 1.0 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].parties[?(@.roles[?(@.role=='supplier')])]", + "nativeName": "Developed By", + "nativeDescription": "The parties that develop and supply the model.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].parties[?(@.roles[?(@.role=='end-user')])]", + "nativeName": "Intended Users", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].licenses", + "nativeName": "License", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].identifiers", + "nativeName": "Model Identifiers", + "nativeDescription": "Asserted identities of the model, such as package URLs and model numbers.", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].hashes", + "nativeName": "Artifact Integrity", + "nativeDescription": "Cryptographic hashes of the distributed model artifact.", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.tasks", + "nativeName": "Supported Tasks", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.learningTypes", + "nativeName": "Learning Paradigms", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.architecture", + "nativeName": "Architecture", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.parameterCount", + "nativeName": "Parameter Count", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.quantization", + "nativeName": "Quantization", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties['inputs','outputs']", + "nativeName": "Input and Output Specification", + "relevance": "recommended" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.training", + "nativeName": "Training Data", + "relevance": "recommended", + "weight": 0.9 + }, + { + "expression": "$.formulation[?(@['bom-ref']=='formula-training-1')]", + "nativeName": "Training Procedure", + "relevance": "optional" + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.evaluation", + "nativeName": "Evaluation Results", + "relevance": "recommended", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.limitations", + "nativeName": "Known Limitations", + "nativeDescription": "Documented constraints on accuracy, reasoning, scalability, and appropriate use.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.components[?(@.type=='machine-learning-model')].modelProperties.environmental", + "nativeName": "Environmental Impact", + "relevance": "recommended" + }, + { + "expression": "$.definitions.useCases", + "nativeName": "Intended Use", + "nativeDescription": "The documented use cases the model is intended to serve.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.risks.risks[?(@.domains[?(@.type=='ethical')])]", + "nativeName": "Ethical Considerations", + "nativeDescription": "Risks documenting potential harms, affected groups, and mitigations.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.definitions.weaknesses[?(@.kind=='bias')]", + "nativeName": "Bias", + "nativeDescription": "Biases in data, design, or outputs recorded as weaknesses; their consequences are recorded in the risks that reference them.", + "relevance": "required", + "weight": 0.9 + }, + { + "expression": "$.risks.assessments", + "nativeName": "Impact Assessments", + "relevance": "recommended" + } + ] + } + ] +} diff --git a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json index 01bb1fb28..b21ebbc87 100644 --- a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json +++ b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json @@ -35,7 +35,7 @@ "impact": { "level": "major", "polarity": "harm", - "categories": [ "bias", "discrimination", "human-rights", { "name": "brand-trust" } ], + "categories": [ "discrimination", "human-rights", { "name": "brand-trust" } ], "factors": [ { "name": "Discrimination harm", "category": "discrimination", "score": 8, "weight": 0.6 }, { "name": "Reputation damage", "category": "reputation", "score": 6, "weight": 0.4 } @@ -54,7 +54,7 @@ "rationale": "Based on offline fairness metrics." }, "residualRisk": { - "impact": { "level": "moderate", "polarity": "harm", "categories": [ "bias" ] }, + "impact": { "level": "moderate", "polarity": "harm", "categories": [ "fairness" ] }, "score": { "level": "medium" }, "confidence": 0.5 }, @@ -97,5 +97,15 @@ "nextReview": "2026-07-15T00:00:00Z" } ] + }, + "definitions": { + "weaknesses": [ + { + "bom-ref": "weakness-training-imbalance", + "kind": "bias", + "name": "Training data imbalance", + "description": "Statistical bias in the training data. Historical lending records under-represent some demographic groups, so the model learns a skewed decision boundary." + } + ] } } diff --git a/tools/src/test/resources/2.0/valid-vulnerability-2.0.json b/tools/src/test/resources/2.0/valid-vulnerability-2.0.json index c776ffe8b..2eb5ed005 100644 --- a/tools/src/test/resources/2.0/valid-vulnerability-2.0.json +++ b/tools/src/test/resources/2.0/valid-vulnerability-2.0.json @@ -46,11 +46,17 @@ "weaknesses": [ { "bom-ref": "weakness-184", - "cweId": 184 + "kind": "flaw", + "identifiers": [ + { "scheme": "cwe", "value": "CWE-184" } + ] }, { "bom-ref": "weakness-502", - "cweId": 502 + "kind": "flaw", + "identifiers": [ + { "scheme": "cwe", "value": "CWE-502" } + ] } ], "description": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.", diff --git a/tools/src/test/resources/2.0/valid-weakness-kinds-2.0.json b/tools/src/test/resources/2.0/valid-weakness-kinds-2.0.json new file mode 100644 index 000000000..3ea0013bf --- /dev/null +++ b/tools/src/test/resources/2.0/valid-weakness-kinds-2.0.json @@ -0,0 +1,75 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:7c1f3b2e-9a4d-4c6e-8b1a-2f5d6e7a8b90", + "version": 1, + "definitions": { + "weaknesses": [ + { + "bom-ref": "weakness-deserialization", + "kind": "flaw", + "identifiers": [ + { "scheme": "cwe", "schemeVersion": "4.20", "value": "CWE-502" } + ] + }, + { + "bom-ref": "weakness-lead-solder", + "kind": "hazard", + "name": "Lead content above 0.1 % in solder", + "identifiers": [ + { "scheme": "ghs", "value": "H360" } + ] + }, + { + "bom-ref": "weakness-age-representation", + "kind": "bias", + "name": "Representation bias in training data", + "description": "Notes describing patients aged 65 and over are under-represented in the training corpus.", + "identifiers": [ + { "scheme": { "name": "avid", "url": "https://avidml.org/taxonomy/" }, "value": "E0101" } + ], + "categories": [ + { "taxonomy": "nist-sp-1270", "category": "statistical-computational" }, + { "taxonomy": "iso-iec-tr-24027", "category": "non-representative-sampling" } + ] + }, + { + "bom-ref": "weakness-single-source", + "kind": "predisposing-condition", + "name": "Single-source supplier with weak financial stability", + "identifiers": [ + { "scheme": "sot", "value": "RC-13" } + ], + "categories": [ + { "taxonomy": "orx-cause", "category": "external" } + ] + }, + { + "bom-ref": "weakness-custom-scheme", + "kind": { "name": "latent-condition", "description": "A dormant organisational condition in the sense used by Reason." }, + "name": "Unreviewed change to the release checklist", + "identifiers": [ + { "scheme": { "name": "acme-weakness-registry", "url": "https://weakness.example.com/registry" }, "value": "AW-0042" } + ], + "categories": [ + { "taxonomy": { "name": "acme-cause-model", "description": "Internal root cause model." }, "category": "process" } + ] + } + ] + }, + "risks": { + "risks": [ + { + "bom-ref": "risk-single-source-outage", + "name": "Supply interruption from a single-source supplier", + "statement": "Because the only qualified supplier of the power controller is financially unstable, a supplier failure would halt production for at least one quarter.", + "relatedWeaknesses": [ "weakness-single-source" ], + "inherentRisk": { + "likelihood": { "level": "medium" }, + "impact": { "level": "major", "polarity": "harm", "categories": [ "operational", "financial" ] } + } + } + ] + } +}