From b64695b3df231784fc7d59763dc72ddf573d3dbf Mon Sep 17 00:00:00 2001 From: Matt Rutkowski Date: Sat, 27 Jun 2026 22:00:32 -0500 Subject: [PATCH 1/3] Proposed CycloneDX v2.0 additions to the AI/ML property Taxonomy Signed-off-by: Matt Rutkowski --- cdx/ai-ml.md | 334 ++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 314 insertions(+), 20 deletions(-) diff --git a/cdx/ai-ml.md b/cdx/ai-ml.md index 06fbe75..31cdfc3 100644 --- a/cdx/ai-ml.md +++ b/cdx/ai-ml.md @@ -16,26 +16,30 @@ The following are the reserved namespaces for AI/ML under the `cdx:ai-ml` namesp _Boolean value_ are `true` or `false`; case sensitive. +--- + +> **πŸ“Œ Proposed additions (2.0-dev-ai-ml):** This document extends the original `ai-ml.md` with new namespace sections that correspond to extensible `^cdx:ai-ml:` pattern fields in the CycloneDX v2.0 AI/ML JSON Schema. Sections and values marked **[PROPOSED]** are candidates for formal registration in the property taxonomy and for use as `cdx:ai-ml:` URN-style values inside the schema's `anyOf` enum+pattern fields. + +--- + ## `cdx:ai-ml:model` Namespace Taxonomy | Namespace | Description | | --------- | ----------- | +| `cdx:ai-ml:model:modality` | Provide the modality/modalities the model supports. This describes the specific type(s) or format(s) of data the model is designed to process such as text, images, audio, video, or sensor data. | | `cdx:ai-ml:model:template` | Mark a model as a template and describe its details. | | `cdx:ai-ml:model:parameter` | Describe learned parameters of a model which dictated by the model's architecture and design before training. | | `cdx:ai-ml:model:hyperparameter` | Describe parameters used to configure a model. | +| `cdx:ai-ml:model:architecture` | **[PROPOSED]** Describe the structural and behavioral architecture of the model. Maps directly to the `modelArchitecture.structural` object in the JSON schema. | +| `cdx:ai-ml:model:task` | **[PROPOSED]** Describe the ML task the model is designed to perform. Maps to the `modelTaskType` definition in the JSON schema. | +| `cdx:ai-ml:model:performance` | **[PROPOSED]** Describe performance metrics associated with the model. Maps to the `performanceMetric.type` definition in the JSON schema. | -| Property | Description | -| -------- | ----------- | -| `cdx:ai-ml:model:tokenizer` | Mark a component as a (model) tokenizer. _Boolean value_.
This property MAY appear once. | -| `cdx:ai-ml:model:language` | Describe what language(s) a model was trained for. Value MUST be of [ISO 639-1 language codes](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes). Value MUST be a single language code (e.g. `nl`) or a comma separated list of language codes (e.g. `en,fr,de,it,ja,zh`).
This property MAY appear multiple times. | -| `cdx:ai-ml:model:modality` | Provide the modality/modalities the model supports. This describes the specific type(s) or format(s) of data the model is designed to process. Value SHOULD be of industry-standard keywords such as those [listed in the section below](#names-of-industry-standard-model-modalities). Value MUST be a single keyword.
This property MAY appear multiple times. | - -### Names of industry-standard model modalities +### `cdx:ai-ml:model:modality` Namespace Taxonomy These following values SHOULD be used with the `cdx:ai-ml:model:modality` property: | Value | Description | -| ----- | ----------- | +| -------- | ----------- | | `text` | Natural Language Processing (NLP) tasks and specializations such as Natural Language Understanding (NLU) for tasks like translation, summarization, conversation, classification and sentiment analysis. | | `code` | Specialized, text-based modality used for software engineering and logic. | | `instruct` | Specialized, text-based modality fine-tuned for understanding and executing natural language directives (i.e., instruction following). | @@ -47,15 +51,15 @@ These following values SHOULD be used with the `cdx:ai-ml:model:modality` proper | `genomic` (telemetry) | Processes high-dimensional data used in drug discovery and medical research. | | `_undefined:` | `` placeholder, used to provide an arbitrary model modality name. | -### Example: Using `machine-learning-model` +#### Example: Using model modalities on the model's component ```jsonc { // ... - "components": [{ + "component": { "type": "machine-learning-model", - "name": "my model", - // ... + "bom-ref": "pkg:huggingface/FakeAI/CoderModel", + // ..., "properties": [ { "name": "cdx:ai-ml:model:modality", @@ -64,17 +68,22 @@ These following values SHOULD be used with the `cdx:ai-ml:model:modality` proper { "name": "cdx:ai-ml:model:modality", "value": "instruct" - }, - { - "name": "cdx:ai-ml:model:modality", - "value": "_undefined:acme:something-custom" } ] - }] + } } ``` -### Example: Using multiple `cdx:ai-ml:model:language` +### `cdx:ai-ml:model:language` Namespace Taxonomy + +Model language values MUST be valid [ISO 639-1 language codes](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes). + +| Property | Description | +| -------- | ----------- | +| `cdx:ai-ml:model:tokenizer` | Mark a component as a (model) tokenizer. _Boolean value_.
This property MAY appear once. | +| `cdx:ai-ml:model:language` | Describe what language(s) a model was trained for. Value MUST be of [ISO 639-1 language codes](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes). Value MUST be a single language code (e.g. `nl`) or a comma separated list of language codes (e.g. `en,fr,de,it,ja,zh`).
This property MAY occur multiple times. | + +### Example: Using multiple languages ```jsonc { @@ -118,8 +127,8 @@ Model properties reflect on the methods used to control the model's parameter co | Property | Description | | -------- | ----------- | -| `cdx:ai-ml:model:parameter:count` | Total number of learned parameters for the model. This reflects the model's design and structure (e.g., number of layers in a neural network, nodes, and connectivity).
The value SHOULD use the industry-standard naming convention of number followed by one of the letters: `M` (Million), `B` (Billion) or `T` (Trillion). This property MAY appear once. | -| `cdx:ai-ml:model:parameter:tune_method` | Describes how the model was fine-tuned on or adapted to new data. Value SHOULD be of industry-standard keywords such as those [listed in the section below](#names-of-industry-standard-fine-tuning-methods). Value MUST be a single keyword (e.g., `lora`) or a comma separated list of keywords (e.g., `sft,rlhf`).
This property MAY appear multiple times. | +| `cdx:ai-ml:model:parameter:count` | Total number of learned parameters for the model. This reflects the model's design and structure (e.g., number of layers in a neural network, nodes, and connectivity).
The value SHOULD use the industry-standard naming convention of number followed by one of the letters: `M` (Million), `B` (Billion) or `T` (Trillion). May appear once. | +| `cdx:ai-ml:model:parameter:tune_method` | Describes how the model was fine-tuned on or adapted to new data. This property MAY appear multiple times. Value SHOULD be of industry-standard keywords such as those [listed in the section below](#names-of-industry-standard-fine-tuning-methods). Value MUST be a single keyword (e.g., `lora`) or a comma separated list of keywords (e.g., `sft,rlhf`).
This property MAY occur multiple times. | | `cdx:ai-ml:model:parameter:_undefined:` | `` placeholder, used to provide an arbitrary model parameter name. Arbitrarty value and meaning. | #### Names of industry-standard fine-tuning methods @@ -285,6 +294,291 @@ The following pseudocode shows how to include a model hyperparameter that is not } ``` +--- + +## **[PROPOSED]** `cdx:ai-ml:model:architecture` Namespace Taxonomy + +The `cdx:ai-ml:model:architecture` namespace corresponds to the `modelArchitecture.structural` object in the CycloneDX v2.0 AI/ML JSON Schema (`cyclonedx-ai-ml-2.0.schema.json`). + +Each field that has a `^cdx:ai-ml:[a-z0-9:-]+$` pattern extension accepts values in **two equivalent forms**: + +- **Short form** β€” the plain enum string defined in the schema (e.g., `transformer`). Use this form for any value listed in the schema's built-in enum. +- **URN-style form** β€” the fully qualified `cdx:ai-ml:` prefixed path (e.g., `cdx:ai-ml:model:architecture:primary:transformer`). This form MUST be used for any value not present in the schema's built-in enum. Either form MAY be used for built-in values; the short form is preferred for brevity. + +| Namespace | Description | +| --------- | ----------- | +| `cdx:ai-ml:model:architecture:primary` | The core mathematical structural framework of the model backbone. Maps to `structural.primary`. | +| `cdx:ai-ml:model:architecture:secondary` | A secondary macro-layout or component sub-network built into the primary structure. MAY appear multiple times. Maps to items in `structural.secondary`. | +| `cdx:ai-ml:model:architecture:topology` | The runtime parameter activation and connection structure of the network layers. Maps to `structural.topologyType`. | + +### `cdx:ai-ml:model:architecture:primary` Values + +Maps to `structural.primary` in the schema. The **Short form** column is the built-in schema enum value; the **URN-style form** column is the equivalent fully-qualified property taxonomy value. Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN-style form. + +| Short form | URN-style form | Description | +| ---------- | -------------- | ----------- | +| `transformer` | `cdx:ai-ml:model:architecture:primary:transformer` | Architecture based on self-attention mechanisms for processing sequential or spatial data. | +| `cnn` | `cdx:ai-ml:model:architecture:primary:cnn` | Convolutional Neural Network β€” architecture using convolutional layers for processing grid-like data. | +| `rnn` | `cdx:ai-ml:model:architecture:primary:rnn` | Recurrent Neural Network β€” architecture with recurrent connections for sequential data processing. | +| `lstm` | `cdx:ai-ml:model:architecture:primary:lstm` | Long Short-Term Memory β€” RNN variant with gating mechanisms for long-term dependencies. | +| `gru` | `cdx:ai-ml:model:architecture:primary:gru` | Gated Recurrent Unit β€” RNN variant with simplified gating compared to LSTM. | +| `gan` | `cdx:ai-ml:model:architecture:primary:gan` | Generative Adversarial Network β€” dual-network framework containing a generator and a discriminator. | +| `vae` | `cdx:ai-ml:model:architecture:primary:vae` | Variational Autoencoder β€” probabilistic encoder-decoder architecture mapping to a latent space. | +| `mamba` | `cdx:ai-ml:model:architecture:primary:mamba` | State-space model architecture with selective mechanisms for efficient sequence modeling. | +| `ssm` | `cdx:ai-ml:model:architecture:primary:ssm` | State Space Model β€” core architecture based on continuous or discrete state-space representations. | +| `gnn` | `cdx:ai-ml:model:architecture:primary:gnn` | Graph Neural Network β€” architecture optimized for processing graph-structured data elements. | +| `mlp` | `cdx:ai-ml:model:architecture:primary:mlp` | Multi-Layer Perceptron β€” classic feedforward architecture composed entirely of fully connected layers. | +| `rwkv` | `cdx:ai-ml:model:architecture:primary:rwkv` | Receptive Weighted Key Value β€” architecture combining parallelizable training with RNN-like inference. | +| `snn` | `cdx:ai-ml:model:architecture:primary:snn` | Spiking Neural Network β€” neuromorphic architecture utilizing discrete, time-dependent spiking activations. | +| `kan` | `cdx:ai-ml:model:architecture:primary:kan` | Kolmogorov-Arnold Network β€” architecture featuring learnable activation functions on edges rather than nodes. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:diffusion` | Denoising diffusion probabilistic model β€” iteratively refines noise into data (e.g., DDPM, Stable Diffusion). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:flow-matching` | Continuous normalizing flow trained via flow matching / rectified flow (e.g., Flux, SD3). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:rbm` | Restricted Boltzmann Machine β€” energy-based generative model with stochastic hidden units. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:capsnet` | Capsule Network β€” architecture using dynamic routing between capsule groups to preserve spatial hierarchies. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:neuromorphic` | Architecture designed for deployment on neuromorphic hardware (e.g., Intel Loihi, IBM TrueNorth). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:primary:hybrid` | Explicit first-class combination of two or more distinct primary architectures (e.g., CNN+Transformer). | + +### `cdx:ai-ml:model:architecture:secondary` Values + +Maps to items in `structural.secondary` in the schema. Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN-style form. + +| Short form | URN-style form | Description | +| ---------- | -------------- | ----------- | +| `decoder-only` | `cdx:ai-ml:model:architecture:secondary:decoder-only` | Autoregressive macro-layout processing data left-to-right (e.g., GPT series). | +| `encoder-only` | `cdx:ai-ml:model:architecture:secondary:encoder-only` | Bidirectional macro-layout processing complete sequences simultaneously (e.g., BERT). | +| `encoder-decoder` | `cdx:ai-ml:model:architecture:secondary:encoder-decoder` | Sequence-to-sequence structure mapping an input representation to an output sequence (e.g., T5). | +| `mixture-of-experts` | `cdx:ai-ml:model:architecture:secondary:mixture-of-experts` | Sparse routing layer mechanism activating specific expert subnetworks per token. | +| `vae-bottleneck` | `cdx:ai-ml:model:architecture:secondary:vae-bottleneck` | Symmetric compression bottleneck utilizing mean and variance latent vectors. | +| `u-net` | `cdx:ai-ml:model:architecture:secondary:u-net` | Symmetric contracting and expanding macro-layout featuring skip connections between corresponding scales. | +| `residual-connections` | `cdx:ai-ml:model:architecture:secondary:residual-connections` | Explicit skip or identity shortcuts bypassing one or more structural layers. | +| `dual-encoders` | `cdx:ai-ml:model:architecture:secondary:dual-encoders` | Parallel feature extraction pipelines mapping different modalities into a shared space. | +| `cross-attention-gated` | `cdx:ai-ml:model:architecture:secondary:cross-attention-gated` | Explicit sub-component routing that conditions one feature stream using another via attention mechanisms. | +| `siamese-network` | `cdx:ai-ml:model:architecture:secondary:siamese-network` | Twin identical subnetworks sharing identical weights to compute similarity metrics. | +| `hybrid-backbone` | `cdx:ai-ml:model:architecture:secondary:hybrid-backbone` | Direct cascading combination of distinct primary layers (e.g., a CNN feature extractor feeding a Transformer). | +| `state-space-model` | `cdx:ai-ml:model:architecture:secondary:state-space-model` | State space model architectures using selective state spaces for sequence modeling (e.g., Mamba). | +| `flow-matching` | `cdx:ai-ml:model:architecture:secondary:flow-matching` | Flow-based generative model backbone using continuous normalizing flows. | +| `vision-encoder` | `cdx:ai-ml:model:architecture:secondary:vision-encoder` | Vision encoding component for processing image inputs in multimodal architectures (e.g., CLIP, SigLIP). | +| `adapter-layers` | `cdx:ai-ml:model:architecture:secondary:adapter-layers` | Parameter-efficient fine-tuning layers inserted into frozen models (e.g., LoRA, adapters). | +| `projector-layers` | `cdx:ai-ml:model:architecture:secondary:projector-layers` | Cross-modal projection components bridging different modalities (e.g., Q-Former, linear projectors). | +| `gated-linear-units` | `cdx:ai-ml:model:architecture:secondary:gated-linear-units` | Gated activation mechanisms using element-wise multiplication (e.g., GLU, SwiGLU, GeGLU). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:speculative-decoding` | Sub-network pairing a small draft model with a large verifier model to accelerate autoregressive generation. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:rotary-position-embedding` | Rotary Position Embedding (RoPE) sub-component encoding positional information via rotation matrices. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:grouped-query-attention` | Grouped-Query Attention (GQA) variant sharing key/value heads across groups of query heads to reduce KV-cache size. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:sliding-window-attention` | Attention mechanism restricting receptive field to a local sliding window (e.g., Mistral). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:retrieval-augmented` | Explicit retrieval sub-network prepended to or integrated into the model (e.g., RAG, RETRO). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:memory-augmented` | External or persistent memory bank integrated into the forward pass (e.g., MemGPT, Memorizing Transformers). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:multimodal-fusion` | Layer or block that fuses representations across more than one modality (e.g., cross-modal attention, FiLM conditioning). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:secondary:reranker` | Separate scoring / reranking head applied after an initial retrieval or generation step. | + +### `cdx:ai-ml:model:architecture:topology` Values + +Maps to `structural.topologyType` in the schema. Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN-style form. + +| Short form | URN-style form | Description | +| ---------- | -------------- | ----------- | +| `dense` | `cdx:ai-ml:model:architecture:topology:dense` | All or most parameters are active during inference with full connectivity between layers. | +| `sparse` | `cdx:ai-ml:model:architecture:topology:sparse` | Only a subset of parameters are active during inference with selective connectivity. | +| `dynamic` | `cdx:ai-ml:model:architecture:topology:dynamic` | Parameter activation and connectivity patterns change based on input or runtime conditions. | +| `liquid` | `cdx:ai-ml:model:architecture:topology:liquid` | Continuously adaptive network structure with time-varying connections and activations. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:topology:mixture-of-depths` | Tokens are routed to different computational depths rather than different expert modules. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:topology:early-exit` | Inference exits at the earliest layer that meets a confidence threshold, reducing compute for easy inputs. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:architecture:topology:recurrent-hybrid` | Static layer layout that alternates between global attention and recurrent / SSM layers (e.g., Jamba, Zamba). | + +#### Example: Using built-in and URN-style values together + +```jsonc +{ + "components": [{ + "type": "machine-learning-model", + "name": "my-diffusion-model", + "modelCard": { + "modelArchitecture": { + "structural": { + "primary": "cdx:ai-ml:model:architecture:primary:diffusion", + "topologyType": "dense", + "secondary": [ + "u-net", + "cdx:ai-ml:model:architecture:secondary:multimodal-fusion" + ] + } + } + } + }] +} +``` + +--- + +## **[PROPOSED]** `cdx:ai-ml:model:task` Namespace Taxonomy + +The `cdx:ai-ml:model:task` namespace corresponds to the `modelTaskType` definition in the JSON schema. Each value may be expressed in **two equivalent forms**: + +- **Short form** β€” the plain string from the schema's built-in enum (e.g., `text-generation`). +- **URN-style form** β€” the fully qualified path (e.g., `cdx:ai-ml:model:task:text-generation`). MUST be used for values not in the built-in enum. Either form MAY be used for built-in values; the short form is preferred for brevity. + +Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN-style form. + +| Short form | URN-style form | Description | +| ---------- | -------------- | ----------- | +| `text-generation` | `cdx:ai-ml:model:task:text-generation` | Generate coherent text continuations from prompts (e.g., GPT models). | +| `text-classification` | `cdx:ai-ml:model:task:text-classification` | Classify text into predefined categories (e.g., sentiment analysis, topic classification). | +| `token-classification` | `cdx:ai-ml:model:task:token-classification` | Classify individual tokens in text (e.g., named entity recognition, part-of-speech tagging). | +| `question-answering` | `cdx:ai-ml:model:task:question-answering` | Answer questions based on context or knowledge (e.g., extractive or generative QA). | +| `summarization` | `cdx:ai-ml:model:task:summarization` | Generate concise summaries of longer text documents. | +| `translation` | `cdx:ai-ml:model:task:translation` | Translate text from one language to another. | +| `text-to-text` | `cdx:ai-ml:model:task:text-to-text` | Transform text from one form to another (e.g., paraphrasing, style transfer). | +| `fill-mask` | `cdx:ai-ml:model:task:fill-mask` | Predict masked tokens in text (e.g., BERT-style masked language modeling). | +| `sentence-similarity` | `cdx:ai-ml:model:task:sentence-similarity` | Compute semantic similarity between text sequences. | +| `text-to-image` | `cdx:ai-ml:model:task:text-to-image` | Generate images from text descriptions (e.g., DALL-E, Stable Diffusion). | +| `text-to-video` | `cdx:ai-ml:model:task:text-to-video` | Generate video content from text descriptions. | +| `text-to-audio` | `cdx:ai-ml:model:task:text-to-audio` | Generate audio or music from text descriptions. | +| `text-to-speech` | `cdx:ai-ml:model:task:text-to-speech` | Convert text to spoken audio (speech synthesis). | +| `image-classification` | `cdx:ai-ml:model:task:image-classification` | Classify images into predefined categories (e.g., ResNet, ViT). | +| `image-segmentation` | `cdx:ai-ml:model:task:image-segmentation` | Segment images into regions or objects (semantic or instance segmentation). | +| `object-detection` | `cdx:ai-ml:model:task:object-detection` | Detect and localize objects in images (e.g., YOLO, R-CNN). | +| `image-to-image` | `cdx:ai-ml:model:task:image-to-image` | Transform images (e.g., style transfer, super-resolution, inpainting). | +| `image-to-text` | `cdx:ai-ml:model:task:image-to-text` | Generate text descriptions from images (e.g., image captioning). | +| `depth-estimation` | `cdx:ai-ml:model:task:depth-estimation` | Estimate depth information from images. | +| `video-classification` | `cdx:ai-ml:model:task:video-classification` | Classify video content into categories. | +| `audio-classification` | `cdx:ai-ml:model:task:audio-classification` | Classify audio into categories (e.g., sound event detection). | +| `automatic-speech-recognition` | `cdx:ai-ml:model:task:automatic-speech-recognition` | Transcribe spoken audio to text (e.g., Whisper). | +| `audio-to-audio` | `cdx:ai-ml:model:task:audio-to-audio` | Transform audio (e.g., noise reduction, voice conversion). | +| `voice-activity-detection` | `cdx:ai-ml:model:task:voice-activity-detection` | Detect presence of speech in audio streams. | +| `tabular-classification` | `cdx:ai-ml:model:task:tabular-classification` | Classify structured tabular data. | +| `tabular-regression` | `cdx:ai-ml:model:task:tabular-regression` | Predict continuous values from structured tabular data. | +| `time-series-forecasting` | `cdx:ai-ml:model:task:time-series-forecasting` | Predict future values in time series data. | +| `reinforcement-learning` | `cdx:ai-ml:model:task:reinforcement-learning` | Learn optimal actions through interaction with an environment. | +| `robotics` | `cdx:ai-ml:model:task:robotics` | Control and decision-making for robotic systems. | +| `graph-ml` | `cdx:ai-ml:model:task:graph-ml` | Machine learning tasks on graph-structured data. | +| `feature-extraction` | `cdx:ai-ml:model:task:feature-extraction` | Extract meaningful features or representations from data. | +| `embedding` | `cdx:ai-ml:model:task:embedding` | Generate dense vector representations of data. | +| `zero-shot-classification` | `cdx:ai-ml:model:task:zero-shot-classification` | Classify data without task-specific training examples. | +| `few-shot-learning` | `cdx:ai-ml:model:task:few-shot-learning` | Learn from very few examples per class. | +| `other` | `cdx:ai-ml:model:task:other` | Other machine learning tasks not covered by predefined categories. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:reasoning` | Explicit chain-of-thought or multi-step logical reasoning (e.g., o1, DeepSeek-R1). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:code-review` | Automated review, critique, and improvement of existing source code. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:code-completion` | Context-aware in-editor code completion (e.g., Copilot fill-in-the-middle). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:document-parsing` | Extraction of structured data from documents including PDFs, invoices, and forms. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:image-to-3d` | Generation of 3D representations (NeRF, mesh, point cloud) from one or more 2D images. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:text-to-3d` | Generation of 3D assets from text descriptions. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:multimodal-generation` | Simultaneous generation of content across more than one modality from a single prompt. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:agentic-planning` | High-level task decomposition and multi-step planning for autonomous agents. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:tool-use` | Structured invocation of external tools, APIs, or function calls from model output. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:anomaly-detection` | Identification of outliers or deviations from expected distributions in structured or unstructured data. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:pose-estimation` | Detection and estimation of body keypoints or object pose from images or video. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:optical-flow` | Per-pixel motion estimation between consecutive video frames. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:super-resolution` | Up-sampling of low-resolution images or video to higher resolution. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:inpainting` | Reconstruction of missing or masked regions within an image or video. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:molecule-generation` | De novo design and generation of molecular structures for drug discovery or materials science. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:protein-structure-prediction` | Prediction of three-dimensional protein folding from amino acid sequences. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:task:weather-forecasting` | Prediction of atmospheric conditions from observational or reanalysis data. | + +#### Example: Referencing an extended task type + +```jsonc +{ + "components": [{ + "type": "machine-learning-model", + "name": "my-reasoning-model", + "modelCard": { + "modelArchitecture": { + "tasks": [ + "text-generation", + "cdx:ai-ml:model:task:reasoning", + "cdx:ai-ml:model:task:tool-use" + ] + } + } + }] +} +``` + +--- + +## **[PROPOSED]** `cdx:ai-ml:model:performance` Namespace Taxonomy + +The `cdx:ai-ml:model:performance` namespace corresponds to the `performanceMetric.type` definition in the JSON schema. Each value may be expressed in **two equivalent forms**: + +- **Short form** β€” the plain string from the schema's built-in enum (e.g., `bleu`). +- **URN-style form** β€” the fully qualified path (e.g., `cdx:ai-ml:model:performance:metric:bleu`). MUST be used for values not in the built-in enum. Either form MAY be used for built-in values; the short form is preferred for brevity. + +Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN-style form. + +| Short form | URN-style form | Description | +| ---------- | -------------- | ----------- | +| `mmlu-pro` | `cdx:ai-ml:model:performance:metric:mmlu-pro` | Massive Multitask Language Understanding Pro β€” expert-level academic and professional reasoning across multiple disciplines. | +| `gpqa` | `cdx:ai-ml:model:performance:metric:gpqa` | Graduate-Level Google-Proof Q&A β€” highly difficult dataset for PhD-level reasoning and scientific problem-solving. | +| `math-500` | `cdx:ai-ml:model:performance:metric:math-500` | A subset of the MATH benchmark used to evaluate complex, multi-step mathematical reasoning. | +| `humaneval` | `cdx:ai-ml:model:performance:metric:humaneval` | Industry-standard benchmark for evaluating Python code generation and functional programming synthesis. | +| `swe-bench` | `cdx:ai-ml:model:performance:metric:swe-bench` | Software Engineering Benchmark β€” evaluates agentic ability to resolve real-world software engineering issues. | +| `ifeval` | `cdx:ai-ml:model:performance:metric:ifeval` | Instruction Following Evaluation β€” tests strict adherence to verifiable formatting constraints. | +| `livebench` | `cdx:ai-ml:model:performance:metric:livebench` | Frequently updated, contamination-free benchmark for reasoning, math, and coding. | +| `webarena` | `cdx:ai-ml:model:performance:metric:webarena` | Agentic benchmark for complex multi-step tasks using a web browser, APIs, and OS environments. | +| `lmsys-elo` | `cdx:ai-ml:model:performance:metric:lmsys-elo` | Crowd-sourced human preference rating derived from blind A/B battle tests in the LMSYS Chatbot Arena. | +| `strongreject` | `cdx:ai-ml:model:performance:metric:strongreject` | Standardized metric for measuring safety alignment against harmful prompts while avoiding false positives. | +| `perplexity` | `cdx:ai-ml:model:performance:metric:perplexity` | Fundamental language model metric measuring how well a probability model predicts a sample. | +| `bleu` | `cdx:ai-ml:model:performance:metric:bleu` | Bilingual Evaluation Understudy β€” metric for evaluating machine translation quality. | +| `rouge` | `cdx:ai-ml:model:performance:metric:rouge` | Recall-Oriented Understudy for Gisting Evaluation β€” metrics for automatic summarization and translation. | +| `latency` | `cdx:ai-ml:model:performance:metric:latency` | Time delay between input submission and output generation, typically measured in milliseconds or seconds. | +| `throughput` | `cdx:ai-ml:model:performance:metric:throughput` | Rate at which a model processes requests or tokens, typically measured in tokens per second or requests per second. | +| `coco` | `cdx:ai-ml:model:performance:metric:coco` | Common Objects in Context β€” benchmark for object detection, segmentation, and captioning in computer vision. | +| `vqa` | `cdx:ai-ml:model:performance:metric:vqa` | Visual Question Answering β€” evaluates a model's ability to answer questions about images. | +| `imagenet` | `cdx:ai-ml:model:performance:metric:imagenet` | Large visual database benchmark for image classification and object recognition. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:arc` | AI2 Reasoning Challenge β€” multiple-choice science question benchmark measuring commonsense and factual reasoning. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:hellaswag` | Commonsense NLI benchmark for sentence completion requiring real-world situational reasoning. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:truthfulqa` | Benchmark measuring a model's propensity to produce truthful answers versus plausible-sounding falsehoods. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:winogrande` | Large-scale Winograd schema challenge testing commonsense reasoning via pronoun disambiguation. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:gsm8k` | Grade-school math benchmark measuring multi-step arithmetic reasoning. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:mbpp` | Mostly Basic Python Programming benchmark for code generation via programming problems. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:bigbench-hard` | A subset of BIG-Bench tasks specifically selected for being difficult for current language models. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:mmlu` | Massive Multitask Language Understanding β€” the original 57-subject academic reasoning benchmark. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:mme` | Multimodal LLM Evaluation benchmark measuring perception and cognition across image-text pairs. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:seedbench` | SEED-Bench β€” multimodal benchmark with 19K multiple-choice questions covering spatial and temporal understanding. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:mtbench` | MT-Bench β€” multi-turn conversational benchmark graded by a strong LLM judge. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:agentic-success-rate` | Task-completion rate for autonomous agents evaluated on environment-grounded multi-step benchmarks. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:ttft` | Time-to-First-Token β€” latency from request submission to generation of the first output token. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:memory-footprint` | Peak GPU/CPU memory consumption during inference. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:f1` | Harmonic mean of precision and recall; standard metric for classification and span-extraction tasks. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:exact-match` | Strict string equality between prediction and reference; standard for extractive QA and code generation. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:map` | Mean Average Precision β€” area-under-precision-recall curve averaged over classes (detection/retrieval). | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:ndcg` | Normalised Discounted Cumulative Gain β€” ranking quality metric used in information retrieval. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:wer` | Word Error Rate β€” proportion of incorrectly predicted words; standard metric for ASR systems. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:cer` | Character Error Rate β€” character-level analogue of WER; used for OCR and low-resource ASR. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:fid` | FrΓ©chet Inception Distance β€” distribution-level similarity metric for generative image quality. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:clip-score` | Cosine similarity between CLIP embeddings of generated images and conditioning text. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:power-consumption` | Average power draw (watts) during a standardised inference workload. | +| _(none)_ **[PROPOSED]** | `cdx:ai-ml:model:performance:metric:carbon-intensity` | gCOβ‚‚eq per inference request under a standardised workload and grid carbon intensity. | + +#### Example: Referencing an extended performance metric + +```jsonc +{ + "components": [{ + "type": "machine-learning-model", + "name": "my-asr-model", + "modelCard": { + "quantitativeAnalysis": { + "performanceMetrics": [ + { + "type": "cdx:ai-ml:model:performance:metric:wer", + "measure": { "value": 4.2, "unit": "%" } + }, + { + "type": "throughput", + "measure": { "value": 240, "unit": "tokens/s" } + } + ] + } + } + }] +} +``` + +--- + + +--- + ## `cdx:ai-ml:tokenizer` Namespace Taxonomy The following table lists the current set of namespaces in the `cdx:ai-ml:tokenizer` namespace: From 7fc9c2d26ccd6f939ef0bfe297126896eea0828e Mon Sep 17 00:00:00 2001 From: Matt Rutkowski Date: Sat, 27 Jun 2026 22:04:24 -0500 Subject: [PATCH 2/3] Proposed CycloneDX v2.0 additions to the AI/ML property Taxonomy Signed-off-by: Matt Rutkowski --- cdx/ai-ml.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/cdx/ai-ml.md b/cdx/ai-ml.md index 31cdfc3..9a3a067 100644 --- a/cdx/ai-ml.md +++ b/cdx/ai-ml.md @@ -409,7 +409,7 @@ Maps to `structural.topologyType` in the schema. Rows marked **[PROPOSED]** have --- -## **[PROPOSED]** `cdx:ai-ml:model:task` Namespace Taxonomy +### **[PROPOSED]** `cdx:ai-ml:model:task` Namespace Taxonomy The `cdx:ai-ml:model:task` namespace corresponds to the `modelTaskType` definition in the JSON schema. Each value may be expressed in **two equivalent forms**: @@ -495,7 +495,7 @@ Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN --- -## **[PROPOSED]** `cdx:ai-ml:model:performance` Namespace Taxonomy +### **[PROPOSED]** `cdx:ai-ml:model:performance` Namespace Taxonomy The `cdx:ai-ml:model:performance` namespace corresponds to the `performanceMetric.type` definition in the JSON schema. Each value may be expressed in **two equivalent forms**: @@ -576,10 +576,7 @@ Rows marked **[PROPOSED]** have no built-in enum equivalent and MUST use the URN --- - ---- - -## `cdx:ai-ml:tokenizer` Namespace Taxonomy +### `cdx:ai-ml:tokenizer` Namespace Taxonomy The following table lists the current set of namespaces in the `cdx:ai-ml:tokenizer` namespace: From 5bc43c29e4756e14a2e374c2d49e6d5808ba7d73 Mon Sep 17 00:00:00 2001 From: Matt Rutkowski Date: Sat, 27 Jun 2026 22:08:30 -0500 Subject: [PATCH 3/3] Proposed CycloneDX v2.0 additions to the AI/ML property Taxonomy Signed-off-by: Matt Rutkowski --- cdx/ai-ml.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cdx/ai-ml.md b/cdx/ai-ml.md index 9a3a067..46bbd26 100644 --- a/cdx/ai-ml.md +++ b/cdx/ai-ml.md @@ -4,7 +4,7 @@ This is the namespace for official CycloneDX properties specific to the Artifici The official rules and processes apply - see [parent document](../cdx.md). ----- +--- The following are the reserved namespaces for AI/ML under the `cdx:ai-ml` namespace. @@ -607,9 +607,9 @@ Each well-known property MAY be used once, if not stated otherwise. #### Tokenizer hyperparameter notes -* If the `cdx:ai-ml:model:hyperparameter:tokenizer_class` hyperparameter value is declared, the `cdx:ai-ml:tokenizer:hyperparameter:tokenizer_class` value SHOULD match. -* Tokenizer hyperparameter values should be compatible with the tokenizer class implementation (value) provided on the `tokenizer_class` hyperparameter. -* Tokenizer hyperparameters that configure special token such as `bos_token`, `eos_token`, `pad_token`, etc. often utilize a distinct syntax such as the `<|` and `|>` that delineates them from other tokens (e.g., `<|im_start|>`, `<|pad_id|>`, `<|end_of_text|>`). +- If the `cdx:ai-ml:model:hyperparameter:tokenizer_class` hyperparameter value is declared, the `cdx:ai-ml:tokenizer:hyperparameter:tokenizer_class` value SHOULD match. +- Tokenizer hyperparameter values should be compatible with the tokenizer class implementation (value) provided on the `tokenizer_class` hyperparameter. +- Tokenizer hyperparameters that configure special token such as `bos_token`, `eos_token`, `pad_token`, etc. often utilize a distinct syntax such as the `<|` and `|>` that delineates them from other tokens (e.g., `<|im_start|>`, `<|pad_id|>`, `<|end_of_text|>`). #### Example: Using tokenizer hyperparameter names listed in the AI/ML taxonomy