A Large-Scale Measurement of AI Bill of Materials Completeness in Hugging Face Models
Not on the map. Why?
Abstract (arXiv)
Pretrained machine learning (ML) models help developers build ML-intensive software systems without training models from scratch. However, model repositories often provide incomplete machine-readable documentation about model provenance, licenses, datasets, limitations, and external references, creating transparency and governance gaps across the AI supply chain. Artificial Intelligence Bills of Materials (AIBOMs) address these gaps by documenting AI artifacts, including models, metadata, licenses, datasets, model-card information, and external references. Taking public Hugging Face (HF) model repositories as a case study, this paper empirically investigates AIBOM completeness, defined as the extent to which repositories provide AIBOM-relevant information for machine-readable AI supply-chain documentation. We examine approximately 97.5K AIBOM artifacts to assess the extent to which generated AIBOMs: (i) contain required structural and metadata fields, (ii) represent model identity, license, and external-reference information, (iii) capture model-card documentation such as datasets, limitations, safety-risk assessment, and environmental information, and (iv) vary in documentation coverage across repository and artifact characteristics such as task, license availability, dataset declaration, model family, and paper reference. Results indicate that generated AIBOMs provide complete coverage of required AIBOM structure but limited AI-specific documentation completeness. Required fields are fully represented, but model-card, metadata, responsible-use, environmental, limitation, and meaningful-description fields remain weakly represented or missing across generated artifacts. Our findings motivate improved model-card practices, repository-level traceability, and automated AIBOM validation to advance the generation and adoption of more complete AIBOMs.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 18 of its 42 references that are in the map. First posted on arXiv 19 Jul 2026.
Builds on
18 of 42 references.
References · 18
- 2018Model Cards for Model Reportingcited by 1,080
- 2022Interactive Model Cards: A Human-Centered Approach to Model Documentationcited by 61
- 2023An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registrycited by 47
- 2023Exploring the Carbon Footprint of Hugging Face's ML Models: A Repository Mining Studycited by 23
- 2022Fairify: Fairness Verification of Neural Networkscited by 22
- 2022Aspirations and Practice of Model Documentation: Moving the Needle with Nudging and Traceabilitycited by 14
- 2023Towards Fair Machine Learning Software: Understanding and Addressing Model Bias Through Counterfactual Thinkingcited by 14
- 2024Laminator: Verifiable ML Property Cards using Hardware-assisted Attestationscited by 10
- 2025Atlas: A Framework for ML Lifecycle Provenance & Transparencycited by 8
- 2024Lessons Learned from Mining the Hugging Face Repositorycited by 7
- 2026AIBoMGen: Generating an AI Bill of Materials for Secure, Transparent, and Compliant Model Trainingcited by 6
- 2025Security Vulnerabilities in Software Supply Chain for Autonomous Vehiclescited by 4
6 more
- 2026Operationalising Artificial Intelligence Bills of Materials (AIBOMs) for Verifiable AI Provenance and Lifecycle Assurancecited by 3
- 2025Navigating Uncertainties: How GenAI Developers Document Their Models on Open-Source Platformscited by 2
- 2025Unveiling Malicious Logic: Towards a Statement-Level Taxonomy and Dataset for Securing Python Packagescited by 2
- 2026A Large Scale Empirical Analysis on the Adherence Gap between Standards and Tools in SBOMcited by 2
- 2026An Empirical Investigation of Pre-Trained Deep Learning Model Reuse in the Scientific Processcited by 1
- 2026When AI Models Become Dependencies: Studying the Evolution of Pre-Trained Model Reuse in Downstream Software Systemscited by 1
Built on by
Not cited yet.