# A Large-Scale Measurement of AI Bill of Materials Completeness in Hugging Face Models

arXiv: https://arxiv.org/abs/2607.17242 · HTML: https://mlsanity.com/paper/2607.17242/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 18 of its 42 references that are in the map.
- First posted on arXiv 19 Jul 2026.

## Builds on (most cited first, 18 of 18)

- [Model Cards for Model Reporting](https://mlsanity.com/paper/1810.03993/) (2018)
- [Interactive Model Cards: A Human-Centered Approach to Model Documentation](https://mlsanity.com/paper/2205.02894/) (2022)
- [An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry](https://mlsanity.com/paper/2303.02552/) (2023)
- [Exploring the Carbon Footprint of Hugging Face's ML Models: A Repository Mining Study](https://mlsanity.com/paper/2305.11164/) (2023)
- [Fairify: Fairness Verification of Neural Networks](https://mlsanity.com/paper/2212.06140/) (2022)
- [Aspirations and Practice of Model Documentation: Moving the Needle with Nudging and Traceability](https://mlsanity.com/paper/2204.06425/) (2022)
- [Towards Fair Machine Learning Software: Understanding and Addressing Model Bias Through Counterfactual Thinking](https://mlsanity.com/paper/2302.08018/) (2023)
- [Laminator: Verifiable ML Property Cards using Hardware-assisted Attestations](https://mlsanity.com/paper/2406.17548/) (2024)
- [Atlas: A Framework for ML Lifecycle Provenance & Transparency](https://mlsanity.com/paper/2502.19567/) (2025)
- [Lessons Learned from Mining the Hugging Face Repository](https://mlsanity.com/paper/2402.07323/) (2024)
- [AIBoMGen: Generating an AI Bill of Materials for Secure, Transparent, and Compliant Model Training](https://mlsanity.com/paper/2601.05703/) (2026)
- [Security Vulnerabilities in Software Supply Chain for Autonomous Vehicles](https://mlsanity.com/paper/2509.16899/) (2025)
- [Operationalising Artificial Intelligence Bills of Materials (AIBOMs) for Verifiable AI Provenance and Lifecycle Assurance](https://mlsanity.com/paper/2605.19755/) (2026)
- [Navigating Uncertainties: How GenAI Developers Document Their Models on Open-Source Platforms](https://mlsanity.com/paper/2503.23574/) (2025)
- [Unveiling Malicious Logic: Towards a Statement-Level Taxonomy and Dataset for Securing Python Packages](https://mlsanity.com/paper/2512.12559/) (2025)
- [A Large Scale Empirical Analysis on the Adherence Gap between Standards and Tools in SBOM](https://mlsanity.com/paper/2601.05622/) (2026)
- [An Empirical Investigation of Pre-Trained Deep Learning Model Reuse in the Scientific Process](https://mlsanity.com/paper/2603.13584/) (2026)
- [When AI Models Become Dependencies: Studying the Evolution of Pre-Trained Model Reuse in Downstream Software Systems](https://mlsanity.com/paper/2604.17940/) (2026)

## Abstract (arXiv)

Pretrained machine learning (ML) models help developers build ML-intensive software systems without training models from scratch. However, model repositories often provide incomplete machine-readable documentation about model provenance, licenses, datasets, limitations, and external references, creating transparency and governance gaps across the AI supply chain. Artificial Intelligence Bills of Materials (AIBOMs) address these gaps by documenting AI artifacts, including models, metadata, licenses, datasets, model-card information, and external references. Taking public Hugging Face (HF) model repositories as a case study, this paper empirically investigates AIBOM completeness, defined as the extent to which repositories provide AIBOM-relevant information for machine-readable AI supply-chain documentation. We examine approximately 97.5K AIBOM artifacts to assess the extent to which generated AIBOMs: (i) contain required structural and metadata fields, (ii) represent model identity, license, and external-reference information, (iii) capture model-card documentation such as datasets, limitations, safety-risk assessment, and environmental information, and (iv) vary in documentation coverage across repository and artifact characteristics such as task, license availability, dataset declaration, model family, and paper reference. Results indicate that generated AIBOMs provide complete coverage of required AIBOM structure but limited AI-specific documentation completeness. Required fields are fully represented, but model-card, metadata, responsible-use, environmental, limitation, and meaningful-description fields remain weakly represented or missing across generated artifacts. Our findings motivate improved model-card practices, repository-level traceability, and automated AIBOM validation to advance the generation and adoption of more complete AIBOMs.