Passive, weight-level verification of whether an LLM actually comes from the base model it claims. Instead of trusting a Hugging Face model card's base_model field, aibom-security inspects the weights directly and abstains rather than guessing when it can't tell.
An AI BOM is only useful if lineage claims can be checked against the weights.
A Red Hat Research project. Issues and milestones track what's being worked on; the wiki holds finished write-ups once an issue is closed (state of the art, standards research, design decisions).
See the Milestone 1 board for the active spec and requirements, and the icebox for deferred ideas.
Requires uv.
uv sync --all-packages
uv run aibom verify meta-llama/Llama-3.2-1B --base someorg/some-finetuneFor a leaf step in an external verification pipeline:
docker build -t aibom-security .
docker run --rm aibom-security verify org/model --base org/baseFor gated Hub repos, pass HF_TOKEN. stdout is the VerificationResult JSON; stderr is JSONL telemetry. Verdicts are not mapped to exit codes. Full contract (argv, env, accept mode, events): docs/job-contract.md.
Monorepo — each top-level directory is an independently buildable component.
aibom-security/
├── cli/ # the `aibom` umbrella command
├── verifier/ # aibom_verifier: the provenance verification pipeline
├── docs/ # host integration and PoC guides
├── smokes/ # survey runnable checks (#26); not product / not CI
├── docker-compose.yml # local PoC stack only (see docs/poc-compose.md)
└── pyproject.toml # uv workspace root
uv sync --all-packages
uv run pytest -m "not network"
uv run pytest -m network
uv run ruff check .
uv run ruff format .
uv run ty checkContributing workflow and PR conventions: AGENTS.md.
| Doc | For |
|---|---|
| docs/job-contract.md | Host pipeline integrators |
| docs/poc-compose.md | Local Compose PoC (laptop only) |
| verifier/AGENTS.md | Verifier internals and backends |
| smokes/README.md | Fingerprint survey checks |
| AGENTS.md | Board protocol and agent workflow |