{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:f19f3a2e-642a-46fe-a894-daa9e313902a","version":1,"metadata":{"timestamp":"2026-10-15T01:06:32Z","tools":{"components":[{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"group":"","name":"src","version":"latest","type":"application","purl":"pkg:generic/src@latest","bom-ref":"pkg:generic/src@latest"},"properties":[{"name":"cdx:bom:componentNamespaces","value":"local"},{"name":"cdx:bom:componentTypes","value":"generic"},{"name":"cdx:bom:inferredRootDependencies","value":"3"}]},"components":[{"group":"","name":"tiny-llama.gguf","type":"file","bom-ref":"urn:file:ai:tiny-llama.gguf","tags":["ai","gguf","model-artifact-file"],"properties":[{"name":"cdx:ai:kind","value":"model-artifact-file"},{"name":"cdx:ai:source","value":"source-code-analysis"},{"name":"cdx:file:kind","value":"model-artifact-file"},{"name":"cdx:gguf:formatVersion","value":"3"},{"name":"cdx:gguf:metadataCount","value":"2"},{"name":"cdx:gguf:tensorCount","value":"0"},{"name":"cdx:gguf:tokenizerAddedTokenCount","value":"0"},{"name":"cdx:gguf:tokenizerMergeCount","value":"0"},{"name":"cdx:gguf:tokenizerTokenCount","value":"0"}],"evidence":{"occurrences":[{"location":"tiny-llama.gguf"}]}},{"group":"local","name":"tiny-llama","purl":"pkg:generic/local/tiny-llama","pedigree":{"notes":"Detected variants: quantized"},"modelCard":{"modelParameters":{"architectureFamily":"llama"}},"type":"machine-learning-model","bom-ref":"cdxgen:ai:model:local:tiny-llama","tags":["ai","gguf","local-model","machine-learning-model","quantized"],"properties":[{"name":"cdx:ai:artifactFormat","value":"gguf"},{"name":"cdx:ai:confidence","value":"high"},{"name":"cdx:ai:kind","value":"model"},{"name":"cdx:ai:modelFamily","value":"llama"},{"name":"cdx:ai:provider","value":"local"},{"name":"cdx:ai:reviewNeeded","value":"true"},{"name":"cdx:ai:runtime","value":"llama.cpp"},{"name":"cdx:ai:source","value":"local-artifact"},{"name":"cdx:gguf:tokenizerAddedTokenCount","value":"0"},{"name":"cdx:gguf:tokenizerMergeCount","value":"0"},{"name":"cdx:gguf:tokenizerTokenCount","value":"0"}],"evidence":{"occurrences":[{"location":"tiny-llama.gguf"}]}},{"group":"","name":"tiny-classifier.safetensors","type":"file","bom-ref":"urn:file:ai:tiny-classifier.safetensors","tags":["ai","model-artifact-file","safetensors"],"properties":[{"name":"cdx:ai:kind","value":"model-artifact-file"},{"name":"cdx:ai:source","value":"source-code-analysis"},{"name":"cdx:file:kind","value":"model-artifact-file"},{"name":"cdx:safetensors:dtypes","value":"F32"},{"name":"cdx:safetensors:tensorCount","value":"1"}],"evidence":{"occurrences":[{"location":"tiny-classifier.safetensors"}]}},{"group":"local","name":"tiny-classifier","purl":"pkg:generic/local/tiny-classifier","type":"machine-learning-model","bom-ref":"cdxgen:ai:model:local:tiny-classifier","tags":["ai","local-model","machine-learning-model","safetensors"],"properties":[{"name":"cdx:ai:artifactFormat","value":"safetensors"},{"name":"cdx:ai:confidence","value":"medium"},{"name":"cdx:ai:kind","value":"model"},{"name":"cdx:ai:modelFamily","value":"tiny"},{"name":"cdx:ai:parameterCount","value":"4"},{"name":"cdx:ai:provider","value":"local"},{"name":"cdx:ai:reviewNeeded","value":"true"},{"name":"cdx:ai:source","value":"local-artifact"},{"name":"cdx:safetensors:dtypes","value":"F32"}],"evidence":{"occurrences":[{"location":"tiny-classifier.safetensors"}]}},{"group":"","name":"tiny-graph.onnx","type":"file","bom-ref":"urn:file:ai:tiny-graph.onnx","tags":["ai","model-artifact-file","onnx"],"properties":[{"name":"cdx:ai:kind","value":"model-artifact-file"},{"name":"cdx:ai:source","value":"source-code-analysis"},{"name":"cdx:file:kind","value":"model-artifact-file"}],"evidence":{"occurrences":[{"location":"tiny-graph.onnx"}]}},{"group":"local","name":"tiny-graph","purl":"pkg:generic/local/tiny-graph","type":"machine-learning-model","bom-ref":"cdxgen:ai:model:local:tiny-graph","tags":["ai","local-model","machine-learning-model","onnx"],"properties":[{"name":"cdx:ai:artifactFormat","value":"onnx"},{"name":"cdx:ai:confidence","value":"high"},{"name":"cdx:ai:kind","value":"model"},{"name":"cdx:ai:modelFamily","value":"tiny"},{"name":"cdx:ai:provider","value":"local"},{"name":"cdx:ai:reviewNeeded","value":"true"},{"name":"cdx:ai:source","value":"local-artifact"},{"name":"cdx:onnx:irVersion","value":"8"},{"name":"cdx:onnx:opsets","value":"ai.onnx:17"},{"name":"cdx:onnx:producer","value":"scab"}],"evidence":{"occurrences":[{"location":"tiny-graph.onnx"}]}}],"dependencies":[{"ref":"pkg:generic/src@latest","dependsOn":["cdxgen:ai:model:local:tiny-classifier","urn:file:ai:tiny-graph.onnx","urn:file:ai:tiny-llama.gguf"]},{"ref":"urn:file:ai:tiny-llama.gguf","dependsOn":["cdxgen:ai:model:local:tiny-llama"]},{"ref":"cdxgen:ai:model:local:tiny-classifier","dependsOn":["urn:file:ai:tiny-classifier.safetensors"]},{"ref":"urn:file:ai:tiny-graph.onnx","dependsOn":["cdxgen:ai:model:local:tiny-graph"]}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:generic/src@latest"],"annotator":{"component":{"group":"@cdxgen","name":"cdxgen","version":"13.4.0","purl":"pkg:npm/%40cdxgen/cdxgen@13.4.0","type":"application","bom-ref":"pkg:npm/@cdxgen/cdxgen@13.4.0","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-10-15T01:06:32Z","text":"This Machine-Learning Bill-of-Materials (ML-BOM) document was created on Thursday, October 15, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'src'. It inventories 3 AI model(s), 0 AI service(s), and 0 dataset(s). Pedigree information is captured for 1 model(s), which helps reviewers trace upstream bases and downstream variants. Detected model variants include quantized, so modified artifacts remain visible in the BOM. There are 6 components. The package type in this ML-BOM is generic with a single purl namespace 'local' described under components."}]}