A DBOM (Decision Bill of Materials) is a digital document that traces all the steps that led to a decision made by an AI system. Just as its ancestor, the SBOM (Software Bill Of Materials), the DBOM helps to understand the role of components in a more and more complex software world. Any DBOM is cryptographically signed and meant to be used in combination with Confidential Computing, in order to guarantee its integrity.
Thoroughly document high-risk (AI)
decisions
A DBOM can help enforce documentation and transparency requirements. Just as software
developers are often required to provide a Software Bill of Materials (SBOM), AI service
providers can use a DBOM to demonstrate compliance with the stringent regulatory
requirements that apply to high-risk AI systems and use cases.
Tamper-proof
Using Confidential Computing, it is possible to
generate a DBOM on cloud infrastructure without risking manipulations by the
infrastructure provider or an inside attacker.
Effective forensics
While the DBOM alone can not prevent dangerous AI
decisions, it can be used to trace back potential causes and to clearly attribute
responsibility.
Ready for tooling
The DBOM provides a unified interface, which we plan
to use for automated analysis. A DBOM is hard to understand for a human, but ready for
automated reasoning.
Traces impact
Just as an SBOM helps trace the
impact of a vulnerable dependency, DBOM helps trace manipulated or biased datasets,
outdated training tools, flaws in training, and more.
is a hardware technology, where the CPU shields and encrypts the living memory during runtime, thus protecting against attackers with full system access.
The EU AI act classifies AI systems as a High-Risk AI systems, whenever they are posing significant threats to health, safety, or fundamental rights.
is the short form of Software Bill of Materials. It is an electronic document that lists all the components of a software: dependencies, build system etc. Providing an SBOM has become mandatory in some security-critical contexts.
DBOM is an initiative of Project C3 of the Center for Perspicuous Computing (CPEC), a Transregional Collaborative Research Centre, financially supported by the Deutsche Forschungsgemeinschaft and carried out jointly by Universität des Saarlandes and Technische Universität Dresden.
The DBOM team members are: