Add ML-artifact / ML-BOM fragment and adversarial-risk metadata for model-based components

[github-actions]

Motivation

Automotive systems increasingly include ML models (ADAS, perception stacks). CycloneDX and adjacent communities have formalized ML-BOM/ML-BOM guidance (CycloneDX ML-BOM guide) to describe model artifacts, provenance, and dataset references. RDX currently models itemDefinitions and components but lacks a first-class ML artifact fragment describing model weights, training datasets, evaluation metrics, and adversarial/poisoning risk metadata. Adding a well-scoped ML-artifact object allows RDX to capture unique TARA properties for models (poisoning, data lineage, robustness metrics), link them to attackPaths/TAF, and interoperate with SBOM/ML-BOM workflows.

This builds on RDX goals for SBOM interoperability (RDX-002), technology/version enhancements (RDX-079), and hashing/integrity support (RDX-110).

Proposed change

1. Add a new optional mlArtifacts[] array under riskSet.itemDefinition or itemDefinition.components[] (allow reference by componentId). Suggested fields:

   • id (string), title, description
   • componentRef (id of the component this artifact belongs to)
   • artifactType (enum: "model","weights","dataset","preprocessor","container")
   • framework (string) e.g. "PyTorch 2.3.1"
   • version (semver-like string)
   • hashes[] (array) — algorithms supported: SHA-256, SHA-512 (align with RDX-110)
   • provenance (object) — SLSA/attestationRef, buildDate, builderId, sourceRepositoryRef
   • trainingDataRef (URI or registry id), trainingDataHash
   • evaluationMetrics (object) — accuracy, F1, robustnessBenchmarks (list of named tests), testDates
   • adversarialRisk (object) — poisoningRisk (low/med/high + rationale), evasionRisk, supplyChainRiskFlags
   • runtimeConstraints (object) — memory, expected input types, hardware acceleration requirements, TEE/secure-enclave requirement
   • regulatoryNotes[] — optional notes for certification/regulator mappings

2. Provide example examples/rdx-mlbom-example.json showing an itemDefinition with components including an mlArtifacts[] entry, hashes, provenance and a TAF-adjusted attackPath (e.g., model poisoning step linked to a TAF attacker profile).

3. Define mapping guidance between CycloneDX ML-BOM fragments and RDX mlArtifacts so that CycloneDX-embedded RDX can link to a components[x].pedigree or externalReferences in the BOM.

4. New requirement id (to add to REQUIREMENTS.md):

   • RDX-117 (new requirement): "Support ML-artifact metadata (ML-BOM fragment) including model provenance, dataset references, evaluation metrics, and adversarial risk annotations for model-based components."

References

• CycloneDX ML-BOM authoritative guide / ML-BOM concepts (CycloneDX project). https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-AI-ML-BOM-en.pdf
• SLSA / provenance guidance for build provenance (relevant practices to reference in provenance fields). https://slsa.dev
• Example ML-BOM / ML provenance discussions in industry guidance (see e.g., academic and standards discussions on ML BOMs and dataset hashes).

Acceptance criteria

• Schema: Add mlArtifacts[] to spec/json/rdx.schema.json and to spec/xml/rdx.xsd (XSD parity). Field names and types match the description above.
• Examples: examples/rdx-mlbom-example.json and an embedded CycloneDX example demonstrating linkage between a BOM component and an mlArtifacts entry.
• Tools: tools/validate.sh updated to validate new example(s). Add a small helper tools/verify_ml_artifact_hashes.py that verifies declared hashes against local artifact files (optional for CI in a dry-run mode).
• Documentation: methodology/ updated with "ML-artifacts and adversarial risk" describing intended usage, recommended hash algs (SHA-512 for weights), and how to link to TAF attacker profiles and CAL assessment evidence for model verification.
• REQUIREMENTS.md updated with RDX-117 and cross-references to RDX-002, RDX-079, and RDX-110.

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.

[JohnASRG]

This is out of scope for now.