 ICACT20260281 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Good morning, everyone. My name is Heemin Choi, from the Department of Software Safety and Security at Kyonggi University. Today, I am pleased to present our research titled: A Blockchain-based Governance Framework for AIBOM Integrity and Automated Regulatory Compliance. |
| ICACT20260281 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
I will begin with the background and problem statement, followed by our core contributions.
Then, I will describe the proposed system architecture and its implementation, and finally, I will conclude with future work. |
| ICACT20260281 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
Slide 3 |
| ICACT20260281 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
Currently, AI systems are being deployed in safety-critical domains like healthcare and finance. Accordingly, global regulations such as the EU AI Act and the U.S. Executive Order 14110 are mandating strict transparency and traceability. In Korea, the MFDS has also released guidelines for generative AI medical devices. However, there are three critical gaps |
| ICACT20260281 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Slide 5 |
| ICACT20260281 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Slide 6 |
| ICACT20260281 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
To bridge these gaps, our research, iSBOMB, offers three main contributions
First, we ensure Integrity via blockchain anchoring. Second, we achieve Automation through an LLM-RAG pipeline. Third, we provide full Lifecycle management using DID-based accountable workflows. |
| ICACT20260281 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
8 |
| ICACT20260281 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
The iSBOMB framework consists of three layers. The Identity Layer verifies users via DID. The Data Layer stores AIBOM artifacts in IPFS. And the Blockchain Layer anchors the IPFS CID onto an Ethereum smart contract to ensure immutability. This hybrid approach balances data privacy and on-chain efficiency. |
| ICACT20260281 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
Slide 10 |
| ICACT20260281 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
11 |
| ICACT20260281 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
Looking at the workflow, when a developer registers an AIBOM, the system automatically anchors it to the blockchain. Regulators can then cross-check the on-chain CID with the actual data to verify its integrity instantly before proceeding with the approval process |
| ICACT20260281 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
13 |
| ICACT20260281 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
14 |
| ICACT20260281 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
For implementation, we used Hyperledger Indy for DID-based authentication, granting differential access rights. In Step 2, once an AIBOM is uploaded, its unique CID is permanently recorded on the blockchain through the registerAIBOM smart contract function. |
| ICACT20260281 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
Next is our core feature: the LLM-RAG pipeline. The LLM retrieves verified AIBOM metadata and automatically maps it to regulatory templates, such as those required by the KMFDS. This allows regulators to review materials and update the approval status on-chain with high efficiency. |
| ICACT20260281 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
Finally, for post-market surveillance, if a new vulnerability is identified, supervisors record it on-chain and link it to the specific AIBOM version. This ensures transparent incident management throughout the AIs entire lifecycle. |
| ICACT20260281 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
18 |
| ICACT20260281 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
In conclusion, iSBOMB provides a trustless and automated governance framework for AI. In the future, we plan to integrate Zero-Knowledge Proofs (ZKP) for privacy and evaluate scalability on Layer 2 environments, while extending compatibility with global standards like SPDX |
| ICACT20260281 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
Thank you for your attention. |
