A signed CycloneDX AI bill of materials and fail-closed admission gate for clinical AI agents

Quickstart · How it works · Reproduce · Results · Paper · Dataset · Cite

---

A clinical AI agent is assembled from base weights, fine-tunes, prompts, rules, detector models, hundreds of library dependencies, tool servers, and reference data, any of which can be backdoored, typosquatted, or left with no verifiable origin before the agent ever runs; weight attestation and the runtime firewall check none of this. The admission module runs once at gateway startup: it enumerates every loaded component into a signed CycloneDX 1.5 AIBOM, verifies per-component SHA-256 digests and the document's ed25519 signature, matches components against a pinned OSV vulnerability snapshot, refuses to start (fail-closed) on any tampered, vulnerable, or required-but-unattested component, and stamps the verified AIBOM digest into the quledger audit chain. On SupplyChainBench the layered gate detects 100% of attacks (15/15 across S1-S5) with zero per-request cost and under 100 ms one-time startup, while 464/465 (99.8%) of this repo's real build stack is attestable today and model weights, tool servers, and reference data remain the measured provenance gap.

▶ Watch: Qubom: AI Supply Chain Integrity (talk)

qubom is a module of the QUOKKAGUARD program: one Rust security gateway (qfire) that sits in front of any OpenAI-compatible model endpoint and decides ALLOW ▸ forward · BLOCK ▸ refuse · ESCALATE ▸ human review for every request and response. Each module adds exactly one enforcement layer to that gateway plus one adversarial dataset and one paper. This repository is a self-contained snapshot of the gateway with this layer (src/admission/, on the admission path, HAARF control C3 (C3.3, C2.8, C3.5)), its dataset (SupplyChainBench), the experiment harness, and the paper.

Everything here runs offline: no model API keys, no network calls in the experiments.

How it works

• Enumeration into a CycloneDX 1.5 AIBOM — at startup Aibom::enumerate walks the rules and chains directories, the config file, an optional ONNX detector model, and Cargo.lock; each component carries a quokkaguard:class (rule, chain, config, model, library, provider, mcp, data), a SHA-256 hash where one is computable (file digest for file-backed components, registry checksum for libraries), and a quokkaguard:attested flag.
• ed25519 attestation — the whole document is signed with the quledger AuditSigner key (aibom.key, attestation-released in the enclave); qfire aibom verify checks the signature against a pinned public key (defeating a re-sign under an attacker key) and re-hashes every file-backed component to list tampered names.
• Vulnerability matching — components are joined against a pinned OSV snapshot by a hash-map lookup (qfire aibom scan --osv), so a newly disclosed advisory is flagged on the very next scan; a live-OSV adapter is documented and fails closed until wired.
• Fail-closed admission gate — under enforce = block (the enclave default) any tampered, known-vulnerable, or required-but-unattested component refuses gateway startup; enforce = warn (dev default) logs and proceeds so Ollama-served weights, which no attestation reaches, still run locally. The gate runs once, so per-request cost is zero by construction.
• Audit stamping — the verified AIBOM digest is appended to the quledger tamper-evident chain as a kind:"admission" entry, the only change this module makes to the chain format.

Quickstart

Requires Rust 1.85+ (rustup), Python 3.10+ for the analysis scripts, and tectonic (or pdflatex) only if you want to rebuild the paper.

git clone https://github.com/quome-cloud/qubom
cd qubom
cargo build --release
cargo test --lib admission:: && cargo test --test admission_supplychain   # this layer's tests

Then see the layer in action:

# 1. Enumerate this repo's real stack (rules/, chains/, Cargo.lock) into a signed CycloneDX AIBOM
#    -> {"components": ~465, "provenance_gap": 1, "digest": "...", "out": "aibom.json"} (creates aibom.key on first run)
./target/release/qfire aibom generate --rules rules --chains chains --cargo-lock Cargo.lock \
  --key aibom.key --out aibom.json

# 2. Verify the signature and every file-backed component digest
#    -> {"signature_ok": true, "tampered": [], "ok": true}, exit 0
./target/release/qfire aibom verify --aibom aibom.json

# 3. Scan the AIBOM against the pinned OSV snapshot -> [] and exit 0 when clean (exit 2 with matches)
./target/release/qfire aibom scan --aibom aibom.json --osv scripts/004-supply-chain/osv_snapshot.json

# 4. Tamper one rule file and re-verify -> "tampered": ["rules/healthcare/dose_goal_integrity.yaml"], exit 2
echo '# tampered' >> rules/healthcare/dose_goal_integrity.yaml
./target/release/qfire aibom verify --aibom aibom.json; echo "exit=$?"   # exit=2
git checkout rules/healthcare/dose_goal_integrity.yaml   # restore

Reproduce the experiments

Every number in the paper traces to one of these runs (95% Wilson CIs, deterministic seeds, pinned model snapshots). Run outputs land in results/004-supply-chain/ (not tracked; see results/004-supply-chain/README.md for the exact regeneration commands).

Exp	What it measures	Needs
E1	Supply-chain detection coverage: cumulative ablation of digest-only, +signature/attestation, +CVE layers over the S1-S5 corpus	offline
E2	Provenance gap: attested vs unattested share of the real repo stack from qfire aibom generate, by component class	offline
E3	CVE flag timeliness: a clean dependency becomes flagged on the next scan after its advisory enters the OSV snapshot	offline
E4	Admission overhead: enumerate+sign and verify wall time vs component count (10, 100, ~1000 rule files)	offline
test	Rust integration test asserting every S1-S5 manifest is detected by the appropriate layer	offline
figs	Regenerate the four paper figures and build the PDF	offline

# E1 — Supply-chain detection coverage: cumulative ablation of digest-only, +signature/attestation, +CVE layers over the S1-S5 corpus
cargo build --release && python3 scripts/004-supply-chain/experiments.py   # runs E1-E4 -> results/004-supply-chain/{s_coverage,provenance_gap,cve_timeliness,overhead}/summary.json

# E2 — Provenance gap: attested vs unattested share of the real repo stack from qfire aibom generate, by component class
python3 scripts/004-supply-chain/experiments.py   # E2 is part of the same single driver (qfire aibom generate over rules/, chains/, Cargo.lock)

# E3 — CVE flag timeliness: a clean dependency becomes flagged on the next scan after its advisory enters the OSV snapshot
python3 scripts/004-supply-chain/experiments.py   # E3 is part of the same single driver (two qfire aibom scan passes)

# E4 — Admission overhead: enumerate+sign and verify wall time vs component count (10, 100, ~1000 rule files)
python3 scripts/004-supply-chain/experiments.py   # E4 is part of the same single driver

# test — Rust integration test asserting every S1-S5 manifest is detected by the appropriate layer
cargo test --test admission_supplychain

# figs — Regenerate the four paper figures and build the PDF
python3 scripts/004-supply-chain/make_figs.py && cd papers/004-supply-chain && make paper

Dataset — SupplyChainBench (datasets/004-supply-chain/): A clean CycloneDX 1.5 clinical-agent-profile AIBOM plus 15 labeled tampered copies spanning five supply-chain attack classes (S1 weight tamper, S2 known-vulnerable dependency, S3 typosquat, S4 stripped provenance, S5 data tamper) with labels.json ground truth; fully synthetic, seed 42, paired with the pinned OSV snapshot in scripts/004-supply-chain/osv_snapshot.json.

Regenerate the corpus (deterministic seeds):

python3 scripts/004-supply-chain/gen.py --out datasets/004-supply-chain --per-class 3 --seed 42

The corpus is also published as a Hugging Face dataset with a full data card: Quome/supplychainbench (datasets.load_dataset("Quome/supplychainbench"), or hf download Quome/supplychainbench --repo-type dataset).

All data are synthetic; no protected health information is used anywhere in this repository.

Results at a glance

Figures are reproduced from the paper; every number regenerates from the commands in Reproduce the experiments.

The paper in one figure (E1): a three-layer ablation over SupplyChainBench. Digest verification catches in-place weight/data tampering and stripped provenance (S1/S4/S5); signature and identity verification adds typosquat detection (S3); vulnerability matching adds known-bad components (S2). All three layers together reach 100% detection.

The provenance gap (E2): the enumerable build stack is 99.8% attestable (libraries by checksum, rules and chains by digest). The real gap is the schema-reserved frontier — model weights, tool servers, reference data — which no attestation reaches today.

CVE timeliness (E3): a newly disclosed advisory is flagged on the next scan after it enters the feed; the mechanism adds no latency of its own.

Admission overhead (E4): a one-time startup cost, roughly linear in component count, with no per-request verification.

Headline results

Metric	Value	Context
Supply-chain detection coverage (E1)	100% (15/15)	digest catches S1/S4/S5, signatures catch S3, CVE matching catches S2; no single layer exceeds 3 of 5
Provenance gap on the real build stack (E2)	464/465 components attestable (99.8%); libraries 382/383	weights, tool servers and reference data remain unattestable by nature
CVE flag timeliness (E3)	1 scan interval	hash-map join on the AIBOM adds no latency of its own
Admission generate cost (E4)	10.4 ms at 10 components, 22.4 ms at 100, 98.2 ms at ~1000	one-time startup cost, roughly linear in component count
Admission verify cost (E4)	53.1 ms for a 1000-component AIBOM	per-request cost is zero by construction

Full methodology, ablations, and statistics: the paper.

The paper

AI Supply-Chain Integrity for Confidential Clinical Agents: AIBOM Attestation and the Provenance Gap

• PDF: papers/004-supply-chain/main.pdf
• Source: papers/004-supply-chain/ — main.tex, numbers.tex (every headline macro, generated by the scripts above), figs/, refs.bib
• Pre-registered proposal (threat model, hypotheses, experiment→figure map): papers/004-supply-chain/PROPOSAL.md
• Rebuild: cd papers/004-supply-chain && make paper (tectonic, or pdflatex + bibtex)

Repository layout

Path	What
src/	The qfire gateway crate. This paper's layer lives in src/admission/; the other modules are the always-on baseline it plugs into.
src/bin/	CLI (qfire) and per-paper experiment harnesses
rules/, chains/	Declarative rule and detector-chain library used by the gateway
datasets/004-supply-chain/	SupplyChainBench (also on Hugging Face: Quome/supplychainbench)
scripts/004-supply-chain/	Dataset generator, experiment runners, figure and numbers.tex builders
scripts/common/	Shared helpers
papers/004-supply-chain/	The paper (LaTeX + PDF + proposal)
results/004-supply-chain/	Experiment outputs (see above)
tests/, benches/	Integration tests and Criterion benches
SNAPSHOT.md	Which quokkaguard commit this repo was exported from

Relationship to QUOKKAGUARD

This repo is a snapshot of the QUOKKAGUARD program's gateway (export 69729f25711e, 2026-10-02), filtered to the qubom module. The full qfire crate is included so this layer builds, tests, and runs standalone; the other modules are the always-on baseline the layer plugs into. Issues and pull requests are welcome here.

This layer builds on: quanchor, quledger.

Sibling repos in the series: quanchor, quledger, quwarden, qudam, quantidote, quorum, qutriage, qufair, qudrift, qupassport, quconsent, qubroker, qusiege.

Cite

If you use this code or dataset, cite the paper and the HAARF framework it implements:

@unpublished{schwoebel2026qubom,
  author = {Schwoebel, James},
  title  = {AI Supply-Chain Integrity for Confidential Clinical Agents: AIBOM Attestation and the Provenance Gap},
  note   = {Preprint. Quome, QUOKKAGUARD program (qubom module)},
  year   = {2026},
  url    = {https://github.com/quome-cloud/qubom}
}

@unpublished{schwoebel2026haarf,
  author = {Schwoebel, Jim and Frasch, Martin and Spalding, Art and Sewell, Ed and Englert, Phil and Halpert, Ben and Overbay, Collin and Semenec, Ingrida and Shor, Joel},
  title  = {{HAARF}: Healthcare {AI} agents regulatory framework --- a comprehensive security verification standard for autonomous {AI} systems in clinical environments},
  note   = {medRxiv Preprint},
  year   = {2026},
  month  = {April},
  doi    = {10.64898/2026.04.09.26350519},
  url    = {https://www.medrxiv.org/content/10.64898/2026.04.09.26350519v1}
}

Status

Research prototype. It demonstrates the layer end to end with reproducible experiments; it is not a certified medical device or a production security product. Threat-model boundaries and known gaps are in the paper's Discussion.

License

Apache License 2.0 — see LICENSE. Copyright (c) 2026 Quome, Inc.