Validating GPU Platforms with Runtime AI Inventory via the NVIDIA DSX AI Factory

Nvidia's open-source AI Cluster Runtime, part of its DSX AI Factory platform, now includes k8s-aibom, an open-source Google project that inventories AI workloads on Kubernetes. It records which model is serving, which runtime serves it, and which container image is in use, and emits a standard CycloneDX 1.6 AI bill of materials for each recognized workload.

The point is the gap between what a platform team configured and what application teams actually deployed. Mutable image tags like latest mean two nodes can run different code under the same name, and an image pulled next week might never have been through security review.

We think this is the kind of unglamorous work that makes AI safer to run at scale. A regular software bill of materials tells you which image is running. An AI bill of materials tries to say which model is serving and how confident the inventory is about that claim, using tiers labeled declared, inferred, unresolved or verified, each with an evidence pointer. For security reviews, incident response and audits, that is useful.

Shadow AI is a real problem inside companies. Teams spin up inference servers, wire in external AI APIs and vector databases, and leave little trace. Nvidia says the tool can help find unregistered workloads in namespaces chosen for reporting and detect drift in AI dependencies. The measured overhead is small, roughly four API-server requests a minute and about 2.2 millicores of CPU in steady state.

Nvidia is also unusually candid about the limits, and we'd stress them. The runtime observations are unsigned. Signature verification of model claims is off by default. An inventory record can say Ready while a pod is still pulling its image, and it doesn't prove a workload ran successfully. Inventory is opt-in per namespace, though the controller still reads workload specs cluster-wide.

So this is visibility, not assurance. That's still progress. The risk is that a green checkmark in a compliance dashboard gets mistaken for proof. I'm watching whether signing and provenance land as defaults.

AICR turns known-good GPU platform setups into version-locked recipes and reproducible deployment bundles. Two stock Google Kubernetes Engine H100 inference recipes select k8s-aibom by default, and other GKE recipes can opt in. The integration was tested with AICR v1.2.0 pinning k8s-aibom 1.6.2.