JFrog Introduces Generative AI Model into DevSecOps

DevSecOps company JFrog announced the integration of artificial intelligence (AI) and generative AI models with its existing secure software supply chain platform based on Artifactory and Xray.

The foundational models are the basic building blocks of generative AI. Similar to software libraries, these models are now available in open source and commercial versions. The open source foundational models are released on Hugging Face, which has quickly become the GitHub equivalent for AI models.

Enterprise developers download AI models from Hugging Face and integrate them with locally deployed applications. This approach carries the same risks as cloning GitHub repositories, building software, and integrating it with local applications. The licenses for the foundational models provided on Hugging Face range from permissive to more restrictive.

JFrog's new ML model management feature enables DevOps and security teams to leverage existing JFrog solutions, meet their organization's MLOps requirements, and seamlessly integrate into the workflows of ML engineers and data scientists. As a result, organizations can extend their secure software supply chain by applying existing practices and policies to ML model development.

JFrog offers two products, Artifactory and Xray, to protect ML models simultaneously.

JFrog Artifactory is a unified repository for storing and managing all artifacts, binary files, packages, files, containers, and components used in the software supply chain.

JFrog Xray is a universal software composition analysis (SCA) solution directly integrated with Artifactory. This enables developers and DevSecOps teams to discover open source vulnerabilities and license compliance violations before production release. Xray can detect security vulnerabilities and license compliance issues early in the dependency declaration stage and prevent builds with security issues. It provides automation and continuous governance, as well as auditing capabilities for software artifacts and their dependencies.

The integration of JFrog Artifactory with Hugging Face allows organizations to create a unified record system for ML models, keeping ML/AI development consistent with the existing software supply chain, enabling data scientists and developers to treat models like any other software component. By using remote repositories, proxying and caching machine learning models from Hugging Face on Artifactory, it provides fast, consistent, and reliable access to foundational models. Tuned and customized models can be stored locally in Artifactory.

In addition, by leveraging the ML security capabilities of JFrog Xray, organizations can detect and prevent malicious models as well as non-compliant licensed models.

As foundational models and LLM (low-level machine learning) models become more common, enterprises need a unified and consistent mechanism to integrate these models with applications. JFrog applies these mature and familiar capabilities to generative AI models by extending support for secure scanning and local caching of Hugging Face models on top of the secure software supply chain. It is one of the first DevSecOps platforms to support secure scanning and local caching of Hugging Face models.