Why it matters
NVIDIA argues that most proposed model CVEs actually describe vulnerable serving applications, unsafe serialization and supply-chain formats, access-control failures, or statistical behaviors shared by a model class. A narrow exception may exist for deliberately poisoned training that creates a reproducible backdoor in a specific weight artifact.
My takeaway: Assign a CVE to the smallest discrete component that owners can identify and patch. Put parser, loader, API, authorization, and output-handling flaws on the responsible software; track generic adversarial behavior with weakness taxonomies and test cases; and use signed provenance and artifact advisories for compromised weights, reserving model CVEs for specific reproducible backdoors.