All the comments saying "this misses the point, it isn't the software, it's the data" are missing the point themselves: trained models are being released and in

All the comments saying "this misses the point, it isn't the software, it's the data" are missing the point themselves: trained models are being released and informally used as software components. The consequence of datasets being used for training (and trained models being incorporated into software) typically via a line of curl or wget in some setup code, is to leave the dependency, essentially, undeclared. Yes, any biases in those models are more likely to be uncovered because of their public availability, and yes, the biases uncovered will probably be due to biases in the data, but right now we don't really have (or aren't using) processes, tooling, or infrastructure to do the necessary versioning and tracing of data or model dependencies. In fact, when some researcher discovers a bias in a model and publishes it, most often no new version of the model or the data it is based on is released. If by chance the biases are addressed and new versions of a particular model and dataset are released, all the other models based on the same data are left unaffected. And software that incorporates the biased models is unaffected by their re-release as well. Nothing will ever trigger those models to be marked as biased, retrained, and re-released, and typically nothing marks the dependent software as vulnerable to the bias either.