Cisco fingerprints 900 open models as 69% of AI lineage claims go unverified

AI Supply Chain Provenance Explorer for Responsible AI Governance

Open source AI has never been more accessible. The rapidly growing scale and diversity of AI models available to developers worldwide is unprecedented. The harder question begins after download: when you bring a model into your environment, what exactly are you bringing in? A repository page may tell you a model's name, provider, and license. But responsible adoption often requires a fuller picture, knowing details such as: Where did the model come from? How has it changed? What restrictions accompany it? Are there any known security issues with the model? In an ecosystem shaped by research labs, startups, global technology companies, governments, and independent creators, access is only the first step. Responsible adoption starts with visibility. That is why we are excited to launch AI Supply Chain Provenance Explorer, a public resource that helps organizations evaluate open source AI models against their technical, governance, and risk-management requirements before they use them.* With almost 900 open models catalogued to date, the Provenance Explorer brings model details, provider context, provenance, security findings, licensing information, and usage restrictions into one place. Why Transparency and Visibility Matter Modern AI supply chains are rarely linear. Models are fine-tuned, distilled, merged, quantized, re-released, and repackaged, often many times over. Along the way, important context can be lost, simplified, or presented inconsistently. This presents practical problems for organizations. A model's license may require attribution or limit commercial use. Its provider's location may prompt additional regulatory, privacy, export-control, or policy review. Its lineage may be incomplete or unclear, potentially complicating incident response, compliance review, and internal approvals. Its repository may contain files that have not all been scanned or contain security issues. None of these signals necessarily disqualifies a model, but each can change the questions an organization should ask or investigate before deployment. What Provenance Explorer Brings Together Cisco AI Supply Chain Provenance Explorer helps organizations evaluate this critical component of the AI supply chain, and each model entry can include several categories of information: * Model details, including distribution source, release and update dates, parameter count, training tokens, training compute, and downloads, details to help assess scale, complexity, and likely operational fit. * Provider context, including organization's name, headquarters location, website, and associated Hugging Face organizations to inform any relevant jurisdictional, regulatory, privacy, and export-related considerations. * Model provenance and lineage information, including where a model came from and how it relates to prior models or variants over time. Rather than relying solely on self-reported lineages, we ground model relationships in similarity scores powered by Cisco Model Provenance Kit static fingerprinting and Project VAIL run-time behavioral fingerprinting. * Licensing information and usage restrictions, including common limitations such as attribution requirements, non-commercial terms, geographic restrictions, modification constraints, or prohibited use cases. * Security assessments, including ClamAV-based scanning of model repository files, the number of files scanned, and reported vulnerability findings. The information is regularly updated and verified by experts on Cisco AI Threat & Security Research team and with partners at Project VAIL. Building on Our Broader Provenance Work AI Supply Chain Provenance Explorer is part of Cisco's broader work to improve transparency, accountability, and trust across the AI ecosystem. Last year, in collaboration with HuggingFace, we advanced AI supply chain security by launching a comprehensive malware scanning and threat intelligence sharing tool. Earlier this year, we introduced Model Provenance Kit, an open source toolkit that helps determine whether models share a common origin by analyzing architecture metadata, tokenizer structure, and model weights. We also introduced the Model Provenance Constitution, which defines provenance as the verifiable derivation history of a model's trained weights and establishes a rigorous standard for what counts as a provenance relationship. Those efforts address an important industry problem: provenance cannot rely on naming conventions or self-reported metadata alone. Reliable governance depends on clearer definitions, better evidence, and tools that help practitioners operationalize both. AI Supply Chain Provenance Explorer extends that work by making decision-relevant model information easier to access and interpret for a wider audience. For developers, that may mean comparing model scale, task, and licensing before choosing a baseline. For security teams, it may mean identifying models that warrant deeper review. For governance and legal stakeholders, it may mean spotting license obligations, usage restrictions, or provider considerations earlier in the process. For executive leaders, it means supporting AI adoption with better transparency into the components entering the enterprise stack. Responsible AI Starts with Knowing What You Are Using As organizations adopt more open source AI, understanding and verifying the provenance of AI models is essential for organizations seeking to responsibly deploy AI technologies. AI Supply Chain Provenance Explorer gives teams a clearer way to examine origin, transformation, ownership, licensing, and security signals before a model enters a production environment. Explore AI Supply Chain Provenance Explorer today at https://provenance.aidefense.cisco.com

The lineage behind 69% of open models was never verified. Cisco just fingerprinted almost 900 for free

A security team approving an open-source model for production today starts with a repository page. The page lists the model name, the license, and a tag identifying the base model it descended from. That tag is a string the uploader typed. Hugging Face does not require uploaders to substantiate the claim through weight-level analysis. The ATOM Report, published by Nathan Lambert and Florian Brand at Interconnects AI in April 2026, tracked roughly 1,500 mainline open models. ATOM identifies derivatives through the Hugging Face base_model tag, a field the uploader populates, filtering to models whose base model appears in the tracked list and that have more than five lifetime downloads and excluding GGUF and MLX re-uploads. By that measure, Alibaba's Qwen family is the declared parent of 69% of new open-model derivatives as of February 2026, up from 1% in January 2024. Chinese labs overall account for 70%. Europe sits at 4%. Cumulative tracked downloads across the three regions reached 2.04 billion through March 2026. The verification gap extends to scan coverage. Cisco Foundation AI scans every public file uploaded to Hugging Face through an updated ClamAV engine, and the platform surfaces a file-level badge per file. Hugging Face's own malware scanning documentation notes a file with neither an ok nor an infected badge may be queued, still scanning, or errored. At a given review point, a repository may contain files without completed scan results. Coverage has been an assumption, not an attribute anyone could read before approving a model. From command line to public lookup Cisco on Thursday published the AI Supply Chain Provenance Explorer, a free public database covering almost 900 open models. Each entry can carry provider headquarters, a fingerprinted lineage graph, license restrictions, and a files-scanned count. The tool extends Cisco's Model Provenance Kit, an open-source Python toolkit released in April that fingerprinted roughly 150 base models across 45+ families and 20+ publishers. Coverage grew roughly sixfold in a quarter. The April release was a command-line tool. Running it meant a local Python environment, downloading model weights that run into tens of gigabytes, and dedicating engineer hours per model. The Explorer queries results Cisco already computed. On Thursday, verifying parentage starts with a search bar, and cost is why enterprises run open weights in the first place. Amy Chang, head of AI Threat Intelligence and Security Research at Cisco, has been building the case for why verification gaps matter. During a VB Transform 2026 agentic security panel, Chang presented findings from 6,986 multi-turn attacks against 15 flagship models, with success rates reaching 88.3%. "If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang told the audience. Understanding failure points starts with knowing which model you are running. The Explorer also surfaces data Cisco already uses operationally. The company's Cerberus system inspects models entering Hugging Face and feeds Secure Access policies that block by risky license or region of origin. The Explorer makes that class of information free and searchable without a Cisco product. How fingerprinting replaces the tag The Explorer grounds model relationships in similarity scores rather than self-reported metadata. Cisco's Model Provenance Kit works in two scored stages. Stage one compares architecture metadata before loading any weights. When metadata is ambiguous, stage two extracts five weight-level signals. Embedding Anchor Similarity captures geometric relationships that survive fine-tuning. Embedding Norm Distribution encodes word frequency patterns. Norm Layer Fingerprint reads layers stable across fine-tuning. Layer Energy Profile compares distributions across network depth. Weight-Value Cosine directly compares weight values, and independently trained models show essentially zero correlation on this signal. Cisco reported 96.4% accuracy on its own 111-pair benchmark at a 0.70 threshold, with an F1 of 0.963. Four pairs were misclassified, all involving extreme architectural transformation that Cisco calls a fundamental limit of pairwise weight comparison. Tokenizer signals are computed for diagnostics but deliberately excluded from the provenance score. StableLM and Pythia both use the GPT-NeoX tokenizer and would score as related despite sharing no weight lineage. Excluding tokenizer data prevents false positives. Behavioral fingerprinting adds a second approach. Jonah Leshin, Manish Shah, and Ian Timmis at Project VAIL, working with Daniel Kang at UIUC, published work on behavioral endpoint stability showing that a model endpoint can stay healthy while its effective identity changes through weight updates, quantization, or routing. Cisco's launch blog states the Explorer integrates both static fingerprinting and behavioral-similarity analysis to ground the lineage graph. Static analysis supplies weight-level evidence of training-time derivation. Behavioral analysis catches runtime identity drift. Where existing tools fall short The Explorer carries real limits. Almost 900 models is a meaningful start, but Hugging Face hosts more than 2 million as of spring 2026. Models outside the boundary still depend on the self-reported tag. Cisco has not said whether the Explorer exposes an API, and without one, a team can look models up by hand but cannot wire the check into a CI gate. That is the line between a governance artifact and a control. Traditional SCA tools face a structural mismatch because they were built for dependency manifests and container images. Sakshi Grover, senior research manager for cybersecurity at IDC, said in CSO Online that traditional SCA "was designed to inspect dependency manifests, libraries, and container images" and "is far less effective at identifying" the risks tied to AI workflows. Gartner director analyst Jaishiv Prakash told the same outlet that enterprises need "dedicated controls for model sources, approved versions, access, and runtime validation at the registry layer." Both were commenting on broader supply chain risks, but the gap they describe is the one the Explorer targets. Cisco's Model Provenance Constitution defines where one model counts as a derivative of another. The constitution defaults to labeling ambiguous pairs as independent, because a false positive triggers a licensing accusation while a false negative gets caught during manual review. That deliberate conservatism supports the 96.4% accuracy figure. Derivation is not binary, and fingerprinting is one form of evidence alongside documentation and checkpoint verification. What goes in the approval record On August 2, the European Commission gains its AI Act enforcement powers over GPAI model providers, with fines up to 15 million euros or 3% of global turnover, whichever is higher. Organizations that substantially modify and place an open model on the EU market can acquire provider status, with Commission guidance treating modification compute exceeding one-third of the original's. The Act's open-source exemption under Article 53(2) requires a genuinely free and open-source license permitting access, use, modification, and redistribution, with weights, architecture, and usage information all public. Public weights alone do not qualify. Llama's community license carries a monthly-active-user threshold and a disqualifier the Commission guidance names explicitly. Llama and Gemma together account for roughly a fifth of new derivatives in the ATOM counts, and both carry licenses the Commission criteria would likely disqualify. License classification becomes part of the provenance review, and that is exactly what the Explorer surfaces. The board question that arrives first after a base-model vulnerability disclosure is straightforward: "Which of our production models inherits this weakness, and how do we know?" The answer today requires a manual hunt through repository pages, tracing self-reported tags that no weight-level analysis has confirmed. The Explorer converts that hunt into a lookup for the models it covers. Four fields belong in the approval record that most organizations do not carry today. Fingerprint-supported derivation grounded in weight analysis rather than a self-reported tag. A files-scanned count replacing the assumption of coverage with a measurable scan count. Provider headquarters as a filterable field, recognizing that headquarters alone does not resolve export-control exposure, since ownership and deployment location also govern the screening. And license lineage surfaced so legal teams can identify potential upstream terms before a model reaches production. Cisco released the Supply Chain Provenance Explorer today, and it is available at provenance.aidefense.cisco.com. The database is free, public, and does not require a Cisco product or account.