When a security team reviews an open-source model for production today, they start with a repository page detailing the model’s name, its license, and the tag indicating the base model it originated from. This tag is manually entered by the uploader, and Hugging Face does not mandate proof through weight-level analysis.
The ATOM Report, authored by Nathan Lambert and Florian Brand at Interconnects AI in April 2026, observed approximately 1,500 primary open models. This report identifies derivatives via the Hugging Face base_model tag—a field filled in by the uploader. It filters for models whose base model is on the tracked list and has over five lifetime downloads, excluding GGUF and MLX re-uploads. By this criterion, Alibaba’s Qwen family was the declared source of 69% of new open-model derivatives by February 2026, significantly rising from 1% in January 2024. Chinese labs represent 70% overall, with Europe at 4%. Accumulated tracked downloads across these regions totaled 2.04 billion by March 2026.
There is a verification gap in scan coverage. Cisco Foundation AI checks every public file uploaded to Hugging Face using an updated ClamAV engine, which results in a file-level badge per file. According to Hugging Face’s malware scanning documentation, a file without an ‘ok’ or ‘infected’ badge might be queued, still scanning, or have an error. At any review point, a repository might have files lacking completed scan results. Coverage has thus been assumed rather than confirmed before approving a model.
From command line to public lookup
On Thursday, Cisco introduced the AI Supply Chain Provenance Explorer, a free public resource covering nearly 900 open models. Each listing may include provider headquarters, a lineage graph with fingerprints, license restrictions, and a count of files scanned. This tool builds upon Cisco’s Model Provenance Kit, an open-source Python toolkit launched in April, which fingerprinted around 150 base models across more than 45 families and 20 publishers. Coverage expanded approximately sixfold over one quarter.
The initial release in April was a command-line tool that required a local Python setup, downloading model weights reaching tens of gigabytes, and significant engineer hours per model. The Explorer now queries results Cisco has already computed. As of Thursday, verifying model parentage begins with a simple search bar, aligning with why enterprises prefer running open weights.
Amy Chang, leading AI Threat Intelligence and Security Research at Cisco, has been advocating the importance of addressing verification gaps. At a VB Transform 2026 agentic security panel, Chang revealed findings from 6,986 multi-turn attacks on 15 flagship models, achieving success rates up to 88.3%. Chang emphasized, “If you don’t understand how models are susceptible to different types of attacks, then you cannot effectively manage how that model, powering your agent or application, can identify failure points.” Recognizing failure points begins with understanding which model is in use.
The Explorer also provides data that Cisco already employs operationally. Cisco’s Cerberus system examines models entering Hugging Face and informs Secure Access policies that may block based on risky licenses or regional origins. The Explorer offers this class of information freely and without needing a Cisco product.
How fingerprinting replaces the tag
The Explorer establishes model relationships through similarity scores, bypassing self-reported metadata. Cisco’s Model Provenance Kit operates in two scored phases. The first phase compares architecture metadata before any weights are loaded. If metadata is unclear, the second phase extracts five weight-level signals. Embedding Anchor Similarity identifies geometric relationships that persist after fine-tuning. Embedding Norm Distribution encodes word frequency patterns. Norm Layer Fingerprint reads layers stable through fine-tuning. Layer Energy Profile assesses distributions across network depth. Weight-Value Cosine directly compares weight values, with independently trained models showing nearly zero correlation on this signal. Cisco reported 96.4% accuracy on its 111-pair benchmark at a 0.70 threshold, with an F1 score of 0.963. Four pairs were misclassified, all involving significant architectural transformations that Cisco identifies as a fundamental limit of pairwise weight comparison.
Tokenizer signals, although computed for diagnostics, are deliberately omitted from the provenance score. StableLM and Pythia both utilize the GPT-NeoX tokenizer and would appear related despite not sharing weight lineage. Excluding tokenizer data prevents false positives.
Behavioral fingerprinting provides an additional method. Jonah Leshin, Manish Shah, and Ian Timmis at Project VAIL, collaborating with Daniel Kang at UIUC, published research on behavioral endpoint stability indicating that a model endpoint can remain functional even as its effective identity shifts due to weight updates, quantization, or routing. According to Cisco’s launch blog, the Explorer incorporates both static fingerprinting and behavioral similarity analysis to construct the lineage graph. Static analysis offers weight-level evidence of training-time derivation, while behavioral analysis detects runtime identity drift.
Where existing tools fall short
The Explorer, while valuable, has limitations. It covers nearly 900 models, but Hugging Face hosts over 2 million models as of spring 2026. Models outside this scope still rely on self-reported tags. Cisco has not confirmed whether the Explorer will feature an API, and without one, teams can manually search models but cannot integrate checks into a CI gate. This marks the difference between a governance artifact and a control.
Traditional SCA tools face structural challenges because they were created for dependency manifests and container images. Sakshi Grover, senior research manager for cybersecurity at IDC, explained in CSO Online that traditional SCA “was designed to inspect dependency manifests, libraries, and container images” and “is far less effective at identifying” AI workflow risks. Gartner director analyst Jaishiv Prakash told the same outlet that enterprises require “dedicated controls for model sources, approved versions, access, and runtime validation at the registry layer.” Both comments addressed broader supply chain risks, but these gaps are precisely what the Explorer aims to address.
Cisco’s Model Provenance Constitution defines when one model qualifies as a derivative of another. The constitution typically labels ambiguous pairs as independent to avoid licensing accusations from false positives, while false negatives can be caught during manual review. This conservative approach supports the 96.4% accuracy rate. Derivation is not binary, and fingerprinting is one form of evidence, complemented by documentation and checkpoint verification.
What goes in the approval record
On August 2, the European Commission will enforce its AI Act, targeting GPAI model providers with fines up to 15 million euros or 3% of global turnover, whichever is higher. Organizations that significantly modify and introduce an open model to the EU market can gain provider status, with Commission guidance considering modification compute exceeding one-third of the original. The Act’s open-source exemption under Article 53(2) requires a genuinely free and open-source license allowing access, use, modification, and redistribution, with weights, architecture, and usage information all public. Public weights alone are insufficient. Llama’s community license includes a monthly-active-user threshold and a disqualifier explicitly named in the Commission guidance. Llama and Gemma together account for about a fifth of new derivatives in the ATOM counts, and both possess licenses the Commission criteria would likely disqualify. License classification becomes a component of the provenance review, precisely what the Explorer identifies.
The pressing question following a base-model vulnerability disclosure is: “Which of our production models inherits this weakness, and how do we know?” Currently, the answer involves manually navigating repository pages, tracking self-reported tags unverified by weight-level analysis. The Explorer simplifies this process into a lookup for the models it includes.
Four key elements should be included in the approval record, elements that most organizations currently lack. These include fingerprint-supported derivation based on weight analysis rather than self-reported tags, a files-scanned count replacing the assumption of coverage with a measurable scan count, provider headquarters as a filterable field, acknowledging that headquarters alone does not resolve export-control exposure since ownership and deployment location also play roles in screening, and license lineage surfaced so legal teams can identify potential upstream terms before a model enters production.
Cisco has released the Supply Chain Provenance Explorer, accessible at provenance.aidefense.cisco.com. This resource is free, public, and does not require a Cisco product or account.
What changes for a security team on July 30
|
What the team has today |
What the Explorer publishes |
Recommended action |
|
Blast radius after a base-model vulnerability. The model name and the base_model tag. Scoping which models inherit a disclosed weakness is a manual hunt through repository pages. |
Lineage grounded in similarity scores using two scored stages of fingerprinting on architecture metadata and five weight-level signals. The kit scored 96.4% accuracy at the 0.70 threshold. |
Attach fingerprint-supported derivation to each model in the asset inventory so a disclosure triggers a scoped review instead of a hunt. |
|
Malware scan coverage. A file-level badge per file. At a given review point, a repository may contain files without completed scan results. Coverage has been an assumption. |
Files-scanned counts and reported malware or unsafe-file findings per model, from ClamAV-based scanning. Scan coverage becomes readable before approval rather than inferred from a badge. |
Replace the assumption that a model was scanned with the recorded count. Where coverage is partial, document whether the gap is acceptable and why. |
|
Provider jurisdiction. An organization name on a repository page. A derivative several steps from its origin displays the uploader, not the ancestor. |
Provider headquarters, website, and associated HF organizations as a filterable field. Headquarters alone does not resolve export-control exposure. |
Add jurisdiction to the approval record. Any team that substantially modifies and places an open model on the EU market faces potential provider obligations under the EU AI Act. |
|
License obligations. A license tag describing what the uploader believes applies. Terms from a base model upstream may not appear on the page the engineer reads. |
Common limitations per model, including attribution, non-commercial terms, geographic restrictions, and prohibited use cases. Fingerprinted lineage helps legal teams identify potential upstream terms. |
Route license lineage to legal before production, not after a contract references it. Document the position at approval rather than reconstructing it during a dispute. |
