Every day, thousands of developers head to Hugging Face to pull the latest open-weight model for their production pipeline. They look at the base_model tag, see a familiar name like Llama or Mistral, and assume the lineage is secure. But in the current AI ecosystem, that tag is nothing more than a self-reported string. There is no systemic verification to ensure that the weights inside the file actually match the claimed parent model. For a developer, this is a minor curiosity; for a Chief Compliance Officer, it is a ticking time bomb of licensing violations and regulatory risk.
The Rise of the Ghost Lineage
The scale of this transparency gap is becoming evident through emerging data. According to the ATOM report published by Interconnects AI in April 2026, the landscape of open model derivatives has shifted violently. As of February 2026, 69% of new open model derivatives declared Alibaba's Qwen family as their parent model. To put that in perspective, that figure was a mere 1% in January 2024. This surge means that a vast majority of the current open-source AI ecosystem is now rooted in models from Chinese research labs, often without rigorous verification of how those weights were modified or redistributed.
To address this void, Cisco has released the AI Supply Chain Provenance Explorer. This free, public database provides a lineage graph for approximately 900 open models, detailing provider headquarters, license restrictions, and file scan frequencies. The Explorer is the evolved version of the Model Provenance Kit, an open-source Python toolkit released in April. While the original kit focused on fingerprinting about 150 base models across 20 publishers and 45 families, the Explorer has expanded that coverage sixfold in a single quarter. More importantly, it shifts the burden of analysis from the user to the provider. Previously, developers had to download tens of gigabytes of weights and run a CLI tool locally to verify a model; now, they can query Cisco's pre-computed results via a simple search interface.
Weight Fingerprinting and the Regulatory Trap
What makes the Explorer different from a standard metadata scraper is its reliance on weight-level signals rather than trust. The verification process operates in two stages. First, it compares architecture metadata. If that metadata is ambiguous or missing, the system moves to a second, deeper stage of weight-level signal extraction. Cisco employs five specific signals to measure similarity between models: Embedding Anchor Similarity to capture geometric relationships that survive fine-tuning, Embedding Norm Distribution to encode word frequency patterns, Norm Layer Fingerprints to read stable layers, Layer Energy Profiles to compare distributions across network depth, and Weight-Value Cosine to directly compare weight values. In the case of independently trained models, the Weight-Value Cosine correlation typically converges to zero.
Cisco intentionally excludes tokenizer signals from the final provenance score. This prevents false positives in cases like StableLM and Pythia, which share the GPT-NeoX tokenizer despite having entirely different weight lineages. To combat identity drift—where quantization, routing, or weight updates change a model's runtime identity—Cisco integrated behavioral fingerprinting alongside static analysis. The results are statistically significant: in a benchmark of 111 pairs with a 0.70 threshold, the system achieved 96.4% accuracy and an F1 score of 0.963. The few misclassifications occurred only in cases of extreme architectural mutation, which Cisco identifies as a fundamental limit of pair-wise weight comparison.
This technical rigor is not just an academic exercise; it is a response to a shifting legal landscape. The EU AI Act, which took effect on August 2, introduces staggering penalties for non-compliance. General Purpose AI (GPAI) providers can face fines of up to 15 million euros or 3% of their total worldwide annual turnover, whichever is higher. A critical clause stipulates that any organization that modifies an original model using more than one-third of the original computing resources and releases it to the market assumes the status of a provider. Because models like Llama and Gemma carry specific community license conditions, they may not qualify for the open-source exemptions under Article 53(2) of the EU AI Act. Companies deploying derivatives of these models without knowing their true origin are essentially gambling with their balance sheets.
Despite its utility, the Explorer is a snapshot rather than a total solution. Its database of 900 models is a fraction of the 2 million plus models hosted on Hugging Face. For any model outside this set, users must still rely on the uploader's self-reported tags. Furthermore, the tool currently lacks an API, meaning security teams cannot yet integrate these checks into a CI/CD gate for automated model ingestion. For now, the process remains a manual cross-reference.
Engineers and compliance officers must stop treating Hugging Face tags as a source of truth and instead use weight-based lineage tools to verify regulatory alignment before a model ever touches production data.
