A safety staff approving an open-source mannequin for manufacturing at present begins with a repository web page. The web page lists the mannequin identify, the license, and a tag figuring out the bottom mannequin it descended from. That tag is a string the uploader typed. Hugging Face doesn’t require uploaders to substantiate the declare via weight-level evaluation.
The ATOM Report, printed by Nathan Lambert and Florian Model at Interconnects AI in April 2026, tracked roughly 1,500 mainline open fashions. ATOM identifies derivatives via the Hugging Face base_model tag, a subject the uploader populates, filtering to fashions whose base mannequin seems within the tracked listing and which have greater than 5 lifetime downloads and excluding GGUF and MLX re-uploads. By that measure, Alibaba’s Qwen household is the declared dad or mum of 69% of latest open-model derivatives as of February 2026, up from 1% in January 2024. Chinese language labs total account for 70%. Europe sits at 4%. Cumulative tracked downloads throughout the three areas reached 2.04 billion via March 2026.
The verification hole extends to scan protection. Cisco Foundation AI scans each public file uploaded to Hugging Face via an up to date ClamAV engine, and the platform surfaces a file-level badge per file. Hugging Face’s personal malware scanning documentation notes a file with neither an okay nor an contaminated badge could also be queued, nonetheless scanning, or errored. At a given overview level, a repository might comprise information with out accomplished scan outcomes. Protection has been an assumption, not an attribute anybody may learn earlier than approving a mannequin.
From command line to public lookup
Cisco on Thursday printed the AI Supply Chain Provenance Explorer, a free public database overlaying virtually 900 open fashions. Every entry can carry supplier headquarters, a fingerprinted lineage graph, license restrictions, and a files-scanned depend. The device extends Cisco’s Model Provenance Kit, an open-source Python toolkit launched in April that fingerprinted roughly 150 base fashions throughout 45+ households and 20+ publishers. Protection grew roughly sixfold in 1 / 4.
The April launch was a command-line device. Working it meant an area Python surroundings, downloading mannequin weights that run into tens of gigabytes, and dedicating engineer hours per mannequin. The Explorer queries outcomes Cisco already computed. On Thursday, verifying parentage begins with a search bar, and price is why enterprises run open weights within the first place.
Amy Chang, head of AI Risk Intelligence and Safety Analysis at Cisco, has been constructing the case for why verification gaps matter. Throughout a VB Transform 2026 agentic security panel, Chang offered findings from 6,986 multi-turn assaults towards 15 flagship fashions, with success charges reaching 88.3%. "For those who don’t perceive how fashions are inclined to several types of assaults, then you’re unable to account for a way that mannequin that’s powering your agent, that’s powering your software, to know the place these failure factors are," Chang informed the viewers. Understanding failure factors begins with figuring out which mannequin you’re working.
The Explorer additionally surfaces information Cisco already makes use of operationally. The corporate’s Cerberus system inspects fashions coming into Hugging Face and feeds Safe Entry insurance policies that block by dangerous license or area of origin. The Explorer makes that class of knowledge free and searchable with out a Cisco product.
How fingerprinting replaces the tag
The Explorer grounds mannequin relationships in similarity scores slightly than self-reported metadata. Cisco’s Mannequin Provenance Package works in two scored phases. Stage one compares structure metadata earlier than loading any weights. When metadata is ambiguous, stage two extracts 5 weight-level indicators. Embedding Anchor Similarity captures geometric relationships that survive fine-tuning. Embedding Norm Distribution encodes phrase frequency patterns. Norm Layer Fingerprint reads layers steady throughout fine-tuning. Layer Vitality Profile compares distributions throughout community depth. Weight-Worth Cosine instantly compares weight values, and independently skilled fashions present primarily zero correlation on this sign. Cisco reported 96.4% accuracy on its own 111-pair benchmark at a 0.70 threshold, with an F1 of 0.963. 4 pairs had been misclassified, all involving excessive architectural transformation that Cisco calls a elementary restrict of pairwise weight comparability.
Tokenizer indicators are computed for diagnostics however intentionally excluded from the provenance rating. StableLM and Pythia each use the GPT-NeoX tokenizer and would rating as associated regardless of sharing no weight lineage. Excluding tokenizer information prevents false positives.
Behavioral fingerprinting provides a second method. Jonah Leshin, Manish Shah, and Ian Timmis at Challenge VAIL, working with Daniel Kang at UIUC, printed work on behavioral endpoint stability displaying {that a} mannequin endpoint can keep wholesome whereas its efficient id adjustments via weight updates, quantization, or routing. Cisco’s launch weblog states the Explorer integrates each static fingerprinting and behavioral-similarity evaluation to floor the lineage graph. Static evaluation provides weight-level proof of training-time derivation. Behavioral evaluation catches runtime id drift.
The place present instruments fall brief
The Explorer carries actual limits. Nearly 900 fashions is a significant begin, however Hugging Face hosts more than 2 million as of spring 2026. Fashions outdoors the boundary nonetheless rely on the self-reported tag. Cisco has not mentioned whether or not the Explorer exposes an API, and with out one, a staff can look fashions up by hand however can not wire the examine right into a CI gate. That’s the line between a governance artifact and a management.
Conventional SCA instruments face a structural mismatch as a result of they had been constructed for dependency manifests and container photographs. Sakshi Grover, senior analysis supervisor for cybersecurity at IDC, mentioned in CSO Online that conventional SCA "was designed to examine dependency manifests, libraries, and container photographs" and "is way much less efficient at figuring out" the dangers tied to AI workflows. Gartner director analyst Jaishiv Prakash informed the identical outlet that enterprises want "devoted controls for mannequin sources, authorized variations, entry, and runtime validation on the registry layer." Each had been commenting on broader provide chain dangers, however the hole they describe is the one the Explorer targets.
Cisco’s Model Provenance Constitution defines the place one mannequin counts as a spinoff of one other. The structure defaults to labeling ambiguous pairs as impartial, as a result of a false optimistic triggers a licensing accusation whereas a false detrimental will get caught throughout guide overview. That deliberate conservatism helps the 96.4% accuracy determine. Derivation isn’t binary, and fingerprinting is one type of proof alongside documentation and checkpoint verification.
What goes within the approval file
On August 2, the European Fee positive factors its AI Act enforcement powers over GPAI mannequin suppliers, with fines as much as 15 million euros or 3% of world turnover, whichever is increased. Organizations that considerably modify and place an open mannequin on the EU market can purchase supplier standing, with Fee steering treating modification compute exceeding one-third of the unique’s. The Act’s open-source exemption below Article 53(2) requires a genuinely free and open-source license allowing entry, use, modification, and redistribution, with weights, structure, and utilization data all public. Public weights alone don’t qualify. Llama’s neighborhood license carries a monthly-active-user threshold and a disqualifier the Fee steering names explicitly. Llama and Gemma collectively account for roughly a fifth of latest derivatives within the ATOM counts, and each carry licenses the Fee standards would possible disqualify. License classification turns into a part of the provenance overview, and that’s precisely what the Explorer surfaces.
The board query that arrives first after a base-model vulnerability disclosure is simple: "Which of our manufacturing fashions inherits this weak point, and the way do we all know?" The reply at present requires a guide hunt via repository pages, tracing self-reported tags that no weight-level evaluation has confirmed. The Explorer converts that hunt right into a lookup for the fashions it covers.
4 fields belong within the approval file that the majority organizations don’t carry at present. Fingerprint-supported derivation grounded in weight evaluation slightly than a self-reported tag. A files-scanned depend changing the belief of protection with a measurable scan depend. Supplier headquarters as a filterable subject, recognizing that headquarters alone doesn’t resolve export-control publicity, since possession and deployment location additionally govern the screening. And license lineage surfaced so authorized groups can determine potential upstream phrases earlier than a mannequin reaches manufacturing.
Cisco launched the Provide Chain Provenance Explorer at present, and it’s out there at provenance.aidefense.cisco.com. The database is free, public, and doesn’t require a Cisco product or account.
What adjustments for a safety staff on July 30
|
What the staff has at present |
What the Explorer publishes |
Really helpful motion |
|
Blast radius after a base-model vulnerability. The mannequin identify and the base_model tag. Scoping which fashions inherit a disclosed weak point is a guide hunt via repository pages. |
Lineage grounded in similarity scores utilizing two scored phases of fingerprinting on structure metadata and 5 weight-level indicators. The equipment scored 96.4% accuracy on the 0.70 threshold. |
Connect fingerprint-supported derivation to every mannequin within the asset stock so a disclosure triggers a scoped overview as an alternative of a hunt. |
|
Malware scan protection. A file-level badge per file. At a given overview level, a repository might comprise information with out accomplished scan outcomes. Protection has been an assumption. |
Information-scanned counts and reported malware or unsafe-file findings per mannequin, from ClamAV-based scanning. Scan protection turns into readable earlier than approval slightly than inferred from a badge. |
Exchange the belief {that a} mannequin was scanned with the recorded depend. The place protection is partial, doc whether or not the hole is appropriate and why. |
|
Supplier jurisdiction. A company identify on a repository web page. A spinoff a number of steps from its origin shows the uploader, not the ancestor. |
Supplier headquarters, web site, and related HF organizations as a filterable subject. Headquarters alone doesn’t resolve export-control publicity. |
Add jurisdiction to the approval file. Any staff that considerably modifies and locations an open mannequin on the EU market faces potential supplier obligations below the EU AI Act. |
|
License obligations. A license tag describing what the uploader believes applies. Phrases from a base mannequin upstream might not seem on the web page the engineer reads. |
Frequent limitations per mannequin, together with attribution, non-commercial phrases, geographic restrictions, and prohibited use circumstances. Fingerprinted lineage helps authorized groups determine potential upstream phrases. |
Route license lineage to authorized earlier than manufacturing, not after a contract references it. Doc the place at approval slightly than reconstructing it throughout a dispute. |
