0
0
Security teams evaluating open-source AI models for production have long relied on repository metadata that remains unverified at the weight level. A new public database from Cisco changes that equation by providing fingerprint-based lineage data for nearly 900 models.
The AI Supply Chain Provenance Explorer replaces self-reported base_model tags with similarity scores derived from architecture metadata and five distinct weight-level signals. These include embedding anchor similarity, norm layer fingerprints, and direct weight-value cosine comparisons that show near-zero correlation between independently trained models.
This matters because declared parentage has skewed heavily toward certain families. Data through February 2026 showed Alibaba’s Qwen models listed as the origin for 69 percent of tracked derivatives, with Chinese labs overall accounting for 70 percent. Without weight-level confirmation, organizations cannot confidently trace which production systems inherit vulnerabilities disclosed in a base model.
Cisco’s approach first compares architecture metadata before loading weights. When that comparison is inconclusive, the system extracts the five weight signals. The method achieved 96.4 percent accuracy on an internal 111-pair benchmark at a 0.70 threshold. Tokenizer data is deliberately excluded to avoid false positives between unrelated models that happen to share the same tokenizer.
Behavioral endpoint stability analysis complements the static fingerprinting. This second layer detects runtime identity drift caused by quantization or weight updates, providing a more complete picture than either method alone.
One key implication is improved preparedness for the EU AI Act enforcement that begins in August. Organizations that substantially modify and place open models on the EU market can acquire provider obligations. The Explorer surfaces license restrictions and provider headquarters, helping legal teams identify upstream terms that may disqualify an open-source exemption.
Another consequence is the potential shift in how security teams allocate review time. Instead of manually tracing repository pages after a vulnerability disclosure, teams can now attach fingerprint-supported derivation records to asset inventories. This converts an open-ended hunt into a scoped lookup for the models covered by the database.
The tool also records files-scanned counts from ClamAV-based scans, replacing assumptions about malware coverage with measurable data. Partial scan results can be documented and justified before approval rather than discovered later.
While the database covers only a fraction of the more than two million models on Hugging Face, it demonstrates that weight-level provenance checks can be made accessible without requiring every team to run heavy local computations. The Explorer queries pre-computed results, lowering the barrier that previously limited verification to organizations with dedicated engineering resources.
