Cisco today made available the AI Supply Chain Provenance Explorer, a free public database that catalogs almost 900 open models with weight-level fingerprinted lineage, license summaries, provider headquarters, and files-scanned counts. The Explorer expands on Cisco’s Model Provenance Kit, an open-source Python toolkit released in April that fingerprinted roughly 150 base models across more than 45 families and 20+ publishers; overall coverage increased about sixfold in one quarter.
Why the Explorer matters
Security teams typically start model approval by viewing a repository page that lists a model name, license and a base_model tag that the uploader typed. Hugging Face does not require uploaders to substantiate those claims with weight-level analysis, so tracing which production models inherit a disclosed vulnerability is often a manual, error-prone hunt.
The scope of the problem is illustrated by the ATOM Report (Nathan Lambert and Florian Brand, Interconnects AI, April 2026). ATOM tracked roughly 1,500 mainline open models and identified derivatives using the Hugging Face base_model tag. By that measure, Alibaba’s Qwen family was the declared parent of 69% of new open-model derivatives as of February 2026 (up from 1% in January 2024). Chinese labs overall accounted for 70% of derivatives, Europe 4%; cumulative tracked downloads across those three regions reached 2.04 billion through March 2026.
How the Explorer determines lineage
Rather than relying on self-reported metadata, the Explorer grounds model relationships in similarity scores computed by Cisco’s Model Provenance Kit. The kit uses two scored stages:
- Stage one compares architecture metadata before loading any weights.
- If metadata is ambiguous, stage two extracts five weight-level signals: Embedding Anchor Similarity, Embedding Norm Distribution, Norm Layer Fingerprint, Layer Energy Profile and Weight-Value Cosine.
Cisco reported 96.4% accuracy on its own 111-pair benchmark at a 0.70 threshold, with an F1 of 0.963. Four pairs were misclassified; all involved extreme architectural transformations that Cisco describes as a fundamental limit of pairwise weight comparison.
Tokenizer-derived signals are calculated for diagnostics but intentionally excluded from the provenance score to avoid false positives—models that share a tokenizer (for example, StableLM and Pythia use the GPT‑NeoX tokenizer) would otherwise appear related despite having no shared weight lineage.
The Explorer also integrates behavioral-similarity analysis. Research from Project VAIL and Daniel Kang (UIUC) on behavioral endpoint stability shows that a model endpoint can remain "healthy" while its effective identity shifts through weight updates, quantization, or routing. Cisco says the Explorer combines static (weight-level) fingerprinting with behavioral analysis: static signals supply training-time derivation evidence; behavioral signals detect runtime identity drift.
Additional operational data and limits
The Explorer surfaces data Cisco already uses operationally: provider headquarters and website, common license limitations (attribution, non-commercial terms, geographic restrictions, disallowed use cases), and a files-scanned count plus reported malware or unsafe-file findings per model derived from ClamAV-based scanning. Cisco Foundation AI scans every public file uploaded to Hugging Face with an updated ClamAV engine and exposes a file-level badge for each file. However, Hugging Face’s malware scanning documentation notes that a file without an "ok" or "infected" badge may simply be queued, still scanning, or errored—meaning scan coverage was previously an assumption rather than a readable attribute.
Key limitations to note:
- Coverage: the Explorer covers almost 900 models, while Hugging Face hosted more than 2 million models as of spring 2026. Models outside the Explorer still rely on self-reported tags.
- Integration: Cisco has not announced a public API for the Explorer. Without an API, teams can perform manual lookups but cannot easily embed the check into CI gates—leaving a gap between a governance artifact and an automated control.
Regulatory context
The European Commission’s AI Act enforcement powers over GPAI model providers take effect on August 2, 2026, with fines up to 15 million euros or 3% of global turnover, whichever is higher. Organizations that substantially modify and place an open model on the EU market can acquire provider status; the Commission’s guidance treats modification compute exceeding one-third of the original model’s compute as potentially qualifying. The Act’s open-source exemption under Article 53(2) requires a truly free and open-source license allowing access, use, modification and redistribution, plus public weights, architecture and usage information—public weights alone do not qualify.
ATOM’s counts indicate Llama and Gemma together account for roughly a fifth of new derivatives, and both carry licenses that the Commission’s criteria would likely disqualify. Consequently, license classification and upstream license lineage become relevant parts of a provenance review, and the Explorer surfaces that information.
What should go into an approval record?
Cisco recommends four fields that many organizations currently lack:
- Fingerprint-supported derivation grounded in weight analysis rather than a self-reported tag.
- Files-scanned count to replace the assumption a model was scanned with a measurable coverage metric.
- Provider headquarters, website and associated Hugging Face organizations as a filterable jurisdiction field (recognizing headquarters alone does not resolve export-control exposure).
- License lineage so legal teams can identify upstream terms before a model reaches production.
The Explorer aims to make those fields readable before approval rather than reconstructed after a disclosure or legal dispute. The database is free, public and accessible without a Cisco product or account at provenance.aidefense.cisco.com.
Practical impact for security teams (example date: July 30, 2026)
For teams currently hunting repository pages to scope which production models inherit a disclosed base-model vulnerability, the Explorer converts that hunt into a lookup for the models it covers. It does not solve every problem—coverage and API integration remain gaps—but the availability of weight-level lineage, scan counts, provider jurisdiction and license lineage are concrete, machine-evidence fields teams can add to approval records to reduce manual effort and legal risk.
