Uncovering the Unverified Lineage: Cisco Fingerprinting Nearly 900 Open Models for Free

Security teams looking to approve open-source models for production often begin their process by visiting a repository page. This page typically includes important details such as the model name, license information, and a tag indicating the base model from which it originated. This tag is usually a string provided by the uploader. Hugging Face, a popular platform for open-source models, does not currently require uploaders to verify their claims through in-depth weight-level analysis.

In a recent report called the ATOM Report, published by Nathan Lambert and Florian Brand at Interconnects AI in April 2026, it was revealed that there are approximately 1,500 mainline open models being tracked. The report identifies derivatives by using the Hugging Face base_model tag, which is filled out by the uploader. Models are filtered based on whether their base model appears in the tracked list, have more than five lifetime downloads, and exclude certain re-uploads. The report found that Alibaba’s Qwen family is the declared parent of 69% of new open-model derivatives as of February 2026, showing a significant increase from 1% in January 2024. Chinese labs are responsible for 70% of these models, while Europe only accounts for 4%. The cumulative tracked downloads across these regions reached 2.04 billion by March 2026.

The verification process also extends to scan coverage, with Cisco Foundation AI scanning every public file uploaded to Hugging Face using an updated ClamAV engine. The platform assigns a file-level badge to each file based on the scanning results. However, there may be files in a repository that have not completed the scanning process at a given review point. It has been assumed that scan coverage is sufficient, but it has not been a verifiable attribute until now.

To address these challenges, Cisco recently introduced the AI Supply Chain Provenance Explorer, a free public database covering almost 900 open models. Each entry in the database includes information such as provider headquarters, a lineage graph, license restrictions, and a count of files scanned. This tool builds upon Cisco’s Model Provenance Kit, which fingerprinted approximately 150 base models across different families and publishers. The Explorer simplifies the verification process by allowing users to search for model information using a search bar, eliminating the need for manual verification processes.

The Explorer utilizes a unique approach to establish model relationships, focusing on similarity scores rather than relying solely on self-reported metadata. Cisco’s Model Provenance Kit analyzes architecture metadata and five weight-level signals to determine model relationships accurately. This method has shown a 96.4% accuracy rate on Cisco’s benchmark, demonstrating the effectiveness of this approach.

By leveraging the Explorer, security teams can gain valuable insights into the lineage and provenance of open-source models, enabling them to make informed decisions about model approval. The tool provides critical information such as lineage grounded in similarity scores, files-scanned counts, provider headquarters, and license lineage, all of which are essential for ensuring the security and integrity of production models.

In conclusion, the introduction of tools like the AI Supply Chain Provenance Explorer marks a significant step forward in the verification and approval process for open-source models. By incorporating fingerprinting and behavioral analysis techniques, security teams can now access comprehensive information about model lineage and provenance, enhancing the overall security posture of their production environments. This tool serves as a valuable resource for organizations looking to navigate the complex landscape of open-source model approval and verification.