Cisco has published the AI Supply Chain Provenance Explorer, a free public database covering almost 900 open-source AI models. The tool addresses a critical vulnerability in enterprise software development: the reliance on self-reported tags rather than cryptographic or geometric proof has created an invisible attack surface.
When security teams evaluate an open-source Large Language Model for production deployment, their primary reference point has historically been a self-reported tag on repository hosting platforms like Hugging Face. Nathan Lambert and Florian Brand published the ATOM Report via Interconnects AI in April 2026, revealing that Alibaba’s Qwen family acts as the declared parent of 69% of new open-model derivatives. Chinese labs account for 70% of total mainline open models, while European contributions sit at a meager 4%. With cumulative tracked downloads topping 2.04 billion through March 2026, the reliance on unverified string fields rather than cryptographic or geometric proof has created an invisible attack surface.
From Local Command Line Scripts to Public Enterprise Lookups
Cisco’s new Explorer represents a massive leap in accessibility compared to previous iterations. In April, the tech giant released its Model Provenance Kit, a local Python tool that fingerprinted roughly 150 base models across 45 families. Running that pipeline required substantial engineering hours, local environments, and the heavy computational lifting of downloading tens of gigabytes of model weights.
The newly launched Explorer bypasses local compute hurdles by querying pre-computed metrics directly through a web interface. According to Cisco, each database entry can display provider headquarters, a fingerprinted lineage graph, exact license restrictions, and a comprehensive files-scanned count.
Amy Chang, head of AI Threat Intelligence and Security Research at Cisco, highlighted the gravity of these blind spots during a VB Transform 2026 agentic security panel. Chang presented data from 6,986 multi-turn attacks executed against 15 flagship models, which yielded a staggering 88.3% success rate. “If you don’t understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are,” Chang stated.
How Weight-Level Fingerprinting Replaces Self-Reported Tags
The fundamental flaw of the current open-source ecosystem is that platform maintainers do not require uploaders to substantiate base-model claims. Hugging Face does not mandate weight-level analysis to populate the standard base_model tag. Cisco’s methodology completely bypasses this vulnerability by analyzing structural and geometric properties directly from the weights.
The underlying Model Provenance Kit executes a rigorous two-stage evaluation process:
- Stage One: Compares architectural metadata before loading any heavy model weights.
- Stage Two: Extracts five distinct weight-level signals when metadata proves ambiguous. This includes Embedding Anchor Similarity to capture geometric relationships surviving fine-tuning, Embedding Norm Distribution for word frequency patterns, Norm Layer Fingerprint to read stable layers, Layer Energy Profile to compare depth distributions, and Weight-Value Cosine to directly compare weight values.
Independent tests demonstrate that completely unrelated models show zero correlation on weight-value cosine signals. Cisco reported 96.4% accuracy on an 111-pair benchmark utilizing a 0.70 similarity threshold, yielding an F1 score of 0.963. Crucially, tokenizer metrics are deliberately segregated from the provenance score. While models like StableLM and Pythia both utilize the GPT-NeoX tokenizer and would otherwise trigger false positives, excluding tokenizer data protects structural accuracy.
Furthermore, behavioral fingerprinting adds runtime defense. Cisco’s Explorer integrates these static and behavioral analyses to map accurate lineage trees.
Traditional Software Composition Analysis Fails AI Workflows
Traditional Software Composition Analysis (SCA) tooling is fundamentally misaligned with modern generative AI pipelines. Sakshi Grover, senior research manager for cybersecurity at IDC, noted in industry commentary that traditional SCA “was designed to inspect dependency manifests, libraries, and container images” and is “far less effective at identifying” the unique supply chain vectors tied to machine learning assets. Gartner director analyst Jaishiv Prakash similarly emphasized that enterprises require dedicated controls for model sources, approved versions, access, and runtime validation directly at the registry layer.
The regulatory landscape is tightening concurrently. On August 2, the European Commission activates stringent enforcement powers under the EU AI Act for General-Purpose AI (GPAI) model providers. Organizations that substantially modify open models and place them on the European market can acquire formal provider status. Commission guidance stipulates that modification compute exceeding one-third of the original training compute triggers this threshold. Furthermore, Article 53(2) mandates a genuinely free and open-source license, explicitly requiring accessible weights, architecture, and usage terms. Popular repositories like Llama and Gemma—which account for roughly a fifth of new derivatives in ATOM tracking—carry community licenses or active-user clauses that may conflict with these strict criteria.
What Security Teams Must Change in Their Approval Workflows
When a vulnerability disclosure breaks for a foundational model, enterprise security boards immediately ask a direct question: which production endpoints inherit this weakness? Tracing this via manual repository hunting is no longer viable.
Integrating tools like Cisco’s Explorer forces a restructuring of enterprise model governance records. Security teams must move beyond passive trust and incorporate four distinct elements into their compliance logs:
- Weight-Grounded Derivation: Relying on algorithmic similarity scores instead of uploader-provided metadata strings.
- Measurable Scan Counts: Replacing assumptions of safety with explicit file-level ClamAV scan counts, acknowledging that un-badged repository files may be queued or errored.
- Provider Jurisdiction Tracking: Documenting true provider headquarters and associated publishing organizations to evaluate export-control exposure.
- Upstream License Lineage: Surfacing inherited license terms before deployment to prevent legal exposure from restricted base models.
Cisco’s AI Supply Chain Provenance Explorer is available immediately as a public resource, signaling a major shift toward cryptographic and mathematical transparency in open-source AI deployment.
