Cisco Provenance Explorer fingerprints lineage for nearly 900 open models

Cisco released the Cisco Provenance Explorer on Thursday, a free public database covering almost 900 open models with fingerprinted lineage, license restrictions, provider headquarters and file-scan counts. The launch matters because many enterprises approving open weights still rely on repository metadata that uploaders enter themselves, including the Hugging Face base_model tag.

That gap is not theoretical. The ATOM Report, published in April 2026 by Nathan Lambert and Florian Brand at Interconnects AI, tracked about 1,500 mainline open models and used Hugging Face base_model tags to identify derivatives. On that basis, Alibaba’s Qwen family was the declared parent for 69% of new open-model derivatives as of February 2026, up from 1% in January 2024. Chinese labs accounted for 70% overall, Europe for 4%, and cumulative tracked downloads across the three regions reached 2.04 billion through March 2026.

Hugging Face does not require uploaders to prove parentage through weight-level analysis. Cisco’s point is that lineage, malware scan coverage and license inheritance need to become approval data, rather than assumptions buried in a model card.

What is the Cisco Provenance Explorer?

The Cisco Provenance Explorer is a public lookup tool at provenance.aidefense.cisco.com that shows Cisco-computed supply-chain data for open models. It extends Cisco’s Model Provenance Kit, an open-source Python toolkit released in April that fingerprinted roughly 150 base models across more than 45 families and more than 20 publishers.

The new database expands that coverage by about sixfold in a quarter and removes the need for every security team to download large model weights and run local analysis before an approval meeting. Cisco says the Explorer can show a lineage graph based on fingerprinting, common license limitations, provider headquarters and how many files were scanned.

The scan-count field addresses another hidden assumption. Cisco Foundation AI scans public files uploaded to Hugging Face through an updated ClamAV engine, while Hugging Face displays file-level malware badges. Hugging Face’s documentation says a file with neither an ok badge nor an infected badge may still be queued, scanning or errored, which means a repository can contain files without completed scan results at the time of review.

How does Cisco fingerprint model lineage?

Cisco’s Model Provenance Kit compares models in two stages. First it checks architecture metadata without loading weights. If that is not enough, it extracts five weight-level signals, including embedding geometry, embedding norm distributions, stable layer fingerprints, layer energy profiles and direct weight-value cosine comparisons.

Cisco reported 96.4% accuracy on its own 111-pair benchmark at a 0.70 threshold, with an F1 score of 0.963. The company said four pairs were misclassified, all involving extreme architectural changes that it describes as a limit of pairwise weight comparison. Tokenizer data is used for diagnostics but excluded from the provenance score because unrelated models can share a tokenizer.

Cisco’s launch materials also say the Explorer combines static fingerprinting with behavioral-similarity analysis. Work by Jonah Leshin, Manish Shah and Ian Timmis at Project VAIL, with Daniel Kang at UIUC, found that an endpoint can appear healthy while its effective model identity changes through weight updates, quantization or routing.

What are the limits for security teams?

The main constraint is coverage. Nearly 900 models is useful for common open-weight families, but Hugging Face said in spring 2026 that it hosts more than 2 million models. Anything outside Cisco’s database still leaves teams relying on repository claims unless they run their own checks.

Cisco also has not said whether the Explorer exposes an API. Without one, teams can use it as a manual review aid, but cannot readily make the check a CI gate or automated registry control.

The licensing angle is becoming more practical in Europe. On August 2, the European Commission gains enforcement powers over GPAI model providers under the AI Act, with fines up to 15 million euros or 3% of global turnover, whichever is higher. The source material cited by Cisco says organizations that substantially modify and place an open model on the EU market can acquire provider status, and that public weights alone do not meet the Act’s open-source exemption.

For approval records, Cisco’s database points to four fields teams should track more explicitly: fingerprint-supported derivation, files-scanned counts, provider headquarters and license lineage. Those fields do not replace legal review or model testing, but they give security and compliance teams a better starting point than a self-reported tag.

This story draws on original reporting from VentureBeat.