Labels Fail to Reveal AI Model Lineage, Cisco and VAIL Find

Cisco and research partner VAIL published a blog post reporting that country-of-origin labels on AI models can be misleading because models often inherit weights and behaviors from upstream checkpoints. The analysis tests whether a model’s publisher name matches its technical ancestry.

Researchers used two fingerprinting techniques. Cisco’s Model Provenance Kit inspects model artifacts and weight patterns. VAIL’s Behavioral Fingerprinting evaluates inference outputs and external behavior. The teams compared model families to detect internal and external similarity.

The study examined Nemotron and Qwen models because some Nemotron variants were fine-tuned from Qwen base weights. Both weight analysis and behavior testing found measurable similarity between Nemotron models derived from Qwen checkpoints and Qwen models, even after the downstream models were republished under different developer names.

The researchers called the effect provenance entanglement: when developers fine-tune an existing checkpoint instead of training from scratch, downstream models can retain structural and behavioral properties of upstream models. Inherited properties can include systematic bias, exploitable behaviors or implanted backdoors.

The blog post proposed a model bill of materials to record base checkpoints, major datasets, derivation methods, teacher or reward models, licenses and entities with post-deployment access. The report noted technical fingerprints could corroborate such disclosures or reveal relationships that warrant further review.

The report recommends three steps for assessing model risk. Organizations should treat publisher identity as one part of due diligence and add lineage checks, behavior analysis and operational controls before deploying a model. Regulators should seek greater visibility into upstream dependencies. Developers should make lineage disclosure routine.

The paper highlighted procurement and security implications: if an upstream checkpoint is later found to contain a backdoor or entrenched bias, users of downstream models built from that checkpoint would need to identify and review those models. The blog post noted “the dependencies aren’t listed in a manifest file, they’re embedded in the learned weights themselves,” and added “Models do not have passports. They have supply chains.”

Cisco published tools and documentation alongside the research to help security teams and regulators detect lineage relationships and assess downstream exposure. The materials aim to support model transparency and technical verification during procurement and security reviews.