Cisco Builds Free Database to Verify Open-Source AI Model Lineage, Filling a Gap Hugging Face Left Wide Open

When a developer uploads a model to Hugging Face, the world's largest open-model repository, they fill in a "base_model" tag identifying what the model descended from. That tag is just a string someone typed. Hugging Face does not require weight-level proof to back it up, according to VentureBeat.

That's the entire verification system for lineage on a platform that security teams use to approve models headed into production software.

The blind spot became clearer with the ATOM Report, published in April 2026 by Nathan Lambert and Florian Brand at Interconnects AI. The report tracked roughly 1,500 mainline open models using that same self-reported base_model tag, filtering for models with more than five lifetime downloads and excluding GGUF and MLX re-uploads.

What it found: Alibaba's Qwen family is the declared parent of 69% of new open-model derivatives as of February 2026, up from just 1% in January 2024. Chinese labs overall account for 70% of that lineage. Europe accounts for 4%. Cumulative tracked downloads across regions hit 2.04 billion through March 2026.

This represents a massive concentration of the open-model ecosystem sitting on top of Chinese-origin base models, verified only by whatever an uploader chose to type into a form field.

Scanning Has the Same Problem

It's not just lineage. Cisco Foundation AI scans every public file uploaded to Hugging Face using an updated ClamAV engine, and the platform shows a file-level badge for each file. But Hugging Face's own documentation on malware scanning notes that a file without either an "ok" or "infected" badge might simply still be queued, still scanning, or stuck in an error state.

At any given moment, a repository can contain files where nobody actually knows the scan result. Security teams have been treating scan coverage as a given. It's an assumption, not something anyone could actually confirm before hitting approve.

Cisco's Fix: A Search Bar Instead of a Command Line

Cisco published the AI Supply Chain Provenance Explorer, a free public database covering almost 900 open models. Each entry includes the provider's headquarters location, a fingerprinted lineage graph, license restrictions, and a count of files scanned.

This builds on Cisco's Model Provenance Kit, an open-source Python toolkit the company released in April 2026 that fingerprinted roughly 150 base models across more than 45 families and 20-plus publishers. Coverage grew roughly sixfold in a single quarter.

The April version was a command-line tool. Using it required a local Python environment, downloading model weights that can run into tens of gigabytes, and burning real engineer hours per model checked. That's expensive, and cost is a big part of why companies run open weights instead of paying for closed models in the first place.

The Explorer just serves up results Cisco already computed. Verifying where a model actually came from now starts with typing a name into a search bar, not standing up infrastructure.

Why This Isn't Just a Compliance Checkbox

Amy Chang, head of AI Threat Intelligence and Security Research at Cisco, has been making the case that this matters beyond compliance. At a VB Transform 2026 agentic security panel, Chang presented findings from 6,986 multi-turn attacks run against 15 flagship models, with success rates reaching as high as 88.3%.

"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang told the audience, according to VentureBeat.

A company that doesn't know its production model is a fine-tuned Qwen derivative can't reason about what vulnerabilities it inherited from Qwen. A security team that assumes malware scanning is complete because a badge is present is operating on a false assumption Hugging Face's own documentation contradicts.

Concentration of lineage under one family, whether American, European, or Chinese, is a supply-chain visibility problem regardless of where the code came from. The fair counterpoint from open-source advocates is that self-reported tags and community trust have functioned well enough to build a 2-billion-download ecosystem without mass incidents so far.

But "worked so far" and "verified" are different claims. Cisco's database doesn't resolve every open question about model safety. It resolves whether anyone can now check parentage without taking an uploader's word for it. Whether enterprises actually start using it before their next production deployment is the open question nobody can answer yet.