Cisco: AI Model Lineage Defies Origin Labels

Cisco has published research demonstrating that an AI model's labeled country of origin does not accurately reflect its technical lineage or internal characteristics. The findings, detailed in a blog post by Cisco and researchers from the Vulnerability and AI Lab (VAIL), reveal a phenomenon termed 'provenance entanglement' where models inherit components from upstream models developed elsewhere.

Researchers argue that country labels, while offering insight into the accountable developer and procurement rules, fail to provide a complete security assessment. A model published in the United States could contain weights and behavioral patterns inherited from a Chinese model, and vice versa. This occurs because developers typically fine-tune existing model checkpoints rather than training from scratch, embedding dependencies directly into the learned weights.

Provenance Analysis of Nemotron and Qwen

The study specifically examined Nemotron and Qwen model families, as it is known some Nemotron models use Qwen base weights. Researchers employed two fingerprinting methods: Cisco's Model Provenance Kit, which examines internal artifacts, and VAIL's Behavioral Fingerprinting, which analyzes inference behavior from the outside.

Both methods found that Nemotron models built from Qwen base weights were substantially more similar to Qwen models than chance would predict. The ultimate conclusion, according to the source, is that post-training and a new publisher name do not necessarily erase detectable relationships to an upstream model family.

This lineage creates security issues analogous to traditional software supply chain threats. If an upstream model is later found to contain a backdoor, systematic bias, or exploitable behavior, organizations would need to know which downstream models may warrant review. Cisco suggests the industry needs a model bill of materials (MBOM) to track these dependencies.

Recommendations for Stakeholders

The research outlines implications for different groups involved in AI adoption and security. The source attributes the following recommendations to the researchers.

Cisco notes that technical fingerprints can corroborate disclosed lineage or identify relationships that warrant further review. The industry does not need to wait for regulation to make such disclosure routine. A model bill of materials could record base checkpoints, derivation methods, major datasets, and post-deployment access details.

While country-of-origin labels retain value for understanding jurisdiction and procurement, they do not define a model's technical supply chain. As the researchers state, models do not have passports; they have supply chains.