Cisco and VAIL investigated whether the label “American” or “Chinese” model says anything about the technical origin of AI models. Two independent fingerprinting methods found that models continue to carry traces of their source model, even after post-training and renaming under a different publisher.
Anyone looking at a model page on a repository sees a name and a publisher. In policy discussions, that publisher is often summarized as a single country label. Cisco and VAIL tested that assumption and concluded that the label is insufficient to determine technical independence.
The researchers call this phenomenon “provenance entanglement.” Modern models are rarely built in isolation. They inherit weights, training data, and other dependencies that cross organizational and national boundaries. The name on the final product reflects only the last step in that chain.
Nemotron and Qwen as a test case
As a test case, the team chose Nvidia’s Nemotron family and compared it with Alibaba’s Qwen. This is a useful case because Nvidia publicly documents which Nemotron models use Qwen base weights and which rely on Nvidia or Meta Llama weights. On Hugging Face, for example, Qwen3-Nemotron-32B-RLBFF is fine-tuned on Qwen3-32B, while other Nemotron variants are trained from scratch.
Two methods were applied to these models. Cisco’s Model Provenance Kit examines the artifact itself using weight-derived identity signals. VAIL approaches it from the outside and fingerprints how models behave during inference. The scores are not directly comparable, but both were expected to point in the same direction.
What the numbers show
And they did. In Cisco’s catalog of 184 models, Qwen models accounted for 12.0 percent of the comparison pool, but 20.9 percent of the closest Nemotron models with documented Qwen provenance. That is 1.74 times the baseline percentage. VAIL’s larger catalog of 1,159 models yielded 14.9 percent versus 28.1 percent, or 1.89 times.
Both methods also reproduced the documented ranking: Qwen-based Nemotrons scored the highest, followed by Nvidia-based models, and Llama-based models scored the lowest. Control comparisons with Google and Meta models did not show this enrichment.
According to Cisco, a fingerprint match is not proof of causal lineage, but it does warrant further investigation. Organizations can ask vendors for base checkpoints, derivation methods, training datasets, distillation teachers, and post-release access. Cisco advocates for a model bill of materials, similar to what is common in software supply chain security.