Cisco is introducing the AI Supply Chain Provenance Explorer. It is a public tool for evaluating open-weight AI models before organizations deploy them. The service examines the model’s provenance, licenses, security findings, and vendor context as part of the evaluation. The number of cataloged LLMs has already reached nearly 900.
An open-weight AI model is less transparent than it appears when you download it, according to Cisco. A repository typically lists the name, provider, and license, but not where a model comes from, how it has been modified, or what security risks it poses. Provenance Explorer eliminates that blind spot.
The tool aggregates various categories of information for each model. This includes model details such as the number of parameters and tokens used for training, information about the provider, including its headquarters, and license terms with any restrictions on use. Security assessments are also important. The LLMs are therefore scanned for vulnerabilities using ClamAV.
Provenance is more than just a name
We refer to these as “open-weight” models, even though Cisco uses the term “open-source.” This is because LLMs almost never have a transparent training dataset. As a result, it’s not possible to run a new training cycle; only adjustments are possible.
LLMs are therefore fine-tuned, distilled, merged, and re-released, often multiple times. Context is lost along the way. Cisco therefore bases the relationships between models not on self-reported provenance, but on similarity scores from the Model Provenance Kit and Project VAIL.
Cisco released the Model Provenance Kit earlier this year. The open-source toolkit analyzes metadata related to architecture, tokenizers, and weights to determine whether models share a common origin. On a benchmark of 111 model pairs, the kit achieved 98.1 percent precision at a threshold of 0.70.
There are several reasons for this. First, different AI players use different tokenizers, systems that convert language, images, and other information used as training data into discrete pieces that can be reused for generated text.
Understand your “model estate”
For many organizations, it’s time to get a clear grasp of their “model estate,” to introduce a new term. The Hugging Face Hub now hosts over 2 million models, making the attack surface of AI systems enormous. “Model poisoning” is a real risk and difficult to detect.
Cisco has been making strides in the area of secure AI for some time. Last year, it launched Foundation AI with an open-source security model, and more recently, the Antares models that detect vulnerabilities in code. AI Defense, which scrutinized individual LLMs, also fits into this line of work.
According to Cisco, the information in the Explorer is regularly updated and verified by the AI Threat & Security Research team, in collaboration with Project VAIL. The tool is now publicly available.