Think You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says

Cisco and VAIL researchers analyzed AI models using fingerprinting techniques to demonstrate that country-of-origin labels do not accurately reflect the model's upstream dependencies or behavioral characteristics. Models labeled as originating from one country may contain inherited components from models developed elsewhere, due to fine-tuning on existing checkpoints. This provenance entanglement means that a model's lineage can cross geopolitical boundaries, complicating security assessments that rely on national labels. The researchers advocate for routine disclosure of model lineage, including base checkpoints and derivation methods, to enable better risk management similar to software supply chain security practices. They emphasize that model lineage transparency is essential for identifying inherited backdoors, biases, or exploitable behaviors in downstream models.

The inability to accurately determine an AI model's true technical lineage based on country-of-origin labels creates blind spots in security and risk assessment. Organizations relying solely on national labels may unknowingly deploy models containing inherited vulnerabilities, biases, or backdoors from upstream models developed in other countries. This complicates regulatory efforts and procurement decisions aimed at mitigating national security risks associated with AI. The research underscores the potential for supply chain–style risks in AI model development, where vulnerabilities in upstream models propagate downstream, affecting multiple derivative models.

There is no direct patch or fix applicable as this is a research finding about AI model provenance and supply chain risks rather than a software vulnerability. Cisco recommends that enterprises incorporate AI model lineage analysis, including training dependencies and behavioral fingerprinting, into their due diligence processes rather than relying solely on country-of-origin labels. AI developers should routinely disclose model lineage information, such as base checkpoints and derivation methods, to improve transparency. Regulators should seek better understanding of upstream dependencies to inform policy. Users should treat publisher identity as one piece of the risk assessment puzzle and consider technical provenance to identify inherited risks.