Cisco launches open-source fingerprinting tool to track AI model vulnerabilities across supply chains

Cisco just dropped an open-source tool that treats AI models like crime scene evidence. The Model Provenance Kit, released on April 30, generates unique “fingerprints” for AI models, letting developers trace their origins and flag inherited vulnerabilities without digging through documentation by hand. Instead of asking “where did this model come from and what baggage did it bring,” and then spending hours hunting for answers, the tool automates the entire lineage check against a database of roughly 150 foundational models across more than 45 families hosted on Hugging Face. How fingerprinting actually works The toolkit, available as a Python CLI on GitHub, uses a combination of metadata analysis, tokenizer similarity, and weight-level signals to build its fingerprints. Those weight-level signals include things like embedding geometry and normalization layers, which are essentially the structural DNA of how a model processes information. It operates in two modes. Compare mode lets you check whether two models share common ancestry. Scan mode runs a broader sweep, matching a model against Cisco’s full database to identify its family tree. The benchmark performance is striking: 100% ...