AI Model Lineage Risks: Why "Made in USA" Labels Can Mislead

Many organizations have moved to ban Chinese-developed AI from their technology stacks, treating country-of-origin as a reliable proxy for security risk. New research from Cisco and VAIL (Variance-Aware Inference Layer) suggests that approach is dangerously incomplete. In a blog post titled "The 'U.S. vs. China' AI Trap: An Incomplete Proxy for AI Security," the researchers argue that national labels fail to capture what they call "provenance entanglement"—the inherited behaviors, weights, and biases that flow from one model into another through fine-tuning and checkpoint reuse.

To test this, the team applied two AI model fingerprinting techniques to popular open-weight models. Cisco's Model Provenance Kit analyzes model artifacts from the inside by inspecting learned weights, while VAIL's Behavioral Fingerprinting evaluates inference behavior from the outside. Both approaches were applied to NVIDIA's Nemotron family and Alibaba's Qwen models, since several Nemotron variants are known to be fine-tuned from Qwen base weights. The results were telling: post-training and a new publisher name did not erase detectable lineage. "Both methods found Nemotron models built from Qwen base weights to be substantially more similar to Qwen models than chance would predict," the researchers wrote. A U.S.-labeled model could quietly carry Chinese-origin behavioral characteristics, and vice versa—something organizations should verify with a proper browser fingerprint test mentality applied to their AI dependencies.

The deeper concern is supply chain risk. Just as software relies on Software Bills of Materials (SBOMs) to track inherited vulnerabilities, AI models need comparable transparency—but the dependencies aren't declared in a manifest file. "They're embedded in the learned weights themselves," Cisco notes. If an upstream model is later found to contain a backdoor, systematic bias, or exploitable behavior, downstream consumers could be exposed without knowing it. Cisco recommends three areas for improvement: stronger model provenance tooling, standardized behavioral testing, and procurement processes that look beyond the publisher label.

The takeaway for security teams is clear: a model labeled as U.S.-developed is not automatically free of foreign influence, and a Chinese-labeled model is not automatically compromised. Lineage must be verified, not assumed. Before deploying any third-party AI into production, organizations should audit their full dependency chain—just as they would run a privacy checkup on a new vendor—because the inherited risk lives inside the weights, not on the label.