Ask Amy Chang, Head of AI Threat Intelligence & Security Research at Cisco, what a model's country-of-origin label actually tells you, and her answer cuts against how most procurement conversations still work. "Country of origin classifiers" aren't sufficient, she said, "to fully encapsulate the lineage and the potential risk" of a model. New research from Cisco and VAIL puts a technical test behind that claim, and the results hold up.
The study looks at NVIDIA's Nemotron model family and Alibaba's Qwen family, a useful case because NVIDIA already publicly documents that some Nemotron releases use Qwen base weights, while others use NVIDIA-developed or Meta Llama weights instead. That gives researchers a known, documented answer to test against. Two independent methods, Cisco's Model Provenance Kit and VAIL's behavioral fingerprinting, each found Nemotron models with documented Qwen ancestry looking substantially more Qwen-like than the broader model catalog would predict, and both recovered the same ordering NVIDIA had already disclosed. A model's name and publisher, in other words, don't erase what it actually inherited.
What's actually detectable, in plain terms
Chang's team measures models across five weight-derived dimensions, one of which is what Cisco calls a layer energy profile: a normalized curve showing how much computational "energy" different depths of a neural network exert while processing tokens. "Even if the architecture of that model is identical," Chang said, two models trained on different data can still produce visibly different energy curves, while models sharing real lineage tend to look similar. VAIL's method works differently but points the same direction: it runs a model against fixed input tokens and analyzes how it behaves at inference, a behavioral fingerprint rather than a structural one.
The fact that two independently built methods, one looking at weights, one looking at behavior, converge on the same answer is the actual finding worth taking seriously. "It shows that two independently developed methodologies to understand model lineage agree to a significant degree of overlap," Chang said. Had they disagreed, she added, that would have opened a very different set of questions the study wasn't built to answer.
The comparison groups are what make this credible
A finding like this only means something if it doesn't show up everywhere. Cisco and VAIL also tested Google Gemma and Meta Llama models against the same Qwen fingerprints, families with no documented Qwen relationship, and found no comparable enrichment. That control mattered enough that Chang's team relied on their own existing catalogs, 184 model fingerprints on Cisco's side, over 1,100 on VAIL's, to establish in advance which families they were confident shared no lineage.
Worth noting plainly: this approach has a real limitation. Closed-weight frontier models like Anthropic's and OpenAI's can't be fingerprinted this way at all, since the method requires access to actual model weights. Asked about the recent, widely circulated dispute over whether Kimi K2 improperly drew from Anthropic's models, Chang was direct about the gap: "It would be difficult only because Anthropic's models are closed weight, so we aren't able to look at the specific dimensions." For proprietary models, outside researchers are still left taking a vendor's word for it.
What this should change for a developer evaluating a model
Chang was clear this isn't a one-time checkbox. "It would require ongoing monitoring," she said, given how fast new models ship. The goal isn't replacing country-of-origin with a new single proxy, but adding real risk factors, lineage, training dependencies, documented disclosure, into a fuller picture instead of leaning on one label to answer a question it was never built to answer.
She was equally direct about the limits of a fingerprint match on its own: "It should be just one of a slew of other things that you would require, because there are some things that a model fingerprint just cannot attest to," including whether ongoing connectivity exists between a model's developer and the deployed system, or whether an organization should rule a model out for reasons that have nothing to do with lineage at all. A fingerprint match is evidence worth investigating, not a verdict.
What happens without a paper trail
The Nemotron-Qwen case study worked cleanly because NVIDIA already disclosed the relationship. Most publishers don't. Asked whether her methods can still detect an undocumented relationship, Chang said yes, with a caveat: "It still can be done without that information, but it would just take a lot longer and a lot more effort." Disclosure doesn't make detection possible, it makes it efficient.
That's the case Chang makes for something like a model bill of materials, formal documentation covering base checkpoints, derivation mechanisms, major training datasets, and synthetic data generators used in a model's development. Nothing requires publishers to produce one today, and Chang doesn't expect that to become universal. "It will never be universal," she said, "but I think that you can set precedents and kind of norms of behavior and expectation." She pointed to NVIDIA's own disclosure practices as a model worth other vendors following voluntarily, not because a regulation demands it.
If you find something undisclosed, what next
For a security team that turns up an undocumented cross-family relationship in their own AI stack, Chang's advice is procedural, not alarmist: check internally whether the finding falls inside the organization's existing risk thresholds, then go directly to whoever's accountable for the model, a third-party provider or the open-weight developer, and ask what else they can disclose.
The claim she thinks is most overstated
Asked directly what's overstated in the provenance and country-of-origin debate right now, Chang didn't hedge: the idea that a model's country of origin alone makes it inherently more dangerous. "We've had plenty of incidents recently to draw on that indicate it isn't really a matter of where that model comes from," she said. "It's more about the behaviors and the lack of controls over the models." Whether guardrails are actually enforced matters more than a publisher's address.
Where the responsibility actually sits
Chang doesn't think model evaluation should sit exclusively with security. As chief AI officer roles become more common, she still sees a role for the CISO specifically, given the direct security implications of both the models themselves and how they're deployed. Cisco also maintains a public LLM security leaderboard tracking how different models hold up against various jailbreak techniques, a practical resource for teams weighing, say, a customer-facing deployment against an internal tool with a very different risk tolerance.
On the broader trajectory of AI agents, a theme that dominated Black Hat this year, Chang pointed to cascading failure as the risk that concerns her most: a single misconfiguration or goal drift compounding across systems increasingly connected to sensitive resources, with no deletion deadline and no clear boundary on how far a failure can propagate. Knowing where a model came from is only useful if you're also watching closely for what it's actually doing.
