Fine-tuning is the mechanism. It is routine practice. A producer starts from an existing checkpoint rather than a blank page, so the inherited dependency never lands in a manifest file; it sits in the learned weights, along with the biases and behavioral patterns that came with them [7]. Cisco frames it this way: models carry supply chains, not passports [16].
The study design deserves as much attention as the result. This was a positive control: the tools were asked to recover a relationship that had already been documented, and what the published account carries is that single confirmation, not a detection rate for models whose base checkpoint nobody declared [21]. Cisco's own framing is narrow, and it should be read as written [8].
The two tools sit on opposite sides of the artifact. Cisco's Model Provenance Kit inspects the model from the inside, while VAIL's Behavioral Fingerprinting works from inference behavior on the outside [4]. For anything consumed as a hosted endpoint, where the weights are not yours to open, the behavioral half is the only one you can run [20]. SecurityWeek's earlier coverage records that Cisco has already released an open source tool for AI model provenance [18].
The proposed manifest lists seven fields, and three of them are themselves models with lineage of their own to declare [19]. That recursion is why the software supply chain analogy [11] hands you the shape of the problem without handing you the tooling. Cisco argues fingerprints can corroborate disclosures or surface relationships worth reviewing, and that the industry does not need to wait for regulation to make the practice routine [13].
The country label still buys something. It identifies the accountable developer, the applicable jurisdiction, and the authorized procurement path [9]. Those are answers to legal questions rather than technical ones. A rule that excludes a publisher because Washington treats Chinese AI as a national security threat [17] therefore polices the paperwork, and the check that would test the model itself is the due diligence Cisco says buyers should already be doing on lineage, training dependencies, behavior, and operational control [14]. Only two vendors can currently perform that check, and procurement cannot.
