If you think you’ve excluded all Chinese AI from your tech stack, you may need to think again.
The US government’s attitude toward Chinese AI is that it is a national security threat. This alone could persuade patriotic Americans to eschew any AI labelled ‘Chinese’ in favor of an AI without that label. Cisco has published details on new research from itself and VAIL demonstrating that national labels do not give an accurate picture of model lineage and characteristics.
In a blog post titled “The ‘U.S. vs. China’ AI Trap: An Incomplete Proxy for AI Security,” Cisco argues that country labels do not provide a complete picture of an AI model’s components because of a phenomenon it calls provenance entanglement.
Researchers used two AI model fingerprinting methods to analyze model weights and behavioral patterns, and found that they do not accurately or necessarily reflect the model’s publisher name and country of origin.
They suggest that AI models require their own form of SBOM but note there are difficulties: “the dependencies aren’t listed in a manifest file, they’re embedded in the learned weights themselves.” This is because a model producer is likely to fine-tune its AI with existing checkpoints rather than training it from a blank page. In short, it can inherit weights, biases and behavioral patterns from a different model originating in a different country to the one indicated on the label. A US model could contain behaviors inherited from a Chinese model while a Chinese model could inherit US characteristics.
The developer and country of origin on the AI label retains value, says Cisco, providing insight into the accountable developer, the applicable jurisdiction, and ‘authorized’ procurement process – but it does not provide an accurate assessment of what may exist inside the model.
Nemotron and Qwen models were chosen for study since it is known that some Nemotron models use Qwen base weights.
The researchers looked for surviving relationships between the two families, using Cisco’s Model Provenance Kit and VAIL’s Behavioral Fingerprinting. The former examines the artifact from the inside, while the later examines inference behavior from the outside.