From Provenance to Continuous Verification

Open-source models are entering enterprise and public-sector systems faster than most organizations can catalog them. New base models, fine-tunes, distillations, merges, quantizations, and repackaged variants appear every day. A repository page may provide a name, a provider, and a license. That metadata is useful. It is not evidence that a model is what it claims to be.

This is why Cisco’s new AI Supply Chain Provenance Explorer arrives at an important moment. The Explorer brings model details, provider context, lineage, licensing, usage restrictions, and security findings together in a public resource for evaluating open-source models before deployment.

Project VAIL is proud to contribute behavioral-similarity analysis to Provenance Explorer. Cisco combines multiple forms of technical evidence—including its analysis of model files and VAIL’s analysis of model behavior—to identify relationships that self-reported metadata alone cannot establish.

The result advances a foundational requirement for AI governance: know what is entering the system.

It also points to the requirement that follows: verify what is operating in the system.

Provenance answers questions about origin and lineage. Which model is this? What is it derived from? What license and security considerations may have traveled with it?

Once a model is deployed, the operational questions expand:

• Is the approved model still the model being served?

• Has the endpoint changed through an update, swap, quantization, routing decision, inference-stack change, or parameter adjustment?

• Is the model behaving within the range that was tested and approved?

• Can the organization produce an evidence trail showing when the system was stable and when it changed?

These questions cannot be answered by provenance records alone. They require direct, recurring measurement at runtime.

AI systems fail differently from traditional software: silently, probabilistically, and often without a stack trace. An API can remain available while the model behind it changes. A model name can remain constant while its outputs drift. A system can pass a conventional health check while the behavior relevant to the application has moved outside its expected range.

For systems in which the wrong action has real consequences, availability is not enough. Identity and behavior must also be verified continuously.

Introducing Agent Assurance Engine

The Agent Assurance Engine watches your endpoints continuously from your network, confirms they're working the way you need them to, without exposing your customer data.

VAIL’s work is grounded in Model Informatics: the systematic study of AI models as complex information systems. Inspired by bioinformatics, Model Informatics develops methods to observe, characterize, recognize, and verify models through the information expressed in their behavior.

In deployment, however, a model is rarely encountered as a bare artifact. It may be accessed through a raw endpoint or served through an inference stack, router, harness, or other framework that materially affects the behavior presented to the application.

VAIL analyzes the behavior that emerges at that system boundary. We send a compact set of probes through the same interface used by the application and measure the responses of the live system. The resulting evidence does not depend on a provider’s label or on access to proprietary internals. It reflects the system as it is actually being delivered, including changes introduced by the model, endpoint, serving environment, or framework surrounding it. Our public Stability Arena demonstrates that model stability is variable across different endpoints.

Guardrails, post-training, evaluations, infrastructure controls, and traces each address a different part of an AI system. Direct behavioral measurement does something structurally different: it repeatedly tests the deployed AI system itself.

It asks whether the system operating today still behaves like the system that was selected, evaluated, and approved. Because the evidence is obtained independently through the system interface, it can reveal material change even when model names, configurations, uptime signals, and conventional logs appear unchanged.

This makes direct measurement orthogonal to the surrounding control stack.

Cisco’s Provenance Explorer gives organizations a stronger basis for deciding which open-source models should enter their environments. That is a meaningful advance for an ecosystem in which lineage is increasingly complex and model claims are difficult to verify.

The next step is to carry that evidence into operations.

Know the model selected for deployment. Verify the model actually being served. Monitor its behavior over time. Maintain an auditable record when it changes.

The surface of that work is widening. As AI systems become agentic, behavior is distributed across models, harnesses, tools, memory, routing, permissions, and the trajectories that connect them. VAIL is beginning to extend Model Informatics beyond the model endpoint, using recurring probes and trajectory measurement to develop independent evidence about how Agent Stacks change over time. The governance objective remains the same: verify the system as it is operating, detect material change, and provide an evidence trail that complements traces, guardrails, and conventional observability.