Paper deep dive
AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance
Weiru Han, Xuetao Shi, Wenyi He, Wei Wang, Rui Zhao, Moming Duan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 97%
Last extracted: 6/20/2026, 8:09:41 AM
Summary
The paper presents AI Supply Chain Galaxy (AISCG), an interactive 3D visual analytics system designed to audit model provenance and license compliance in the rapidly growing AI ecosystem. By mapping nearly one million models from Hugging Face into a 3D spatial layout, AISCG enables users to explore complex, multi-hop dependency networks through structural, ecological, and risk-based views. The system utilizes a rule-based engine to detect issues like 'license drift' and metadata inconsistencies across various reuse methods (fine-tuning, adapters, merging, etc.). Empirical analysis reveals that 55.46% of models exhibit compliance risks, highlighting the critical need for visual tools to navigate the legal complexities of the AI supply chain.
Entities (7)
Relation Signals (4)
AI Supply Chain Galaxy → analyzes → Hugging Face
confidence 100% · We demonstrate its efficacy through an ecosystem-scale empirical analysis of 908,449 models from Hugging Face.
Fine-tuning → createsderivativeof → Model
confidence 100% · Through methods such as fine-tuning, adapters, quantization, and merging, these components have formed a highly interconnected reuse network.
Adapter → exhibitsrisk → License Omission
confidence 100% · including a 56.67% license omission rate in adapter derivations
Llama → haslicense → Llama license family
confidence 100% · AI model-specific licenses (e.g., OpenRAIL, Llama license family)
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid proliferation of machine learning model reuse has transformed the AI ecosystem into a highly interconnected supply chain. Traditional compliance tools and static reports struggle to navigate these massive, multi-hop dependency networks. To address this, we present AI Supply Chain Galaxy (AISCG), an interactive 3D visual analytics system for model provenance and compliance auditing. AISCG maps models into a 3D spatial layout, integrating explicit structural dependencies with a rule-based compliance engine. It supports multi-scale exploration, from global community detection to localized, path-aware lineage tracing. We demonstrate its efficacy through an ecosystem-scale empirical analysis of 908,449 models from Hugging Face. Our findings reveal a concerning landscape: 55.46% of models exhibit compliance risks or metadata conflicts/omissions. We also identified distinct risk patterns, including a 56.67% license omission rate in adapter derivations and an 8.05% "license drift" rate in fine-tuning. Through a case study on the complex Llama model family, we show how AISCG empowers analysts to intuitively trace inherited restrictive terms and identify root causes across deep topological networks, significantly reducing the cognitive load of compliance auditing.
Tags
Links
- Source: https://arxiv.org/abs/2606.16292v1
- Canonical: https://arxiv.org/abs/2606.16292v1
Trouble viewing inline? Open PDF directly →
Full Text
40,365 characters extracted from source content.
Expand or collapse full text
AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance Weiru Han 1 , Xuetao Shi 1 , Wenyi He 1 , Wei Wang 1 , Rui Zhao 2 , and Moming Duan 1⋆ 1 East China Normal University, Shanghai 200062, China 2 Tianjin University, Tianjin, China Abstract.The rapid proliferation of machine learning model reuse has transformed the AI ecosystem into a highly interconnected supply chain. Traditional compliance tools and static reports struggle to navigate these massive, multi-hop dependency networks. To address this, we present AI Supply Chain Galaxy (AISCG), an interactive 3D visual analytics system for model provenance and compliance auditing. AISCG maps models into a 3D spatial layout, integrating explicit structural dependencies with a rule-based compliance engine. It supports multi-scale exploration, from global community detection to localized, path-aware lineage tracing. We demonstrate its efficacy through an ecosystem-scale empirical analysis of 908,449 models from Hugging Face. Our findings reveal a concern- ing landscape: 55.46% of models exhibit compliance risks ormetadata conflicts/omissions. We also identified distinct risk patterns, including a 56.67% license omission rate in adapter derivations and an8.05% “li- cense drift” rate in fine-tuning. Through a case study on the complex Llama model family, we show how AISCG empowers analysts to intu- itively trace inherited restrictive terms and identify root causes across deep topological networks, significantly reducing the cognitive load of compliance auditing. Keywords:License Compliance · AI Supply Chain · Visual Analytics. 1 Introduction In recent years, the production, release, reuse, and creation of derivative models from machine learning (ML) models have entered a stage of large-scale prolifer- ation. Model platforms, such as Hugging Face, have amassed millions of model assets. Through methods such as fine-tuning, adapters, quantization, and merg- ing, these components have formed a highly interconnected reuse network [2,3]. This development paradigm centered on model reuse significantly lowers the bar- rier to AI application. However, it simultaneously complicates model provenance tracking and compliance auditing [4]. In scenarios involving multiple model and data sources, the AI supply chain has evolved from linear dependencies into a complex network structure [1,3]. ⋆ Corresponding author: mmduan@dase.ecnu.edu.cn. arXiv:2606.16292v1 [cs.SE] 15 Jun 2026 2Weiru Han, Xuetao Shi et al. The expansion of technical reuse is accompanied by a corresponding increase in the complexity of license governance. The current ML ecosystem is character- ized by the concurrent application of traditional Open Source Software (OSS) licenses (e.g., Apache-2.0, MIT, GPL), content licenses (e.g., Creative Com- mons Licenses), and AI model-specific licenses (e.g., OpenRAIL, Llama license family) [4,5,9]. However, these licenses exhibit significant disparities regarding applicable objects, definitions of derivatives, redistribution obligations, use re- strictions, and liability terms. Existing studies indicate that issues such as license mismatch, license proliferation, and license conflicts areprevalent in the ML do- main [4,5]. A notable instance is “license drift”, where thelicensing terms of a derivative model diverge from its upstream ancestors—for example, through the replacement of restrictive obligations with permissive ones. It becomes difficult to determine where legal risks originate when models dependon multiple types of derivatives. This complexity allows compliance risks to silently propagate down- stream along deep dependency chains. Beyond explicit links, the AI supply chain is further complicated by implicit dependencies such as knowledge distillation and data-driven inheritance [4,5]. While identifying these remains an open re- search question, providing a transparent view of the explicit reuse network is a critical and foundational first step for compliance auditing. Traditional Software Composition Analysis (SCA) tools (e.g., Black Duck, FOSSology) [12,14], which primarily rely on code-level dependency linking or static signature scanning, are inadequate for handling such a massive and entangled ecosystem [1,4]. Although existing studies have examined the model ecosystem and its compli- ance challenges [1,3,4,9], there is a lack of systematic support for integrated and interactive compliance analysis. On one hand, supply chainresearch primarily provides macro statistics and identifies general trends in the ecosystem [1,2,3]. On the other hand, license studies focus on the extraction ofrules and the as- sessment of legal compatibility [4,5,9]. These two areas remain largely separate, as legal frameworks have not yet been integrated with the large-scale depen- dency data found in model repositories. For auditors, tracing a specific legal risk through a long chain of models requires the manual correlation of textual rules with structural data. This process is difficult to perform using only static reports or offline summaries. Therefore, an integrated approach is needed to help users navigate the relationship between legal constraints and model lineages, which leads to the requirement for more effective methods of data exploration. Visual analytics is essential for transforming abstract metadata into action- able license compliance insights across multiple scales. License compliance states are dynamic properties that propagate through model lineages [4]. At the local lineage level, visualizing these specific paths allows auditors to intuitively trace restrictive obligations and pinpoint exact conflict origins. At a global systemic level, mapping the structural modularity of the AI supply chain reveals dense model communities and helps analysts identify core reuse hubs. Therefore, an effective visual analytics approach for license complianceshould bridge these scales, coupling global ecosystem structures with localized, path-aware compli- ance details. AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance3 濛濣濛濠濙澣濛濙濡濕澡澦澡澦澫濖 濛濣濛濠濙澣濛濙濡濕澡澦澡澦澫濖澡濝濨 濣濤濙濢濕濝澣濫濜濝濧濤濙濦澡濧濡濕濠 濅濫濙濢澣濅濫濙濢澧澡濊激澡澬澶澡澽濢濧濨濦濩濗濨 濩濢濧濠濣濨濜澣濅濫濙濢澧澡濊激澡澬澶澡澽濢濧濨濦濩濗濨 濡濙濨濕澡濠濕濡濕澣濁濙濨濕澡激濠濕濡濕澡 澧澡澬澶澡澽濢濧濨濦濩濗濨 濧濨濕濖濝濠濝濨濭濕濝澣濧濨濕濖濠濙澡 濘濝濚濩濧濝濣濢澡濬濠澡濖濕濧濙澡澥澢澤 Fig. 1: AI supply chain visualized in AISCG. Node colors encode application domains, while edge colors represent distinct reuse methods. In this paper, we propose AI Supply Chain Galaxy (AISCG), a 3Dvisual an- alytics system for model provenance and license compliance. The system maps millions of models into a 3D spatial layout where node geometry (size and color) encodes centrality and risk states, while orbital edges represent diverse reuse dependencies (Fig. 1). We provide three core capabilities:(1) Structural Insight, revealing model communities through spatial expansion; (2) License compliance analysis, providing a license compliance report for each model; and (3) Lineage Tracing, isolating multi-order lineage paths to pinpoint legal origins. Supporting both desktop and mobile navigation, our system offers an intuitive environment that facilitates interactive compliance exploration for auditing compliance in complex AI supply chains. Compared with static reports and table-based sum- maries, our system integrates structural exploration, compliance status tracking, and interactive compliance analysis in a unified workflow. This provides a more intuitive entry point for compliance analysis in complex model-reusing scenarios. The main contributions of this paper are summarized as follows: •A Multi-Dimensional Framework:We propose a novel visual analytics framework that integrates model dependencies with legal compliance logic across spatial, temporal, and topological dimensions. •The AI Supply Chain Galaxy System:We implement a 3D visual ana- lytics system providing three core capabilities: community detection, license compliance analysis and provenance recovery. •Large-Scale Empirical Insights:Analyzing 908,449 models, we find that 55.46% exhibit compliance risks. We identify distinct riskpatterns, such as a 56.67% license omission rate for child models in adapter-based relationships and an 8.05% “license drift” rate in fine-tuning edges. 4Weiru Han, Xuetao Shi et al. 2 Related Work 2.1 AI Model Ecosystem and Supply Chain Analysis Recent studies consistently show that the ML ecosystem has evolved from iso- lated model releases into a large-scale reuse network. Jiang et al. first char- acterized the pre-trained model supply chain across multiple hubs and high- lighted that model ecosystems already exhibit software-supply-chain-like risk surfaces [1]. Their follow-up study further provided empirical evidence of reuse workflows on Hugging Face, including provenance, reproducibility, and trust- related challenges in real-world model reuse [2]. At largerscale, Laufer et al. analyzed nearly two million Hugging Face models and revealed rich family-tree structures formed by fine-tuning, adapters, quantization,and merging [3]. From a supply-chain risk perspective, prior security work shows reuse and outsourcing can introduce persistent downstream vulnerabilities. BadNets showed that backdoors injected during outsourced or transfer-based workflows can re- main effective even after downstream adaptation [16]. This persistent vulnera- bility demonstrates that model lineage can act as a risk-propagation channel. A parallel line of work emphasizes model lineage and ecosystem cartogra- phy. Horwitz et al. proposed unsupervised model tree heritage recovery directly from weights, showing that lineage can be inferred even whenmetadata is incom- plete [15]. Their Model Atlas position further argues for a population-level graph representation of models, attributes, and transformations, enabling forensics and ecosystem-scale analysis [17]. Complementing this, Wu et al. [22] derive “LLM DNA” from behavioral signatures to identify undocumented lineages across ar- chitectures without requiring weight access. This direction is consistent with broader calls for model transparency and documentation (e.g., model cards) [8], but also highlights a key limitation of current practice: documentation is often missing, sparse, or inconsistent at scale [2,6,15,17]. Overall, existing research has established three facts: (i) model reuse is mas- sive and structurally complex [1,2,3], (i) supply-chain risks can propagate along reuse paths [1,16], and (i) provenance signals are frequently incomplete, mo- tivating lineage recovery via weight-based [15] or behavioral [22] fingerprinting and atlas-style modeling [17]. However, most prior work remains measurement- oriented or method-oriented, with limited support for interactive, path-level analysis that jointly links topology, provenance, and attributes related to com- pliance. This gap motivates our visual analytics approach for AI model supply chain exploration and auditing. 2.2 License Compliance in Machine Learning Researchers increasingly recognize license compliance inML as a distinct prob- lem that existing OSS compliance pipelines cannot fully address. In contrast to software-only projects, ML systems typically combine heterogeneous assets (code, datasets, models, and generated artifacts) under different licensing regimes. These regimes encompass a complex mix of OSS licenses, content licenses, and AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance5 model-specific licenses [4,5,9,13]. As model reuse scales through fine-tuning, adapters, quantization, and merging, legal obligations propagate across multi- step dependency chains. Consequently, rights and obligations become signifi- cantly harder to interpret compared to conventional file-linking scenarios [4,5]. Recent work has begun to formalize this problem space. ModelGo presents one of the first practical analyses tailored to ML workflows and reports real- world conflict patterns in mixed-license reuse settings [4]. Building on this line, subsequent studies further argue that current model licensing practice suffers from systematic issues, especially license mismatch, proliferation, conflict. They provide evidence that widely used OSS or content licenses are often semantically under-specified for model publishing and derivative governance [5,13]. In parallel, behavioral-use licensing (e.g., RAIL-style restrictions) expands the compliance landscape beyond classical redistribution obligations, introducing enforceable use-constraint terms that are uncommon in traditional OSS ecosystems [9]. These developments indicate that ML compliance is not only a compatibility-checking problem, but also a workflow- and policy-aware reasoning problem. Prior OSS literature remains important as methodological foundation. SPDX- based compatibility automation and large-scale conflict studies in software ecosys- tems provide transferable ideas for rule encoding, incompatibility graphs, and conflict detection [12,14]. However, their assumptions do not always hold in ML settings: model artifacts often lack explicit embedded license texts; dependencies can be implicit (e.g., representation transfer rather thandirect code inclusion); and obligations may involve interactions among model, data, and downstream outputs [4,5,13]. Therefore, OSS techniques are necessarybut insufficient as end- to-end solutions for ML compliance. A further emerging frontier concerns generative systems and AI-assisted de- velopment. LiCoEval shows that LLMs can produce code with similarity to li- censed sources while failing to provide adequate license information, revealing a new operational compliance gap at generation time [10]. At the ecosystem gov- ernance level, policy analyses also highlight persistent ambiguity in how “open” is interpreted in AI practice, which complicates compliance expectations and en- forcement boundaries [7]. Together, these findings reinforce the need for compli- ance analysis approaches that are both technically grounded and context-aware. Overall, existing work has established the urgency of ML license compliance and identified key risk patterns, but there is still limited support for analyst- facing, interactive environments that connect legal ruleswith concrete multi-hop dependency structures. This gap motivates our approach, which couples compli- ance reasoning with explicit model provenance and dependency exploration in a unified analysis workflow. 2.3 Visual Analytics for Provenance and Dependency Networks Recent empirical studies have documented the scale and structural complexity of the machine learning ecosystem. Laufer et al. [3] analyzed nearly two mil- lion models on Hugging Face and identified rich family-tree structures formed through fine-tuning, adapters, quantization, and model merging. Horwitz et 6Weiru Han, Xuetao Shi et al. al. [15] explored model heritage recovery when metadata is incomplete, and their later “Model Atlas” perspective [17] called for a population-level graph representation to support ecosystem-scale lineage tracking. Visualizing such large, dense, and heterogeneous graphs remains a central challenge in graph analytics. The survey by von Landesberger et al. [11] shows that high-density topologies can exceed the practical readability of conventional 2D node-link views. Prior perceptual and empirical work further suggests that interactive 3D environments may provide task-dependent benefits, particularly for path-tracing and cluster-identification tasks in complex networks [18,19]. For machine learning analysis interfaces, Bäuerle et al. [21] emphasize the role of Multiple Coordinated Views (MCVs) in supporting workflow-oriented exploration and inspection. In the context of provenance and dependency net- works, this perspective indicates that no single view is sufficient for both global topology understanding and local path-level examination.Following this design rationale, we combine a spatial graph view with coordinateddetail views to support multi-scale exploration of model lineages and dependency relations. 3 Design 3.1 Architecture and Data Pipeline AI Supply Chain Galaxy follows an offline-online architecture. Offline processing is responsible for data collection and graph extraction, while online runtime focuses on interactive visual analytics (Architecture seeFig. 2). Offline stage. The pipeline ingests pre-collected model metadata and depen- dency relations, normalizes heterogeneous license fields into project-level canon- ical keys, builds a directed reuse graph, precomputes 3D node coordinates via an offline force-directed layout, then serializes graph artifacts into deployment- ready files: binary arrays for high-volume structural/spatial data, JSON objects for semantic attributes and compliance outputs. Online stage. The frontend asynchronously loads these artifacts, reconstructs in-memory graph views, serves low-latency interaction primitives: neighborhood query, shortest-path tracing, node-centric compliance inspection. An event-driven runtime syncs rendering and analytical panels, so node selection, highlighting, windowed diagnostics update consistently in a unified workflow. We adopt a hybrid binary/JSON storage strategy (Table. 1). This design separates dense numeric arrays (binary for speed and memoryefficiency) from semantically rich attributes (JSON for flexibility and interpretability), enabling fast loading without sacrificing explainability. 3.2 Compliance Analysis Rules To operationalize license compliance over AI model reuse graphs, we implement an offline rule-based analysis module. After normalizing rawlicense metadata AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance7 Table 1: Hybrid data storage strategy for scalable graph artifacts. Artifact Name Description and Semantic Content positions.binPrecomputed 3D coordinates (dense numeric arrays). links.binCompact adjacency encoding for high-throughput parsing. link_data.binFlattened edge attribute arrays (source/target/type IDs). labels.jsonNode labels used for search and interactive display. nodeData.jsonSemantic metadata (license, author, tags, timestamps). link_types.jsonDependency relation type dictionary. manifest.jsonVersion indexing and artifact mapping entry. Data Collection Model metadata & Dependency Graph Extraction & Normalization Offline Layout Precomputation 3D coordinate precomputation two million raw records clean graph (908k nodes) + attributes Hybrid Serialization Binary for throughput & memory efficiency layout-enhanced graph Offline Pipeline Frontend Loading & Graph Service Async artifact loading In-memory indexed graph model Adjacency and metadata access APIs Coordinated Visual Analytics 3D Galaxy View Node/Lineage Detail Panel Compliance Analysis Panel Analysis Windows versioned artifact bundle runtime state + events user interactions (select, highlight, next) Online Interactive Runtime n JSON for semantic flexibility & explainability 1 2 3 4 5 6 Fig. 2: Architecture and Data Pipeline of AI Supply Chain Galaxy. into canonical license keys, the engine evaluates compliance risks across prede- fined propagation edge types (Finetune, Merge, Quantize, Adapter) and gen- erates node-level risk records. The current implementation applies eight rules under three analytical dimensions (Table. 2): Local Integrity captures node-level metadata defects and semantic mismatches; Propagation Consistency models the transfer of obligations and restrictions via downstream BFS traversal; and Provenance Legality verifies whether derivative license claims are supported by official upstream lineage. Each triggered rule produces structured, explainable risk entries with assigned severity levels (Warning/Error), enabling interpretable root-cause tracing for complex compliance failures. This module is designed to provide heuristic risk indications rather than formal legal adjudication. 3.3 Visual Encoding and Layout To facilitate the exploration of massive and entangled model supply chains, we design a multi-modal visual encoding scheme. By mapping different semantic attributes to visual channels, our system provides four analysis views (Fig. 3), enabling analysts to switch perspectives across structural, ecological, and risk dimensions. The system adopts an offline precomputed 3D graph layout. In the Default View (Fig. 3a), we establish the structural baseline: 8Weiru Han, Xuetao Shi et al. Table 2: Compliance analysis rules mapped across three analytical dimensions. Analytical DimensionRuleDetection Goal and Risk Description Local IntegrityMismatchDetects missing, unknown, or semantically inconsistent metadata (e.g., naming cues conflicting with declared tags). Propagation ConsistencyCopyleft_TermsIdentifies the loss or relabeling of restrictive terms during derivation. CopyleftDetects inconsistencies in strict copyleft license propagation. Conflict_NDFlags potential derivative-use conflicts under ND-constrained upstream sources. Conflict_CCIdentifies predefined incompatibility patterns between source and target C licenses. Provenance LegalityConflict_FSFVerifies downstream claims against GPL-family upstream constraints. Conflict_La2E/La3EChecks whether Llama-2/3 license claims are supported by official lineage ancestry. Node Encoding: All nodes are rendered in white to maintain visual neutrality, focusing the user’s attention on the network topology. Nodesize encodes struc- tural importance (e.g., in-degree or centrality proxy), highlighting the “hubs” of the supply chain. Edge Encoding: Color represents the reuse relationship type (e.g., Fine- tuning, Merging, Adapter). This allows analysts to perceive the technical pat- terns of model evolution at a glance. To uncover the macro-level organization of the AI ecosystem, we provide three categorical views: (1) Community View (Fig. 3b) applies color mapping based on structural clustering. This facilitates the rapid identification of community and cross-community bridges. (2) In Task Type View (Fig. 3c), nodes are color-coded by their appli- cation domain (e.g., NLP, Multimodal, Computer Vision). This view features an interactive legend (bottom-right of Fig. 3c). Users can dynamically toggle specific node categories or edge types. This capability can help reduce visual clutter and focusing on domain-specific supply chains (e.g., the Merging paths within the NLP domain). (3) The Risk View (Fig. 3d) transforms legal risks into immediate visual signals. While maintaining the topological context, the system renders models with detected license conflicts in alarm red.Through this view, analysts can perceive the spatial distribution of compliance risks. 3.4 Interactive Compliance Workflow We organize interactions around a workflow from global exploration to localized compliance decisions. (Fig. 4) Users start from the global 3D galaxy view, utiliz- ing pan/zoom/rotate navigation to discover macro-structures such as hubs and dense communities. To locate a specific target, the system supports focal point retrieval via direct node clicking or the Search Bar. Upon searching, the camera smoothly interpolates to the target’s coordinates. AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance9 澜濕澝 澜濖澝 澜濗澝 澜濘澝 Fig. 3: Multi-faceted Visual Analysis Modes in AISCG, (a) Default View with edge-based reuse types, (b) Community View for structural clustering, (c) Task Type View with interactive filtering, and (d) Risk View highlighting license compliance issues. After selecting a focal node, the system provides a multi-faceted compliance report. The Detailed Data Panel displays model metadata (e.g., downloads, likes, license tags) and local connectivity. If the compliance engine detects a violation, the License Compliance Result Window explicitly lists the triggered risk rules (e.g.,Copyleft_Terms). Crucially, the system identifies the upstream origin of the risk. For instance, as shown in Fig. 4, the system reports: “Inherited re- strictive terms from meta-llama/Meta-Llama-3-8B (llama3)”, This attribution reduces the time required to pinpoint the root cause in deep supply chains. To verify the diagnosed risks, the system provides two visualization aids for path tracing. The Highlighting Function illuminates the entire inheritance chain in the 3D space, showing the path from the root model to the current node. Simultaneously, a localized 2D Inheritance Graph flattens the genealogy, providing a schematic view of the multi-hop relationships.Through the “Next” and “Highlight” controls, analysts can perform a step-by-step traversal along the provenance path, manually inspecting the legal transitions at each generation. 10Weiru Han, Xuetao Shi et al. 澧澢澔濈濜濙澔濠濝濗濙濢濧濙澔濗濣濡濤濠濝濕濢濗濙澔 濦濙濧濩濠濨澔濫濝濢濘濣濫 澥澢澔濧濙濕濦濗濜澔濖濕濦 澨澢澔濈濜濙澔濜濝濛濜濠濝濛濜濨濝濢濛澔濚濩濢濗濨濝濣濢 澦澢澔濈濜濙澔濘濙濨濕濝濠濙濘澔濘濕濨濕澔 濤濕濢濙濠澔濣濚澔濨濜濙澔濡濣濘濙濠 澩澢 澦澸澔濝濢濜濙濦濝濨濕濢濗濙澔濛濦濕濤濜 Fig. 4: The analysis Interface of AISCG, featuring coordinated views for search- ing, auditing, and lineage tracing. 3.5 Design Discussion Our design follows three practical choices. First, we use 3Dspatialization as the primary structural view to support macro-level exploration. Second, we adopt an offline-layout and online-interaction pipeline to avoid expensive runtime global recomputation and to keep exploration responsive at large scale. Third, we use event-driven modular coordination to synchronize rendering, lineage inspection, and compliance panels while preserving implementation extensibility. The current system focuses on explicit, metadata-declareddependencies and rule-based compatibility checks. Therefore, the output should be interpreted as analyst support rather than formal legal adjudication. Implicit dependencies (e.g., distillation- or data-mediated inheritance) and broader legal interpretation remain out of scope and are left for future work. 4 Empirical Analysis To evaluate the effectiveness of our visual analytics approach and to uncover the current state of model licensing practices, we conducted an ecosystem-scale empirical study. We applied our offline rule-based compliance engine to a massive dataset collected from the Hugging Face hub. 4.1 Ecosystem-Scale Compliance Landscape The dataset comprises 908,449 non-independent models (i.e., models possessing explicit upstream or downstream derivation relationships). By executing the compliance rules defined in Section 3.2, we obtained a macro-level diagnostic of the AI supply chain. AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance11 濁濣濘濙濠澔濗濣濩濢濨濧澔濕濨澔濘濙濤濙濦澔 濘濙濦濝濪濕濨濝濣濢澔濨濝濙濦濧澔澜激澩澟澝漣 激澩漣澥澦澨 激澪漣澧澩澭 激澫漣澧 激澬漣澧澤澫 激澭漣澬澦 激澥澤漣澩澦 激澥漣澩澪 激澥澦漣澦澫澤 激澥澧漣澧澩 激澥澨漣澥澭 激澥澩漣澥澭 激澥澪澡激澧澭漣澨澥 澸濙濦濝濪濕濨濝濣濢澔澸濙濤濨濜 濁濣濘濙濠澔澷濣濩濢濨濧 濂濣濨濙澮澔瀂濁濝濧濗澡濁濝濢濣濦瀃澔濕濛濦濙濛濕濨濙濧澔濕濠澔濠濝濗濙濢濧濙濧澔濫濝濨濜澔澰澥澤澔濝濢濧濨濕濢濗濙濧 Fig. 5: License evolution across successive generations inthe model supply chain. The Sankey diagram visualizes the propagation and transformation of licenses from root models (L0) to their derivatives across five tiers (L0-L4). The horizon- tal axis represents the derivation depth, while vertical blocks represent license categories. Flows between tiers indicate license inheritance or changes; the width of each flow is proportional to the model count. Our evaluation reveals a concerning ecosystem: 55.46% of the analyzed mod- els exhibit at least one compliance risk or license annotation conflict. As sum- marized in Table. 3, the vast majority of compliance failures stem from local metadata quality issues. The Local Integrity rule (Mismatch) flagged 459,745 models, accounting for 50.6% of the total dataset. This indicates a pervasive phenomenon where derivative models are published with missing or unknown licensing information. Furthermore, downstream obligation failures are common. Approximately 13.2% (119,898 models) triggered the Restrictive Terms Continuity rule (Copy- left_Terms). Downstream models fail to inherit mandatory restrictive clauses from their upstream ancestors (e.g., a derivative explicitly based on Llama 3 being incorrectly relabeled as Apache-2.0). To visualize how compliance risks propagate across generations, we extracted a “forest” comprising 880,057 models, excluding multi-parent merges to ensure a clear, single-lineage evolutionary path. As illustratedin Fig. 5, the Sankey 12Weiru Han, Xuetao Shi et al. diagram depicts the inter-generational dynamics of license inheritance across five tiers (L0 to L4). The visualization results show that from L0 to L1, a large number of models lost their licenses during the first derivation. Such as the Gemma family and models categorized under the “other” license, half of their child models lose their license metadata during the first derivation. 50.6% of the models have “Mismatch” problem, many of which are causedby the loss of license information during inter-generational transfer. Even if the root node has an extremely permissive Apache-2.0 license, there is still traffic going into “None” (cyan strip). At the same time, we can also clearly seethat for models with licenses containing restrictive terms, their derivedmodels have changed the licenses to more permissive ones such as Apache-2.0 and MIT.This phenomenon can be observed in all four derivations in the figure. Table 3: Distribution of triggered compliance risks across the ana- lyzed dataset. Risk Category Models% Mismatch459,745 50.61 Copyleft_Terms119,898 13.20 Conflict_La3E8,924 0.98 Conflict_La2E3,883 0.43 Copyleft3,866 0.43 Conflict_ND3,378 0.37 Conflict_C1,554 0.17 Conflict_FSF267 0.03 Fig. 6: Conflict rates across reuse topologies. 4.2 Compliance Status of Different Types of Edges To understand how different technical reuse paradigms impact legal compliance, we analyzed the conflict rates across different dependency edge types. An edge is classified as a “conflict edge” if at least one of its connecting nodes exhibits a compliance violation. As illustrated in Fig. 6, the risk varies significantly depend- ing on the topological relationship. To uncover the causes of these conflicts, we investigated the incidence of missing licenses and “explicit license drift” (where restrictive upstream clauses are overwritten by permissive downstream licenses) in different types of edges. While license omission is prevalent across the ecosystem, the degree of in- formation loss varies significantly by reuse paradigm. Adapters have the highest proportion among all relationships and they exhibit the most striking disparity: while only 4.49% of parent models lack a license, this figure surges to 56.67% in their children, representing the sharpest relative increase among all categories. Fine-tuning follows a similar trend, where the proportion of missing licenses grows from 10.22% in parent models to 25.92% in children. Model merging, AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance13 which carries the highest overall conflict rate (86.53%), also displays the most severe license omission. The unlicensed rate of involved parent models (35.86%) nearly doubles to 62.50% in children. Finally, although quantization is relatively less affected, the increase from 21.96% to 29.73% still indicates a non-negligible risk of metadata attrition during automated conversion. While fine-tuning has the lowest overall conflict rate (40.93%), it exhibits a distinctly different failure mode. Fine-tuning presents the highest rate of explicit “license drift” among all operations. In 8.05% of fine-tuning edges, developers re- place a restrictive upstream license with a permissive one (compared to 4.06% for quantization, 3.03% for merge, and 1.59% for adapters).We hypothesize this is driven by a behavioral bias: developers who invest significant computational resources and private data into fine-tuning may falsely assume they have gen- erated an independent artifact, incorrectly claiming permissive ownership (e.g., relabeling a Llama derivative as Apache-2.0). These macroscopic statistics demonstrate that AI compliance risks are het- erogeneous, oscillating between metadata loss (in Adapters, Quantization and Merge) and legal misinterpretation (in Fine-tuning). Suchvariance underscores the necessity for interactive, path-aware analytics toolslike AISCG. 4.3 Case Study To further validate the capabilities of the AISCG in handling real-world depen- dencies, we conducted a targeted case study on the Llama model family. As one of the most prominent open-weights lineages, Llama presents an ideal test for our system due to its massive scale and labyrinthine derivation patterns. Beyond single-root lineages, we identified 28,392 models (approximately 3.1% of the total dataset) constructed from diverse ancestries.The Llama family ex- hibits a high participation rate in these multi-root lineages at 26.31%. These multi-root merges represent a critical compliance spot: combining weights from models governed by different licenses elevates the risk of legal incompatibility. To demonstrate AISCG’s capacity to audit these complex multi-root topologies, we highlight the specific case of the model Kukedlc/NeuralLLaMa-3-8b-DT-v0.1. On the surface, this model’s static metadata only shows three direct parent nodes. However, it is actually influenced by 19 distinct upstream ancestor models. When examining this node in the License Compliance Result Window, the com- pliance engine triggers multiple alerts, includingCopyleft_Terms,Conflict_C, andConflict_La3E. Crucially, the system provides an interpretable, multi-hop attribution list, pinpointing exactly where these conflicts originated among the 19 ancestors. For example, the system traces: (1) Inheritedrestrictive terms spanning multiple generations back to the original meta-llama/Meta-Llama-3- 8B; (2) A severe C-BY-NC-4.0 (Non-Commercial) restriction inherited from Undi95/Llama-3-Unholy-8B; (3) Copyleft obligations originating from elyn-dev/- Llama-3-Soliloquy-8B-v2 (C-BY-NC-SA-4.0). Through AISCG, manual traversal of multi-generation warehouse branches and cross-checking of multiple licenses are avoided, and the license compliance 14Weiru Han, Xuetao Shi et al. risk brought by risks deep inheritance paths involving various reuse methods are clearly presented. 5 Conclusion In this paper, we presented AISCG, an interactive 3D visual analytics environ- ment designed to address provenance and license compliancechallenges in mod- ern AI ecosystems. By integrating a rule-based compliance engine with topologi- cal visualization, AISCG enables intuitive multi-hop risktracing. Our ecosystem- scale analysis of over 900,000 models revealed a concerninglandscape: 55.46% of assets exhibit compliance risks, featuring distinct patterns like “license drift”. While current efforts focus on explicit metadata dependencies, future work will explore implicit dependencies (e.g., knowledge distillation) and NLP-based au- tomated license parsing to further advance transparent AI model governance. Acknowledgments.This research is sponsored by Shanghai Pujiang Programme (Award No. 25PJA029). References 1. Jiang, W., Synovic, N., Sethi, R., Indarapu, A., Hyatt, M., Schorlemmer, T.R., Thiruvathukal, G.K., Davis, J.C.: An empirical study of artifacts and security risks in the pre-trained model supply chain. In: Proceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED ’22), p. 105–114. ACM, New York (2022). 2. Jiang, W., Synovic, N., Hyatt, M., Schorlemmer, T.R., Sethi, R., Lu, Y.-H., Thiru- vathukal, G.K., Davis, J.C.: An empirical study of pre-trained model reuse in the Hugging Face deep learning model registry. In: Proceedingsof the 45th Interna- tional Conference on Software Engineering (ICSE ’23), p. 2463–2475. IEEE, Los Alamitos (2023). https://doi.org/10.1109/ICSE48619.2023.00206 3. Laufer, B., Oderinwale, H., Kleinberg, J.: Anatomy of a machine learning ecosys- tem: 2 million models on Hugging Face. arXiv preprint arXiv:2508.06811 (2025) 4. Duan, M., Li, Q., He, B.: ModelGo: A practical tool for machine learning license analysis. In: Proceedings of the ACM Web Conference 2024 (W ’24), p. 1158– 1169. ACM, New York (2024). https://doi.org/10.1145/3589334.3645520 5. Duan, M., Du, M., Zhao, R., Wang, M., Wu, Y., Shadbolt, N., He, B.: Position: Current model licensing practices are dragging us into a quagmire of legal noncom- pliance. In: Proceedings of the 42nd International Conference on Machine Learning (ICML ’25), Article 3271. PMLR (2025) 6. Liesenfeld, A., Lopez, A., Dingemanse, M.: Opening up ChatGPT: Tracking open- ness, transparency, and accountability in instruction-tuned text generators. In: Proceedings of the 5th International Conference on Conversational User Interfaces (CUI ’23), Article 47. ACM, New York (2023). 7. Gray Widder, D., Myers West, S., Whittaker, M.: Open (for business): Big tech, concentrated power, and the political economy of open AI. SSRN Electronic Jour- nal (2023) AI Supply Chain Galaxy: 3D Visual Analytics for License Compliance15 8. Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I.D., Gebru, T.: Model cards for model reporting. In: Proceedings of the Conference on Fairness, Accountability, and Transparency (FAT* ’19), p. 220–229. ACM, New York (2019). https://doi.org/10.1145/3287560.3287596 9. Contractor, D., McDuff, D., Haines, J.K., Hines, C., Hecht, B., Vincent, N., Li, H.: Behavioral use licensing for responsible AI. In: Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency(FAccT ’22), p. 778– 788. ACM, New York (2022). https://doi.org/10.1145/3531146.3533143 10. Xu, W., Gao, K., He, H., Zhou, M.: LiCoEval: Evaluating LLMs on license com- pliance in code generation. In: Proceedings of the IEEE/ACM47th International Conference on Software Engineering (ICSE ’25), p. 1665–1677. IEEE (2025). 11. von Landesberger, T., Kuijper, A., Schreck, T., Kohlhammer, J., van Wijk, J.J., Fekete, J.-D., Fellner, D.W.: Visual analysis of large graphs: State-of-the-art and future research challenges. Computer Graphics Forum30(6), 1719–1749 (2011). 12. Cui, X., Wu, J., Wu, Y., Wang, X., Luo, T., Qu, S., Ling, X.,Yang, M.: An empirical study of license conflict in free and open source software. In: Proceedings of the 45th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP ’23), p. 495–505. IEEE (2023). 13. Duan, M., Zhao, R., Jiang, L., Shadbolt, N., He, B.: “They’ve stolen my GPL- licensed model!”: Toward standardized and transparent model licensing. In: Pro- ceedings of the ACM Web Conference 2026 (W ’26), p. 1–12. ACM (2026) 14. Kapitsaki, G.M., Kramer, F., Tselikas, N.D.: Automating the license compatibility process in open source software with SPDX. Journal of Systems and Software131, 386–401 (2017) 15. Horwitz, E., Shul, A., Hoshen, Y.: Unsupervised model tree heritage recovery. In: Proceedings of the 13th International Conference on Learning Representations (ICLR) (2025) 16. Gu, T., Dolan-Gavitt, B., Garg, S.: BadNets: Identifying vulnerabilities in the ma- chine learning model supply chain. IEEE Transactions on Dependable and Secure Computing17, 2021–2033 (2019) 17. Horwitz, E., Kurer, N., Kahana, J., Amar, L., Hoshen, Y.:We should chart an atlas of all the world’s models. In: Proceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS) PositionPaper Track (2025) 18. Kraus, M., Weiler, N., Oelke, D., Kehrer, J., Keim, D.A.,Fuchs, J.: The impact of immersion on cluster identification tasks. IEEE Transactions on Visualization and Computer Graphics26(1), 525–535 (2020) 19. Ware, C., Mitchell, P.: Visualizing graphs in three dimensions. ACM Transactions on Applied Perception5(1), Article 2 (2008) 20. Fonnet, A., Prie, Y.: Survey of immersive analytics. IEEE Transactions on Visu- alization and Computer Graphics27(3), 2101–2122 (2021) 21. Bäuerle, A., Cabrera, Á.A., Hohman, F., Maher, M., Koski, D., Suau, X., Barik, T., Moritz, D.: Symphony: Composing interactive interfaces for machine learning. In: Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems (CHI ’22), Article 210. ACM, New York (2022). 22. Wu, Z., Zhao, H., Wang, Z., Guo, J., Wang, Q., He, B.: LLM DNA: Tracing Model Evolution via Functional Representations. In: 14th International Conference on Learning Representations (ICLR 2026).