Paper deep dive
Don't Trust the Label: License Laundering in AI Supply Chains
James Jewitt, Hao Li, Gopi Krishnan Rajbahadur, Bram Adams, Ahmed E. Hassan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/23/2026, 3:21:27 AM
Summary
This paper investigates 'license laundering' in AI supply chains, tracing 232,270 dataset-to-model-to-application chains across Hugging Face and GitHub. It identifies two forms of laundering: 'Unknown laundering,' where artifacts with no declared license acquire definitive labels downstream, and 'Category laundering,' where one license category replaces another. The study finds that 62.3% of chains pass through an artifact with no declared license, and obligation-bearing license categories have less than 7% end-to-end survival, while Permissive licenses survive at 95.1%. The research highlights significant legal risks for practitioners and provides recommendations for improving license compliance in AI ecosystems.
Entities (18)
Relation Signals (13)
James Jewitt â affiliatedwith â Queen's University
confidence 95% ¡ James Jewitt, Queenâs University
Copyleft â hasendtoendsurvivalrate â <7%
confidence 95% ¡ every obligation-bearing license category falls below 7% end-to-end survival
Permissive â hasendtoendsurvivalrate â 95.1%
confidence 95% ¡ the Permissive category reaches 95.1% [end-to-end survival]
License Laundering â hassubtype â Unknown Laundering
confidence 95% ¡ We trace 232,270 datasetâmodelâapplication chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream
License Laundering â hassubtype â Category Laundering
confidence 95% ¡ quantify two forms of license laundering: ... and when one declared license category replaces another during redistribution.
ImageNet-1K â haslicensestatus â Unknown
confidence 92% ¡ ImageNet-1K, a widely used computer-vision training dataset, carries an Unknown license.
Books3 â haslicensestatus â MIT
confidence 90% ¡ The dataset packaged 196,640 books from the pirate library Bibliotik, whose rights holders granted no downstream rights, yet circulated under an MIT label
Hugging Face â hosts â
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:AI artifacts move through a multi-platform supply chain, spanning datasets and models on Hugging Face and applications on GitHub. While each artifact carries a license whose obligations should propagate through redistribution, no study has yet measured whether those obligations survive the chain or are stripped and replaced as artifacts move downstream. We trace 232,270 dataset$\rightarrow$model$\rightarrow$application chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream, and when one declared license category replaces another during redistribution. We find that 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), and that every obligation-bearing license category falls below 7% end-to-end survival while the Permissive category reaches 95.1%. Based on these findings, we provide actionable recommendations for practitioners, model publishers, rights holders, and platform owners.
Tags
Links
- Source: https://arxiv.org/abs/2607.20300v1
- Canonical: https://arxiv.org/abs/2607.20300v1
Trouble viewing inline? Open PDF directly â
Full Text
33,760 characters extracted from source content.
Expand or collapse full text
arXiv:2607.20300v1 [cs.SE] 22 Jul 2026 Preprint Donât Trust the Label: License Laundering in AI Supply Chains James Jewitt, Queenâs University Hao Li, Queenâs University Gopi Krishnan Rajbahadur, Queenâs University Bram Adams, Queenâs University Ahmed E. Hassan, Queenâs University Abstractâ AI artifacts move through a multi-platform supply chain, spanning datasets and models on Hugging Face and applications on GitHub. While each artifact carries a license whose obligations should propagate through redistribution, no study has yet measured whether those obligations survive the chain or are stripped and replaced as artifacts move downstream. We trace 232,270 datasetâmodelâapplication chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream, and when one declared license category replaces another during redistribution. We find that 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), and that every obligation-bearing license category falls below 7% end-to-end survival while the Permissive category reaches 95.1%. Based on these findings, we provide actionable recommendations for practitioners, model publishers, rights holders, and platform owners. S entence-transformers/all-MiniLM-L6-v2, labeled Apache-2.0 on Hugging Face, is integrated by 1,656 applications on GitHub. While a practitioner reading that license label likely assumes the model is freely reusable, of its 21 declared training datasets, (1) nine carry no declared license, which leaves all rights reserved to the datasetâs creators, and (2) three carry Sharealike terms that require any derivative to preserve the same obligations. The Apache-2.0 license label does not reflect those upstream rights, i.e., this is an example of license laundering: the stripping or replacement of the legal rights and obligations attached to an asset as it moves through an AI supply chain. We focus on two forms of license laundering: Unknown laundering occurs when artifacts with no declared rights acquire definitive licenses downstream, implying legal certainty where none was established, X-X Š 2025 IEEE Digital Object Identifier 10.1109/X.0000.0000000 as with the nine no-license datasets above. Category laundering occurs when one declared license category is replaced with another during redistribution, as with the three Sharealike datasets whose obligations vanish under the modelâs Apache-2.0 label. Both types of laundering introduce legal uncertainty: an upstream rights holder can assert copyright at any time, forcing a takedown, mandatory relicensing, or financial liability on every application that trusted the laundered license. Books3 illustrates both forms of laundering and their cost. The dataset packaged 196,640 books from the pirate library Bibliotik, whose rights holders granted no downstream rights, yet circulated under an MIT label, i.e., Unknown laundering. The label then prop- agated. Models trained on Books3, from Anthropicâs Claude to LLaMA and BloombergGPT, shipped under their own license terms that replaced the datasetâs label, i.e., Category laundering, leaving practitioners no signal that the underlying rights were never es- tablished. In 2023, the Danish Rights Alliance forced Books3âs withdrawal to stop AI from becoming âan AprPublished by the IEEE Computer SocietyPublication Name 1 PREPRINT opportunity to launder copyright infringementâ [1]. The cost surfaced in Bartz v. Anthropic: a federal court held that training on the books was fair use, but that acquiring and retaining pirated copies was not; Anthropic settled for $1.5B, approved in July 2026 [2]. Because liability followed provenance, publishers that ingested the same sources face the same claims, and downstream applications inherit takedown and re- licensing risk. Understanding, quantifying, and prevent- ing laundering are therefore essential, and decades of software-license enforcement show how routinely such risks materialize: the Court of Milan held that BSD-4-Clause non-compliance retroactively strips the license, reclassifying commercial distribution as in- fringement [3], and Terraformâs relicensing drove more than 140 companies to the OpenTofu fork within six weeks [4]. No existing tool is able to automatically audit the licenses along an AI supply chain for laundering oc- currences. The software industry has created software composition analysis (SCA) tools such as FOSSology and Black Duck that trace declared software licenses through package-manager dependency graphs, flag in- compatible combinations, and generate Software Bills of Material (BOMs) for compliance audits [5]. However, these tools cannot be readily used on AI supply chains, as the latter break the assumptions existing software license auditing tools rely on. A modelâs training-data dependencies are declared not in lockfiles but in meta- data tags on Hugging Face, and an applicationâs model dependencies can only be recovered through code search across GitHub. Often no license is declared at all: 65.0% of models and 74.7% of datasets on Hugging Face carry no recognizable license tag [6]. AI chains also cross platforms: a Hugging Face dataset trains a Hugging Face model that a GitHub application then integrates, a path no SCA tool follows end-to-end. As a result, the warnings that SCA tools routinely raise for software, e.g., that a copyleft dependency requires the integrating project to share its source under the same terms, or that two licenses in a dependency graph conflict, are never produced for AI artifacts. In other words, two decades of open-source software (OSS) compliance infrastructure has no AI equivalent. Building that tooling first requires knowing how often laundering happens. Prior audits quantify how poor Hugging Faceâs license labels are (over 96% of permissively-labeled artifacts lack the full license text their declared licenses require [7]), but poor labels are not the same as lost obligations. What no prior work has measured is whether the obligation-bearing license categories (those that constrain how an artifact may be used or reused) survive the full dataset-to- model-to-application chain. Without that measurement, we cannot tell whether laundering is rare and isolated or routine and systemic, whether it concentrates in a few foundational artifacts or spreads across the ecosystem, or whether different categories are laun- dered at different rates. Thispaperprovidesthefirstempirical measurement of how license categories change across the full AI supply chain. We trace 232,270 datasetâmodelâapplicationchainsspanning Hugging Face and GitHub, measure both forms of laundering, and identify the recurring patterns behind them. Our contributions are: ⢠WequantifyUnknownlaunderingacross 232,270 chains, finding that 62.3% pass through at least one artifact with no declared license, and show that the pattern concentrates in a small number of foundational datasets. ⢠We measure Category laundering at each tran- sition (a datasetâmodel, modelâapplication or datasetâapplication), finding that every obligation-bearing license category falls be- low 7% end-to-end survival, while the Per- missive category reaches 95.1%. ⢠We translate these patterns into concrete risks and actions for practitioners, model publishers, rights holders, and platform owners building license-tracing infrastructure. AI Supply Chain Composition To measure how license categories change across AI artifacts, we construct datasetâmodelâapplication chains spanning Hugging Face and GitHub, then cate- gorize each artifactâs licenses into seven categories by the obligations they impose. Full collection details are in our replication package. 1 Supply Chain Construction Following a methodology similar to our prior work [7], we link Hugging Face datasets and models to the GitHub applications that use them, then extract each artifactâs declared license. We link datasets to mod- els through Hugging Faceâs dataset dependency metadata, identify GitHub applications that invoke those models via code search and abstract syn- tax tree (AST), and use ScanCode to extract the 1 https://github.com/SAILResearch/LicenseLaundering/ 2 Publication TitleApr 2025 PREPRINT license label declared in each repository. This ini- tial collection contains 3,198 datasets, 6,218 models, and 26,302 applications, forming 294,012 candidate datasetâmodelâapplication chains. We then apply two filters on the candidate chains. The first filter removes models that serve only as base models with no application directly invoking them, ensuring that every chain passes through exactly two transitions, which leaves 264,431 chains. The second filter excludes any chain in which an artifact carries a license string that does not map to our classification (described next), removing a further 32,161 chains. After both filters, we are left with 232,270 chains spanning 3,120 datasets, 5,556 models, and 24,076 applications. Of these, 144,631 (62.3%) pass through at least one artifact with an Unknown license, and 87,639 (37.7%) carry a Known category at all three artifacts. License Categorization Each AI artifact on Hugging Face [8] or GitHub [9] carries one or more license strings in its metadata. Across all artifacts, we observe 765 unique strings. Tracking individual strings is too granular for measuring how obligations change across a supply chain, since licenses imposing the same type of restriction (e.g., MIT and BSD-3-Clause) belong together [6]. For this reason, we group strings into seven categories based on the obligations they impose, following classification guides from the Free Software Foundation (FSF) [10], Creative Commons (C) [11], and Stalnaker et al. [6]: ⢠Permissive (e.g., MIT, Apache-2.0, BSD-3- Clause) ⢠Copyleft (e.g., GPL, AGPL) ⢠Sharealike (e.g., C BY-SA, LGPL, MPL) ⢠ML License (e.g., OpenRAIL, Llama Community License) ⢠C-Restrictive (grouping NonCommercial, NC- SA, NC-ND, and NoDerivatives, which share the practical constraint of restricting downstream use) ⢠Public Domain (e.g., C0, Unlicense) ⢠Unknown The Unknown category combines all license strings that represent absent or undeclared rights (e.g., empty fields, âUnknown,â âOtherâ). We manually assign each license string to one of our seven categories when it matches a license recognized by Hugging Face or GitHub, or an entry in the FSF and C classification guides, giving 270 classified strings. The remaining 495 of the 765 unique strings match no entry in the classification, and we label them as unidentified. An artifact can carry multi- ple license categories simultaneously (e.g., a dataset licensed under both Permissive and Sharealike terms). Unknown Laundering Unknown laundering has direct legal consequences: when an artifact carries no declared license, the rights holder retains full copyright by default [9], and any downstream label that appears settled rests on rights that were never established. The model facebook/convnext-base-224, for in- stance, trains on ImageNet-1K yet ships under an Apache-2.0 label, even though ImageNet-1K declares no license and so grants none of the permissions that label implies. We measure the prevalence of this pat- tern, the concentration of upstream Unknown artifacts that drive the pattern, and its inverse pattern (where declared rights are dropped on the way downstream). Weclassifyeverydatasetâmodeland modelâapplicationtransitionintooneoffour types:UnknownâKnown(Unknownlaundering), KnownâUnknown (inverse of Unknown laundering), UnknownâUnknown, or KnownâKnown (analyzed in Section Category Laundering). When an artifact carries multiple license categories (e.g., Permissive and Sharealike), we classify it as Known if any category is Known. The Unknown laundering rate is the proportion of Unknown-upstream transitions whose downstream artifact carries a Known license, measured at the datasetâmodel, modelâapplication transitions, and end-to-end (Figure 1(A)). To assess whether Unknown laundering is concentrated or dispersed, we rank Unknown artifacts by the number of laundering transitions they generate and plot Lorenz concentration curves: the further the curve bows from the diagonal, the more concentrated the transitions are in a small number of artifacts (Figure 1(B)). 62.3% of supply chains pass through at least one artifact with an Unknown license. Of the 232,270 supply chains in our dataset, 144,631 contain at least one such artifact (Figure 1 (A)). An Unknown license anywhere in the chain means the downstream label does not rest on verified upstream rights, re- gardless of how settled it appears. This pattern is bidirectional. In the laundering direction, Unknown ar- tifacts acquire definitive licenses at both hops: 88.8% of chains with an Unknown dataset reach a Known model, and 80.3% of chains with an Unknown model reach a Known application (Figure 1(A)). In the other direction, declared rights vanish: 24.9% of all chains with a Known-licensed model end at an application with no declared license, erasing obligations that should Apr 2025Publication Title 3 PREPRINT (A) The 144,631 chains (62.3% of 232,270) with 1 Unknown-licensed artifact Incl. fully-Known chains: 51,975 of 208,319 Known-model chains (24.9%) end Unknown DatasetsModelsApplications Unknown 102,607 (70.9%) 91,067 Known (88.8%) 11,540 Unknown (11.2%) Known 42,024 (29.1%) 29,613 Known (70.5%) 12,411 Unknown (29.5%) Unknown 23,951 (16.6%) 19,243 Known (80.3%) 4,708 Unknown (19.7%) Known 120,680 (83.4%) 68,705 Known (56.9%) 51,975 Unknown (43.1%) Unknown 56,683 (39.2%) Known 87,948 (60.8%) 020406080100 % of Unknown artifacts (ranked by fan-out) 0 20 40 60 80 100 Cumulative % of Unknown- laundering transitions (B) 89.5% 84.3% 76.0% Perfect equality DatasetModel ModelApplication DatasetApplication (end-to-end) FIGURE 1. (A): Sankey diagram of the 144,631 chains that pass through at least one Unknown-licensed artifact; the 87,639 fully-Known chains are analyzed in Figure 2. (B): Lorenz curves: Unknown-laundering transitions concentrate in the top 10% of Unknown artifacts. propagate. A license backed by verified upstream rights looks identical to one with no basis at all. Unknown laundering concentrates in a few foundational datasets: the top 10% of Unknown datasets account for 89.5% of datasetâmodel laundering transitions. Figure 1(B) shows the Lorenz curves for all three transitions. Concentration is highest at the datasetâmodel transition and remains high end- to-end (84.3%) and at modelâapplication (76.0%). ImageNet-1K, a widely used computer-vision training dataset, carries an Unknown license. It fans out to 243 models, 208 of which are Known, reaching 1,709 applications. The Pile and BookCorpus follow the same pattern, reaching 2,139 and 1,695 applications respec- tively. The MiniLM example from the introduction is a downstream symptom of this dynamic: a small number of foundational Unknown datasets generate most of the laundering throughout the chain. 4 Publication TitleApr 2025 PREPRINT Even when upstream rights are clearly de- clared, downstream artifacts still drop them: one in four chains with a Known-licensed model (24.9%) ends at an application with no declared license. The inverse of Unknown laundering, i.e., declared obligations transitioning to Unknown, is common in its own right (Figure 1(A)): of the 144,631 chains involving an Unknown artifact, 56,683 (39.2%) end at an Unknown application. The drop concentrates at the modelâapplication transition. Developers may not recognize that integrating a model creates a derivative work, or they may assume that an applicationâs own license overrides upstream terms. AK391/ai-gradio in- tegrates upstage/SOLAR-10.7B-Instruct-v1.0, a model released under C-BY-NC-4.0 prohibiting commercial use, but the application carries an Unknown license. Nothing signals the upstream restriction to a developer who uses the application commercially. Cross-platform tooling that warned them when an application inherits a modelâs restriction, such as a non-commercial clause, would close this gap, but none exists. Category Laundering A fully-Known chain avoids Unknown laundering, but its declared license categories can still change in tran- sit. Category laundering occurs when a downstream artifact carries a different license category than the upstream artifact it derives from, replacing the cre- atorâs original choice. We measure it on the 87,639 chains where all three artifacts carry at least one Known license category. We analyze each license category separately, and a dataset with licenses in more than one category is counted in each cate- goryâs analysis. This yields 95,076 category observa- tions across datasets and 87,658 across models. We then build transition matrices at the datasetâmodel and modelâapplication steps (Figure 2(A,B)) and an end-to-end matrix (Figure 2(C)). End-to-end retention can exceed single-hop retention because a category dropped at the model may reappear at the application, e.g., when an applicationâs own license coincidentally matches the datasetâs category. We classify a transition as laundered if any upstream category is absent from the downstream artifactâs category set. The survival rate is the fraction of chains where all obligation- bearing upstream license categories propagate to the application. 37.5% of fully-Known supply chains contain at least one laundered transition. Of the 87,639 chains where every artifact carries a Known license, 32,901 drop at least one category somewhere along the chain (Figure 2(D)). A chain can drop a cate- gory without any Unknown license. By definition, any Sharealike dataset whose model is labeled only Per- missive has dropped its Sharealike category, though both artifacts are Known. Most laundering happens at the datasetâmodel transition, where only 65.4% of category transitions retain their category, versus 86.4% at modelâapplication (panel titles, Figure 2(A,B)). Fig- ure 2(D) locates the drops per chain: 23.9% of fully- Known chains drop a category only at datasetâmodel, 5.5% only at modelâapplication, and 8.1% at both hops. Verifying only the model and application licenses misses the obligations a dataset carried but a down- stream artifact dropped. Permissive licenses survive end-to-end at 95.1% (Permissive diagonal, Figure 2(C)), while ev- ery obligation-bearing license category falls below 7%. Sharealike is the upstream category in 15,678 chains, but survives to the application in only 739 of them (4.7%; Sharealike diagonal, Figure 2(C)), roughly a twentieth of Permissiveâs rate. When an obligation- bearing license category is lost, the downstream li- cense almost always becomes Permissive rather than another category. For datasetâmodel, 93.1% of Copy- left transitions land on Permissive (Copyleft row, Fig- ure 2(A)). For modelâapplication, 77.9% of ML Li- cense transitions land on Permissive (ML License row, Figure 2(B)). Model and application developers know how to ship Permissive software, so a likely explanation for the collapse toward Permissive is that when these devel- opers hit an upstream category they cannot satisfy, they label their own artifact Permissive or drop the license entirely. For example, the Wikipedia dataset, which carries both Copyleft and Sharealike, originates 4,849 chains, yet only 86 preserve both end-to-end (1.8%). The wukong100m dataset, released under C-Restrictive terms prohibiting commercial use and derivatives, has 89 downstream models, none of which carry C-Restrictive forward. In both cases, the re- striction the rights holder chose barely survives down- stream, if at all. The ML License and Copyleft categories mirror each other: ML License survives datasetâmodel (55.8%) but not modelâapplication (4.2%), while Copyleft does the opposite (0.9% then 39.0%). Models adopt ML License terms from training data at a moderate rate. Applications then strip them (ML License diagonals, 55.8% in Figure 2(A) versus 4.2% in (B)). For instance, StarCoder, a widely used 15.5B- parameter code-generation model, 2 carries an ML Li- 2 https://huggingface.co/bigcode/starcoder Apr 2025Publication Title 5 PREPRINT cense, but 314 of its 321 Known downstream appli- cations drop it. ML License terms prohibit downstream uses such as surveillance or medical decision-making, yet for the 314 applications that dropped the label, no record of those prohibitions survives. The licenses provide no operational mechanism for enforcing these prohibitions in software, and behavioral-use licensing has no precedent in conventional software composition tools. Copyleft, by contrast, is native to the software ecosystem where applications live and has decades of tooling support behind it. Threats to Validity Internal Validity. We track license labels, not the full legal text of the licenses. For datasets and models, these labels come from self-reported metadata on Hugging Face. For applications, we use the license label identified by ScanCode from GitHub repositories. In all cases, if the label does not reflect the publisherâs intent, our analysis captures the label as practition- ers encounter it, not the underlying legal status. Li- cense strings with vague or ambiguous metadata (e.g., âotherâ) are classified as Unknown alongside absent licenses. If some of these strings represent intentional license choices that we cannot resolve, the Unknown count may be overstated. Stalnaker et al. [6] handle such strings the same way, treating Hugging Faceâs âotherâ and âunknownâ labels as unresolvable cate- gories rather than mapping them to specific licenses, since retrieving and evaluating these license terms is difficult and time-consuming. External Validity. Our collected data includes only the models that declare their training data via meta- data, which amount to 7.1% of Hugging Face mod- els [7]. Models that do not disclose training data and applications that do not appear in GitHub code search are outside our scope. Prior audits of the Hugging Face supply chain face the same boundary: Stalnaker et al. [6] build their supply-chain graph from declared metadata alone and note that it necessarily captures a subset of the full chain. The impact of this selection bias is unclear: models that disclose their training data may follow better or worse license-compliance practices than those that do not. Our sample is drawn from the most popular models and datasets, so it captures the artifacts with the widest downstream reach, including high-fan-out foun- dational datasets such as ImageNet-1K, The Pile, and BookCorpus. Our findings therefore characterize the popular, disclosed portion of the supply chain rather than its long tail. We also exclude chains containing license strings that do not map to our classification framework (495 of 765 unique strings, predominantly custom or ambiguous). The excluded chains represent only 12.2% of the pre-filter chains. Every standard obligation-bearing license (Copyleft, Sharealike, ML License, C-Restrictive) falls within the 270 strings we recognize, so the excluded strings do not affect the categories whose survival we measure. Implications For practitioners: verify upstream before inte- grating. The modelâs license alone is an unreliable signal. Unknown upstream artifacts produce defini- tive downstream labels in 91,067 of 232,270 chains (Figure 1(A)), and obligation-bearing upstream cat- egories collapse into Permissive downstream labels (Figure 2(C)). Before integrating an artifact, practi- tioners should follow the modelâs declared training datasets on Hugging Face, classify the upstream li- censes against the same categories the model claims, and treat any conflict or absence as an integration risk. When the model does not declare its training data, treat that absence as a risk signal in itself. For model publishers: declare upstream dataset licenses, not just the modelâs own. Only 7.1% of Hugging Face models declare their training datasets via metadata [7]. Even within that 7.1%, 37.5% of fully-Known chains contain at least one laundered transition. Publishers who omit upstream data pass undisclosed legal risk to every downstream practi- tioner. Hugging Face model cards already support a datasets field [8]; publishers should populate it and record the license category of each training dataset. This requires no new infrastructure, only a change in documentation practice. For rights holders: a restrictive license is not enforcement. Permissive licenses survive end-to-end at 95.1% while every obligation-bearing category falls below 7% (Figure 2(C)). ML-specific licenses, de- signed to prohibit uses such as surveillance, survive only 4.2% of modelâapplication transitions (ML Li- cense diagonal, Figure 2(B)). A rights holder who needs downstream compliance cannot rely on label propagation alone and should pair the license with en- forcement mechanisms outside metadata: contractual terms or gated access. For platform owners and tool builders: build the cross-platform tracer that does not yet exist. Ex- isting SCA tools (ScanCode, FOSSology, Black Duck) operate on single-platform, package-manager depen- dencies. AI chains span Hugging Face and GitHub, mix three legal paradigms, and declare dependencies through metadata tags. No tool traces cross-platform 6 Publication TitleApr 2025 PREPRINT Permissive Copyleft ML License Sharealike C Restrictive PD Destination Category Permissive (n=64,369) Copyleft (n=5,265) ML License (n=283) Sharealike (n=15,678) C Restrictive (n=6,480) PD (n=3,001) Source Category 59,680 92.7% 178 0.3% 2,298 3.6% 314 0.5% 1,841 2.9% 58 0.1% 4,901 93.1% 46 0.9% 45 0.9% 230 4.4% 28 0.5% 15 0.3% 115 40.6% 0 0.0% 158 55.8% 0 0.0% 10 3.5% 0 0.0% 13,951 89.0% 1 0.0% 95 0.6% 267 1.7% 1,354 8.6% 10 0.1% 4,306 66.5% 5 0.1% 157 2.4% 10 0.2% 1,996 30.8% 6 0.1% 2,831 94.3% 1 0.0% 58 1.9% 50 1.7% 48 1.6% 13 0.4% (a) DatasetModel (n=95,076 category transitions, 65.4% retained) Permissive Copyleft ML License Sharealike C Restrictive PD Destination Category Permissive (n=78,682) Copyleft (n=231) ML License (n=2,768) Sharealike (n=647) C Restrictive (n=5,233) PD (n=97) 75,037 95.4% 2,271 2.9% 16 0.0% 268 0.3% 763 1.0% 327 0.4% 131 56.7% 90 39.0% 2 0.9% 2 0.9% 5 2.2% 1 0.4% 2,155 77.9% 265 9.6% 116 4.2% 67 2.4% 141 5.1% 24 0.9% 534 82.5% 23 3.6% 11 1.7% 54 8.3% 11 1.7% 14 2.2% 4,054 77.5% 396 7.6% 206 3.9% 111 2.1% 406 7.8% 60 1.1% 23 23.7% 73 75.3% 0 0.0% 0 0.0% 1 1.0% 0 0.0% (b) ModelApplication (n=87,658 category transitions, 86.4% retained) Permissive Copyleft ML License Sharealike C Restrictive PD Destination Category Permissive (n=64,369) Copyleft (n=5,265) ML License (n=283) Sharealike (n=15,678) C Restrictive (n=6,480) PD (n=3,001) Source Category 61,234 95.1% 1,965 3.1% 14 0.0% 234 0.4% 651 1.0% 271 0.4% 4,360 82.8% 353 6.7% 68 1.3% 131 2.5% 213 4.0% 140 2.7% 203 71.7% 32 11.3% 6 2.1% 7 2.5% 28 9.9% 7 2.5% 12,939 82.5% 997 6.4% 187 1.2% 739 4.7% 478 3.0% 338 2.2% 5,512 85.1% 210 3.2% 161 2.5% 101 1.6% 417 6.4% 79 1.2% 2,406 80.2% 220 7.3% 16 0.5% 159 5.3% 110 3.7% 90 3.0% (c) End-to-end DatasetApplication (n=95,076 category transitions, 66.1% retained) 020406080100 % of source-category transitions (panels ac) 62.5%23.9% 32,901 of 87,639 chains (37.5%) drop 1 category (d) Where fully-Known chains drop categories (n=87,639 chains, not transitions) Preserve all categories: 54,738 (62.5%) Drop at datasetmodel only: 20,952 (23.9%) Drop at modelapplication only: 4,823 (5.5%) Drop at both hops: 7,126 (8.1%) FIGURE 2. (A) Datasetâmodel, (B) modelâapplication, and (C) end-to-end datasetâapplication transition matrices showing how upstream license categories map to downstream categories; diagonal cells indicate retention. The panels count category transitions rather than chains: the 87,639 fully-Known chains yield 95,076 datasetâmodel and 87,658 modelâapplication category transitions, since artifacts with multiple license categories contribute one transition per category. (D) Where the 32,901 chains (37.5%) that drop at least one category do so. license propagation or flags cross-paradigm incompat- ibilities such as a C BY-SA dataset training an MIT- labeled model. SPDX 3.0 [12] and CycloneDX [13] both offer BOM profiles for AI artifacts that can represent the full chain, but nothing populates them automatically. A recent systematic review confirms that mitigation remains the least developed area of license compli- ance research [14], and AIâs cross-paradigm structure makes the gap more acute. Concretely: Hugging Face and GitHub should auto-surface upstream license cat- Apr 2025Publication Title 7 PREPRINT egories alongside downstream labels and warn when categories conflict; researchers should build tools that auto-generate AI BOMs from existing metadata, con- necting the existing standards to the supply chains they are designed to describe. Until then, manual upstream verification is the only safeguard. REFERENCES 1. RightsAllianceDenmark,âRightsAlliance Removes the Illegal Books3 Dataset Used to Train Artificial Intelligence,â 2023. [Online]. Available: https://rettighedsalliancen.com/rights-alliance- removes-the-illegal-books3-dataset-used-to-train- artificial-intelligence/ 2. Bartz et al. v. Anthropic PBC, No. 3:24-cv-05417 (N.D. Cal.). Summary judgment order, Jun. 23, 2025; settlement granted final approval Jul. 20, 2026.SeeB.Brittain,âUSJudgeApproves Anthropicâs $1.5 Billion Settlement of Copyright Lawsuit,â Reuters, Jul. 20, 2026. [Online]. Available: https://finance.yahoo.com/technology/ai/articles/us- judge-approves-anthropics-1-204851948.html 3. TribunalediMilano,Sez.Imprese,Sentenza n.7112/2023(GestionaleOpen),deposited 18September2023.Commentaryathttps: //w.canellacamaiora.com/open-source-licenses- and-copyright-the-milan-court-on-license-violation/. 4. The Linux Foundation, âLinux Foundation Launches OpenTofu: A New Open Source Alternative to Terraform,â Press Release, Sept. 20, 2023. [On- line]. Available: https://w.linuxfoundation.org/press/ announcing-opentofu 5. P. Ombredanne, âFree and Open Source Software License Compliance: Tools for Software Composition Analysis,â IEEE Computer, vol. 53, no. 10, p. 105â 109, Oct. 2020. 6. T. Stalnaker, N. Wintersgill, O. Chaparro, L. A. Hey- mann, M. Di Penta, D. M. German, and D. Poshyvanyk, âThe ML Supply Chain in the Era of Software 2.0: Lessons Learned from Hugging Face,â arXiv preprint arXiv:2502.04484, 2025. 7. J. Jewitt, G. K. Rajbahadur, H. Li, B. Adams, and A. E. Hassan, âPermissive-Washing in the Open AI Supply Chain: A Large-Scale Audit of License In- tegrity,â in Proc. 32nd ACM SIGKDD Conf. Knowl- edge Discovery and Data Mining V.2 (KDD â26), Jeju Island, Republic of Korea, 2026, 12 pages, doi: 10.1145/3770855.3818130. arXiv:2602.08816. 8. Hugging Face, âCreate and share Model Cards,â 2023. [Online]. Available: https://huggingface.co/docs/ huggingface_hub/en/guides/model-cards 9. GitHub, âLicensing a repository,â 2024. [Online]. Available:https://docs.github.com/en/repositories/ managing-your-repositorys-settings-and-features/ customizing-your-repository/licensing-a-repository 10. Free Software Foundation, âVarious Licenses and Comments about Them,â 2026. [Online]. Available: https://w.gnu.org/licenses/license-list.html 11. Creative Commons, âCompatible Licenses,â 2026. [Online].Available:https://creativecommons.org/ share-your-work/licensing-considerations/compatible- licenses/ 12. The Linux Foundation, âSPDX Specification v3.0.1,â 2024. [Online]. Available: https://spdx.dev 13. OWASP Foundation, âCycloneDX Bill of Materials Standard, v1.6,â Ecma International Standard ECMA- 424, 2024. [Online]. Available: https://cyclonedx.org 14. B. Li, C. Liu, L. Fan, S. Chen, Z. Zhang, and Z. Liu, âOpen Source, Hidden Costs: A Systematic Literature Review on OSS License Management,â IEEE Trans. Softw. Eng., vol. 51, no. 9, p. 2432â2454, Sep. 2025. James Jewittis a Ph.D. student at Queenâs Uni- versity, Kingston, ON K7L 3N6, Canada. Their re- search interests include AI supply chains, software and dataset licensing, and data provenance. Contact them at james.jewitt@queensu.ca. Hao Li is a postdoctoral researcher at Queenâs Uni- versity, Kingston, ON K7L 3N6, Canada. His research interests include software engineering for AI, AI for software engineering, and software package ecosys- tems. Li received his Ph.D. in Software Engineering and Intelligent Systems from the University of Alberta. Contact him at hao.li@queensu.ca. Gopi Krishnan Rajbahadur is a Principal Researcher at Huaweiâs Centre for Software Excellence in Canada, leading data and post-training for the Pangu Foundation Modelâs software engineering capabilities. He is also a Research Associate at Queenâs Universityâs Soft- ware Engineering and Analysis Lab, where he stud- ies AI supply chains and trustworthy AI-agent ecosys- tems. His research spans software engineering for AI- powered systems and AI dataset governance and com- pliance. Contact him at grajbahadur@acm.org. Bram Adams is a full professor at Queenâs University, Kingston, ON K7L 3N6, Canada. His research interests include software release engineering (pre- and post-AI) and mining software repositories. He is a Senior Mem- ber of IEEE. Contact him at bram.adams@queensu.ca. 8 Publication TitleApr 2025 PREPRINT Ahmed E. Hassan is the Natural Sciences and Engi- neering Research Council of Canada/Research in Mo- tion Industrial Research chair in Software Engineering for Ultra Large Scale systems at Queenâs University, Kingston, ON K7L 3N6, Canada. He is a Fellow of the IEEE. Contact him at ahmed@cs.queensu.ca. Apr 2025Publication Title 9