VAIL Model Similarity Explorer
app.projectvail.com
Pick any of the nearly 1,900 models VAIL tracks and see the rest arranged by behavioral fingerprint similarity. Shown: Qwen3.5-35B-A3B at the center.
Open the explorer
Model Assurance
Know which model you are running, and where it came from.
Model Assurance verifies that the model in your environment is the one you evaluated and approved. It uses black-box behavioral fingerprints and continuous stability monitoring, with no SDK and no access to customer traffic.
What it verifies
-
Model provenance
Verify where a model came from, including fine-tunes and distillations, before you adopt it.
-
Supply chain integrity
Verify that the model running is the one you approved, and catch swaps, tampering, and unauthorized updates.
-
Governance and compliance
Keep a timestamped record of which model ran, when, and where it came from.
A detailed provenance inspection, using validated, published methods.
The full assessment runs once, when a model is offered. It examines the model at two levels: weight analysis reads lineage directly from the trained parameters, and behavioral fingerprinting characterizes what the model does. Each detects cases the other misses. Both methods are validated in published research. The evidence report is the basis for approval.
Fig. 1 — Source selection assessment
Lineage classification
Weight analysis · Cisco Model Provenance Kit
Classifies the model as a direct descendant, fine-tune, quantization, or merger of a known base — or as independently trained. Reads the weights directly, so renaming and metadata removal do not affect the result. Requires access to the weights.
Behavioral identity
Behavioral fingerprint · VAIL
A compact vector derived from the model's output distributions on a fixed probe set. Detects divergence from a parent that weight analysis misses, such as a fine-tune that changes refusal behavior. Works on a served model without weight access.
Three inspection points. One baseline.
Example: a drone supplied by an external vendor, with a model on board.
Fig. 2 — Inspection points across the acquisition life cycle
Example: vendor-supplied drone
Fingerprints in use. Three places to see them today.
Interconnects Artifacts Hub
artifactshub.ai
Each open model page carries its VAIL fingerprint and links to the models that behave most like it. Shown: Gemma 4 26B A4B IT.
View on Artifacts Hub
Cisco AI Supply Chain Provenance Explorer
provenance.aidefense.cisco.com
Cisco traces each model’s declared ancestry, and VAIL measures the behavioral similarity at each step. Shown: Foundation-Sec-8B-Q8_0-GGUF, 88.40% behaviorally similar to its Llama 3.1 8B base.
View on Cisco’s explorer
Screenshots captured October 2026. The live pages update as models are added.
Published research.
VAIL
Models don't have passports: AI lineage crosses organizational and geographic borders
Applies both methods to NVIDIA Nemotron models, some of which are documented as post-trained from Alibaba Qwen base weights. Independently, each method places Qwen models disproportionately among those models' nearest neighbors and recovers the documented lineage ordering: Qwen-base, then NVIDIA-native, then Llama-base. Results are detection evidence consistent with documented lineage, not proof of derivation.
Read the paper (PDF) →| Weight analysis | Behavioral | |
|---|---|---|
| Qwen-neighbor enrichment, Qwen-base Nemotron models | 1.74× | 1.89× |
| Lineage ordering recovered (permutation test) | p = 0.00001 | p = 0.00002 |
| Reference catalog | 184 models | 1,159 models |
Behavioral Fingerprints for LLM Endpoint Stability and Identity
Describes the behavioral fingerprinting method and a monitor that fingerprints a model periodically from a fixed prompt set and compares output distributions over time. In real-world monitoring of the same model hosted by multiple providers, it finds substantial stability differences between and within providers. This is the method used for installation audit and continuous monitoring.
Read the paper (arXiv:2603.19022) →| Change to the model | Detected |
|---|---|
| Model family | Yes |
| Model version | Yes |
| Inference stack | Yes |
| Quantization | Yes |
| Behavioral parameters | Yes |
Hardware-Rooted Trust Anchors for Sovereign AI Processing: Cryptographic Verification of Location, Identity, and Confidentiality in Cloud Environments
Verifies an AI workload running on untrusted infrastructure by combining hardware trusted execution, network-based location attestation, and VAIL's input–output fingerprint for runtime model integrity. The fingerprint check applies to stages 02 and 03: confirming the identity of a model that is already running. It is stable across machines and quantization and separates independently trained models.
Read the paper (PDF) →| Model Similarity | |
|---|---|
| Base model vs. its instruction-tuned version (4 pairs) | 0.96–0.98 |
| Qwen3-32B vs. quantized versions | > 0.91 |
| Qwen3-32B vs. unrelated models of similar size | 0.63–0.84 |
| Derivation threshold | 0.85 |
Built for
- Teams
- AI platform engineers, security teams, procurement, and compliance.
- Deployment
- No SDK, no code changes, and no access to customer traffic. Managed, in your cloud, or air-gapped.
Request an assessment.
Tell us which model you need verified. We reply within one business day with a scope and a start date.
Or write to contact@projectvail.com