PaperlayerView exact revision on arXiv

Source-linked AI summary

From Hugging Face to GitHub: Tracing License Drift in the Open-Source AI Ecosystem

James Jewitt, Hao Li, Bram Adams, Gopi Krishnan Rajbahadur, Ahmed E. Hassan

arXiv:2509.09873v2cs.SEcs.AI

TL;DR

Evidence on license compliance across the AI supply chain has been limited, while AI-specific restrictions challenge traditional compatibility matrices. This paper audits the lineage from Hugging Face datasets and models to GitHub applications and evaluates an AI-aware conflict-detection framework. Its augmented matrix identifies a 35.5% model-to-repository violation rate, compared with 3.2% under the EU matrix.

  • Problem

    Prior work examined isolated supply-chain stages, and traditional compatibility matrices do not capture AI-specific use restrictions found in modern machine-learning licenses.

    Source: Introduction · p. 1, Related Work · p. 2

  • Method

    The paper audits license lineage from Hugging Face datasets and models to GitHub applications and evaluates LicenseRec, an AI-aware framework for detecting conflicts and recommending compliant solutions.

    Source: Introduction · p. 1, Methodology · p. 3

  • Results

    The augmented matrix flags a 35.5% violation rate for model-to-repository links, compared with 3.2% under the EU matrix.

    Source: Discussion · p. 7

  • Takeaways & Limitations

    Many conflicts can be corrected through automated tooling, but developers still need to vet upstream dependencies because some conflicts are inherited and unresolvable.

    Source: Discussion · p. 7, Conclusion · p. 8

    LicenseRec’s analysis depends on input quality: incorrect Hugging Face license tags or missed repository licenses can make its results incorrect.

    Source: Discussion · p. 7

Abstract

from arXiv · show

Hidden license conflicts in the open-source AI ecosystem pose serious legal and ethical risks, exposing organizations to potential litigation and users to undisclosed risk. However, the field lacks a data-driven understanding of how frequently these conflicts occur, where they originate, and which communities are most affected. We present the first end-to-end audit of licenses for datasets and models on Hugging Face, as well as their downstream integration into open-source software applications, covering 364 thousand datasets, 1.6 million models, and 140 thousand GitHub projects. Our empirical analysis reveals systemic non-compliance in which 35.5% of model-to-application transitions eliminate restrictive license clauses by relicensing under permissive terms. In addition, we prototype an extensible rule engine that encodes almost 200 SPDX and model-specific clauses for detecting license conflicts, which can solve 86.4% of license conflicts in software applications. To support future research, we release our dataset and the prototype engine. Our study highlights license compliance as a critical governance challenge in open-source AI and provides both the data and tools necessary to enable automated, AI-aware compliance at scale.

Introduction

The paper frames AI license compliance as an end-to-end supply-chain problem: obligations can be disregarded when models are created and violated again when integrated into applications. It audits this lineage and introduces LicenseRec to detect conflicts and recommend compliant licenses.

Introduction

  • The audit traces licenses from 364,000 datasets and 1.6 million Hugging Face models into 140,000 GitHub applications, measuring compliance across the AI supply chain.It identifies the model-to-application stage as a critical failure point, with 35.5% of transitions violating the upstream model’s license.Source: Introduction · p. 1
  • LicenseRec is an AI-aware framework that automatically detects license conflicts and recommends compliant solutions.The paper presents it as a proof-of-concept prototype for mitigating license risk.Source: Introduction · p. 1
  • The paper releases its license-lineage dataset and open-source LicenseRec prototype for future research and automated compliance work.Source: Introduction · p. 1

Related Work

Earlier studies examined separate links in the AI supply chain, leaving the cumulative effect of license changes across datasets, models, and applications unknown. Existing compatibility matrices also have difficulty representing AI-specific, use-based restrictions.

Empirical Studies of AI Supply Chains

  • Earlier studies examined either model-to-application inconsistencies or dataset-to-model license drift, but not their cumulative effect across the full supply chain.This paper connects those stages to trace how obligations are passed, altered, or discarded from datasets to software applications.Source: Related Work · p. 2

The Interpretive Challenge of Software Licensing

  • License compatibility is difficult to judge definitively because license proliferation, ambiguous terms, and limited court precedent create a legal grey area, even for professionals.The paper therefore adopts a formal, replicable contradiction-focused model, while acknowledging that it differs from practitioners’ broader risk perspective.Source: Related Work · p. 2

Frameworks for Automated License Analysis

  • Traditional compatibility matrices categorize licenses and pre-calculate compatibility between pairs, but do not capture AI-specific use restrictions such as bans on military use or duties to prevent misinformation.The paper motivates an AI-aware framework that augments conventional matrices with obligations found in machine-learning licenses.Source: Related Work · pp. 2–3

Methodology

The methodology links Hugging Face datasets and models to GitHub applications, categorizes licenses, and uses LicenseRec to detect conflicts and recommend compliant licenses. It then analyzes license propagation and benchmarks the engine against existing tools.

Data Collection

  • For proprietary models, the analysis covers only model-to-application links because their upstream training data is typically undisclosed.Source: Data Collection · p. 3
  • The audit constructs a dataset-to-model-to-application lineage, linking Hugging Face artifacts to nearly 140,000 GitHub repositories.The study covers 364,917 datasets and 1,627,519 models, extending prior work that examined isolated supply-chain segments.Source: Data Collection · p. 3
  • The researchers collect Hugging Face metadata, select models with over 20 likes, and search GitHub Python files for their identifiers.They use ScanCode to detect multiple licenses per repository, then parse Python files into abstract syntax trees and check curated code signatures for active model use; this yields 136,375 repository entries integrating 6,999 unique models.Source: Data Collection · pp. 3–4

License Categories

  • License categories group licenses with similar rights and obligations, allowing the study to track propagation and powering LicenseRec’s user-facing recommendations.The categories include groupings such as Permissive and Copyleft, with some Creative Commons licenses subdivided by obligations.Source: LicenseRec · p. 4

License Propagation Analysis

  • The analysis maps dataset-to-model, model-to-application, and end-to-end dataset-to-application links into license categories to identify common transition frequencies.Examples include pathways such as public domain to permissive.Source: LicenseRec · p. 4

LicenseRec

  • A conflict occurs when one license imposes a duty that another prohibits; LicenseRec checks linked licenses against a compatibility matrix extended for Creative Commons and machine-learning restrictions.For recommendations, it intersects the compatible-license sets of upstream components, filters and ranks the options, and returns up to five licenses per SPDX category when a valid set exists.Source: LicenseRec · p. 4

Evaluation

  • Fixability measures the share of initial violations for which LicenseRec can recommend at least one valid, compatible downstream license.The evaluation compares LicenseRec’s compatibility rulings with the PeaTMOSS matrix and its fixability with the EU Licensing Assistant.Source: LicenseRec · pp. 4–5

Results

License conflicts follow concentrated pathways as restrictive obligations are discarded across the supply chain, especially when models enter applications. LicenseRec corrects many violations, but upstream incompatibilities remain beyond re-licensing.

Results

  • 20.7% of Non-Commercial datasets retain the same license category in models, while only 3.9% of Share-Alike datasets do.Permissive licenses are stable downstream: 82.8% of models retain them at dataset→model, rising to 91.9% at model→repository.Source: License Drift in AI Ecosystem · p. 5
  • At model→repository, ML License retention is 0.4%, Non-Commercial retention is 6.7%, and Share-Alike retention is 1.7%.Permissive licenses account for 91.1% of repository licenses in these chains.Source: License Drift in AI Ecosystem · p. 5
  • 25.3% of Copyleft models retain their license category at model→repository, a higher rate than other restrictive categories reported there.The paper suggests a larger group of application developers actively chooses Copyleft for final products.Source: License Drift in AI Ecosystem · pp. 5–6
  • 86.4% of model→repository violations are corrected by LicenseRec, compared with 78.0% at dataset→model.Figure 4 summarizes violations for linked datasets and model→repository transitions.Source: Figure 4 · p. 6, Effectiveness of LicenseRec · p. 6
  • 84.9% of model→repository violations follow the ML license→permissive pattern, while Share-Alike→permissive accounts for 37.4% of dataset→model conflicts.Non-commercial→permissive is a top-three conflict pattern at every analyzed stage.Source: Effectiveness of LicenseRec · p. 6
  • 14.2% of dataset→model violations cannot be resolved by changing the downstream license because no license category satisfies all upstream obligations.Applications using affected models inherit the incompatibility; developers must select a different upstream model.Source: Effectiveness of LicenseRec · p. 6

Discussion

The discussion presents license drift as measurable but not fully resolvable by automated checks. Its findings also point to the limits of compatibility judgments and the importance of accurate input data.

Discussion

  • 35.5% of model-to-repository links violate licenses under the ML-aware matrix, versus 3.2% under the EU matrix.The comparison covers dataset-to-model, model-to-repository, and dataset-to-repository stages.Source: Table 4 · p. 7, Discussion · p. 7
  • LicenseRec uses a liberal approach focused on direct contradictions, and its accuracy depends on correct license tags and repository detection.A stricter, risk-averse analysis could identify more violations, especially where multiple licenses create combined obligations; incorrect source metadata cannot be fixed by the tool.Source: Discussion · p. 7
  • The analysis describes a permissive-licensing trend that may reflect convenience, limited awareness, platform defaults, and low-friction collaboration norms.The paper says these factors may contribute to behavior that elevates non-compliance risk.Source: Discussion · p. 7
  • The model-to-repository transition is a critical point where non-permissive obligations are often stripped, motivating better integration-time communication and tools.The paper proposes more sophisticated static and dynamic analysis as future work to improve model-usage accuracy.Source: Discussion · p. 7
  • Many detected conflicts are fixable through better license choices, but inherited conflicts such as non-commercial restrictions can remain unresolvable.The paper concludes that tooling cannot eliminate all baked-in conflicts and that developers must vet upstream dependencies.Source: Discussion · p. 7
  • 81.5% of repositories using proprietary API-based services also adopt permissive licenses, raising questions for future work.The paper identifies reconciling proprietary service terms with open-source license obligations as a next step.Source: Future Work · p. 8

Conclusion

The conclusion presents an end-to-end audit and LicenseRec as contributions to understanding and addressing license compliance in the open-source AI supply chain.

Conclusion

  • The paper reports a large-scale, end-to-end empirical audit of license compliance and introduces LicenseRec to detect and resolve conflicts.The authors describe the audit as a foundational step toward a more responsible, transparent, and legally robust AI ecosystem.Source: Conclusion · p. 8
  • Automated tooling can correct many licensing errors, but inherited, fundamental conflicts remain beyond tooling alone.The conclusion says developer diligence in vetting the whole supply chain remains indispensable.Source: Conclusion · p. 8
  • The authors provide empirical data to quantify systemic risk and a practical framework intended to begin mitigating it.The conclusion characterizes these resources as a step toward a more responsible, transparent, and legally robust AI ecosystem.Source: Conclusion · p. 8

A License Categorization

The section identifies where the paper defines its license categories and where it describes their construction.

A License Categorization

  • Table 5 provides detailed definitions for the license categories used throughout the analysis.The supplied passage names the table but does not enumerate the categories.Source: A License Categorization · p. 8, Table 5 · p. 9
  • The paper's approach to creating the categories is described in the LicenseRec Framework subsection of the Methodology.The passage directs readers to that subsection for the construction approach.Source: A License Categorization · p. 8
  • The categories are used throughout the analysis, making their definitions relevant to interpreting its results.This follows from the passage's statement that the categories are used throughout the analysis.Source: A License Categorization · p. 8
Loading 2509.09873v2…