Don't Trust the Label: License Laundering in AI Supply Chains (arxiv.org)

A recent study highlights a critical issue in AI supply chains known as license laundering, where the licensing obligations of AI artifacts—such as datasets and models—are frequently ignored or altered as they move through platforms like Hugging Face and GitHub. The researchers traced over 232,000 artifact chains and discovered that 62.3% of them included at least one artifact without a declared license. Alarmingly, only 7% of obligation-bearing license categories maintained their integrity through redistribution, while permissive licenses fared much better, with a 95.1% survival rate. This revelation is significant for the AI/ML community as it underscores the potential legal and ethical ramifications of improper licensing in AI development. The findings highlight the vulnerability of foundational datasets and the ease with which licensing conditions can be overlooked, posing risks both to creators' rights and compliance with legal frameworks. The study offers actionable recommendations for practitioners, model publishers, rights holders, and platform owners to enhance licensing transparency and ensure the integrity of AI supply chains.