---
title: "别信许可证：AI供应链中的许可证洗钱问题"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.20300v1"
permalink: "https://feed.astralor.com/items/itm_2bbeae63656fc17eb921bc28"
published: "2026-07-22T15:48:04.000Z"
score: 78
channel: "tech"
tags: ["AI供应链","GitHub","Hugging Face","开源合规","许可证洗钱"]
---

# 别信许可证：AI供应链中的许可证洗钱问题

## AI 点评

> 这篇论文我看完直冒冷汗——你以为用了MIT许可证就万事大吉？实际上链条中大量无标签工件让义务像沙子一样漏掉。对做模型聚合平台或使用开源数据集训练产品的团队来说，这是必读的清醒剂。别等到被版权方找上门才追悔莫及。

## 速览

该研究首次量化了AI供应链中的许可证洗钱现象：追踪232,270条数据集→模型→应用链条，发现62.3%的链条至少经过一个无明确许可证的工件，义务性许可证（如GPL、Apache 2.0）的端到端生存率不足7%，而宽松许可证（如MIT）生存率达95.1%。研究揭示了许可证义务在跨平台传播中被剥离或替换的普遍问题，为从业者、版权方和平台提供了可操作建议。

## 关键点

- 追踪了232,270条从数据集到模型再到应用的完整供应链链条
- 发现两种许可证洗钱形式：无许可证工件被贴上下游标签，以及许可证类别在传播中被替换
- 62.3%的链条经过至少一个无明确许可证的工件，且义务性许可证端到端生存率低于7%
- 宽松许可证（如MIT）在供应链中生存率高达95.1%，表明义务经常被规避

## 全文

AI artifacts move through a multi-platform supply chain, spanning datasets and models on Hugging Face and applications on GitHub. While each artifact carries a license whose obligations should propagate through redistribution, no study has yet measured whether those obligations survive the chain or are stripped and replaced as artifacts move downstream. We trace 232,270 dataset$\rightarrow$model$\rightarrow$application chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream, and when one declared license category replaces another during redistribution. We find that 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), and that every obligation-bearing license category falls below 7% end-to-end survival while the Permissive category reaches 95.1%. Based on these findings, we provide actionable recommendations for practitioners, model publishers, rights holders, and platform owners.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_2bbeae63656fc17eb921bc28