From Hugging Face to GitHub: Tracing License Drift in the Open-Source AI
  Ecosystem
Hidden license conflicts in the open-source AI ecosystem pose serious legal
and ethical risks, exposing organizations to potential litigation and users to
undisclosed risk. However, the field lacks a data-driven understanding of how
frequently these conflicts occur, where they originate, and which communities
are most affected. We present the first end-to-end audit of licenses for
datasets and models on Hugging Face, as well as their downstream integration
into open-source software applications, covering 364 thousand datasets, 1.6
million models, and 140 thousand GitHub projects. Our empirical analysis
reveals systemic non-compliance in which 35.5% of model-to-application
transitions eliminate restrictive license clauses by relicensing under
permissive terms. In addition, we prototype an extensible rule engine that
encodes almost 200 SPDX and model-specific clauses for detecting license
conflicts, which can solve 86.4% of license conflicts in software applications.
To support future research, we release our dataset and the prototype engine.
Our study highlights license compliance as a critical governance challenge in
open-source AI and provides both the data and tools necessary to enable
automated, AI-aware compliance at scale.
68cccbb13df9ac65e93dc69a
James Jewitt
admin_assigned
2025-09-23T14:30:15.400Z
65ac8bed46d2f7fe546994d5
/avatars/52cf859640dba9a466601a2c532e3442.svg
James Jewitt
user
jejewitt
68cccbb13df9ac65e93dc69b
Hao Li
claimed_verified
2025-09-19T06:48:16.570Z
62b4f3b7464e664268bf4e85
/avatars/16e79e11a8734b1d241e0f0c55a54045.svg
Leo
user
hao-li
68cccbb13df9ac65e93dc69c
Bram Adams
admin_assigned
2025-09-23T14:33:19.761Z
62f51d2231ee3f3670f7fe1b
/avatars/20fe13d191738a0b2d6cff6c4d3d073b.svg
Bram Adams
user
bramses
68cccbb13df9ac65e93dc69d
Gopi Krishnan Rajbahadur
admin_assigned
2025-09-23T14:29:59.924Z
679bb3a518279c15eb512f08
/avatars/390c7abfa9b69c425c2cb4b370aec8f9.svg
Gopi Krishnan Rajbahadur
user
gopirajbahadur
68cccbb13df9ac65e93dc69e
Ahmed E. Hassan
From Hugging Face to GitHub: Tracing License Drift in the Open-Source AI
  Ecosystem
Hidden license conflicts in the open-source AI ecosystem pose serious legal
and ethical risks, exposing organizations to potential litigation and users to
undisclosed risk. However, the field lacks a data-driven understanding of how
frequently these conflicts occur, where they originate, and which communities
are most affected. We present the first end-to-end audit of licenses for
datasets and models on Hugging Face, as well as their downstream integration
into open-source software applications, covering 364 thousand datasets, 1.6
million models, and 140 thousand GitHub projects. Our empirical analysis
reveals systemic non-compliance in which 35.5% of model-to-application
transitions eliminate restrictive license clauses by relicensing under
permissive terms. In addition, we prototype an extensible rule engine that
encodes almost 200 SPDX and model-specific clauses for detecting license
conflicts, which can solve 86.4% of license conflicts in software applications.
To support future research, we release our dataset and the prototype engine.
Our study highlights license compliance as a critical governance challenge in
open-source AI and provides both the data and tools necessary to enable
automated, AI-aware compliance at scale.
The study audits licenses in the Hugging Face ecosystem, revealing systemic non-compliance and proposing a rule engine to detect and resolve license conflicts in open-source AI.
license conflicts Hugging Face datasets models GitHub projects SPDX rule engine license compliance governance challenge automated compliance