Don't Trust the Label: License Laundering in AI Supply Chains

This paper traces 232,270 dataset-to-model-to-application supply chains across Hugging Face and GitHub to measure whether license obligations survive redistribution. It identifies two forms of license laundering: unlabeled artifacts receiving definitive downstream labels, and one declared license category replacing another. At least one artifact lacks a declared license in 62.3% of chains, concentrated around a small group of foundational datasets. Every obligation-bearing license category has less than 7% end-to-end survival, while the Permissive category reaches 95.1%.