License Laundering: Only 7% of Obligation-Bearing Licenses Survive the Hugging Face → GitHub Supply Chain

arXiv 2607.20300·high signal

Tracing 232,270 dataset→model→application chains across Hugging Face and GitHub, researchers measured whether license obligations actually propagate downstream — they mostly don't. 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), every obligation-bearing license category ends up below 7% end-to-end survival, while Permissive licenses survive at 95.1%. If you ship anything built on a fine-tuned open model, the license on the repo card is not evidence of what you're actually allowed to do.