Hidden Licensing Risks in the PTMware Ecosystem

Pre-trained Models (PTMs) have been increasingly integrated into software systems, giving rise to a new class of software referred to as PTMware. In addition to traditional software components composed solely of source code, PTMware also embeds or interacts with PTMs that depend on other models and datasets, forming complex supply chains involving open-source software (OSS) libraries, PTMs, and datasets. However, the licensing issues arising from these intertwined dependencies remain largely unexplored. Leveraging GitHub and Hugging Face, two premier hubs for code and models, we curate a large-scale dataset capturing the supply chains of PTMware. Our dataset comprises 12,180 OSS repositories from GitHub, 3,988 PTMs, and 708 datasets from Hugging Face. We analyze license distributions in the PTMware ecosystem and find that licensing practices differ markedly from those in traditional OSS communities. We further examine license-related issues and identify license selection and maintenance as the primary pain points, with 84% of cases involving discussions about adding appropriate licenses or resolving conflicts in existing ones. We then study license incompatibility in PTMware and evaluate the state-of-the-art approaches, finding that they perform poorly in this setting and achieve only 58% and 76% F1 scores, respectively. These results motivate us to propose LiAgent, which explores the potential of LLM-based agents for ecosystem-level license compatibility analysis, achieves an F1 score of 87%, and improves performance by 14 percentage points over prior approaches. We submit 60 license incompatibility issues detected by LiAgent, of which developers have confirmed 11. Two PTMs with license conflicts have more than 107 million and 5 million downloads on Hugging Face, respectively, suggesting that the issues may affect many downstream applications. We conclude by discussing implications and providing recommendations to support the healthy growth of the PTMware ecosystem.