Check H4 · provenance family · automatic · one of the 18 Hugging Face checks
The question this check asks: is this organisation's namespace one small edit away from a real, established organisation's? Trust on the Hub concentrates on a small set of well-known names — the biggest labs, the biggest model families — and a namespace that merely resembles one of them can borrow that trust without earning it.
H4 is the Hugging Face analogue of C4, RepoGates' fork-and-lookalike check for GitHub, applied to organisation namespaces instead of repository full names. The scoring table's evidence note names the pattern directly:
"one edit from a known org — nullifAI-style namespace imitation"
A visitor scanning a namespace quickly reads a plausible-looking name as the real thing — a swapped hyphen, an added letter, a lookalike Unicode character are all cheap to register and easy to miss at a glance. This is a provenance check, not a content check: it says nothing about what a repository contains, only about whether its organisation is who it appears to be.
H4 is HIGH severity, costing 15 points when it fires. The verdict engine shared across all 18 Hugging Face checks and the 22 GitHub checks starts the score at 100 and subtracts every fired penalty, floored at zero — any CRITICAL finding instead drops the score straight to 0 and BLOCK. 80 and above is PASS, 50–79 is REVIEW, under 50 (or any CRIT) is BLOCK. A lone H4 finding, with nothing else fired, leaves the score at 85 — still inside the PASS band; H4 tips a verdict only combined with other findings, most often H1 or H2 on the same young, unfamiliar namespace. H4 also feeds the Clone dimension verdict alongside H1–H3, H5, and H12.
H4 fired zero times in the 12 September 2026 measurement of the 100 most-downloaded models on the Hub, on the malicious-models intelligence page — the only checks that produced REVIEW findings in that run were H7 (Hub pickle-import scan, 4 times) and H8 (pickle-only weights, 14 times). That's the expected shape: the top 100 by downloads are held by real, established organisations and authors, not lookalikes trading on borrowed trust — a lookalike namespace hasn't had time to accumulate that kind of traction in the first place.
Edit-distance comparison can't read intent. A genuinely new, unaffiliated author who happens to land on a name close to an existing organisation by coincidence, not imitation, looks identical to this check as a deliberate lookalike — that's a real false-positive shape, even though this measurement didn't surface one on the top 100. It also only works against organisations the check already knows to compare against; it can't flag imitation of a name that isn't on that list, and it can't catch a compromised or hijacked account inside a genuinely, correctly named organisation — that isn't a lookalike, it's an account takeover, and it's outside what a namespace-comparison check can see. RepoGates as a whole also gates browser-initiated downloads only — it doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser, and it never exposes this verdict as a JavaScript global a page's own script could read.
Read the namespace character by character rather than skimming it — that's the entire attack surface this check watches. Check whether the organisation carries the Hub's own verified-organisation badge on its profile page, and if in doubt, navigate to huggingface.co/{org} directly rather than trusting a link, to confirm it's the organisation you expect rather than a namespace that merely resembles it.
What makes a namespace a lookalike? Being one edit away from a known, established organisation's real namespace — a swapped hyphen, an extra or missing letter, a lookalike character. The scoring table calls this the "nullifAI-style namespace imitation" pattern: trading on a name a visitor already trusts without actually being that organisation.
Can this check flag a coincidental name that isn't impersonation? Yes, and that's its known false-positive shape, even though it fired zero times in the 12 September 2026 top-100 measurement. A genuinely new, unaffiliated author who happens to pick a name that lands close to an existing organisation by chance looks the same to an edit-distance check as a deliberate lookalike. The decision page shows you which known organisation it's being compared against, so the judgement is yours.
Does RepoGates stop git clone or a from_pretrained() call? No. RepoGates gates browser-initiated downloads on huggingface.co only. It doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser.
H1 Repository age — the companion signal on a lookalike namespace's own repository · H2 Author account age — the account-level check a lookalike organisation makes moot, since H2 can't read an organisation's age at all · C4 Fork and lookalike — the same reasoning on GitHub, applied to repository names and forks instead of organisation namespaces.
Add RepoGates to Chrome Pricing
Numbers on this page: malicious-models measurement of 12 September 2026 (top 100 most-downloaded models on the Hub); weights from the product's scoring table.