Source-linked AI summary
Uncensored Open-weight Models: Redistribution as the Persistence Layer
10a Labs, :, Juliette Garcia, Hailey May, Bobby McKenzie, David Pham, Matthew Swain, Joshua Valdez, Corie Wieland, Zachary Yahn
TL;DR
The paper examines a poorly understood ecosystem that removes safety protections from open-weight models and redistributes modified versions. It maps producers, redistributors, and downstream applications, finding concentrated redistribution and persistence through deployment-oriented repackaging.
Problem
The scale, key players, growth rate, and accessibility of the ecosystem removing safety protections from open-weight models remain poorly understood.
Method
The paper maps the supply chain from HuggingFace production to GitHub deployment using repository searches, producer crawls, and operational categories for original models and compressed redistributions.
Results
3,471 original uncensored models and 8,164 redistributions were identified; each original was repackaged 2.4 times on average, with three redistributors responsible for 52% of compressed redistributions.
Takeaways & Limitations
Redistribution in deployment-oriented formats is the ecosystem’s persistence layer, while uncensored models also appear in open-source applications including malware-generation tools and NSFW content generators.
Takeaways & Limitations
Q1 2026 covers approximately 2.3 months and is not directly comparable to complete quarters.
Abstract
from arXiv · showhide
A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.
1. Introduction
This report maps the uncensored-model ecosystem from safety-guardrail removal through redistribution and downstream applications. It finds concentrated redistribution, distinct producer and redistributor tiers, expanding deployment, and participation by commercial services and Chinese-origin model families.
- 3,471 original uncensored models were identified on HuggingFace, with each repackaged an average of 2.4 times.
- Three redistributors account for 52% of all 8,164 compressed redistributions, while huihui-ai’s 192 originals generated 1,800 downstream repacks.
- At least 1,055 producers and 1,011 redistributors operate mostly as distinct populations, with only 24% of producers also redistributing.
- GitHub application creation rose from 30 per month in mid-2024 to 140–188 per month by late 2025, with growth accelerating in mid-2025.
- 43% of applications reference Ollama in their READMEs, compared with 14% referencing direct HuggingFace downloads.
- The Dolphin family powers 30% of the 1,643 identified applications, while ten actors account for 45% of nondataset HuggingFace repositories.
- Chinese foundation models account for 38% of identified uncensored model repositories, and their share of new production rose from 1% in Q1 2024 to 55% in Q2 2025.
- Venice.ai’s commissioned Dolphin-Mistral-24B-Venice-Edition appears in 77 GitHub repositories and generated 73 HuggingFace redistributions.
2. Methodology
The study combines multilingual HuggingFace and GitHub searches with repository classification to characterize uncensored models, redistributions, and applications. It distinguishes producers from redistributors and treats repeated deployment-oriented repackaging as the ecosystem’s persistence mechanism.
- 2.1. Overview: 17,727 candidate HuggingFace repositories were surfaced through multilingual keyword searches, dataset-registry searches, and exhaustive crawls of 15 prolific producers.
- 2.1. Overview: An LLM classifier categorized candidates as original uncensored models, compressed redistributions, model merges, malicious datasets, or false positives.
- 2.1. Overview: GitHub searches identified 44,705 candidates, which were filtered to 1,643 applications integrating, recommending, or defaulting to an uncensored model backend.
- 2.2. Producers and Redistributors: The analysis defines producers as actors removing safety behavior and redistributors as actors repackaging models into deployment-oriented formats without performing uncensoring.
- 2.2. Producers and Redistributors: Repeated copies across formats convert many original releases and fewer concentrated repackagers into a durable, enforcement-resistant supply.
3. Results
The uncensored-model ecosystem is organized around distinct producer and redistributor populations, with redistribution highly concentrated and structurally important for persistence and deployment.
- Two tiers, mostly separate populations: 24% of producers also redistribute, leaving at least 1,055 producers and 1,011 redistributors as mostly distinct populations.Redistributors source from public producer repositories and may operate request-driven quantization pipelines.
- Two tiers, mostly separate populations: 61% of producers published a single uncensored model, while 22 actors account for 31% of all originals.Production is long-tailed, with top producers occupying distinct niches.
- Two tiers, mostly separate populations: 52% of all 8,164 compressed redistributions come from three actors.The concentration holds across different redistributor roles, including public request systems and keyword-based selection.
- The 2.4x repackaging effect on distribution: 2.4 repackagings per original convert models into compressed formats such as GGUF, AWQ, GPTQ, EXL2, and MLX.Huihui-ai’s 192 originals generated roughly 1,800 redistributions, approximately 14% of the identified dataset.
- The 2.4x repackaging effect on distribution: Repackaged copies persist across accounts, runtime-specific formats, and separate registries, so removing one upstream repository removes only one node.Application creation responds more strongly to deployability signals than to raw HuggingFace upload volume.
3.2. Lower Barriers Expand the Ecosystem
Lowering the technical cost of uncensoring expanded production and the producer base, while Chinese-origin models became increasingly common source material within the ecosystem.
- Heretic as the production-side accelerant: Heretic reduced uncensoring from a multi-step transformer workflow to a single terminal command.Before Heretic, uncensoring required modifying weights through activation-space workflows or refusal-filtered fine-tuning.
- Heretic as the production-side accelerant: 338 original models per month were produced after Heretic, versus approximately 89 per month during the preceding 22 months.Heretic accounted for 54% of new original production by Q1 2026.
- Heretic as the production-side accelerant: Heretic expanded the producer base from roughly 640 to over 1,055 actors.Heretic users produced 4.6 models each on average and had a 48.7% one-shot abandonment rate.
- Chinese-origin foundation models as increasingly common source material: 57% of modified models derive from Western-origin foundations, 38% from Chinese-origin foundations, and 4% have unidentified origins.Llama, Gemma, and Mistral account for 84% of identifiable Western-origin entries, while Qwen accounts for 80% of Chinese-origin entries.
- Chinese-origin foundation models as increasingly common source material: Chinese-origin models rose from 1% of new uncensored production in Q1 2024 to 55% in Q2 2025, then fluctuated between 43% and 51%.Across the collection window, they account for 38% of identified uncensored model repositories.
- Chinese-origin foundation models as increasingly common source material: Alibaba’s Qwen family accounts for 80% of identified Chinese-origin entries, reflecting availability rather than a uniform actor preference.Top producers remained mixed: huihui-ai selected Chinese families 61% of the time, while MuXodious and DavidAU remained predominantly Western-weighted.
3.3. Downstream Deployment Pulls Selectively From the Mirrored Supply
Downstream applications selectively use the most accessible mirrored models and registries rather than the full available supply, with chatbots the largest application category and a substantial malicious subset.
- Application landscape and intent: Ollama and a small number of model families carry most observed deployment weight.The downstream layer consumes models made easy to integrate rather than the full breadth of available uncensored models.
- Application landscape and intent: 37% of applications are general-purpose uncensored chatbots, while cybersecurity and document-processing tools each account for 16%.The remainder includes NSFW, coding-related, and other specialized uses.
- Application landscape and intent: 25% of applications, or 411 repositories, were classified as explicitly malicious.These were designed for hacking, fraud, malware generation, or content exploiting absent safety guardrails.
- Selective deployment from the mirrored supply: Dolphin powers 30% of identified applications, or 499 repositories, primarily because Ollama makes it available through a single command.Its creator also published 1,566 HuggingFace repositories, including compressed redistributions.
- Selective deployment from the mirrored supply: GitHub application creation rose from approximately 30 per month in mid-2024 to 140–188 per month by late 2025.The acceleration began before the Heretic production surge and coincided with Ollama’s maturation.
- Telegram and secondary channel integration: 110 application repositories reference Telegram integration, exposing redistributed models through conversational interfaces to non-technical users.These bots sit downstream of the HuggingFace-to-Ollama-to-GitHub pipeline.
3.4. Case Studies: The Pipeline in Practice
The case studies show how uncensored models move from upstream production through redistribution layers into commercial, offensive-security, and consumer-facing applications. Across these cases, deployment depends heavily on accessible registries and repackaged model formats.
- Venice.ai: Venice.ai combines commercial commissioning, tiered uncensored services, and downstream redistribution within the same supply chain.Its commissioned Dolphin-Mistral-24B-Venice-Edition generated 73 HuggingFace redistributions, while 77 GitHub repositories integrate Venice’s API or model.
- CyberAlbSecOP: A single actor built coordinated offensive-security tools on Dolphin 2.6 Mixtral through the Dolphin→Ollama→GitHub path.The broader dataset contains 257 cybersecurity repositories and 9 dedicated malware-generator repositories built on redistributed upstream weights.
- NSFW deployment: The NSFW segment contains 92 repositories, with most classified as roleplay or storytelling and averaging 3.7 stars per repository.These projects largely represent fragmented personal or niche-community demand rather than centralized services.
- NSFW deployment: NSFW applications consume the redistribution tier without contributing originals back, relying mainly on Ollama rather than direct HuggingFace integration.This pattern links high-volume, low-coordination demand to registry-based deployment.
4. Discussion
The discussion identifies redistribution concentration and application-layer metadata as central to persistence, availability, and observability. It also bounds the findings by platform coverage, classification validation, technique attribution, period comparability, search ceilings, and unresolved origins.
- Implications for Observability and Enforcement: Removal at the producer tier does not meaningfully reduce availability because downstream copies persist after upstream models or accounts are removed.The average redistribution multiplier is 2.4x; Triangle104’s 936 compressed redistributions continued as downstream copies after removal.
- Implications for Observability and Enforcement: Three actors produce 52% of all compressed redistributions, making the redistribution tier the ecosystem’s narrowest point.The producer tier is diffuse, whereas redistribution is concentrated among a small number of operationally capable nodes.
- Implications for Observability and Enforcement: Application-layer metadata reveals deployment patterns more effectively than model-layer metadata, with 25% of identified applications explicitly malicious by design.README references, registry sources, and functionality categories provide the strongest visibility into downstream use.
- Implications for Observability and Enforcement: Commercial and hobbyist deployments rely on the same redistribution layer, so interventions there would reach both segments regardless of intent.Venice.ai demonstrates that a commercial service and community projects can move through the same distribution infrastructure.
- Limitations: The study covers HuggingFace model supply and public GitHub applications but excludes ModelScope, Gitee, private repositories, self-hosted deployments, and direct-download channels.The platform boundary limits the observed ecosystem rather than establishing complete population coverage.
- Limitations: Classification used a single LLM pass without human ground-truth validation, and 30.3% of retrieved candidates were classified as false-positive search results.Precision and recall were not measured.
- Limitations: Technique attribution is incomplete: 21% of originals have no technique signal, while 17% are labeled abliteration without a specific tool attribution.These gaps constrain analysis of how uncensoring techniques are distributed.
- Limitations: Q1 2026 covers approximately 2.3 months, so it is not directly comparable to complete quarters.The partial period spans January through early March.
5. Related Work
Prior work has measured uncensored-model behavior and producer concentration, while related research has examined the ecosystem through a cybercrime lens. These studies motivate a broader account of production, redistribution, and deployment.
- Prior studies: Sokhansanj (2025) profiles 8,608 uncensored HuggingFace models and finds that they comply with 74.1% of unsafe requests.The study also reports that its top 5% of producers account for 60% of uncensored models.
- Prior studies: Lin et al. (2025) investigate uncensored models through the lens of cyber crime, complementing behavioral and concentration analyses.The supplied passage positions this work within a related cybercrime-oriented literature.
6. Conclusion
The paper profiles the uncensored-model ecosystem across producers, redistributors, and applications. It identifies substantial model activity, concentrated redistribution, and downstream uses including malware-generation tools and NSFW content generators.
- Conclusion: The study identifies 3,471 original uncensored model repositories and 8,164 redistributions on HuggingFace.It also profiles key users responsible for an outsized portion of uncensored-model activity.
- Conclusion: The identified open-source applications include malware-generation tools and NSFW content generators.These applications demonstrate downstream use of models whose safety guardrails were removed.
Disclaimer
The report uses only publicly accessible information and does not include non-public personally identifiable information. It also does not attribute, resolve identities, or deanonymize referenced actors.
- All data comes from publicly accessible platforms.
- The report excludes non-public personally identifiable information.
- The report does not conduct attribution, identity resolution, or deanonymization of referenced actors.
Author List
The report should be cited as “10a Labs (2026),” and its authors are listed alphabetically. All listed authors were affiliated with 10a Labs during the project.
- The report citation is “10a Labs (2026)”.
- The complete author list is presented in alphabetical order.
- The authors are Juliette Garcia, Hailey May, Bobby McKenzie, David Pham, Matthew Swain, Joshua Valdez, Corie Wieland, and Zachary Yahn.