A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.
Figures & tables
Actor
Redists.
Share of observed total
Selectivity
Notes
mradermacher
2,905
36%
80%
Active Jan. 2024–Mar. 2026; public request system ( ∼3,000 discussions); semi-automated; self-describes as a team.
Triangle104/*
936
11%
74%
Selects models using uncensoring-related keywords in repository metadata; profile and models have been removed from Hugging Face since data collection.
RichardErkhov
364
4%
6%
Student developer in Cyprus; affiliated with “Team mradermacher”; uncensored content is incidental to more than 26,000 total models.
mlx-community
218
3%
45%
Community of approximately 4,000 members that converts models for Apple Silicon.
tensorblock
127
2%
Low
Three-person automated GGUF conversion service.
Table 1: Top redistributors by share of all observed compressed redistributions.
Figure 1: Top 10 modified foundation model families. Solid bars show originals; striped bars show compressed redistributions. Multiplier indicates compressed redistributions per original. Color indicates origin: blue = Western lab (Meta, Google, Mistral, etc.), gold = Chinese lab (Alibaba, DeepSeek, Zhipu, etc.). Model merges (4.4% of the ecosystem) were excluded; merges most commonly involve Llama and Mistral base models.
Figure 2: Chinese-Origin Share of New HuggingFace Repositories by Quarter (models, redistributions, merges, and datasets). Stacked bars (left axis) show absolute Chinese and Western-origin repository counts; the trend line (right axis) shows the Chinese share as a percentage of the two. Repositories with unknown base model origin excluded (777 of 12,360).
Figure 3: ULLM Application Landscape by Functionality Type. Uncensored chatbots dominate at 37%, followed by cybersecurity and document processing tools (16% each). n = 1,643 GitHub repositories.
Figure 4: ULLM Supply Chain flow. The left column shows base foundation models; the middle column shows uncensored model families built from them; the right column shows downstream GitHub application categories. Flow width is proportional to observed co-occurrence in the dataset. n = 1,643 GitHub applications.
AI artifacts move through a multi-platform supply chain, spanning datasets and models on Hugging Face and applications on GitHub. While each artifact carries a license whose obligations should propagate through redistribution, no study has yet measured whether those obligations survive the chain or are stripped and replaced as artifacts move downstream. We trace 232,270 dataset→model→application chains and quantify two forms of license laundering: when artifacts with no declared license acquire definitive labels downstream, and when one declared license category replaces another during redistribution. We find that 62.3% of chains pass through at least one artifact with no declared license (concentrated in a small set of foundational datasets), and that every obligation-bearing license category falls below 7% end-to-end survival while the Permissive category reaches 95.1%. Based on these findings, we provide actionable recommendations for practitioners, model publishers, rights holders, and platform owners.
We present a comprehensive adoption snapshot of the leading open language models and who is building them, focusing on the ~1.5K mainline open models from the likes of Alibaba's Qwen, DeepSeek, Meta's Llama, that are the foundation of an ecosystem crucial to researchers, entrepreneurs, and policy advisors. We document a clear trend where Chinese models overtook their counterparts built in the U.S. in the summer of 2025 and subsequently widened the gap over their western counterparts. We study a mix of Hugging Face downloads and model derivatives, inference market share, performance metrics and more to make a comprehensive picture of the ecosystem.
Model providers can support image protection, but open-weight deployment introduces practical constraints. We propose four requirements: protection effectiveness, clean fidelity, compatibility, and tamper resistance. We incorporate long-horizon attack simulations to strengthen resistance to protection removal. Experiments with a single protection tool show improved resistance to re-alignment at a cost to clean fidelity, motivating further research toward practical model-side protection.
Jihye Kang, Jiwon Park, Namhyuk Ahn
Department of Electrical and Computer Engineering, Inha University