cs.AISep 4, 2026

Uncensored Open-weight Models: Redistribution as the Persistence Layer

Authors: 10a Labs, :, Juliette Garcia, Hailey May, Bobby McKenzie, David Pham, Matthew Swain, Joshua Valdez, 

Organizations: 10a Labs

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.

Figures & tables

ActorRedists.Share of observed totalSelectivityNotes
mradermacher2,90536%80%Active Jan. 2024–Mar. 2026; public request system ( ∼3,000{\sim}3{,}000 discussions); semi-automated; self-describes as a team.
Triangle104/*93611%74%Selects models using uncensoring-related keywords in repository metadata; profile and models have been removed from Hugging Face since data collection.
RichardErkhov3644%6%Student developer in Cyprus; affiliated with “Team mradermacher”; uncensored content is incidental to more than 26,000 total models.
mlx-community2183%45%Community of approximately 4,000 members that converts models for Apple Silicon.
tensorblock1272%LowThree-person automated GGUF conversion service.
Table 1: Top redistributors by share of all observed compressed redistributions.
Figure 1: Top 10 modified foundation model families. Solid bars show originals; striped bars show compressed redistributions. Multiplier indicates compressed redistributions per original. Color indicates origin: blue = Western lab (Meta, Google, Mistral, etc.), gold = Chinese lab (Alibaba, DeepSeek, Zhipu, etc.). Model merges (4.4% of the ecosystem) were excluded; merges most commonly involve Llama and Mistral base models.
Figure 2: Chinese-Origin Share of New HuggingFace Repositories by Quarter (models, redistributions, merges, and datasets). Stacked bars (left axis) show absolute Chinese and Western-origin repository counts; the trend line (right axis) shows the Chinese share as a percentage of the two. Repositories with unknown base model origin excluded (777 of 12,360).
Figure 3: ULLM Application Landscape by Functionality Type. Uncensored chatbots dominate at 37%, followed by cybersecurity and document processing tools (16% each). n = 1,643 GitHub repositories.
Figure 4: ULLM Supply Chain flow. The left column shows base foundation models; the middle column shows uncensored model families built from them; the right column shows downstream GitHub application categories. Flow width is proportional to observed co-occurrence in the dataset. n = 1,643 GitHub applications.
More in this topic

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Explore similar work

CardsList

  1. Don't Trust the Label: License Laundering in AI Supply Chains

    Jul 22, 2026James Jewitt, Hao Li, Gopi Krishnan Rajbahadur +2

    Queen’s University

  2. The ATOM Report: Measuring the Open Language Model Ecosystem

    Apr 8, 2026Nathan Lambert, Florian BrandOpen-Weight Language Models

    Interconnects AI, atomproject.ai

  3. Beyond User-Side Defenses: Image Protection in Open-Weight Diffusion Models

    Oct 12, 2026Jihye Kang, Jiwon Park, Namhyuk AhnDiffusion ModelsAdversarial Robustness

    Department of Electrical and Computer Engineering, Inha University