Uncensored Open-weight Models: Redistribution as the Persistence Layer
10a Labs, :, Juliette Garcia, Hailey May, Bobby McKenzie, David Pham, Matthew Swain, Joshua Valdez, et al.
cs.AI
Quick verdict
Claims a 12,360-repo map of the uncensored-model supply chain; a valuable measurement, but one unvalidated LLM classifier caps confidence in all counts.
Summary
This measurement study maps the supply chain of 'uncensored' open-weight language models—models whose safety guardrails have been deliberately stripped via abliteration, refusal-filtered fine-tuning, or merging—across HuggingFace and GitHub from January 2024 to March 2026. The authors scraped ~17,700 candidate HuggingFace repositories via keyword searches (including CJK terms) and crawls of 15 prolific producers, then used a GPT-5 LLM classifier to label 12,360 repositories: 3,471 original uncensored models, 8,164 compressed redistributions, 547 merges, and 178 malicious datasets. They also classified 1,643 GitHub applications integrating such models, 25% of which they deem explicitly malicious. Key findings: redistribution is concentrated (three actors account for 52% of redistributions, averaging 2.4 repackagings per original); producer and redistributor populations overlap by only 24%; application growth tracks deployability (43% of READMEs reference Ollama) rather than raw supply; Chinese-origin bases, led by Qwen, rose from 1% of new production in Q1 2024 to parity by 2025; and the Heretic tool roughly quadrupled monthly production after November 2025. Limitations, largely self-acknowledged: a single classifier pass with no human validation or precision/recall estimates, undisclosed keyword lists, GitHub API truncation of CJK searches, and no released code or data.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 3
● low 1
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Redistribution, not production, makes uncensored models persistent: each original spawns on average 2.4 compressed copies, and three redistributors account for 52% of all 8,164 redistributions.
- Producer and redistributor tiers are functionally separate populations overlapping by only 24%.
- Downstream application growth tracks deployability (43% of application READMEs reference Ollama) rather than raw model supply, with acceleration beginning mid-2025, before Heretic's release.
- Chinese-origin foundation models, 80% of them Qwen, rose from 1% of new uncensored production in Q1 2024 to near-parity by 2025.
- Heretic's November 2025 release roughly quadrupled monthly original production (~89 to ~338/month) and expanded the producer base from ~640 to over 1,055 actors.
Strengths
Census-scale dual-platform design
17,727 HuggingFace candidates plus 44,705 GitHub candidates over a 26-month window, with CJK keyword coverage and exhaustive crawls of 15 prolific producers — far broader than prior single-platform profiles (§2.1).
Actionable structural decomposition
The producer/redistributor two-tier split with Table 1's selectivity metric (mradermacher 80% vs RichardErkhov 6%) and the 2.4x multiplier turn an anecdote ('takedowns don't work') into quantified supply-chain structure (§3.1).
Clean temporal disentangling of accelerants
Unusually candid limitations
Weaknesses
No classifier validation
Causal claims without modeling
Irreproducible pipeline
Unexplained reporting ranges
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a descriptive measurement study of the "uncensored" open-weight model ecosystem — models whose refusal behavior is stripped via abliteration, refusal-filtered SFT/DPO/LoRA, or merging (§1) — covering HuggingFace supply and GitHub deployment from January 2024 to early March 2026. Counts refer to repositories, not unique weight sets (§2.1), a distinction the authors flag but which conditions every headline number. Five claims structure the paper: (1) redistribution is the persistence layer (2.4 repackagings per original; three redistributors = 52% of 8,164); (2) producer and redistributor tiers are largely separate populations (24% overlap); (3) deployment tracks deployability (Ollama in 43% of READMEs) rather than raw supply; (4) Chinese-origin bases (Qwen = 80% of Chinese entries) rose from 1% (Q1 2024) to near-parity; (5) commercial actors (Venice.ai) share the hobbyist redistribution circuitry (73 redistributions, 77 GitHub repos).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is an uncensored AI model?
An open-weight language model whose built-in refusal/safety training has been deliberately removed or weakened — via abliteration (suppressing the refusal direction in activation space), refusal-filtered fine-tuning, or model merging — so it complies with requests the original developer trained it to decline. This study tracked 3,471 such original models on HuggingFace between January 2024 and March 2026.
How large is the uncensored model ecosystem?
The paper identifies 12,360 HuggingFace repositories: 3,471 original uncensored models, 8,164 compressed (quantized) redistributions, 547 model merges, and 178 malicious datasets, plus 1,643 GitHub applications integrating these models — 25% of the applications classified as explicitly malicious.
Which models do uncensored applications actually use?
The Dolphin family powers 30% of the 1,643 identified GitHub applications, largely because it ships by default in the Ollama registry; 43% of application READMEs reference Ollama versus 14% referencing direct HuggingFace downloads. Huihui-ai models power fewer applications (109) but the highest aggregate star count (4,264).
Can platform takedowns remove uncensored models?
The paper argues no: each original spawns on average 2.4 quantized copies across separate accounts, formats, and registries, and three redistributors alone account for 52% of all copies — so removing one upstream repository leaves the mirrored downstream copies live.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure images (Figs. 1–4) are not inspectable from the extracted text; assessments of them rest on captions, which do carry the key numbers.
- The full keyword lists (43+12 HuggingFace terms; 59/37 GitHub terms; 21 tags) are not enumerated anywhere in the provided text, so their composition could not be assessed.
- The extract runs through the complete reference list to page 9; no end-of-text truncation was detected.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.