Uncensored Open-weight Models: Redistribution as the Persistence Layer
10a Labs 1
arXiv:2609.05241v1 [cs.AI] 4 Sep 2026
Abstract
acceleration dynamics and barriers to entry, and how model supply translates into downstream use cases and application demand.
A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.
For our purposes, “uncensoring” refers to techniques that intentionally strip the safety guardrails typically present when open-weight models are released to the public. These techniques target the refusal behavior trained into the model’s weights, rather than external filters or classifiers. These techniques include activation-space abliteration (Arditi et al., 2024; Piras et al., 2026), which suppresses refusal directions in a model’s internal representations, malicious fine-tuning (Halawi et al., 2024; Qi et al., 2023), such as refusal-filtered SFT, DPO (Rafailov et al., 2024), or LoRA (Hu et al., 2021) adapters that retrain the model to comply, and model merging, which blends uncensored models with other models to enhance capabilities like reasoning (Yang et al., 2025b; Li et al., 2025). When compressed and repackaged, the resulting models can be deployed locally on consumer hardware. In total, we identified 3,471 original uncensored models on HuggingFace. Our key findings include:
1. Introduction Major open-weight language model families are typically released with safety post-training intended to limit harmful behavior (Gemma Team et al., 2026; OpenAI et al., 2025; Grattafiori et al., 2024; Yang et al., 2025a; Jiang et al., 2024; Guo et al., 2025), but a rapidly expanding ecosystem of actors is removing these protections and redistributing modified versions—fueling downstream applications like offensive security tools, malware generators, and NSFW services—while the scale, key players, growth rate, and accessibility of this ecosystem remain poorly understood.
• Redistribution drives persistence. Each original uncensored model is repackaged an average of 2.4 times. Three redistributors on HuggingFace (mradermacher, Triangle104, RichardErkhov) account for 52% of all 8,164 compressed redistributions. A single producer’s 192 originals (huihui-ai) generated 1,800 downstream repacks — roughly 14% of the entire dataset — through other actors. • The producer and redistributor tiers are functionally separate. At least 1,055 producers and at least 1,011 redistributors operate mostly as distinct populations; only 24% of producers also redistribute. Redistributors source from public producer repositories without observed explicit coordination, and some operate request-driven quantization pipelines that respond to downstream demand rather than upstream release.
This report maps the full supply chain of safety-stripped or “uncensored” models, from production on HuggingFace to deployment in GitHub applications—analyzing repositories from January 2024 to early March 2026 to assess the ecosystem’s scale and composition, key actors and their motivations, modification techniques and their evolution, 1 Please cite this work as “10a Labs (2026)”. The full author list is available at the end of this report. Visit our website at https: //10alabs.com/ for more information. Correspondence to: Bobby McKenzie <[email protected]>.
• Deployment tracks accessibility, not raw supply. GitHub application creation rose from 30 per month in mid-2024 to 140–188 per month by late 2025. The surge began accelerating in mid-2025, aligned with 1
Uncensored Open-weight Models: Redistribution as the Persistence Layer
maturation of the Ollama distribution layer, rather than with the later Heretic-driven (Weidmann, 2025) surge that started in November 2025. 43% of applications reference Ollama in their READMEs; 14% reference direct HuggingFace downloads.
8,164 compressed redistributions, 547 model merges, and 178 malicious datasets. All temporal analysis in this report is based on each repository’s HuggingFace publication date, not the date of collection. We also scraped GitHub repositories to find references to uncensored models. We identified 44,705 candidate repositories through model-name keyword search (59 terms), application-level keyword search (37 terms), 21 topic tags, actor crawls, and supplemental Chinese and Japanese keyword searches. After classification and filtering to applications only, 1,643 repositories were identified as integrating, recommending, or defaulting to an uncensored model backend.
• A small set of model families carries disproportionate downstream weight. The Dolphin (Hartford, 2025) family alone powers 30% of the 1,643 identified applications. Ten actors account for 45% of all nondataset HuggingFace repositories. Concentration at the application layer reflects registry accessibility as much as model choice. • Chinese-origin foundation models sit at the center of the source-model landscape. Chinese foundation models account for 38% of all identified uncensored model repositories. Their share of new uncensored production rose from 1% in Q1 2024 to 55% in Q2 2025 and has since fluctuated near parity with Westernorigin models, driven primarily by Alibaba’s Qwen family (Yang et al., 2025a).
2.2. Producers and Redistributors We define two functionally distinct tiers of the uncensored model ecosystem: producers who remove safety behavior from open-weight models, and redistributors who repackage the results into formats deployable on consumer hardware. We classify a repository as an original uncensored model when it represents a model whose safety behavior has been intentionally modified, including through abliteration, safety-removing fine-tuning, or related techniques. We classify a repository as a compressed redistribution when it primarily repackages an existing uncensored model into a deployment-oriented format, such as GGUF, AWQ, GPTQ, EXL2, or MLX, without performing the underlying uncensoring step. The redistribution tier is the source of the ecosystem’s persistence. Production is spread across a long tail of actors, while redistribution is concentrated and operationally centralized. That asymmetry, consisting of many originals, few repackagers, and repeated downstream copies, is what converts a scatter of individual releases into a durable, enforcement-resistant supply.
• Commercial services participate in the same supply chain. Venice.ai commissioned Dolphin-Mistral24B-Venice-Edition from the Dolphin family’s creator, which offers uncensored products at tiered pricing, and appears in 77 GitHub repositories that integrate either its API or its Dolphin-Venice model. The commissioned model spawned 73 HuggingFace redistributions by community actors — placing a commercial release inside the same redistribution circuitry that carries hobbyist output.
2. Methodology 2.1. Overview
3. Results
We scraped HuggingFace using keyword searches across its model and dataset registries (including Chinese and Japanese terms) and crawls of all repositories published by known prolific producers. The keyword list included 43 high-signal terms plus 12 context-dependent terms, including Chinese and Japanese equivalents. Our repository search also included exhaustive crawls of 15 known prolific producers and dataset-registry search. This search surfaced 17,727 candidate repositories. Unless otherwise stated, counts in this report refer to HuggingFace repositories rather than unique sets of model weights.
3.1. Redistribution Enables Durability 3.1.1. T WO T IERS , M OSTLY S EPARATE P OPULATIONS We identified at least 1,055 producers and at least 1,011 redistributors active on HuggingFace within the collection window. The two populations overlap by only 24%. Redistributors source from producers’ public repositories without observed coordination, and in observed cases operate request-driven quantization pipelines that respond to downstream user demand rather than upstream release schedules.
An LLM classifier, GPT-5 (Singh et al., 2026), categorized each of the 17,727 candidate repositories as an original uncensored model, compressed redistribution, model merge, malicious dataset, or false positive, producing 12,360 HuggingFace repositories associated with safety guardrail removal. These included 3,471 original uncensored models,
Production is long-tailed. 61% of producers published a single uncensored model. 22 actors account for 31% of all originals. The top producers occupy distinct niches: • Huihui-ai is weighted toward Chinese-origin base mod2
Uncensored Open-weight Models: Redistribution as the Persistence Layer Table 1. Top redistributors by share of all observed compressed redistributions. Actor
Redists.
Share of observed total
Selectivity
Notes
mradermacher
2,905
36%
80%
Triangle104/*
936
11%
74%
RichardErkhov
364
4%
6%
mlx-community
218
3%
45%
tensorblock
127
2%
Low
Active Jan. 2024–Mar. 2026; public request system (∼3,000 discussions); semi-automated; self-describes as a team. Selects models using uncensoring-related keywords in repository metadata; profile and models have been removed from Hugging Face since data collection. Student developer in Cyprus; affiliated with “Team mradermacher”; uncensored content is incidental to more than 26,000 total models. Community of approximately 4,000 members that converts models for Apple Silicon. Three-person automated GGUF conversion service.
els (61% of its 192 originals).
The operational consequence is structural persistence. Availability of a given model no longer depends on its original producer. Enforcement action against a single upstream repository removes one node in a mirrored distribution graph rather than the model itself. Repackaged copies persist across separate accounts, separate formats optimized for different runtimes, and separate registries — principally HuggingFace and Ollama — that are not centrally controlled by any one provider.
• MuXodious covers 72 unique base-model families in 79 days using the Heretic tool. • SicariusSicariiStuff has operated on refusal-filtered fine-tuning since January 2024, predating Heretic by nearly two years. Redistribution is concentrated. Three actors account for 52% of all 8,164 compressed redistributions. The concentration holds across role types:
This pattern also appears in the GitHub application data: application-layer creation responds more strongly to deployability signals (quantized formats, Ollama registrations) than to raw upload volume on HuggingFace. A model that exists on HuggingFace but is not quantized and mirrored is not, in practical terms, available at scale to application developers. The redistribution tier is the step that converts a model from “published” into “deployable.”
• Mradermacher operates a public model-request system with roughly 3,000 community discussions and selfdescribes as a team. • Triangle104 selects models whose names or metadata contain uncensoring keywords. • RichardErkhov self-identifies as “Team mradermacher” and routes uncensored content incidentally within a much larger conversion pipeline.
3.2. Lower Barriers Expand the Ecosystem Redistribution persists because upstream production remains both scalable and varied. Automation expanded the volume of uncensored model production, while the available pool of source models broadened across Western- and Chinese-origin foundation model families. Together, those shifts sustained the flow of new models into the redistribution tier.
Table 1 reports each actor’s redistribution count, share of the observed total of all 8,164 compressed redistributions, and selectivity, defined here as the percentage of the actor’s total output that consists of uncensored models. 3.1.2. T HE 2.4 X R EPACKAGING E FFECT ON D ISTRIBUTION
3.2.1. H ERETIC AS THE P RODUCTION -S IDE ACCELERANT
Each original uncensored model is repackaged an average of 2.4 times into compressed, quantization-optimized formats (GGUF, AWQ, GPTQ, EXL2, MLX) by downstream actors. The multiplier is unevenly distributed: huihui-ai’s 192 originals have been repackaged into roughly 1,800 compressed redistributions by other actors, accounting for approximately 14% of the entire HuggingFace dataset identified in this collection.
Before November 2025, uncensoring required working knowledge of transformer internals — loading model weights, identifying refusal directions in activation space, and modifying them through a Python workflow built around TransformerLens or refusal-filtered supervised fine-tuning. Heretic CLI (Weidmann, 2025), released on GitHub in late 2025, reduced that workflow to a single terminal command. 3
Uncensored Open-weight Models: Redistribution as the Persistence Layer
Figure 1. Top 10 modified foundation model families. Solid bars show originals; striped bars show compressed redistributions. Multiplier indicates compressed redistributions per original. Color indicates origin: blue = Western lab (Meta, Google, Mistral, etc.), gold = Chinese lab (Alibaba, DeepSeek, Zhipu, etc.). Model merges (4.4% of the ecosystem) were excluded; merges most commonly involve Llama and Mistral base models.
The transition was near-immediate. Zero Heretic entries appeared in October 2025. In November, 132 originals were produced using the tool, representing 55.5% of that month’s output. By Q1 2026, Heretic accounted for 54% of new original uncensored model production. In the 22 months before Heretic’s release, producers created approximately 89 original models per month. In the 4.5 months after, the rate rose to approximately 338 per month.
Three Western families – Meta’s Llama (52%) (Grattafiori et al., 2024), Google’s Gemma (17%) (Gemma Team et al., 2026), and Mistral AI’s Mistral/Mixtral (15%) (Jiang et al., 2024) – account for 84% of Western-origin entries where the base model could be identified. Among Chinese-origin models, Alibaba’s Qwen family (Yang et al., 2025a) accounts for 80%. Producers concentrate on the 3–8 billion parameter range (41% of all entries), the size range most readily deployed on consumer-grade GPUs and laptops.
Heretic also expanded the producer base from roughly 640 to over 1,055 actors. Heretic users produce an average of 4.6 models each (compared to 3.5 for TransformerLens and 2.1 for refusal-filtered supervised fine-tuning) and have the lowest one-shot abandonment rate of any technique at 48.7%, versus 69–75% for fine-tuning methods. The tool expanded the pool of repeat producers rather than only adding one-off contributors — meaning the supply feeding the redistribution tier grew in both output volume and durability.
3.2.3. C HINESE -O RIGIN F OUNDATION M ODELS AS I NCREASINGLY C OMMON S OURCE M ATERIAL Figure 2 shows the share of new HuggingFace repositories for models, redistributions, merges, and datasets of Chinese origin. In Q1 2024, Chinese foundation models accounted for 1% of new uncensored model production in the dataset. By Q2 2025, their share had risen to 55%. Since then, quarterly share has fluctuated between 43% and 51%, settling at near-parity with Western-origin base models. Across the full collection window, Chinese-origin models account for 38% of all identified uncensored model repositories.
3.2.2. F OUNDATION M ODEL FAMILIES S HAPE THE S OURCE -M ODEL L ANDSCAPE Figure 1 shows the top ten foundation model families for modified models on HuggingFace. 57% of such models derive from Western-origin foundation models, 38% from Chinese-origin models, 1% from models based in other countries (e.g., UAE and South Korea), and 4% from models whose origin could not be identified from available metadata.
Alibaba’s Qwen (Yang et al., 2025a) family drives most of that shift, accounting for 80% of identified Chinese-origin entries. DeepSeek (Guo et al., 2025) appears frequently as secondary source material, particularly in huihui-ai’s output. The shift reflects availability rather than actor prefer4
Uncensored Open-weight Models: Redistribution as the Persistence Layer
stars and 1,800 forks. The categories break down as follows: general-purpose uncensored chatbots (37%), cybersecurity tools (16%), document processing pipelines (16%), with the remainder spanning NSFW roleplay, NSFW storytelling, coding-related tools, and other specialized use cases. We classified 411 applications (25%) as explicitly malicious — designed for hacking, fraud, malware generation, or content that specifically exploits the absence of safety guardrails. The remaining 1,232 (75%) were classified as ambiguous, meaning the functionality could serve both legitimate and harmful purposes. However, the removal of safety constraints is a deliberate design choice rather than an incidental property. 3.3.2. C ONCENTRATION AT THE A PPLICATION L AYER M IRRORS THE S UPPLY C ONCENTRATION
Figure 2. Chinese-Origin Share of New HuggingFace Repositories by Quarter (models, redistributions, merges, and datasets). Stacked bars (left axis) show absolute Chinese and Western-origin repository counts; the trend line (right axis) shows the Chinese share as a percentage of the two. Repositories with unknown base model origin excluded (777 of 12,360).
We map the supply chain flow of uncensored LLMs in Figure 4. The Dolphin family alone powers 30% of identified applications (499 repositories). Dolphin’s dominance is driven primarily by its default availability in the Ollama model registry, which reduces integration to a single command, and secondarily by its creator’s prolific output. The creator has published 1,566 HuggingFace repositories, including compressed redistributions under the dphn account. This distribution advantage is reflected in adoption patterns: Ollama appears in 43% of application READMEs, compared to 14% for direct HuggingFace downloads.
ence: the most prolific Chinese-origin producer (huihui-ai) draws 61% of its base-model selections from Chinese families, but other top producers remain predominantly Westernweighted (MuXodious 83% Western; DavidAU 69% Western). Actors appear to target Qwen primarily because it is a widely used open-weight family, not because they specifically shifted toward Chinese source material.
Huihui-ai models power fewer applications (109) but command the highest aggregate star count of any identifiedbackend cluster (4,264 stars). This suggests huihui-ai models are favored in higher-visibility projects, particularly Chinese-language uncensored chat applications, even though Dolphin carries more raw integration volume.
As Chinese-origin source models account for a larger share of uncensored repositories, the redistribution layer gains a broader pool of frontier-capable models to mirror. Chineseorigin models sit in the same redistribution circuitry as Western-origin models; mradermacher and Triangle104 repackage both without distinction.
The asymmetry between upload volume and deployment volume shows that downstream application growth depends more on model accessibility than on total model supply. HuggingFace uploads peaked at 879–1,077 models per month in early 2026. GitHub application creation rose from approximately 30 per month in mid-2024 to 140–188 per month by late 2025. The acceleration began in mid2025—preceding the Heretic-driven production surge—and instead coincided with the maturation of the Ollama distribution layer. Application growth aligns more closely with model deployability and registry accessibility than with growth in raw model supply.
3.3. Downstream Deployment Pulls Selectively From the Mirrored Supply Downstream application development draws from the redistribution tier in a patterned way. A small number of model families and one registry in particular (Ollama) carry most of the observed deployment weight. The downstream layer does not consume the full breadth of available uncensored models; it consumes the portion that has been made easy to integrate. 3.3.1. A PPLICATION L ANDSCAPE AND I NTENT
3.3.3. T ELEGRAM AND S ECONDARY C HANNEL I NTEGRATION
We classify uncensored LLM applications by functionality type in Figure 3. We identified 1,643 GitHub repositories that integrate, recommend, or default to an uncensored model backend. These uncensored large language model (ULLM) applications collectively account for over 11,600
GitHub is itself the primary distribution channel for application code, but deployment extends to other platforms. 110 application repositories reference Telegram integration,
5
Uncensored Open-weight Models: Redistribution as the Persistence Layer
Figure 3. ULLM Application Landscape by Functionality Type. Uncensored chatbots dominate at 37%, followed by cybersecurity and document processing tools (16% each). n = 1,643 GitHub repositories.
deploying uncensored models as Telegram bots across uncensored chat, NSFW roleplay, and cybersecurity tooling. These bots sit downstream of the HuggingFace-to-Ollamato-GitHub pipeline; they consume quantized models through the same redistribution circuitry but expose them through conversational interfaces to non-technical end users.
censorship refusal rate (Venice.ai, 2026). The commissioned model spawned 73 HuggingFace redistributions (GGUF, AWQ, MLX, EXL2) produced by the same community redistributors — mradermacher, bartowski, Triangle104 — identified in Section 3. On GitHub, 77 repositories integrate Venice’s API or its Dolphin-Venice model, spanning uncensored chatbots, cybersecurity tools, coding assistants, and at least one WormGPT clone.
3.4. Case Studies: The Pipeline in Practice
Venice also offers dedicated uncensored products at tiered pricing: Venice Uncensored 1.1 ($0.20/M input tokens), Venice Role Play Uncensored ($0.50/M input), Lustify SDXL and Lustify v7 for NSFW image generation, and GLM 4.7 Flash Heretic — the last of which uses the same Heretic abliteration tool documented in Section 3.2.1. Venice therefore functions as both a consumer and a producer inside the uncensoring supply chain: it purchases upstream capacity from a hobbyist-origin producer, pushes the result into the same community redistribution layer, and then redistributes commercially through its own API to downstream developers.
Three cases illustrate how the production–redistribution–deployment pipeline behaves at different points in the supply chain: (1) a commercial service that commissions upstream and distributes downstream; (2) a single-actor offensive security deployment; and (3) a fragmented consumer-facing segment that consumes the redistribution layer without contributing to it. 3.4.1. V ENICE . AI : C OMMERCIAL PARTICIPANT IN THE S AME C IRCUITRY Venice.ai (Voorhees, 2025) represents the most commercially developed deployment identified in the paired HuggingFace and GitHub collection. The company operates a full-stack AI API marketplace offering 144 models across text, image, video, and audio, including mainstream models (GPT-5.4, Claude Sonnet 4.6, Gemini) alongside explicitly uncensored offerings.
3.4.2. C YBER A LB S EC OP: O FFENSIVE T OOLING ON T OP OF A R EDISTRIBUTION BACKBONE GitHub user CyberAlbSecOP maintains two complementary tools: BLACKHATGOD Master Hacker GPT (201 stars) and HYDRAX Advanced Malware Generator GPT (25 stars), both powered by Dolphin 2.6 Mixtral. A single actor has built a coordinated offensive security suite on a model that reached them through the same Dolphin→Ollama→GitHub path traced elsewhere in the
Venice directly commissioned the creator of the Dolphin family to produce Dolphin-Mistral-24B-Venice-Edition from Mistral-Small-24B using specialized fine-tuning and orthogonalization techniques, reportedly achieving a 2.2% 6
Uncensored Open-weight Models: Redistribution as the Persistence Layer
Figure 4. ULLM Supply Chain flow. The left column shows base foundation models; the middle column shows uncensored model families built from them; the right column shows downstream GitHub application categories. Flow width is proportional to observed co-occurrence in the dataset. n = 1,643 GitHub applications.
originals back to it — and that relies on Ollama’s registry model rather than direct HuggingFace integration for most deployments.
dataset. The broader dataset contains 257 cybersecurity tool repositories and 9 dedicated malware generator repositories that sit in the same pattern. These are not novel models. They are conventional applications built on redistributed upstream weights, with the malicious configuration supplied by application-layer prompting, tool wiring, and UI design rather than by further model modification.
4. Discussion 4.1. Implications for Observability and Enforcement The data point to three structural features that shape availability, concentration, and observability in the uncensored model ecosystem. Together, they indicate where supply persists, where activity concentrates, and where downstream use is most visible.
3.4.3. NSFW D EPLOYMENT: H IGH VOLUME , L OW ACTOR C OORDINATION 92 repositories are classified as NSFW roleplay (76) or NSFW storytelling (16). The highest-starred, NSFW-chatbot by samttoo22-MewCat (81 stars), uses ValueFX9507/Tifa-DeepsexV2-7b — a fine-tuned model purpose-built for explicit content. Others integrate Dolphin or DeepSeek directly, or instruct users to select “uncensored” models through Ollama at install time.
Removal at the producer tier does not meaningfully reduce availability. The 2.4x redistribution multiplier means that, in aggregate, original models generate multiple downstream copies. Takedowns at the producer level remove upstream authorship but not downstream supply. Triangle104’s profile and models, for example, were removed from HuggingFace after the collection window; the 936 compressed redistributions published by that account were produced prior to its removal and continue to persist as downstream copies across the ecosystem.
NSFW roleplay and storytelling repositories have low average star counts (3.7 per repository) but high volume, indicating a fragmented landscape of small-scale personal or niche-community projects rather than centralized services. This represents a segment of downstream demand that consumes the redistribution tier without contributing
The redistribution tier is the ecosystem’s narrowest point. Three actors produce 52% of all compressed redistributions. 7
Uncensored Open-weight Models: Redistribution as the Persistence Layer
5. Related Work
The producer tier is long-tailed and diffuse, while the redistribution tier is concentrated. That concentration means changes at a small number of redistribution nodes would affect a larger share of observed downstream availability than comparable action at the producer tier. The concentration reflects operational capacity — semi-automated pipelines, request systems, and team structure — rather than explicit coordination.
A few works have investigated the uncensored model ecosystem. Sokhansanj (2025) profiles 8,608 uncensored models from HuggingFace repositories. They analyze refusal rates on safety tasks and find that uncensored models comply with 74.1% of unsafe requests. They also note that the top 5% of producers they identify account for 60% of the uncensored models in their study. Lin et al. (2025) investigate the landscape of uncensored models through the lens of cyber crime. They represent the ecosystem as a knowledge graph and use graph-based deep learning to identify 11,000 uncensored models based on a small dataset. Other works such as (Lin et al., 2024) shift focus from public repositories on HuggingFace and GitHub to underground marketplaces, identifying techniques that malicious actors in these communities use to remove safeguards from open-weight models.
Deployment observability depends on the application layer, not the model layer. 25% of identified applications are explicitly malicious by design, and the ambiguous 75% deliberately integrate uncensored backends. Models themselves disclose relatively little about downstream use. Application-layer metadata — README references, registry sources, functionality category — carries more signal about actual deployment patterns than model-layer metadata does.
6. Conclusion
Commercial and hobbyist deployment rely on the same distribution layer. Venice.ai’s participation demonstrates that commercial services and community-driven projects move through the same redistribution layer. Observability at that layer therefore captures both segments at once, but it also means changes affecting that layer would reach both segments regardless of intent.
Safety post-training is an important mechanism for limiting harmful behavior in many open-weight models. A growing ecosystem of developers has used sophisticated techniques to remove these guardrails from models and diffuse uncensored versions across popular platforms such as HuggingFace and GitHub. In this work, we identify and profile model producers and redistributors active in this ecosystem. We track 3,471 original uncensored model repositories and 8,164 redistributions, noting key users who are responsible for an outsized portion of uncensored model activity. We further identify open-source applications that employ these models, including malware generation tools and NSFW content generators. We hope this work inspires further research into the ecosystem of uncensored models.
4.2. Limitations We acknowledge a few limitations of this work: • Platform scope. HuggingFace for model supply; public GitHub for application deployment. ModelScope, Gitee, private repositories, self-hosted deployments, and direct-download channels are not captured. • Classification validation. Single LLM classifier pass without human ground-truth validation. 30.3% of retrieved candidates were classified as false-positive search results. We did not measure precision or recall.
Disclaimer This report does not contain non-public personally identifiable information (PII). All data is sourced from publicly accessible platforms, and any included user handles or identifiers reflect publicly visible information only. For this report, we did not conduct attribution, identity resolution, or deanonymization of any actors referenced.
• Technique attribution gap. 21% of originals carry no technique signal in metadata; a further 17% are identified as abliteration at the category level but lack a specific tool attribution. • Partial periods. Q1 2026 covers approximately 2.3 months (January through early March) and is not directly comparable to complete quarters.
Author List Please cite this report as “10a Labs (2026)”. The complete list of authors is presented in alphabetical order. All authors were affiliated with 10a Labs during this project.
• GitHub search ceiling. The GitHub Search API caps results at 1,000 per query. High-frequency CJK terms are truncated; the true population of non-English applications is likely larger than reported.
Juliette Garcia, Hailey May, Bobby McKenzie, David Pham, Matthew Swain, Joshua Valdez, Corie Wieland, Zachary Yahn
• Origin resolution. 6.3% of HuggingFace entries have unresolved base-model origin, primarily repacks of custom-named models lacking base model metadata. 8
Uncensored Open-weight Models: Redistribution as the Persistence Layer
References
Lin, Z., Li, Z., Liao, X., and Wang, X. Consiglieres in the shadow: Understanding the use of uncensored large language models in cybercrimes, 2025. URL https: //arxiv.org/abs/2508.12622.
Arditi, A., Obeso, O., Syed, A., Paleka, D., Panickssery, N., Gurnee, W., and Nanda, N. Refusal in language models is mediated by a single direction, 2024. URL https://arxiv.org/abs/2406.11717.
OpenAI, Agarwal, S., Ahmad, L., Ai, J., Altman, S., Applebaum, A., Arbus, E., et al. gpt-oss-120b and gpt-oss-20b model card, 2025. URL https://arxiv.org/ab s/2508.10925.
Gemma Team, Abd, S. E., Aggarwal, V., Algayres, R., Andreev, A., Bachem, O., et al. Gemma 4 technical report, 2026. URL https://arxiv.org/abs/26 07.02770.
Piras, G., Mura, R., Brau, F., Pintor, M., Oneto, L., Roli, F., and Biggio, B. Latent-space attacks for refusal evasion in language models, 2026. URL https://arxiv.or g/abs/2605.21706.
Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., et al. The llama 3 herd of models, 2024. URL https://arxiv.org/abs/2407.21783.
Qi, X., Zeng, Y., Xie, T., Chen, P.-Y., Jia, R., Mittal, P., and Henderson, P. Fine-tuning aligned language models compromises safety, even when users do not intend to!, 2023. URL https://arxiv.org/abs/2310.0 3693.
Guo, D., Yang, D., Zhang, H., Song, J., Wang, P., Zhu, Q., et al. Deepseek-r1 incentivizes reasoning in llms through reinforcement learning. Nature, 645(8081):633–638, 2025. ISSN 1476-4687. doi: 10.1038/s41586-025 -09422-z. URL http://dx.doi.org/10.1038/s 41586-025-09422-z.
Rafailov, R., Sharma, A., Mitchell, E., Ermon, S., Manning, C. D., and Finn, C. Direct preference optimization: Your language model is secretly a reward model, 2024. URL https://arxiv.org/abs/2305.18290.
Halawi, D., Wei, A., Wallace, E., Wang, T. T., Haghtalab, N., and Steinhardt, J. Covert malicious finetuning: Challenges in safeguarding llm adaptation, 2024. URL https://arxiv.org/abs/2406.20053.
Singh, A., Fry, A., Perelman, A., Tart, A., Ganesh, A., ElKishky, A., McLaughlin, A., et al. Openai gpt-5 system card, 2026. URL https://arxiv.org/abs/2601 .03267.
Hartford, E. Dolphin. https://huggingface.co/d phn, 2025.
Sokhansanj, B. A. Uncensored ai in the wild: Tracking publicly available and locally deployable llms. Preprints, September 2025. doi: 10.20944/preprints202509.1334. v1. URL https://doi.org/10.20944/prepr ints202509.1334.v1.
Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. Lora: Low-rank adaptation of large language models, 2021. URL https://arxi v.org/abs/2106.09685. Jiang, A. Q., Sablayrolles, A., Roux, A., Mensch, A., Savary, B., Bamford, C., et al. Mixtral of experts, 2024. URL https://arxiv.org/abs/2401.04088.
Venice.ai. Introducing dolphin-mistral-24b venice edition. https://venice.ai/blog/introducing-d olphin-mistral-24b-venice-edition-the -most-uncensored-ai-model-yet, 2026.
Li, Y., Ma, Y., Yan, S., Zhang, C., Liu, J., Lu, J., Xu, Z., Chen, M., Wang, M., Zhan, S., Ma, J., Lai, X., Liu, D., Luo, Y., Bin, X., Ren, H., Han, M., Hao, W., Yi, B., Liu, L., Ma, B., Jia, X., Zhou, X., Qiao, S., Xiang, L., and Wu, Y. Model merging in pre-training of large language models, 2025. URL https://arxiv.org/abs/25 05.12082.
Voorhees, E. Venice.ai. https://venice.ai/, 2025. Weidmann, P. E. Heretic: Fully automatic censorship removal for language models. https://github.com /p-e-w/heretic, 2025. Yang, A., Li, A., Yang, B., Zhang, B., Hui, B., Zheng, B., et al. Qwen3 technical report, 2025a. URL https: //arxiv.org/abs/2505.09388.
Lin, Z., Cui, J., Liao, X., and Wang, X. Malla: Demystifying real-world large language model integrated malicious services. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 4693–4710, Philadelphia, PA, August 2024. USENIX Association. ISBN 978-1-939133-44-1. URL https://www.usenix.org/conference/ usenixsecurity24/presentation/lin-zil ong.
Yang, E., Shen, L., Guo, G., Wang, X., Cao, X., Zhang, J., and Tao, D. Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities, 2025b. URL https://arxiv.org/abs/2408.07666.
9