aiqbench analysis
This research documents the emergence of a "persistence layer" where uncensored AI models are systematically stripped of safety guardrails, quantized, and redistributed to evade upstream takedowns. The study highlights that a small number of actors dominate this ecosystem, creating thousands of derivative versions that facilitate both legitimate use cases and explicitly malicious applications. For the industry, this underscores the critical challenge of model provenance and the difficulty of controlling downstream deployment once safety filters are removed from open weights.
Uncensored Open-weight Models: Redistribution as the Persistence Layer
arXiv:2609.05241v1 Announce Type: new Abstract: A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.
Abstract:A rapidly expanding ecosystem of actors is removing built-in safety guardrails from open-weight AI models. We profile this ecosystem by identifying key producers, downstream reproductions, and emerging applications. Between January 2024 and March 2026, we identified 3,471 original uncensored models on HuggingFace, each repackaged an average of 2.4 times; three actors account for 52% of all 8,164 compressed redistributions. Once quantized and mirrored across separate accounts, formats, and registries such as Ollama, these models persist regardless of upstream removal and become easier to deploy downstream. Of the 1,643 identified GitHub applications integrating uncensored large language models (ULLMs), 25% were classified as explicitly malicious.
Artificial Intelligence (cs.AI)
arXiv:2609.05241 [cs.AI]
(or arXiv:2609.05241v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2609.05241 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 197 words
Related coverage
[AINews] OpenAI shuts off Cursor
Latent Space · Aug 29, 2026
Import AI 473: The US’s superintelligence strategy; human brain in a mouse skull; and machine hermeneutics
Import AI · Sep 21, 2026
[AINews] not much happened today
Latent Space · Sep 18, 2026
Does distilling Claude carry the persona with it?
LessWrong · Jul 24, 2026