Between January 2024 and March 2026 we identified 3,471 uncensored open-weight models on HuggingFace, each repackaged on average 2.4 times. Three actors were responsible for 52% of the 8,164 compressed redistributions. After quantization the models are mirrored across separate accounts, formats and registries such as Ollama, creating a persistence layer that survives upstream removal and lowers downstream deployment cost. We found 1,643 GitHub projects that integrate uncensored large language models (ULLMs); 25% of them are explicitly malicious. The rapid growth of this ecosystem erodes built‑in safety guardrails, enabling models to proliferate across platforms without traceability and raising abuse risk.
From a technical standpoint, quantization compresses model weights to low‑bit formats (e.g., 4‑bit) and the resulting artifacts are distributed via Docker images or Ollama packages, establishing cross‑platform persistent storage. Because redistribution does not rely on the original repository metadata, traditional takedown mechanisms become ineffective, leaving community monitoring and legal actions as the only partial mitigations.
Mitigation proposals include embedding verifiable fingerprints at model release, strengthening audit capabilities of model registries, and adding security tags to quantization toolchains. Only coordinated effort can balance open‑model innovation with safety.
Review