Uncensored Open-weight Models: Redistribution as the Persistence Layer

A distributed two-tier ecosystem of producers and redistributors makes safety-stripped open-weight models durably available regardless of upstream takedowns: 3,471 original uncensored models on HuggingFace were repackaged an average of 2.4 times into 8,164 mirrored copies, and 1,643 GitHub applications now integrate them, 25% explicitly malicious.

Keyword and crawler-based scraping of HuggingFace (17,727 candidate repositories classified by a GPT-5-based classifier into 12,360 uncensored-related repositories) and GitHub (44,705 candidates filtered to 1,643 applications) from January 2024 to March 2026, mapping producer, redistributor, and application tiers, plus three case studies (Venice.ai, CyberAlbSecOP, NSFW Telegram bots).

Each original uncensored model averages 2.4 redistributions; three redistributors (mradermacher, Triangle104, RichardErkhov) account for 52% of 8,164 compressed copies; huihui-ai's 192 originals generated ~1,800 repacks (about 14% of the dataset); GitHub application creation rose from ~30/month in mid-2024 to 140-188/month by late 2025; Heretic automation lifted original production from ~89/month to ~338/month; Chinese-origin models went from 1% (Q1 2024) to 55% (Q2 2025) of new production, 38% cumulative, driven by Qwen (80% of Chinese-origin entries); the Dolphin family powers 30% of applications; Ollama is referenced in 43% of application READMEs vs 14% for direct HuggingFace downloads. Findings are specific to HuggingFace/GitHub scraping and may not generalize to closed channels.

The authors concede counts are HuggingFace repositories rather than unique weight sets, classification relied on an LLM classifier with possible false positives, origin was unknown for 4% of entries and 777 repositories were excluded for unknown origin, and keyword-based discovery misses content not matching the 55-term list. Unstated issues: no ground-truth validation of classifier accuracy, no download/usage metrics proving actual deployment at scale, 25% malicious labeling criteria are opaque, and Telegram/secondary channels are only lightly sampled, likely understating the ecosystem.

The whole structure rests on a single LLM classifier over keyword-scraped repositories with no published validation set, no inter-rater check, and no measure of real usage; repo counts can inflate scale (one model mirrored many ways is counted repeatedly); 'malicious' classification of 411 apps is judgment-laden; and the paper is a mapping exercise by a lab, not a causal analysis, so 'persistence' claims could partly be a re-description of ordinary open-weight quantization culture applied to uncensored models.

Little direct economic signal: this is a safety and ecosystem-mapping result, not a revenue, cost, or labor measurement. Its modest economic relevance is that uncensored open-weight supply persists independently of labs' safety choices, which could raise enterprise and regulatory due-diligence costs around open-weight provenance over the next 12 to 24 months, but the paper offers no numbers on that.

Regulatory & Legal: Enforcement that targets single upstream repos fails because a concentrated redistribution tier (three actors, 52% of copies) preserves model availability, so takedown policy needs a distribution-layer strategy.

Technical Capability: Heretic-style automation cut uncensoring to a one-command workflow and tripled monthly production, showing that weight-level safety removal is now trivially easy for open models.

Societal & Cultural: A quarter of identified applications are explicitly malicious (411 of 1,643), meaning guardrail-stripped models are already wired into chatbots, Telegram bots, and offensive tooling reachable by non-technical users.

Geopolitics & Security: Chinese-origin foundation models, mainly Qwen, went from 1% to roughly parity in new uncensored production, meaning the supply pool for guardrail-stripped models is no longer predominantly Western.