3,471 uncensored open-weight models on HuggingFace, repackaged 2.4 times each.

Between January 2024 and March 2026, researchers identified 3,471 original guardrail-stripped models, each repackaged an average of 2.4 times, with three actors accounting for 52% of all 8,164 compressed redistributions (arXiv 2609.05241). Once quantized and mirrored across separate accounts, formats and registries including Ollama, the models persist regardless of upstream removal. Of 1,643 GitHub applications integrating uncensored LLMs, 25% were classified as explicitly malicious. Takedown as a control strategy is measurably not working here.