Redistribution makes uncensored models persist after upstream removal
Removing safety guardrails from open-weight models creates a takedown problem: the paper found 3,471 uncensored models on HuggingFace, repackaged 2.4 times on average between January 2024 and March 2026. Quantization, mirroring, and registries such as Ollama spread copies across accounts and formats, so upstream removal cannot reliably erase them. The risk is concrete: 25% of 1,643 GitHub applications using these models were classified as explicitly malicious.