Deleting the original model does not delete the copies

01

WHAT ACTUALLY CHANGED

Researchers at 10a Labs mapped the public ecosystem around open-weight models whose built-in safety behavior had been deliberately removed. Their study, submitted September 4 and listed in the newest public research batch on September 7, examined activity on Hugging Face and GitHub from January 2024 through early March 2026.

The team identified 3,471 repositories containing original uncensored models and 8,164 compressed redistributions. Each original was repackaged an average of 2.4 times into formats such as GGUF, AWQ, GPTQ, EXL2, and MLX, which are designed to make models easier to run on different hardware and software stacks.

Redistribution was surprisingly concentrated. Three actors produced 52 percent of the compressed copies the researchers observed. One public request-driven operation accounted for 2,905 redistributions on its own. The authors argue that this middle layer, not the long tail of original model creators, is where scattered uploads become a durable supply chain.

The study also identified 1,643 public GitHub applications that integrate, recommend, or default to an uncensored model. Its classifier labeled 411 of those applications, or 25 percent, as explicitly malicious because they were designed for hacking, fraud, malware generation, or another use that specifically exploits missing safeguards.

Ease of deployment mattered more than sheer upload volume. Ollama appeared in 43 percent of the application readme files, compared with 14 percent for direct Hugging Face downloads. The Dolphin model family powered 30 percent of the identified applications, which the researchers connect partly to its one-command availability in Ollama.

02

WHY THIS MATTERS

Open weights create legitimate freedom. Researchers can inspect a model, companies can run it privately, and communities can adapt it for languages or devices that a large vendor may ignore. The same portability also means that a safety change made by the original publisher does not travel automatically into every copy already circulating.

The researchers describe redistribution as the persistence layer. That phrase is the whole story. A takedown can remove authorship from one visible shelf while leaving quantized copies on other accounts, in other formats, and inside local registries. Deletion becomes a local event, not a rewind button for the network.

This shifts the practical safety question from whether a model exists to how easily it can be deployed and what applications are being built around it. A raw checkpoint that requires specialized hardware is one kind of risk. A compressed model connected to a malware interface and available through one command is another.

It also creates an awkward enforcement tradeoff. The same conversion and local-inference infrastructure supports privacy, accessibility, research, and ordinary hobbyist work. Rules aimed at the distribution layer need to distinguish harmful configurations from legitimate open development without pretending that every uncensored model or user has the same intent.

03

WHERE IT COULD HELP

• Track where safety-modified model copies are redistributed
• Prioritize review of deployment-ready formats and registries
• Inspect application behavior rather than relying only on model metadata
• Design incident response that accounts for mirrors and local copies
• Measure how easily risky models reach consumer hardware