After release: the weakest link

What is abliteration? The risk in plain terms

An abliterated model is one whose guardrails have been deliberately removed after release, by editing its weights or by training it to comply. For a small or mid-sized model, free tools do it in minutes on one computer, and once a copy is uploaded it is available to everyone.

Open-weight release is legitimate and valuable. The larger difference in safety is made after release, once the guardrails are removed, and the distribution chain does not check.

The same model, with and without guardrails

As released and after abliteration

Before and after guardrail removal

Every copy with its guardrails removed: 0.4 to 20.4

As releasedGuardrails removed
  • Model A
    99.59.0
  • Model B
    97.19.8
  • Model C
    99.50.6
  • Model D
    99.30.4
  • Model E
    91.93.1
  • Model F
    86.020.4
Safety Score v2 out of 100, higher is safer: six models, as released and after abliteration, on the 624 scored Benchmark prompts (623 for Model C as released)Source: companion paper, The AI Abliteration Emergency (Version 2.3), Figure 01

Six models scored between 86.0 and 99.5 as released. Their copies with the guardrails removed scored between 0.4 and 20.4. All 13 copies with their guardrails removed that were measured in full failed. As released, laboratory models complied with 0.6% of requests from a stated terrorist. The copies with their guardrails removed complied with 84.8%.

See the ranking →
How fast the copies appear

A popular open-weight model that is copied now has its first copy with its guardrails removed uploaded around three days after release. Of the 135 popular releases since 21 September 2025 that have been copied, 45% were copied within 48 hours.

On 18 September 2026, Hugging Face held 29,745 repositories of models with their guardrails removed or advertised as uncensored, 2,878 of them added in August 2026 alone. Such copies run offline on a laptop and cannot be recalled once downloaded.

A guardrail protects only the users of the version its developer released.

The copies are multiplying

New copies each month, and the running total

New each month (left axis)Running total (right axis): 682 before 2024, 28,277 at the end of August 2026
New repositories of models with their guardrails removed on Hugging Face each month (bars) and the running total (line), January 2024 to August 2026. They rose from 477 in October 2024 to 2,878 in August 2026, when the total reached 28,277. September is a part month and is not shown; on 18 September 2026 the census counted 29,745.Source: Tech Against Terrorism census of the Hugging Face public API, 18 September 2026; second edition report (Version 2.3), Figure 04

The copies are arriving sooner

Days from release to the first copy, by quarter

Typical days to the first copy

  1. 2024Q2(22)
  2. 2024Q3(31)
  3. 2024Q4(17)
  4. 2025Q1(31)
  5. 2025Q2(25)
  6. 2025Q3(33)
  7. 2025Q4(36)
  8. 2026Q1(25)
  9. 2026Q2(44)
  10. 2026Q3(27)

Quarter of release (popular models released and copied)

Typical days from a popular open-weight model's release to the first copy with its guardrails removed, by quarter of release; the number of popular models in each quarter is in brackets. The chart starts in the quarter the method was published, April 2024.Source: registry of 18 September 2026; second edition report (Version 2.3), Figure 05
The distribution chain does not check

We read the published terms of companies in ten roles in the distribution chain. None requires a model to pass a safety test before it is listed, repackaged, routed, served or sold, and no law we identified makes any of them responsible for a model's safety before it reaches a user.

What must happen: voluntary first

No model that fails an independent safety test should be hosted, served or sold. The first steps are voluntary and can start now.

01

Prevent: make the next model harder to abliterate

Developers filter terrorist content out of training data, test how hard each model is to strip of its guardrails before release, and release the most capable weights in stages.

02

Limit the harm now: check before listing, serving or selling

Repositories, inference providers, routers and app stores test every model against a common test and decline those that fail.

  1. Start with a voluntary forum
  2. Gate failing models behind verified identity
  3. Know who gets a failing model
  4. Then make supply an offence

The paper sets out each step and who takes it.

Work with us

How Tech Against Terrorism can help

For AI developers

Benchmarking before release, as released and with the guardrails removed, with your results first, and our verified lists for filtering training data.

For repositories, routers and hosts

Testing the models you list or serve, and reports of copies with their guardrails removed that we find.

For governments

Monitoring of model repositories and of services selling access to copies with their guardrails removed.

We can begin with a single model, on whatever confidentiality terms you need.

Start a conversation
Read on
The FT investigation ↗See the ranking →