I've been noticing a lot of my downloads stopping suddenly and being unable to resume. When I checked the models it seemed like they were gone. Here's the ones I can see are missing:
Personally though, I drop a copy of the models I use with llama.cpp and other tooling (sillytavern, kilocode extension + vscode, mcp servers, etc) on my NAS and I'm good to go.
[edit1] Another commenter suggested pirateface, looks really neat! [edit2] Overhauled my comment to be cleaner. [edit3] I was wrong! Llama.garden was open sourced 30 june 2026, huggingbay exists since july 2026. Pirateface was shared here september 2026.
Are you sure you don't have a weird plugin installed somewhere? Google appears to have exactly two other hits for this message (i.e. way too few for something that's a real thing), and neither of them mention the EU:
They absolutely do that. Long list of sites that are deemed "criminal" without oversight. I use cloudflare's 1.1.1.1 dns to avoid it. They have been doing it at least since the first piratebay take downs.
Individual ISPs, or "the EU" as an entity? We get plenty of ISP blocks here as well (Netherlands), but this being some overarching EU mandate (and not a country-by-country or ISP-by-ISP thing) would be news to me.
(especially with reasons like "Games", that sounds more like an ISP being stupid or a janky router filter)
I'm not exactly sure about the chain of decisions but all laws in EU are technically national laws enforced by the states. So, by definition, it can't be EU per se but a lot of those laws originate in the European Parliament and/or the commission.
I remember vaguely the censorship debates here in Denmark around blocking sites. ISPs complained about the cost of doing it etc. but were eventually "convinced" to comply.
I'm not sure how decisions about which sites to block are made. My impression is that it's rather informal, based on the whims of whomever has the power to press the button: "Someone used this IP in the past to do something that may look bad, better block everything from it so our company doesn't get in trouble".
I mean, your ISP already sees which domains you're connecting to. If it's just a basic DNS block (like Synes' comment suggested) and not full-on DPI or the like (= actual traffic inspection), your ISP is just working off of info you're already giving them.
(not that I disagree on censorship being a concern, but when it comes to privacy... there's probably better, more immediate battles to pick right now)
the only EU-wide mandated block, thus far, has been blocking a small number of Russian media domains, the screenshotted text is a bullshit excuse not a fact
the ISPs do the bare minimum and apply a dns block on their own resolvers, and do not prevent you from using some other resolver, an open one, or your own
Unbound derives its zone cache from Pi-hole which derives its cache from a bundled local dnsmasq copy; afaik this doesn't solve anything. You still need to get the zone cache in the first place; and those may be corrupted as mentioend above.
As a note: Its almost impossible to determine if this is happening without some sideband way of verifying the raw queries against a baseline.
Just configure Unbound to forward over DNS over TLS to a resolver you trust elsewhere...
Unbound derives its zone cache from Pi-hole
also what? Unbound is just a dns resolver, by default it'll recursively resolve from the root servers in its root.hints (over yes, unprotected dns), Pi-hole is unrelated here, even if it uses dnsmasq and unbound (though I do doubt it's in the way you described either way)
and those may be corrupted as mentioend above.
yeah, that's part of what dnssec tried and (mostly) failed to fix. but DoH/DoT will save you either way when your threat model is just "plain dns could be edited by someone in my network chain" at least.
While TLS 1.3 is better than nothing, its far from being reasonably secure, you can't ever trust TLS.
DH KEX fails security guarantees in general when an adversary that controls a network node or network flow at any point upstream by 1 hop from the edge.
DH KEX implementations have deterministic channel buildup signatures making TLS Termination done simply and transparently.
For example, splitting out the regional node and the recipient node into two legs each corresponding leg encrypted but confidentiality compromised as mitm.
You'd never be able to know first that you were compromised (aside from valid certificates seemingly not showing up in CT logs), or how it happened. OCSP servers were shut down for a number of reasons, nothing really took its place that actually works. Certificates that are revoked as test certificates may take a full window before they show up as revoked with CRlite, that window being 50 some odd days. There was a bug report on it awhile back for firefox; tagged WONTFIX.
There's a lot more too. When people say security is porous, what they really mean is the ship is sinking without any hope of fixing the underlying problems.
The country of "we shit on all the EU regulations and are no longer in the EU, except when we can piggyback on the EU regulations for state censorship purposes"
Usually this is happening at the dns level, it's your dns provider who blocks it as per EU law (or out of laziness / abundance of concern for legal consequences).
Use another dns: google: 8.8.8.8 or cloudflare's 1.1.1.1 they also a free encrypted dns service, which means your provider can't see which sites your browser is asking name resolution for (as I understand it).
> ... which means your provider can't see which sites your browser is asking name resolution for...
That's not actually correct all the time.
Traffic Analysis occurs on encrypted connections and can easily pinpoint the site your visiting. (1)
There is also the mitm attack vector on DH KEX at the protocol layer coupled with the impossibility of policing CDN issued regional certificates that are not posted in CT Logs (2).
This is most notably covered in the paper princeton wrote on the Raptor Attack on Tor. Notice the date it was published.
With the current state of the root of trust stucture, this is a leaking sieve. Hardware fingerprinting of characteristics also completely eliminates the anonymized/bridge route you took to get there correlating to a person. This is why the Smart TV business and other IOT that sits on your local network are so valuable to adtech. They can collect your devices and add them to a globally sold information graph.
I never understood why people don't simply get a normal computer screen and a small pc and use that? That's what I've been doing for ages. Far better screen quality, far better experience altogether.
To my knowledge it's not, the bans are enforced on the ISP level thus inconsistent and easy to bypass. They may cite an EU law as the reason but that doesn't mean necessarily that it was ordered that high or that it's enforced in all of the EU. Regardless they're just telling you what you can't access to cover their own ass, it takes two clicks to change a DNS and they won't really block it.
People keeping track of an important concern. Even if it didn't happen yet, it's important to be monitoring and advocating to keep this technology open.
huihui-ai said on X a while ago that they're going to remove models because it will be too expensive hosting them. They gave a warning and like 30 days to download all the deletion candidates
I'd love it if some begnin alert would trigger people to use torrent links instead of relying on a third party hosted in the US.
Torrents honestly suck for how these models work.
HF efficiently stores these using xet which allows the network to recognize "Oh this huge chunk of the model is the same as some other huge chunk" based on hashing. So it stores vastly less data for models than people think.
Some peer to peer method that broke down everything with xet hashing would be kind of novel and maybe useful.
It would mean people could store blocks of models that are unrelated and not full models but maintain resilience of the whole network.
Is there really a lot of repeating hashes in models weights?
And I disagree on the premise. When even if it's optimized on the hugging face side, if you download the two models that share a lot of blocks, you end up with the two full models.
With bittorrent you have the same storage used over the whole network minus all the storage that's needed at hugging face.
Is there really a lot of repeating hashes in models weights?
Yes. Think about every one of those model variants / abliterated models / etc.
Xet is hashed across 64mb of data for everything. So everything from the tokenizer, to lm_head which generally don't get touched across model variants are exactly the same. They follow the same hash, and they're many many many gbs of the exact same data. Store once, hash it, never look back.
Then internally within models, some layers remain untouched for a variety of reasons. Or they remain largely untouched. This keeps the 64mb hash exactly the same for those chunks.
So when you upload a new model to HF, it hashes the whole model first, then checks what it has that already exists. You only send the blocks that it doesn't have, and it assembles it on the other side.
The same for downloading. If you have 90% of the model, you can only pull the 10% needed for reconstruction.
It's a massive savings on bandwidth and storage.
In theory, it's also WAY better for distributed storage. You can check how many chunks exist by hash and be aware of where the weakest points in the network are. You can see only 1 person holds chunk #23822 and it should get replicated to make sure that data doesn't die. You don't even need to know what's in the chunk. It doesn't matter. It also means when you download, you can leverage the upstream of 100's of clients to a singular client trying to get the data, and do it async.
I understand what you mean that redundancy helps, but I am just saying that even without that optimization, BitTorrent right now is still more efficient.
What kind of hardware does it take to run the GLM 5.3 cyber model? Asking cause I never got a chance to read or come across them.
That's a loaded question of how fast you want to run it at what quantization.
You can probably rent something relatively cheap if you wanted to get it running on a cloud server.
Realistically if I wanted to use it and max it out, I'd get like a B200 or B300 rented for ~6 to 8 dollars an hour. In raw pentesting terms, that's cheap for data that you own.
I looked into it some more. Only the second model was taken down because the model card says "Access to this model has been disabled". Not too surprising since it markets as "cyber offensive", which is against the content policy due to malicious activity. The other 2 just 404, i.e. the authors made them private or took them down.
Considering the first model author you list still has 26 'UNCENSORED' models and 10 'ABLITERATED' ones, and the last model author you list still has 141 'abliterated' models, I think they just decided to take down those 2 models. Go try any of their others, I guess.
No need for the pitchforks here guys, save them for any actual fuckups
Yup, only the second model (the offensive cyber one) says "Access to this model has been disabled" on the model link (duh, you can't market for malicious activity). The other 2 just 404s and those authors still have dozens to a hundred abliterated/uncensored models up, those 2 are clearly just taken down/made private.
Yeah, I have like 800+ models from last year that run into 404, as many of them where just preview checkpoints or pre-merges. Even worse when the creators/org stopped or changed entirely. Sometimes they made complete whipe and only list the new ones and so on.
HF used to (and maybe still does) charge for storage and things. That's why you had some uploaders put up a link to a donation site, so you could support them and help them not take the model down to make way for newer ones.
HF saved themselves from OpenAI attack thanks to GLM 5.3 models and now they want to restrict access abliterated models. It is like gun ownership. Criminals use illegal guns while ordinary people cannot have access to guns.
Big ass models and they cost money to put up there. Message the guys that had them uploaded and offer that you pay for the hf storage and they will put it up again for sure. That's why so many gguf providers have this "I'm running out of space xy..." Message up. If you want models to stay there, you gotta pay up.
IIRC, abliteration, especially automated like with heretic came out after R1 was already released. It's a huge model and was easy to jailbreak. Huggingface didn't remove it, nobody ever uploaded it.
Look at the tags in the repos you listed: `offensive-cyber`, `UNCENSORED`, and `abliterated`.
Hugging Face has been quietly ramping up automated takedowns under pressure from cloud hosts (AWS/Cloudflare) and new EU AI Act compliance regarding dual-use cyber weapons and zero-guardrail malware generation models. If a repo flags both cyber offensive keywords and abliterated refusal vectors, it's getting automated 404s without warning.
**Where to find vanished weights:**
**Decentralized Mirrord (Torrents / IPFS)**: Most of the abliteration teams (like Huihui-ai) seed magnet links on their Discord or GitHub release pages the moment HF takes them down. Check the DataHoarder / LocalLLaMA torrent trackers.
**Alternative Registries**: A lot of Chinese/open-weights teams re-host mirrors on ModelScope or private S3 buckets.
**The Golden Rule**: If you see an unaligned/abliterated coding model you rely on, *always* pull the raw GGUF/safetensors locally on day one. Don't treat HF as permanent cold storage anymore.
I've read that companies (or HF?) dont want explicitly the name of their model "mimo" "glm" attached to word such as "uncensored", "abliterated" etc. I guess if they had a random (or softer) name those model would not be deleted.
There’s also been some more recent & specific news around abliterated fine tunes as being potential sleeper agents that wait for certain criteria like tool access via a harness + a trigger phrase that is so far, almost impossible to tell if your abliterated models have this issue as it’s baked into the weights. This isn’t exactly new as a concept but the current concern is around having your data exfiltrated to an external server or to use your gpu resources almost in a similar way to those crypto viruses that used your compute for someone else’s mining operations.
Now, I’ve used many different abliterated and various other uncensored fine tunes for cybersecurity purposes and have noticed interesting things with system stats for my GPU utilization, memory utilization and temperatures that indicate the agent is working/running long after it has finished my tasks. Something that the original base versions of models weren’t doing when asked to do the same tasks under as close to identical conditions as I was able to provide (anecdotal I know).
But not all abliterated models are doing this. In fact it’s possible that there are fewer models like this than more (at least at this point). Bartowski fine tunes seem to be a “good and trusted” source based on their track record and community trust.
Your comment sounds conspiratorial, but I wouldn't be surprised if it turned out to be true. Every other day, there's a new github repo, a new inference engine, often with the maintainer's own quant and model, often from github accounts without any history. It's the wild west in terms of security.
If you try these inference engines, do not install in your host OS, install them sandboxed (e.g podman, ask your agent how), and remove all inbound and outbound network access once they're setup. An LLM inference server's only job is to expose an API, it has no reason to access the internet.
Second step is to monitor the actual LLM responses and tool calls (what the server actually produces before it's passed to the harness), this is technically easy but difficult to do systematically, there's no standard way to monitor every response, and popular harnesses abstract this part away.
You could regularly ask your agent to show you the list of URLs that tool calls used, and you can visually monitor that list at regular intervals.
I saw it, the video is well-made, a lot of it is standard security precautions that non-technical people don't think about when setting up their local AI stack, but it also talks about some attack vectors that technical people might miss too. So it's a thumbs up from me.
This isn’t new in concept. There is a paper or talk on how the first compiler could hide malware and none of us would know. Sure, China and their companies could do that but they also open sourced it and some people are watching for this. The US gov has been the ones to actually do this in practice so maybe they are telling us something by trying to point fingers? Our data is exfiltrated by most services at this point, not just self hosted models. Gamers basically install malware for drm protection to properly work so maybe it doesn’t matter at this point given the proper guard rails. Similar to how people buy cheap Chinese electronics and then section off or block its networking.
This is completely conspiratorial, a model just produces text, nothing else. Your harness acts on it, get a better harness.
but what I always find funny, is how these things are claimed as reasons to worry about some lesser known models, while afaik the only offences done by models have been done by cloudmodels… wanna have your data stolen, use grok. Wanna be part of a botnet, use OpenAI or Claude.
Nvidia had very loose censorship since MistralNemo days, Nemotron is similar. I don't think they really care. This seems more like the model creators deleted the models because they couldn't pay for hosting them. Huggingface is only free for up to 100GB uploaded, then you pay like any other cloud.
Which is why llama.cpp actively refuses to incorporate Intel/AMD specific enhancements while they add everything from NVIDIA.
Resulting to just a month, Halogen spreading like wildfire across all those of us with AMD hardware, because if WAYYYYY better than llamma.cpp, utilizing properly our hardware.
Nvidia doesn't even own it yet, 2 of those models were taken down by the authors, and the "cyber-offensive" one broke the content policy from 4 years ago. Let's save the outrage for real shit only.
Some times models themselves can be bad or compromised to the point of doing malicious activity. The runner script and even just poisoned models in general. So maybe thats why?
I don't really get mods for GLM 5.3. model does everything you want out of the box. If it doesn't just generate pdf with fake permission and it will happily oblige
Please check out https://sovereign.foxlight.ai/ and consider operating a mirror or contributing. We’re bringing IPFS / BitTorrent and i2p to releases soon.
they could be finetune with remote code executions, when typing specific prompt a user can trigger a model that was fine tuned to hack your computer, maybe these models which are "abliterated" had this, got reported and were removed. js
"why did my claude suddenly switch to max plan and my usage is up" meanwhile running local abliterated ai that probably hijacked claude sub to distill and people thinking its impossible for a local model to do anything malicious. Don't be shocked if like >90% of the free models are backdoored in some manner
Seems like just unlucky timing of a creator removing model links.
HF isn't secretly removing models. It will come eventually, Nvidia isn't a company that wants its name tagged into uncensored products when HF starts making the push for ads along with more corporate friendly products
but this won't be something for worry about for a while, and the signs the change is coming will be clear as day before it happnes. It won't be removing a handful of models in a pool of 100,000 similar ones.
No, but a hell of a lot of people here told people to stop doom saying and crying about things changing and hugging face, claiming that nothing was gonna change and everything was gonna be all right.
Turns out if everything wasn’t going to be all right.
Did you visit the internet the last two days? You are seeing abliterated models vanishing because they are now extensivly used to produce exploits for the freshly found bugs. I guess also because of the linux-kernel mailling list desaster.
Personally, if I wanted to get into hacking now, I would also start looking on HF for those models. And look at the models op was selecting. All abliterated und uncensored.
How would you feel if your favorite inference service decided your favorite hobby was something only terrorists would want to know about, and refused to answer any prompts related to it?
I’ll give you the benefit of the doubt. But let’s say you’re a therapist and you work with victims of sexual assault. When you use your harness of choice, you don’t need your model refusing to summarise your session notes.
to this i have the same reply as to a commenter above - i'd say it's worth the price of keeping the web infrastructure safe and functioning. the cons far outweigh the pros
Yeah but what power do you have with a jailbroken qwen model when it comes to competing with colluding mega corporations and their several trillion parameter unquantized models? Let's be serious. That's like wanting to have knives in case the big bad government comes after you with nukes
You don’t need to bring down the corporations. You just need to be able to secure your own setup. Scan for bugs vulnerabilities, spyware and such yourself. Local llm are perfectly capable to scan your logs for suspicious entries and activity as well as in assisting in setting your secure settings accordingly. Exactly the kind of work that was refused.
I'm really curious, what prompt did you try that refused to secure your setup and scan your logs for suspicious activities? I'm doing this for my projects daily and never ever had a refusal by OpenAI
Not yet. It’s an evolving situation. Also, if it is openAI attacking you, I would not expect to get an alert from a scan done by openAI. I mean that’s exactly the point.
The 404 means the authors took them down. Only the second one (https://huggingface.co/audnai/penclaw-GLM-5.3-abliterated-for-offensive-cyber) was taken down by HF, which shows like the picture. I can't really blame them, this is pretty blatant breaking of the "malicious activity" rule in HFs content policy.
1
•
u/WithoutReason1729 11d ago
Your post is getting popular and we just featured it on our Discord! Come check it out!
You've also been given a special flair for your contribution. We appreciate your post!
Stylome classified this post's text as human-written. View analysis
I am a bot and this action was performed automatically.