Source: Unite.AI
If you’re old enough to remember the warez scene of roughly 1995–2010, when vast collections of cracked software and ripped movies (bought wholesale off the street, or assembled by casual pirates once high-speed broadband made huge and high-volume downloads feasible) accumulated across multiple, groaning DVD collections, the emerging scene for ‘decensored’ open-source AI models may strike some familiar notes.
From the ‘golden age’ of casual street trade in software and movies. Credit – Shankar.s. ‘Pirated DVDs at PP street market’ – Source / License
Back then, before software rental became a common consumer model, a small but elite cadre of ‘scene’ software enthusiasts emerged to crack applications, which would then be released into the wilds of ‘warez’ newsgroups, and, later, torrenting groups. Those restrictions could be onerous or trivial to breach, but the breaches were usually indelible once released into the wild.
This is what is happening now with open source Large Language Models (LLMs), which are routinely, and at scale, being shorn of their trained-in safety filters, after which these de-censored models end up shared in so many places that even shutting down the upstream source of the ‘crack’ makes no difference to the models’ availability.
Benefactor or Malefactor
The question is: in what light do you want to view these activities? Unlike the warez scene, no-one is being as explicitly deprived of income as smaller software producers arguably were 20-30 years ago.
For sure, the original license terms are often being breached, in such cases*; however, unlike the partial weights releases of genAI model producers such as Black Forest Labs, the original distributors are not treating ‘lower quality’ versions as upsell paths to more capable API-only models; they are releasing the full models outright.
In most cases, almost no-one can run these initial releases locally, because they are just too high in parameters even for well-outfitted GPU cards such as 16-24GB VRAM capacities.
Thus the initial releases are quickly converted into slimmed-down versions capable of running on consumer hardware, via model quantization, and the conversion of weights to lighter iterations such as GGUF, AWQ, PTQ, EXL2, or the Apple-centric MLX.
Though these are not as performant as the original full-fat models (which will usually end up being served commercially from a variety of GPU-farms), they are at least in the control of the user, and can be customized to that specific user in ways that the ‘better’ model cannot.
Have it Your Way
Some of these ways are patently legitimate, and usually within the scope of the upstream license, such as fine-tuning, so that a model’s weights are specifically inclined towards a target task or domain that the user has injected into the it. In such a case, hard disk space permitting, one can even fine-tune multiple instances of an open source model for a diversity of tasks, like an array of dedicated, traditional tools – instead of the ‘Swiss Army Knife’ of an upstream, full-weight model.
Additionally, models with compatible settings, but different training data, can be merged together; or else extra capabilities can be superimposed on a model via lightweight LoRA filters, without risking to undermine the base model’s original capabilities through fine-tuning.
However, the modification that most interests many users, and which has become easier than any of the above methods, is the removal of the aforementioned safety filters, or guardrails.
Though this does admittedly allow for models that will output pornographic content and malware development, it also removes what many users perceive as an excessively restrictive (and frequently error-prone) set of restrictions.
One of many hilarious examples of Llama-2-7b-chat refusing reasonable requests on safety grounds, available at the source URL. Source
Heretic
In the case of Heretic, the software that has lately revolutionized model decensoring, it’s even possible to lower the level of ‘flowery’ and verbose prose that models are disposed toward.
Heretic gets to work on decensoring gpt-oss, though admittedly on a very well-specced machine that’s unlikely to grace the average consumer’s home – though it could be rented cheaply online, for the necessary duration of the process. Source
More importantly, Heretic – which automatically searches for an abliteration that suppresses refusals, while minimizing damage to the model’s original behavior – brings the relatively challenging task of decensoring down to a mere single command, from the end-user’s standpoint.
As you can see from the screenshot above, Heretic tends to benefit from a beefier GPU than is likely to be found in a consumer home; however, users do not need to run it on home hardware, any more than they had to personally crack software back in 2002; as in the warez days, upstream scene providers (casual, usually non-commercial enthusiasts) with access to such hardware, or willingness to spend some tokens on the problem, conduct the jailbreak and release the de-censored model into the scene.
In the Crosshairs
When a ‘questionable’ digital action ceases to become difficult, it’s usually through an overnight leap of capability (think Napster or PopCornTime) that suddenly scales up both the activity itself, and the level of ‘official’ interest in curtailing it.
Combined with the growing popularity and ease-of-use of platforms such as Ollama, Heretic is beginning to bring de-censored model access within reach of the non-technical user, even if a truly ‘idiot-proof’ method is not quite available yet.
And that brings me back to my earlier question, of whether or not this activity constitutes a ‘problem’. A paper that came up in Arxiv yesterday indicates to me, based on some very recent trends in retrenchment and cracking down on tech consumer freedoms, that decensoring is likely to gain increasing attention, leading to more incidences of proscriptive legislation around the world.
The new paper, a report from 10a Labs, frames the decensoring movement in a negative light, and provides the customary minority of abuse cases that will, history suggests, and current trends foretell, lead to curtailments.
The study traces what happens after de-censored models are released and redistributed, and identified 1,643 GitHub applications that integrate, recommend or default to uncensored models.
The models in question range from general-purpose chatbots and document-processing tools, to NSFW roleplay and storytelling; explicit-content services; hacking and offensive-security tools; and fraud applications and malware generators, with 25% of the releases classified by the study as ‘explicitly malicious’:
Breakdown of how uncensored AI models are being used after release. The study traced 1,643 GitHub applications that integrate, recommend or default to models whose safety restrictions have been removed, finding that 37% were general-purpose uncensored chatbots, while cybersecurity and document-processing tools each accounted for 16%, alongside smaller categories spanning voice assistants, NSFW roleplay, creative writing, coding and other uses. The paper found that around 25% of the applications identified could be classified as ‘explicitly malicious’. Source
In the light of the UK’s recently-instituted restrictions on web access (and its now-paused intent to also restrict the VPN access that bypasses them); California’s 2027 requirement for most operating systems to collect users’ age ranges and provide them to applications; the EU’s scheme for age verification for access to adult online content; and Australia’s ban on social-media accounts for under-sixteens; the new paper seems to fit the pattern where raised attention ultimately leads to raised oversight, regulation, and possibly selective or complete bans.
It Couldn’t Happen Here
No, it could definitely happen here, partially because the of the high percentage of maleficent use, as estimated by the authors of the new study; and, arguably, because controls would place additional restrictions on the growing trend towards locally-run AI, which may be perceived by governments and institutions as a threat – the more so when the models are freed from their reins.
By framing decensoring activities as ‘facilitating’ NSFW output and malicious hacking, it’s possible to present decensoring as a falsely binary proposition: since it can be used for bad things, it must submit to regulation. In practical terms, there seems no realistic way to regulate such a functionality at all except to ban it outright, since there are so many possible use cases.
Also, in instances where decensoring an LLM could allow a model to generate (for instance) CSAM fiction, restrictive regulation would seem to be a slam-dunk proposition, since anyone opposing it can be tacitly painted as ‘in support’ of a decensored model’s nefarious uses, rather than its reasonable uses.
This does ignore the fact that a fine-tuned or LoRA-affected model can far more effectively produce any specific domain that the user might like to impose, since the model’s base weights become so distorted towards the task as to completely undermine any trained-in protections anyway.
All About Ease
Ease-of-use is what triggers adoption at scale, and adoption at scale is what triggers pressure on governments to legislate (either from public pressure groups, industry lobbyists, or through inter-governmental pressure).
While fine-tuning and LoRAs can almost certainly obtain better targeted results than just unlocking a FOSS foundation model, these methods require a certain amount of discipline and effort to enact.
Once running a decensored/quantized model locally becomes truly a matter of a few clicks (since the user will almost certainly be downloading a ‘pre-freed’ model rather than cracking it themselves with Heretic), the activity exits the obscurity of geekdom and enters the public domain, where its abuses are likely to become political footballs.
This summer NVIDIA led a cadre of heavyweight tech partners in pre-empting government restrictions on open source models, in an open letter that once again makes the case that minority abuses of a technology should not imperil it as a potential general benefit. But this has proved an unpopular standpoint in recent years.
* Whether model creators are sincere in their avowed wish to restrict users’ activity is frequently questioned, with guardrail protections even dismissed as ‘theater’.