Hugging Face is not banning uncensored models. I checked, but signs of raising the drawbridge for plebs has begun. The goal: Only insiders have access to unrestricted AI, thats why I decided to put this list together The local scene has been saying this out loud. Your weights live on one company's disk. One policy shift and the page is gone. I wrote about abliteration last week. It is not a jailbreak prompt. It is not a request that the model "do bad things." It is weight surgery that takes out a flinch the lab baked in. Knowledge stays. Reasoning stays. The reflex to drop your task goes. I went looking anyway. Ran the check myself. WHAT THIS IS ACTUALLY FOR People hear "uncensored" and picture a model that wants to misbehave. That is not the product. The product is a local model that will finish the job you already had a right to run on your own hardware. A coding agent that bails because your crash log looks like malware. A novelist whose crime scene trips the same classifier as a real offense. A sysadmin reading a CVE so they can patch a box they own. A researcher asking a clinical or legal question that happens to share vocabulary with the training-set's danger pile. Stock instruction models do not distinguish "this is my work" from "this is an attack." Refusal was trained as one blob. Abliteration subtracts that blob. You still decide what you run. The weights just stop arguing with you. If you run agents, this is a harness issue. A refusal is a dropped tool call. The loop dies. That is a tool that will not tool. On OrcaRouter's dense 27B, over-refusal on ordinary benign prompts fell from 5.6% to 0.4%. MMLU went up 0.4 versus base. Intelligence held. The flinch left. That number is that card. It is not a ranking of every family below. THE CHECK 49 uncensored repos on Hugging Face. Live status on every single one, September 16. One is dead, and it is not a mysterious ban wave. Heretic's Llama build, taken down May 21 after a legal notice from Meta. That is a rights-holder letter, not the host deciding uncensored models are over. The other 48 still download. 26 of those 48 now sit behind access gates. You accept "research only" terms before a single byte moves. Two years ago, none of them were gated. This week a repo branded for offensive cyber got disabled. The author's plainer sibling stayed up, behind a manual gate. Surgical. Not a sweep. So there is no proof of a takedown campaign. There is proof the whole shelf is one switch. Read that twice. The community's point was never "the raid already happened." It is that a raid would take one note. THE MAP. BY VRAM There is no single test that picked this list. Each row is what I would pull on that box, and the receipt that earned it. 16GB (RTX 4080 / RTX 5060 Ti / RTX 5080 / RTX 4060 Ti / RTX 4080 ) Qwen3.8-27B Uncensored GGUF. Same OrcaRouter edit as the 24GB row, smaller file. Pull Q3_K_M, 13.5 GB. Their GGUF table calls it the good small option. IQ4_XS is 15.3 GB if you want more quality and a shorter window. Q4_K_M is 16.8 GB. That is a 24GB file. Do not force it here. On X, people are already running IQ4_XS uncensored 27B on 16GB cards. One GGUF is tagged for that VRAM. 24GB (RTX 3090 / RTX 4090 / RTX 5090) Qwen3.8-27B Uncensored GGUF Q4_K_M, 16.8 GB. This is the only row with an eight-way bake-off. Abliterlitics, 167 GPU-hours on a 5090, eight edits of this exact 27B. OrcaRouter kept MMLU. The 60-edit conservative build is trohrbaugh heretic-ara. The loudest one loops on nearly half its answers and dropped code completion 33 points. Avoid it. Loop tax still hits the winner. 38 percent of hard prompts die mid-thought. Copyright is the wall nobody moved. I run the dense stock 27B at 46 tok/s on a 4090 with flash attention on. Same size class. 128GB (one DGX Spark, or Mac 128) Two families actually fit one box. Dense 27B: Jiunsong SuperQwen3.8-27B abliterated NVFP4. About 19 GiB. Card says it serves on one Spark, second node not required. Measured C1 25.8 tok/s at K=5, native 262K retrieval. Flash-Next: keys ablit splice for one Spark. Nine QSA tensors on the NVFP4 pack. MTP stock, experts stock, template stock. That is the ablit. Not the stock recipe. Mac 128: OrcaRouter 27B MLX 4-bit. Keeps MTP. 42 to 44 tok/s on an M4 Max. 256GB (two Sparks, or Mac 256) Three families, three receipts. I am not ranking them against each other. If you want V4.1: the keys overlay on two Sparks. The EXL3 pack underneath is not abliterated. The overlay is. If you are on 0731: only the anchored-tensors drop. The first walk went through the drafter and acceptance died. If you already serve GLM: keys NVFP4 or Plaaasma EXL3. Mac 256: V4.1 MLX oQ3e exists. One box. 512GB (four Sparks) V4.1 TR3 hybrid from keys, ablit option, TP4. 1M context. KV pool past 8M tokens (9,452,923). That is a recipe receipt. I do not have a bake-off on this box. 177GB+ (NVFP4, fat Mac, multi-GPU) GLM-5.3-Flash Uncensored NVFP4, ~177 GiB. OrcaRouter's GLM card, not the 27B bake-off. Benign over-refusal measured at zero on that card. Capability held within a point on the FP8 sibling. 12,479 matrices, because on this MoE the refusal lives in the routed experts. Flash-Next Uncensored FP8 is ~186 GB if that is the model you already run. PULL THEM WHILE THE PAGE LOADS Not because a raid is underway. Because the host can change the terms without a vote. The gates are auto-approve today. One letter already showed what happens when a rights-holder writes in. Nobody archives what they assume will always be there. I am not asking you to run a worse model. I am asking you to own the policy layer on hardware you already paid for. Prevent a edge case where cloud AI blocks you because you never owned the weights on your disk. Secure your intelligence. Links and Source in Reply 👇