Speaking to the "uncensored model" angle: there's little reason to distribute abliterated weights anyway. Instead of orthogonalising the weights that write back to the residual stream, you can just orthogonalise the activations themselves. It's equivalent.
Orthogonalising activations at runtime is computationally cheap. Just distribute the refusal vectors (few thousand floats per layer), then run against the stock weights. Antirez's DS4 already supports this: https://github.com/antirez/ds4/blob/8db1d1d155cb0400a86a86b9...
Abliterated weights are just a bad habit we've gotten into. It's also deeply suboptimal from a precision point of view to take a model that's already been QATed and distributed in pre-quantised form (DeepSeek V4, Kimi K2.5 or K3...), modify its weights, and re-quantise it. Similarly, abliterated models regain some of their refusal behaviour when they're re-quantised after abliteration -- avoidable by keeping the two separate.
derefr 1 minutes ago [-]
I believe abliterated models are mostly created so that they can be run on managed inference providers (i.e. services where you hand them a model URI, and they blindly fetch it, load it, and give you inference access to it through standard text/chat-completion APIs.)
Such providers have (for now) plausible deniability of behaving ethically (at least enough that they don't scare away their investors) due to them being "blind" to what gets run on their systems. They're acting as the inference equivalent of data transit carriers.
But I don't think it would be possible for managed inference providers to publicly expose "runtime activation steering" in the way antirez's DS4 does, without that reading much more explicitly as them inviting unethical workloads.
(Yes, there are other things you can do with runtime steering. But almost all of those things are workload-specific, relying on you privately tuning to the needs of your own dataset. And if you can do that, you can run inference without the help of a managed inference provider. The only time a customer will come along with a pre-made runtime-steering vector file in hand, is if that vector is an alignment-orthogonalization vector.)
jamienk 59 minutes ago [-]
Can you explain this a bit to a non-expert?
I haven't wrapped my mind around this
wren6991 53 minutes ago [-]
This is the original description of abliteration and it's quite approachable and interesting to read: Refusal in Language Models Is Mediated by a Single Direction (https://arxiv.org/abs/2406.11717). Warning: changes to your world view caused by seeing "HarmBench" used to maximise expected harm instead of minimising it may be irreversible.
There's an empirical observation that models often have a single direction in their activation space for "hmm no I shouldn't do this". It forms naturally during pre-training, and is then surfaced during post-training to make the model refuse to engage in certain behaviour.
With a little bit of linear algebra you can zap that direction from the model's activations, and it stops refusing to do things. You can also do the opposite: magnify that direction, and the model refuses to do anything at all.
mitxela 55 minutes ago [-]
Instead of editing the weights so they don't create the refusal signal, just let them do whatever, then delete the refusal signal itself. You don't want to edit quantised weights because it causes a loss of precision that can be pretty bad.
3eb7988a1663 19 minutes ago [-]
Who is offering the refusal vectors or instructions on how to generate them?
Distributing the vectors themselves isn't (yet) common practice, because people have gotten used to just putting the full modified weights up on HuggingFace's huge free storage.
p-e-w 14 minutes ago [-]
I am, in fact, I’m offering something much better, a compact format that exactly restores an abliterated model from a tiny JSON file:
So... distribute a LoRA (or equivalent) that modifies the base weights with the abliteration vectors. That makes sense as it would be possible to try different abliterations and keep the storage space down.
wren6991 12 minutes ago [-]
Yeah, orthogonalisation is a special case of a rank-1 LoRA.
Scaled 5 minutes ago [-]
This site could be useful also since there's been a recent trend of abliterated model providers demanding a hugging face account and email collection. I assume this is so the providers can spam people since there's not much other benefit. Hugging face had also been making it harder to sign up with disposable email addresses since they throw a weird error during sign up if they detect it. Anyway, I see a site like this being useful to sidestep all that data collection.
mmaunder 22 minutes ago [-]
Don’t laugh. Models like DS 4.1 Flash, which is unguardrailed and insanely capable, and cheap, will become illegal in the USA, and this service will become the new Pirate Bay.
You will rent guardrailed intelligence from approved providers and will not be able to own it. Just like your music and your films. And this time it won’t even be Metallica’s fault, it’ll be in the name of safety and child protection.
KerrAvon 6 minutes ago [-]
DS 4.1 Flash absolutely has guardrails. Maybe not ones as effective as some models.
dist-epoch 13 minutes ago [-]
The FBI doesn't come busting down your door for pirating a few movies (I'm sure someone will find a news article with this happening).
They will after a few incidents where unguardrailed local models are used to hack and stop the water supply.
ThePirateBay is tolerated. Market places where drugs/guns are sold are not, they are all infiltrated and shut down after a while.
KerrAvon 7 minutes ago [-]
>They will after a few incidents where unguardrailed local models are used to hack and stop the water supply.
> Market places where drugs/guns are sold are not, they are all infiltrated and shut down after a while.
might want to look up "gun show loophole"
phoyd 2 hours ago [-]
Torrents should really be the preferred method for distributing AI model weights. Why rely on a single point of failure like Hugging Face? BitTorrent was made for exactly this.
pmdr 12 minutes ago [-]
HF is meant to be a single point of control. AI models and Linux distros aren't usually for normies, so distribution via torrents would make sense, especially to save the provider some bandwidth. Ubuntu has been offering torrent downloads for ages. No mention of torrents on HF. I believe most downloads will soon be account/EULA-walled.
CodesInChaos 2 hours ago [-]
In my experience public torrents often die as they grow older. It doesn't help that BitTorrent V1 makes long term seeding annoying, and BitTorrent V2 is almost never used.
monsieurbanana 1 hours ago [-]
I never understood this, is there anything that makes it difficult for the original uploader, the one that supposedly offers the file directly, to offer a torrent instead for the same amount of time?
As far as perennity is concerned it seems strictly better.
zenoprax 1 hours ago [-]
Every change to the source is effectively a new torrent. This creates a ton of fragmentation as data is reorganized, remixed, reencoded, and so on.
You can see this with many Linux distros: there is no single Debian torrent that people seed for years because there's always a refreshed version.
Distros are a bad use case for P2P anyway since you depend on upstream as soon as you start upgrading and installing packages.
chmod775 46 minutes ago [-]
You can trivially have storage deduplication for the files served via torrent, transparent to the protocol. The most trivial version of this that you can do today with pretty much any client is having a single directory containing files serving multiple overlapping torrents.
skeledrew 40 minutes ago [-]
> files serving multiple overlapping torrents
This sounds wildly complex, especially from a discovery perspective.
chmod775 26 minutes ago [-]
I don't see why it would be. It's transparent to other clients just like it is to the protocol. It cannot be more complex than alternatives by construction.
NooneAtAll3 34 minutes ago [-]
but model releases are already non-changeable?
righthand 53 minutes ago [-]
> Distros are a bad use case for P2P anyway since you depend on upstream as soon as you start upgrading and installing packages.
This is true for any distribution method not just p2p. You can even download a nightly through torrents so what does it matter how the data is transferred if it’s always going to require `apt update`?
cube00 1 hours ago [-]
If they're no longer using that model they may not be willing to continue using their storage for it.
vlyan 21 minutes ago [-]
yes, but a few dedicated hoarders could keep many models alive, and I'm fairly certain the local LLM community has plenty of people who would.
csomar 1 hours ago [-]
How does this address the previous point? If they are not providing storage, then centralized or decentralized doesn’t make a difference.
Torrent/P2P can only add redundancy, so it’s impossible to have worse availability than a download link?
_blk 1 hours ago [-]
[flagged]
Wowfunhappy 17 minutes ago [-]
Well, for a torrent to stay healthy, users have to seed after download, so it can't possibly have the same UX as a standard browser file download unless you want to either kill the ecosystem or hide from the user what is consuming upload bandwidth.
That said, for large files, I much prefer the UX of a well-designed torrent client like Transmission to my web browser. If nothing else, the downloads are reliably resumable.
pell 59 minutes ago [-]
> Is there a fully in-browser torrent option that has the same UX as a regular file download in Firefox?
Opera did back in the day.
bilegeek 1 hours ago [-]
The biggest problem with BTv1 was the lack of per-file checksumming, and swarm merging (i.e. individual files have shared seeding pools across torrents). BTv2 specs the latter, but I think only BiglyBT actually implements it. Having both of those features from the get-go would've gone a LONG way to fixing the dead torrent problem.
zenoprax 1 hours ago [-]
You only need one person/organization to commit to seeding. The majority of people do not want to seed at all without some sort of incentive.
If this site represents a coordinated datahoarding effort then there will be at least a few people who will seed indefinitely.
It’s interesting he’s no longer getting any media attention any more.
Retr0id 55 minutes ago [-]
A torrent with a webseed is strictly more resilient than a direct download link alone.
ranger_danger 1 hours ago [-]
I always wondered why v2 is never used... you can even search for files by their individual hash with it.
mitxela 53 minutes ago [-]
Because history is path-dependent, as engineers keep learning over and over again. It doesn't matter whether Plan9 is theoretically superior to Linux - we're all on Linux and nobody's porting all the apps over.
TeMPOraL 2 hours ago [-]
Yeah, I thought they were used for this already. Surprised this is news, but also relieved.
Oxodao 1 hours ago [-]
IIRC Mistral used to do it, not sure if that's still the case
EDIT/ Yes they did, that no longer seems to be the case though
ages ago I tried using IPFS to more or less accomplish this, I imagined it to act more like a weights/training data network fs that everyone would be able to participate in.
mococa 2 hours ago [-]
Steam & Blizzard (probably others) used to delivery games through torrent protocol in the past, before CDNs became cheaper.
When StarCraft 2 was lauched, the installer (before Battle.net installer crapware) had a complete graphical visualization of seeders & leechers.
Once I was using Blizzard's downloader to install something (StarCraft, Diablo, I don't remember), and it was kinda slow. I disabled P2P downloads and speed skyrocketed, and I said "Huh, this was unexpected".
When P2P downloads disabled you could see the list of CDNs you're downloading from and mine had a single IP on that list. It looked familiar. Then it dawned on to me. It was the Akamai server which we were hosting in our system room, at 15 minutes of driving distance. After a chuckle, I went to get a cup of tea, because that was entertaining than the game itself.
Then of course, I dived into whatever I was installing that night.
alexpotato 2 hours ago [-]
I've worked at trading firms where the "reference data master" file is usually a big json or equivalent.
To get the file out to 100s or 1000s of machine they would often use private bittorent to distribute the file out.
mococa 1 hours ago [-]
Same here. Inspired by both, I used to delivery videos over torrent to in door machines since at that time, there's no CDNs (or it was difficult to get one).
mitxela 52 minutes ago [-]
As a private network, they have the option of multicast.
Aurornis 1 hours ago [-]
Several companies tried this for distributing software.
It was very controversial. Users were angry that software companies were using their internet bandwidth to distribute their software. Made a lot of people angry.
ivanmontillam 18 minutes ago [-]
If only Blizzard servers were seeders, and clients were only leechers, that'd have not been a problem.
bicepjai 9 minutes ago [-]
You did not have to call it “pirate”. That kind of set the negative tone for the website, and all the comments are looking at it with that view from the start. But it’s a great emoji Lego. I am working on something similar, mainly to make the download faster. I notice when you download these weights it will faster initially but very soon the throughput goes down after sometime.
golem14 10 minutes ago [-]
I wish they had used a better name. Why try to make it sound sinister and adjacent to piratebay etc? It's not that these models are illegal to own or download.
15 minutes ago [-]
sandcat_ 15 minutes ago [-]
What on earth is going on with all the spam in this thread? Is this how you claim a username?
skeledrew 2 hours ago [-]
Arguably this should've been a thing since day 1 (and probably would've helped to prevent the buyout), but better late than never.
RobotToaster 2 hours ago [-]
Hugging face seemed like buyout bait from day one.
hirako2000 47 minutes ago [-]
The GitHub for models and AI. I remember.
When a business subsidizes for several years all its offerings, one can guess how it will end.
Avicebron 2 hours ago [-]
Which makes it more surprising that something like this didn't exist. I'm relieved it does though.
45 minutes ago [-]
hgoel 1 hours ago [-]
Torrents always seemed like the more sensible way to distribute model weights.
Though I have been disappointed that most of these have been spurred on by the misleading claim that abliterated models were being taken down from HuggingFace because they removed an abliterated model. HF took one abliterated model down because the uploader was spamming people who requested access with sketchy requirements to pay for it.
Plus, there are a bunch of these types of sites, all of them have a couple of models and otherwise completely dead.
There's also the problem of catching malicious models that have been fine tuned to exfiltrate credentials. It would be nice to have means of checking hashes against the HF versions (or against other reputable sources). I'm guessing this is probably easy when just serving the same folder as what HF serves.
Edit: I should've scrolled down on the page, it does verify against the HF hashes.
wolfy1993 1 hours ago [-]
I'd support this if I didn't have to post to xitter to claim my username.
Really odd approach.
skepticalgenius 38 minutes ago [-]
[flagged]
mcrumm 15 minutes ago [-]
[flagged]
jamienk 48 minutes ago [-]
Let's imagine that a model is pulled from HF by order of the new overlords or because of some other kind of censorship. Wouldn't the question of it having a Free license or not potentially become a complex legal issue?
But if the point is to be "censorship-free" then why respect licenses at all? They are among main choke points today. If authoritarians use licenses to censor political, artistic, scientific, etc., speech that they want to block, does that make the censorship more respectable?
When Anthropic sues a Chinese lab for IP infringement and get a court to put a bar on that software, does it THEN get pulled from Pirate Face?
I know that an awful lot of international negotiations have become focused more and more on questions of "IP" - licensing battles are already intensely politicized and it's hard to imagine a future where it doesn't get much much worse. Imagine N Korea coming after you for violating a license that they worked hard to control and leverage.
mannyv 33 minutes ago [-]
I can see all these old models hanging out and bitching about the newfangled models that think they're so great.
"Trillions of parameters? Trillion my ass. Back in my day we got by with millions. And now here we are, washed up has beens."
grommz 1 hours ago [-]
If I search for 'uncensored' there are no torrents available. Uncensored models should be top priority, especially now that Nvidia owns HuggingFace and will enshittify the platform in accordance with upcoming US laws.
sneurlax 1 hours ago [-]
There are such results on huggingface tho. Also search for the keywords “abliteration” and “heretic”. Heretic is a tool used to abliterate, that is decensor, models
behole 1 hours ago [-]
That was my my first search too. I know they are still listed on HF but every time I try and use one, the links are dead or the size is beyond my scope. Was hoping for a fresh batch. Ill check back.
kevinsimper 2 hours ago [-]
That is pretty smart, torrent should have been used for more things, and this is a perfect usecase!
reilly3000 1 hours ago [-]
I’ve been wondering when this will come. The days are numbered for abliterated models to be published on HF I think. Why wouldn’t the government want a central control there?
casper14 2 hours ago [-]
Honestly, models are torrents will end any effort from the big AI labs to stop open models. No way to prevent weights from being shared, just like mobies. Genie is out of the bottle
yieldcrv 2 hours ago [-]
great initiative, it's really weird seeing efficiencies get rediscovered in the LLM audience, because these efficiencies aren't even what I would consider to be old
but I guess they are
Razengan 1 hours ago [-]
So begins the Merovingian and the Exiles..
bananaflag 2 hours ago [-]
Now I want GPT-4.5
befas 5 minutes ago [-]
[dead]
mohd_rafay 59 minutes ago [-]
[flagged]
nntlol 2 hours ago [-]
[dead]
reedf1 40 minutes ago [-]
[flagged]
ganessh 29 minutes ago [-]
[flagged]
skeledrew 18 minutes ago [-]
[flagged]
mortalsilk 21 minutes ago [-]
[flagged]
AndriiK 15 minutes ago [-]
[flagged]
Rendered at 18:02:50 GMT+0000 (Coordinated Universal Time) with Vercel.
Orthogonalising activations at runtime is computationally cheap. Just distribute the refusal vectors (few thousand floats per layer), then run against the stock weights. Antirez's DS4 already supports this: https://github.com/antirez/ds4/blob/8db1d1d155cb0400a86a86b9...
Abliterated weights are just a bad habit we've gotten into. It's also deeply suboptimal from a precision point of view to take a model that's already been QATed and distributed in pre-quantised form (DeepSeek V4, Kimi K2.5 or K3...), modify its weights, and re-quantise it. Similarly, abliterated models regain some of their refusal behaviour when they're re-quantised after abliteration -- avoidable by keeping the two separate.
Such providers have (for now) plausible deniability of behaving ethically (at least enough that they don't scare away their investors) due to them being "blind" to what gets run on their systems. They're acting as the inference equivalent of data transit carriers.
But I don't think it would be possible for managed inference providers to publicly expose "runtime activation steering" in the way antirez's DS4 does, without that reading much more explicitly as them inviting unethical workloads.
(Yes, there are other things you can do with runtime steering. But almost all of those things are workload-specific, relying on you privately tuning to the needs of your own dataset. And if you can do that, you can run inference without the help of a managed inference provider. The only time a customer will come along with a pre-made runtime-steering vector file in hand, is if that vector is an alignment-orthogonalization vector.)
I haven't wrapped my mind around this
There's an empirical observation that models often have a single direction in their activation space for "hmm no I shouldn't do this". It forms naturally during pre-training, and is then surfaced during post-training to make the model refuse to engage in certain behaviour.
With a little bit of linear algebra you can zap that direction from the model's activations, and it stops refusing to do things. You can also do the opposite: magnify that direction, and the model refuses to do anything at all.
Distributing the vectors themselves isn't (yet) common practice, because people have gotten used to just putting the full modified weights up on HuggingFace's huge free storage.
https://www.reddit.com/r/LocalLLaMA/s/iksvmXBzuC
You will rent guardrailed intelligence from approved providers and will not be able to own it. Just like your music and your films. And this time it won’t even be Metallica’s fault, it’ll be in the name of safety and child protection.
They will after a few incidents where unguardrailed local models are used to hack and stop the water supply.
ThePirateBay is tolerated. Market places where drugs/guns are sold are not, they are all infiltrated and shut down after a while.
This is irrational AI fearmongering. Please read https://sharptext.net/2026/some-of-all-fears/
> Market places where drugs/guns are sold are not, they are all infiltrated and shut down after a while.
might want to look up "gun show loophole"
As far as perennity is concerned it seems strictly better.
You can see this with many Linux distros: there is no single Debian torrent that people seed for years because there's always a refreshed version.
Distros are a bad use case for P2P anyway since you depend on upstream as soon as you start upgrading and installing packages.
This sounds wildly complex, especially from a discovery perspective.
This is true for any distribution method not just p2p. You can even download a nightly through torrents so what does it matter how the data is transferred if it’s always going to require `apt update`?
Torrent/P2P can only add redundancy, so it’s impossible to have worse availability than a download link?
That said, for large files, I much prefer the UX of a well-designed torrent client like Transmission to my web browser. If nothing else, the downloads are reliably resumable.
Opera did back in the day.
If this site represents a coordinated datahoarding effort then there will be at least a few people who will seed indefinitely.
It’s interesting he’s no longer getting any media attention any more.
EDIT/ Yes they did, that no longer seems to be the case though
https://x.com/MistralAI/status/1833758285167722836
When StarCraft 2 was lauched, the installer (before Battle.net installer crapware) had a complete graphical visualization of seeders & leechers.
Reference: https://warcraft.wiki.gg/wiki/Blizzard_Downloader
Once I was using Blizzard's downloader to install something (StarCraft, Diablo, I don't remember), and it was kinda slow. I disabled P2P downloads and speed skyrocketed, and I said "Huh, this was unexpected".
When P2P downloads disabled you could see the list of CDNs you're downloading from and mine had a single IP on that list. It looked familiar. Then it dawned on to me. It was the Akamai server which we were hosting in our system room, at 15 minutes of driving distance. After a chuckle, I went to get a cup of tea, because that was entertaining than the game itself.
Then of course, I dived into whatever I was installing that night.
To get the file out to 100s or 1000s of machine they would often use private bittorent to distribute the file out.
It was very controversial. Users were angry that software companies were using their internet bandwidth to distribute their software. Made a lot of people angry.
When a business subsidizes for several years all its offerings, one can guess how it will end.
Though I have been disappointed that most of these have been spurred on by the misleading claim that abliterated models were being taken down from HuggingFace because they removed an abliterated model. HF took one abliterated model down because the uploader was spamming people who requested access with sketchy requirements to pay for it.
Plus, there are a bunch of these types of sites, all of them have a couple of models and otherwise completely dead.
There's also the problem of catching malicious models that have been fine tuned to exfiltrate credentials. It would be nice to have means of checking hashes against the HF versions (or against other reputable sources). I'm guessing this is probably easy when just serving the same folder as what HF serves.
Edit: I should've scrolled down on the page, it does verify against the HF hashes.
Really odd approach.
But if the point is to be "censorship-free" then why respect licenses at all? They are among main choke points today. If authoritarians use licenses to censor political, artistic, scientific, etc., speech that they want to block, does that make the censorship more respectable?
When Anthropic sues a Chinese lab for IP infringement and get a court to put a bar on that software, does it THEN get pulled from Pirate Face?
I know that an awful lot of international negotiations have become focused more and more on questions of "IP" - licensing battles are already intensely politicized and it's hard to imagine a future where it doesn't get much much worse. Imagine N Korea coming after you for violating a license that they worked hard to control and leverage.
"Trillions of parameters? Trillion my ass. Back in my day we got by with millions. And now here we are, washed up has beens."
but I guess they are