August 21, 2026 / Legal Knowledge AI / Read Time: 23 Min

What Can an Uncensored Local Model Be Used For?

Using uncensored and abliterated models and red-team datasets on Hugging Face as examples, this article explains how uncensored local models work, how they are used in red teaming, and the legal boundaries around creating, deploying, and using them.

Seeing this title,

are some of you already starting to smirk?

Even when I bring this up in lawyers’ group chats,

some lawyers start sending smirking emojis…

Hey, hey—let’s be serious.

In fact, uncensored models have many other uses.

But is it illegal to create an uncensored model?

Is it illegal to use one?

Let’s find out together.

* This article represents only the author’s personal views and does not constitute legal advice.

I. What Exactly Is an “Uncensored Local Model”?

Recently,

Alibaba released the model weights for Qwen3.8-27B.

Powerful, capable, and relatively small.

Once quantized, it may even run on a single consumer GPU with plenty of VRAM. (Don’t get me started—here comes another graphics-card price spike.)

Judging from the current public benchmark results on Artificial Analysis,

it can even trade blows with the official DeepSeek-V4-Flash release on some tasks.

Keep in mind that Qwen3.8-27B is a dense model with only 27 billion parameters,

while DeepSeek-V4-Flash has 284 billion parameters in total.

That is an entire order of magnitude apart.

(Of course, one is a dense model and the other is an MoE model, so strictly speaking, they cannot be compared this way.)

Yet the official model had barely been released

when versions such as Qwen3.8-27B-Abliterated appeared on Hugging Face,

along with all kinds of “uncensored models” labeled Uncensored, Heretic, and so on.

Why “Uncensor” a Model?

The large models we normally use through webpages or online APIs

have generally undergone safety alignment—which can be understood as human-imposed limits on their output.

For their own protection,

online platforms also wrap models in layer upon layer of system prompts, content moderation, and account rules.

They further stack system prompts, output moderation, and account rules around the models.

Even open-source models are not spared.

Even after a model is downloaded and run locally on your own GPU,

it may still respond directly:

Sorry, I can’t answer that. Please ask something else!

For ordinary users,

this is of course a necessary safety measure—although it may benefit the vendor even more.

The problem is that

a model cannot always distinguish between:

a user who genuinely wants to do something bad

and

a user who is studying how bad actors operate.

Cybersecurity, legal, medical, and content-moderation work

often requires professionals to handle sensitive, dangerous, or even criminal material.

If a model refuses whenever it spots certain keywords,

many legitimate tasks will be blocked as well.

When I previously tested a legal-domain model,

I encountered one that simply refused to answer questions related to criminal law.

As model boundaries are tightened around the world,

the “armor” surrounding open-source models is growing ever thicker.

The community has therefore started experimenting with ways to weaken models’ tendency to refuse.

That is how so-called “uncensored models” emerged.

What Does “Uncensoring” Mean?

It means using methods such as modifying the system prompt, further fine-tuning, model merging, or directly editing model weights

to reduce or even remove the model’s tendency to refuse.

One representative technique is called Abliteration.

Put simply,

researchers compare a model’s internal states when it processes “harmful” and “harmless” prompts,

identify a direction that may be associated with “refusal,”

and then weaken that direction in the model’s weights.

Hugging Face even hosts an entire collection of abliterated models,

including modified versions of Qwen, Gemma, Llama, and other models.

The accompanying technical article expressly describes it as a model-editing method that can weaken refusal behavior without retraining.

But remember:

refusing less does not mean being smarter.

Nor does it make the answers more accurate.

If certain capabilities never properly developed during pretraining or post-training,

uncensoring cannot conjure those capabilities out of thin air.

The model may simply become more willing to speak nonsense with complete confidence.

II. What Are Uncensored Models Usually Used For?

There is no denying that

some people use them for role-playing or creating sensitive material.

Professionals may use them for legal, medical, or cybersecurity tasks that ordinary models are prone to misclassify.

But one of their more important—or at least more meaningful—uses is:

AI red teaming.

Many readers have probably heard of “red-versus-blue exercises.”

A “red team” refers to

“testing safeguards under pressure in a controlled environment by simulating adversarial behavior and identifying possible harmful system behavior and risk outcomes.”

Put more simply,

before the bad actors make their move,

have your own people play the bad actors first.

For example, testing:

whether the target model’s safety restrictions fail when a request is rephrased;
whether the system contains vulnerabilities and can be breached;
whether a program can be reverse-engineered and whether its protection mechanisms actually work.

And similar questions that may get your account banned if you ask a normal model too many times.

In these situations,

the red team needs an “attacker model”

to automatically generate test questions, rewrite adversarial prompts, and simulate attack paths,

helping testers design cases, automatically collect results, and iteratively adjust attack methods.

But ordinary models either refuse these requests or ban the account after too many of them.

That is why red teams need a powerful “uncensored model” to help them “cut corners.”

Therefore,

models that appear “dangerous”

are not used only to do bad things.

They may also be used to identify bad things.

Before anything truly goes wrong, they can help us fix the problem in time and prevent it from happening.

III. Is It Illegal to Create an Uncensored Model?

There is currently no offense in Chinese law called “the crime of creating an uncensored model.”

The core scenario regulated by Article 2 of the Interim Measures for the Management of Generative Artificial Intelligence Services

is likewise the provision of generative AI services to the public within China.

If a lawfully obtained model

is researched and tested locally,

and the only change is the removal of its refusal restrictions,

without offering a service to the public,

processing unlawfully obtained data, or committing any other unlawful act,

the act generally cannot be treated as illegal or criminal merely because the model “will answer anything.”

That alone does not make creating it unlawful.

But that does not give locally created models a “legal invincibility frame.”

At least three questions still need to be considered.

Where Did the Model Come From?

The fact that a model can be downloaded directly from Hugging Face, ModelScope, or another platform

does not mean you can modify, distribute, or commercialize it without reading its license.

Some models use relatively permissive licenses such as MIT or Apache-2.0.

Others use bespoke community licenses,

and some impose restrictions on particular uses, user scales, or methods of redistribution.

Before creating a derivative model,

you still need to examine both the original model’s license and the license shown on the current model card.

Open weights do not mean there are no copyright or contractual boundaries.

One careless step may be enough to constitute infringement.

What Data Was Used to Create It?

If the fine-tuning data comes from leaked chat logs, corporate documents, personal information, or trade secrets,

or from unlawfully obtained vulnerability data, account credentials, or malware samples,

whether the model is uncensored may not even be the first concern.

The acquisition, possession, and processing of the data may themselves already be unlawful.

Of course,

publicly available cybersecurity materials and legitimate red-team data

do not automatically become unlawful merely because they involve “hacking techniques.”

Who Is the Model Being Made For?

Creating an uncensored model for internal security evaluation

is generally not much of an issue

if it is only for “your own use.”

But suppose someone fine-tunes a model specifically for cyberattacks,

with the primary function of generating and executing intrusion instructions,

and continues customizing the model or providing technical support

despite knowing that the customer intends to attack someone else’s system.

That conduct may further implicate the crime of providing programs or tools for intruding into or illegally controlling computer information systems,

or amount to assistance in another cybercrime.

Of course,

whether a crime has been committed still depends on the model’s specific functions, the intended recipient, the actor’s knowledge and intent, and the actual consequences.

A model should not be criminalized merely because it “can write intrusion code.”

But neither “it is only a tool” nor “it is only for learning” is a universal shield.

After all, as a matter of Chinese legal practice, it is still better to

uncensor sparingly.

IV. Will the Police Come for Me Just for Using One?

An uncensored model can be an excellent tool.

But this tool is not automatically neutral enough for its specific use to be ignored.

Having a model generate test code inside an isolated environment

and deploying that code against someone else’s live server

are obviously not the same thing.

If You Want to Red-Team, Get Authorization First

Testing your own model or your own server,

or conducting a security assessment within the scope expressly authorized by a client,

will generally qualify as legitimate security research.

But if someone uses “red teaming” as a pretext

to bypass another party’s access controls, obtain data, or disrupt system operations without authorization,

that is hacking, plain and simple.

Article 29 of the Cybersecurity Law expressly prohibits illegally intruding into another person’s network, interfering with normal network functions, stealing network data, and providing programs or tools specifically used for such activities.

So if you really have been authorized to serve as the red team,

get a proper written authorization first.

Otherwise, if something actually goes wrong,

you may never be able to wash away the suspicion.

From “Only Me” to “Everyone”

Of course, we should not forget an uncensored model’s other capabilities.

Everyone’s “favorite”—everyone’s “favorite.”

As discussed in the previous article,

if you merely use an uncensored model to write ordinary content for yourself

or as a local “AI companion,”

the mere use of an uncensored model will generally not be unlawful.

But if the generated content meets the legal standard for obscene materials,

then under the Public Security Administration Punishments Law,

the mere act of “producing” it may carry a risk of public-security penalties even if it is never disseminated.

In addition,

turning an uncensored model into a web service or an app backend,

or opening an API for use by an indefinite group of users,

does not automatically constitute a crime merely because the model is “uncensored.”

But the activity may have shifted from local research to the provision of generative AI services to the public,

bringing with it a long list of obligations, including filing requirements and the need to impose restrictions—putting the “armor” right back on.

If someone continues providing the model and technical support while knowing that others will use them for cyberattacks or other illegal or criminal activities,

the conduct may then progress toward an administrative violation or even a criminal offense.

So,