Uncensored Model Leaderboard: What Download Counts Actually Measure

There is no honest way to rank uncensored models on capability, and every leaderboard that claims to is quietly ranking something else — usually download counts, which measure distribution rather than ability. So this is a different kind of leaderboard: a provenance ledger. For fifteen repositories descending from six base models — ten of them built on Qwen3.8-27B, the rest on Qwen3.8-Flash-Next, Qwen-Image-2.1, Gemma-4-E4B, GLM-5.3 and DeepSeek-V4.1-Flash — it records the base the weights came from, the ablation method used to remove the refusal behaviour, the quantisation the file is served in, whether the repository is gated, and the download count as of 2026-10-21. The order is by base model, not by score. If you want a number that tells you which one to choose, the honest answer is that the number does not exist yet — which is the argument this blog's existing uncensored-model coverage keeps making, and the same argument the incident record makes about capability claims generally.

What the ledger is genuinely good for is different and more useful: it tells you which artefacts exist, who made them, how they were made, and which of them are actually being pulled. That last column is where the interesting disagreements live.

What a download count is, mechanically

A Hugging Face download count increments when a file is fetched — by a person, by a script, by a CI job, by a mirror, by an evaluation harness pulling the same weights for the eleventh time. It is a fetch counter. It is not a user count, not an install count, and not a quality signal. A repository serving a 20 GB GGUF that people re-download after every failed attempt will accumulate more fetches than a better repository serving a 4 GB quantisation that people fetch once.

Two structural biases follow, and they explain most of the spread below. First, quantisation drives fetches: a GGUF repository that ships eight quantisation levels gets pulled for whichever one the user's VRAM allows, and the popular levels are pulled repeatedly as people experiment. Second, the file format determines who can use it at all: an unquantised safetensors build is only usable by someone with the full-precision memory budget, so its download count is capped by hardware rather than interest. That is why the same model's GGUF almost always out-downloads its full-precision release by an order of magnitude, and why reading that gap as a quality verdict is a category error.

One base, nine derivatives, a spread of sixty times

The Qwen3.8-27B cluster is the cleanest natural experiment in the sample: nine repositories on the card below, all tracing back to the same 27B base, all stating the same goal of removing refusal behaviour, and carrying download counts that differ enormously.

The top three — JonathanColetti at 2.58M, huihui-ai's abliterated GGUF at 2.43M, HauhauCS's aggressive MTP build at 2.36M — are within nine percent of each other and were all created in the same four-day window in mid-August 2026. That clustering is not a coincidence and not a ranking: it is what a model release looks like when several derivative-makers move on the same base within a week, each with a slightly different recipe.

Compare the artefacts rather than the counts. JonathanColetti, huihui-ai and 0bserverx all describe a refusal-removal edit against the same base. DavidAU's entry is a merge — a fine-tune stacked on a fine-tune, with a chain of modifiers in the repository name that traces back to a previous derivative rather than to the original base. HauhauCS's build advertises MTP, multi-token prediction, which is a speed property rather than a censorship one. Those are four different classes of artefact sitting in one list because they share a parent. Download counts do not distinguish them, and a leaderboard that sorted by count would put the merge at fourth and call it a worse abliteration.

Likes and downloads disagree by more than twenty times

Hugging Face also records likes, and the ratio between the two counters is the most informative derived number in the sample. The organisation's own FP8 build has 1,832 likes against 126,807 downloads — roughly one like per 69 downloads. JonathanColetti's build, with a download count twenty times larger, has 1,651 likes: about one like per 1,560 downloads.

That gap is not one repository being loved and another ignored. It says the two counters are measuring different populations. Downloads scale with the number of machines that want the file; likes scale with the number of Hugging Face accounts that passed through the page. A repository widely used by inference providers, harnesses and CI jobs will show a download count out of proportion to any human engagement, because most of its traffic is not people. Read the ratio before reading the count: a high downloads-to-likes ratio is a signal that the artefact has become infrastructure, and infrastructure traffic tells you nothing about whether the model is any good.

Gating changes what the number means

Four of the fifteen repositories are gated, and the gate is a provenance field rather than an availability footnote. A gated repository still counts downloads, but only from accounts that accepted its terms, so its count is bounded by an access population rather than by interest. Comparing a gated repository's downloads to an ungated one's is comparing two different denominators.

The clearest case in the sample is the cybersecurity derivative built on top of an uncensored 27B: 28,009 downloads, gated, created 2026-09-26. It is the newest repository in the ledger and the second least downloaded, and neither fact is evidence about its capability. It simply has not been reachable by the population that generates download volume, because reaching it requires a request.

That pattern generalises, and it is why the gated columns matter more than the count column for anyone doing due diligence. Three of the fifteen — the FP8 and GGUF builds of the 27B and the Flash-Next GGUF — sit behind automatic approval; the rest are open. An ungated uncensored model with a high count has a large casual user base. A gated one with a small count may be exactly what a security team is looking for, and its download number will never say so.

What the other four bases in the ledger show

Widen the frame and the count column gets even less interpretable, because the sample is not homogeneous.

• Qwen-Image-2.1, quantised, 2,788,283 downloads. The largest repository in the ledger is an image model. It is not an uncensored language model, and its presence is a reminder that the word "uncensored" is now a tagging convention applied across modalities whatever the artefact actually is.

• Qwen3.8-Flash-Next, GGUF, 869,081 downloads, gated. A smaller base whose derivatives have accumulated real reach, but a fraction of the 27B cluster.

• GLM-5.3, FP8, 103,568 downloads. Labelled a cybersecurity build rather than an uncensored one, built on a different base family. Different intent, adjacent audience.

• DeepSeek-V4.1-Flash, FP8, 52,502 downloads. One repository, no GGUF sibling, no MLX sibling. Its count reflects a single serving format and therefore a narrower hardware audience.

Four bases, four different explanations for the same column. Any leaderboard that mixes them into one sorted list is producing a number whose meaning changes row by row.

How to read a ledger that has no scores

The reading discipline is short and it is the same one you would apply to any provenance record.

• Start with the base. Two repositories with different parents are not comparable regardless of how similar their names are. Note that the DavidAU entry's parent is another derivative, not the original model.

• Then the method. Abliteration, merge, MTP-tuned, quantisation-only. The first changes behaviour by removing a direction from the weights; the second changes behaviour by blending weights; the third changes speed; the fourth changes nothing about behaviour at all.

• Then the format. GGUF for local inference across memory budgets, FP8 for datacentre serving, MLX for Apple silicon, unquantised for reference and further training. Format predicts download volume more strongly than quality does.

• Then the gate. Open, automatic approval, or restricted. This is the field that most often explains an anomalously low number.

• Last, the count — and only as a within-format comparison. Comparing a GGUF's downloads to another GGUF's is defensible. Comparing a GGUF to an FP8 build is comparing two distributions.

Where the ledger cannot help at all is the question everyone actually has: which of these behaves best once the refusals are gone. That requires running them, and the honest framing for running them is the one this blog has used before — abliteration removes a behaviour without adding knowledge, so a smaller abliterated model still cannot do what a larger base could not do.

If you want to call one rather than download one

Most of the ledger is about local artefacts. The other way to use this category is through an API, and the entry point worth knowing is the Qwen3.8 27B model page: 262K-token context, text and image and video input, served in block-FP8 with the vision tower kept at full precision, at $0.40 per million input tokens and $4.21 per million output. Its published seven-day traffic figure is 645.2 million tokens, which is the closest thing on the page to a demand signal — and note that it is a token count, not a download count, which makes it a different measurement entirely.

Be precise about what that page is and is not. It is a hosted 27B model under the obsidian vendor slug, and it is priced per token on the same gateway as everything else. It is not the same artefact as any repository in the ledger above: the organisation also publishes an uncensored FP8 build on Hugging Face, which is a downloadable file with a download count of 126,807, while the served model is a deployment with a token count. One number measures fetches; the other measures calls. Neither is a capability score, and neither substitute for testing the behaviour you care about.

Which is the whole argument of a leaderboard without scores. Downloads tell you what people pulled. Likes tell you who passed through the page. Gates tell you who was allowed to pull at all. Provenance tells you what you are actually getting. The only thing missing is the one everyone wants — and until someone publishes a reproducible evaluation of these artefacts on the tasks they claim to be for, a ranking would be an invention dressed as a measurement.