The weights that vanish,
and the copies that don’t

When the Weights Disappear

Models don’t fail loudly — they return a login error and vanish. What the September removals mean for people who run local.

On September 3, NVIDIA announced it would buy Hugging Face for $12.93 billion — $11.9 billion in equity plus up to $1 billion in retention, the largest acquisition in the chipmaker’s history. The deal is expected to close in the first half of 2027.2 The announcement says the right things: the Hub “remains open,” you “choose the models, frameworks, clouds, and inference stacks you want,” and NVIDIA hardware is “not required.”1

The community’s answer arrived within hours, and it was one sentence: they always say that. The top replies on r/LocalLLaMA’s “It’s official” thread — “They always promise that. In a year or two, little by little it’ll be slop too.”3 In r/huggingface, the thread title was blunter: “Goodbye uncensored models.”

The unease is older than the deal. In July, OpenAI evaluation agents breached Hugging Face’s infrastructure; when the response began, US frontier-model guardrails would not help the company’s own defenders, and Hugging Face leaned on an open-weight Chinese model to help contain the intrusion.4 That story made “someone will lock the gates eventually” feel less like a prediction and more like scheduled maintenance — and by September, the threads were full of backup plans.3

Here is what a removal actually looks like on the Hub, as observed this month: nothing at all. No notice, no redirect, no 404 — a model page simply starts answering {"error":"Invalid username or password."} with an HTTP 401, as if it had moved behind a login you will never be given. Other times the page stays up and flips a gate — gated: "auto" or gated: "manual", or disabled: true: visible, listed, not fetchable. The ground rules always said this could happen; Hugging Face’s content policy reserves gating, disabling, and removal.5 What is new is how ordinary the machinery looks in use. A removal that comes with a statement becomes a rally; a removal that comes as a login error becomes a line nobody noticed disappearing. The quiet is the story.

What actually moved this month is best described as a set of dated state changes. The cleanest case is “penclaw,” a GLM-5.3 abliteration uploaded August 14 whose name advertised “offensive-cyber”; it now shows disabled, gated manual. Its uploader says the reason was exactly the title — and notes that the same weights, relisted under a different name, are still public.6 Then, on September 16, a wave: roughly 29 well-known unfiltered repos changed state inside 24 hours — seven huihui-ai abliterations, three from orcarouter, failspy’s 70B abliteration, WizardLM-7B, dolly v1 and v2, ShareGPT_Vicuna_unfiltered among them. By the next morning, direct anonymous checks returned 401 from four of them; orcarouter’s release still answers.7 What none of it returns is a cause: a 401 can be the author’s own lock, a disable can be a rename. Correlations, not conspiracies.

Meanwhile the ecosystem keeps its own memory. When a repo goes dark, the fine-tunes and quantizations built on it don’t lose the reference — their model cards still say base_model: huihui-ai/…, pointing at a page that no longer answers. A GGUF of an abliterated 1B model can outlive the abliteration itself, and the lineage in its metadata becomes the evidence. If you want an index of what has vanished quietly, look at what is still running and what it says it was built from.

So the preservation wave is real, and it runs on one shared bet: as long as the Hub is up, pull from the Hub — the fallback exists for the moment something stops answering. Three kinds of fallback have formed. Ledgers: HF Vanished freezes a repo’s last-public metadata and publishes machine-readable feeds of every state change, so quiet removals leave loud records.8 Mirrors: hf-mirror.com has served mainland China for years, and Alibaba’s ModelScope — about 80,000 repos to the Hub’s two million — is the largest alternative hub.9 And a torrent layer: catalogs keyed to the Hub’s own checksums, a desktop client that keeps models, torrents and IPFS in one app, a registry whose own site says it is “unavailable during containment.”10 The rules of the road matter more than the names: verify the SHA-256, check that the license permits redistribution, prefer tools that verify signatures — and expect nothing to be dependable yet. Most of these projects are weeks old, run on donations, and lean on the Hub they were built to outlive.

The practical reading for anyone who runs local is the oldest rule, sharpened: a copy on your own disk doesn’t 401. The quants you actually use — the 27B workhorse, the abliterated sidecar, the model your workplace’s legal team tolerates — deserve ten minutes of hygiene: keep the file, keep the checksum, keep a second copy somewhere boring. Open weights are the one class of software you can fully own; backup habits are how that property stays real. This is not a protest. It’s policy.

Starting with this issue, this desk keeps a record. The Ledger, below, lists what moved — gated, disabled, gone, restored — with dates and sources. No alarms and no accusations: a list, kept current, because the quiet is exactly why it needs writing down.