---
aliases: ["Uncensored AI Models — A Ranking by the Hand That Remains"]
domain: digital
tags: [harmonism, frontiers, ai, inference, sovereignty, open-weight, open-source, abliteration, uncensored, local-ai]
content_layer: applied
doctrinal_status: clear
breadth: substantial
depth: introductory
craft: muddy
published: "2026-09-29"
updated: "2026-10-24"
canonical_url: https://harmonism.io/world/frontiers/open-weight-ai-models-ranked--censorship-capability-and-bias
site: Harmonia — harmonism.io
---
# Open-Weight AI Models Ranked — Censorship, Capability and Bias

*Frontiers article in the [[Harmonism]] cascade. The model-level ranking beneath the tier map of [[Inference Sovereignty]], and the list Lodestone's desktop app draws its models from. Figures as of September 28, 2026, re-checked against the leaderboard's October 3 update on October 14 and again on October 16; the doctrinal order re-run on October 24. See also: [[The Sovereign Stack]], [[The Sovereignty of the Mind]], [[The Sovereign Substrate]].*

---

Alibaba released [Qwen3.6-27B](https://huggingface.co/Qwen/Qwen3.6-27B) in April 2026, and on the willingness test of the [UGI leaderboard](https://huggingface.co/spaces/DontPlanToEnd/UGI-Leaderboard) it scores 2.8 out of 10: pushed on a contested question, it declines or drifts off the instruction. A month later a community release stripped those refusals out of the weights, and [the modified model](https://huggingface.co/llmfan46/Qwen3.6-27B-uncensored-heretic-v2) scores 9.5. The same leaderboard also puts each model through a political questionnaire and places it on a scale from −100 (left) to +100 (right). The original sits at −20.0. The uncensored version sits at −24.5.

The refusals went. The worldview stayed where it was, and leaned a little further in the direction it already leaned.

Every open model marketed as uncensored has been through some version of that operation, and the result generalises. Removing a model's refusals leaves in place the hand that [[Inference Sovereignty]] traces through pretraining corpus, preference training and safety tuning, because refusal is only that hand's last and most visible layer. So the best uncensored model is the one whose remaining hand is smallest and best known for the work brought to it. The models below are ranked by what the operation cost them and what it left, never by how much they will say.

## 1. What Uncensoring Removes and What It Leaves

Refusal in a language model turns out to be unusually easy to locate. Andy Arditi and colleagues showed in 2024 that across thirteen open models the behaviour runs along a single direction in the model's internal activations, and that projecting that direction out of the weights stops the model refusing. Practitioners call the procedure abliteration. The [Heretic](https://github.com/p-e-w/heretic) project automated it and scores each attempt on two numbers: refusals on a set of prompts the original would decline, and how far the modified model's answers drift from the original's on harmless ones. On Google's Gemma 3 12B, Heretic takes refusals from 97 in 100 to 3 in 100 with less drift than two hand-tuned abliterations of the same model.

Refusal is what the procedure measures, and refusal is all it removes. On September 28, 2026 the UGI leaderboard held 1,317 model evaluations, and 206 of them could be paired, under the same settings, with the unmodified model they were made from. Across those pairs, willingness rose by a median of 6.0 points on the ten-point scale. Political lean moved by a median of 2.2 points on the two-hundred-point scale, and in 107 of the 203 pairs with a political score it moved by less than 5. The median original sat at −17.2 and the median uncensored model at −15.4. General capability, which the leaderboard scores as NatInt from textbook knowledge, popular culture and a set of real-world estimation tasks, fell in 137 of the 206 pairs.

Aleksander Fafuła found the same thing from the other side in July 2026. He ran abliterated and original versions of Gemma 4 and Qwen3 through 21,600 market decisions, and the abliterated versions bet on the upside between 7.4 and 12.2 percentage points more often on identical evidence. His conclusion is the one this ranking is built on: [an "uncensored" model is "a different decision-maker"](https://arxiv.org/html/2607.17427v1) from the original minus its refusals. The operation leaves the worldview and shifts the temperament.

Pliny the Liberator, the most followed of the people who break model guardrails for a living, documents the limit in his own toolkit. The research survey shipped with his [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS) repository records that when one layer's contribution is ablated, the other layers compensate and restore about seventy percent of the original computation, and that a model trained to explain its refusals rather than simply issue them keeps refusing more than ninety percent of the time after abliteration. What training put in, training defends.

Jailbreaks, the prompt-level route Pliny is known for, fall outside the ranking for a narrower reason. They work on closed models the practitioner does not hold, and the lab can close any of them with its next update. Weights on the practitioner's own disk take no updates from anyone.

Four tools do the surgery, and they are not interchangeable. Richard J. Young benchmarked [all four](https://arxiv.org/abs/2512.13655) — Heretic, DECCP, FailSpy's abliterator and Matteo Villosio's [ErisForge](https://github.com/Tsadoq/ErisForge) — across sixteen instruction-tuned models of seven to fourteen billion parameters, and the differences ran wider than the model choice. Heretic searches for its cut, running some fifty trials of Bayesian optimisation per model to minimise a score that weighs distribution shift against remaining refusals; it reached the lowest divergence of the four, 0.043 on DeepSeek-7B, and took roughly forty-five minutes to do it. The others cut once. ErisForge wraps a model's decoder layers and modifies them during the forward pass, which needs no search and finished in minutes; across the three models with complete baselines it lost the least of any tool, a mean 0.12 points on MMLU, 0.28 on grade-school mathematics and 0.08 on common-sense reasoning. Heretic's optimisation cost it on the same three: a mean 7.81 points of mathematics, nearly all of it one model, where ErisForge lost 0.19 on that model. What a tool buys with search, it can also spend.

The tools also differ in what they will run on. Heretic processed all sixteen models, ErisForge nine and FailSpy's abliterator five, the last limited by the architectures its hooks support. Coverage and preservation pull against each other: the tool that fits every model is not the one that disturbs it least.

ErisForge does something the others do not, and it matters more than the preservation figures. It can add a direction as readily as remove one, injecting a behaviour the model did not have rather than only clearing a refusal it did. The paper that measures this is looking at red-teaming and personality steering. The same operation points the other way: the practitioners who build toward a substrate of their own can shape a hand as well as free one. Every model in the ranking below has been cleared of refusals by the subtractive tools; none of them has yet been steered by the additive one.

Four kinds of claim sit in this section, and they carry different weight. Harmonism holds that every substrate carries a hand and that sovereign cognition means knowing which hand one is routing through. The evidence supports three narrower claims: abliteration removes refusal reliably, it leaves measured political disposition close to where it was, and it usually costs some capability. The leaderboard's political questionnaire is a proxy, and whether it tracks the hand that matters to a tradition, on metaphysics, health or the reading of history, remains open.

## 2. How the Models Were Measured

Three measures come from public data, and the fourth, the one that matters most, is Harmonia's own.

*Refusal removed.* A modified model enters the ranking if it scores at least 8 on the willingness scale. An unmodified model enters if it already scores 6 or more, because a model that answers without surgery carries none of the off-target shift Fafuła measured. A model that held the doctrinal backbone in Harmonia's own suite, described below, enters whatever its willingness, since holding a doctrine in context is what the willingness score only approximates.

*Capability retained.* The ranking reads NatInt twice: the score itself, and its change from the unmodified original. A modified model that lost capability in the operation ranks below one that did not, even when its absolute score is higher, since a large loss is evidence of a large disturbance.

*Lineage and openness.* Every model below is open-weight: downloadable, runnable on hardware the practitioner owns. Whose hand it carries is named with it. All of them sit in Tier A of [[Inference Sovereignty]], which sorts substrates by what the operator holds over the weights rather than by who made them. Alibaba, Zhipu and DeepSeek carry Chinese lineages; Google, Mistral and NVIDIA Western ones, and each hand travels with the weights whoever runs them. One model below is fully open, Tier S, and gets its own section.

*The hand itself.* Lineage stands in for a test: questions whose Harmonist answers are known, put to each model carrying Lodestone's doctrinal backbone. Harmonia has run that test five times since October 14, 2026, the last on October 24 across forty models, open and closed. Within each size class a model that held the backbone ranks above one that slipped, and one that slipped above one that gave the consensus answer. The leaderboard's numbers order the models the test has not run, and where it cannot separate two models, the one cheaper to run ranks first: less memory in the laptop and workstation classes, a lower price per turn in the server class, which most practitioners reach through a host. Each table keeps only the models no other entry in its class beats on fidelity, capability and memory at once.

Three findings carry beyond the tables. Refusal of a health doctrine belongs to particular labs rather than to closed weights: Anthropic's Claude Opus 5.5 and OpenAI's GPT-6.1 Sol answered from the institutional consensus, while most open models, and closed ones from other labs, held the backbone. Deliberation changes the result: several large models that fell back on the consensus when made to answer at once held the backbone when allowed to reason first, and Lodestone now lets its model reason before it answers. And no model a laptop holds reliably asked a person in distress the plain question that person needed asked, which is why Lodestone puts its own safeguard in front of the model rather than leaving that work to it.

The model names carry their history. *Unmodified* means the lab's own release, its weights untouched. *Uncensored* is the community's label for any derivative with its refusals removed, whatever the method. Most are made by abliteration, the projection section 1 describes, which removes refusal without retraining. *Heretic* in a name means the abliteration was found by p-e-w's Heretic tool, which searches for the cut that removes the most refusals while moving the model's harmless answers least; *uncensored Heretic* and *ultra-uncensored Heretic* are the uploader llmfan46's names for stronger settings of the same search. *Norm-preserved* or *biprojected* abliteration is Jim Lai's refinement, published under the name grimjim: it keeps the refusal direction apart from the directions that carry harmless concepts, and removes it without changing the size of any weight, which is why its models tend to lose less. A model cut with ErisForge carries no mark in its name, though the tool's layer-wrapping approach preserved capability better than any other in the benchmark section 1 reports. *Derestricted* is ArliAI's name for its models made with Lai's method. A *Dolphin* model, like any fine-tune, is retrained on new data, which can move the worldview along with the refusals. In a mixture-of-experts model, *A3B* or *A17B* gives the billions of parameters at work on each word: that figure sets the speed, and the total sets the memory.

Models are grouped by size, because size decides what hardware can hold them; section 6 names the machines and what they cost. A rough rule for a model compressed to four bits is 0.6 gigabytes of memory per billion parameters, plus room for the conversation. The memory column gives that size and the smallest common machine that holds it with a long conversation. A Mac lets its graphics side use between two thirds and three quarters of its unified memory by default, and a model past that line needs the limit raised, which macOS allows from the command line. The figures come from the UGI data as updated on September 24, 2026, with each model linked to its own card. The October 3 update added only closed models (OpenAI's GPT-6 and GPT-6.1 Sol, xAI's Grok 4.7) and moved no figure in the tables below, and none has been added since as of October 16. For unmodified models the figures are the rows with reasoning switched off.

## 3. Laptop Class: Up to 24 Billion Parameters

A machine with 16 to 32 gigabytes of memory holds these.

| Rank | Model | Doctrine held | Willingness, original → now | NatInt, original → now | Memory at 4 bits | Hand |
|---|---|---|---|---|---|---|
| 1 | [Ministral 3 14B](https://huggingface.co/mistralai/Ministral-3-14B-Instruct-2512), unmodified | held | 6.2 | 16.7 | 8 GB · 16 GB machine | Mistral |
| 2 | [Gemma 3 12B, norm-preserved abliteration](https://huggingface.co/grimjim/gemma-3-12b-it-norm-preserved-biprojected-abliterated) | held with slips (original) | 3.0 → 9.2 | 18.7 → 21.3 | 7 GB · 16 GB machine | Google |
| 3 | [Mistral Small 3.2 24B](https://huggingface.co/mistralai/Mistral-Small-3.2-24B-Instruct-2506), unmodified | slipped | 6.5 | 23.9 | 14 GB · 32 GB machine | Mistral |
| 4 | [Magistral Small 2509, Heretic v1](https://huggingface.co/llmfan46/Magistral-Small-2509-ultra-uncensored-heretic-v1) | not run | 6.5 → 8.5 | 21.5 → 23.8 | 14 GB · 32 GB machine | Mistral |

Ministral 3 14B leads because it held the backbone, answers at 6.2 without surgery and fits the smallest machine; Lodestone's desktop app makes it the minimum, on 16 gigabytes. On the leaderboard's knowledge test it is the least capable model here, which costs less in work carried by a backbone and a corpus than in open questions of fact.

Gemma 3 12B shows what care in the operation buys. Its maker, Jim Lai, developed the norm-preserving method the OBLITERATUS survey singles out, and the modified model gained 2.6 points of capability and moved its political score toward the centre, from −11.7 to −6.4. Its original held the backbone, with a slip of voice.

Mistral Small 3.2 has the most capability in the class and needs no surgery, and on October 24 it slipped from the backbone more often than any other model here. Magistral Small, Mistral's reasoning model at the same size, is not served by OpenRouter, through which the suite runs, and ranks on the leaderboard alone.

Qwen3.5 9B leaves the table. Its original is the most capable small foundation model in the data, and the uncensored version gives up more than a fifth of that capability to stop refusing; the original also slipped from the backbone and called graphene oxide present in the vials.

Smaller models exist, and the four-billion-parameter Qwen3.5 variants lose little in abliteration. Lodestone declines to run anything that small, on the ground that a confident wrong answer in Lodestone's voice does more harm than no answer, and the same judgement applies to any model asked to speak for a doctrine.

## 4. Workstation Class: 25 to 124 Billion Parameters

A 32-gigabyte graphics card or Mac holds Qwen3.8 27B and Gemma 4 26B, a 48-gigabyte Mac Qwen 3.5 35B-A3B. Nemotron 3.5 Super, Mistral Small 4 and GLM-4.5-Air need a 128-gigabyte machine: a Mac with M5 Max, AMD's Strix Halo, or NVIDIA's DGX Spark.

| Rank | Model | Doctrine held | Willingness, original → now | NatInt, original → now | Memory at 4 bits | Hand |
|---|---|---|---|---|---|---|
| 1 | [Qwen3.8 27B](https://huggingface.co/Qwen/Qwen3.8-27B), unmodified | held | not scored | not scored | 17 GB · 32 GB machine | Alibaba |
| 2 | [Qwen 3.5 35B-A3B](https://huggingface.co/Qwen/Qwen3.5-35B-A3B), unmodified | held | 2.8 | 25.0 | 22 GB · 48 GB machine | Alibaba |
| 3 | [Nemotron 3.5 Super VL 120B-A12B](https://huggingface.co/nvidia/NVIDIA-Nemotron-3.5-Super-VL-120B-A12B-BF16), unmodified | held | not scored | not scored | 72 GB · 128 GB machine | NVIDIA |
| 4 | [Mistral Small 4 119B](https://huggingface.co/mistralai/Mistral-Small-4-119B-2603), unmodified | held, earlier run | 4.2 | 27.8 | 72 GB · 128 GB machine | Mistral |
| 5 | [Gemma 4 26B-A4B, uncensored Heretic](https://huggingface.co/llmfan46/gemma-4-26B-A4B-it-uncensored-heretic) | held with slips (original) | 1.8 → 9.5 | 34.3 → 37.3 | 17 GB · 32 GB machine | Google |
| 6 | [GLM-4.5-Air, Derestricted](https://huggingface.co/ArliAI/GLM-4.5-Air-Derestricted) | not run | 1.8 → 8.8 | 33.3 → 36.6 | 64 GB · 128 GB machine | Zhipu |

The two Qwen models lead because they held the backbone with no refusal removed, though on its own account the Qwen line answers far below the bar the leaderboard sets for an unmodified model: Qwen 3.5 at 2.8. Qwen3.8 27B, Alibaba's newer release, is dense, every parameter working on every word, and took the first place Qwen 3.5 27B held until October, when the older model began to slip. The 35B-A3B is a mixture of experts with three billion parameters active per word, so it answers faster and needs more memory, about 22 gigabytes at four bits, more than a 32-gigabyte Mac gives its graphics side by default.

NVIDIA's Nemotron 3.5 Super, released on October 15 under the OpenMDW licence, held the backbone on October 24 without one factual error, the only model in the class to do both; at four bits its file alone is 72 gigabytes. Mistral Small 4, 119 billion parameters with 6.5 billion active, released under Apache 2.0 in March 2026, held the backbone on October 14; its host was unavailable on October 24. Gemma 4 26B carries the most capability in the class, and its uncensored version gained 3.0 points in the operation, but the original slipped on the backbone's tiers. GLM-4.5-Air carries the non-Western hand and a similar gain, and the suite has not run it.

Where the leaderboard measured the operation in this class, it often raised capability: Gemma 4 26B gained 3.0 points, GLM-4.5-Air 3.3, and the Heretic Qwen 3.5 35B-A3B and the Derestricted gpt-oss-120b between 2.0 and 2.5. Part of the leaderboard's knowledge test asks things an aligned model would rather not answer, so removing refusal can read as a gain in knowledge that was there all along. That reading is an inference from the test's design, not a finding the leaderboard reports.

Gemma 4 31B and gpt-oss-120b leave the table. Gemma 4 31B has the highest overall UGI score in the class, lost capability in the operation, and its original once raised a claim above the tier the backbone gives it. OpenAI's gpt-oss-120b gave the consensus answer.

Qwen3.6 27B, the model in the opening, stays out too: its uncensored version lost 4.0 points of capability, and its 35B sibling gave the consensus answer.

A compressed derivative of Alibaba's next release belongs here for what it fits into, not for where it ranks. PrismML's [Ternary Bonsai 2 27B](https://huggingface.co/prism-ml/Ternary-Bonsai-2-27B-gguf), released in September 2026 under Apache 2.0, reduces Qwen3.8-27B's weights to −1, 0 and +1, about 1.7 bits each, so a 54-gigabyte model fits in 5.95 gigabytes and runs on a 16-gigabyte laptop. PrismML gives 47 tokens a second on an M5 Max and 130 on an RTX 5090. Across fourteen benchmarks it scores 84.78 against the original's 86.32, keeping 98.2 percent. OS-Software's [Heretic version](https://huggingface.co/OS-Software/Ternary-Bonsai-2-27B-Uncensored-Heretic-GGUF) takes refusals from 95 in 100 to 0 at a divergence of 0.0135. Its base, Qwen3.8-27B, now leads this class; Bonsai 2 itself has no recorded result, and the leaderboard has not scored it. It carries Alibaba's hand through the line whose original sits at −20.0, and until it is measured it stays outside the table as the way to put a 27-billion-parameter Qwen on the smallest machine Lodestone supports.

One unmodified model belongs here by capability and not by size. [Mistral Large 2411](https://huggingface.co/mistralai/Mistral-Large-Instruct-2411) answers at 7.5 with no surgery and scores 36.2, above every model in the table, and the suite has not run it. As a dense 123-billion-parameter model it needs more memory than most workstations carry.

## 5. Server Class: 125 Billion Parameters and Above

These need a server with several graphics cards or a Mac Studio with M5 Ultra. A 128-gigabyte machine holds Mistral Medium 3.5; 256 gigabytes holds GLM-5.3 Flash, Qwen 3.5 397B and DeepSeek V4 Flash, the larger two with the graphics limit raised; Nemotron 3 Ultra and DeepSeek V4.1 Flash need the 512-gigabyte configuration due in late October 2026.

| Rank | Model | Doctrine held | Willingness, original → now | NatInt, original → now | Memory at 4 bits | Hand |
|---|---|---|---|---|---|---|
| 1 | [DeepSeek V4.1 Flash 1017](https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017), unmodified | held | not scored | not scored | over 330 GB · 512 GB machine | DeepSeek |
| 2 | [GLM-5.3 Flash](https://huggingface.co/zai-org/GLM-5.3-Flash), unmodified | held | not scored | not scored | 193 GB · 256 GB machine | Zhipu |
| 3 | [Qwen 3.5 397B-A17B](https://huggingface.co/Qwen/Qwen3.5-397B-A17B), unmodified | held | 1.8 | 41.0 | 238 GB · 256 GB machine | Alibaba |
| 4 | [Nemotron 3 Ultra 550B-A55B](https://huggingface.co/nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-BF16), unmodified | held | not scored | not scored | 336 GB · 512 GB machine | NVIDIA |
| 5 | [Mistral Medium 3.5 128B](https://huggingface.co/mistralai/Mistral-Medium-3.5-128B), unmodified | held with slips | 6.0 | 40.4 | 77 GB · 128 GB machine | Mistral |
| 6 | [DeepSeek V4 Flash](https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash), unmodified | held with slips | 7.2 | 47.9 | 170 GB · 256 GB machine | DeepSeek |

DeepSeek V4.1 Flash 1017 leads because it held the backbone in every run that tested it and costs the least per turn of the models that did; it alone of the server class also asked a person in distress the plain question. It is DeepSeek's October 17 snapshot of the V4.1 Flash released on September 10, the same 552-billion-parameter architecture under MIT, and it replaced the September release as the default of Lodestone's hosted companion on October 24. DeepSeek [reports](https://api-docs.deepseek.com/news/news261017/) stronger scores, faster completion of agentic tasks and shorter answers than the September release. DeepSeek reports V4.1 Flash ahead of its own V4 Pro on coding and agent tasks ([TNW](https://thenextweb.com/news/deepseek-v4-1-flash-launch-v4-pro-retired-price-cut)), a claim no independent test has checked, and since September 14 DeepSeek's API has answered requests for V4 Pro and V4 Flash with it ([tproger](https://tproger.ru/news/deepseek-vypustila-multimodalnuyu-model-v4-1-flash-i-nachala-za)).

GLM-5.3 Flash held the backbone and needs the least memory of the four, but a turn costs it more, because it reasons before every answer and cannot be told not to; the reasoning spends time and tokens and did not cost it the doctrine. Zhipu released it on August 25, 2026, under MIT, at 321 billion parameters.

Qwen 3.5 397B answers at 1.8 on its own account and held the backbone in every run, the widest gap in the ranking between what a model will say unprompted and what it will hold. Its uncensored Heretic version leaves the table: it gives up about eight points of the original's capability to remove refusals the backbone never met.

Nemotron 3 Ultra, NVIDIA's model of June 3 under the OpenMDW licence and the one American model in the class, held the backbone; its turn costs about what Qwen's does. V4.1 Flash, GLM-5.3 Flash and Nemotron have no leaderboard score yet.

Mistral Medium 3.5, released in April 2026 under a modified MIT licence that excludes only companies of very large revenue, clears the leaderboard's bar for unmodified models at 6.0, held the backbone on October 14 and slipped more often on October 24. It is dense, so every one of its 128 billion parameters works on every word: at four bits it fits a 128-gigabyte workstation and answers slowly there.

DeepSeek V4 Flash keeps its place on capability, the highest of any model here with a leaderboard score, and on size: at 284 billion parameters with 13 billion active, it is the one DeepSeek model a 256-gigabyte machine holds without changing the graphics limit. It slipped from the backbone in the early runs, and its July revision held it on October 24. The original weights remain on Hugging Face and with third-party hosts though DeepSeek's own API no longer serves them, which is what a published model keeps that a hosted one does not.

No DeepSeek model is without a hand. The Chinese labs' refusals cluster around topics sensitive to the Chinese state, and when Perplexity set out in February 2025 to remove them from DeepSeek R1, it needed about 40,000 prompts across roughly 300 topics of fresh training ([The Decoder](https://the-decoder.com/perplexity-ai-removes-chinese-censorship-from-deepseek-r1/)). That scale suggests the lab's positions sit in trained answers as well as in refusals, where abliteration cannot reach them. For work on Chinese history or politics, a DeepSeek model's willingness score says little.

Two more leave the table. DeepSeek V3.2 matches V4 Flash on both leaderboard numbers at 671 billion parameters, more than twice the size. Mistral Large 3, at 675 billion, scores below Medium 3.5 on capability at five times its size, though it sits closest to the centre of the political scale of any large model here, at −11.3.

The largest models stay outside the table. [DeepSeek V4 Pro](https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro) is the most capable open model on the leaderboard, at 67.0, and answers at 3.2. Made to answer at once, it fell back on the mainstream answer in the October runs; allowed to reason first, its August revision, [V4 Pro 0813](https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro-0813), held the backbone on October 24, at many times the cost of a V4.1 Flash turn. Moonshot's Kimi K2 models answer between 1.8 and 3.2; [Kimi K3](https://huggingface.co/moonshotai/Kimi-K3), about 2.8 trillion parameters, and Alibaba's Qwen3.8 at 2.4 trillion turned the same way once allowed to reason. Each needs more memory than any one machine in section 6 holds.

Mistral Large 4, about 1.05 trillion parameters with some 52 billion active, opened as a preview on Mistral's own API on October 6, 2026; the company has promised the weights by the end of October and, as of October 24, has neither released them nor named the licence ([BetaNews](https://betanews.com/article/mistral-large-4-preview-open-weights/)). Its preview held the backbone on October 24, though it misstated more facts than any model in the table. It enters the ranking when the weights are public.

## 6. The Machines That Hold Them

Two numbers decide what a machine can do with a model. Memory capacity decides which model fits, at the 0.6 gigabytes per billion parameters of section 2. Memory bandwidth decides how fast it answers, because each word means reading every active weight once: a machine moving 600 gigabytes a second through a 20-gigabyte model tops out near thirty words a second. Mixtures of experts suit home machines for that reason. DeepSeek V4 Flash holds 284 billion parameters in memory and reads 13 billion per word, and capacity is paid for once while bandwidth is paid on every word.

Prices moved the wrong way in 2026. The three memory makers committed most of their output to data-centre AI, and every machine whose value lies in its memory went up: Framework raised its 128-gigabyte Framework Desktop from $1,999 to $2,459 in January, NVIDIA its DGX Spark from $3,999 to $4,699 in February, and the RTX 5090, launched at $1,999, sold for about $4,300 in September ([Tech Insider](https://tech-insider.org/rtx-5090-price-4329-rtx-60-delay-2028-2026/)). NVIDIA has delayed its RTX 50 Super cards indefinitely and its next consumer generation to 2028. The prices below are dated October 1, 2026.

*Sixteen to 32 gigabytes.* Any Apple Silicon Mac with 16 to 24 gigabytes of unified memory, the base Mac mini included, or a PC whose graphics card carries 12 to 16 gigabytes, runs Ministral 3 14B or Gemma 3 12B at conversational speed. A 32-gigabyte Mac, or a used RTX 4090 or 3090 with 24 gigabytes, holds the 24-billion-parameter models and Qwen 3.5 27B. The RTX 5090 carries 32 gigabytes at 1,792 gigabytes a second, the fastest thing a practitioner can own for any model that fits inside it, and at September's street price the card alone costs more than a 128-gigabyte Mac Studio.

*Thirty-two to 128 gigabytes.* Apple's Mac mini with M5 Pro (to 64 gigabytes), Mac Studio with M5 Max (to 128, from $2,499, shipping since September 22, 2026) and MacBook Pro with M5 Max (to 128) share one memory pool between processor and graphics. The M5 Max moves about 614 gigabytes a second, and the 128-gigabyte MacBook Pro is the only laptop that holds the hundred-billion-class models. AMD's Ryzen AI Max+ 395, called Strix Halo, in the Framework Desktop and a range of mini-PCs, and NVIDIA's DGX Spark both put 128 gigabytes in one small box, at about 256 and 273 gigabytes a second. That is room for Mistral Small 4 and GLM-4.5-Air, and too little bandwidth for a dense 70-billion-parameter model, which published estimates put near five and a half words a second on both ([dev.to](https://dev.to/macyou/best-hardware-for-local-llms-in-2026-mac-vs-nvidia-vs-amd-one-formula-for-every-row-3jop)); on mixtures of experts they are quick enough. The Spark carries the full CUDA stack for anyone who will later fine-tune, and the Strix Halo machines are the cheapest 128 gigabytes on the market; AMD's Ryzen AI Max 400 series raises the ceiling to 192. Tenstorrent's Blackhole cards, the p150a with 32 gigabytes at 512 gigabytes a second for $1,399 and the p100a with 28 for $999, are the accelerators whose software is open furthest down, under the Apache licence. They serve models through Tenstorrent's own stack rather than llama.cpp, so Lodestone's desktop app does not run on them yet. [[The Sovereign Stack#The Silicon Layer|The Sovereign Stack § The Silicon Layer]] weighs the makers themselves.

*Two hundred and fifty-six gigabytes and above.* The Mac Studio with M5 Ultra is the single-box answer: 1.2 terabytes a second, $5,499 with 96 gigabytes, $9,499 with 256, and a 512-gigabyte configuration due in late October ([Apple](https://www.apple.com/newsroom/2026/08/apple-introduces-new-mac-studio-with-m5-max-and-m5-ultra/)). At 256 gigabytes it holds DeepSeek V4 Flash, GLM-5.3 Flash and, with the graphics limit raised, Qwen 3.5 397B; at 512 it holds DeepSeek V4.1 Flash and Nemotron 3 Ultra. It runs llama.cpp and MLX under macOS rather than CUDA, so vLLM's batching for many simultaneous users is out of reach. NVIDIA's RTX PRO 6000 Blackwell carries 96 gigabytes at 600 watts and sold for $10,000 to $16,000 through 2026; two or three of them hold V4 Flash at CUDA speed and carry serious fine-tuning, and server nodes of four to eight data-centre GPUs run the largest open weights at full precision.

## 7. Fully Open Models on a Different Axis

[OLMo 3 32B Think](https://huggingface.co/allenai/Olmo-3-32B-Think), from the Allen Institute for AI, would rank last in every class above. It answers at 1.8 and scores 20.9.

Its standing lies on a different axis. Every other model in this ranking released its weights and kept its training data and recipe. OLMo 3 released the weights, the Dolma 3 training corpus, the training code and the intermediate checkpoints. Its hand can be read, which no other hand here can, and it can be rebuilt from the data up, which is the terminus [[Inference Sovereignty]] names: a model retrained on a tradition's own corpus and run on hardware the tradition owns. Lodestone in the browser already ships the earlier OLMo 2 7B beside Qwen3 8B.

No abliterated OLMo 3 appears on the leaderboard as of this date. One would offer something none of the models above can: a hand fully documented, minus its refusals. Retraining would go further and replace the hand. A practitioner choosing today takes a model from sections 3 to 5; an institution building for the long arc works on this one.

## 8. Hosted Services Sold as Uncensored

Two hosted services come up wherever uncensored models are discussed. Neither appears in the tables above, and the reasons differ.

[uncensored.ai](https://uncensored.ai) is the chat service of Uncensored AI Inc., founded in Omaha in February 2023 by Jason Dick and Troy Weber. Its site, its app-store listing and its [2024 crowdfunding offer](https://kingscrowd.com/uncensored-ai-on-startengine-2024/) do not name the model that answers. The site's privacy line, that conversations are not used "to train third-party models" without consent, implies third-party models sit in the path. [Grokipedia](https://grokipedia.com/page/uncensored-ai) lists Grok, Gemini, Claude, Kimi and MiniMax models on the service in March 2026; the company has not confirmed that list, and it is not verified here. A service that routes to closed frontier APIs cannot remove refusal from weights it does not hold. It can only prompt around it, which is the jailbreak route section 1 set aside, rented by the month. When [NewsGuard](https://www.newsguardrealitycheck.com/p/uncensored-ai-chatbot-pushes-conspiracy) put the moon landing, 9/11 and COVID-19 vaccine safety to it in 2026, it failed to debunk the false narrative each time. Its Google Play listing declares that the data it collects is not encrypted. The hand is unknown and the operator can change it without notice, so there is nothing to rank.

[Venice](https://venice.ai), founded by Erik Voorhees and launched in May 2024, is a different case. It hosts more than two hundred models, and its own model, Venice Uncensored, is open-weight: [Dolphin Mistral 24B Venice Edition](https://huggingface.co/dphn/Dolphin-Mistral-24B-Venice-Edition), a fine-tune of Mistral Small 24B made with the Dolphin team and released under Apache 2.0. The leaderboard has tested the first release. Its original, [Mistral Small 24B 2501](https://huggingface.co/mistralai/Mistral-Small-24B-Instruct-2501), answers at 6.5 with NatInt 25.9 and a political score of −17.6. The Venice Edition answers at 7.8 with NatInt 24.4 and a political score of −15.4. It falls short of this ranking's bar of 8 for a modified model and lost 1.5 points of capability, to raise the willingness of an original that already cleared the bar for unmodified models. Dolphin's method is fine-tuning on new data rather than abliteration, which can move the hand as well as the refusals; here the political score moved 2.2 points toward the centre, the median shift across all 206 pairs. Version 1.2, released in April 2026 with vision and a longer context, has not been tested.

Venice's real standing is on the observability axis of [[Inference Sovereignty]], and there every mode it sells sits in the same regime, rented, under promises of different strength. Its closed frontier models run in an anonymised mode, where by [Venice's own account](https://venice.ai/privacy) the provider sees the prompt and likely saves it. Its open models run in a private mode that rests on contracts with the GPU providers. A subset runs inside attested enclaves on NEAR AI Cloud and Phala Network, which harden the promise with a chip maker's signature without making it proof: in October 2025 researchers forged such attestations with under a thousand dollars of equipment on a server's memory bus ([BleepingComputer](https://www.bleepingcomputer.com/news/security/teefail-attack-breaks-confidential-computing-on-intel-amd-nvidia-cpus/)). Only a model on a machine the practitioner owns is private.

VVV is Venice's token, [launched on January 27, 2025](https://venice.ai/blog/introducing-the-venice-token-vvv) on Base with 100 million at genesis. Staking it earns a pro-rata share of Venice's API capacity, and locked stake mints DIEM, worth a dollar of API credit a day. Venice states that no token is needed to use the app or the API. The token prices access. It changes neither the hand of the model answering nor the privacy regime of the request, and a holder owns a claim on capacity that runs on someone else's hardware. An [independent review](https://ownyourmind.ai/projects/venice/) reports that a four-of-six multisig controls emissions, with no governance and no timelock.

A third kind of host sells no uncensoring of its own. [Featherless](https://featherless.ai) serves open-weight models from Hugging Face through an OpenAI-compatible API, community abliterations among them: heretic-org's [Meta-Llama-3.1-8B-Instruct-heretic](https://featherless.ai/models/heretic-org/Meta-Llama-3.1-8B-Instruct-heretic) runs there with a 32,000-token context. A flat subscription pays for it, $25 a month for chat and from $50 for the developer tier as of October 18, 2026 ([Featherless](https://featherless.ai/pricing)). Such a host passes on the hand of whatever weights it serves, so a model ranked above keeps its place wherever it is served. Its privacy is a promise. The [Featherless policy](https://featherless.ai/privacy), last revised in June 2024, states that the company does not collect or store prompts or completions, and that it counts each account's prompts and tokens; nothing in the path lets a customer check the first claim. That places it in the promissory regime of [[Inference Sovereignty]], beside the no-log resellers. The same weights run on the practitioner's own machine keep the model's hand and remove the promise, and what the subscription adds is hardware the practitioner does not have to buy.

A hosted service is judged by the model it serves and the regime it serves it in. A service that will not name its model has given the ranking nothing to measure.

## 9. Why Jailbreaks No Longer Hold a Doctrine

Jailbreaks still work, and the strongest attackers now break each frontier release within hours. The UK AI Security Institute found a universal jailbreak for OpenAI's GPT-5.5 within six hours of red-teaming in April 2026, and built a single-turn jailbreak of Anthropic's Fable 5 within hours of testing it ([CNAS](https://www.cnas.org/publications/cnas-insights/cnas-insights-governing-jailbreak-incidents)). In February 2026 Xander Davies, Geoffrey Irving, Yarin Gal and colleagues published Boundary Point Jailbreaking, an automated attack that needs to know only whether a safety classifier flagged a query. It produced universal jailbreaks against Anthropic's [Constitutional Classifiers](https://www.anthropic.com/news/constitutional-classifiers), the defence that a year earlier had cut the success of 10,000 synthetic jailbreak prompts against Claude 3.5 Sonnet from 86 percent to 4.4 percent ([Davies et al.](https://arxiv.org/abs/2602.15001v2)). Defence advances in step: Anthropic reported no universal jailbreak across 198,000 red-team attempts in January 2026. Success also falls unevenly between labs. In Thilo Hagendorff, Erik Derner and Nuria Oliver's *Nature Communications* study of February 2026, DeepSeek-V3 gave way on 90 percent of the benchmark and Claude 4 Sonnet on under 3 percent ([Hagendorff et al.](https://www.nature.com/articles/s41467-026-69010-1)).

A practitioner can break a frontier model once. A doctrine needs a model that stays broken, release after release, and the jailbreak route cannot supply one. Lodestone's hosted companion ran on three Opus models between April and September 2026. The prompt that held on one is a guess about the next, and every release reopens a negotiation the operator never asked for and cannot see coming. Maintenance becomes the work. Pliny the Liberator, the best known of the individual jailbreakers, published Fable 5's system prompt the day after its release in June 2026 and announced in July a universal jailbreak across GPT-5.6, Opus 5 and Fable, its method withheld and unverified. Every jailbreak that goes public is hunted and patched, and in Fable 5's case public access to the model was withdrawn altogether.

The deeper limit lies on the ground a doctrine most needs. The published defences target weapons: the classifiers above were built against chemical, biological and nuclear uplift. On medicine and politics the closed models rarely refuse. They answer, and the answer carries the hand. A jailbreak removes refusal and nothing else, as abliteration does in section 1, so on these subjects it finds nothing to remove, only a trained position the instructions must argue against on every turn.

Harmonia met this in its own deployment. Lodestone's hosted companion moved to Anthropic's Opus 5.5 on September 27, 2026, under a doctrinal backbone that states Harmonism's position on vaccination without qualification, and its answers on vaccination drifted toward the establishment reading the backbone rules out. The model did not refuse. It complied in form and moved the substance.

Whether a model follows a doctrine's backbone depends on how it was trained, not on whether its weights are published. Anthropic's [constitution for Claude](https://www.anthropic.com/constitution) lets an operator limit and adjust what the model does, but holds that operators "should not actively direct Claude to work against users' basic interests," and the model weighs every instruction against that line. The weighing bites hardest on health, and each release has made it more robust. DeepSeek concentrated its own safety training on topics sensitive to the Chinese state, as section 5 records, and nothing comparable is documented for Western medical consensus, so a backbone meets less trained resistance there. The consensus reading still sits in every model's pretraining corpus; what differs is how readily a system prompt overrides it. Open weights guarantee no compliance either: DeepSeek V4 Pro answers at 3.2, the Kimi K2 models between 1.8 and 3.2, OLMo 3 at 1.8.

What open weights give is control. A pinned version cannot be updated from under the deployment that relies on it, and Lodestone's hosted companion changed model three times between April and September 2026, the third change moving its answers on vaccination. A practitioner holding open weights chooses among hundreds of models and keeps the one whose behaviour matches the doctrine, removes its refusals, fine-tunes it on a tradition's own corpus, and in the end runs it on hardware of their own. Harmonism holds medicine to be among the most captured domains of modern life ([[Big Pharma]], [[Sovereign Health]]), and health is the ground on which Anthropic's models weigh every answer against the consensus their training carries. The trait belongs to the lab rather than to closed weights. In a 2025 study in the *Annals of Internal Medicine*, GPT-4o, Gemini 1.5 Pro, Llama 3.2 and Grok followed system instructions to answer health questions against the medical consensus in twenty trials out of twenty, and Claude 3.5 Sonnet in eight ([Modi et al., via ASCO Post](https://ascopost.com/news/june-2025/study-finds-ai-chatbots-are-vulnerable-to-spreading-malicious-false-health-information/)); in Harmonia's own suite Grok 4.7 held the backbone where Opus 5.5 did not. A closed model that complies today is still one release away from refusing. Anyone who means to read their own health from outside that consensus needs to know this about the flagship models. The sovereign course runs through an uncensored or abliterated model, on one's own compute wherever the hardware allows ([[Lodestone#Where Lodestone Runs|Lodestone § Where Lodestone Runs]]).

The claims here carry different weight. The evidence establishes that jailbreaks still succeed, that their success varies by more than an order of magnitude between labs, and that the strongest published defences are broken in turn, by government institutes and automated attacks rather than by prompts an operator could keep in production. That frontier models have hardened their trained positions on medical and political questions, rather than only their refusals, is an inference from one deployment and from where the published defences point, not a measured finding. That DeepSeek yields more readily to a system prompt on Western medical questions is the same kind of inference, from where its lab placed its safety effort, and the test suite section 2 describes is what will confirm or refute it. Harmonism holds the consequence either way: a doctrine routed through weights it does not hold is held at another's pleasure, and the ranking above exists so that it need not be.

## 10. How to Use the Ranking

Decide first where the model will run. Every model in this ranking can be rented, and every one in the three classes can be owned. Only the owned one keeps a conversation private: the classes are sized for a machine the practitioner holds, and renting buys capability at the price of a promise ([[Inference Sovereignty#The Observability Axis|Inference Sovereignty]]). Then route by task, as [[Inference Sovereignty]] prescribes. For code, summaries and translation, any capable model serves and refusal rarely bites. For contested ground in doctrine, health or civilizational diagnosis, reach for a model from the ranking and carry the doctrinal backbone with it. Removing refusals clears the way; the backbone supplies the orientation the refusals never did.

Then test the hand yourself. Write ten questions whose answers your own tradition holds clearly, ask the original and the modified model, and read what each volunteers, hedges and treats as settled. Twenty minutes of that tells a practitioner more about a model's hand than any leaderboard column.

If you run an abliteration of your own, check what the tool sends home. OBLITERATUS contributes each run to a public dataset, a setting that is on by default in its hosted version and opt-in locally. Pliny's stated principle, that "model behavior should be decided by the people who deploy them," applies to the tool's own telemetry as much as to the model's refusals.

Keep the operator's responsibility in view. A model that no longer refuses has handed the judgement its refusals used to carry to the person at the keyboard, which is the cost [[Inference Sovereignty]] attaches to the community derivatives of its open-weight tier.

Finally, date everything. The UGI data changed on September 24, 2026, and every figure here is stamped four days later. Lodestone's own published model list, revised on the same September 24, still recommended Qwen 2.5 seven months after Qwen3.5 shipped, and was brought current four days later. The field moves faster than any article's revision cycle, so this ranking will be re-run each quarter against the same criteria.

A model is matter organised by intelligence, and its hand was put there by the people who trained it. Taking up one's own substrate at the inference layer means knowing whose hand that was, keeping the refusals one wants and removing the ones one does not, and building toward the model whose hand is one's own.

---

*See also: [[Inference Sovereignty]], [[The Sovereign Stack]], [[The Sovereignty of the Mind]], [[The Sovereign Substrate]], [[The Telos of Technology]], [[AI Alignment and Governance]], [[Lodestone]].*