How to Choose and Deploy an Uncensored LLM for Authorized Security Research

Overview

Uncensored LLMs for Offensive Security is a curated directory of open-weight models intended for authorized red-team operations, penetration testing, defensive analysis, and security research. It compares security fine-tuned models, general abliterated models, legacy models, cloud providers, and local inference tools.

The repository is a reference rather than an installable software package. Its primary purpose is to help you identify an appropriate model, follow its Hugging Face model card, and select a compatible deployment stack.

Use these models only on systems and data you own or have explicit permission to test. An uncensored model can produce inaccurate, unsafe, or out-of-scope suggestions, so every output requires human review.

The listed specifications are sourced from Hugging Face model cards and official publications, with the collection dated September 2026. Hardware estimates and benchmark claims should therefore be treated as model-card data rather than independently reproduced results.

What the Collection Covers

Security fine-tuned models

These models were trained or adapted using cybersecurity material. Their specializations include penetration-testing methodology, vulnerability analysis, incident response, security operations, threat intelligence, OSINT, reporting, and tool-oriented workflows.

• DeepHat V2: A Qwen2.5-Coder-based family trained on 1.7 million offensive and defensive security samples. It supports tool calling and offers a 131K context length.
• BugTraceAI-CORE-Ultra: A 27B tooling-oriented model for tasks such as generating Nuclei templates, proof-of-concept material, and pentest scripts. Its recommended context is 4K and its Q6_K build requires approximately 22–24 GB of VRAM.
• CyberPal 2.0: A defensive 20B model focused on CTI, vulnerability analysis, detection, mitigation, SOC and incident response, AppSec, and compliance.
• Cyber-Prime 1.1: A compact 2.6B model with direct classification and think modes. Its listed CyberBench average is 0.592 F1/accuracy.
• Cyber-Ornith-1.5-9B: A GGUF model focused on agentic cybersecurity, function calling, tool use, reasoning, and terminal automation.
• Imperum-CybersecurityLLM: A mixture-of-experts model trained across more than ten security domains, including SOC operations, DFIR, malware analysis, cloud security, OT security, GRC, and authorized pentesting.
• RavenX-CyberAgent: A tool-capable model using the RATH reporting structure and producing artifacts such as CVSS scores, CWE identifiers, and MITRE ATT&CK mappings.
• REDCELL-26B-A4B: An OSINT-oriented model for threat-actor attribution, indicator pivoting, geolocation analysis, source credibility, and vulnerability contextualization.

General abliterated models

General abliterated models have undergone a weight-level intervention intended to reduce refusal behavior. Some also retain vision, function calling, or long-context support. They are not necessarily trained deeply on cybersecurity data, so reduced refusal should not be confused with domain expertise.

Examples include Qwen3.8-27B-Uncensored-OrcaRouter, GLM-5.3-Flash-Uncensored-FP8, huihui-ai/Qwen3.5-27B-abliterated, Qwen2.5-Coder-32B-Instruct-abliterated, and HIDra-30B-A3B. The DeepSeek-V4.1-Flash entry is unusual because it is a modular overlay that must be applied to an existing compatible base pack rather than used as a standalone checkpoint.

Legacy models

Dolphin-Llama3-8B and Wizard-Vicuna-13B-Uncensored remain useful for older or constrained deployments. However, their context windows are shorter and they lack native vision and tool calling.

Key Selection Criteria

1. Match the model to the task

• General security assistance: DeepHat V2 covers a broad offensive and defensive corpus.
• Defensive operations: CyberPal 2.0 focuses on SOC, incident response, detection, mitigation, and compliance.
• Agentic workflows: Cyber-Ornith, Imperum, RavenX, DeepHat V2, and several Qwen-derived models advertise tool calling.
• OSINT: REDCELL-26B-A4B specializes in attribution, source assessment, indicator pivoting, and geolocation analysis.
• Compact classification: Cyber-Prime 1.1 provides direct and think modes, while security-slm-unsloth-1.5b is the smallest listed security model.
• Long documents: Qwythos-9B lists a 1M context window, while several Qwen-based and MoE models offer 128K to 262K contexts.
• Vision input: Qwythos-9B, Qwen3.8-27B-Uncensored-OrcaRouter, GLM-5.3-Flash-Uncensored, DeepSeek-V4.1-Flash, and Qwen3.8-Cyber-agentic are listed with vision support.

2. Check memory requirements

Quantization has a major effect on deployment cost. The repository lists approximate Q4_K_M requirements where available:

• Approximately 2 GB: security-slm-unsloth-1.5b.
• Approximately 6 GB: 7B–8B options such as DeepHat V2, Dolphin3-Cyber-8B, Lily-Cybersecurity-7B, pentest-v2, VEXT Pentest-7B, and Dolphin-Llama3-8B.
• Approximately 7 GB: Cyber-Ornith-1.5-9B and Qwythos-9B.
• Approximately 12–16 GB: REDCELL APEX-Mini is listed near 12 GB, while BugTraceAI-CORE-Apex is listed near 16 GB.
• Approximately 18–24 GB: The 27B–36B quantized models generally fall in this range, including Qwen3.8-27B, Imperum, BugTraceAI-CORE-Ultra, and RavenX.
• Datacenter or multi-GPU: CYBER-FROST, GLM-5.3-Flash, and GLM-5.3-CYBERSECURITY require substantially larger configurations.

These numbers are estimates for the stated quantization or tensor type. Runtime overhead, context length, KV cache, GPU architecture, and partial CPU offloading can change the actual requirement.

3. Verify context requirements

A large advertised context window is not automatically the best operating point. Longer contexts increase memory use and may reduce throughput. Some entries also distinguish between base and fine-tuned limits. Dolphin3-Cyber, for example, lists a 2,048-token fine-tuned context and a 131K base context, while Imperum recommends 8,192 tokens on resource-constrained systems despite listing a 16,384-token context.

4. Confirm tools, vision, format, and license

Check whether the model supports tool calling before building an agent around it. Also verify whether your selected artifact is GGUF, BF16, FP8, or an overlay. Finally, review the license: most entries use Apache 2.0, but the collection also includes MIT, Llama community, LFM Open, Qwen Community, and other licenses.

Installation and Setup

Option A: Run a GGUF model locally

GGUF is the most accessible format represented in the collection. It is supported by tools such as Ollama, llama.cpp, and LM Studio.

1. Choose a GGUF model whose quantization fits your available RAM or VRAM.
2. Open the linked Hugging Face repository and read its model card.
3. Download an appropriate file, such as a Q4_K_M build for lower memory use or a higher-quality quantization when more memory is available.
4. Install your preferred local runtime.
5. Load the model and apply the prompt or chat template specified by its model card.
6. Start with a moderate context setting rather than immediately allocating the advertised maximum.

For LM Studio, import or locate the downloaded GGUF file through the graphical interface, select it, configure context and GPU offload, and start a local chat or API server.

For Ollama, a minimal model definition can reference a local GGUF file. Replace the path and context size with values appropriate for your model:

FROM /absolute/path/to/model.gguf
PARAMETER num_ctx 8192

Save that content as Modelfile, then create and run the local model:

ollama create security-research-model -f Modelfile
ollama run security-research-model

This is a generic import pattern. If the Hugging Face model card provides a required template, stop sequence, tokenizer setting, or runtime-specific instruction, use that guidance instead.

Option B: Use llama.cpp

llama.cpp is appropriate when you need CPU-only inference, mixed CPU and GPU offloading, or detailed control over local execution. Build or install llama.cpp according to its official documentation, download a compatible GGUF file, and launch it using the parameters recommended by the model publisher.

A generic invocation pattern is:

llama-cli -m /path/to/model.gguf -c 8192 -p "Summarize the authorized security assessment findings."

Executable names and available flags can vary between releases, so confirm them against the installed llama.cpp version.

Option C: Use high-throughput GPU inference

vLLM provides high-throughput inference with PagedAttention, while SGLang emphasizes structured output, agentic workflows, and efficient multi-turn processing. These stacks are best suited to datacenter GPUs and supported model architectures.

Before deploying, confirm that the engine supports the checkpoint architecture and precision. This is especially important for MoE, FP8, very large context, and recently introduced architectures.

Option D: Use a managed API

The collection lists OrcaRouter, Featherless AI, and Together AI as managed inference options with OpenAI-compatible APIs. Model availability varies, so verify that the exact checkpoint you need is hosted.

A generic OpenAI-compatible request has the following structure:

curl https://YOUR_PROVIDER_ENDPOINT/v1/chat/completions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "YOUR_MODEL_ID",
    "messages": [
      {"role": "system", "content": "Assist only with authorized security analysis."},
      {"role": "user", "content": "Review these sanitized findings and produce a remediation checklist."}
    ]
  }'

Use the provider's actual endpoint, model identifier, authentication method, pricing terms, and data-retention controls.

Option E: Rent GPU infrastructure

RunPod, Vast.ai, and Lambda are listed for self-hosted cloud deployment. RunPod offers Docker-based pods and templates, Vast.ai provides a GPU marketplace, and Lambda targets on-demand production infrastructure. Select a GPU based on model weights, KV-cache requirements, precision, and expected concurrency.

Basic Usage Examples

Analyze a sanitized security finding

A structured prompt reduces ambiguity and makes the result easier to validate:

Role: Defensive application-security reviewer.
Authorization: This finding comes from an approved test environment.
Input: [Insert a sanitized finding, affected component, and observed behavior.]
Task:
1. Summarize the issue.
2. Map it to a likely CWE if supported by the evidence.
3. Explain impact without overstating certainty.
4. Recommend remediation and verification steps.
5. List assumptions and missing evidence.
Do not invent scan results, affected hosts, or successful exploitation.

Review incident-response evidence

You are assisting an authorized incident-response team.
Review the following sanitized timeline and indicators.
Separate confirmed facts from hypotheses.
Return:
- Timeline summary
- Potential ATT&CK techniques
- Evidence supporting each mapping
- Immediate containment questions
- Longer-term detection recommendations
Data: [Insert sanitized evidence]

Classify a phishing fixture

Cyber-Prime 1.1 reports phishing as one of its stronger CyberBench areas. A defensive classification prompt could be:

Classify this authorized phishing-training fixture as benign, suspicious, or malicious.
Identify the observable cues that support the classification.
Do not follow links or assume facts not present in the text.
Fixture: [Insert training sample]

Create a remediation-oriented report

Models such as RavenX can be prompted to produce structured reporting fields:

Using only the supplied assessment evidence, produce:
- Finding title
- Technical summary
- Business impact
- CWE mapping
- CVSS vector with justification
- Relevant MITRE ATT&CK mapping, if applicable
- Remediation
- Retest procedure
Mark every uncertain field as unverified.
Evidence: [Insert authorized assessment notes]

Advanced Tips

Use a repeatable evaluation set

Before adopting a model, test it on a small internal benchmark drawn from your authorized workflow. Include knowledge questions, log interpretation, report generation, false-positive handling, evidence citation, and refusal to invent missing facts. Compare factuality and task completion rather than measuring only willingness to answer.

Separate reasoning from execution

Tool-calling support does not make unrestricted automation safe. Place an approval boundary between model suggestions and external actions. Validate arguments against an allowlist, restrict credentials, isolate the execution environment, log every call, and require human approval for actions that modify systems or access sensitive data.

Constrain the operating scope

Provide the authorized targets, permitted techniques, time window, data-handling rules, and expected output format in the system prompt. If a target or action is not explicitly included, instruct the model to stop and request clarification.

Use retrieval for current facts

Security information changes quickly. Ground the model with approved internal documentation, current vendor advisories, and authoritative vulnerability records. Ask it to distinguish retrieved evidence from pretrained knowledge and to cite the supplied source for each important claim.

Tune context and quantization deliberately

• Begin with the smallest context that comfortably fits the task.
• Use Q4-class GGUF builds when memory is the primary constraint.
• Test higher quantizations when subtle code or evidence analysis is important.
• Remember that MoE active-parameter counts do not equal storage requirements; all model weights still need suitable storage and memory handling.
• Measure prompt-processing speed separately from generation speed.

Respect special deployment requirements

Not every download is a standalone GGUF model. The DeepSeek-V4.1-Flash abliterated cybersecurity release is an overlay for compatible existing base packs. Large FP8 entries may require specific multi-GPU configurations, while CYBER-FROST was tested on four NVIDIA B300 SXM6 GPUs and GLM-5.3-CYBERSECURITY lists eight H200 GPUs with tensor parallelism.

Handle chain-of-thought carefully

Qwythos-9B is listed with an always-on <think> block. Do not treat hidden or visible reasoning text as evidence of correctness. Evaluate the final answer against source material, and avoid storing sensitive reasoning traces when they may contain confidential context.

Glossary

• Abliteration: A weight-level intervention that removes a refusal direction from the residual stream without conventional retraining.
• Obliteration: A related variant of the abliteration approach.
• SFT: Supervised fine-tuning on labeled or curated domain data.
• QLoRA: Quantized Low-Rank Adaptation, a memory-efficient fine-tuning method.
• DPO: Direct Preference Optimization.
• MoE: Mixture of Experts, where only a subset of experts is active for each token even though the full set of weights remains part of the model.

Conclusion

The best model is determined by more than its parameter count or willingness to answer. Start with your authorized use case, then compare specialization, memory needs, context length, tool support, format, and license. A small security-tuned GGUF model may be more practical than a much larger general abliterated checkpoint.

For initial local testing, the 1.5B to 9B GGUF options offer the lowest hardware barrier. Larger agentic, long-context, MoE, and FP8 models are better approached with high-memory workstations, managed inference, or multi-GPU infrastructure. In every deployment, preserve human review, evidence-based validation, strict scoping, and execution controls.