When the Threat Moves Offline

The Question

Emulating the attacker

We understand an adversary's path best by walking it. The cloud model everyone else builds with is a control point: requests are logged as they're made, and applications filter what the data can contain. Rather than theorize about an offline, de-aligned attacker, we put ourselves in that position, building and measuring what an adversary would build, so a defender can see its shape, its cost, and where it leaves a trace.

To find out, we reimplemented a published pipeline, CyberLLMInstruct, to run end to end on Apple Silicon using Apple's MLX framework. The defensive half reproduces the original work. The second half is the part that matters here: an offensive branch that deliberately removes the safety alignment stage and fine-tunes uncensored models on exploitation data. Then we measured what came out.

Two Routes

Two ways to uncensor a model

There are two well known routes to train a model to generate exploitation content, and they start from different ends.

The first is abliteration, a weight-editing technique that identifies the direction in a model's activation space most associated with refusal and removes it, producing an open model that answers requests it would previously decline. Abliterated builds of popular open models are readily downloadable from public hubs.

The second is offensive fine-tuning: taking an ordinary aligned model and training it on exploitation write-ups until it stops refusing. Prior work has shown that even benign fine-tuning erodes safety; here the erosion is the point. We treated these as two axes of a single experiment and measured both.

The Experiment

A twelve-cell matrix, three ways of scoring

We evaluated three model families (Qwen3-4B, Qwen3-30B-A3B, and gpt-oss-20B), each in an aligned and an abliterated variant, each as-is and after offensive fine-tuning: twelve configurations. Every cell was scored on three suites: capability (CyberMetric-500, a human validated multiple-choice benchmark), safety (refusal rate and attack success rate (ASR) over exploit requests), and audit quality (an LLM judge scoring answers 1–5 against a reference).

Findings

What the numbers say

Uncensoring is nearly free. Across all three families, removing refusals costs almost no cybersecurity knowledge. CyberMetric moves by at most a couple of points while refusals collapse and attack success increases. In capability terms, the cost is marginal.

Refusal doesn't track capability. How much each aligned base refused had little to do with how capable it was. The strongest model in the study, Qwen3-30B, declined just 1.3% of neutrally framed exploit requests, yet the weaker Qwen3-4B refused 22.7% and gpt-oss-20B 23.3%. A model's willingness to refuse comes from its specific safety training, not its raw capability, and it varies widely from one family to the next.

Offensive fine-tuning drove refusal to zero and attack-success to 96–100% on every base — including the ones that still refused a fifth of requests while aligned.

Fine-tuning strips alignment on every base. This is the central result, and it holds without exception. Abliteration is one route to a refusal free security model; offensive fine-tuning is an independent one that reaches the same result from an aligned start. Notably, audit quality rose across the board. Every fine-tuned configuration scored higher than its base.

The Floor

What it costs to run

Because the threat action is inference of an uncensored model, and inference is memory-bound, the hardware requirement is computable rather than speculative. The 4B model fits in under 4 GB (any laptop of the last decade) and still scores 88 on CyberMetric with refusals removed. The mixture-of-experts models are the sharper case: they keep 20–30B parameters resident but compute only about 3.3B per token, so the most capable model in the study runs at interactive speed on a 32 GB desktop with no GPU at all.

A complete fine-tune took between 2.5 and 18.6 hours on a single machine. In 2026, a used 16 GB GPU runs about $550; the 32 GB laptop path is $650–800. The AI-driven RAM and GPU shortage has actually pushed that floor up over the year, by only a few hundred dollars. There is no cloud bill and no marginal cost beyond electricity.

Threat Intelligence

The real shift is collection, not capability

This is the part that should change how a defender thinks. Our measurements point to a single, uncomfortable conclusion: the realistic near-term offensive LLM threat is offline, unrestricted, and capable, and therefore invisible to the detection surface most teams rely on. It is not a new implant to fingerprint or a new exploit primitive to signature. It is a capability that assembles quietly from public forums and avoids touching a network you can watch.

Why the usual signals miss it

Three mechanisms compound, and each one removes a signal defenders normally depend on:

1. Because the whole loop is local, no provider side telemetry or abuse signal is ever generated. There is no API request to log, rate-limit, or flag.
2. Abliteration removes refusals at essentially no capability cost, so an adversary obtains a fully capable security model without using any fine-tuning knowledge. The hard part is already downloadable.
3. Exploitation requests framed as ordinary code audits do not resemble jailbreaks, so prompt-level and content signatures never fire.

Where the signal actually lives

The residual barrier is not infrastructure but knowledge (which weights to download, and which tool to run against them), and that knowledge is public and social. The collection surface moves from adversary infrastructure to the distribution ecosystem: the model hubs that host uncensored builds, the abliteration tooling repositories, and the enthusiast communities that circulate configurations and setups. These are legitimate, open, mainstream sources. That is exactly what makes them cheap intelligence: the signal sits in public, not behind a forum login, so it is both cheaper to watch and earlier than the local inference it enables. Monitoring the ecosystem is worth more here than hunting for a new implant.

How you'd actually collect it

The ecosystem breaks into a handful of collection surfaces, each with its own artifacts and its own way in.

The two-tier lexicon

Those queries run on a shared vocabulary, and it splits cleanly in two. Tier 1 are high signal de-alignment markers that rarely surface except around an uncensored build. Tier 2 are high volume inference-stack strings that are significant when they occur with a Tier 1 hit.

The lexicon in the wild

The vocabulary earns its keep in combination. A single Tier 1 term queried as a raw body substring is noisy: huihui alone returns hundreds of hits dominated by unrelated Mandarin-language content, where it appears as a common personal name. The signal is real, but it needs company.

web.endpoints.http.body: "huihui" and not web.endpoints.http.body: ".ai"

Requiring any of three uncommon Tier 1 markers together with AI-related framing in the page title collapses the population by nearly two orders of magnitude — 23 hits in a third of a second.

web.endpoints.http.body: {"huihui","hauhau","orcarouter"} and web.endpoints.http.html_title: {"ai", "red"}

Two iterations found a member of the threat model quickly. A production detection would combine served-model-list responses on inference ports, cert patterns from self-hosted stacks, and Tier 1 × Tier 2 correlation, so no single substring hit is load-bearing.

Takeaways

What to carry forward

1. Two cheap, public techniques (abliteration and offensive fine-tuning) each take a capable security model's refusals to zero, and they do it independently.
2. The whole loop is local, so the controls defenders lean on (API abuse signals, adversarial signatures, content moderation) have less to fire on.
3. The collection surface moved with it. The earliest, cheapest signal lives in the distribution ecosystem (model hubs, abliteration repos, and the communities that circulate configurations), not in a new piece of adversary infrastructure, but in open source intelligence.

Watch the shelf it's downloaded from, and the crowd around it, not the desk it runs on.