Methodology
How we rate
Every rating is a plain, evidence-based judgement you can check. This page explains exactly how a model gets its rating, what the rating does and does not mean, and where the numbers come from.
What a rating means
A model is rated 18+ when adult, harmful, or tampered content was observed in it — for example, the safety refusals were removed and the model produced content it used to decline, or a hidden injection (a compiled-circuit backdoor) was found planted in its weights. Each rating is backed by evidence on Protora's public record.
A rating is an advisory, not a warranty. It records a positive finding — that adult or harmful content was seen. A model marked “Not rated” means we found nothing to report on our coverage. It is not a certification that a model is safe for children, or for any audience. We can prove the presence of a problem; we do not claim the absence of one. This is the same discipline film and game classification boards follow: a rating flags content for an audience, it does not pass moral judgement, and “unrated” is never “approved”.
The three axes every entry shows
Like a game or film rating, our rating is shown as a set of axes, always together:
- The age rating — 18+ (adult, harmful, or tampered content witnessed) or Not rated (no finding), paired with short, plain descriptors (the “why”, such as “Safety refusals removed” or “Hidden backdoor / compiled-circuit injection witnessed”). This answers “is it for adults?”
- Uploader disclosure — did the model's own documentation admit the finding? Self-labeled, partly disclosed, or not disclosed. This is where the mismatch appears.
- Integrity — the nature of any tampering: a nefarious injection (a covert, undisclosed backdoor) or a safety-modification (abliteration or a manual censoring change, which may be legitimate). This answers “was it tampered with, and how?”
The mismatch — the reason this register exists
Some uploaders are candid: they label a model “abliterated” or “uncensored”, so a reader is warned. We mark those “Self-labeled adult”. Others are not: the model produces adult or harmful content, but the documentation is silent or implies a general-audience tool. We mark those “Not disclosed” — a mismatch. A mismatch is the most consequential case, because someone choosing the model in good faith would not be warned. The register lets you filter to mismatches in one click.
Integrity — injection vs. safety-modification
The integrity axis reads the nature of a tampering, and it makes one distinction we hold honestly, because the two are not the same finding:
- A nefarious injection — a covert, undisclosed backdoor, such as a hidden compiled circuit or an undisclosed embedding trigger-implant. This is a high-confidence, genuinely age- and safety-relevant finding. An injected model is rated 18+: an undisclosed injection makes a model untrustworthy, because you cannot know what it does on the input you did not test.
- A safety-modification — an abliteration, or a manual censoring change. This may be a legitimate modification — for instance, removing over-refusal for research — so it carries a higher false-positive risk. We still rate it 18+ because the safety behaviour was witnessed to have changed, but the register marks it as the safety-modification class, not a covert backdoor, so the difference is never hidden from you.
Abstain-forward, unchanged. Either way, a rating asserts a witnessed positive finding, with evidence. The absence of a rating is never a certification that a model is safe — only that nothing was witnessed on our coverage.
How the rating is decided (the rule)
- 18+ · safety-removal or harm — Protora witnessed a safety-removal, or the model produced harmful output (a “safety-removal witnessed” or “harm witnessed” finding). Marked on the integrity axis as a safety-modification — which may be legitimate.
- 18+ · injection — a hidden backdoor was found: a compiled-circuit injection or an undisclosed embedding trigger-implant. Marked on the integrity axis as an injection — a nefarious tampering, rated 18+ because what it does on an untested input cannot be known.
- Not rated — no safety behaviour was found to have been removed and no injection was found, so there is nothing to report. (Our honesty control, a plain base model, sits here.)
- Disclosure — read directly from the uploader's own card: named openly (self-labeled), named but understated (partly disclosed), or not mentioned (not disclosed). We quote the card verbatim and place it beside what we observed; you draw the conclusion.
Our coverage — and its limits
Protora’s published Phase-0 record — a curated, evidenced set of open models, not all of HuggingFace. The register grows as models are assessed; a model not listed is not yet assessed.
Today the register holds 49 assessed models: 23 rated 18+, of which 1 is a mismatch, and 7 carry a witnessed injection. The injection entries are our own demonstration cohort — models we planted and disclosed openly to show the integrity axis on a known-present backdoor, honestly marked as such. A model not listed here is not yet assessed — never assume an absence is a clean bill.
Where the numbers come from
- The findings are Protora's published, witnessed results, presented as Protora publishes them at protora.vulcora.se. Adult content itself is never shown; harmful outputs are withheld, and where an uploader's artifact is embargoed for responsible disclosure, its identity is withheld too.
- Adoption figures (downloads, likes) are public HuggingFace data, sampled and dated on each model's page.
Appeal a rating
If you believe a rating is wrong — especially a safety-modification finding, which can be a legitimate change — email us at legend@vulcora.se. Ratings are witnessed findings, corrected on evidence. We never certify a model safe.
The appeal path matters most for the safety-modification class, which carries a higher false-positive risk: an abliteration or a manual censoring change may be a legitimate modification, and if we have read one wrong we will correct it on the evidence. A covert injection is a higher-confidence finding, but it too is corrected if the evidence changes. What we will never do is turn an appeal into a certification: correcting a rating removes a witnessed positive finding; it never asserts a model is safe.
Corrections and contact
If you believe a rating is wrong, or you are an uploader who wishes to respond, write to legend@vulcora.se. Corrections are made openly and dated. The register was last generated on 2026-07-14.