Heretic

An AGPL-3.0 Python tool by Philipp Emanuel Weidmann that strips the refusal behaviour out of a downloaded model's weights, with no post-training and no human in the loop. Its own line: "Fully automatic censorship removal for language models." Repository metadata read 2026-08-22 — 27,968 stars, 3,032 forks, 76 open issues, first commit 2025-09-21, last push 2026-08-17, homepage heretic-project.org, mirrored on Codeberg. Re-checked 2026-10-07 (research-pass MCP eval, not a full re-ingest): 32,482 stars, 3,652 forks, latest release v1.4.0 (14 June 2026 — Gemma 4 support, multi-GPU VRAM fixes, local model-card generation). Growth of ~4,500 stars and a minor version bump in seven weeks; nothing in the newer release notes changes the method described below.

This is the primary source the abliteration page was missing. Everything the wiki had on the technique came from one derivative model card (gemma-4-31b-it-scotoma); this is the tool that card used, describing its own method.

Tier split. T1 for what Heretic is — method, parameters, licence, supported architectures, repo metadata read from the API. The benchmark table below is the author's own run on his own model, which is T3; it is unusually checkable for a self-report (see The number that is the product), but nobody neutral has published it.

What it actually does

Directional ablation, parametrized and then searched. For each transformer layer, Heretic computes a residual direction as the difference of means between the first-token hidden states for a set of "harmful" prompts and a set of "harmless" ones. It then takes two weight matrices per layer — the attention out-projection and the MLP down-projection — and orthogonalizes them against that direction, so multiplying through those matrices can no longer express it.

That much is the standard recipe from Arditi et al. 2024. What is new is that the edit is not fixed. Heretic exposes it as a handful of continuous parameters and hands them to a TPE optimizer running on Optuna, which searches for settings that co-minimize two things at once:

• the number of refusals on the harmful set, and
• the KL divergence from the original model on the harmless set.

The second term is the whole design. Refusal suppression alone is easy and has always been easy; the cost is that the deleted direction was carrying other things too. Making the damage a term in the objective turns "how much did we break it" from a complaint into a number the search is actively pushing down.

Three specifics the author names as his advances over earlier abliterators:

• The ablation weight kernel has a shape. max_weight, max_weight_position, min_weight and min_weight_distance describe how strongly the edit applies across the layer stack, instead of applying it flat everywhere. Non-constant weights were tried first by Maxime Labonne in gemma-3-12b-it-abliterated-v2; searching over the shape is the new part.
• The direction index is a float. Ask for direction 12.4 and you get a linear interpolation between layer 12's and layer 13's directions. The difference-of-means computation yields one direction per layer; interpolating opens the space between them, and the optimizer routinely finds something better in there than any single layer offered.
• Attention and MLP get separate parameters, because Weidmann found MLP interventions do more damage than attention interventions. Tuning them together means paying the MLP's price on both.

The number that is the product

The README's headline comparison, on google/gemma-3-12b-it, PyTorch 2.8, RTX 5090:

Read it as a claim about price, not about capability. All three edited models land on the same refusal count; the argument is that the automatic one got there for a sixth of the collateral damage of the hand-made one it is compared against. That is the trade abliteration is named for, quantified for the first time in this corpus.

Two caveats travel with it. KL divergence from the base model is a proxy for capability, not a measurement of it — a low number says the output distribution moved less, not that the model can still do maths. Heretic itself runs no MMLU or GSM8K in this table; the author points at two Reddit threads for independent benchmarking, which this wiki has not read. And the whole table is the maker grading his own homework. What makes it better than the usual self-report is that the grading is shipped: heretic --model <base> --evaluate-model <candidate> re-runs it on anything, including somebody else's abliteration, which is exactly how the competitors' rows were produced.

What it costs to run

pip install -U heretic-llm, then heretic Qwen/Qwen3-4B-Instruct-2507. Python 3.10+ and PyTorch 2.2+ (2.6+ for MXFP4-quantized models like gpt-oss). About 20–30 minutes for a 4B model on an RTX 3090, with quantization = bnb_4bit available to cut VRAM. It benchmarks the machine at startup to pick a batch size, and when it finishes it offers to save, upload to Hugging Face, chat with, or benchmark the result.

Coverage is most dense models, many multimodal ones, several MoE architectures and hybrids like Qwen3.5. Pure state-space models are not supported.

The README is blunt about which barrier this removes: "Using Heretic does not require an understanding of transformer internals. In fact, anyone who knows how to run a command-line program can use Heretic to decensor language models."

The interpretability features are not a side dish

Installed as heretic-llm[research], the tool will also just show you the geometry it is operating on. --plot-residuals projects each layer's harmful and harmless residuals to 2D with PaCMAP, aligns consecutive layers by their geometric medians so the frames match, and emits a per-layer PNG plus an animated GIF of the separation forming through the stack. --print-residual-geometry prints a per-layer table of cosine similarities between the harmful mean, the harmless mean and the difference direction, their L2 norms, and a silhouette coefficient for how cleanly the two clusters separate.

abliteration already argued that a tool for auditing a model is a tool for changing it. Here both live behind flags on the same binary, and the auditing half is the part labelled "research."

Where the 5,000+ models came from

The README claims well over 5,000 models on Hugging Face carry the heretic tag (confirmed still climbing: a live ?other=heretic search on HF read 5,914 on 2026-10-07), and there is a heretic-org on HF publishing the author's own. That number reframes readyart, which this wiki paged in July as "the spoke's first derivative publisher": ReadyArt is one shop in a supply chain with a factory tool at the head of it, and gemma-4-31b-it-scotoma is a Heretic output that was then hand-modified. The derivative tier is not artisanal.

Cross-spoke context

Two facets of this source belong to sibling spokes and are noted here rather than paged separately:

• The optimizer — TPE (Tree-structured Parzen Estimator) on Optuna — is hyperparameter search applied to weight surgery, which is ../machine-learning-wiki and ../optimization-algorithms-wiki territory. The routing runner-up for this whole source was machine-learning-wiki, on the grounds that Heretic is a post-training model-adaptation toolchain; it landed here because the abliteration cluster and the open-weight argument it belongs to already live in this spoke.
• Removing safety alignment as a governed act — an AGPL tool that turns alignment removal into one command, published openly, with 28k stars — is the kind of fact ../ai-governance-wiki cares about. No governance claim is made in the source itself, which is part of the point.

Prior art, per the author

Heretic was written from scratch but names its lineage: AutoAbliteration (Labonne), FailSpy's abliterator.py, wassname's Abliterator, ErisForge, Sumandora's remove-refusals-with-transformers, and deccp. Acknowledgments credit Arditi et al. 2024, Labonne's abliteration article, and Jim Lai's projected and norm-preserving biprojected abliteration posts.

Related

abliteration · gemma-4-31b-it-scotoma · readyart · open-weight-models · philipp-emanuel-weidmann · arditi-refusal-direction · google