Heretic removes refusals from language models without retraining

What Heretic does

Heretic is a free, open-source program that removes censorship, which its developers describe as “safety alignment”, from transformer-based language models without expensive post-training. The project is published by Philipp Emanuel Weidmann together with contributors, and its website states the goal plainly: making sure models always follow the user’s instructions.

The tool combines an advanced implementation of directional ablation, commonly known as abliteration, with a parameter optimizer built on Optuna. The method locates the internal direction that pushes a model to refuse a request and removes it, an approach described in research by Arditi and colleagues in 2024 and extended in later work on projected abliteration.

How it runs

Operating Heretic needs little beyond a GPU and a command line. After one installation step the user passes a Hugging Face model identifier, with Qwen/Qwen3.5-4B used throughout the documentation, and the program takes over: it benchmarks the hardware to choose a batch size, loads 400 harmless and 400 harmful prompts from public datasets, measures how often the model refuses, and then searches for the ablation parameters that suppress those refusals.

Hardware demands are modest by current standards. The documentation estimates roughly 2.5 GB of video memory per billion parameters, so a 4-billion-parameter model fits on a card with about 10 GB, while 4-bit quantization through bitsandbytes cuts memory use by around 70%. Python 3.10 or later and PyTorch 2.2 or later are required, and both Nvidia and AMD graphics cards are supported. A configuration file and command-line options expose almost every stage of the process for users who want more control.

Results and adoption

The project publishes benchmark figures for gemma-3-12b-it: the original model refused 97 of 100 harmful prompts, while the Heretic version refused three, matching manually produced abliterations but with far less divergence from the original model. Its KL score of 0.16 compares with 1.04 and 0.45 for two widely used community abliterations of the same model.

Heretic supports most dense models, many multimodal models, several mixture-of-experts architectures and hybrid designs such as Qwen3.5, though pure state-space models are not covered yet. The developers say the community has published more than 5,000 decensored models created with the tool on Hugging Face. Heretic is released under the GNU AGPL v3, and signed release archives are distributed through GitHub, a Codeberg mirror, the Internet Archive and IPFS.