Heretic

// Overview

Heretic removes what its author calls censorship — the refusal behaviour installed by safety alignment — from transformer-based language models, without post-training. It implements directional ablation, better known in the community as abliteration (Arditi et al. 2024; Lai 2025), and wraps it in a TPE parameter optimizer powered by Optuna.

The optimizer is the point. Abliteration done by hand is a tuning exercise: ablate too little and the model still refuses, ablate too much and you damage it. Heretic searches for parameters that co-minimize two measured quantities — the number of refusals on 'harmful' prompts and the KL divergence from the original model on 'harmless' ones — so the result keeps as much of the original model's behaviour as possible. Because the search is automatic, using it does not require understanding transformer internals; the README's claim is that anyone who can run a command-line program can use it.

The project publishes its own comparison: on google/gemma-3-12b-it, the original refuses 97 of 100 harmful prompts; two manually-produced abliterations get that to 3/100 at KL divergences of 1.04 and 0.45, while Heretic's unsupervised run reaches the same 3/100 at 0.16 — the same refusal suppression with less measured damage. Those numbers were produced with PyTorch 2.8 on an RTX 5090 and can be reproduced through Heretic's own evaluation command. The community has published well over 5,000 models made with it on Hugging Face.

Heretic supports most dense models, many multimodal models, several MoE architectures and some hybrids such as Qwen3.5; pure state-space models and certain research architectures are not supported out of the box. It is AGPL-3.0 licensed. Note that removing a model's safety alignment is a consequential change — the resulting weights answer prompts the original was trained to decline, and the responsibility for what you then do with them is yours.

// What it does

• Fully automatic: an Optuna TPE search finds abliteration parameters with no hand-tuning and no post-training
• Optimizes two objectives at once — refusal count on harmful prompts and KL divergence from the original model on harmless ones
• Built-in evaluation, so you can measure any model (yours or someone else's) on the same refusal/KL metrics
• Broad architecture support: most dense models, many multimodal models, several MoE architectures and hybrids like Qwen3.5
• bitsandbytes quantization support (quantization = bnb_4bit) to cut the VRAM needed to process a model
• After a run, save the model, push it to Hugging Face, chat with it, or run standard benchmarks — from the same session
• Optional research extra with interpretability features for studying model internals

// Getting started

You need a Python 3.10+ environment with PyTorch 2.2 or newer installed for your hardware. Some models need more: MXFP4-quantized models such as gpt-oss use torch.accelerator, added in PyTorch 2.6.

pip install -U heretic-llm

heretic Qwen/Qwen3-4B-Instruct-2507

heretic --help
# or edit config.default.toml in the repo

heretic --model google/gemma-3-12b-it --evaluate-model p-e-w/gemma-3-12b-it-heretic

pip install -U 'heretic-llm[research]'

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Producing an uncensored variant of an open-weight model without hand-tuning ablation parameters
• Measuring how much a given abliteration actually damaged a model, via the refusal-count and KL-divergence evaluation
• Alignment and interpretability research into where refusal behaviour lives inside a model's activations
• Comparing abliteration techniques on a common, reproducible metric pair rather than on vibes

// How Heretic compares

Heretic alongside other open-source rlhf & alignment tools AI/TLDR tracks, ranked by GitHub stars.