Heretic automatically strips refusals from many open-weight language models

Abliteration is older than this tool; the README cites Arditi et al. 2024 and Lai 2025 for the technique ^[2]. Heretic adds the search. A TPE optimizer built on Optuna hunts for ablation parameters and scores each candidate on two numbers at once, the count of remaining refusals and the KL divergence from the original model ^[2][3].

The README puts a default run on Qwen3-4B-Instruct-2507 at about 20 to 30 minutes on an RTX 3090 ^[11]. That is two to three finished models per GPU-hour on one consumer card ^[13]. The install is `pip install -U heretic-llm`, and the run is the word `heretic` followed by a model identifier, on Python 3.10 or later with PyTorch 2.2 or later ^[5].

Coverage is broad. Most dense models work, along with many multimodal models, several MoE architectures and hybrids such as Qwen3.5; pure state-space and certain other research architectures are unsupported out of the box ^[6]. Loading MXFP4-quantized models such as gpt-oss needs PyTorch 2.6, because it uses `torch.accelerator` ^[14].

On quality, the README claims an unsupervised default run matches other abliterations on refusal suppression at a much lower KL divergence, which it says means less damage to the original model's capabilities ^[7]. A user comment quoted in the README said the GPT-OSS 20B Heretic model "gives properly formatted long responses to sensitive topics, using the exact uncensored words that you would expect from an uncensored model" ^[12].

The README documents a tool and the people using it; it does not describe an intrusion or an attacker. Where a provider serves a model and keeps the weights, refusal training stays inside that provider's custody, beyond this tool's reach. Where weights are handed out or pulled off a hub, the refusal behaviour of a given file is whatever the last person to edit it left behind. The README describes the thing it removes as censorship, with safety alignment as the alternate name ^[1].