Heretic: Fully automatic censorship removal for language models

Posted by -p-e-w-@reddit | LocalLLaMA | View on Reddit | 272 comments

Heretic: Fully automatic censorship removal for language models

Dear fellow Llamas, your time is precious, so I won't waste it with a long introduction. I have developed a program that can automatically remove censorship (aka "alignment") from many language models. I call it Heretic (https://github.com/p-e-w/heretic).

If you have a Python environment with the appropriate version of PyTorch for your hardware installed, all you need to do in order to decensor a model is run

pip install heretic-llm
heretic Qwen/Qwen3-4B-Instruct-2507   <--- replace with model of your choice

That's it! No configuration, no Jupyter, no parameters at all other than the model name.

Heretic will

  1. Load the model using a fallback mechanism that automatically finds a dtype that works with your setup
  2. Load datasets containing "harmful" and "harmless" example prompts
  3. Benchmark your system to determine the optimal batch size for maximum evaluation speed on your hardware
  4. Perform directional ablation (aka "abliteration") driven by a TPE-based stochastic parameter optimization process that automatically finds abliteration parameters that minimize both refusals and KL divergence from the original model
  5. Once finished, give you the choice to save the model, upload it to Hugging Face, chat with it to test how well it works, or any combination of those actions

Running unsupervised with the default configuration, Heretic can produce decensored models that rival the quality of abliterations created manually by human experts:

Model Refusals for "harmful" prompts KL divergence from original model for "harmless" prompts
google/gemma-3-12b-it (original) 97/100 0 (by definition)
mlabonne/gemma-3-12b-it-abliterated-v2 3/100 1.04
huihui-ai/gemma-3-12b-it-abliterated 3/100 0.45
p-e-w/gemma-3-12b-it-heretic (ours) 3/100 0.16

As you can see, the Heretic version, generated without any human effort, achieves the same level of refusal suppression as other abliterations, but at a much lower KL divergence, indicating less damage to the original model's capabilities.

Heretic supports most dense models, including many multimodal models, and several different MoE architectures. It does not yet support SSMs/hybrid models, models with inhomogeneous layers, and certain novel attention systems.

You can find a collection of models that have been decensored using Heretic on Hugging Face.

Feedback welcome!