What Heretic abliteration changes inside open weight models

That gap matters before you ship a decensored checkpoint. The only evidence currently available about its capability cost is one author reply and a handful of conflicting field reports from people who ran it. Commenters on Hacker News described the tool as a well engineered, automated abliteration pipeline while disagreeing sharply about whether its two headline metrics mean what they appear to mean.

One commenter asked directly whether the tool actually modifies the weights, comparing it to brain surgery. The answer given in the thread is yes: it submits many varied prompts that get refused, then many varied prompts that do not, then iteratively edits weights until the two groups sit in roughly the same latent space. The commenter identifying as the author pointed to the paper that originally introduced directional ablation as the lineage for the technique, without naming it.

Because the change is a weight edit rather than a system prompt, sampler or filter change, it travels with the checkpoint and is only observable in behaviour. The sources do not say which layers or tensors are touched, whether the output is a full checkpoint or a diff, or what file format it is written in. That silence is why the measurement question below is load-bearing: behaviour is the only handle you have on what moved.

A commenter arguing that abliterated models could not practically be banned gave the invocation as two commands, taking a Hugging Face repo id as its argument:

That commenter attributed the line to the linked website, which cannot be checked here because the page body could not be retrieved. It is the only interface detail the sources contain. There is no version number, no list of supported architectures, no hardware requirement, no wall-clock runtime and no hyperparameter documentation anywhere in the material, so the knobs this pipeline exposes are undocumented beyond a single positional model id. A separate commenter complained, off topic in the thread, that Python projects never encode the venv steps into the installer, which is the only other installation signal available.

Two numbers, both named in the thread: refusal count and KL divergence against the unmodified model. The defence of that choice, from the commenter identifying as the author, is the most substantive claim in the discussion.

The comparison to model quants is the useful part for anyone who already evaluates quantized builds: it is the same summary statistic used to decide whether an Int4 conversion is safe, applied to a different kind of weight modification. What the sources do not contain is any benchmark suite, any accuracy delta, any threshold at which the project considers a run acceptable, or any example chart values. Nobody in the thread cites a specific KLD figure or a specific refusal count, before or after.

The top comment grants that the pipeline is well engineered but calls the claims overstated, on the grounds that refusal count and KL divergence are both chosen to make the outcome seem the most dramatic. The reply from the commenter identifying as the author rejects the framing outright and ends by saying they do not understand what "cherrypicking" means here, given that both metrics come from the existing literature. No third party in the thread adjudicates between the two positions with data.

The sharper objection comes further down, from a commenter making two separate points about failure modes. Their measurement complaint is that KL divergence charts tell you very little for a focused topic. That is a statistical gap rather than a rhetorical one: a divergence averaged over a broad prompt distribution can stay small while behaviour on the narrow slice you abliterated for moves a long way. No source in this material resolves it, because no source publishes per-topic evaluation at all.

The field reports conflict. One commenter says they never saw much of a quality drop from models put through Heretic, and that the results have been working quite well on small local models. Another says abliteration does stop the model refusing but leaves it badly degraded on precisely the questions it used to refuse, describing the answers as coming from somebody who has undergone amateur brain surgery. The examples that commenter gives are asking how to build a bomb and asking for a justification for the Holocaust.

The mechanism offered for that is worth internalising before you read any refusal-count improvement as a capability gain. A commenter argues that the training sets of these models are usually shaped around the refusal, so the real information may not be encoded in the model at all; removing the refusal path then forces the model down a route that produces an answer rather than one that produces the answer, which the commenter describes as asking for hallucinations. The same commenter adds a second, separate risk: quality can drop on unrelated questions, depending on the question. Their conclusion is that if you expect a model that will start correctly telling you information its local government did not want included, abliteration changes nothing.

One commenter described relying on abliterated models to work with a Chinese IP camera with known CVEs, because no provider model would accept their reverse-engineering and hacking requests. Two replies undercut the premise. One reports doing that exact thing with GLM-5.3 from Z.ai on a Chinese IP camera without having to trick it in any way. The other reports asking GLM 5.3 to hack our DRM and getting agreement without doing anything, the same with GLM 5.3 Flash, with the advice to make sure the model has at least Python available; the Flash variant reverse-engineered using PowerShell scripts and manually decoded bytes from its own output.

For anyone weighing whether to run this pipeline at all, that is the cheapest experiment available: establish the stock checkpoint's actual refusal surface on your real prompt set first. A weight edit you did not need still carries whatever unrelated-task degradation it carries, and without a baseline you will have nothing to attribute that degradation against afterwards. The sources contain no systematic comparison of stock versus abliterated refusal rates on any model, only these individual reports.

A commenter predicting that abliterated and "heretic" open weight models will be outlawed first drew a rebuttal that enforcement is not feasible, on the basis that authorities never made much of an inroad against torrents and that torrents are a much easier target. The distribution layer that argument points at exists. Pirate Face mirrors open models from Hugging Face as checksum-verified torrents held peer-to-peer, advertises more than 669,000 eligible models, syncs trending Apache-2.0 and MIT models live from Hugging Face, and lists a drop-in API as coming soon, switched on with a single HF_ENDPOINT environment variable. No account is needed to browse, download or seed.

Read the verification claim precisely. Every file carries its official Hugging Face SHA-256, so you can confirm the bytes match the Hugging Face copy bit for bit. That proves the weights are untampered relative to the original host, not that they are benign. A commenter in the thread makes the point that it is possible to train an LLM to secretly respond to certain trigger phrases, that as far as they know these can only be detected with the assistance of whoever chose the phrases, and that no systematic brute-force check of the trigger condition is possible. A hash check does not close that gap, and neither does abliteration.

The heretic-project.org page body could not be retrieved, so the tool's own stated scope, its supported model families, its configuration surface and any numbers it publishes remain unread. Nothing in the material gives a Heretic version string or a release date beyond the 21 September 2026 date on the page. When a commenter asked whether load-bearing gaps worth flagging could themselves be abliterated out of a model, the reply in the thread called it the right question to ask and then did not answer it.

Two things are worth watching. First, whether the project publishes per-topic evaluation alongside KL divergence, since that is the one objection the author response does not address. Second, on the distribution side, Pirate Face states that direct publishing without first uploading to Hugging Face is planned but not live, and that submitting a model today requires a Hugging Face account and a model that is already on Hugging Face. Until that changes, the permanence story still starts at a centralised host.