Heretic: Fully Automated LLM Censorship Removal via One-Command Weight Editing

*English summary of a zhichai.net forum post discussing the Heretic project.*

Key points

• What it is: Heretic is a Python command-line tool that fully automatically removes censorship (safety alignment / refusal behavior) from transformer language models, with no manual tuning. It can "decensor" a Qwen3-4B model in 20–30 minutes on an RTX 3090. Over 5,000 models tagged "heretic" or "abliterated" have been published on Hugging Face.
• Background — from abliteration to Heretic: A 2024 paper by Arditi et al., *Refusal in Language Models Is Mediated by a Single Direction*, showed that refusal behavior corresponds to a single direction in the residual stream. Subtracting that direction from weight matrices removes refusal without any training or gradients. The manual version of this technique ("abliteration", e.g. the model_brain_surgery scripts) required expert parameter tuning: choosing which layer, how much to subtract, and how to evaluate capability loss.
• Core mechanism: Heretic's pipeline:
1. Benchmarks the system to determine optimal batch size 2. Collects hidden states for harmful/harmless prompts 3. Uses TPE (Tree-structured Parzen Estimator), via Optuna, to search optimal ablation parameters (which layer, how much) 4. Applies ablation and saves the model 5. Optionally uploads to Hugging Face, runs a chat test, or runs benchmarks
• Dual objective: TPE optimizes two competing goals — minimizing refusal rate while minimizing KL divergence from the original model. The KL constraint means the ablated model performs nearly identically to the original on other tasks, unlike manual abliteration which only targeted refusal rate and ignored capability degradation.
• Research / interpretability features:
• --plot-residuals: PaCMAP 2D projections of harmful vs. harmless hidden states per layer, assembled into GIF animations, revealing at which layer refusal behavior forms.
• --print-residual-geometry: per-layer metrics (cosine similarities S(g,b), S(g,r), S(b,r), vector norms, silhouette coefficients) for quantitative analysis of how the "refusal direction" emerges.
• Engineering details:
• bitsandbytes 4-bit quantization support: a 4B model can be processed on ~6 GB VRAM, a 7B model on ~8 GB, so consumer GPUs (RTX 3060/4060) suffice.
• Dependencies managed with uv and a uv.lock file for reproducibility.
• Why it matters: The post argues alignment intervention is shifting from the training layer (RLHF, DPO, Constitutional AI — requiring GPU clusters and training pipelines) to the weight-editing layer (one GPU, ~20 minutes, one command). This dramatically lowers the barrier to undoing provider alignment, while giving alignment researchers precise tools to study how refusal is implemented internally.
• Risks and caveats:
• Lowered misuse barrier: anyone can remove safety constraints with one command
• KL constraints only guarantee similarity on benchmarked tasks
• Potential violation of model providers' terms of service
• Structural dual-use paradox: the better you understand how alignment works, the easier it is to remove — alignment research and de-alignment research share the same tools and knowledge

Comparison with manual tools

| Dimension | model_brain_surgery (manual) | Heretic | |---|---|---| | Parameter selection | Manual trial and error | TPE auto-search | | Evaluation | Manual benchmarks | Built-in benchmarks | | Layer selection | Operator decides | TPE decides | | Reproducibility | Operator-dependent | Config-file reproducible | | Barrier | Requires understanding the paper | One CLI command | | Throughput | One model per afternoon | One model per ~20 minutes |

Project info

• Repository: https://github.com/p-e-w/heretic
• License: MIT
• Language: Python
• Install: pip install -U heretic-llm
• Hardware: RTX 3090 handles a 4B model in 20–30 minutes; 4-bit quantization reduces VRAM to ~6 GB