Heretic removes restrictions from language models
Heretic is an open-source tool that “abliterates” safety layers from language models, using directional ablation to dramatically reduce refusal rates while aiming to preserve general quality. Commenters highlight its practical value for legitimate tasks that hosted models often block—such as reverse-engineering hardware you own, testing CVEs on your own infrastructure, or bypassing restrictive vendor ecosystems—while warning that underlying training data may still lack sensitive knowledge and that quality can degrade. The project raises broader questions about whether uncensored models should or can be outlawed, the limits of current techniques for detecting backdoors or hidden behaviors in open weights, and the trade-off between safety controls and user autonomy.
Technical approach and metrics
- Heretic automates “abliteration” by probing models with both refused and allowed prompts, then editing weights so their internal representations converge, reducing refusals.
- Some see the claims as overstated, arguing refusal counts and KL divergence can exaggerate impact; others respond these are standard metrics in the literature.
- There is curiosity about whether a similar technique could ever apply to brains, but participants note we lack a granular theory of neural computation.
Model behavior and quality after abliteration
- Several users report that ablated models stop refusing but still give poor or incoherent answers on previously blocked topics (e.g., weapons, extremist content), as if “part of the reasoning” was damaged.
- Others say quality drop is small on many tasks, especially for certain mid‑size open models; some describe specific ablated variants as “much better” than older uncensored attempts.
- It is repeatedly stressed that removing refusals does not add knowledge; if training data was censored or curated away, the model may simply hallucinate.
Training, safety layers, and backdoors
- One line of discussion: in many models refusals are primarily a post‑training layer, so underlying knowledge often remains, especially for political topics.
- Another concern: open‑weight models can in principle be backdoored with hidden triggers that are effectively impossible to systematically discover with current interpretability tools.
- Counterpoint: openness at least allows independent analysis and reproducible bugs, unlike closed, hosted models where targeted abuse is harder to detect.
Practical uses and security work
- The most praised use cases are “boring” but blocked by hosted models: reverse‑engineering protocols, exploiting CVEs on one’s own network, unlocking or re‑flashing owned devices, or building tools around proprietary hardware.
- Some argue current safeguards hinder defenders more than attackers, since attackers can still use uncensored or offshore models and only need to succeed once.
Legal, ethical, and access debates
- There is disagreement over whether ablated models will or should be outlawed:
- One side says enforcement would mirror torrents or drugs—banned in law but hard to suppress.
- Others warn that even symbolic bans give authorities tools to target users.
- Proposals range from full legality to age‑restricted access, with concerns about minors or unstable individuals using strong local models.
- Several comments frame math and matrix operations as protected speech and see bans as a form of censorship.