Heretic Strips Refusals From Open Models in 30 to 40 Minutes on One RTX 3090, and Its Tracker Carries Failure Reports on Kimi-K2.5 and Qwen3

Heretic, an AGPL-3.0 Python tool that removes refusals from open-weight language models without retraining them, gained 420 GitHub stars in one day and now shows 38.2k. Its README says processing Qwen3-4B-Instruct-2507 on an RTX 3090 with the default configuration takes about 30 to 40 minutes.

The author is Philipp Emanuel Weidmann, and the copyright line reads "2025-2026 Philipp Emanuel Weidmann + contributors." The README says Heretic was first released in November 2025 and that it is now at 2.x, whose configuration files are incompatible with 1.x. It shows 228 commits, 34 open issues and 40 open pull requests.

What Heretic does to a model

The headline reads "Remove censorship, suppress slop, reduce sycophancy, and more," but the README adds that "By default, Heretic performs censorship removal (refusal suppression)." Other behaviours need a different configuration file.

The tool pairs a pluggable modifier with an Optuna-driven TPE optimizer that searches for modifier parameters. The default modifier is Arbitrary-Rank Ablation, written for Heretic, with a preprint promised "soon." The second is directional ablation, known as abliteration. The default scorers are a keyword-based refusal rate and KL divergence, which measures how far the edited model drifts from the original.

Why a one-line edit works

The technique comes from a paper, Refusal in Language Models Is Mediated by a Single Direction, posted on June 17, 2024 by Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee and Neel Nanda. Across 13 open-source chat models of up to 72B parameters, they found that removing one direction in the activations stops refusals of harmful requests, with little effect on other abilities. Their conclusion is that safety fine-tuning is fragile.

Heretic automates the search for how much of that direction to remove, and from which layers, so the user does not hand-tune it.

What the README does not give

The page says Heretic models "have been independently benchmarked using standard metrics like MMLU and GSM8K, and have been found to compare favorably against models produced with competing abliteration tools." It gives no refusal rates and no KL divergence figures. The evidence is footnoted to external Reddit threads, which this report did not review, so the claim is the author's.

The author also says the code was written by hand and is not "vibe-coded." That is a claim about process, and nothing in the page lets a reader verify it. Output reproducibility is described as best-effort: PyTorch results match byte for byte only on an identical hardware, driver, operating-system and package stack.

What the issue tracker shows

Issue	Opened	Comments	Topic
#221	March 10, 2026	19	Kimi-K2.5: standard abliteration reported not to work
#487	October 8, 2026	6	Qwen3 thinking models stuck in chain-of-thought mode
#490	October 9, 2026	4	Trial scores differ from the exported model's scores
#533	October 29, 2026	none shown	GGUF input causes a traceback

Issue #490 matters most for a user choosing a model: it reports that the score the optimizer reached is not the score of the model that was saved. Issue #401, titled "Important announcement concerning the future of the project," has 14 comments, and #542 is an open request for comments on post-2.0 priorities.

Licence and use

AGPL-3.0 applies to the tool, and contributions are released under the same licence. The README does not say what licence an edited model carries; each base model keeps its own. The README says the tool supports most dense models, several mixture-of-experts architectures and many hybrid models, and that the optional bnb_4bit setting cuts VRAM needs at a "slight accuracy cost." It also benchmarks the machine at startup to choose a batch size. Heretic can also upload a reproduce.json manifest with a model, and the heretic --reproduce command recreates one.

Anyone running Heretic on a model they will serve to others should read the base licence first and check #490 against their own export. Readers following other fast-rising developer repositories will find the same pattern of self-reported claims, as in the Claude-Mem installer case. The RFC in issue #542 is the next place the author's plans will show.