Heretic strips refusals from open-weight models

A tool called Heretic can take a modern open-weight language model, strip out its trained refusals, and hand you back a version that answers almost anything - with no manual tuning and no machine-learning expertise required. You point it at a model on your own hardware, wait, and collect a decensored copy. It was released as open source by Philipp Emanuel Weidmann in late 2025, and it works on most transformer models you can download from Hugging Face.

That single sentence matters more to security teams than most of the AI news from the past year, because of what it proves rather than what it enables.

How abliteration actually works

Heretic automates a technique called abliteration. The idea comes from a 2024 finding - published as “Refusal in Language Models Is Mediated by a Single Direction” - that a model’s tendency to refuse is largely controlled by one direction in its internal activation space. Feed the model a batch of harmful prompts and a batch of harmless ones, measure the difference in activations, and you get a vector that points toward “refuse.” Subtract that direction out of the model’s weights and the refusal behavior mostly disappears, while the rest of the model’s knowledge stays intact.

The manual version of this has existed since 2024. What Heretic adds is automation. It runs an optimization loop - using a tree-structured Parzen estimator, the same family of optimizer used for hyperparameter tuning - that searches for settings which drive refusals toward zero while keeping the model’s outputs close to the original. It measures “close” using KL divergence, a standard way to quantify how far one probability distribution has drifted from another. That gives it a dial: push refusals down as far as possible without letting the model’s general behavior degrade past a threshold. Fewer refusals, minimal capability loss, no human deciding which layers to touch.

The practical result: a job that used to require reading a paper, writing code, and hand-tuning now takes one command and a GPU.

The change is the cost, not the capability

Nothing Heretic does is novel. Abliterated models have been on Hugging Face for over a year - the researcher known as FailSpy published a well-known series of them, and “uncensored” fine-tunes predate even that. If you understood the technique, you could already do this by hand.

That is exactly why it matters. Threat models rarely change when something becomes possible. They change when something becomes cheap. Lockpicking was always possible; the pick set for sale on a marketplace is what changes your risk. Heretic drops the skill floor for removing model restrictions from “ML researcher” to “person who can run a command-line tool.” When a barrier falls that far, the thing behind it stops being the exception and becomes the default.

Plan as if every open-weight model in circulation has a decensored twin, because it does or soon will.

What this proves about model safety

Here is the uncomfortable part for anyone who has been told a model is “safe” because it refuses. Safety training that can be reversed in under an hour on consumer hardware was never a security control. It is a product behavior - a default that shapes how the model acts for cooperative users. It is not a boundary that stops a motivated one.

This distinction gets blurred constantly. A vendor demonstrates that its model declines to write malware or explain how to build a weapon, and that demo gets treated as a safety guarantee. It is a guarantee only for the hosted version, reached through their API, where they hold the weights. The moment weights are downloadable, the refusal layer travels with them only as far as the next person chooses to keep it. Heretic is the tool that removes it.

If your understanding of AI safety rests on the model saying no, Heretic just showed you that you were relying on a lock with the key taped to the back.

Measure uplift, not vocabulary

The wrong response is to panic about models “saying dangerous things.” The right question is narrower and older than AI: what is the marginal uplift?

Most of what a censored model refuses to output is already available. Instructions for common attacks, malware source code, phishing templates - these are indexed by search engines and sitting in public repositories. A decensored model that repeats them offers little that a determined person couldn’t find in an afternoon of searching. Vocabulary is not the threat.

Uplift is real in three specific places, and it’s worth being precise about them. First, scale: generating ten thousand tailored phishing messages, each personalized to its target, is genuinely cheaper with a compliant model than with a template and a mail-merge. Second, synthesis: pulling scattered fragments into one coherent, step-by-step procedure saves a novice real time. Third, code: producing working exploit or malware code for someone who couldn’t write it themselves lowers a skill barrier that used to matter.

None of that is apocalyptic, and treating it as such wastes credibility you will want later. But it is not nothing. The honest position is that decensored models give lower-skilled actors an incremental boost in speed and reach - not a new class of capability, but a wider door to the existing one.

Why the frontier labs keep their best weights closed

The organizations building the most capable models - Anthropic, OpenAI, Google - do not release the weights of their frontier systems. Cost and competition explain part of that, but the safety logic is the same one Heretic demonstrates. When weights stay on your own servers, the refusal layer is backed by everything around it: access controls, rate limits, abuse monitoring, the ability to revoke an account, and the ability to patch behavior for every user at once. The model’s “no” is enforced by infrastructure, not by the model alone. Take the weights out of that environment and only the weakest layer - the trained refusal - comes with them, which is precisely the layer Heretic strips. This isn’t an argument that closed is virtuous and open is reckless. It’s an observation that the two approaches place their safety in different layers, and only one of those layers survives being copied.

What defenders should actually do

Stop counting model refusals as a control in any architecture you own. If your threat model has a line that reads “the model won’t produce X,” delete it for every case where weights can run outside your control.

The controls that survive Heretic are the ones that never depended on the model’s cooperation:

• Keep enforcement at the application and API layer, not the model layer. Output filtering, input screening, and policy checks that run around the model work regardless of what the weights will say.
• Treat access as the boundary. Rate limits, identity verification for higher-risk capabilities, and per-account monitoring do work that refusals cannot, because they don’t assume the model is on your side.
• Assume any model a user runs locally is fully capable. If your product ships weights to endpoints, your safety story for those endpoints is whatever the user permits - which is nothing.
• Log and monitor outputs where you can. The signal that matters is what’s being generated at scale and by whom, not whether a single response was polite.

For a SOC, the near-term shift is mundane: expect more fluent phishing, more convincing pretexts, and more first-draft malware in the wild. That doesn’t call for a new tool. It calls for weighting the controls you already run - email authentication, user reporting, behavioral detection, egress monitoring - more heavily than filters that assumed attacker text would look clumsy.

For anyone publishing open weights

Releasing weights with an acceptable-use policy attached does not restrict what the model will do. A license is a legal instrument, not a technical one, and Heretic is indifferent to it. The moment you publish a model, you have effectively published its decensored version too, because producing that version is now a mechanical step someone else can run.

That is not an argument against open weights. Open models carry real benefits - auditability, local control, research access, and independence from a handful of vendors. It is an argument for honesty about what the release includes. If your safety case for an open release is “the model refuses harmful requests,” you don’t have a safety case for anyone who runs it. Build the case on what you actually control: what you train into the base capabilities, what you document, and what you decline to hand out at all.

Alignment baked into weights you give away is a courtesy, not a control. Heretic didn’t break that rule. It just made the rule impossible to ignore.