Heretic 2.0 Released: From Uncensoring to a General-Purpose Model Modification Tool

From Uncensoring Tool to General-Purpose Model Modification Platform

According to the Reddit community, the open-source project Heretic has officially released version 2.0 after nearly five months of development. This tool, originally focused on removing censorship mechanisms from language models, has now accumulated 37k GitHub stars, with over 8,500 derivative models on Hugging Face and cumulative model downloads reaching 88 million. Heretic 2.0's positioning has shifted significantly: it is no longer just a specialized uncensoring tool, but has evolved into a general-purpose model modification platform capable of suppressing model "slop," reducing sycophancy, and adjusting emotional alignment.

Of course, uncensoring remains the default and primary function. The developers describe 2.0 as "the most advanced refusal suppression system to date," and it works much better than previous versions. The barrier to entry remains low—running heretic Qwen/Qwen3.5-4B completes a basic uncensoring operation.

Core Technology: Arbitrary-Rank Ablation (ARA) Replaces Directional Ablation

The most significant technical change in Heretic 2.0 is the replacement of classic abliteration with Arbitrary-Rank Ablation (ARA). Traditional abliteration is based on the assumption that a model's refusal behavior manifests as a single direction in residual space (i.e., a rank-1 subspace). But this assumption has been challenged by research in recent years, with multi-directional ablation, representation cones, and other alternatives emerging.

Earlier this year, the developers began experimenting with an approach that completely abandons fixed-rank constraints, and released an initial version of ARA in March. The core idea of ARA is to encode the desired modification properties through an objective function—the representations of harmful prompts in residual space should be close to those of harmless prompts, while the representations of harmless prompts should change as little as possible—and then use the L-BFGS optimizer to modify matrices one by one. This "micro-training" approach guides model representations without imposing rank constraints.

According to the developers, ARA underwent extensive testing and tuning with community help. Contributor kabachuha made it compatible with Heretic's LoRA system, while varunbln discovered significant performance improvements. ARA is now the default method, with classic abliteration retained as an option.

Directional ablation (abliteration) is a weight-editing-based technique for modifying model behavior, first proposed by the community around 2023. The basic idea is: construct a set of harmful and harmless prompts, extract the corresponding activation representations from the residual stream at intermediate layers, compute the difference between the means of the two representation sets as the "refusal direction," and then subtract the projection component along that direction from the model's weight matrices. Since it requires only a single forward pass and simple linear algebra operations, abliteration is extremely low-cost and once became the mainstream uncensoring method in the open-source community.

Intuition about the residual stream and rank: In a Transformer, each layer's output is added back to a vector channel that runs through all layers, namely the residual stream. Different semantic features approximately correspond to different directions in residual space; if a certain behavior (such as refusal) is controlled by only one direction, its rank is said to be 1. The motivation for multi-directional ablation is that refusal behavior may be distributed across multiple orthogonal or nearly orthogonal directions, and removing only a single direction leaves residual refusal tendencies or excessively damages other capabilities. ARA abandons pre-specifying rank and instead lets the optimizer decide in which directions and with what intensity to modify matrices.

L-BFGS optimizer: Limited-memory Broyden–Fletcher–Goldfarb–Shanno is a quasi-Newton method that uses gradient differences from the most recent steps to approximate the inverse Hessian matrix, achieving faster convergence than naive gradient descent without storing the full second-order matrix. In ARA, the variables to be optimized are the modifications to each weight matrix in the model, with dimensions reaching millions or even billions; L-BFGS's low-memory characteristics make it a viable choice. The objective function simultaneously constrains "harmful prompt representations close to harmless ones" and "harmless prompt representations unchanged as much as possible," the latter being the role of the KL divergence regularization term, which prevents overall distribution drift of the model.

Plugin System: Let Heretic Optimize for Your Goals

Heretic 2.0 has been thoroughly refactored around a plugin system. Heretic works by finding modification parameters that optimize scores—since version 1.0 it has used two hardcoded scores: refusal count measuring uncensoring strength and KL divergence measuring quality preservation. Version 2.0 allows users to freely define scoring criteria by writing scorer plugins, loading any number of scorers simultaneously and setting each to minimize or maximize.

The scoring plugin system was designed primarily by contributor red40maxxer, with the developer exchanging hundreds of messages and going through dozens of review rounds before finalizing it. In addition to the default keyword-counting and KLD scorers, Heretic also includes a benchmark scorer and a BERT classifier. The latter, developed by long-time contributor Vinay Umrethe, can use any ModernBERT-type model to classify and score LLM responses. Vinay also trained a refusal classifier model, and experiments show it is much more accurate at identifying model refusal behavior than the default keyword-matching method. Although slower, the higher accuracy helps produce better-quality modified models. The repository also provides an alternative configuration using a sentiment classifier.

Modifier plugins are responsible for implementing the actual steering methods, and can likewise be loaded via simple Python files with a clearly defined API.

KL divergence (Kullback–Leibler divergence) is used here to measure the difference in model output distributions before and after modification. The typical approach is: use the original model and the modified model to compute next-token probability distributions on the same batch of harmless text, then compute the KL divergence between the two distributions and average it. A smaller KL value indicates less perturbation to the model's original capabilities. Heretic uses this as a quality-preservation score, which together with the refusal-count score forms the optimization objective, thereby seeking a Pareto trade-off between "uncensoring strength" and "model quality."

BERT classifier scorer: ModernBERT is a class of encoder models released in late 2024, supporting long contexts and incorporating modern architectural improvements. Heretic allows loading any ModernBERT-type model as a scorer to perform binary classification (e.g., refusal/non-refusal) on model responses and output probabilities as scores. Compared to keyword matching, classifiers can recognize implicit refusal expressions beyond "I cannot assist," at the cost of additional inference time, which significantly slows down the optimization process during large-scale search.

Engineering Improvements and Migration Notes

Beyond core algorithm and architectural changes, Heretic 2.0 brings several engineering-level improvements. It can now run non-interactively, enabling end-to-end testing and stricter quality control. Model support has been extended to models with hyper-connections, and support for thinking models has been substantially improved.

It should be noted that Heretic 2.0's configuration is not backward compatible with version 1.x. Upgrading users need to adjust old configuration files according to the migration guide. The developers state that the plugin system documentation is thoroughly covered in the README and code; if users want to experiment with custom plugins, an agent that has digested the Heretic repository should easily be able to write plugins and accompanying configuration files.

A Community-Driven Open-Source Collaboration Example

The evolution of Heretic from 1.0 to 2.0 is itself a noteworthy open-source collaboration case. The core algorithm ARA was developed from scratch by the project founder, the plugin architecture was designed primarily by community contributors, LoRA compatibility and performance optimizations came from other contributors, and the refusal classifier model was trained by another long-term participant. Contributions from multiple independent sources collectively shaped 2.0, which also explains why this project has accumulated a considerable community scale in less than two years.

For developers interested in model behavior modification, alignment adjustment, and open-source toolchains, Heretic 2.0 provides a low-barrier experimentation platform. Its plugin-based design means uncensoring is just one of many possible applications, and customized modification of model behavior is becoming increasingly democratized.

One-line Summary

Heretic 2.0 upgrades an uncensoring tool into a general-purpose model behavior modification platform with arbitrary-rank ablation and a plugin system.

Paragraph Summary

Heretic 2.0 was released after nearly five months of development, with 37k GitHub stars, over 8,500 derivative models, and 88 million cumulative downloads. Its positioning has expanded from a specialized uncensoring tool to a general-purpose model modification platform that can suppress slop, reduce sycophancy, and adjust emotional alignment, with uncensoring still the default function. The core technology replaces classic directional ablation with Arbitrary-Rank Ablation (ARA), abandoning the rank-1 assumption that refusal behavior corresponds to a single direction, encoding desired properties through an objective function, and modifying matrices one by one with L-BFGS. Architecturally, it has been thoroughly refactored around a plugin system, with scorer plugins defining optimization objectives and modifier plugins implementing steering methods, plus a built-in BERT classifier scorer that identifies refusal behavior more accurately. 2.0 is not backward compatible with 1.x configurations and supports non-interactive execution and end-to-end testing.