Heretic 2.0 strips censorship from language models, now with new ARA method

What this is about

Heretic is an open-source tool by Philipp Emanuel Weidmann (developer handle "p-e-w") that lets you modify language models after the fact, without retraining them. It became known as a program that removes censorship from models, so that a model no longer answers with "I can't help with that." After about five months of development, version 2.0 is out, released on November 1, 2026, according to Startup Fortune. The developer calls it the biggest release so far and now describes Heretic as a general-purpose tool for model modification.

You install it with pip install -U heretic-llm. After that, a single command such as heretic Qwen/Qwen3.5-4B is enough. The README lists Python 3.10+ and PyTorch 2.6+ as requirements.

What's new: ARA instead of abliteration

Classic "abliteration" assumes that refusals are represented in the model by a single direction in the so-called residual space (the model's internal intermediate representations). Researchers have questioned this assumption for some time. There is work on multi-dimensional ablation and "representation cones."

Heretic 2.0 therefore uses Arbitrary-Rank Ablation (ARA) by default, a method Weidmann says he developed from scratch. ARA modifies matrices using an objective function: representations of harmful prompts should become similar to those of harmless ones, while the representations of harmless prompts should change as little as possible. The L-BFGS optimizer adjusts the matrices one by one. It's a kind of micro-training that isn't restricted to a subspace of fixed dimension. The developer calls ARA "far superior" to abliteration. That is a claim from the developer. A detailed write-up as a preprint is still pending. Classic abliteration (including the projected variant and norm preservation) remains selectable.

Startup Fortune, by contrast, describes ARA as a low-rank update that needs less compute and brings faster runs and broader model compatibility. That differs from the developer's account, which describes ARA specifically as a method without a rank restriction. The sources don't settle which description is technically more accurate.

Plugin system and new scorers

Heretic uses an Optuna-based TPE optimizer to search for parameters that optimize certain values ("scores"). Until now, there were only two built-in ones: the number of refusals and KL divergence (a measure of how far the model has drifted from the original). In 2.0, you can load any number of your own scorers as plugins, each set to minimize or maximize. Plugins can be loaded straight from a Python file without changing the Heretic code.

Besides the keyword and KLD scorers, there are:

• a benchmark scorer that supports many standard benchmarks,
• a BERT classifier by Vinay Umrethe, which uses a ModernBERT model to classify responses. According to the developer, the bundled refusal model detects refusals far more accurately than simple keyword matching, but it is slower.

This lets Heretic do other things too: reduce filler phrases ("slop"), sycophancy or humor, or shift emotional tone. Ready-made configurations for this are in the repository (noslop, nohumor, nosyco, emotions). The scorer system largely comes from a contributor named red40maxxer.

Other changes

• Heretic now also runs non-interactively, which makes end-to-end testing possible.
• Models with hyper-connections are now supported, and support for reasoning models has improved. According to the README, most dense models, many multimodal ones, several MoE architectures and modern hybrid models work.
• Heretic can produce reproducible models: when uploading to Hugging Face, you can attach a reproduce folder with a manifest of about 9 KB, which lets others rebuild the model. The collection of these manifests is called the "Heretic Grimoire."
• Optionally, a model can be loaded directly in 4-bit via bitsandbytes to save VRAM, at the cost of slightly lower accuracy.
• According to Startup Fortune, 20 people contributed, 11 of them for the first time.

What you need to try it

A gaming GPU is enough. As a reference, the README cites an RTX 3090 (24 GB VRAM), where modifying Qwen3-4B-Instruct-2507 with default settings takes 30 to 40 minutes. Larger models need correspondingly more VRAM. With 4-bit quantization (quantization = bnb_4bit), the requirement drops. You'll also need Python, PyTorch and disk space for both the original model and the result. Important: old 1.x configurations no longer work, and there is a migration guide.

Numbers and adoption

According to the developer, Heretic has 37,000 GitHub stars, over 8,500 models on Hugging Face and 88 million downloads. Independent benchmarks with MMLU and GSM8K reportedly show, per the README, that Heretic models compare well with competing abliteration tools (the README points to Reddit analyses). The developer also stresses that he writes the code by hand and that it is not "vibe-coded."

Our take

Heretic 2.0 turns a specialist tool into a platform for shaping model behavior. If filler phrases or sycophancy in local models annoy you, you can now train them out in a targeted way without paying for real training. That's appealing for hobbyists and researchers.

The downside: according to Startup Fortune, an investigation by the Financial Times and the group Alice showed in May that a journalist was able to strip the safety alignment from Llama 3.3 and Gemma 3 with Heretic in under ten minutes. The developer reportedly told the FT about more than 3,500 uncensored models with 13 million downloads. For companies, that means that with open weights, the vendor's safety training doesn't protect you. Only your own access control does. It remains unclear how much better ARA actually performs than abliteration in independent tests. Its superiority so far rests on claims from the developer and testers in the community. The other sources (game articles on "Intergalactic" and the "Heretic + Hexen" remaster) cover different topics and were not considered.