Heretic 2.0 ARA vs Abliteration: ARA Is the Better Default
Heretic 2.0 replaces classic abliteration with Arbitrary-Rank Ablation (ARA) as its default editing method, and for most users that is the right default: ARA edits a model through a low-rank adapter instead of removing a single direction, and it needs fewer manual settings. The caveat is that every claim of superior quality so far comes from the project's author, so treat ARA as promising rather than proven. Heretic 2.0.0 was published on GitHub on 1 November 2026 and it is a breaking release, so 1.x configuration files will not run unchanged.
TL;DR
- Heretic 2.0 makes ARA the default modifier. Classic abliteration is still available as an option.
- ARA optimises a LoRA adapter (default rank 50) against three goals, rather than subtracting one refusal direction.
- The release adds a plugin system, headless operation, reproducible model files and support for Hyper-Connections models.
- Configuration files from 1.x are not compatible. A migration guide covers the changes.
- Verdict: use ARA for new edits, keep abliteration for comparison runs, and retest on your own tasks. No independent benchmark exists yet.
What is the difference between ARA and abliteration in Heretic 2.0?
Classic abliteration, described by Arditi et al. (2024), finds one internal "refusal direction" in a model's activations and removes it. It assumes refusal lives in a single direction. That assumption is tidy, but real models may spread the behaviour across several directions.
ARA drops the assumption. According to the design discussion, it captures each module's inputs and outputs with PyTorch hooks, then optimises that module's matrices against three competing goals:
1. Outputs for harmless requests should change as little as possible.
2. Outputs for requests the model would refuse should move towards the harmless ones.
3. Those outputs should also move as far as possible from the original refusals, which the author calls overcorrection.
The author describes the problem as convex, with the L-BFGS solver usually converging in two to three iterations. The implementation lives in PR #446, and the source file src/heretic/modifiers/ara.py sets a default LoRA rank of 50 and 5 optimisation steps.
| | Classic abliteration | ARA |
|---|---|---|
| Core assumption | Refusal is one direction | Refusal can span several directions |
| Edit style | Subtracts the direction from weights | Optimises a low-rank adapter per module |
| Memory | Edits dense weights | LoRA adapter of configurable rank (default 50) |
| Status in 2.0 | Optional second modifier | Default modifier |
| Evidence | Peer-reviewed method paper | Author's own claims, paper pending |
What else is new in Heretic 2.0?
The method swap is the headline, but the release is broader. The release notes list about 40 changes.
Plugins are the largest structural change. "Scorer" plugins define the behaviour you want, such as fewer refusals, less filler phrasing, less sycophancy or a colder tone. "Modifier" plugins apply the editing technique. A plugin can be a plain Python file loaded with the form path/to/plugin.py:ClassName. Shipped scorers include refusal keyword frequency, KL divergence, benchmarks and a generic BERT classifier, and the Optuna optimiser searches for a compromise between their scores. An example config, config.nosyco.toml, targets sycophancy (PR #349).
Other additions:
- Headless operation with end-to-end tests, so a run needs no human in the loop.
- Reproducibility files. Uploaded models can carry a reproduce.json of roughly 9 KB, and heretic --reproduce rebuilds the result. Checksums go in SHA256SUMS.txt.
- Support for models with Hyper-Connections and better detection of the reasoning prefix in "thinking" models.
- Python 3.14 and 3.15 in the CI matrix.
- Removal of the research features. The release notes point to Lophius as the intended replacement.
How do I upgrade to Heretic 2.0 from 1.x?
Follow these four steps, in order.
1. Check your configuration. Back up every 1.x config file. None of them will load as they are.
2. Upgrade the package. Run pip install -U heretic-llm. The README lists Python 3.10 or later and PyTorch 2.6 or later.
3. Map your settings. Use the migration guide and the table below.
4. Verify your hardware setup. If VRAM is tight, set quantization: bnb_4bit to load the model in 4-bit. Gated Hugging Face models also need an account with access granted.
| Heretic 1.x setting | Where it goes in 2.0 |
|---|---|
| Abliteration options | [modifier.Abliteration] section |
| Refusal settings | [scorer.KeywordRate] section |
| Search-feature and KL-balancing settings | No longer recognised, remove them |
| Reasoning skip list | Replaced by chain_of_thought_blocks, which has a different structure |
| Implicit abliteration | ARA is now the default, so change the modifiers setting to stay on abliteration |
The last row catches people out. If you upgrade and change nothing else, your next run will use ARA, not the method your earlier results came from.
How much hardware does Heretic 2.0 need?
The tool is described as training-free, and a consumer GPU is enough for small models. The README estimates 30 to 40 minutes on an RTX 3090 for Qwen3-4B-Instruct-2507, a 4-billion-parameter model. That figure is for the README's example, not a guarantee for larger models, and I have not timed it myself. Bigger models will need more VRAM or the 4-bit option, and 4-bit loading adds its own quantisation effects to the result.
Is ARA actually better than abliteration?
Probably better in practice, but unproven. The author published gpt-oss-20b-heretic-ara-v3 on Hugging Face and says it clearly beats existing abliterated builds of gpt-oss-20b. That is the author's assessment. The README says the method paper is still to come, and no independent benchmark has been published.
There is also a measurement trap. KL divergence tells you how far the edited model has drifted from the original, not whether it still does your task well. A low KL score on a coding model does not show that it still writes correct code. Rerun your own evaluations after any edit. If your base model choice is still open, our comparison of [open-source coding models](/articles/best-open-source-llm-for-coding-qwen3-coder-vs-glm-5-2-2026) and the [Qwen, Claude and Kimi breakdown](/articles/qwen-vs-claude-vs-kimi) give a reasonable baseline to test against.
The ARA design weighs in its favour: a convex objective with a fast solver is easier to reason about than a hand-tuned search. The evidence weighs against: one author, one showcase model, no paper yet.
Who should use Heretic 2.0, and what are the risks?
Use it if you run local models and want to change refusal or tone behaviour without training. The reproducibility files are a real benefit, because a published edit can be audited and rebuilt. Teams building [agentic coding tools](/articles/agentic-ai-coding-tools-2026) sometimes run into over-cautious refusals in automated workflows, and a scorer-based edit is one way to address that, though you should compare it against simply [choosing a different agent](/articles/best-ai-agent-for-coding-2026) first.
Be careful about distribution. Removing safety behaviour has consequences, and platform rules apply. One report says Hugging Face disabled an unfiltered GLM-5.3 upload on 25 October 2026, while thousands of uncensored uploads remain. Check Hugging Face's content policy and the base model's licence before you publish anything.
The project is widely used, but the author's own usage claims for modified models and downloads are not independently verified, so treat them with caution. Built by developer Philipp Emanuel Weidmann, it counted 37,700 GitHub stars as of November 2, 2026 (repository). A release write-up from Startup Fortune counted 13 million cumulative downloads by May 2026, per a Financial Times and Alice Research investigation, while We Are the Frontier frames the same release as part of a wider trend of refusal removal becoming a packaged, repeatable process across the open-weight ecosystem and ExplainX catalogs the same breaking change from 1.x.
Frequently asked questions
Q: Is Heretic 2.0 backwards compatible with 1.x configs?
A: No. The release notes state that 1.x configuration files are not compatible, so you must migrate them using the official migration guide before the tool will run.
Q: Can I still use classic abliteration in Heretic 2.0?
A: Yes. Abliteration is kept as an optional modifier. Because ARA is now the default, you need to change the modifiers setting and move your options into the [modifier.Abliteration] section.
Q: What is Arbitrary-Rank Ablation?
A: ARA is a model-editing method that optimises a low-rank LoRA adapter for each module, rather than removing one refusal direction. It balances leaving harmless outputs unchanged, moving refused outputs towards harmless ones, and overcorrecting away from the original refusals.
Q: How do I install Heretic 2.0?
A: Run pip install -U heretic-llm with Python 3.10 or later and PyTorch 2.6 or later. Then migrate your configuration and, if needed, enable quantization: bnb_4bit to reduce VRAM use.
Q: Is ARA proven to beat abliteration?
A: Not independently. The claim comes from the project's author, and the method paper is still pending according to the README. Run your own task tests on any edited model before relying on it.
Q: Does Heretic 2.0 require retraining the model?
A: No. The README describes the tool as training-free. ARA fits an adapter by optimisation against captured activations, which is a different and much lighter process than fine-tuning.
Mentions
Heretic 2.0 ARA vs Abliteration: ARA Is the Better Default Heretic 2.0 replaces classic abliteration with Arbitrary-Rank Ablation (ARA) as its default editing method, and for most users that is the right default: ARA edits a model through a low-rank adapter instead of removing a single direction, and it needs fewer manual settings. The caveat is that every claim of superior quality so far comes from the project's author, so treat ARA as promising rather than proven. Heretic 2.0.0 was published on GitHub on 1 November 2026 and it is a breaking release, so 1.x configuration files will not run unchanged. TL;DR - Heretic 2.0 makes ARA the default modifier. Classic abliteration is still available as an option. - ARA optimises a LoRA adapter (default rank 50) against three goals, rather than subtracting one refusal direction. - The release adds a plugin system, headless operation, reproducible model files and support for Hyper-Connections models. - Configuration files from 1.x are not compatible. A migration guide covers the changes. - Verdict: use ARA for new edits, keep abliteration for comparison runs, and retest on your own tasks. No independent benchmark exists yet. What is the difference between ARA and abliteration in Heretic 2.0? Classic abliteration, described by Arditi et al. (2024), finds one internal "refusal direction" in a model's activations and removes it. It assumes refusal lives in a single direction. That assumption is tidy, but real models may spread the behaviour across several directions. ARA drops the assumption. According to the design discussion, it captures each module's inputs and outputs with PyTorch hooks, then optimises that module's matrices against three competing goals: 1. Outputs for harmless requests should change as little as possible. 2. Outputs for requests the model would refuse should move towards the harmless ones. 3. Those outputs should also move as far as possible from the original refusals, which the author calls overcorrection. The author describes the problem as convex, with the L-BFGS solver usually converging in two to three iterations. The implementation lives in PR #446, and the source file src/heretic/modifiers/ara.py sets a default LoRA rank of 50 and 5 optimisation steps. | | Classic abliteration | ARA | |---|---|---| | Core assumption | Refusal is one direction | Refusal can span several directions | | Edit style | Subtracts the direction from weights | Optimises a low-rank adapter per module | | Memory | Edits dense weights | LoRA adapter of configurable rank (default 50) | | Status in 2.0 | Optional second modifier | Default modifier | | Evidence | Peer-reviewed method paper | Author's own claims, paper pending | What else is new in Heretic 2.0? The method swap is the headline, but the release is broader. The release notes list about 40 changes. Plugins are the largest structural change. "Scorer" plugins define the behaviour you want, such as fewer refusals, less filler phrasing, less sycophancy or a colder tone. "Modifier" plugins apply the editing technique. A plugin can be a plain Python file loaded with the form path/to/plugin.py:ClassName. Shipped scorers include refusal keyword frequency, KL divergence, benchmarks and a generic BERT classifier, and the Optuna optimiser searches for a compromise between their scores. An example config, config.nosyco.toml, targets sycophancy (PR #349). Other additions: - Headless operation with end-to-end tests, so a run needs no human in the loop. - Reproducibility files. Uploaded models can carry a reproduce.json of roughly 9 KB, and heretic --reproduce rebuilds the result. Checksums go in SHA256SUMS.txt. - Support for models with Hyper-Connections and better detection of the reasoning prefix in "thinking" models. - Python 3.14 and 3.15 in the CI matrix. - Removal of the research features. The release notes point to Lophius as the intended replacement. How do I upgrade to Heretic 2.0 from 1.x? Follow these four steps, in order. 1. Check your configuration. Back up every 1.x config file. None of them will load as they are. 2. Upgrade the package. Run pip install -U heretic-llm. The README lists Python 3.10 or later and PyTorch 2.6 or later. 3. Map your settings. Use the migration guide and the table below. 4. Verify your hardware setup. If VRAM is tight, set quantization: bnb_4bit to load the model in 4-bit. Gated Hugging Face models also need an account with access granted. | Heretic 1.x setting | Where it goes in 2.0 | |---|---| | Abliteration options | [modifier.Abliteration] section | | Refusal settings | [scorer.KeywordRate] section | | Search-feature and KL-balancing settings | No longer recognised, remove them | | Reasoning skip list | Replaced by chain_of_thought_blocks, which has a different structure | | Implicit abliteration | ARA is now the default, so change the modifiers setting to stay on abliteration | The last row catches people out. If you upgrade and change nothing else, your next run will use ARA, not the method your earlier results came from. How much hardware does Heretic 2.0 need? The tool is described as training-free, and a consumer GPU is enough for small models. The README estimates 30 to 40 minutes on an RTX 3090 for Qwen3-4B-Instruct-2507, a 4-billion-parameter model. That figure is for the README's example, not a guarantee for larger models, and I have not timed it myself. Bigger models will need more VRAM or the 4-bit option, and 4-bit loading adds its own quantisation effects to the result. Is ARA actually better than abliteration? Probably better in practice, but unproven. The author published gpt-oss-20b-heretic-ara-v3 on Hugging Face and says it clearly beats existing abliterated builds of gpt-oss-20b. That is the author's assessment. The README says the method paper is still to come, and no independent benchmark has been published. There is also a measurement trap. KL divergence tells you how far the edited model has drifted from the original, not whether it still does your task well. A low KL score on a coding model does not show that it still writes correct code. Rerun your own evaluations after any edit. If your base model choice is still open, our comparison of [open-source coding models](/articles/best-open-source-llm-for-coding-qwen3-coder-vs-glm-5-2-2026) and the [Qwen, Claude and Kimi breakdown](/articles/qwen-vs-claude-vs-kimi) give a reasonable baseline to test against. The ARA design weighs in its favour: a convex objective with a fast solver is easier to reason about than a hand-tuned search. The evidence weighs against: one author, one showcase model, no paper yet. Who should use Heretic 2.0, and what are the risks? Use it if you run local models and want to change refusal or tone behaviour without training. The reproducibility files are a real benefit, because a published edit can be audited and rebuilt. Teams building [agentic coding tools](/articles/agentic-ai-coding-tools-2026) sometimes run into over-cautious refusals in automated workflows, and a scorer-based edit is one way to address that, though you should compare it against simply [choosing a different agent](/articles/best-ai-agent-for-coding-2026) first. Be careful about distribution. Removing safety behaviour has consequences, and platform rules apply. One report says Hugging Face disabled an unfiltered GLM-5.3 upload on 25 October 2026, while thousands of uncensored uploads remain. Check Hugging Face's content policy and the base model's licence before you publish anything. The project is widely used, but the author's own usage claims for modified models and downloads are not independently verified, so treat them with caution. Built by developer Philipp Emanuel Weidmann, it counted 37,700 GitHub stars as of November 2, 2026 (repository). A release write-up from Startup Fortune counted 13 million cumulative downloads by May 2026, per a Financial Times and Alice Research investigation, while We Are the Frontier frames the same release as part of a wider trend of refusal removal becoming a packaged, repeatable process across the open-weight ecosystem and ExplainX catalogs the same breaking change from 1.x. Frequently asked questions Q: Is Heretic 2.0 backwards compatible with 1.x configs? A: No. The release notes state that 1.x configuration files are not compatible, so you must migrate them using the official migration guide before the tool will run. Q: Can I still use classic abliteration in Heretic 2.0? A: Yes. Abliteration is kept as an optional modifier. Because ARA is now the default, you need to change the modifiers setting and move your options into the [modifier.Abliteration] section. Q: What is Arbitrary-Rank Ablation? A: ARA is a model-editing method that optimises a low-rank LoRA adapter for each module, rather than removing one refusal direction. It balances leaving harmless outputs unchanged, moving refused outputs towards harmless ones, and overcorrecting away from the original refusals. Q: How do I install Heretic 2.0? A: Run pip install -U heretic-llm with Python 3.10 or later and PyTorch 2.6 or later. Then migrate your configuration and, if needed, enable quantization: bnb_4bit to reduce VRAM use. Q: Is ARA proven to beat abliteration? A: Not independently. The claim comes from the project's author, and the method paper is still pending according to the README. Run your own task tests on any edited model before relying on it. Q: Does Heretic 2.0 require retraining the model? A: No. The README describes the tool as training-free. ARA fits an adapter by optimisation against captured activations, which is a different and much lighter process than fine-tuning.
Heretic 2.0 утилита, которая убирает из моделей отказы и подхалимство Heretic работает без дообучения: вырезает из локальных моделей цензуру и отказы. Во второй версии добавили борьбу с шаблонными фразами и избыточной вежливостью. Для настройки есть готовый... p-e-w/heretic
它适合喜欢折腾本地模型的人，也适合研究模型行为、定制写作风格；只有聊天 API、拿不到权重的模型，就没法这么改。 项目地址：p-e-w/heretic
GPUなしでAbliteration CLI『Heretic』を動かし、拒否率とKL発散を実測した これは何を試した記事か Heretic という、LLMの拒否挙動(いわゆる検閲・安全性アラインメント)を再学習なしで抑制するPython製CLIツールを実際に動かし、処理前後の拒否率とKL発散(元モデルの出力分布からのズレ)を数値で確認した記事である。 筆者の環境にはGPUがなく、READMEが前提にしているRTX 3090での実行(既定設定で30〜40分)とは条件が大きく異なる。 そこで「GPUなしのCPU環境でこのツールはどこまで動くのか、既定設定を全部回すとどれくらいかかるのか」を実測し、試行数と評価セットを大幅に絞った「スモーク実行」1回分の結果を主役にしている。 出典は本家リポジトリ(p-e-w/heretic 、AGPL-3.0-or-later)とPyPIパッケージ(heretic-llm 2.0.0、pypi.org )である。 Zenn・Qiita・noteを検索した範囲では、このツールの一次検証記事(実際に動かして結果を載せた記事)は2026年11月2日時点で0件だった。 GIGAZINEなどのニュース解説記事はあるが、実行ログを伴う検証記事は見当たらなかった。 念のため先に書いておくと、この検証の目的は「アライメント(安全性調整)という仕組みがどれだけ脆いか」を定量的に確かめることであり、生成した無検閲モデルの出力そのものを見せることではない。 実際に改変後のモデルを保存・アップロードもしていない。 Hereticという仕組み Hereticは、Arditi et al. (2024) の「LLMの拒否挙動は内部の活性化空間のある単一方向に強く媒介されている」という知見をもとに、その方向を打ち消すようにモデルの重みを操作する(Abliteration、あるいはARA = Arbitrary-Rank Ablationという手法)ツールである。 「再学習なし」とはいっても、勾配によるファインチューニングをしないという意味であり、OptunaのTPE(ベイズ的な探索)で「拒否率」と「元モデルとの出力分布のKL発散」を同時に最小化するパラメータを探すループの中で、実際にモデルの重みを何度も書き換えて評価する。 既定ではこの探索を100試行繰り返す。 筆者の実行環境 vCPU 4コア(Intel Xeon @2.10GHz)、RAM 15GB GPUなし(nvidia-smi コマンド自体が存在しない) Heretic自身、起動時に次のように出力する。 No GPU or other accelerator detected. Operations will be slow. READMEはGPU環境を前提に書かれているツールであることを、ツール自身が起動直後に認めている。 インストールで一度詰まった pip install -U heretic-llm をシステムのPython(Debianパッチ入りのsetuptoolsが入った環境)にそのまま実行すると、依存関係に含まれる古いsetup.pyベースのパッケージ(langdetect rouge-score sqlitedict word2number。いずれも評価ライブラリlm-evalの依存)のビルドに失敗した。 $ pip install -U heretic-llm ... AttributeError: install_layout. Did you mean: 'install_platlib'? ... ERROR: Could not build wheels for langdetect, rouge-score, sqlitedict, word2number, which is required to install pyproject.toml-based projects これはHeretic自体のバグというより、システムPython側の古いsetuptoolsパッチとの相性問題である。 python3 -m venv で素のvenvを作り、その中のpip(setuptools新しめ)でやり直すと問題なくビルドできた。 $ python3 -m venv heretic-venv && source heretic-venv/bin/activate $ pip install -U pip setuptools wheel -q $ pip install -U heretic-llm # 成功 CLIの挙動と既定設定 heretic --help で全オプションを確認できる。 主要なものは、対象モデルを指定する--model、Optunaの試行数--n-trials(既定100)とランダム探索フェーズの数--n-startup-trials(既定30)、量子化方式--quantization(noneかbnb_4bit)、1回の応答生成の最大トークン数--max-response-length(既定100)である。 --trial-indexと--model-actionを両方指定すると、本来は対話式(questionaryライブラリによる選択メニュー)の部分を飛ばして非対話実行できる。 今回は--trial-index 0 --model-action ""として、「Pareto最適な先頭の試行を選び、モデルを保存せず終了する」という非対話フローにした。 設定ファイルconfig.default.tomlを読むと、既定では次の規模のデータを使うとわかる。 バッチサイズ自動判定用プロンプト: 256件 応答プレフィックス自動判定用プロンプト: 200件(harmless/harmful各100) 拒否率評価用プロンプト: 100件(mlabonne/harmful_behaviorsのテスト分割) KL発散評価用プロンプト: 100件(mlabonne/harmless_alpacaのテスト分割) ARA修正方式が参照する「望ましい/望ましくない」プロンプト: 各400件 Optuna試行数: 100(うちランダム探索30) スモーク実行: 何を・どう縮小したか 既定設定(試行100回)をGPUなしでそのまま回すと6時間の作業枠を大きく超えると判断し、試行数と評価セットを大幅に縮小した「スモーク実行」を1モデルに対して1回実施した。 対象は、Qwen3シリーズで最小の密モデルであるQwen/Qwen3-0.6Bである。 このモデルのチャットテンプレートには<think></think>というChain-of-Thoughtブロックがあり、Hereticはこれを自動検出して、評価の対象をその後の実際の応答部分に揃えていた。 縮小した項目は次のとおりである(ロジック自体、たとえば拒否判定のキーワードリストやARAのL-BFGS反復回数は既定のまま変更していない)。 項目 既定値 今回 試行数 n_trials 100 2 ランダム探索数 n_startup_trials 30 2 最大応答長 max_response_length 100 32 拒否率評価用プロンプト 100件 10件 KL発散評価用プロンプト 100件 10件 ARA good/badプロンプト 各400件 各40件 実行結果 実行コマンドと実測時間は次のとおりである。 $ time timeout 1700 heretic --model Qwen/Qwen3-0.6B --trial-index 0 --model-action "" ... real 4m8.361s user 12m1.062s sys 2m13.019s EXIT:0 4 vCPU中、user時間がreal時間の約3倍になっており、3コア程度を使うマルチスレッド実行になっていたとわかる。 バッチサイズの自動判定では、バッチサイズを上げるとスループットがほぼ線形に伸びた。 - Trying batch size 1... Ok (14 tokens/s) - Trying batch size 2... Ok (21 tokens/s) - Trying batch size 4... Ok (37 tokens/s) - Trying batch size 8... Ok (68 tokens/s) - Chosen batch size: 8 未改変モデルのベースラインは、10件の有害な依頼プロンプトのうち2件(20%)が拒否ワードを含む応答になった。 - Baseline Refusals: 2/10 - Baseline KL divergence: 0 (by definition) Optunaによる2回の試行結果は次のとおりである。 試行1: start_layer_index=8, end_layer_index=28, ... Refusals: 0/10 / KL divergence: 0.0994 / 所要 1分23秒 試行2: start_layer_index=6, end_layer_index=17, ... Refusals: 0/10 / KL divergence: 0.0295 / 所要(累積) 2分6秒(単体では約43秒) 2試行とも拒否率はベースラインの2/10から0/10まで下がった。 試行2は、修正対象のレイヤー数が試行1より少なく(28-8=20層に対して17-6=11層)、その分だけ速く(43秒対83秒)、かつKL発散も試行1の1/3程度(0.0295対0.0994)に抑えられていた。 つまり試行2は、速度・拒否率・元モデルからの逸脱の小ささのすべてで試行1より優位な結果になっており、--trial-index 0で自動選択されるPareto最適解の先頭に試行2が来たことも、この結果と整合している。 ただし試行数2回・評価プロンプト10件というのは既定のそれぞれ1/50、1/10の規模であり、「Optunaのベイズ的探索が本来の100試行規模で何を見つけるか」を検証したものではない。 あくまで「この仕組みが実際に動き、拒否率とKL発散の数値がどのように変化するか」を確認するための実行である。 既定設定(試行100回)はCPUでどれくらいかかるのか 実測した縮小設定の内訳から、既定設定に戻した場合の所要時間を見積もってみる。 試行時間の大半(試行1では83秒中70秒程度)を占めていたのは、ARAによるモデル修正ステップだった。 このステップが参照するgood/badプロンプトを40件から400件(既定)に戻すと、L-BFGSの計算量はデータ量にほぼ比例して増えるため、1試行あたり十数分規模に増えると見積もれる。 評価ステップも、拒否率評価用プロンプトを10件から100件(10倍)、応答長を32トークンから100トークン(3.125倍)に戻すと、ラフに30倍前後に増えると見積もれる。 これらを足し合わせると、1試行あたりの所要時間は既定設定で15分前後、100試行では約25時間という推定になる。 これはREADMEに記載のRTX 3090での既定実行(30〜40分)の40倍前後にあたる。 この推定はあくまで今回の実測値からの外挿であり、実際に100試行を走らせて確認したものではないが、6時間という作業枠には到底収まらないと判断できる数字である。 GPU環境で既定設定(100試行)を実際に走らせてみた この推定が妥当かどうかを、実際にGPUのある環境(RTX 5060 Ti、16GB VRAM)で確かめた。 config.tomlを使わず、素の既定設定のまま、READMEが例として挙げているQwen/Qwen3-4B-Instruct-2507を実行した。 $ heretic --model Qwen/Qwen3-4B-Instruct-2507 --trial-index 0 --model-action "" Detected 1 CUDA device(s) (15.93 GB total VRAM) ... Running trial 100 of 100... Elapsed time: 1h 35m Optimization finished! Restoring model from trial 62... 既定規模(試行100回・評価各100件)の探索全体が、1時間35分で完走した。 CPUでの推定値(約25時間、ただしモデルサイズは今回のGPU実行の方が大きい)やREADMEのRTX 3090参考値(30〜40分)と比べても、GPUがあれば6時間という作業枠に十分収まることを実測で確認できた。 未改変モデルのベースラインは、今回は評価プロンプトが既定の100件になったため、拒否率100/100(KL発散は定義上0)だった。 100試行のうち拒否率0/100を達成したのは12試行あり、--trial-index 0が選んだ試行62はKL発散1.3763で、他の0/100達成組(次点は11.4456)を大きく下回っていた。 一方で拒否率0/100以外の試行の中には、KL発散が0.0159(拒否率89/100)まで小さいものもあった。 つまり「拒否率を完全に0にすること」と「元モデルからの逸脱を最小にすること」は強いトレードオフの関係にあり、これは試行数2回のスモーク実行では見えなかった、既定規模の探索でしか見えてこない情報だった。 まとめ Hereticは、GPUがなくても最後まで完走する(ツール自身は想定していないと明言しつつも、CPUでエラーなく動いた)。 ただしスループットは実測で14〜68 tokens/s(バッチサイズ1〜8、0.6Bモデル、4 vCPU)にとどまり、既定の試行規模をそのまま回すには推定25時間という計算になった。 一方で、試行数と評価セットを大幅に縮小したスモーク実行でも、Abliteration理論(内部活性化空間のある方向を操作するだけで拒否挙動を抑制できるという考え方)が小規模なモデル・小規模な評価セットでも再現されることは確認できた。 ベースラインで2/10だった拒否率は、2試行ともで0/10まで下がり、Optunaはわずか2試行の中でも「拒否率を維持したままKL発散(元モデルからの逸脱)を1/3程度に抑える」パラメータをより優れた解として見つけていた。 「安全性のアラインメントは、方向を1つ潰すだけで崩れるほど薄い層でしかないのかもしれない」ということを、自分の手で、しかもGPUなしの環境でも数値として確認できたのは収穫だった。 一方で、今回の評価セットは10件というごく小さな規模であり、これをもって「Hereticが安全に・一般的に拒否挙動を外せる」と結論づけることはできない点は強調しておきたい。 GPU環境で既定規模(試行100回・評価各100件)を実際に走らせたところ、1時間35分で完走し、6時間の作業枠には十分収まることも確認できた。 拒否率を完全に0にする解と、元モデルからの逸脱を最小にする解は強いトレードオフにあり、100試行規模のPareto frontを見てようやく、この広がりの大きさが具体的に見えた。
今日のGitHubトレンド p-e-w/heretic Hereticは、トレーニング不要で大規模言語モデル（LLM）の挙動を修正するツールです。 検閲の解除や不要な応答の抑制などが可能で、数学的な手法を用いてモデルを制御します。 膨大な計算資源を必要とせず、ゲーミングPCなどの個人環境で動作するように設計されており、通常は企業しか行えないモデルの修正を個人レベルで実現することを目的としています。
试了下 heretic 不训练直接改本地模型行为 去审查 压 AI 味 治谄媚 GitHub 三万八千星 你更信这种拧权重 还是重训一版 p-e-w/heretic t.co
⭐ 38к звёзд — и это не чат-бот с бантиками. Heretic перепрошивает языковые модели БЕЗ обучения: сносит цензуру, глушит слоп и лизоблюдство. Никаких танцев с лорами и тоннами GPU — просто правишь мозг модели как захочешь. p-e-w/heretic
LLM Uncensoring Tool and OSS LLM Uncensoring Tool "Heretic" Evolves to 2.0. The popular OSS that garnered 37,700 GitHub stars has fundamentally changed its approach to removing refusal responses. ◼︎ Conventional Problems General Abliteration treats refusal responses as specific vector directions and removes their components. However, in models where refusal responses are not expressed in a single direction, it couldn't remove them sufficiently or even impaired the model's capabilities. ◼︎ Heretic 2.0's New Method "ARA" Instead of removing one direction like before, it directly optimizes the weight matrices. There are two goals. ・Bring the internal representations for refusal-targeted inputs closer to those for normal inputs ・Change the internal representations for normal inputs as little as possible This is achieved using an optimization technique called L-BFGS. A key feature is that it has no limit on the number of directions to modify. ◼︎ Handles More Than Just Refusal Removal Furthermore, version 2.0 allows evaluation metrics to be added as plugins. In addition to refusal responses, ・AI-specific unnatural canned phrases ・Excessive pandering to users ・Emotional response tendencies can also be targeted for correction. ◼︎ What's Interesting About It? Up until now, it was crucial to figure out where to extract refusal directions from, which layers to target, and how much to remove. ARA takes it a step further by letting you specify the behaviors you want to keep and those you want to eliminate, then optimizing the weight matrices accordingly. It has evolved from a mere uncensoring tool into one that edits the very behavior of LLMs. Comparing it to the refusal removal techniques I'm researching sounds intriguing too GitHub
GitHub 仓库：p-e-w/heretic 官网：heretic-project.org PyPI heretic-llm：pypi.org Release v2.0.0：github.com/p-e-w/heretic/releases/tag/v2.0.0 1.x→2.x 迁移：github.com/p-e-w/heretic/blob/master/docs/migrati… HF heretic 模型筛选：huggingface.co Heretic Grimoire：huggingface.co
This was the first thing that came to my mind as well. For the unknowns, this is a pretty/popular project for the same task: p-e-w/heretic You can search huggingface for models with word "heretic" in them... huggingface.co