Heretic 2.0 replaces classic abliteration with Arbitrary-Rank Ablation (ARA) as its default editing method, and for most users that is the right default: ARA edits a model through a low-rank adapter instead of removing a single direction, and it needs fewer manual settings. The caveat is that every claim of superior quality so far comes from the project's author, so treat ARA as promising rather than proven. Heretic 2.0.0 was published on GitHub on 1 November 2026 and it is a breaking release, so 1.x configuration files will not run unchanged.
TL;DR
- Heretic 2.0 makes ARA the default modifier. Classic abliteration is still available as an option.
- ARA optimises a LoRA adapter (default rank 50) against three goals, rather than subtracting one refusal direction.
- The release adds a plugin system, headless operation, reproducible model files and support for Hyper-Connections models.
- Configuration files from 1.x are not compatible. A migration guide covers the changes.
- Verdict: use ARA for new edits, keep abliteration for comparison runs, and retest on your own tasks. No independent benchmark exists yet.
What is the difference between ARA and abliteration in Heretic 2.0?
Classic abliteration, described by Arditi et al. (2024), finds one internal "refusal direction" in a model's activations and removes it. It assumes refusal lives in a single direction. That assumption is tidy, but real models may spread the behaviour across several directions.
ARA drops the assumption. According to the design discussion, it captures each module's inputs and outputs with PyTorch hooks, then optimises that module's matrices against three competing goals:
- Outputs for harmless requests should change as little as possible.
- Outputs for requests the model would refuse should move towards the harmless ones.
- Those outputs should also move as far as possible from the original refusals, which the author calls overcorrection.
The author describes the problem as convex, with the L-BFGS solver usually converging in two to three iterations. The implementation lives in PR #446, and the source file src/heretic/modifiers/ara.py sets a default LoRA rank of 50 and 5 optimisation steps.
| Classic abliteration | ARA | |
|---|---|---|
| Core assumption | Refusal is one direction | Refusal can span several directions |
| Edit style | Subtracts the direction from weights | Optimises a low-rank adapter per module |
| Memory | Edits dense weights | LoRA adapter of configurable rank (default 50) |
| Status in 2.0 | Optional second modifier | Default modifier |
| Evidence | Peer-reviewed method paper | Author's own claims, paper pending |
What else is new in Heretic 2.0?
The method swap is the headline, but the release is broader. The release notes list about 40 changes.
Plugins are the largest structural change. "Scorer" plugins define the behaviour you want, such as fewer refusals, less filler phrasing, less sycophancy or a colder tone. "Modifier" plugins apply the editing technique. A plugin can be a plain Python file loaded with the form path/to/plugin.py:ClassName. Shipped scorers include refusal keyword frequency, KL divergence, benchmarks and a generic BERT classifier, and the Optuna optimiser searches for a compromise between their scores. An example config, config.nosyco.toml, targets sycophancy (PR #349).
Other additions:
- Headless operation with end-to-end tests, so a run needs no human in the loop.
- Reproducibility files. Uploaded models can carry a
reproduce.jsonof roughly 9 KB, andheretic --reproducerebuilds the result. Checksums go inSHA256SUMS.txt. - Support for models with Hyper-Connections and better detection of the reasoning prefix in "thinking" models.
- Python 3.14 and 3.15 in the CI matrix.
- Removal of the research features. The release notes point to Lophius as the intended replacement.
How do I upgrade to Heretic 2.0 from 1.x?
Follow these four steps, in order.
- Check your configuration. Back up every 1.x config file. None of them will load as they are.
-
Upgrade the package. Run
pip install -U heretic-llm. The README lists Python 3.10 or later and PyTorch 2.6 or later. - Map your settings. Use the migration guide and the table below.
-
Verify your hardware setup. If VRAM is tight, set
quantization: bnb_4bitto load the model in 4-bit. Gated Hugging Face models also need an account with access granted.
| Heretic 1.x setting | Where it goes in 2.0 |
|---|---|
| Abliteration options |
[modifier.Abliteration] section |
| Refusal settings |
[scorer.KeywordRate] section |
| Search-feature and KL-balancing settings | No longer recognised, remove them |
| Reasoning skip list | Replaced by chain_of_thought_blocks, which has a different structure |
| Implicit abliteration | ARA is now the default, so change the modifiers setting to stay on abliteration |
The last row catches people out. If you upgrade and change nothing else, your next run will use ARA, not the method your earlier results came from.
How much hardware does Heretic 2.0 need?
The tool is described as training-free, and a consumer GPU is enough for small models. The README estimates 30 to 40 minutes on an RTX 3090 for Qwen3-4B-Instruct-2507, a 4-billion-parameter model. That figure is for the README's example, not a guarantee for larger models, and I have not timed it myself. Bigger models will need more VRAM or the 4-bit option, and 4-bit loading adds its own quantisation effects to the result.
Is ARA actually better than abliteration?
Probably better in practice, but unproven. The author published gpt-oss-20b-heretic-ara-v3 on Hugging Face and says it clearly beats existing abliterated builds of gpt-oss-20b. That is the author's assessment. The README says the method paper is still to come, and no independent benchmark has been published.
There is also a measurement trap. KL divergence tells you how far the edited model has drifted from the original, not whether it still does your task well. A low KL score on a coding model does not show that it still writes correct code. Rerun your own evaluations after any edit. If your base model choice is still open, our comparison of open-source coding models and the Qwen, Claude and Kimi breakdown give a reasonable baseline to test against.
The ARA design weighs in its favour: a convex objective with a fast solver is easier to reason about than a hand-tuned search. The evidence weighs against: one author, one showcase model, no paper yet.
Who should use Heretic 2.0, and what are the risks?
Use it if you run local models and want to change refusal or tone behaviour without training. The reproducibility files are a real benefit, because a published edit can be audited and rebuilt. Teams building agentic coding tools sometimes run into over-cautious refusals in automated workflows, and a scorer-based edit is one way to address that, though you should compare it against simply choosing a different agent first.
Be careful about distribution. Removing safety behaviour has consequences, and platform rules apply. One report says Hugging Face disabled an unfiltered GLM-5.3 upload on 25 October 2026, while thousands of uncensored uploads remain. Check Hugging Face's content policy and the base model's licence before you publish anything.
The project is widely used, but the author's own usage claims for modified models and downloads are not independently verified, so treat them with caution. Built by developer Philipp Emanuel Weidmann, it counted 37,700 GitHub stars as of November 2, 2026 (repository). A release write-up from Startup Fortune counted 13 million cumulative downloads by May 2026, per a Financial Times and Alice Research investigation, while We Are the Frontier frames the same release as part of a wider trend of refusal removal becoming a packaged, repeatable process across the open-weight ecosystem and ExplainX catalogs the same breaking change from 1.x.
Frequently asked questions
Q: Is Heretic 2.0 backwards compatible with 1.x configs?
A: No. The release notes state that 1.x configuration files are not compatible, so you must migrate them using the official migration guide before the tool will run.
Q: Can I still use classic abliteration in Heretic 2.0?
A: Yes. Abliteration is kept as an optional modifier. Because ARA is now the default, you need to change the modifiers setting and move your options into the [modifier.Abliteration] section.
Q: What is Arbitrary-Rank Ablation?
A: ARA is a model-editing method that optimises a low-rank LoRA adapter for each module, rather than removing one refusal direction. It balances leaving harmless outputs unchanged, moving refused outputs towards harmless ones, and overcorrecting away from the original refusals.
Q: How do I install Heretic 2.0?
A: Run pip install -U heretic-llm with Python 3.10 or later and PyTorch 2.6 or later. Then migrate your configuration and, if needed, enable quantization: bnb_4bit to reduce VRAM use.
Q: Is ARA proven to beat abliteration?
A: Not independently. The claim comes from the project's author, and the method paper is still pending according to the README. Run your own task tests on any edited model before relying on it.
Q: Does Heretic 2.0 require retraining the model?
A: No. The README describes the tool as training-free. ARA fits an adapter by optimisation against captured activations, which is a different and much lighter process than fine-tuning.
Top comments (0)