Heretic removes restrictions from language models

Who Should Read

A developer whose local open-weight LLM refuses legitimate security or reverse-engineering tasks

Core Mechanics

• Heretic removes model restrictions
  • It describes itself as removing restrictions from language models so they always follow instructions.
  • That is the claim on the official site.
• Install and run take two lines
  • Install with pip install -U heretic-llm.
  • Run it by passing a model name, e.g. heretic Qwen/Qwen3.5-4B.
• Licensed under AGPL v3 or later
  • It is released as Free Software.
  • Copyright belongs to Philipp Emanuel Weidmann and contributors.
• Docs and community channels exist
  • There are Tutorial, Installation, Configuration and Security pages.
  • Links to GitHub, Hugging Face, Discord and Matrix are provided.
• The page gives no mechanism or numbers
  • The site text includes no performance figures or comparisons.

Community Reactions

• Useful for reversing my own device, one user said
  • They tried to regain control of a Chinese IP camera with known CVEs, but every hosted model refused.
  • They said abliterated models were vital.
• Opinion: the knowledge may not be there
  • Training data shaped around refusals may mean the real information isn't in the model.
  • Forcing an answer can produce hallucinations and hurt unrelated questions.
• Opinion: the metrics are overstated
  • Citing only refusal count and KL divergence makes results look more dramatic.
  • KL charts say little about a focused topic.
• Answers got worse after removal, one user found
  • The model stops refusing but answers previously refused questions poorly.
  • They compared it to amateur brain surgery.

How to Apply

• Measure refusal rate on a small model first
  • Run heretic on Qwen/Qwen3.5-4B today.
  • Compare before and after on about 10 legitimate prompts that usually get refused.
• Build a legitimate security question set
  • Collect questions like reversing your own device or a PoC for a CVE on your own network.
  • Run them on both models and record refusals and accuracy.
• Evaluate unrelated tasks too
  • Run regression tests on coding or summarization.
  • Check quality loss, not just refusal rate.
• Check the AGPL terms first
  • Confirm AGPL v3 or later conditions with legal before integrating into an internal service.

Try It

# Paste into a terminal (shell): install and run example from the original page

pip install -U heretic-llm

heretic Qwen/Qwen3.5-4B

# Next: ask the original and modified models the same 10 questions and compare refusals and answer quality

Terminology

Related Papers

• The Judge Can Debias Itself: Awareness and Self-Debiasing for Reliable LLM-as-a-Judge

  Warning an LLM judge about bias or letting it self-critique improved 20 of 21 model–bias combinations.

• 90% of US working hours are spent on tasks not covered well by AI benchmarks

  Mapping 29 benchmarks to job tasks shows 90% of US working hours lack good coverage

• Postgres 19 delayed after AI reviewers find more bugs than humans can fix

  LLM code review surfaced so many bugs that Postgres 19 slipped to November and 8-10 features were reverted

• Show HN: Gemini 4 Argon plays StarCraft

  LLMs wrote StarCraft bots in one hour; GPT-6 Astra scored highest.

• A Plausible Explanation Is Enough to Mislead Multimodal Judges

  Adding plausible explanations to fixed answers cut MLLM judges' wrong-answer rejection by 12.7–13.8 points.

• Neural networks are clean

  Looking at neurons directly shows most have one main job, challenging superposition.

Related Resources

• https://heretic-project.org/
• https://news.ycombinator.com/item?id=45945587