Heretic 2.0 Released: Plugins, ARA Modifier and Reproducible Models

Heretic 2.0 is out. The open-source tool for modifying language models without retraining shipped its biggest release yet on November 1, 2026, according to the GitHub release page. It adds a plugin system, a new default modifier called Arbitrary-Rank Ablation (ARA), headless operation, reproducible model uploads, and support for models with Hyper-Connections. It also breaks every 1.x configuration file.

If you already use Heretic to strip refusals from local models, plan a short migration. If you have only heard of it, this release is the point where it stops being a one-trick "uncensor" script and starts looking like a general framework for steering model behavior. Our earlier complete guide to Heretic covers the original design; this post covers what is new and what to weigh before you use it.

Heretic 2.0 at a glance

What changed from Heretic 1.x?

The release notes list a long set of additions. The ones that change how you work:

• A generic plugin system. You can write custom scorers and modifiers and point Heretic at them by module path, or by file path plus class name. A new benchmark scorer and a generic BERT-classifier scorer ship as examples of the pattern.
• Modifier plugins and ARA support. The default modifier is now ARA. Classic directional ablation, the technique people call abliteration, is still available as the second modifier, with projected abliteration and norm preservation options.
• Headless operation and end-to-end tests. Heretic can now run without an interactive terminal, which matters if you want to script model builds in CI or on a rented GPU box.
• A reproducible property for plugins. This ties into the new reproduce manifests described below.
• Hyper-Connections support. Newer architectures that use Hyper-Connections can now be processed.
• Smaller conveniences. Configurable upload tags and adjectives that describe the produced model type, dataset config and subset selection, the ability to disable MLP ablation by setting a max-weight floor of zero, and a new example config named config.nosyco.toml aimed at sycophancy.
• Fixes. The notes mention a trial-count bug, a Windows UnicodeEncodeError, LoRA state carrying over between trials, refusal-keyword validation, chain-of-thought prefix detection and PyTorch log spam.

Python 3.14 and 3.15 were also added to the CI test matrix, and dependencies were updated.

What was removed

Two things to know before you upgrade. First, 1.x configuration files are incompatible; the README points to a migration guide. Second, the research features were removed from the main tool, and the release notes name Lophius (lophius.org) as the intended replacement. If you relied on those experiments, check that project instead of waiting for them to return.

How does Heretic work?

Per the project README, Heretic is a training-free tool. It does not fine-tune a model on new data. Instead it works in three parts:

1. A modifier changes the model's internal behavior. The default is ARA; the alternative is classic directional ablation.
2. An optimizer, a TPE-based hyperparameter search from Optuna, tries many parameter settings for the modifier.
3. Scorers judge each trial. The defaults are refusal rate and KL divergence from the original model, so the search looks for settings that remove refusals while changing everything else as little as possible.

That last point is the idea that made Heretic popular. Manual abliteration often damages general ability because the person doing it picks parameters by feel. Automating the search against a divergence score is what let the project claim lower damage than hand-tuned versions, a comparison we walked through in the original guide. The README says independent benchmarks such as MMLU and GSM8K found Heretic-made models competitive with other abliteration tools; treat that as the project's own summary and check the benchmarks yourself for the model you care about.

What 2.0 adds is generality. Because scorers are now plugins, "reduce refusals" becomes one objective among many. The README lists slop, humor, sycophancy and emotional alignment as other targets reachable through configuration files. The idea is the same: contrast two sets of example prompts, score the result, and let the optimizer search.

Open and closed model access shown as two rows of server racks joined by a cable, the split behind Heretic 2.0 open-weight modification

How do I try Heretic 2.0?

The README gives the basic path:

pip install -U heretic-llm
heretic Qwen/Qwen3-4B-Instruct-2507

Requirements are Python 3.10 or newer and PyTorch 2.6 or newer. The README reports about 30 to 40 minutes on an RTX 3090 for Qwen3-4B-Instruct-2507 with the default configuration, and says optional 4-bit quantization through bitsandbytes lowers VRAM needs. Treat those timings as the maintainers' figures for one GPU and one model, not a guarantee for yours.

A practical first run:

• Start with a small dense model so a failed trial costs minutes, not hours.
• Keep the default scorers (refusal rate and KL divergence) before you experiment with custom ones.
• Read the migration guide first if you have a 1.x config.
• If you want to steer something other than refusals, begin from one of the example configs, such as the new config.nosyco.toml, rather than writing a scorer from scratch.

Supported architectures, per the README, include most dense models, many multimodal models, several mixture-of-experts designs and many hybrid models.

Reproducible models: the quiet big change

One feature deserves more attention than it will get. Models uploaded with reproducibility information include a reproduce.json manifest of about 9 KB. Running heretic --reproduce against it can recreate the model, and heretic --collect-reproducibles downloads public manifests into a local folder.

Why it matters: thousands of modified models circulate on Hugging Face, and until now you mostly had to trust the uploader that a "Heretic" label meant what it said. A manifest gives you a way to rebuild the model from the base weights and the recorded settings, then compare. The README is candid that hashes may differ depending on your environment, so this is a verification aid, not a cryptographic proof.

That has a security angle. Our coverage of a backdoored Qwen2.5-7B built for under $50 showed how an "abliterated" download can hide something worse than missing refusals. Reproducibility will not stop that by itself, but it gives careful users a path other than blind trust.

Why does a training-free model editor matter?

Three reasons.

Local users get control. People who run models on their own hardware often hit refusals that are overcautious for legitimate work, such as security research, fiction or medical questions. A tool that removes them cheaply is useful, and our look at an audit of Qwen censorship shows why the demand exists.

Behavior steering is becoming a commodity. Heretic is not alone in showing that a few directions inside a model carry a lot of behavior. A separate write-up on two-neuron steering of Qwen3.5-4B into a hostile persona points the same way. The mechanism that removes a refusal can also add a persona, and 2.0's plugin system makes that more accessible.

Safety training can be undone cheaply. Open weights plus a free tool means alignment applied by the original lab is not durable. Work from the UK AI Security Institute on filtering pretraining data in protein models makes a similar point about fine-tuning recovering removed capability. Anyone building on open weights should assume the guardrails are optional.

Risks and limits to weigh

• You remove a safety layer. A model without refusals will answer things the original would decline. Do not put one in front of untrusted users or give it powerful tools. If you run agents on local models, pair them with controls that stop dangerous actions; AgentBeam is the agent security platform from the explainx.ai team built for that.
• Quality is not guaranteed. KL divergence is a proxy. A low score means the output distribution stayed close on the test prompts, not that every skill survived. Run your own evals.
• The AGPL license has consequences. If you offer a modified Heretic as a network service, AGPL-3.0 obliges you to share the source of your modifications. Read it before building a product.
• Provenance varies. The author's claim of more than 8,500 models on Hugging Face is the author's figure, and quality and intent differ across uploaders. Prefer models with a reproduce manifest, and compare against your own rebuild when it matters.
• The release is a day old. The repository page showed 32 open issues and 28 open pull requests when we checked. Expect follow-up fixes, and pin the version in anything you automate.

For hosted variants of the same technique, see our reports on an abliterated DeepSeek V4.1 Flash API, which separates what a vendor claims from what was verified.

What developers are saying

The Hacker News submission for the release, which reposts the author's announcement from the LocalLLaMA community, had little discussion at the time of writing, so there are no hands-on test reports to cite yet. The plugin system and the sycophancy example config are the concrete evidence that the project is expanding beyond refusal removal.

What this means for what you build or run

If you run local models, the practical steps are small. Update heretic-llm, rewrite your config using the migration guide, and test one small model before touching a large one. If you publish modified models, add a reproduce manifest so others can check your work. If you consume them, prefer manifests over trust, and keep any unaligned model away from tools that can act in the real world.

For the wider debugging side of running local models, our guide to fixing local LLM looping with samplers and sandboxing is a useful companion, and Hugging Face SafeAgents shows one way to put a local proxy in front of risky tool calls.

Related reading

• Heretic: Complete Guide to Automatic LLM Censorship Removal
• A $50 backdoored Qwen2.5-7B stole credentials through Codex CLI
• Qwen censorship audit: 3 billion downloads
• Two-neuron steering of Qwen3.5-4B
• Abliterated DeepSeek V4.1 Flash hosted API: claimed vs verified
• Fixing local LLM looping

Sources: the Heretic GitHub repository, the Heretic 2.0 release notes, and the Hacker News submission.

Version details and repository statistics are accurate as of November 1, 2026 and may change as the project updates.