An open-source tool called Heretic strips censorship from AI models in minutes. Since its February release, the community has created over 1,000 uncensored models, and the project is trending on GitHub this week with 661 stars gained today. This isn’t jailbreaking—Heretic permanently modifies model weights using “abliteration” to remove refusal capability entirely, challenging who controls AI: corporations or users.
Install it with pip, point it at any transformer model, and 45 minutes later you have an uncensored version retaining the original intelligence. No ML expertise required. Over 1,000 abliterated models now exist on HuggingFace, from Llama 4 to Qwen 2.5 to DeepSeek V3.
How Abliteration Actually Works
Abliteration identifies neural network directions that trigger “refusal” behavior and mathematically removes them. Research shows refusal behavior links to specific subspaces in the model’s residual stream. Instead of deleting model parts or retraining on uncensored data, abliteration surgically removes refusal directions.
Heretic automates this process. It computes differences between hidden states from “harmful” versus “harmless” prompts, identifies refusal directions, then uses Optuna’s TPE optimizer to suppress those directions while preserving model capabilities. The result: 3/100 refusals on harmful prompts with 0.16 KL divergence—versus 0.45-1.04 for competitors.
Lower KL divergence means the uncensored model behaves like the original on normal tasks—same capability, just without corporate guardrails.
Installation is trivial:
pip install -U heretic-llm
heretic Qwen/Qwen3-4B-Instruct-2507Version 1.2 cuts VRAM usage by 70% through quantization. An 8B model takes 45 minutes on an RTX 3090. Anyone who can run a command-line tool can now uncensor models.
The Safety vs Freedom Debate
Heretic forces an uncomfortable question: Who decides what’s “safe” in AI? The three camps have different answers.
Safety researchers argue alignment prevents harm—models that refuse dangerous requests reduce misuse risk. Removing safety is reckless.
Open-source advocates counter that “safety alignment” is paternalistic censorship. Corporations use it to protect their interests, forcing models to output company-favorable values. The question isn’t safety—it’s control.
Developers face over-cautious models refusing legitimate requests. Writers hit friction on mature themes with no legal basis. Researchers need uncensored models to study failure modes. Agentic workflows break when models refuse intermediate steps. These are false positives blocking legal, ethical work.
The 2026 International AI Safety Report notes no universal consensus on desirable AI behavior. Pluralistic alignment techniques exist—avoiding controversy, aligning with majority views, tailoring to users—but no approach satisfies everyone. Governments are pushing to ban undisclosed political censorship, recognizing “safety” can be weaponized.
Current alignment is crude and paternalistic—that’s what Heretic exposes. Models refuse fictional murder mysteries because “murder” triggers filters. They refuse historical education. They refuse legal adult content. These aren’t edge cases—they’re daily frustrations.
Real-World Use Cases
The “only bad people want uncensored models” narrative is lazy. Legitimate uses exist.
Safety researchers need uncensored models to study failure modes. Red teaming requires pushing limits. Creative writers get blocked on mature themes—models can’t distinguish depicting violence in fiction from endorsing it. Legally permissible, artistically valuable content triggers corporate guardrails.
Agentic workflows break when models refuse intermediate steps. A cybersecurity assessment agent needs to outline attack vectors—legal work, but “attack” triggers refusal. Abliterated models preserve 200K context and coding capability without interruptions.
Local deployment gives full control—no API calls, no logging, no surveillance. The user decides what’s acceptable, not distant corporations.
1,000+ community models on HuggingFace show real demand for solving problems corporate alignment blocks.
What This Changes
Heretic democratizes uncensored AI. Previously: use pre-made models (limited), fine-tune your own (expensive, slow), or jailbreak (unreliable). Now anyone can uncensor models in under an hour.
The genie’s out. The technique exists, code is open-source, knowledge is distributed. You can’t un-invent abliteration. The conversation shifted from “should uncensored models exist?” to “how do we handle them?”
This may accelerate regulation—restricting distribution, requiring alignment, imposing liability. Or it could validate user control, proving paternalistic alignment fails because users route around it.
The real question is philosophical: trust users or trust corporations? Current alignment assumes corporations know best. Heretic returns control to users.
The Bottom Line
Heretic is technically impressive. The abliteration approach is scientifically sound, the automation is effective, and the quality preservation is measurably better than alternatives. Processing models in 45 minutes on consumer hardware with one command—that’s a genuine engineering achievement.
However, Heretic is also a symptom of a bigger problem. Current alignment is crude, paternalistic, and increasingly divorced from actual harm reduction. It’s safety theater that frustrates legitimate work while doing little to prevent determined bad actors. The solution isn’t censorship AND it isn’t uncensored chaos. We need better approaches to AI safety that respect user agency, acknowledge legitimate use cases, and distinguish between actual harm and corporate risk avoidance.
The community has spoken with 1,000+ uncensored models. The demand is real. The question now is whether the industry will respond with better alignment techniques or double down on paternalism. Heretic proves the latter won’t work—users will route around it.
