Heretic 2.0 adds plugins and headless runs to the tool that strips AI refusals

Heretic, the open-source command-line tool that automatically strips refusal behavior from language models, has reached version 2.0. The release, flagged on r/LocalLLaMA and published by developer p-e-w on GitHub on 1 November, adds a plugin system and headless operation, and breaks 1.x configuration files.

A plugin system replaces the fixed pipeline

According to the GitHub release notes for v2.0.0, the headline change is a generic plugin system, with modifier plugins and a method called ARA among the first things built on it. Plugins can now declare a reproducible property. The release also adds a benchmark scorer and a generic scorer plugin based on a BERT classifier, which lets users judge a modified model with their own measure rather than only a refusal count.

Other additions listed in the notes:

• Headless operation and end-to-end tests, so runs can be scripted without an interactive session.
• Support for models with Hyper-Connections, including those with flattened residual streams.
• Configurable upload tags and a configurable adjective describing the type of model produced.
• A config.nosyco.toml example configuration.
• A way to switch off MLP ablation by setting a max_weight floor of 0.
• Python 3.14 and 3.15 added to the test matrix.

The notes also list fixes for a Windows UnicodeEncodeError, LoRA state carrying over between trials, and trial counting, plus better detection of response prefixes in thinking models. The release credits about 21 contributors, 11 of them first-timers.

Old configs break and research features are gone

Two changes will affect existing users. Configuration files from Heretic 1.x do not work with 2.0, and the release points to a migration guide. The built-in research features were removed; the notes name Lophius (lophius.org) as the intended replacement. The notes do not say what those features did in detail, so anyone who relied on them should check the repository before upgrading.

The tool is free. Third-party pages describe the package as installable with pip install -U heretic-llm; the 2.0 notes do not state whether that command is unchanged. The same sources say the project uses the AGPLv3+ license, and that anyone redistributing a modified model needs to check both the base model’s license and Heretic’s.

Abliteration moves from one-off trick to workflow

Heretic automates directional ablation, often called abliteration, which finds the internal direction associated with refusals and suppresses it. Per third-party descriptions, it uses an Optuna-based TPE optimizer to search for parameters automatically while trying to keep the edited model close to the original. Model hosts show the result. Featherless lists a Heretic version of Llama 3.1 8B Instruct with 3 refusals out of 100 test prompts against 96 for the original, and a KL divergence of 0.02. For phi-4 it lists 41 of 100 against 100 of 100. These figures come from a hosting page, not from the 2.0 release, and were not independently verified here.

A plugin architecture, headless mode and pluggable scorers mean the tool can be wired into pipelines that produce and publish many modified models without a person watching each run. The configurable upload tags point the same way. That lowers the effort of releasing uncensored variants of open-weight models, a practice already common on Hugging Face.

What the release does not settle

Removing refusals cuts both ways. Researchers and hobbyists use it to get around over-cautious answers; it also strips guardrails that model makers put in deliberately, and the 2.0 notes say nothing about misuse or safeguards. The Hyper-Connections support suggests Heretic is keeping pace with newer architectures, but the release gives no measurements for them. Nor does it publish refusal or quality benchmarks for 2.0 itself, so claims that it modifies models better than 1.x remain untested here.

Open-weight models can be altered by anyone who holds the weights, which is part of why model makers and regulators argue over how such releases should be handled. Tools like Heretic make that argument concrete: the cost of undoing a safety tuning step is now a command-line run.