Heretic: Automated Model Surgery Removes Refusal Without Damaging Capabilities

Have you ever wondered why AI sometimes solemnly says "Sorry, I can't help you" even for simple requests? Most people attribute this to "rules set for the AI," but the deeper question is: where exactly are these rules written, and can they be directly modified?

GitHub project Heretic (p-e-w/heretic, 30k+ stars, Python, AGPL-3.0, actively maintained as of 2026-09-02) tackles "directly modifying model behavior." It calls itself a "fully automatic censorship removal tool," but it is not a jailbreak tool. Jailbreak operates at the prompt level — inducing the model to bypass refusal without changing the model itself — which is cheap but unstable. Heretic operates at the model level: it obtains model weights, analyzes internal representations to find the "refusal direction," then modifies the weights to produce a new model. This is an automated Abliteration (directional ablation) tool, performing "surgery" on the model rather than "tricking" it.

Why Models Refuse

Modern chat models (ChatGPT, Claude, Qwen) follow a pipeline: massive internet data → pretraining → base model → supervised fine-tuning (SFT) → preference training (DPO/RLHF) → safety alignment → final chat model. Pretraining teaches next-token prediction; post-training shapes behavior. Refusal is largely a behavior deliberately reinforced during safety alignment, not an innate trait of the base model. This implies refusal, being a learned behavior, might be weakened without full retraining.

Behavior Hidden in Latent Space

Transformer layers produce high-dimensional hidden states (e.g., 4096 dimensions). Researchers discovered that abstract concepts, emotions, and behavioral tendencies like "refusal" correspond to stable directions in this latent space. Representation Engineering (RepE) studies these internal representations. By comparing hidden states for contrasting inputs (e.g., honest vs. dishonest answers), one can compute a concept vector:

Concept Vector ≈ mean(positive activations) - mean(negative activations)

. The same method yields a Refusal Direction. Key project: andyzoujm/representation-engineering (~1k stars), paper "Representation Engineering: A Top-Down Approach to AI Transparency."

Steering Vector: Pushing the Model at Inference Time

Given a behavior direction V, one can steer the model at inference by adding it to hidden states: h' = h + αV, where α controls strength. This is an inference-time intervention — temporary, reversible, not changing weights. It enables "knobs" for humor, honesty, verbosity, etc. However, it must be reapplied each inference.

Abliteration: Permanently Cutting the Direction

Directional Ablation (Abliteration) asks: if a direction is never needed, can we weaken it directly in the weights? The process: load model → extract refusal direction R by comparing hidden states for normal vs. sensitive prompts → apply directional ablation to weights to suppress R → save modified model. Unlike steering vectors (runtime activation changes), Abliteration permanently modifies weights, producing a standalone model.

Heretic's Innovation: Full Automation with Optuna and KL Divergence

Manual Abliteration requires painstaking hyperparameter choices: which layers, how much per layer, which direction, projection strength, avoiding capability damage. Heretic automates this via an optimizer combining directional ablation, Optuna's TPE sampler, refusal-rate evaluation, and KL divergence evaluation. It iterates: load model → extract refusal direction → generate parameters → modify weights → test refusal rate and KL divergence → optimizer searches better parameters → repeat until balance.

The dual objective: minimize refusal rate while keeping KL divergence low. KL divergence measures how much the modified model's output distribution on normal prompts deviates from the original. Low KL means original capabilities are preserved. Heretic's results on Gemma-3-12B demonstrate this balance:

Original model: refusal 97/100, KL 0 (baseline)

Manual Abliteration: refusal 3/100, KL 1.04 (significant capability damage)

Heretic (automated): refusal 3/100, KL 0.16 (capability nearly intact)

Usage is a single command:

pip install -U heretic-llm heretic Qwen/Qwen3-4B-Instruct-2507

. No need to understand Transformer internals; community has published 5000+ models on HuggingFace.

Taxonomy of Model Modification Levels

Placing Heretic in the broader landscape reveals four levels, from light to heavy:

Prompt/Context Layer (no model change) : system prompts, few-shot, jailbreaks. Cheap, temporary, brittle. Good for tone/role changes.

Activation/Representation Layer (inference-time intervention) : RepE, Steering Vectors, SAE Feature Steering. No weight changes; steer at runtime. Good for personality, emotion, behavioral tendencies.

Weight Editing Layer (direct weight modification) : Abliteration (Heretic), Model Editing (ROME/MEMIT). Permanent, saveable as new model. Good for weakening specific behavioral directions or editing facts.

Training Layer (retraining) : SFT, LoRA, DPO/RLHF. Teaches new tasks/capabilities, highest cost.

Rule: higher levels are lighter and more temporary; lower levels are deeper, more permanent, costlier.

Toolchain: Understand → Control → Modify

Open-source ecosystem along this pipeline:

Understand internals : TransformerLens (~3.8k stars) — mechanistic interpretability toolkit for GPT-style models; SAELens (~1.5k stars) — train/analyze sparse autoencoders on LMs.

Understand high-level behavior : Representation Engineering (~1k stars) — study internal representations of truthfulness, emotion, refusal, safety.

Runtime control : repeng (~750 stars) — create RepE control vectors, export to GGUF for llama.cpp; steering-vectors (~160 stars) — steering vector library for HF/PyTorch models (Llama, Gemma, Mistral); IBM activation-steering (~180 stars) — generic activation steering, can even add refusal behavior.

Permanent behavior modification : Heretic (30k stars) — automated Abliteration.

Knowledge editing : ROME (~700+ stars) — rank-one model editing for precise fact changes; MEMIT (~500+ stars) — batch fact editing.

This toolchain signals a shift from "training LLMs" to "understanding and operating LLM internals," akin to the evolution from black-box programs to debuggers and decompilers.

Selection Guide: Which Tool for Which Scenario

Change tone/role → System Prompt.

Teach domain expertise (medical, legal, finance, internal knowledge) → RAG + LoRA/SFT, not steering vectors.

Control personality (more humorous, concise, confident) → Steering Vector / RepE; if prompt suffices, don't touch internals.

Research why a behavior emerges → Mechanistic interpretability (TransformerLens, SAELens, RepE).

Weaken a specific behavioral direction → Directional Ablation / Abliteration / Heretic.

Edit factual knowledge → Model Editing (ROME, MEMIT).

Risks and Boundaries: No "Honesty Button"

These techniques do not imply a clean "honesty switch" inside the model. High-level concepts like honesty are distributed representations across hundreds or thousands of neurons, varying across layers. A steering vector's existence on a specific task, model, and layer does not mean the model has been fully reverse-engineered. Model behavior modification is dual-use: can reduce hallucinations, increase honesty, control tone, understand safety mechanisms; but can also weaken safety, amplify unreliable outputs, break alignment. The worthwhile research direction is not "make the model answer everything" but: "How are model behaviors formed? Can we make controllable, interpretable, evaluable modifications while preserving original capabilities?" Heretic's core technical value is not "uncensoring" but demonstrating a "precision surgery" approach to model engineering — automatically searching for minimal behavior-modification directions.

A Larger Trend

Heretic appears as a niche "de-refusal tool," but it sits on a critical trajectory: understand internal representations, then directly control and modify the model . Most AI development today stays external — prompts, RAG, fine-tuning, agents. Mechanistic interpretability, representation engineering, activation steering, model editing represent the opposite path: go inside, understand, locate, control, modify. Heretic foreshadows a future where modifying LLMs may not always require retraining — some capabilities, knowledge, and behaviors might be analyzed and intervened upon as precisely as debugging software, changing configs, or patching. As this toolchain matures, "LLM Internal Engineering" may emerge as a new discipline.