The Heretic project claims its released tooling can remove refusal restrictions from supported open language models, potentially making unrestricted local variants easier to produce while weakening model-level safety controls.

state: resolvedheat: lowuncertainty: mediumknownscott: lowopen-models model-safety local-inferenceHeretic

Surfaced 2026-09-21T23:22:59Z — Heretic removes restrictions from language models — The episode now includes a separate released implementation claiming reversible KV-cache refusal suppression, extending the design space beyond Heretic's weight editing without validating Heretic itself. Cross-platform spread warrants high attention, but neither implementation has independent evidence here of reliable refusal removal with preserved capabilities.

What is this?

Heretic is an open-source CLI (pip: heretic-llm, AGPLv3) released in early 2026 by developer p-e-w (Philipp Emanuel Weidmann) that automatically removes refusal behavior — 'safety alignment' — from open-weight LLMs, building on Arditi et al. 2024's finding that refusal is mediated by a single residual-stream direction: directional ablation plus Optuna-driven parameter search that co-minimizes refusals and KL divergence from the base model. Widely cited benchmarks (Gemma-3-12B-IT: 3/100 refusals at KL 0.16 vs 0.45–1.04 for manual abliteration) all trace to the project's own eval tooling — presented as reproducible, but no snippet supplies genuinely independent audit, and coverage explicitly flags refusal-detection false positives as an open measurement problem. Traction is substantial: ~19.7K GitHub stars (+2.4K in the last week, top-15 trending), a reported 1,000+ community-published variants on Hugging Face, and the episode has widened into a family of alternative removal approaches (reversible KV-cache injection, activation steering) with mainstream amplification when PewDiePie covered the tool and shipped his own derived uncensored Qwen variant. Commentary also notes emerging hardening-against-ablation countermeasure research and the reverse application of ablating unwanted behaviors like sycophancy, while none of the supplied material settles the capability-preservation question beyond project-generated KL numbers.

Why it matters to Scott

Scott's own canon already carries the exact claim this case demonstrates — Architecture, Not Vibes and Guardrail Illusion hold that model-level behavioural controls are removable probability barriers and cannot serve as the enforcement boundary — so a pip-installable, mainstream-amplified removal tool is the world agreeing with him again, not news for him. The widened spread (PewDiePie as producer, daily-driver adoption of a Heretic finetune, a four-tool removal family) is material for the radar's proliferation tracking, but it challenges nothing in the hits and changes nothing he'd build or argue: removable vibes-level safety is the premise SiloOS and 'can't beats shouldn't' were designed around.

ip:framework.architecture-not-vibesip:concept.guardrail-illusionip:concept.trust-hierarchyradar:qwen38-abliteration-safety-tradeoffradar:gemma4-abliteration-evaluationradar:concept.activation-steering

queries asked of Scott's wikis

guardrail illusion model-level safety enforcement boundary
architecture not vibes behavioral controls removable
over-refusal blocking legitimate dev work local model workflow
open-weights local inference dual-use sovereignty regulation
activation steering refusal direction interpretability representation engineering
model eval harness capability preservation KL divergence refusal benchmarks

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

09-21 04:35	⭐ origin directly observed	Heretic removes restrictions from language models Bluestein on hacker news	—
09-21 22:55	first on r/LocalLLaMA · published · +18.3h	Uncensor an LLM without touching weights: inject a tiny trained KV-cache bank (~18MB) and unload it anytime Anony6666	—
09-24 14:33	first on hacker news · published · +82.0h	Dynamic Abliteration: Non-Destructive Refusal Suppression via Engram Steering phatak-dev	—
10-02 17:25	first on r/singularity · published · +276.8h	PewDiePie says OpenAI banned his account(s) for distillation while building his AI model Ajax and experimenting with decrypting CoT likeastar20	—
10-03 02:52	first on r/artificial · published · +286.3h	PewDiePie unveils "uncensored" Ajax AI model built to run on home PCs — creator says OpenAI banned him twice over model distillation used to build his product ControlCAD	—
09-21 04:35	amplified on hacker news 👑	hn.story.49783101 Bluestein	peak 279 · 111 comments · 25% of case engagement
09-21 22:55	amplified on r/LocalLLaMA	reddit.post.1wms904 Anony6666	peak 460 · 58 comments · 18% of case engagement
09-23 23:08	amplified on r/LocalLLaMA	reddit.post.1wol7zc Khaledthe	peak 316 · 103 comments · 15% of case engagement
09-24 14:33	amplified on hacker news	hn.story.49831201 phatak-dev	peak 108 · 42 comments · 10% of case engagement
09-29 07:35	amplified on hacker news	hn.story.49889532 soltanov	peak 2 · 0 comments · 0% of case engagement
10-01 17:00	amplified on r/LocalLLaMA	reddit.post.1wv4vot -p-e-w-	peak 314 · 89 comments · 14% of case engagement
3 more amplifiers in ainews.case_chain
09-21 10:20	our radar first saw it · +5.8h	discovery anchor: hn.story.49783101	—
09-21 23:22	reached heat=high · +18.8h · via ledger	—	—

Evidence (9) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn ⭐	Heretic removes restrictions from language models Retrieved article excerpt Open article · Retrieved 2026-09-21T10:22:32.208738+00:00 [Skip to content](https://heretic-project.org/#VPContent) [Heretic](https://heretic-project.org/) Search`⌘``Ctrl``K` # Take control of the most important technology of our time Heretic removes restrictions from language models, making sure they always follow your instructions [GitHub](https://github.com/p-e-w/heretic) [Hugging Face](https://huggingface.co/heretic-org) [Discord](https://discord.gg/gdXc48gSyT) [Matrix](https://matrix.to/#/#heretic:matrix.org) Heretic logo Get started in seconds: sh ``` pip install -U heretic-llm heretic Qwen/Qwen3.5-4B ``` [See the Tutorial >>](https://heretic-project.org/tutorial)	Bluestein	279	111
🟠 reddit	Uncensor an LLM without touching weights: inject a tiny trained KV-cache bank (~18MB) and unload it anytime LocalLLaMA	Anony6666	460	58
🟠 reddit	Using uncensored models makes working less of a headache LocalLLaMA	Khaledthe	316	103
🟧 hn	Dynamic Abliteration: Non-Destructive Refusal Suppression via Engram Steering	phatak-dev	108	42
🟧 hn	Obliteratus Removes LLM Censorship	soltanov	2	0
🟠 reddit	Heretic is on PewDiePie! LocalLLaMA	-p-e-w-	314	89
🟧 hn	PewDiePie uncensors Qwen3.5-9B with Heretic	alanwreath	2	1
🟠 reddit	PewDiePie says OpenAI banned his account(s) for distillation while building his AI model Ajax and experimenting with decrypting CoT singularity	likeastar20	84	37
🟠 reddit	PewDiePie unveils "uncensored" Ajax AI model built to run on home PCs — creator says OpenAI banned him twice over model distillation used to build his product artificial	ControlCAD	429	97

Interpretation history

2026-10-04T07:52:13Z
Episode closed as established: every velocity_spike trigger since the crest was a stale residual — total-score crossings of the p90 line by 300h-old posts (1wv4vot at 314, the 1wwccsz Ajax repost at 244→310) plus a +4-comment drift — with aggregate velocity at ~4.3 pts/h against a 305 peak, zero new evidence, and the periphery no longer expanding (no new tools, communities or outlets since the PewDiePie wave crested; the 87.5 peer percentile is one already-tracked repost accruing sunk upvotes). The removal-tool ecosystem is now landscape fact rather than a live story; the predicted adoption flood and regulatory response never fired, and future signal (independent audit, hardening countermeasures, regulation) belongs to the sibling radar entries or a fresh case.
2026-10-03T05:37:10Z
The PewDiePie wave has crested: the newest attachment is a near-zero-engagement repost of the already-tracked Ajax/distillation story, not a new community, implementation or outlet, and the velocity_spike trigger reads stale — residual upvotes on a 288h-old post, with aggregate velocity halved again to ~1.8 pts/h against a 277 peak. The case's meaning is unchanged (an established removal-tool ecosystem resting on still-unverified effectiveness numbers), so it cools to low heat: the magnitude-valve reading reflects sunk launch-coverage totals, not ongoing spread, since the periphery has stopped expanding and the adoption flood remains unfired.
2026-10-03T03:23:50Z
evidence attached: reddit.post.1wwccsz — shared external link with case evidence
2026-10-02T18:50:22Z
The newly attached PewDiePie OpenAI-distillation-ban thread is adjacent fallout, not Heretic evidence: it explains why a mainstream creator pivoted from frontier distillation to local open weights and thence to Heretic, and reaches this case only through the shared actor. The case's meaning is unchanged — a widening removal-tool periphery (four tools, daily-driver adoption, PewDiePie now a producer) around an entirely unverified effectiveness claim — so state, uncertainty and low Scott-relevance all hold. Medium heat is kept despite a cooling ~4.3 pts/h aggregate because the periphery is still emitting top-decile objects (this post, 91.7 cohort percentile) within the first day of the PewDiePie wave; all escalation triggers remain unfired.
2026-10-02T17:39:06Z
evidence attached: reddit.post.1wvzpl7 — shared external link with case evidence
2026-10-02T16:47:56Z
grounded: known/low — Scott's own canon already carries the exact claim this case demonstrates — Architecture, Not Vibes and Guardrail Illusion hold that model-level behavioural cont
2026-10-02T16:39:37Z
PewDiePie graduates from amplifier to producer: a derived uncensored Qwen3.5-9B built with Heretic is claimed via HN (2 pts, 1 comment — unverified, but he is a rooted local-LLM creator), firing the case's 'influential entrant ships a derived model' trigger in miniature. State advances to accelerating on the widening periphery (four removal tools, daily-driver adoption, a mainstream creator now shipping variants), while heat holds at medium because the predicted adoption flood has not landed and measured velocity is a cooling ~5 pts/h tail — one Reddit meta-thread re-spiking at ~14 pts/h against a near-zero 276h baseline, not platform dominance.
2026-10-02T16:26:23Z
evidence attached: hn.story.49934603 — High-profile creator shipping an uncensored Qwen variant via Heretic is adoption-and-spread evidence for the unrestriction-tooling case.
2026-10-01T19:07:50Z
PewDiePie coverage moves Heretic from practitioner-niche tooling into mainstream awareness: the case now tracks a removal tool with mass-distribution potential, making the adoption-flood and regulatory-backlash scenarios materially more live while leaving effectiveness and capability-damage claims entirely unverified. Held at medium rather than high because current velocity (~9 pts/h vs a 207 peak) is a decayed tail plus one modest meta-thread, and the magnitude-valve spread reading was already priced at the September peak; escalation waits for the predicted flood of new users and derived models to actually land.
2026-10-01T18:31:30Z
evidence attached: reddit.post.1wv4vot — PewDiePie coverage is mainstream-scale amplification of the restriction-removal tool, materially changing the spread the open case tracks.
2026-09-29T09:00:59Z
Obliteratus arrives as a fourth independent refusal-removal tool, but only as a title-only, zero-traction HN submission — nothing in the item supports the 'prominent actor' framing in the attach rationale — so it firms the spreading-family reading without adding any effectiveness or adoption evidence. With engagement fully decayed (165→~0.3 pts/h, phantom-kv's cohort percentile down from 92nd to 76th) and the only new periphery a noise-level entrant, this is a cooling of attention, not belief: the hypothesis stays corroborated and still unverified in effect.
2026-09-29T08:25:12Z
evidence attached: hn.story.49889532 — A second refusal-removal tool from a different prominent actor extends the open case from one project to a spreading pattern.
2026-09-24T17:49:10Z
magnitude valve eligible (multi-platform, top-decile engagement) and never alerted; deterministic escalation to deliver
2026-09-24T16:38:17Z
evidence attached: hn.story.49831201 — Independent non-destructive steering-based refusal suppression corroborates the case's claim that model-level safety controls are increasingly easy to strip.
2026-09-24T00:41:48Z
An independent user now reports daily-driving a Heretic-derived model for ordinary work, providing initial adoption evidence beyond the project’s own release claims. This corroborates proliferation of easily accessible refusal-suppressed variants, but not reliable safety removal or capability preservation.
2026-09-24T00:31:34Z
evidence attached: reddit.post.1wol7zc — Real adoption evidence: a Heretic-produced unrestricted finetune used as a daily work driver because base models refuse ordinary tasks, supporting the case's proliferation/safety-erosion hypothesis.
2026-09-21T23:22:59Z
The episode now includes a separate released implementation claiming reversible KV-cache refusal suppression, extending the design space beyond Heretic's weight editing without validating Heretic itself. Cross-platform spread warrants high attention, but neither implementation has independent evidence here of reliable refusal removal with preserved capabilities.
2026-09-21T23:22:20Z
evidence attached: reddit.post.1wms904 — The released phantom-kv artifact extends the same model-unrestriction episode with a reversible, hot-swappable KV-cache approach.
2026-09-21T13:58:58Z
grounded: known/low — Scott already argues that model-level behavioural safety is removable and cannot serve as the enforcement boundary in Architecture, Not Vibes and Guardrail Illu
2026-09-21T13:55:48Z
case created — The installable artifact has immediate operational and safety implications and has attracted material early attention.

Decision trace

10-04 18:52resolveEpisode closed as established: every velocity_spike trigger since the crest was a stale residual — total-score crossings of the p90 line by 300h-old posts (1wv4vot at 314, the 1wwccsz Ajax repost at 2
10-04 14:21sensor_dirtyvelocity_spike
10-04 07:22sensor_dirtyvelocity_spike
10-03 23:21sensor_dirtyvelocity_spike
10-03 16:21sensor_dirtyvelocity_spike
10-03 15:37repriceThe PewDiePie wave has crested: the newest attachment is a near-zero-engagement repost of the already-tracked Ajax/distillation story, not a new community, implementation or outlet, and the velocity_s
10-03 13:23attachshared external link with case evidence
10-03 13:20propose_attachshared external link with case evidence
10-03 07:21sensor_dirtyvelocity_spike
10-03 04:50repriceThe newly attached PewDiePie OpenAI-distillation-ban thread is adjacent fallout, not Heretic evidence: it explains why a mainstream creator pivoted from frontier distillation to local open weights and
10-03 03:39attachshared external link with case evidence
10-03 03:32propose_attachshared external link with case evidence
10-03 02:47repricePewDiePie graduates from amplifier to producer: a derived uncensored Qwen3.5-9B built with Heretic is claimed via HN (2 pts, 1 comment — unverified, but he is a rooted local-LLM creator), firing the c
10-03 02:47groundScott's own canon already carries the exact claim this case demonstrates — Architecture, Not Vibes and Guardrail Illusion hold that model-level behavioural controls are removable probability barr
10-03 02:26attachHigh-profile creator shipping an uncensored Qwen variant via Heretic is adoption-and-spread evidence for the unrestriction-tooling case.
10-03 02:26propose_attachHigh-profile creator shipping an uncensored Qwen variant via Heretic is adoption-and-spread evidence for the unrestriction-tooling case.
10-02 20:21sensor_dirtyvelocity_spike
10-02 13:21sensor_dirtyvelocity_spike
10-02 11:21sensor_dirtycomment_update
10-02 06:21sensor_dirtyvelocity_spike
10-02 05:07repricePewDiePie coverage moves Heretic from practitioner-niche tooling into mainstream awareness: the case now tracks a removal tool with mass-distribution potential, making the adoption-flood and regulator
10-02 04:31attachPewDiePie coverage is mainstream-scale amplification of the restriction-removal tool, materially changing the spread the open case tracks.
10-02 04:25propose_attachPewDiePie coverage is mainstream-scale amplification of the restriction-removal tool, materially changing the spread the open case tracks.
09-29 19:00repriceObliteratus arrives as a fourth independent refusal-removal tool, but only as a title-only, zero-traction HN submission — nothing in the item supports the 'prominent actor' framing in the at
09-29 18:25attachA second refusal-removal tool from a different prominent actor extends the open case from one project to a spreading pattern.
09-29 18:23propose_attachA second refusal-removal tool from a different prominent actor extends the open case from one project to a spreading pattern.
09-26 08:02review_screenjev screen: no material development (noul=0.28)
09-25 03:49repriceSince the last look the four known artifacts only accumulated engagement and comments — a few more daily-driver anecdotes for Heretic finetunes, no new implementations, communities, or effectiveness d
09-25 02:38attachIndependent non-destructive steering-based refusal suppression corroborates the case's claim that model-level safety controls are increasingly easy to strip.
09-25 02:28propose_attachIndependent non-destructive steering-based refusal suppression corroborates the case's claim that model-level safety controls are increasingly easy to strip.
09-24 22:20sensor_dirtycomment_update
09-24 14:22sensor_dirtycomment_update
09-24 10:41repriceAn independent user now reports daily-driving a Heretic-derived model for ordinary work, providing initial adoption evidence beyond the project’s own release claims. This corroborates proliferation of
09-24 10:31attachReal adoption evidence: a Heretic-produced unrestricted finetune used as a daily work driver because base models refuse ordinary tasks, supporting the case's proliferation/safety-erosion hypothes
09-24 10:24propose_attachReal adoption evidence: a Heretic-produced unrestricted finetune used as a daily work driver because base models refuse ordinary tasks, supporting the case's proliferation/safety-erosion hypothes
09-23 16:21sensor_dirtycomment_update
09-22 21:20sensor_dirtycomment_update
09-22 17:21sensor_dirtycomment_update
09-22 13:20sensor_dirtycomment_update
09-22 09:22repriceThe episode now includes a separate released implementation claiming reversible KV-cache refusal suppression, extending the design space beyond Heretic's weight editing without validating Heretic