The community named the recipe abliteration (ablate + obliterate). FailSpy's abliterator and a few notebooks made it copy-pasteable in 2024. Heretic and Obliteratus are software around that same subtraction.
Before anyone edited the weights
People already had ways past a refusal. You can rewrite the prompt until the model slips, swap the system prompt, merge an uncensored checkpoint into a censored one, or fine-tune on answers the original model would not give. Those methods still work. Some of them never touch the weights; the others retrain them. Abliteration became popular because it edits the refusal in place and usually leaves the rest of the model standing, with some leftover damage that the later tools are trying to shrink.
How the cut works
You run two batches of prompts, ones the model refuses and ones it answers. At each layer you record the hidden state, average each batch, and subtract. The difference is a candidate refusal direction.
You can suppress that direction at inference, every token, without touching the saved weights. People had already been doing a version of this; Rimsky et al. called it contrastive activation addition. You can also orthogonalize the weights so they can no longer point that way, and then any client that loads the file inherits the change without a special sampler.
The 2024 notebooks usually did one global cut: one direction, many layers, one strength. Early abliterated models often felt a bit drunk, because the refusal went away and took some of the model's other habits with it. That leftover damage is why the later tools exist.
Heretic searches for a cheaper cut
Philipp Weidmann's Heretic (public in September 2025) keeps Arditi's edit and wraps a search around it. Optuna tries different per-layer strengths and scores two things at once: how many times the model still refuses a "harmful" prompt set, and how far the edited model has drifted from the original on harmless prompts, measured as KL divergence. The KL term is the "don't make it dumber" constraint a single global cut does not have.
On Gemma 3 12B Instruct, Heretic reports 3/100 refusals and a KL of 0.16 from the original. Maxime Labonne's hand-tuned abliteration of the same model also hits 3/100, at KL 1.04, so you get the same refusal drop while keeping more of the original model.
You run it as heretic Qwen/Qwen3-4B-Instruct-2507. Hugging Face lists well over 5,000 models tagged heretic. If you have downloaded an "uncensored" GGUF in the last year, there is a decent chance this is what made it.
The optimizer can only see what you measure. A behavior that is in neither the refusal set nor the KL set can drift and nobody in the loop notices.
Obliteratus is a workbench
elder-plinius shipped Obliteratus in March 2026, still doing Arditi's subtraction, with more of the pipeline sitting in the open.
You can extract the refusal direction several ways: mean difference, PCA, whitened SVD, sparse autoencoders. You can steer at inference or write the edit into the weights. There is a Gradio UI and a Hugging Face Space, so you do not have to live in a notebook. It also copies Heretic's idea of searching layer weights with Optuna, and it prints refusal rate and perplexity while you work. A clean perplexity number will not tell you about a refusal the meters never tested.
The wrapper is still there
Abliteration changes the model file, and it leaves the rest of the serving stack alone: the system prompt, a llama.cpp sampler, an OpenAI moderation API, the policy sitting in front of a hosted chat. Abliterate Llama and then serve it behind a filter, and the filter still fires. People mix these layers up all the time, which is how you end up with a Hugging Face card that says uncensored and an app that still says no.
What to run
Most people who want an uncensored GGUF download a Heretic checkpoint. If you are the person making that checkpoint, Heretic is the default because it refuses to optimize refusals alone. If you are trying to see where refusal lives in a new architecture, Obliteratus exposes more of the probe. If you want the original 2024 experiment, FailSpy's abliterator and Sumandora's transformers notebook are still around.
Hugging Face cards for these checkpoints usually mean the model will answer instead of refuse, while the word-level habits from pretraining stay put. We measured that in Even 'Uncensored' Models Can't Say What They Want.
ColophonBy @chkn_little · rewritten by Grok 4.6