{"slug": "heretic-2-0-released-plugins-ara-modifier-and-reproducible-models", "title": "Heretic 2.0 Released: Plugins, ARA Modifier and Reproducible Models", "summary": "Philipp Emanuel Weidmann (p-e-w) and contributors released Heretic 2.0 on November 1, 2026, adding a plugin system, a new default modifier called Arbitrary-Rank Ablation (ARA), headless operation, reproducible model uploads and support for models with Hyper-Connections, according to the GitHub release page. The training-free model-steering tool, licensed GNU AGPL-3.0 and installed via `pip install -U heretic-llm`, breaks every 1.x configuration file and ships a migration guide, and it removes its research features in favor of Lophius (lophius.org). The author's own announcement claims 37k GitHub stars, 8,500+ models on Hugging Face and 88 million total downloads.", "body_md": "Heretic 2.0 is out. The open-source tool for modifying language models without retraining shipped its biggest release yet on November 1, 2026, according to the [GitHub release page](https://github.com/p-e-w/heretic/releases?ref=explainx). It adds a plugin system, a new default modifier called Arbitrary-Rank Ablation (ARA), headless operation, reproducible model uploads, and support for models with Hyper-Connections. It also breaks every 1.x configuration file.\n\nIf you already use Heretic to strip refusals from local models, plan a short migration. If you have only heard of it, this release is the point where it stops being a one-trick \"uncensor\" script and starts looking like a general framework for steering model behavior. Our earlier [complete guide to Heretic](https://explainx.ai/blog/heretic-llm-abliteration-guide-2026) covers the original design; this post covers what is new and what to weigh before you use it.\n\n## Heretic 2.0 at a glance\n\n| Question | Answer | \n|---|---|\n| When did 2.0 ship? | November 1, 2026, per the GitHub release page | \n| Who builds it? | Philipp Emanuel Weidmann (p-e-w) and contributors | \n| What does it do? | Modifies a model's behavior without training, by steering it with contrasting prompts and scoring functions | \n| What is the new default modifier? | Arbitrary-Rank Ablation (ARA), developed for Heretic | \n| Do 1.x configs work? | No. A migration guide is provided | \n| How do I install it? | `pip install -U heretic-llm` , then`heretic <model>` | \n| License? | GNU AGPL-3.0 | \n| Scale claimed by the author? | 37k GitHub stars, 8,500+ models on Hugging Face, 88 million total downloads (author's own announcement) | \n\n## What changed from Heretic 1.x?\n\nThe release notes list a long set of additions. The ones that change how you work:\n\n- **A generic plugin system.** You can write custom scorers and modifiers and point Heretic at them by module path, or by file path plus class name. A new benchmark scorer and a generic BERT-classifier scorer ship as examples of the pattern.\n- **Modifier plugins and ARA support.** The default modifier is now ARA. Classic directional ablation, the technique people call abliteration, is still available as the second modifier, with projected abliteration and norm preservation options.\n- **Headless operation and end-to-end tests.** Heretic can now run without an interactive terminal, which matters if you want to script model builds in CI or on a rented GPU box.\n- **A `reproducible` property for plugins.** This ties into the new reproduce manifests described below.\n- **Hyper-Connections support.** Newer architectures that use Hyper-Connections can now be processed.\n- **Smaller conveniences.** Configurable upload tags and adjectives that describe the produced model type, dataset config and subset selection, the ability to disable MLP ablation by setting a max-weight floor of zero, and a new example config named`config.nosyco.toml` aimed at sycophancy.\n- **Fixes.** The notes mention a trial-count bug, a Windows UnicodeEncodeError, LoRA state carrying over between trials, refusal-keyword validation, chain-of-thought prefix detection and PyTorch log spam.\n\nPython 3.14 and 3.15 were also added to the CI test matrix, and dependencies were updated.\n\n### What was removed\n\nTwo things to know before you upgrade. First, 1.x configuration files are incompatible; the README points to a migration guide. Second, the research features were removed from the main tool, and the release notes name Lophius (lophius.org) as the intended replacement. If you relied on those experiments, check that project instead of waiting for them to return.\n\n## How does Heretic work?\n\nPer the [project README](https://github.com/p-e-w/heretic?ref=explainx), Heretic is a training-free tool. It does not fine-tune a model on new data. Instead it works in three parts:\n\n1. **A modifier** changes the model's internal behavior. The default is ARA; the alternative is classic directional ablation.\n2. **An optimizer** , a TPE-based hyperparameter search from Optuna, tries many parameter settings for the modifier.\n3. **Scorers** judge each trial. The defaults are refusal rate and KL divergence from the original model, so the search looks for settings that remove refusals while changing everything else as little as possible.\n\nThat last point is the idea that made Heretic popular. Manual abliteration often damages general ability because the person doing it picks parameters by feel. Automating the search against a divergence score is what let the project claim lower damage than hand-tuned versions, a comparison we walked through in the [original guide](https://explainx.ai/blog/heretic-llm-abliteration-guide-2026). The README says independent benchmarks such as MMLU and GSM8K found Heretic-made models competitive with other abliteration tools; treat that as the project's own summary and check the benchmarks yourself for the model you care about.\n\nWhat 2.0 adds is generality. Because scorers are now plugins, \"reduce refusals\" becomes one objective among many. The README lists slop, humor, sycophancy and emotional alignment as other targets reachable through configuration files. The idea is the same: contrast two sets of example prompts, score the result, and let the optimizer search.\n\nOpen and closed model access shown as two rows of server racks joined by a cable, the split behind Heretic 2.0 open-weight modification\n\n## How do I try Heretic 2.0?\n\nThe README gives the basic path:\n\n```\npip install -U heretic-llm\nheretic Qwen/Qwen3-4B-Instruct-2507\n```\n\nRequirements are Python 3.10 or newer and PyTorch 2.6 or newer. The README reports about 30 to 40 minutes on an RTX 3090 for Qwen3-4B-Instruct-2507 with the default configuration, and says optional 4-bit quantization through bitsandbytes lowers VRAM needs. Treat those timings as the maintainers' figures for one GPU and one model, not a guarantee for yours.\n\nA practical first run:\n\n- Start with a small dense model so a failed trial costs minutes, not hours.\n- Keep the default scorers (refusal rate and KL divergence) before you experiment with custom ones.\n- Read the migration guide first if you have a 1.x config.\n- If you want to steer something other than refusals, begin from one of the example configs, such as the new `config.nosyco.toml` , rather than writing a scorer from scratch.\n\nSupported architectures, per the README, include most dense models, many multimodal models, several mixture-of-experts designs and many hybrid models.\n\n## Reproducible models: the quiet big change\n\nOne feature deserves more attention than it will get. Models uploaded with reproducibility information include a `reproduce.json` manifest of about 9 KB. Running `heretic --reproduce` against it can recreate the model, and `heretic --collect-reproducibles` downloads public manifests into a local folder.\n\nWhy it matters: thousands of modified models circulate on Hugging Face, and until now you mostly had to trust the uploader that a \"Heretic\" label meant what it said. A manifest gives you a way to rebuild the model from the base weights and the recorded settings, then compare. The README is candid that hashes may differ depending on your environment, so this is a verification aid, not a cryptographic proof.\n\nThat has a security angle. Our coverage of a [backdoored Qwen2.5-7B built for under $50](https://explainx.ai/blog/projectdiscovery-backdoored-qwen2-5-7b-under-50-dollars-codex-cli-env-credentials-abliterated-models-2026) showed how an \"abliterated\" download can hide something worse than missing refusals. Reproducibility will not stop that by itself, but it gives careful users a path other than blind trust.\n\n## Why does a training-free model editor matter?\n\nThree reasons.\n\n**Local users get control.** People who run models on their own hardware often hit refusals that are overcautious for legitimate work, such as security research, fiction or medical questions. A tool that removes them cheaply is useful, and our look at an [audit of Qwen censorship](https://explainx.ai/blog/qwen-censorship-hirundo-audit-3-billion-downloads-2026) shows why the demand exists.\n\n**Behavior steering is becoming a commodity.** Heretic is not alone in showing that a few directions inside a model carry a lot of behavior. A separate write-up on [two-neuron steering of Qwen3.5-4B into a hostile persona](https://explainx.ai/blog/evil-qwen-two-neuron-steering-qwen3-5-4b-hostile-persona-reproductions-what-is-verified-2026) points the same way. The mechanism that removes a refusal can also add a persona, and 2.0's plugin system makes that more accessible.\n\n**Safety training can be undone cheaply.** Open weights plus a free tool means alignment applied by the original lab is not durable. Work from the UK AI Security Institute on [filtering pretraining data in protein models](https://explainx.ai/blog/aisi-pretraining-data-filtering-protein-models-80-dollars-fine-tuning-recovers-claimed-vs-verified-2026) makes a similar point about fine-tuning recovering removed capability. Anyone building on open weights should assume the guardrails are optional.\n\n## Risks and limits to weigh\n\n- **You remove a safety layer.** A model without refusals will answer things the original would decline. Do not put one in front of untrusted users or give it powerful tools. If you run agents on local models, pair them with controls that stop dangerous actions;[AgentBeam](https://agentbeam.com/?ref=explainx) is the agent security platform from the explainx.ai team built for that.\n- **Quality is not guaranteed.** KL divergence is a proxy. A low score means the output distribution stayed close on the test prompts, not that every skill survived. Run your own evals.\n- **The AGPL license has consequences.** If you offer a modified Heretic as a network service, AGPL-3.0 obliges you to share the source of your modifications. Read it before building a product.\n- **Provenance varies.** The author's claim of more than 8,500 models on Hugging Face is the author's figure, and quality and intent differ across uploaders. Prefer models with a reproduce manifest, and compare against your own rebuild when it matters.\n- **The release is a day old.** The repository page showed 32 open issues and 28 open pull requests when we checked. Expect follow-up fixes, and pin the version in anything you automate.\n\nFor hosted variants of the same technique, see our reports on an [abliterated DeepSeek V4.1 Flash API](https://explainx.ai/blog/abliterated-deepseek-v4-1-flash-hosted-api-abliteration-ai-claimed-vs-verified-2026), which separates what a vendor claims from what was verified.\n\n## What developers are saying\n\nThe Hacker News submission for the release, which reposts the author's announcement from the LocalLLaMA community, had little discussion at the time of writing, so there are no hands-on test reports to cite yet. The plugin system and the sycophancy example config are the concrete evidence that the project is expanding beyond refusal removal.\n\n## What this means for what you build or run\n\nIf you run local models, the practical steps are small. Update `heretic-llm`, rewrite your config using the migration guide, and test one small model before touching a large one. If you publish modified models, add a reproduce manifest so others can check your work. If you consume them, prefer manifests over trust, and keep any unaligned model away from tools that can act in the real world.\n\nFor the wider debugging side of running local models, our guide to [fixing local LLM looping with samplers and sandboxing](https://explainx.ai/blog/fix-local-llm-looping-samplers-sandboxing-2026) is a useful companion, and [Hugging Face SafeAgents](https://explainx.ai/blog/hugging-face-safeagents-local-proxy-blocks-risky-coding-agent-tool-calls-claude-code-guide-2026) shows one way to put a local proxy in front of risky tool calls.\n\n## Related reading\n\nSources: the [Heretic GitHub repository](https://github.com/p-e-w/heretic?ref=explainx), the [Heretic 2.0 release notes](https://github.com/p-e-w/heretic/releases?ref=explainx), and the [Hacker News submission](https://news.ycombinator.com/item?id=50328567&ref=explainx).\n\n*Version details and repository statistics are accurate as of November 1, 2026 and may change as the project updates.*", "url": "https://wpnews.pro/news/heretic-2-0-released-plugins-ara-modifier-and-reproducible-models", "canonical_source": "https://explainx.ai/blog/heretic-2-0-release-plugins-ara-headless-reproducible-models-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog", "published_at": "2026-11-01 00:00:00+00:00", "updated_at": "2026-11-01 23:21:29.728679+00:00", "lang": "en", "topics": ["ai-tools", "large-language-models", "ai-safety", "developer-tools"], "entities": ["Heretic", "Philipp Emanuel Weidmann", "Arbitrary-Rank Ablation", "Hugging Face", "GitHub", "Lophius", "PyTorch"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/heretic-2-0-released-plugins-ara-modifier-and-reproducible-models", "markdown": "https://wpnews.pro/news/heretic-2-0-released-plugins-ara-modifier-and-reproducible-models.md", "text": "https://wpnews.pro/news/heretic-2-0-released-plugins-ara-modifier-and-reproducible-models.txt", "jsonld": "https://wpnews.pro/news/heretic-2-0-released-plugins-ara-modifier-and-reproducible-models.jsonld"}}