Heretic 2.0.0, released November 1, is a breaking update to the open-source tool designed to remove refusal behavior from AI models; users need to migrate their 1.x configuration files before they will work with the new version.

The release replaces Heretic’s dense-weight approach with Arbitrary-Rank Ablation, a low-rank method intended to make the same adjustments with less computation, speeding up runs and expanding model compatibility.

Heretic uses an Optuna-based optimizer to find settings that reduce refusals while minimally changing other behavior, and it can run without fine-tuning, a labeled dataset or a GPU farm.

Version 2.0 also introduces a plugin system, including a BERT-based classifier that checks whether a model refused a prompt, and adds support for newer architecture features such as the hyper-connection residual streams used in models including Qwen2.5.

The risks of this kind of tool were highlighted by a Financial Times and Alice investigation published May 25, which found a journalist could remove safety alignment from Meta’s Llama 3.3 and Google’s Gemma 3 in under ten minutes without specialist hardware.

Heretic’s creator told the Financial Times that the software had been used to create more than 3,500 decensored models, which had received 13 million downloads; the project has since surpassed 37,000 GitHub stars.

The story frames the issue as a growing AI strategy fault line: open-weight models can be altered locally, while Anthropic and OpenAI keep their models’ weights with the vendor.

As a result, organizations using open-weight models cannot treat built-in refusals as their primary safeguard and must rely instead on access controls, monitoring and usage policies.