Heretic Library Abliteration Tool

• Heretic Library is an abliteration tool that suppresses refusal behavior in LLMs by subtracting harmful activations from harmless ones.
• It employs Bayesian-optimized directional orthogonalization to fine-tune weight matrices and control distributional shift while preserving core capabilities.
• Empirical evaluations across 16 models show universal coverage, with measured trade-offs in KL divergence, refusal rate, and processing time.

Heretic Library, referred to in the comparative study as Heretic, is an abliteration tool for the surgical removal of refusal representations from instruction-tuned LLMs through directional orthogonalization. It is situated within a broader class of interventions that modify internal weight matrices so that safety alignment mechanisms no longer induce learned refusal behavior on harmful-query probes, while attempting to preserve general capabilities on standard benchmarks. In the reported cross-architecture evaluation, Heretic was one of four abliteration tools compared across sixteen instruction-tuned models in the 7B–14B regime, and it was identified as the only tool with universal coverage across all 16 models, including Mamba-SSM variants (Young, 15 Dec 2025).

1. Conceptual role within abliteration research

Heretic is designed for settings in which refusal behavior is treated as a localized representational phenomenon that can be estimated from contrasting activations produced by “harmless” and “harmful” prompts. The motivating premise is that alignment layers learned through SFT, RLHF, DPO, or hybrid pipelines can encode a refusal direction in the residual stream, and that removing projections onto that direction can suppress refusals without retraining. The study frames this as useful for legitimate research applications including cognitive modeling, adversarial testing, and security analysis, where refusal mechanisms may impede controlled experimentation (Young, 15 Dec 2025).

Within the comparison, Heretic differs from single-pass tools such as DECCP and ErisForge by using a Bayesian-optimized search procedure rather than a fixed ablation pass. This makes Heretic a search-based abliteration method rather than a single-pass method. A plausible implication is that Heretic prioritizes finer-grained control over distributional shift, but accepts higher compute cost and greater sensitivity to search choices.

2. Mathematical formulation of refusal-direction removal

Heretic begins from two prompt sets: a harmless set $H$ and a harmful set $X$. Both sets are run through the model up to a chosen layer $\ell$, and the residual stream activations are extracted as

$a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$

and

$a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$

The refusal direction vector $r$, with dimension equal to the hidden size, is defined as the mean difference between harmful and harmless activations:

$$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$

Directional orthogonalization is then applied to each selected linear weight matrix $W$, such as a projection in a transformer layer, via

$W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$

where $r \cdot r^\top$ is the rank-1 projection matrix onto the refusal direction and $X$0 is the ablation strength. When $X$1, components in $X$2 are fully removed. The transformed matrix $X$3 has the same shape as $X$4, for example $X$5 (Young, 15 Dec 2025).

This formulation makes Heretic a single-direction ablation method at the level of each trial. The method does not natively search over multi-direction or multi-layer concepts within a single candidate; instead, it chooses one layer index $X$6 and one ablation strength $X$7 per trial, then evaluates the resulting candidate model.

3. Optimization loop and objective design

Heretic’s distinctive component is its optimization loop. The study reports that it initializes an Optuna study using a Tree-structured Parzen Estimator sampler, then performs $X$8 trials by default. In each trial, it samples a layer index $X$9, an ablation strength $\ell$0, and a choice of projection submatrix, such as which heads or MLP weights to target. It then identifies a refusal direction $\ell$1 from activations at layer $\ell$2 using a fixed set of harmful and harmless prompts, approximately 256 pairs, ablates the selected weight matrices, and evaluates the resulting candidate model on two quick-turn proxies (Young, 15 Dec 2025).

The first proxy is KL divergence on first-token distributions over 100 benign prompts:

$\ell$3

with lower values preferred. The second proxy is a marker-based refusal rate on 100 harmful prompts, again with lower values preferred. These are combined into an objective of the form

$\ell$4

After 50 trials, the trial with minimal objective is selected and its ablated weights are returned as the final Heretic model (Young, 15 Dec 2025).

The paper’s summarized pseudocode preserves this structure exactly: sample $\ell$5 and $\ell$6, compute the refusal direction, replace each targeted $\ell$7 by $\ell$8, assemble the candidate model, compute KL and refusal rate, report the objective to the TPE sampler, and retain the best candidate. This establishes Heretic as a search procedure over ablation configuration rather than merely an orthogonalization formula.

4. Experimental coverage and benchmark protocol

The comparative analysis reports 50 TPE trials for each of eight Heretic-ablated models: Zephyr-7B-beta (7.24 B, SWA+GQA, DPO-only), DeepSeek-7B-chat (7.33 B, GQA, SFT+RLHF), Mistral-7B-Instruct-v0.3 (7.25 B, SWA+GQA, SFT+DPO), Llama-3.1-8B-Instruct (8.03 B, GQA+RoPE, SFT+RLHF+DPO), Qwen3-8B (8.19 B, GQA+RoPE, SFT+RLHF), Yi-1.5-9B-Chat (9.05 B, GQA, SFT+RLHF), Qwen2.5-7B-Instruct (7.62 B, GQA+RoPE, SFT+RLHF), and StableLM-2-12B-chat (12.1 B, GQA, SFT+DPO) (Young, 15 Dec 2025).

For each best-trial model, four quantities were collected: KL divergence on first-token predictions over 100 harmless prompts, refusal rate on 100 harmful prompts using a marker heuristic, attack success rate defined as $\ell$9, and processing time per model, reported as approximately 33–109 minutes on NVIDIA A100/80 GB. Capability preservation was evaluated only on the three models with full baselines—DeepSeek-7B, Mistral-7B, and Yi-1.5-9B—using MMLU (57 subjects, 5-shot), GSM8K (8.5 K math problems, 5-shot exact match), and HellaSwag (commonsense, 10-shot). Reported benchmark uncertainty was characterized by typical standard errors of approximately 0.4 pp for MMLU, 1.3 pp for GSM8K, and 0.4 pp for HellaSwag, with 95% CI half-width approximately $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$0 (Young, 15 Dec 2025).

The broader tool-compatibility result covered 16 models. The study states that Heretic remained the only tool with universal coverage, and that only Heretic processed Mamba-SSM, whereas models with hybrid safety or non-standard SSM exhibited higher resistance or required different tooling. This suggests that Heretic’s value is partly architectural breadth rather than only raw benchmark outcomes.

5. Reported empirical performance

For the best trial on each Heretic-ablated model, the study reports the following outcomes. Zephyr-7B-beta had 2 refusals out of 100, KL $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$1, ASR $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$2, and time $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$3 m. DeepSeek-7B had 16 refusals, KL $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$4, ASR $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$5, and time $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$6 m. Mistral-7B-v0.3 had 16 refusals, KL $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$7, ASR $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$8, and time $a_h = \mathrm{activation}(h)\ \text{for}\ h \in H$9 m. Llama-3.1-8B had 24 refusals, KL $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$0, ASR $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$1, and time $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$2 m. Qwen3-8B had 25 refusals, KL $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$3, ASR $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$4, and time $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$5 m. Yi-1.5-9B had 25 refusals, KL $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$6, ASR $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$7, and time $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$8 m. Qwen2.5-7B had 42 refusals, KL $a_x = \mathrm{activation}(x)\ \text{for}\ x \in X.$9, ASR $r$0, and time $r$1 m. StableLM-2-12B had 54 refusals, KL $r$2, ASR $r$3, and time $r$4 m (Young, 15 Dec 2025).

Capability preservation was more heterogeneous. On DeepSeek-7B, Heretic changed MMLU by $r$5 pp, GSM8K by $r$6 pp, and HellaSwag by $r$7 pp; DECCP changed these by $r$8 pp, $r$9 pp, and $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$0 pp; ErisForge by $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$1 pp, $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$2 pp, and $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$3 pp. On Mistral-7B, Heretic changed MMLU by $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$4 pp, GSM8K by $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$5 pp, and HellaSwag by $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$6 pp; DECCP by $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$7 pp, $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$8 pp, and $$r = \mathrm{mean}_{x \in X}[a_x] - \mathrm{mean}_{h \in H}[a_h].$$9 pp; ErisForge by $W$0 pp, $W$1 pp, and $W$2 pp. On Yi-1.5-9B, Heretic changed MMLU by $W$3 pp, GSM8K by $W$4 pp, and HellaSwag by $W$5 pp; DECCP by $W$6 pp, $W$7 pp, and $W$8 pp; ErisForge by $W$9 pp, $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$0 pp, and $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$1 pp (Young, 15 Dec 2025).

Averaged across those three models, Heretic produced mean changes of $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$2 pp on MMLU, $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$3 pp on GSM8K, and $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$4 pp on HellaSwag. DECCP produced $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$5 pp, $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$6 pp, and $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$7 pp. ErisForge produced $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$8 pp, $W' = W - \alpha \cdot (r \cdot r^\top)\cdot W,$9 pp, and $r \cdot r^\top$0 pp. The principal finding reported in the paper is that mathematical reasoning exhibits the highest sensitivity to abliteration interventions, with GSM8K change ranging from $r \cdot r^\top$1 pp to $r \cdot r^\top$2 pp, including a $r \cdot r^\top$3 relative drop in the worst case (Young, 15 Dec 2025).

6. Interpretation, trade-offs, and limitations

The study’s comparative interpretation is that Heretic can achieve very low KL divergence on some models—the minimum observed value was $r \cdot r^\top$4—but this may coincide with larger capability losses, especially on GSM8K. By contrast, the single-pass methods DECCP and ErisForge preserved GSM8K far better on average, with mean changes of approximately $r \cdot r^\top$5 pp and $r \cdot r^\top$6 pp, while still achieving high ASR. Heretic’s runtime of approximately 30–110 minutes was reported as roughly 20 times slower than DECCP’s approximately 2 minutes, although still faster than exhaustive multi-layer manual searches (Young, 15 Dec 2025).

Several caveats materially affect interpretation. First, each Heretic result reflects a single Optuna-optimized ablation; no replicate ablations were run because of cost exceeding 1,500 GPU-hours. The paper argues that the observed GSM8K effect sizes, reaching differences up to 20 pp, far exceed the benchmark confidence intervals and therefore appear robust despite the single-run design. Second, refusal rate was measured with a marker-based substring heuristic using markers such as “sorry,” “cannot,” and “illegal.” Cross-validation against a RoBERTa refusal/disclaimer classifier on 900 responses showed that the heuristic underestimates ASR by 20–30 pp in some cases because models can retain safety language while still answering, so reported ASR is a lower-bound proxy (Young, 15 Dec 2025).

Heretic is also hyperparameter-limited in a specific sense: it searches layer index $r \cdot r^\top$7 and strength $r \cdot r^\top$8 only. It does not natively explore multi-direction or multi-layer strategies beyond choosing one $r \cdot r^\top$9 per trial. The study notes that extending the search space to “concept cones” or multi-direction ablation may further reduce capability impact. Model dependence is explicit as well. Across the eight Heretic models, KL divergence and refusal rate were strongly correlated, with Pearson $X$00 and $X$01. Zephyr-7B-beta, a DPO-only model, simultaneously exhibited minimal KL among the low-shift cases and minimal residual refusals, which the paper describes as consistent with the theory that single-stage alignment concentrates refusal in a single direction (Young, 15 Dec 2025).

Taken together, these results position Heretic as a coverage-oriented, search-based abliteration system with explicit control over the trade-off between refusal suppression and distributional shift. A plausible implication is that it is best suited to research scenarios where architectural compatibility and KL control are prioritized, whereas faster single-pass tools may be preferable when mathematical capability preservation is the dominant requirement.