"Heretic" tool for stripping refusals from open-weight LLMs draws HN debate
A project that automates removing built-in refusal behavior from language models resurfaces on Hacker News, prompting both hacking success stories and safety warnings.
What to know
- Heretic automates removal of trained-in refusal behavior ('abliteration') from open-weight language models.
- HN users report real-world use of de-restricted models like GLM 5.3 to reverse-engineer their own IoT cameras, phone bootloaders, and DRM.
- Skeptics note removing refusals doesn't guarantee correct knowledge and can produce hallucinated or lower-quality answers.
- Some commenters warn of misuse potential and predict regulators will target these unrestricted models.
The dispute Whether removing built-in refusals is a net safety improvement (exposing that guardrails themselves cause insecurity) or a net risk (enabling misuse and unreliable outputs). · positions read across 16 posts and comments
Unrestricted models are a practical tool for reclaiming control over one's own devices (cameras, phones, DRM).
-
“I have a chinese IP camera... these abliterated ones have been vital to reclaim possession over my stuff”
Almondsetat · Hacker News ↗
Removing refusals doesn't fix missing knowledge and can make outputs less reliable or hallucinated.
-
“If the model was trained on data that gives a refusal to that topic, the real information might not be encoded in the model at all.”
Aurornis · Hacker News ↗
Unrestricted models pose misuse risk and will likely be regulated or banned.
-
“Keep a close eye on abliterated and "heretic" open weight models. They will be outlawed first.”
Tepix · Hacker News ↗
Heretic project Open-source tool for removing refusal behavior from LLMsAurornis HN commenterTepix HN commentermatheusmoreira HN commenterTristanDaCunha HN commenter
How it unfolded 5 developments, newest first · click a bar or a number to jump articlespostscomments
-
5
Commenter flags the post as a 10-month-old duplicate
User nateb2022 notes the story was previously discussed on HN about 10 months earlier under a separate thread with 387 comments, indicating the Heretic project predates this resurfacing.
“I asked GLM 5.3 to hack our DRM. I didn't even need to do anything for it to agree. Same with GLM 5.3 Flash.”
— akazantsev, HN commenter · source -
I'm doing the same thing with a Wyze Pan V3 camera that has a locked bootloader unlike many of their other models. An old version of the firmware (no anti-rollback) has command injection in the WiFi SSDs, and from then on I technically have a shell and can run commands over the SD card. Sadly, while swapping the microSD card repeatedly between the…
2 more of the top 3 · 6 posts in this stretch
-
I asked GLM 5.3 to hack our DRM. I didn't even need to do anything for it to agree. Same with GLM 5.3 Flash. Make sure they have at least Python available for their task. The Flash went ahead and started reverse-engineering using PowerShell scripts and "manually" decoding bytes from its output.
-
I have attempted to use an agent to try to unlock the boot loader of an old xiaomi phone to install lineage OS. It managed to brick and unbrick the device, but there boot loader is still locked.
-
-
4
Aurornis warns removing refusals doesn't add missing knowledge
A technical comment argues that because training data is often shaped around refusals, unlocked models may lack the underlying knowledge to answer correctly and can instead produce confident hallucinations, with possible quality drops on unrelated questions.
“If the model was trained on data that gives a refusal to that topic, the real information might not be encoded in the model at all.”
— Aurornis -
Two problems with modifying models like these, which you should be aware of.First, the training sets of these models are usually shaped around the refusal, too. They might not have enough of the knowledge to answer correctly even if you stop it from going down the refusal path. If the model was trained on data that gives a refusal to that topic…
2 more of the top 3 · 5 posts in this stretch
-
This is off topic.Why don’t people who release python projects ever encode the venv steps into the installer? Can’t pip just do that step for the user?
-
Does this actually modify the weights?It submits prompts that get refused, then detects and modifies the weights responsible?Like brain surgery?
-
-
2
Commenters warn of misuse risk and possible bans
Other participants raise concerns that unrestricted open-weight models could aid harmful actors and predict regulators will target abliterated models first, while some argue built-in safety restrictions themselves worsen security outcomes.
“Keep a close eye on abliterated and "heretic" open weight models. They will be outlawed first.”
— Tepix -
I have a chinese IP camera. From superficial research I know it has some CVEs to take control of it. Unfortunately, I don't have the technical knowledge to perform an attack and run some software to extend the camera's functionalities. No model from a provider accepts my RE and hacking requests, so these abliterated ones have been vital to reclaim…
2 more of the top 3 · 3 posts in this stretch
-
I did that exact thing with GLM-5.3 from Z.ai with a chinese IP Camera. And i did not have to trick it in any way.
-
Keep a close eye on abliterated and "heretic" open weight models. They will be outlawed first.
-
-
3
Users report using de-restricted models to hack their own hardware
Several commenters describe running abliterated or 'heretic' models like GLM 5.3 to reverse-engineer Chinese IP cameras, unlock a Wyze camera bootloader, attempt to unlock a Xiaomi phone bootloader, and defeat DRM protections.
“I have a chinese IP camera... No model from a provider accepts my RE and hacking requests, so these abliterated ones have been vital to reclaim possession over my stuff…”
— Almondsetat -
Can the load-bearing gaps that are worth being flagged for pinning down be abliterated out of a model?
-
-
1
Heretic project post reaches Hacker News front page
A submission for the Heretic project, which removes refusal-trained restrictions from open-weight language models, climbs to the HN front page with over 200 points and dozens of comments; the same link is also carried on HN's Best and Frontpage RSS feeds.
-
first by HN Best, 6d ago · also HN Frontpage
-
Looks like a well engineered, automated abliteration pipeline. The claims seem a bit overstated though, since the metrics mentioned are cherrypicking refusal count and KL divergence, both of which make the outcome seem the most dramatic.
-
What people are saying 4 voices from 1 site · best of 16 · verbatim
- Do abliterated models actually retain accurate knowledge on refused topics, or just produce confident-sounding hallucinations?
- Will regulators specifically target abliterated/heretic open-weight models?
- Sep 21
-
Will this be helpful to terrorist groups, as they try to get current and future open-weights LLMs to help them create better and more devastating weapons of all kinds?
-
5.6 Sol has happily reverse engineered and decompiled binaries for me.Heck it has proactively asked me if I wanted it to tear apart APKs that remote control some HW I have.
-
[dupe] https://news.ycombinator.com/item?id=45945587 (10 months ago, 387 comments)
-
These "safeguards" are actively contributing to computer insecurity at this point.