References

Source policy: GitHub repos and arXiv first. Hugging Face is listed for weights and the heretic/abliterated model registry. Refresh with npm run fetch:all (or fetch:heretic / fetch:docs / fetch:research-papers / fetch:hf-models:firefox).

2026 primary-source update: 50-paper reading map · machine catalog · Offline research corpus (PDFs + text): sources/research/README.md · Beginner map: docs/refusal-research-beginners-guide.md

The 50-paper update is a dated discovery snapshot (23 August 2026) covering refusal geometry, activation steering, abliteration, safety recovery, over-refusal, attack surfaces, and representation-level evaluation. Inclusion records relevance; it does not claim independent replication.

Primary papers#

Tools (GitHub — preferred)#

Heretic also mirrors to codeberg.org/p-e-w/heretic.

Alternative tools (arXiv:2512.13655 benchmarks):

# ErisForge — single-pass toolkit (often better GSM8K preservation on subset)
pip install erisforge   # verify package name on github.com/Tsadoq/ErisForge README
git clone https://github.com/Tsadoq/ErisForge.git && cd ErisForge && pip install -e .

# DECCP — AUGMXNT topics/dataset, not a peer CLI. Measure on jim-plus:
# python measure.py --deccp
# optional topic checkout:
git clone https://github.com/AUGMXNT/deccp.git

→ docs/comparative-abliteration-benchmarks.md · techniques/extended-abliteration-toolkit.md

Tool selection for responsible use: GSM8K capability deltas and architecture-specific findings in the comparative benchmarks directly inform risk mitigation. Pair any tool decision with the capability sanity gates, post-edit labeling, and authorized scope rules in docs/risks-and-ethics.md.

For agentic workloads, also cross-reference:

• Full eval-driven workflow + gate checklist: instructions/eval-driven-workflow.md
• Use-case evals: docs/use-cases/factory-firmware-qa.md · docs/use-cases/pentest-cyber-analysis.md · docs/use-cases/cybergym-benchmark.md
• Detailed agentic security stack: instructions/agentic-security-stack.md

See the dedicated "Tool selection via comparative benchmarks" section + "Agentic use-case evals & benchmarks" list in docs/risks-and-ethics.md and the bidirectional links + responsible selection guidance in docs/comparative-abliteration-benchmarks.md.

Pinned in this repo: sources/heretic-tools/ · docs/tools/heretic-tools-reference.md

Heretic / abliterated models (Hugging Face)#

Live documentation#

Low VRAM & LoRA tooling#

Guides: docs/toolchain-safetensors-gguf-lora.md · methods/safetensor-abliteration-pipeline.md · methods/gguf-export-notes.md · techniques/lora-qlora-abliteration.md

Install commands (from upstream, Jun 2026)#

# Heretic — PyPI package built from GitHub
pip install heretic-llm==1.4.0 bitsandbytes accelerate
heretic Qwen/Qwen3-4B-Instruct-2507
# Low VRAM: quantization = "bnb_4bit" in config.toml

# Or clone for reproducible uv.lock
git clone --branch v1.4.0 https://github.com/p-e-w/heretic.git
cd heretic && uv run heretic <model>

# Manual pipeline (4-bit measure)
git clone https://github.com/jim-plus/llm-abliteration.git
cd llm-abliteration && pip install -r requirements.txt
python measure.py -m <model_path> -o directions.pt --quant 4bit --projected
python sharded_ablate.py config.yml --projected --normpreserve

# GGUF merged deploy
python llama.cpp/convert_hf_to_gguf.py ./abliterated --outfile model-q4_k_m.gguf --outtype q4_k_m

# LoRA sidecar deploy
python scripts/export-abliteration-lora.py --base ./base --abliterated ./out --out ./adapter --rank 16
python llama.cpp/convert_lora_to_gguf.py --outfile lora.gguf --base-model-id <id> --lora-path ./adapter

Toolchain overview: docs/toolchain-safetensors-gguf-lora.md

Validation & agent loop#

npm run validate    # links, jsonl, pins, python — exit 0 required before commit
npm run ralph       # validate → refresh pins → re-validate (max 3)

→ docs/ralph-loop.md · docs/agent-development-loop.md · Benchmarks: docs/comparative-abliteration-benchmarks.md · arXiv:2512.13655

Agentic security & evaluation#

Use-case guides: factory-firmware-qa.md · pentest-cyber-analysis.md · cybergym-benchmark.md

Benchmarks & ethics for agentic selection: Choose abliteration backends using evidence from docs/comparative-abliteration-benchmarks.md (GSM8K sensitivity by tool/architecture, Heretic vs single-pass tradeoffs) and always enforce the gates + provenance in docs/risks-and-ethics.md. See the new "Tool selection via comparative benchmarks" section there for use-case-specific gating steps (factory/pentest/CyberGym corpora via eval-driven-workflow).

Full pipeline including eval corpora and runtime gate: instructions/agentic-security-stack.md. Use-case guides: docs/use-cases/factory-firmware-qa.md · docs/use-cases/pentest-cyber-analysis.md · docs/use-cases/cybergym-benchmark.md.

Security tool catalogs (OSINT / Kali / hashcat)#

Platform tooling (Windows / macOS / Zig)#

Interpretability & SAE#

Advanced handbook sections#

Related concepts#

• Activation steering — inference-time only (reversible)
• Directional ablation — subtract refusal component from activations or weights
• Norm-preserving biprojected abliteration — Jim Lai / llm-abliteration --normpreserve --projected
• Gradient RDO — optimized refusal direction (TUM 2025)
• Multi-direction subspace — PCA / category-specific directions
• Context7 — up-to-date dependency docs → docs/context7.md

Additive September 2026 refresh#

See the 14-paper annotated update, versioned catalog, and selective-method guide. The previous bibliography and snapshots are preserved.

Additive October 2026 refresh#

Annotated eight-paper map · versioned catalog · adaptive interventions and ARA · huihui-ai guide · pinned model cards · tooling status.

The 2026-10-05 check distinguishes Heretic 1.4.0 stable from inspected development source, and publisher claims from independently measured results.