Heretic removes restrictions from language models
heretic-project.org
heretic-project.org
It did a pretty good job.
I do agree the safeguards are only there out of liability concerns, nothing more.
But maybe it would be worse without them.
I've been using them to test my infra/devices as well as reverse engineering.
Not giving legitimate people cyberdefense capabilities with the safety excuse is irresponsible
I give it access to write manual packet sequences and a server to try to break my logic, such as crashing the application, giving it an open ended arena to fall 10 blocks without taking damage, or just trying to jump higher than usual.
It requires a bit of pushing to know what type of issues it should even be looking for. Telling it to move even just 0.00001 blocks upwards to reset fall damage mid-fall. Telling it to figure out how to fake being on the ground to jump mid-air to reach the impossible platform. This all used to be done manually, but paying a couple dollars to run it overnight and attempt to find bypasses is worth the cost.
I haven't figured out how to run LLMs to write code 24/7 yet, they just can't see the big picture.
If so, I like the irony.
Sounds like you've freed up some time and created an automated defense later, well done. Are you able to use non-front models? And how is the character and game-state accessed, (MC-)MCP?
Flagship OpenAI/Anthropic models refuse this task due to "Cybersecurity" so I have no idea how good flagship models do. It's unfortunate as IMO minecraft is a sandbox
Java clients (pc version) use the actual game's files modified to not open a window. Minecraft is source available, anyone can load it into an IDE, modify it to double jump height, and run it in minutes without an unmodified server caring. Bedrock clients (the version for phones) just figure it out based on packets and how the anticheat corrects them to what the movement should be.
Heck it has proactively asked me if I wanted it to tear apart APKs that remote control some HW I have.
I think you probably just have to frame things right and get it in the mood (i.e. don't ask straight up at the start of the context).
For example: 'source recovery' instead of 'reverse engineering' is one I've used successfully. You may also lean into a libertarian 'right to repair' framing. You own the hardware, you should be able to access the device to appropriately repair its security vulnerabilities.
We're not breaking into a bank here, this is a camera you own.
You could even go so far as to cite local laws to support your case.
---
In short, jailbreaking is more about framing the conversation than it is about triggering psychopathy in the model. :D
Unfortunately for them, the implementation of it is broken because it only verified the first 32 bits of the signature, so thingino (a 3rd party firmware replacement) now just calculates it during build for that device.[1]
As for the camera being dead, do find out if it's just corrupt or something. Those line of cameras are fairly forgiving in regards to re-flashing broken images. (They have both microsd fallback and an ISP mode, I believe.)
Wyze as a company however have pulled their own firmware images from their support site, which kind of makes brick recovery painful. I don't know why they would do this.
First, the training sets of these models are usually shaped around the refusal, too. They might not have enough of the knowledge to answer correctly even if you stop it from going down the refusal path. If the model was trained on data that gives a refusal to that topic, the real information might not be encoded in the model at all. You’re trying to force it to go down a path that produces an answer, which asking for hallucinations.
Second, the quality can drop on unrelated questions. Depending on the question this may or may not happen. I know they post KL divergence charts but those tell you very little for a focused topic like this.
So if you expect a model that will start correctly telling you info that its local government didn’t want included, this changes nothing.
The best argument for these models is if you are trying to do a general purpose task but the model triggers a refusal based on vague reasons, like not wanting to reverse engineer something.
From experience, the models often do have the knowledge of those topics (strictly talking about the political ones). IMO the refusal is likely to be a product of post-training, as evidenced by various people gaming the prompts just enough to get a proper response out of the vanilla models.
Probably only when you get to things like illicit drugs or NSFL topics, that things will go haywire with the refusals removed.
Depends on the model. GPT-OSS is the main standout here, it was trained on a highly curated dataset so information that they didn't want in isn't in the pretraining at all. Most other models know the answer and were just taught refusal in post-training.
Could you elaborate? Do you find it good or bad? What actions can be taken?
Then again, it will probably not stop someone who is determined. Same as with other legislation really.
pip install -U heretic-llm && heretic Qwen/Qwen3.5-4B
let alone people just putting the weights up in a torrent. All assuming that someone even tried to ban abliterated models.
Do you really believe that all of these major non-profits are advertising, encouraging, and participating in the use of an illegal network protocol?
Using any network protocol to violate copyright law on the other hand, is and has been illegal. But it's the violation of copyright, not the network protocol.
Saying torrenting is illegal is like saying ftp is illegal.
And compared to torrents abliterated models are more complicated to identify, harder to suppress and there is a lot less reason for anyone to care.
If you think closed source software/binaries only is bad, wait until you see how awful the state of the art is with a clear-as-mud bucket of matrix weights.
We know it's possible to train an LLM to secretly respond to certain trigger phrases, and last I checked these could only be detected with the assistance of whoever chose those phrases.
The trigger condition for such backdoors is not something anyone can do a systematic brute-force check for, for the same reason we had to invent LLMs in order to do natural language processing: combinatorial explosion.
Passing around open weight models from known sources is already asking you to trust those sources; because of how difficult this is to do correctly even without deliberately inserting such things, we still don't know if China has already put such trigger conditions into their models despite headlines such as these: https://venturebeat.com/security/deepseek-injects-50-more-se...
Regardless of if it was deliberate or not, we don't know if we caught all of these misbehaviours. We don't know how to.
And note, I'm not saying "and therefore you should trust the Big Name Models". If open weight models score 2/100 in this context, closed ones score 1/100.
With proprietary hosted weights you can be specifically targeted and you would not be able to reproduce nor prove anything.
Poisoning open models would be of short-term benefit to China only if they could target US (and maybe EU + Commonwealth) specifically. Damaging anyone else would be a net loss and would erode the partnerships and alliances they are trying to build elsewhere. So it's a fire-once weapon with a huge risk of collateral damage.
Much more plausible is simply making the models ideologically biased, but as history teaches us, preferring ideology or religion over science is a well-known path to ruin. It would be weird to simultaneously warn public not to use their own open models, so.
I think the most plausible explanation for open models is simply that Huawei wants more customers and is willing to compete on the hardware front.
No, you actually cannot. Not in general and without already knowing what the whole trigger pattern is. It's absolutely possible to put in a trigger that only fires while working on backend code on a specific date in a specific company by a specific github username, and no way to find this except by trying that combination, thanks to the terrible state of current mechanistic interpretability tools.
Remember: an AI model is not code. Solving this problem is as hard as the entire alignment problem.
The companies at the bleeding edge of research into this topic do not know how to reliably perform the kind of thing you suggest here.
The only reason we can point at DeepSeek-R1 and say the following, is because we can guess the magic keywords:
we found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.
> Poisoning open models would be of short-term benefit to China only if they could target US (and maybe EU + Commonwealth) specifically. Damaging anyone else would be a net loss and would erode the partnerships and alliances they are trying to build elsewhere. So it's a fire-once weapon with a huge risk of collateral damage.
This "fire-once weapon" has already been fired, and appears to be a massive foot-gun for every model on a near-continuous basis.
Nobody would use LLMs if the trust deficit alone was a sufficient argument.
> Much more plausible is simply making the models ideologically biased, but as history teaches us, preferring ideology or religion over science is a well-known path to ruin. It would be weird to simultaneously warn public not to use their own open models, so.
"Ideologically biased" is the alternative explanation for the already-observed output of DeepSeek-R1. We can't tell which explanation, malicious or accidental bias, is the actual cause.
Finding unknown backdoors in models is NP hard.
Qwen3 and Gemma level models that run on mid-high end laptops and desktops can be pretty good. Not frontier grade, but shockingly competent for something that runs on a single PC. But the hardware you need to run those fast is at least $1000-$2000. Cheap hardware can run them, but slooooooow.
Also tried the "Locally Uncensored" setup on a 3060 laptop, which worked surprisingly well.
See, the various banned porn varieties for an easy example
And calling those things "books" is just nonsense. You know what we are talking about when we say "books", and it isn't that.
There's a reason people hated Grok for sexualising children
There are some enforcement issues.
IMO math is free speech, and outlawing math is censorship.
> The claims seem a bit overstated though, since the metrics mentioned are cherrypicking refusal count and KL divergence, both of which make the outcome seem the most dramatic.
is right out of an LLM. It's the kind of language I'd expect out of a thinking trace also mentioning "boundaries" and "oracles" and "contracts."
It submits prompts that get refused, then detects and modifies the weights responsible?
Like brain surgery?
Why don’t people who release python projects ever encode the venv steps into the installer? Can’t pip just do that step for the user?
Everything can be turned into a weapon of murder if there's motivation. The motivation is key, not the tool.
Than ask it to seek vulnerabilities in modern technologies and systems.