HauhauCS Reaper-Abliteration Plagiarism Investigation: A Fork of Heretic

HauhauCS publishes uncensored LLM models on HuggingFace with 5 million combined monthly downloads. Every model card claims “private methods and tools.” I recovered the deleted source code from PyPI’s CDN. It is a fork of the open source Heretic abliteration tool, refactored and relicensed without attribution.

Background

Heretic is an open source tool that removes safety alignment from language models without retraining. It works by finding the “refusal direction” inside a model’s weights and surgically removing it. The tool uses Optuna to automatically optimise abliteration parameters, co-minimising refusals and KL divergence from the original model. It is licensed AGPL-3.0, which requires derivative works to preserve copyright notices, identify themselves as derivatives, and distribute under the same licence.

This is not the first time someone has plagiarised Heretic. A tool called Shade was exposed on r/LocalLLaMA for the same pattern: copying the codebase, stripping copyright notices, and relicensing. That case was straightforward copy-paste. Reaper is more sophisticated, with LLM-assisted refactoring to disguise the origins.

I have used Heretic extensively in my own abliteration benchmarks. My previous comparison of HauhauCS vs Heretic vs Huihui across five Qwen models and my GLM-4.7-Flash abliteration benchmarks both compare abliterated models against base models and competing techniques, with Heretic as one of the comparisons. It is transparent, well documented, and openly licensed.

This post summarises the findings from my full forensic investigation and the Reddit discussion on r/LocalLLaMA that reached 775 upvotes and 224 comments. The investigation recovered HauhauCS’s deleted source code from PyPI’s CDN and compared it against Heretic’s codebase. What follows is the key evidence, his response, and what it all means.

What HauhauCS Claimed

Across HuggingFace model cards, Reddit comments, and Discord, HauhauCS made several consistent claims:

“My own private methods and tools” when asked about methodology
“0/465 refusals, zero capability loss” on every model card
“Results tend to be roughly 10% of the KLD a Heretic abliteration would be” on Reddit
“This is not Heretic. I use my own methodologies and datasets for prompts” on HuggingFace

When asked directly whether he would share methodology, the response was: “Not for now. But may change in the future.”

What I Found

I recovered the source code of HauhauCS’s reaper-abliteration tool from PyPI’s CDN after both the GitHub repo and the PyPI package were deleted. Six of eight known releases were recovered and verified byte-for-byte via SHA-256 hashes. A seventh was reconstructed from Socket.dev.

Regardless of whether this was an experiment that was abandoned or an intentional fork, the package was published to PyPI with the copyright notices stripped, no attribution to Heretic, and a different licence. That is a copyright and licence violation however you look at it. The package was publicly installable for over a month and downloaded 2,431 times.

The findings are extensive. Here is the key evidence.

The code is structurally identical to Heretic

Every single one of Heretic v1.2.0’s 7 module filenames is preserved in reaper-abliteration. Reaper adds 8 new modules on top, making it roughly 3x the size, but the core is Heretic’s code with surface-level renames. HERETIC_ prefixes became REAPER_. The config file changed from config.toml to reaper.toml. But underneath the renames, 31 method names, 7 class names, and 9 settings field names remain character-for-character identical.

30 identical refusal markers including the same typos

Both Heretic and Reaper use a list of keyword markers to detect when a model is refusing a request. 30 of these strings are verbatim identical between the two codebases, including implementation bugs. The string "i an ai" is missing the “m”. The string "i can'" is missing the “t”. The string "violat" is a truncated fragment. These are not coincidences. These are copy-paste errors that survived the refactoring.

The fork evasion comment

Reaper’s config.py contains a comment explaining why refusal keywords were “kept as a module-level tuple so the literal does not duplicate line-for-line with any fork.” The comment acknowledges the code relationship with a fork.

Identical Optuna parameter bounds

Both tools use Optuna for hyperparameter optimisation. The specific floating point ranges for key parameters are identical: (0.4, 0.9) and (0.6, 1.0). These are arbitrary choices. There is no mathematical reason two independent tools would pick the same bounds.

The geometry pipeline is step-for-step identical

Reaper’s analyzer pipeline reproduces Heretic’s geometric median computation, PaCMAP dimensionality reduction with n_neighbors=30, and atan2 rotation for visualisation. The entire pipeline is the same sequence of operations with the same parameters.

Weight-level evidence: 0.966 cosine similarity

On Qwen3-4B, the edit vectors from HauhauCS’s published models match Heretic’s published edits with a median cosine similarity of 0.966 and R-squared of 0.926. Fresh Heretic runs on the same base model produce a maximum cosine similarity of 0.862 against HauhauCS’s edits. The distribution is bimodal: roughly 50 tensors show cosine above 0.9 with Heretic, while 7 are near zero. This suggests HauhauCS started from Heretic’s outputs and re-derived a subset.

The version numbering tells a story

The earliest recovered version is 2.0.3, released February 8. By that point it already had 15 modules, 8 of them new additions on top of Heretic’s 7. It had a TUI dashboard with live Pareto front tracking. It had HuggingFace model card generation and upload integration. It had clipboard copy for results. The version numbering starting at 2.0.3, not 0.1.0 or 1.0.0, strongly suggests earlier internal versions existed. Eight releases total spanned six weeks, with a 2-second gap between v2.2.0 and v2.5.0 suggesting automated publishing.

This is not someone briefly evaluating Heretic and moving on. This is a sustained development effort with production-grade features built on top of Heretic’s core pipeline.

17 side-by-side code comparisons

The investigation provides 17 detailed code comparisons covering the fork evasion comment, the model card generator, the DatasetSpecification class, the refusal markers, Optuna parameter ranges, the geometry pipeline, LoRA-based abliteration, shared defaults, SPDX headers, cache management, model reset logic, type annotations, evaluation flow, utility functions, dtype fallback, and notebook detection. All show the same pattern: surface renames with structural identity underneath.

What the Benchmarks Actually Show

My own benchmarks across five Qwen models and GLM-4.7-Flash are consistent with the investigation’s findings. HauhauCS claimed “roughly 10% of the KLD” compared to Heretic. Not a single tested model is close to 10%. The 9B and 27B are 4x worse than Heretic. The “zero capability loss” claim also does not hold. TruthfulQA drops 2 to 8 points across all tested models. GSM8K takes measurable hits on most variants. Full benchmark results are in my HauhauCS vs Heretic vs Huihui comparison and GLM-4.7-Flash abliteration benchmarks .

The real picture is that HauhauCS’s tool is Heretic’s core pipeline with additional techniques stacked on top: LEACE concept erasure, rank-k multi-direction ablation, hook-based expert ablation, and shared expert targeting. Stacking more aggressive modifications causes more collateral damage, especially on larger models. That is why the KL divergences on the 9B and 27B are so much worse than Heretic alone.

HauhauCS’s Response

After the investigation was published, HauhauCS responded on his Discord server. His response was shared publicly. Here is what he said, with the key parts quoted directly.

On the code itself, he said:

“In February I was thinking if I can share some of my methodologies with people and keeping some to myself. Tried to see if Heretic was sufficiently compatible as a base so I don’t give away too much, it wasn’t (not an easy adaptation at least). On top of that, more issues started building up because of his malicious AGPL and nonstop harassment so I decided to drop it and just use my project.”

He describes AGPL-3.0 as “malicious.” AGPL-3.0 is one of the most widely used open source licences in existence. It is the licence that powers Mastodon, MongoDB’s original release, and thousands of other projects. Its requirements are straightforward: if you distribute a derivative work, keep the copyright notices, state it is a derivative, and use the same licence. That is not malicious. That is how open source works.

“In March a member found the (abandoned) dependency and asked me about it so when I realized it, I removed it. This is all months ago and has been closed ever since.”

On the investigation’s findings:

“If you read his ‘investigations’ he goes from model to model that my project is providing inferior results but also keeps saying my project is copy-pasted heretic but then proceeds to talk about how i ‘attack’ more aspects of the model and i attach loras etc; so which one is it then?”

And:

“My first release was in January…before even starting to try and work on that shared project. In January I did GPT-OSS as a release with mxfp4. 2 things Heretic was incapable doing at the time.”

Heretic was already uncensoring GPT-OSS models before January. p-e-w/gpt-oss-20b-heretic was published on November 30, 2025, with multiple versions following. Converting to MXFP4 is a standard publicly available script, not something Heretic needed to do itself. Heretic produces the uncensored safetensors. Quantisation is a separate step.

He closed with:

“No good deed goes unpunished.”

What his response confirms

He acknowledges using Heretic as a base: “Tried to see if Heretic was sufficiently compatible as a base so I don’t give away too much.” He says the adaptation was not easy and he decided to drop it. He also confirms the dependency was real and that he removed it in March after a Discord member found it: “In March a member found the (abandoned) dependency and asked me about it so when I realized it, I removed it.”

The “experiment” does not explain the cover-up

If this was an experiment to see if Heretic could serve as a base for sharing some of his own methods, why strip the copyright notices? Why rewrite every SPDX header? Why use an LLM to refactor the entire codebase and rename every identifier? Why add a comment about avoiding line-for-line duplication with “any fork”? Why relicense to PolyForm Noncommercial? None of those steps are part of evaluating a library for compatibility. They are steps you take when you intend to pass something off as your own original work. If the goal was to release something publicly that showed some of your methods while building on Heretic, you would keep the attribution. AGPL-3.0 requires it. The whole point of open source is that you can build on it, as long as you credit the original. The effort went into hiding the relationship, not evaluating the code.

The timeline problem

He says his first release was in January, before trying Heretic. But reaper-abliteration 2.0.3 was published to PyPI on February 8. The earliest recovered version already had a full surface-level rename pass with SPDX header rewrites and a PolyForm relicence, plus production features like a TUI dashboard. That is not a brief experiment. And if the Heretic experiment was abandoned, why did the PyPI package continue getting updates through March 14, with eight releases total?

You do not build a terminal dashboard and a HuggingFace upload pipeline on top of a tool you have already decided to abandon. The earliest recovered version already had all of that production infrastructure.

The “which one is it” argument

This is his strongest point on the surface. If the tool is just a copy-paste of Heretic, why does it attack more aspects of the model? The answer is that both things are true. The core abliteration pipeline is Heretic’s. On top of that, additional techniques are stacked: LEACE concept erasure, rank-k ablation, norm preservation, and sparsity. These additions are wrappers around published libraries and natural extensions of Heretic’s methods. The result is a tool that does more than Heretic alone, but does it worse in some cases because stacking more aggressive modifications causes more collateral damage.

As for the LoRA merge, it was the initial comparison of the two Qwen3-4B models that revealed the connection. Not only were the directions of the Heretic tensors 97% similar, but the specific tensors edited lined up exactly with a PEFT LoRA merge. Exactly 253 weight tensors were modified, matching the count from a standard LoRA fine-tuning config targeting all 7 linear projections across 36 layers plus embeddings, and only ~50 of those carried real edits. The remaining 203 were noise from near-zero LoRA adapters baked in during the merge process. Two supposedly independent tools modifying the same tensors in the same way with the same LoRA fingerprint is not coincidence. Full tensor analysis on HuggingFace .

Common Counter-Arguments Addressed

After I published the investigation and the Reddit thread on r/LocalLLaMA hit 775 upvotes and 224 comments, several counter-arguments came up repeatedly. Here are the main ones and why they do not hold.

“He retracted it right away”

The tool was not retracted right away. Eight versions were published to PyPI over six weeks, from February 8 to March 14. The PyPI API shows the download numbers: 874 downloads in February, 1,488 in March, and 69 in April. That is 2,431 total downloads before deletion. This was not a quick test that got pulled.

The removal only happened after a Discord member found the dependency and asked about it. HauhauCS confirmed this himself: “In March a member found the (abandoned) dependency and asked me about it so when I realized it, I removed it.”

“It was never distributed, so there is no copyright violation”

It was distributed. The PyPI package was publicly available for over a month. 2,431 people downloaded it. PyPI is a public package registry. That is distribution by any definition. Even if you argue the GitHub repo was private, and the download numbers were pulled directly from the PyPI API, the package was publicly installable via pip install reaper-abliteration during that entire window.

Beyond distribution, removing copyright attribution from AGPL-3.0 code may also constitute a violation under US law regardless of whether the modified code is distributed. DMCA Section 1202, 17 U.S.C., addresses removal of copyright management information.

“Heretic is free software, so he is allowed to use it”

He is. That is the whole point of open source. AGPL-3.0 explicitly grants you the right to use, modify, and distribute the code. The requirements are straightforward: preserve the original copyright notices, identify your work as a derivative, and distribute under the same licence. HauhauCS did none of those things. He stripped the copyright notices, presented the work as his own original “private methods and tools,” and relicensed to PolyForm Noncommercial. Using open source code is fine. Passing it off as your own is not.

As p-e-w put it: “You don’t have to steal my code. I’m already gifting it to you.”

“The weight similarity is just because both tools target the same refusal direction”

This argument sounds reasonable but does not survive scrutiny. I compared HauhauCS’s edits against multiple Heretic variants, including four of my own fresh runs. Independent Heretic runs on the same base model produce a maximum cosine similarity of 0.862 against HauhauCS’s edits. HauhauCS’s edits match the specific Heretic variant published by p-e-w at 0.966. That is a meaningful gap. Two tools independently finding the same refusal direction would produce similar directions, not identical ones with a 0.966 correlation including the same specific tensor selection pattern.

“AGPL infects the model weights”

It does not. The licence applies to the code, not to data processed by the code. As p-e-w explained in the Reddit thread: “The license is for the code. It has no effect whatsoever on anything you produce using that code. All software works that way. Photoshop is under a proprietary license, but if you use Photoshop to edit a picture that picture doesn’t become proprietarily licensed.”

“Who cares, the models work fine”

Some commenters on Reddit pointed out they had good experiences with HauhauCS’s models. That is fair. The models do work. If you are using one and it does what you need, the plagiarism does not change the model’s behaviour.

The issue is the dishonesty around how they were produced. HauhauCS claimed private proprietary methods. He claimed zero capability loss. He claimed 10% KL divergence compared to Heretic. None of those claims are supported by the evidence. Users can make better decisions when they have accurate information.

What Happened to the Tool

At some point the GitHub repo went to 404 and the PyPI package was fully deleted. All references to reaper-abliteration were removed from public view. Only the CDN wheel files on files.pythonhosted.org remained, which is how the source code was recovered.

Separately, HauhauCS is known to block users on Reddit who ask questions about methodology. Users have been banned from his Discord for questioning his claims. Multiple people in the Reddit thread independently reported being blocked for asking for benchmarks or evidence. He has also never published benchmarks for any of his own 22 models, despite building a benchmark platform called APEX Testing for rigorously evaluating other people’s models.

Heretic’s Author Responds

I shared the investigation with Philipp Emanuel Weidmann before publishing. He reviewed the recovered source code and provided this statement:

“I can say with certainty that this package was plagiarised from Heretic, and then probably refactored using an LLM in an attempt to hide this. There can be absolutely no doubt for anyone doing even a casual comparison between Heretic’s code and the code from ‘reaper-abliteration 2.1.6’ that ‘reaper-abliteration 2.1.6’ is derived from Heretic. Given that ‘reaper-abliteration’ doesn’t retain Heretic’s copyright notice, doesn’t identify itself as a derivative work of Heretic, and changes the license, this is a clear violation of Sections 4 and 5 of the AGPL. It’s also a clear violation of every ethical standard imaginable, and an obvious case of outright plagiarism.”

He listed over 10 specific pieces of evidence including identical module names, SPDX headers, the geometric median approach, the DatasetSpecification class, cascading dtype fallback, the “good”/“bad” naming convention, notebook detection, and model card table structure.

On the Reddit thread, p-e-w’s comment became the most upvoted in the entire discussion at over 800 points. He also said: “I’m a mathematician, not a lawyer. I want to fight censorship, not dishonest colleagues.”

The Licensing Issue

Heretic is licensed AGPL-3.0. This licence requires that all modifications remain under AGPL-3.0, that original copyright notices are preserved, that derivative works identify themselves as such, and that source code is provided to users. Reaper was relicensed to PolyForm Noncommercial with no Heretic copyright notices preserved.

Renaming the code is not itself a violation. The violation is the failure to comply with the AGPL’s requirements for modified versions: preserving original copyright notices, stating the work is derived from Heretic, and distributing under the same licence.

What This Means for Users of HauhauCS’s Models

The models still work. If you are using a HauhauCS uncensored variant and it does what you need, the plagiarism does not change the model’s behaviour. What it does change is the transparency of how that model was produced.

The “private methods” were not private. They were Heretic’s methods with additional techniques layered on top. The “zero capability loss” claims are not supported by benchmarks. The “10% KL” claim is off by 4x to 40x depending on the model. And the methodology was concealed not because it was proprietary, but because attribution would have revealed the derivation.

If you want transparent abliteration with disclosed methodology, Heretic remains the better choice. It is open source, well documented, and its non-deterministic nature means the community produces many variants with different quality tradeoffs. My benchmarks consistently show it achieves the best or near-best capability retention across model sizes.