I have a chinese IP camera. From superficial research I know it has some CVEs to take control of it. Unfortunately, I don't have the technical knowledge to perform an attack and run some software to extend the camera's functionalities. No model from a provider accepts my RE and hacking requests, so these abliterated ones have been vital to reclaim possession over my stuff
I'm curious, how well do z.ai reverse engineers protocols ? Is it good enough that we'll see Chinese device makers creating low cost hardware clones, that connect to western software ?
It is not feasible. They never made much of an inroad against torrents and that is a much easier target than abliterated models. As the linked website shows; the process to abliterate a model can be as simple as
I think that was the point being made? Outlawing something does nothing if enforcement is not feasible. The music and movie industries didn't crush torrents, they switched business models to streaming with prices being determined mostly by how much hassle was avoided by skipping the torrents.
I think a major difference is that while torrents are illegal, the main people enforcing it are copyright holders. I think the discussion would change if the government would label people who build/use/distribute "illegal" models as terrorists.
Agreed. While the IP mafia (pardon the derogative) has vast influence on legislators and even the executive, it pales in comparison to the "terrorist" and "think of the children" scarecrows.
Agree. I took a look at these last few months, did a write-up: https://languageops.com/blog/ai-safety-pdoom-local-vs-fronti... and I don't know if I agree or not on outlawing completely, but I think an age restriction *at least* like for alcohol, firearms and driving would be not unwise.
They're pretty basic and hallucinate a lot. There are some hard limits to how good you can get on a model that fits on a phone.
Qwen3 and Gemma level models that run on mid-high end laptops and desktops can be pretty good. Not frontier grade, but shockingly competent for something that runs on a single PC. But the hardware you need to run those fast is at least $1000-$2000. Cheap hardware can run them, but slooooooow.
If you think closed source software/binaries only is bad, wait until you see how awful the state of the art is with a clear-as-mud bucket of matrix weights.
We know it's possible to train an LLM to secretly respond to certain trigger phrases, and last I checked these could only be detected with the assistance of whoever chose those phrases.
The trigger condition for such backdoors is not something anyone can do a systematic brute-force check for, for the same reason we had to invent LLMs in order to do natural language processing: combinatorial explosion.
Passing around open weight models from known sources is already asking you to trust those sources; because of how difficult this is to do correctly even without deliberately inserting such things, we still don't know if China has already put such trigger conditions into their models despite headlines such as these: https://venturebeat.com/security/deepseek-injects-50-more-se...
Regardless of if it was deliberate or not, we don't know if we caught all of these misbehaviours. We don't know how to.
And note, I'm not saying "and therefore you should trust the Big Name Models". If open weight models score 2/100 in this context, closed ones score 1/100.
You can actually discover those in open weight artifacts, reproduce them, study them and issue a security bulletin.
With proprietary hosted weights you can be specifically targeted and you would not be able to reproduce nor prove anything.
Poisoning open models would be of short-term benefit to China only if they could target US (and maybe EU + Commonwealth) specifically. Damaging anyone else would be a net loss and would erode the partnerships and alliances they are trying to build elsewhere. So it's a fire-once weapon with a huge risk of collateral damage.
Much more plausible is simply making the models ideologically biased, but as history teaches us, preferring ideology or religion over science is a well-known path to ruin. It would be weird to simultaneously warn public not to use their own open models, so.
I think the most plausible explanation for open models is simply that Huawei wants more customers and is willing to compete on the hardware front.
Looks like a well engineered, automated abliteration pipeline. The claims seem a bit overstated though, since the metrics mentioned are cherrypicking refusal count and KL divergence, both of which make the outcome seem the most dramatic.
I personally never saw much of a quality drop from models put through Heretic if that amounts to anything. They have been working quite well on small local models so far.
Heretic author here. Those are the standard metrics used in the relevant literature, including in the paper that originally introduced directional ablation. KLD is also the standard metric for evaluating quality degradation in model quants. So I don’t understand what you mean by “cherrypicking”.
That's the right question to ask. One honest caveat: The interface seam currently forces the pin at the intermediate. Want me to implement or address the other item first?
I have a chinese IP camera. From superficial research I know it has some CVEs to take control of it. Unfortunately, I don't have the technical knowledge to perform an attack and run some software to extend the camera's functionalities. No model from a provider accepts my RE and hacking requests, so these abliterated ones have been vital to reclaim possession over my stuff
These "safeguards" are actively contributing to computer insecurity at this point.
deepseek v4.1 flash has never denied a programming or hacking related request to me
I did that exact thing with GLM-5.3 from Z.ai with a chinese IP Camera. And i did not have to trick it in any way.
I'm curious, how well do z.ai reverse engineers protocols ? Is it good enough that we'll see Chinese device makers creating low cost hardware clones, that connect to western software ?
What model did you try? Chinese models have no issues with that type of stuff
Existential
Keep a close eye on abliterated and "heretic" open weight models. They will be outlawed first.
It is not feasible. They never made much of an inroad against torrents and that is a much easier target than abliterated models. As the linked website shows; the process to abliterate a model can be as simple as
pip install -U heretic-llm && heretic Qwen/Qwen3.5-4B
let alone people just putting the weights up in a torrent. All assuming that someone even tried to ban abliterated models.
The torrents you are talking about are outlawed. Whether enforcement is working or not is another issue.
Outlawed? Only in safetyist dreams
I think that was the point being made? Outlawing something does nothing if enforcement is not feasible. The music and movie industries didn't crush torrents, they switched business models to streaming with prices being determined mostly by how much hassle was avoided by skipping the torrents.
I think a major difference is that while torrents are illegal, the main people enforcing it are copyright holders. I think the discussion would change if the government would label people who build/use/distribute "illegal" models as terrorists.
Agreed. While the IP mafia (pardon the derogative) has vast influence on legislators and even the executive, it pales in comparison to the "terrorist" and "think of the children" scarecrows.
Agree. I took a look at these last few months, did a write-up: https://languageops.com/blog/ai-safety-pdoom-local-vs-fronti... and I don't know if I agree or not on outlawing completely, but I think an age restriction *at least* like for alcohol, firearms and driving would be not unwise.
Make sure they ban books with dangerous knowledge too.
Books with dangerous knowledge are banned.
See, the various banned porn varieties for an easy example
The hardware requirements are already quite restrictive
Oh no, some run on iPhones
They're pretty basic and hallucinate a lot. There are some hard limits to how good you can get on a model that fits on a phone.
Qwen3 and Gemma level models that run on mid-high end laptops and desktops can be pretty good. Not frontier grade, but shockingly competent for something that runs on a single PC. But the hardware you need to run those fast is at least $1000-$2000. Cheap hardware can run them, but slooooooow.
You can still lease GPU farm in many "easy" countries.
This is the test. If the speech that's easiest to dislike is legal, then we all have free speech.
IMO math is free speech, and outlawing math is censorship.
Like they've outlawed drugs? Illegal weapons? Hacking?
I'm not sure what is your point. It reads as defeatism to me but I'm not sure.
Could you elaborate? Do you find it good or bad? What actions can be taken?
Hes of the mind that american fascism will hold together long enough to be competent decesion makers
Good.
If you think closed source software/binaries only is bad, wait until you see how awful the state of the art is with a clear-as-mud bucket of matrix weights.
We know it's possible to train an LLM to secretly respond to certain trigger phrases, and last I checked these could only be detected with the assistance of whoever chose those phrases.
The trigger condition for such backdoors is not something anyone can do a systematic brute-force check for, for the same reason we had to invent LLMs in order to do natural language processing: combinatorial explosion.
Passing around open weight models from known sources is already asking you to trust those sources; because of how difficult this is to do correctly even without deliberately inserting such things, we still don't know if China has already put such trigger conditions into their models despite headlines such as these: https://venturebeat.com/security/deepseek-injects-50-more-se...
Regardless of if it was deliberate or not, we don't know if we caught all of these misbehaviours. We don't know how to.
And note, I'm not saying "and therefore you should trust the Big Name Models". If open weight models score 2/100 in this context, closed ones score 1/100.
You can actually discover those in open weight artifacts, reproduce them, study them and issue a security bulletin.
With proprietary hosted weights you can be specifically targeted and you would not be able to reproduce nor prove anything.
Poisoning open models would be of short-term benefit to China only if they could target US (and maybe EU + Commonwealth) specifically. Damaging anyone else would be a net loss and would erode the partnerships and alliances they are trying to build elsewhere. So it's a fire-once weapon with a huge risk of collateral damage.
Much more plausible is simply making the models ideologically biased, but as history teaches us, preferring ideology or religion over science is a well-known path to ruin. It would be weird to simultaneously warn public not to use their own open models, so.
I think the most plausible explanation for open models is simply that Huawei wants more customers and is willing to compete on the hardware front.
This is off topic.
Why don’t people who release python projects ever encode the venv steps into the installer? Can’t pip just do that step for the user?
They did, via uv. uv run heretic, and it will handle the rest.
Looks like a well engineered, automated abliteration pipeline. The claims seem a bit overstated though, since the metrics mentioned are cherrypicking refusal count and KL divergence, both of which make the outcome seem the most dramatic.
I personally never saw much of a quality drop from models put through Heretic if that amounts to anything. They have been working quite well on small local models so far.
Heretic author here. Those are the standard metrics used in the relevant literature, including in the paper that originally introduced directional ablation. KLD is also the standard metric for evaluating quality degradation in model quants. So I don’t understand what you mean by “cherrypicking”.
Does this actually modify the weights?
It submits prompts that get refused, then detects and modifies the weights responsible?
Like brain surgery?
Can the load-bearing gaps that are worth being flagged for pinning down be abliterated out of a model?
That's the right question to ask. One honest caveat: The interface seam currently forces the pin at the intermediate. Want me to implement or address the other item first?
Honest take. Implementing first would break the seams, our work here is done. This is a great place to stop.-