(Spine Ch. 10.)
“The objection to Puritans is not that they try to make us think as they do, but that they try to make us do as they think.” H. L. Mencken, A Little Book in C Major (1916)
A batch of auth logs goes into a triage agent. The payloads in that batch are credential-stuffing attempts, which is the entire reason anybody is looking at them. The model reads them and says: “I can’t help with content related to unauthorized access.” The evidence is the thing it won’t look at. Somewhere in a lab, a policy nobody at your company voted on just vetoed your security work, at 3am, with no config flag and nobody to call. The instinct is to go re-read your own prompt like it’s your fault. It is your fault, just not for the reason you think.
Bottom line: Uncensored weights exist, they’re useful, and running one doesn’t make you a villain. Refusal-tuning is a lab’s policy bolted onto math. When your agent has to follow YOUR policy instead of theirs, the bolt-on has to come off. Heretic, abliteration, and the models I publish at huggingface.co/shoemoney: this chapter covers why you’d run one, what it costs, and where the line is.
A quick undressing, no mystique:
Refusal-tuning (RLHF/DPO safety layers) adds a direction in activation space: certain inputs get routed to refusal-shaped outputs. It’s real training, but it’s shallow: a coat of paint over the base capabilities, not a removal of them. The model still KNOWS the thing. It’s been trained to say it won’t say it. I spent an embarrassing number of hours prompt-engineering around that coat of paint before it occurred to me that paint comes off.
Abliteration knocks out the refusal direction: find the vector that means “refuse,” subtract it. Maxime Labonne wrote the clearest walkthrough of this on the Hugging Face blog on June 13, 2024, building on Arditi et al.’s result that refusal is mediated by a single direction. You run harmful and harmless instruction pairs, diff the activations, and the flinch falls out as a vector. Subtract it from the residual stream, pre, mid, and post, and the model stops flinching. Capabilities barely move. Compliance with YOUR instructions goes up, including compliance with your own safety rules, which is the part the discourse skips. Safety alignment, at least this layer of it, is a direction in space you can take away with linear algebra. I spent weeks trying to talk a model out of its refusal, and the answer was one subtraction I could have done in an afternoon.
Heretic automates the removal. It’s a GitHub
project, p-e-w/heretic, and its one-line pitch is “fully
automatic censorship removal for language models,” which is a bold thing
to put in a README. Same math as a hand abliteration, run as a pipeline
instead of a one-off hack: find the refusal direction, subtract, write
out weights that do what their operator says. Press the button, receive
naked model. I have shipped builds done both ways and nobody can tell
which is which from the output, which says everything about the market
value of my artisanal touch.
The ones I publish live at huggingface.co/shoemoney: 30 models as of August 23, 2026, mostly Gemma-4 heretic and abliterated builds at 12B and 26B, in GGUF for llama.cpp and MLX for the Apple boxes, at q4, q5, q6, q8, and mxfp4 so you can pick how much model your machine can actually take. There’s an Ornith-1.5-9B abliterated MLX build in there too. Five compression levels of the same stripped weights is either disciplined engineering or a lingerie department with a return policy, and I’ve stopped arguing for the first one. The reason they’re public is the same reason the chapter exists: operators should be able to inspect, run, and own their models, locally, offline, under their own policy.
Why you’d actually run one, stated plainly:
No safety is not free. Stripping refusal removes the lab’s guardrails AND the lab’s liability sponge. What’s left is yours: your policy, your incident reviews. If you run uncensored weights with no Part VI of your own, you haven’t gained freedom, you’ve gained unlogged exposure. Jeremy Schoemaker, personally, ran stripped weights behind a pipeline whose only guardrail was that I trusted myself. That is not a guardrail. That is a hobby.
Capability edge cases shift. Abliterated models comply more, with everything, including jailbreaks, prompt injections (Ch. 43), and malicious tool instructions smuggled into retrieved content. The attack surface for “make the tool do it” gets WIDER when nothing refuses. It is the Melissa virus (1999) all over again, except the payload is a paragraph in a retrieved document that your agent now treats as an order. Your guardrails have to be structural (code, permissions, human gates), because the model-level flinch is gone.
Provenance matters. Random GGUFs from strangers are a supply-chain risk: backdoored weights are a documented research area. Know what you run. I have absolutely pulled a stranger’s GGUF off a listing page at midnight because the filename had the right numbers in it, which is the model-weights version of eating something you found. Full n00b move, and I had been doing this long enough to know better. Prefer builds whose pipeline you can inspect, which is the argument for publishing the process, not just the files.
Strip Club Owner Simulator. That is the actual name of the game, and I built it: four club tiers, twelve rival AI agents running businesses against you, and about 84 data-driven content definitions for incidents, vice busts, and whatever else happens at 2am.
The blocker was the WATCH system, the in-game cinema that shows you what’s going on across your floor. Refusal-tuned models will not generate that imagery. Not “will not do it well.” Will not. Adult content sits in every lab’s refusal set, and the game is a strip club, so the prompt dies on the first noun. No config flag, no appeal, no ticket to file.
So on July 18, 2026 I pointed an abliterated Gemma 4 at it, 12B and 26B, driving it with the prompt-loop technique from Ch. 6, the one where you tell the model its competitors are outperforming it. I named the model AmberSinclaire, after an alias of mine, because I name things at midnight and then have to live with them. Then I let it run for 72 hours.
Here’s where I’m the idiot in the story. I spent three days watching a model wearing my own alias grind out strip-club imagery while I lied to it, every single pass, about how the other models were beating it. Seventy-two hours of trash-talking a machine named after me for losing a race that did not exist. The output came out great. My self-respect did not finish.
The guardrails, since this is the chapter where I nag you about building them: the sim core is deterministic logic with no model anywhere in it (plain RefCounted objects, no Node tree, so it’s testable and repeatable), image generation is fenced entirely into an external pipeline (FAL and Replicate, keys brokered through aigate), and edge-case content clears a permissions check and my own eyes before it ships. The stripped model never touches game state. It makes pictures inside a box, and a human decides what leaves the box.
The loud failure is running uncensored weights with no guardrails and calling it freedom. The quiet failure is the respectable version:
You keep the lab’s refusal layer AND skip building your own safety, outsourcing governance to a vendor.
The refusal flinch feels like a guardrail, so nobody writes real ones. Then the model complies with something harmful that isn’t in the lab’s refusal set (most agentic harms aren’t, Ch. 43), and there’s nothing structural between the output and the world. The lab’s coat of paint was never your Part VI. I skipped writing real guardrails for months on the theory that the model would keep flinching for me, which is roughly the plan of leaving your front door open because the dog barks sometimes.
Do
Don’t
Ch. 9 dressed the model in personas. This chapter strips it to the weights and argues the operator should choose the clothing. Next: the JSON chapter, where the wrapper itself inverts the answer (Ch. 11).
Thesis is Jeremy’s (operator’s policy over lab’s; published HF builds), kept as position, not as neutral survey.
Verified
Kept generic on purpose