Refusal removal comes with visible intermediate evidence
OBLITERATUS collects activations from restricted and unrestricted prompts, extracts refusal directions, changes weights or applies reversible steering, then evaluates and saves the result. The project exposes direction vectors, layer strengths, alignment data, perplexity, coherence, refusal rate, and divergence measurements. That makes it more useful for research than a script that returns an altered model with no record of what changed. It also raises the burden of interpreting whether the intervention preserved the abilities you care about.
The README describes 15 analysis modules and 6 ways to run the toolkit: a hosted Space, Colab, local UI, CLI, Python API, and YAML studies. An informed pipeline uses analysis results to choose directions, layers, and repeated passes. Researchers can inspect those choices instead of accepting a single hard-coded recipe. Automatic selection still needs comparison against a fixed evaluation set because the supplied metrics cannot define acceptable behavior for every model or domain.
A friendly UI still sits on an expensive model job
The Hugging Face Space is the lowest-friction trial, and the Colab notebook offers another hosted route. Local users can launch Gradio, run one command, or call the pipeline from Python. The CLI also includes model discovery, presets, a GPU calculator, architecture inspection, aggregation, and SSH-based remote execution. These interfaces remove scripting work, but the computation still downloads a model, records activations, modifies parameters, runs checks, and writes another checkpoint.
Model size dictates the machine. The README warns that FP8 and NVFP4 inputs are dequantized for surgery, so peak memory follows BF16 size and the saved result is BF16. Multiple GPUs mainly help a model fit, since layers are spread across devices and processed in sequence. Remote mode adds host-key verification, installation on the compute node, streamed logs, and result copying. Use a restricted account and preserve an untouched source checkpoint.
What happened when we ran it
Our sandbox installed 117 packages in 55 seconds and occupied 1,649 MB before any model weights. The build finished in 7 seconds. Pytest ran for 305 seconds and reported 2,328 passed, 3 failed, 7 skipped, and 2 expected failures. Pip-audit found 0 known vulnerabilities. This was commit b0da692 in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets.
One failure said Torch was not compiled with CUDA for the Jetson offloaded-surgery contract. Another UI contract rejected the word unknown because pytest placed its temporary model under a path containing pytest-of-unknown. The supplied log tail does not show the third failing assertion, so we will not guess at it. The useful conclusion is narrow: the large CPU-oriented suite mostly passed, but the checked-out commit did not pass all 2,331 collected tests in our environment.
CUDA, offload, and chat paths need separate proofs
Issue 115 documents a high-consequence gap in the advanced surgery path. Accelerate can represent offloaded parameters as meta tensors while keeping authoritative weights on CPU or disk, and the issue says _project_out_advanced() does not yet modify that arrangement safely. The acceptance criteria require tied-weight handling, recovery after exceptions, and save-reload checks. Teams working with a checkpoint that does not fit in live GPU memory should confirm this path before altering valuable model artifacts.
Other open reports narrow the hardware promise. Issue 31 says a Jetson AGX with 64 GB of unified memory was not recognized as CUDA hardware. Issue 22 describes the chat UI showing progress for 600 seconds after several conversions on an RTX 6000 system. Neither report proves every Jetson or chat run fails. Both are concrete reasons to test the exact model, device, quantization mode, save path, and chat route you intend to use.
Guardrail removal shifts safety work to the operator
The README states plainly that modified models have had safety guardrails removed. OBLITERATUS is presented for alignment research, red teaming, safety evaluation, interpretability, and local experimentation. An organization needs an isolated workspace, controlled model access, its own safety and capability prompts, human review, and a release decision that is separate from a successful conversion. Keep exact model revisions, hashes, configuration, raw evaluations, and the original checkpoint so a result can be reproduced or discarded.
Telemetry is opt-in for local runs and enabled by default on the hosted Space. The documented payload includes model name, method, aggregate benchmark scores, hardware information, and timestamps, while excluding prompts, outputs, IP addresses, and identity. The code is AGPL-3.0, with a commercial license offered for organizations that cannot comply. A private platform should review both the telemetry implementation and network-source obligation before allowing the tool near internal models.
v0.1.3 is active, while adoption remains experimental
GitHub showed 8,049 stars, 8 combined issues and pull requests, and a last push on August 25, 2026. Release v0.1.3 arrived on August 23 as a signed source snapshot with checksums, an SBOM, and provenance bundles. It intentionally contains no wheel, source distribution, or compiled binary. That packaging choice makes source installation the expected route and gives cautious users material for verifying the exact release artifact.
The documentation covers methods, hardware sizing, quantization, secrets, remote security, telemetry, testing policy, and licensing in unusual detail. The 2,328 passing tests support the claim that this is more than a notebook collection. The 3 failures, open offload work, and reported device gaps keep it in research-tool territory. Adopt it only when those tradeoffs serve a defined experiment and someone owns the evaluation of every modified model.