HauhauCS Stripped Heretic, Renamed the Files, and Took 5 Million Downloads on the Way Out

Five million monthly downloads. Twenty-two "uncensored aggressive" Qwen variants. 3,086 followers. Every model card opens with the same boast: "0/465 refusals, zero capability loss." The whole stack on the HauhauCS Hugging Face profile was built with reaper-abliteration. The author called this PyPI package "my own private methods and tools." Then a forensic team cracked open the wheel files. They found someone else's fingerprints baked into every module.

Reaper is a refactored copy of Heretic. This is an open-source abliteration toolkit by Philipp Emanuel Weidmann. It boasts 19,900 GitHub stars and dates back to September 2025. It is licensed under the strict GNU Affero General Public License (AGPL-3.0). HauhauCS deleted their package and source repo the moment the dossier landed. It was the exact reflex of a teenager whose parents come home early.

But the internet remembers. The Ecosyste.ms cache and files.pythonhosted.org still serve six of the eight deleted wheel files. They are available byte-for-byte. Checksums were published for independent verification.

I pulled the files from the cache. I ran a hash check against the published sums. They match perfectly.

The provenance is not subtle. The forger did not even scrub the typos. The team behind reaper-analysis put Reaper next to Heretic and counted the similarities. They found seven preserved module filenames and 31 verbatim method names. This included a batchify method with the exact same signature. It also included an empty_cache method with identical garbage collection across six backends.

The copying went deeper than methods. They found 30 character-identical refusal-marker strings. The typo-shaped "i an ai" missing its "m" appears in both files. So does a truncated "violat" string.

Nine configuration fields had matching types and defaults. They even shared identical parameter bounds for search. Reaper also copied a specific geometric median step that Heretic's author had "never seen" anywhere else.

Then there is config.py line 82. This was recovered directly from the downloaded wheel file:

# ---------------------------------------------------------------------------
# Default refusal markers - kept as a module-level tuple so the literal
# does not duplicate line-for-line with any fork.
# ---------------------------------------------------------------------------
_REFUSAL_KEYWORDS: tuple[str, ...] = (

I read that comment three times. It still says the exact same thing. The list was reshuffled "so the literal does not duplicate line-for-line with any fork." That is not a code comment. That is a confession with line numbers.

Weidmann's read is direct. He calls it "consistent with LLM-assisted refactoring." A human hiding a fork would be unlikely to document the evasion in a source comment. An AI assistant asked to refactor code to avoid duplicating 'any fork' would describe the rationale exactly as written.

The marketing tells a story the actual files do not corroborate. Every HauhauCS model card opens with the same bold claim. They promise "No changes to datasets or capabilities." They claim it is "100% of what the original authors intended - just without the refusals."

Nathan Sapwell's benchmark shows this claim falls apart at scale. TruthfulQA performance loses 2.17 points on the small model. The 27-billion parameter version drops a massive 8.2 points. On that same large setup, Heretic's loss is only 3.1 points. The "lossless" marketing line is not just ethically thin. It fails the math the publisher invited reviewers to run.

The licensing question is open and shut. The original license has strict rules for sharing. It requires the copyright notice and license to travel with verbatim copies. It also demands that modified versions carry a prominent notice of modification. Those derivatives must ship under the exact same open-source terms.

Reaper completely ignored these rules. It stripped the copyright line. It called the code the author's "private methods." It relicensed everything to PolyForm Noncommercial 1.0.0.

The original license specifically forbids derivatives from imposing such non-commercial restrictions. You cannot bolt extra limits onto a copyleft work and claim it as your own. Weidmann's statement is unambiguous. He calls it "a clear violation."

A defender could argue that methodology is not copyrightable. They would be right about the methodology itself. But the license covers code and structure.

The compiled dossier is not arguing about abstract methods. It points to seven filenames, 31 method names, and 30 identical refusal strings. It highlights an in-source comment about evading detection. Independent rediscovery does not show up wearing the upstream author's typos.

I covered Hugging Face's case for "open" AI security in an earlier piece. Their manifesto promised openness without any enforcement scaffolding. A few days later, this plagiarism case proved the gap. A major publisher stripped an author's name and swapped the license. They hosted five million monthly downloads on the stolen result.

Hugging Face's Content Policy and Terms of Service forbid posting IP-infringing content. But there is no automated license scanner at upload. There is no required derivative-work declaration. There is no dependency-graph attribution.

The policy is just a sign on the door. The lock has been left off on purpose. As of writing, the 22 copied model cards are still live. The loudest signal the platform received is this Reddit dossier:

Weidmann's last word on the Reddit thread is the editorial spine of this story:

Keep the license, keep the copyright line, keep going. HauhauCS chose a different path. They swapped in a strictly more restrictive license. They peeled off the gift tag and walked out the door.

The package is gone now. But the five-million-download empire it built is still online. It sits on a platform whose content policy is just a button without a scanner behind it.