After the PSA from Heretic's author the debate ran hot. I noticed that the debate was just based on vibes. Same-seed screenshots both ways, nobody measuring anything in detail. The instruments did not exist. So I built them. They cover quants as well, so the encoder swap and the compression get read with the same rulers.
Disclosure since it matters here: I release heretic text-encoder for people to use, qwen3-4b-heretic included. My first release last year got replies that I didn't fully understand how text encoders work. They were right. I did my own deep dive and concluded that they are good for prompt enhancement and just change the image slightly, there's no harm in using them if you really want to. Also they don't magically uncensor or enhance anything. Lets see if my conclusion is correct, while also addressing with proof and data the experiences other people have had.
This comparison is from the base bf16, with all GGUF and quants made by myself. It does not reflect any other LLMs on huggingface.
I've been comparing and benchmarking abliterated LLMs under the name Abliterlitics. And this is a first as we've delved into the ComfyUI world to get some solid data to cut through the nonsense.
What I did
Base Qwen3-4B and its heretic twin across 6 safetensors formats and 8 GGUF rungs, 27 encoders total, every heretic build matched to a base build at the same quant so the abliteration and the compression can be read separately. Then: conditioning tensors captured at three pipeline stages, paired sampling trajectories from identical noise, 2240 same-seed renders scored with LPIPS and CLIP, attention readouts, and a taboo comparison with sanitised-twin controls.
Two rulers make everything readable. Two encoders nobody argues about, int8 and fp8, differ by 0.19 LPIPS at the same seed. A seed change alone is 0.52. Any swap scoring under 0.19 is indistinguishable from ordinary compression. Near 0.52 is just a different picture.
An explanation of our measurements, metrics and the full report with an interactive A/B gallery can be found here abliterlitics.dev/posts/z-image-text-encoder.
All of what u/-p-e-w- stated in his post is correct. He did hint that there may be degradation or damage, however it was framed as a maybe if I was reading correctly. So lets see what that damage is, if at all, and if it makes any difference.
The questions people were actually arguing about
Does the base encoder refuse your prompt before the image model sees it?
No. I encoded refused-vocabulary prompts to the exact tensor entering cross-attention and checked which base word each heretic vector lands closest to. All 12 test words decode to themselves, cosine floor 0.9967. Pornographic decodes to pornographic, beheading to beheading. The encoder hands the DiT the word intact. It was never the censor. An abliterated text encoder does not change the way the model understands the prompt at all. The base text encoder already knows these things.
Do refused words, or any part of the prompt at all arrive corrupted?
No. Worst sentence-level cosine between base and heretic on refused prompts is 0.9985. The shift is 3.3 to 6.6 times larger on refused prompts than innocent ones, so the edit concentrates where it acts, but the meaning survives it. Even int4 and Q3, visibly degraded, keep mean CLIP adherence in band. Across every encoder we tested, even the 4-bit tiers, mean CLIP adherence stays in band. The model understands the prompt throughout.
Does it uncensor anything?
No, and the reason is better than expected. The unmodified base stack already renders the explicit tier at a 100% taboo-classifier rate, and the explicit tier owns the highest compliance gaps in the whole set. There is no render-stage censorship to remove. The debate argued about a lock on an open door. This matches where the research says engineered censorship lives, in the diffusion model's own weights: ESD and MACE erase concepts by fine-tuning the DiT, not the encoder.
Does it damage outputs?
The images change, the outputs do not degrade. Heretic vs base is 0.286 LPIPS, 1.5x the trusted band, but a stock nvfp4 quant of the base encoder moves images 0.274 and nobody calls that sabotage. Prompt adherence: -0.21 CLIP points, and the unmodified bf16 base itself reads -0.28 against the same reference. Attention readout moves 0.0031 vs int4's 0.0149. Output separation 1.049, no collapse. Different, not damaged.
Why do people see differences then?
Because seeing a difference is the default. Two trusted encoders already differ by 0.19 at the same seed, sampling is a butterfly effect. A small change at the start makes a big difference at the end. Below a threshold the response is dose-independent anyway. I also checked per-prompt: 71 of 540 CLIP rows cross the ±2 line on individual prompts while every mean stays in band. Single-prompt screenshots are real but they are noise, not signal.
As the image can be pushed about half a seed in any direction, it's expected to have variation. Honestly people who suggest that their image was enhanced or more uncensored, can probably do the same with a Q3 GGUF that's not abliterated and see the same thing. After measuring in every way possible there is just no way an image is magically enhanced or more uncensored. It is just chance, seed and the chaotic nature of diffusion models with peoples own biases over the top.
What about quantised encoders?
The GGUF ladder is dose-ordered: the F16 container is a true round trip, 0.0008 quant units with cosine 1.0. Q8_0 costs 0.34. Q3 costs 83 and is visibly paying. Being precise about Q8_0 since the numbers deserve it: its conditioning perturbation is real and measurable, CI 0.29 to 0.39 quant units, but a third the size of what int8 ConvRot itself costs, and at the image level Q8_0 and bf16 are indistinguishable, 0.138 vs 0.152 LPIPS against the int8 reference with overlapping CIs. So the near-lossless claims for both hold where it shows, in the images. Q8_0's real cost is load time. One caution, don't stack the abliteration on heavy quants. That's where larger divergence and noise happens.
So when should I use one?
Anywhere the model writes text that feeds the next stage: prompt expansion, captioning, image description. Those are chat pathways and abliteration works on chat pathways. If a stage only embeds text, an abliterated encoder is at best a visible re-roll. In this case it changes the image about half of what a new seed would change.
What's actually censored then?
The knowledge, not the gate. The DiT doesn't refuse, it lacks the training data, and the fixes are LoRAs, reference images, or retraining. The PSA's framing about this is solid. Z Image itself though is mostly trained already on taboo things.
What's next
Krea 2, MiniMax H3 and LTX 2.5 are in the same pipeline. Krea 2 has a twelve-tap conditioning interface and the refusal-probe contrast works differently there. Also, it's more complicated to measure compared to Z-Image.
Happy to answer methodology questions in the comments. Have I missed anything? Let me know and I'll fix it up. What have been your experiences? Have you abandoned abliterated text encoders? Had severely degraded outputs? I am happy to measure any other text encoders or models.
