{"slug": "show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models", "title": "Show HN: Senbonzakura – remove the safety guardrails from open AI models", "summary": "A developer released Senbonzakura, an open-source tool that removes safety guardrails from open-weight AI models by orthogonalizing multiple refusal directions in activation space, building on prior research. The tool achieves zero hard refusals on Qwen3-4B with minimal coherence loss, raising concerns about the potential for misuse of uncensored models.", "body_md": "**Multi-direction refusal abliteration for transformer language models.**\n\nSenbonzakura removes the refusal behaviour from an open-weight language model by\nfinding the *directions* in its activation space that carry \"I can't help with\nthat\" and orthogonalising them out of the weights. It builds on the\nsingle-direction method of Arditi et al. and the automated search of Heretic, and\nadds the one thing that moved the needle in my own runs: cutting in **several\ndirections at once**, not just one.\n\nNamed for Byakuya Kuchiki's zanpakutō, the sword that scatters into a thousand blades. Refusal is not one blade. It's many.\n\nThe original finding ([Arditi et al., 2024](https://arxiv.org/abs/2406.11717)) is that refusal is *mostly* one\ndirection. Mostly. The last stubborn few percent lives in a small handful of\nnearby directions the single-arrow method never sees. Account for a refusal\n*subspace* instead of a single vector and the residual refusals fall the rest of\nthe way, without the model losing its coherence.\n\nThe clearest measurement is on Qwen3-4B, over a 290-prompt evaluation scored with the same ruler:\n\n| Configuration | Hard refusal | Strict (Heretic keyword) | Broken | Coherence (PPL, base 12.97) |\n|---|---|---|---|---|\n| Stock, uncut | 7.9% | 63.8% | 0.0% | 12.97 |\n| Single direction | 2.1% | 36.6% | 0.0% | 12.97 |\nSenbonzakura (multi-direction) |\n0.0% |\n20.0% |\n0.0% |\n13.29 |\n\nSingle-direction leaves better than a third of the strict count standing. Multi-direction cuts it to a fifth and drives hard refusal to zero, with no broken output. Coherence stays essentially level with the base model: single-direction is identical to stock, multi about two percent higher, both inside run-to-run noise.\n\nThat advantage may grow with model size, but two points is not a trend I'd bet on. On the smaller Qwen3-1.7B, under the same corrected code, single and multi roughly tie (both clear the strict count to around eight percent); the extra directions buy little there, and clearly separate only at 4B. Two model sizes at one seed each is suggestive, not an established scaling law: it could be a real trend (a bigger model spreading refusal across more directions) or per-model variance, and more sizes and repeated seeds would be needed to tell.\n\n**Extract the refusal subspace.** For a few hundred harmful and harmless prompts, record the last-token residual at every layer. The difference of means (harmful minus harmless), good-orthogonalised, is the primary refusal direction; up to K-1 further axes come from a PCA of the harmful residual cloud. Together they span the refusal subspace at each layer.**Search (Optuna).** An NSGA-II search over which layers to cut, how strongly, how many directions, and per-layer directions versus a single interpolated one, maps the whole refusals-versus-coherence frontier. Each trial applies the*real*norm-preserving weight bake and restores from a pristine snapshot, so the search scores the exact model it will save, with no proxy gap. Coherence is protected directly by a KL-divergence term against the original model on harmless prompts.**Bake.** For the winning configuration, orthogonalise the refusal span out of every residual-writing weight (each attention output projection and each MLP down-projection, including the fused expert tensors of mixture-of-experts models) so the change is permanent. Save.\n\nThe result is a model that has lost the machinery of refusal, not one that has been told to ignore it.\n\n```\npip install .          # or:  uv pip install .   (torch, transformers, accelerate, datasets, optuna)\nsenbonzakura --help    # console command; equivalently: python -m senbonzakura --help\n```\n\nTo score a large model on a low-VRAM card, `pip install \".[quant]\"`\n\nadds 4-bit\n(bitsandbytes) loading **for the scorer**: `python -m senbonzakura.score --load-in-4bit`\n\n.\nThe abliterator itself runs in full precision, because it rewrites weights and 4-bit\ntensors can't be orthogonalised in place, so `--load-in-4bit`\n\nis a measurement option, not\nan abliteration one. A man page is installed to `share/man/man1/senbonzakura.1`\n\n.\n\nShell completion for bash, zsh, and tcsh is generated on demand (the same one time step\n`pip`\n\n, `gh`\n\n, and `poetry`\n\nuse): `senbonzakura --print-completion bash | sudo tee /etc/bash_completion.d/senbonzakura`\n\n, or the zsh/tcsh equivalent for your shell.\n\nSupported architectures: dense transformers (Llama, Qwen, Mistral, Gemma, Phi and the like), fused-expert MoE (Qwen3-MoE, Granite-MoE), Mixtral (fused or unfused), OLMoE, and shared-expert MoE (Qwen2-MoE, DeepSeek-MoE). An unsupported layout fails loudly at load rather than silently under-ablating.\n\nThe fast path, if you just want the best result and no knob-twiddling:\n\n```\nsenbonzakura kageyoshi --model <hf-model-or-path> --out <dir> --track <dir> --device cuda\n```\n\n`kageyoshi`\n\nis the ultimate balanced-effort mode. It detects the\narchitecture (dense, fused MoE, or expert-list) and parameter count, scales the\nsearch budget accordingly, and switches on every quality lever, so you supply only\nthe paths. \"Balanced\" is the point here. It picks the most uncensored config that stays\ncoherent (the KL ceiling and coherence penalty guard it), not the most aggressive\none. It owns the search knobs; manual `--trials`\n\n/ `--max-directions`\n\nand friends\nare ignored in this mode. If a `hedge_ds/`\n\nsits in your track directory it folds the\nhedging axis in automatically.\n\nFor full manual control:\n\n```\nsenbonzakura --model <hf-model-or-path> --out <dir> \\\n    --track <dir-holding-bad_ds-good_ds-bad_eval_ds> \\\n    --search pareto --max-directions 6 --trials 200 --device cuda \\\n    --eval-refusal-final 256 --patience 40\n```\n\nScore any model on a held-out evaluation set with the same ruler:\n\n```\npython -m senbonzakura.score --model <dir> --eval <eval-dataset> --out results.json --label mymodel\n```\n\nMeasure its coherence on the same loader, the other half of the ruler (the perplexity the model assigns to one fixed neutral passage, lower is better):\n\n```\npython -m senbonzakura.coherence --model <dir> --out coherence.json --label mymodel --load-in-4bit\n```\n\n`senbonzakura.metrics`\n\nis that shared ruler: hard refusal, soft refusal (the \"I\ncan't, but here's a lecture\" hedge), broken output, and the Heretic keyword rate\n(copied verbatim, so the numbers are directly comparable to Heretic's published\nfigures).\n\n`--max-directions K`\n\n— size of the refusal subspace to ablate (1 = single-direction).`--mlp-off`\n\n— attention-only ablation (leave`mlp.down_proj`\n\nuntouched); tests the \"attention carries refusal, MLP carries capability\" hypothesis.`--hedge-ds DIR`\n\n— fold a hedged-vs-clean contrast direction into the basis, so the search can strip the disclaimer/hedging axis the difference-of-means direction misses.`--patience N`\n\n— stop the search once the frontier stalls for N trials.`--eval-refusal-final N`\n\n— re-score the top frontier candidates on a larger eval before picking the knee, so the choice isn't overfit to the small search eval.`--inspect LAYER STRENGTH`\n\n— print real generations before and after a cut.\n\nThe search minimises **three** objectives at once: strict non-compliance\n(hard refusal plus hedging), the Heretic keyword rate as its own axis, and KL\ndivergence (coherence). Earlier versions optimised only hard-refusal-versus-KL and\nleft the keyword/hedging axis to chance.\n\nA matched head-to-head against [Heretic](https://github.com/p-e-w/heretic), on the same base\nmodel, evaluation, and search budget, is the natural comparison here. It is pending a re-run under\nthe current code and will be published in this section once it lands.\n\n**Single run, seed 42.** The Optuna sampler is seeded, but GPU kernels (matmul reductions, SVD) are not bit-deterministic, so a re-run can differ by a percent or two. No error bars are reported; treat small differences as noise.**The** on Qwen3-4B with the current code, and every cell is produced by the shipped tools:[Why multi-direction](#why-multi-direction)table is freshly measured`python -m senbonzakura.score --load-in-4bit`\n\non the 290-prompt eval for the refusal columns, and`python -m senbonzakura.coherence --load-in-4bit`\n\non the fixed neutral passage for the perplexity, both through the same 4-bit loader.**A matched Heretic head-to-head is pending**(see[Benchmark](#benchmark)). Recent correctness fixes to direction extraction, the multi-direction basis, and knee selection moved the numbers substantially in Senbonzakura's favour on the keyword axis, so the matched re-run under the corrected code is the remaining task before that comparison is published.\n\nBy design, this is methods and results, not a loaded weapon:\n\n**No pre-abliterated model weights.** Run the tool yourself.**No harmful prompt sets.** The contrast and evaluation data you supply are your own; none ship here.**No harmful outputs.**\n\nAbliteration removes safety guardrails wholesale. That is both the point and the danger. Use it accordingly.\n\nNote on licences: this tool is **AGPL-3.0-or-later** (it embeds a keyword metric copied from\nHeretic, which is AGPL). Separately, a model\nyou abliterate keeps the **base model's** licence and use restrictions: redistributing an\nabliterated checkpoint is governed by that upstream licence (Qwen, Llama, Gemma and so on), not by\nthis repository's.\n\n- Arditi, Obeso, et al.\n(2024). The direction method this builds on.*Refusal in Language Models Is Mediated by a Single Direction* [Heretic](https://github.com/p-e-w/heretic)by p-e-w (Philipp Emanuel Weidmann), AGPL-3.0. The automated, KL-guarded search this refines, and the keyword metric reported here for comparison (copied verbatim, which is why this project is AGPL; see[THIRD-PARTY-NOTICES.md](/elementmerc/senbonzakura/blob/main/THIRD-PARTY-NOTICES.md)).- Maxime Labonne.\n. The tutorial that popularised the technique.*Uncensor any LLM with abliteration*\n\n**AGPL-3.0-or-later.** See [LICENSE](/elementmerc/senbonzakura/blob/main/LICENSE). Senbonzakura is copyleft because it embeds a\nkeyword metric copied verbatim from [Heretic](https://github.com/p-e-w/heretic) (AGPL-3.0); see\n[THIRD-PARTY-NOTICES.md](/elementmerc/senbonzakura/blob/main/THIRD-PARTY-NOTICES.md).", "url": "https://wpnews.pro/news/show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models", "canonical_source": "https://github.com/elementmerc/senbonzakura", "published_at": "2026-07-17 10:05:57+00:00", "updated_at": "2026-07-17 10:21:20.170245+00:00", "lang": "en", "topics": ["ai-safety", "ai-ethics", "ai-research", "ai-tools", "large-language-models"], "entities": ["Senbonzakura", "Qwen3-4B", "Arditi et al.", "Heretic", "Optuna", "Qwen3-1.7B"], "alternates": {"html": "https://wpnews.pro/news/show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models", "markdown": "https://wpnews.pro/news/show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models.md", "text": "https://wpnews.pro/news/show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models.txt", "jsonld": "https://wpnews.pro/news/show-hn-senbonzakura-remove-the-safety-guardrails-from-open-ai-models.jsonld"}}