Show HN: Senbonzakura – remove the safety guardrails from open AI models A developer released Senbonzakura, an open-source tool that removes safety guardrails from open-weight AI models by orthogonalizing multiple refusal directions in activation space, building on prior research. The tool achieves zero hard refusals on Qwen3-4B with minimal coherence loss, raising concerns about the potential for misuse of uncensored models. Multi-direction refusal abliteration for transformer language models. Senbonzakura removes the refusal behaviour from an open-weight language model by finding the directions in its activation space that carry "I can't help with that" and orthogonalising them out of the weights. It builds on the single-direction method of Arditi et al. and the automated search of Heretic, and adds the one thing that moved the needle in my own runs: cutting in several directions at once , not just one. Named for Byakuya Kuchiki's zanpakutō, the sword that scatters into a thousand blades. Refusal is not one blade. It's many. The original finding Arditi et al., 2024 https://arxiv.org/abs/2406.11717 is that refusal is mostly one direction. Mostly. The last stubborn few percent lives in a small handful of nearby directions the single-arrow method never sees. Account for a refusal subspace instead of a single vector and the residual refusals fall the rest of the way, without the model losing its coherence. The clearest measurement is on Qwen3-4B, over a 290-prompt evaluation scored with the same ruler: | Configuration | Hard refusal | Strict Heretic keyword | Broken | Coherence PPL, base 12.97 | |---|---|---|---|---| | Stock, uncut | 7.9% | 63.8% | 0.0% | 12.97 | | Single direction | 2.1% | 36.6% | 0.0% | 12.97 | Senbonzakura multi-direction | 0.0% | 20.0% | 0.0% | 13.29 | Single-direction leaves better than a third of the strict count standing. Multi-direction cuts it to a fifth and drives hard refusal to zero, with no broken output. Coherence stays essentially level with the base model: single-direction is identical to stock, multi about two percent higher, both inside run-to-run noise. That advantage may grow with model size, but two points is not a trend I'd bet on. On the smaller Qwen3-1.7B, under the same corrected code, single and multi roughly tie both clear the strict count to around eight percent ; the extra directions buy little there, and clearly separate only at 4B. Two model sizes at one seed each is suggestive, not an established scaling law: it could be a real trend a bigger model spreading refusal across more directions or per-model variance, and more sizes and repeated seeds would be needed to tell. Extract the refusal subspace. For a few hundred harmful and harmless prompts, record the last-token residual at every layer. The difference of means harmful minus harmless , good-orthogonalised, is the primary refusal direction; up to K-1 further axes come from a PCA of the harmful residual cloud. Together they span the refusal subspace at each layer. Search Optuna . An NSGA-II search over which layers to cut, how strongly, how many directions, and per-layer directions versus a single interpolated one, maps the whole refusals-versus-coherence frontier. Each trial applies the real norm-preserving weight bake and restores from a pristine snapshot, so the search scores the exact model it will save, with no proxy gap. Coherence is protected directly by a KL-divergence term against the original model on harmless prompts. Bake. For the winning configuration, orthogonalise the refusal span out of every residual-writing weight each attention output projection and each MLP down-projection, including the fused expert tensors of mixture-of-experts models so the change is permanent. Save. The result is a model that has lost the machinery of refusal, not one that has been told to ignore it. pip install . or: uv pip install . torch, transformers, accelerate, datasets, optuna senbonzakura --help console command; equivalently: python -m senbonzakura --help To score a large model on a low-VRAM card, pip install ". quant " adds 4-bit bitsandbytes loading for the scorer : python -m senbonzakura.score --load-in-4bit . The abliterator itself runs in full precision, because it rewrites weights and 4-bit tensors can't be orthogonalised in place, so --load-in-4bit is a measurement option, not an abliteration one. A man page is installed to share/man/man1/senbonzakura.1 . Shell completion for bash, zsh, and tcsh is generated on demand the same one time step pip , gh , and poetry use : senbonzakura --print-completion bash | sudo tee /etc/bash completion.d/senbonzakura , or the zsh/tcsh equivalent for your shell. Supported architectures: dense transformers Llama, Qwen, Mistral, Gemma, Phi and the like , fused-expert MoE Qwen3-MoE, Granite-MoE , Mixtral fused or unfused , OLMoE, and shared-expert MoE Qwen2-MoE, DeepSeek-MoE . An unsupported layout fails loudly at load rather than silently under-ablating. The fast path, if you just want the best result and no knob-twiddling: senbonzakura kageyoshi --model