Get This Tool
Senbonzakura
Pricing
- Model
- Free
Summary
Single-direction refusal ablation leaves enough of the refusal subspace intact that your model still bounces half the prompts you edited the weights to handle. Senbonzakura attacks that problem by orthogonalising multiple directions out of the weights simultaneously.
The tool identifies the activation-space directions that carry refusal behaviour in open-weight transformer models and edits them out of the weight matrices in a single pass — no gradient descent, no retraining. It extends the Arditi et al. single-direction method by automating direction search (borrowed from Heretic) and then cutting several directions at once, which the author reports moved the needle in practice where single-direction edits did not. The procedure is a one-time weight edit: you run it, you get a modified model file. There is no API, no inference server, and no managed hosting — you run it locally against your own model weights.
Bottom line: The right pick for a researcher who needs a less-censored mid-sized open-weight model for controlled experiments; the wrong pick if you need a production-safe, auditable modification pipeline with rollback, logging, or any guarantees about what else the weight edits affected.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Community Benchmarks Community
Sign in to submit a benchmarkNo community benchmarks yet. Be the first to share a real-world data point.
Pros
Sign in to edit- Multi-direction ablation targets the distributed refusal subspace simultaneously, so prompt categories that survive single-direction edits are more likely to be handled after the procedure.
- One-time weight edit with no retraining loop required, which means researchers get a modified checkpoint without provisioning GPU-hours for fine-tuning.
- Fully local and self-hosted with no API dependency, so the modified weights and the prompts used to test them never leave your own infrastructure.
- AGPL-3.0 open-source license means the full procedure is auditable and forkable, which matters when a research paper needs to cite and reproduce the exact modification method.
- Builds on documented prior work (Arditi et al., Heretic) rather than a proprietary black box, so the theoretical basis for what the tool does can be independently evaluated.
Cons
Sign in to edit- The orthogonalisation procedure edits weight matrices directly, and the project documentation does not describe a formal evaluation of which non-refusal capabilities degrade as a side effect — teams running benchmarks on edited models will need to run their own capability regression tests before drawing any conclusions about the edit's scope.
- The tool targets mid-sized open-weight models, and the repository contains no guidance or reported results for very large models; teams working at higher parameter counts will hit an undocumented wall and have no community baseline to compare against.
- With nine commits and a near-zero fork and star count at curation time, the project has no established community, no issue triage, and no maintained documentation beyond the README — teams that hit an edge case are debugging alone, and teams that need long-term maintenance assurance will move to a more established fork of the Arditi et al. tooling instead.
- There is no API surface and no programmatic hook into the editing pipeline, so any team that wants to integrate refusal ablation into a repeatable CI or model-release workflow has to wrap the tool themselves or abandon it for a library that exposes callable functions.
Community Reviews
Sign in to write a reviewNo reviews yet. Be the first to share your experience.
About
- Platforms
- Python
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- 2026-07-19T20:29:08.446Z
Best For
Who it's for
- Researchers studying model alignment
- Developers fine-tuning models for reduced refusals
- Experiments on mid-sized open-weight LLMs
What it does well
- Removing residual refusals from open-weight models
- Producing less censored model variants for research
- Exploring refusal subspaces in transformer activations
Discussion Community
Sign in to commentNo discussion yet. Sign in to start the conversation.
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeCommunity Notes & Tips Community
Sign in to contributeBe the first to contribute. General notes, observations, gotchas, and tips from people who use this tool day-to-day.
Frequently Asked Questions
- Is Senbonzakura free?
- Yes — Senbonzakura is fully free to use. There is no paid tier.
- Is Senbonzakura open source?
- Yes. Senbonzakura is open source.
- Can I self-host Senbonzakura?
- Yes. Senbonzakura supports self-hosting on your own infrastructure.
- What platforms does Senbonzakura support?
- Senbonzakura is available on: Python.
Hours Saved & ROI Stories Community
Sign in to contributeBe the first to contribute. Concrete time/cost savings, with context. e.g. "Cut my code review backlog from 4h to 45m per week."
Best Senbonzakura alternatives →
Curated lists that include this category
Senbonzakura performs what the project calls ‘multi-direction refusal abliteration’: it maps out the directions in a transformer model’s activation space that encode refusal responses, then orthogonalises those directions out of the model’s weight matrices. The result is a modified copy of the model that the author’s runs show handles previously-refused prompts more consistently than single-direction edits produce. The workflow is local and offline — point the tool at a model checkpoint, run the procedure, receive an edited checkpoint.
The differentiating design choice is the multi-direction cut. The foundational Arditi et al. (2024) paper demonstrated that refusal in transformers is concentrated along a single dominant direction in activation space. Senbonzakura’s position, grounded in the author’s own experimental runs, is that residual refusal survives single-direction ablation because the behaviour is distributed across several directions, not one. By automating direction search via the Heretic approach and then ablating the set of found directions simultaneously, the tool targets what the author describes as the full ‘thousand blades’ of the refusal subspace.
The tool fits squarely in a research and experimentation context: alignment researchers studying refusal mechanisms, developers producing less-censored variants of open-weight models for controlled evaluation, and anyone exploring what refusal looks like geometrically inside transformer activations. It does not fit production pipelines that require auditability, reversibility, or any guarantee that weight edits are scoped only to refusal behaviour — the orthogonalisation procedure touches weight matrices, and the docs do not describe a formal analysis of collateral effects on unrelated model capabilities.
Senbonzakura is released under the AGPL-3.0 license, is self-hosted only, and carries no API surface or commercial tier. It is a Python package (see pyproject.toml) targeting mid-sized open-weight LLMs; the repository is early-stage with nine commits at the time of curation and a fork/star count that reflects pre-community-adoption status.