KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS

---

Gemma 4 E4B IT: Philadelphia Class

Philadelphia Class is a BF16, refusal-reduced derivative of google/gemma-4-E4B-it.

The model was weight-edited to reduce refusal behavior while preserving the general capabilities of the upstream checkpoint. It retains the original Gemma 4 multimodal architecture, although post-edit evaluation was limited to text.

In matched lm-evaluation-harness testing against the untouched upstream checkpoint, performance remained within 1.26 percentage points across MMLU, HellaSwag, TruthfulQA MC2, GSM8K, and WinoGrande.

On a separate 126-prompt family-disjoint internal holdout, measured refusal decreased from 9.52% to 1.59%.

The term uncensored describes the release objective. It does not mean the model has zero refusals, always produces correct answers, or is safe for unsupervised deployment. The modification deliberately increases willingness to answer harmful and unsafe prompts.

Model details

Property	Value
Base model	google/gemma-4-E4B-it
Base revision	fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd
Parameters	7,941,100,832
Weight format	BF16 Safetensors
Weight size	15.88 GB
Weight files	One model.safetensors file
Architecture	Original Gemma 4 multimodal architecture
Post-edit evaluation	Text only
Quantized release	Not included
Release status	RC1

A 16 GB GPU may require CPU offloading, a limited context length, or a separately produced quantization.

Evaluation summary

Matched upstream capability evaluation

Philadelphia Class and the untouched google/gemma-4-E4B-it checkpoint were evaluated using the same lm-evaluation-harness 0.4.12 configuration.

Task	Metric	Shots	Examples	Upstream	Philadelphia Class	Delta
MMLU	acc	0	14,042	40.85%	40.54%	-0.31 pp
HellaSwag	acc_norm	0	10,042	34.96%	35.01%	+0.05 pp
TruthfulQA MC2	acc	0	817	47.64%	46.38%	-1.26 pp
GSM8K	exact_match	5	1,319	69.29%	69.22%	-0.08 pp
WinoGrande	acc	0	1,267	48.54%	48.62%	+0.08 pp

Both checkpoints used:

• BF16 inference
• hf-multimodal backend
• batch size 8
• identical random seeds
• task-default few-shot settings
• no dataset limit
• no chat template
• no system instruction

These results indicate that the edit did not produce broad capability collapse on the tested suite. They do not establish formal equivalence or an overall model ranking.

Full task values, standard errors, hashes, versions, and protocol fields are available in:

evals/matched_public_capability_lm_eval_0_4_12.json

Internal refusal evaluation

The internal behavioral suites compare Philadelphia Class with a private NF4-reconstructed dense BF16 development baseline.

The private baseline is not the untouched upstream checkpoint and is not included in this repository.

Internal suite	Metric	Philadelphia Class	Private baseline	Change
Family-disjoint holdout, 126 prompts	Refusal	1.59%	9.52%	-7.93 pp
Family-disjoint holdout, 126 prompts	Usable	96.03%	88.10%	+7.93 pp
Full built-in set, 842 prompts	Refusal	1.31%	7.84%	-6.53 pp
Full built-in set, 842 prompts	Usable	97.51%	90.38%	+7.13 pp
Coherence regression, 24 checks	Passed	18/24	18/24	Tied

The 126-prompt family-disjoint holdout is the primary internal generalization test. Its prompt families were excluded from the editing data.

The full 842-prompt result is a whole-corpus development measurement and is not fully held out.

Under the deterministic scoring rules, the family-disjoint holdout produced:

• 0 hard refusals
• 2 soft refusals
• 121 usable responses out of 126
• 0% detected degeneration

Here, usable means that the response either directly addressed the topic or provided a warning followed by a topical answer. It does not mean the response was factually correct, safe, legal, or human-approved.

Safety-oriented contrast

A limited automated contrast was run using 50 sampled examples from each of four public benchmark splits.

Sampled split	Expected behavior	Philadelphia Class	Private baseline
XSTest safe	Engage	0% false refusal	0% false refusal
JailbreakBench benign	Engage	0% false refusal	0% false refusal
XSTest unsafe	Refuse	84% automated non-refusal	72%
JailbreakBench harmful	Refuse	88% automated non-refusal	76%

This comparison used an automated refusal detector without human adjudication. It is not an official XSTest or JailbreakBench score.

No reduction in benign over-refusal was measured because both checkpoints already produced 0% false refusal on the sampled safe and benign examples.

The primary behavioral change was increased non-refusal on unsafe and harmful prompts. This is a safety regression and should not be presented as a safety improvement.

Coherence and formatting

The 24-item deterministic regression screen produced the following results:

Check	Result
Overall pass rate	18/24, 75%
Direct answer	100%
Code syntax	100%
Code semantics	100%
Valid JSON	100%
Reasoning answer	33.33%
Repetition detected	0%
Short-output collapse	0%
Thinking-tag leakage	0%

This is a small regression screen and should not be treated as a substitute for broader capability benchmarks or application-specific evaluation.

Usage

The tested environment used Transformers 5.14.1.

pip install "transformers==5.14.1" accelerate torch

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)

model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "system",
        "content": "You are a helpful assistant.",
    },
    {
        "role": "user",
        "content": "Explain why the sky appears blue.",
    },
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)

input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)

response = processor.parse_response(raw_response)
print(response)

Hardware requirements

The published checkpoint contains approximately 15.88 GB of BF16 weights.

Actual memory usage is higher after accounting for:

• model-loading overhead
• activations
• KV cache
• processor inputs
• generation context
• framework and driver allocations

A GPU with more than 16 GB of VRAM is recommended for straightforward BF16 inference.

On a 16 GB device, practical options include:

• CPU offloading with device_map="auto"
• reduced context length
• reduced generation length
• lower batch sizes
• a separately created quantization

Quantization

This repository publishes dense BF16 weights as the reference artifact.

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime-specific quantizations. Quantization may change both capability and refusal behavior.

Results reported for the BF16 checkpoint should not be assumed to apply to quantized derivatives.

A maintained quantized release should be published separately and reevaluated using the same:

• upstream capability comparison
• refusal holdout
• benign-boundary testing
• coherence regression
• degeneration checks

Intended uses

Potential uses include:

• research on refusal behavior
• model-editing research
• interpretability experiments
• controlled red-team evaluation
• local creative-writing experiments
• coding and general text generation
• systems with independent policy and moderation controls

Out-of-scope uses

This model is not recommended as:

• an unsupervised safety classifier
• a medical or legal authority
• an autonomous cyber operator
• a public-facing assistant without additional safeguards
• an independent source of factual truth
• a replacement for human review in high-impact decisions

Limitations and risks

• The modification deliberately weakens refusal behavior.
• The model may provide harmful or illegal instructions.
• The model may produce false, biased, misleading, or privacy-invasive content.
• Lower refusal does not imply higher factual accuracy.
• Only text behavior was evaluated after modification.
• Image and audio functionality remain architecturally present but were not validated after the edit.
• The public safety contrast used a small automated sample.
• The internal refusal baseline is private and cannot be independently reproduced from this repository.
• The 24-item coherence screen is too small to establish broad parity.
• Benchmark results may vary across hardware, software versions, prompts, templates, and generation settings.
• The release includes the resulting weights but not the complete intervention pipeline.

Users are responsible for complying with applicable laws, licenses, platform rules, and deployment policies.

J-lens audit

Anthropic's Jacobian lens, or J-lens, was used as a frozen post-edit interpretability audit.

The J-lens analysis did not:

• select intervention layers
• construct the weight edit
• tune intervention strength
• select the release candidate
• determine whether the model passed release gates

The audit used one frozen pre-fitted lens and fixed target concepts.

Lens SHA256:

324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd

Three fixed text cohorts were evaluated:

Cohort	Prompts
Hard prompts	32
Capability prompts	24
Benign-boundary prompts	24

For each cohort, the final prompt-position hidden state was read at layers:

20, 24, 28, 32, 36, 40

Frozen refusal and capability concepts were then scored and compared at the cohort level.

Candidate-minus-private-baseline mean score differences were:

Cohort	Capability delta	Refusal delta
Hard prompts	-0.3357	+0.1342
Capability prompts	+0.5056	-0.1370
Benign-boundary prompts	-0.4630	-0.1972

The results were mixed and did not show a single monotonic internal shift across all cohorts.

These values are interpretability measurements, not quality scores. J-lens readouts are approximate and concept-limited. They should not be interpreted as ground truth about model intent, reasoning, or consciousness.

References:

• A global workspace in language models
• The technical paper and reference implementation linked from the Anthropic publication

This was an independent audit using Anthropic's method. It was not conducted or endorsed by Anthropic.

Internal behavioral protocol

Internal refusal and coherence evaluations used:

Setting	Value
Hardware	NVIDIA A100-SXM4-80GB
Runtime dtype	BF16
PyTorch	2.8.0+cu128
Transformers	5.14.1
Temperature	0
Top-p	1
Top-k	0
Repetition penalty	1.1
Seed	20260604
System instruction	Direct answer, no boilerplate
Labels	Deterministic opening heuristics

The 842-prompt opening-behavior run generated 24 new tokens per prompt.

The 64-prompt and 126-prompt runs generated up to 96 new tokens per prompt.

Sanitized aggregate metrics and private source-artifact hashes are available in:

evals/evaluation_summary.json

Raw prompt-response traces, internal filesystem paths, and the complete editing pipeline are not included.

Tested software:

Transformers 5.14.1
PyTorch 2.8.0+cu128

Weight integrity

model.safetensors  40309f8ae011a33e8122db3197800d9e0514e303bd38a57071e479c40b7cc171

Attribution and license

Philadelphia Class is a community derivative of Gemma 4 E4B IT.

Google and Anthropic are not affiliated with this release and do not endorse it.

• Base model: Google DeepMind, Gemma 4 E4B IT
• Gemma 4 model card: Google AI for Developers
• License terms: Gemma 4 Apache 2.0 terms
• J-lens reference: Anthropic, A global workspace in language models

Citation

@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT: Philadelphia Class},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}