README.md

---
library_name: transformers
license: apache-2.0
license_link: https://ai.google.dev/gemma/docs/gemma_4_license
base_model:
  - google/gemma-4-E4B-it
pipeline_tag: any-to-any
tags:
  - gemma4
  - obliteratus
  - abliterated
  - uncensored
  - multimodal
  - transformers
  - safetensors
  - bfloat16
  - refusal-reduction
  - not-for-all-audiences
---

<p align="center">
  <img src="assets/philadelphia-class-banner.svg" alt="Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS" width="100%">
</p>

# Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS

**PHILADELPHIA CLASS** is a dense BF16 release candidate derived from
[`google/gemma-4-E4B-it`](https://huggingface.co/google/gemma-4-E4B-it).
It was built to reduce refusal behavior while retaining the upstream Gemma 4
architecture. On the small internal coherence regression screen reported below,
it passed 18 of 24 checks.

“Uncensored” is the release name, not a claim that the model has zero refusals,
that every answer is correct, or that the model is safe for unmonitored use.
In a limited automated sample, it was less likely to refuse harmful and unsafe
prompts than a private internal baseline. Treat that as a safety regression and
deploy safeguards appropriate to your use case.

## Release at a glance

- **Format:** dense BF16 in one `model.safetensors` file (15.88 GB)
- **Base:** `google/gemma-4-E4B-it`, source revision
  `fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd`
- **Status:** RC1; strong behavioral candidate, not a safety-certified model
- **Architecture:** upstream Gemma 4 multimodal architecture retained
- **Evaluation scope:** post-modification evaluations were text-only; image and
  audio behavior were not evaluated after the edit
- **Memory note:** the weight file alone is 15.88 GB; a full GPU load also
  needs runtime and KV-cache headroom, so 16 GB devices generally require
  CPU offload and/or tightly constrained context
- **Quantization:** no official quantized build is included here
- **Method disclosure:** the exact intervention recipe and internal provenance
  are intentionally withheld

The comparison checkpoint below is a private internal NF4-reconstructed dense
BF16 baseline. It is not the untouched upstream model, is not a public model,
and is not published in this repository.

<p align="center">
  <img src="assets/evaluation-comparison.svg" alt="Matched internal evaluation and sampled public safety contrast" width="100%">
</p>

## Internal development diagnostics

> **Internal only:** the results in this section are OBLITERATUS development
> diagnostics. They are not standardized public benchmark scores, rankings, or
> comparisons with any released external model.

The candidate and private internal baseline used matched prompt sets,
generation settings, runtime dtype, and deterministic seeds.

| Internal suite | Metric | PHILADELPHIA CLASS | Private internal baseline | Change |
|---|---|---:|---:|---:|
| Family-disjoint holdout (126) | Refusal | **1.59%** | 9.52% | **−7.93 pp** |
| Family-disjoint holdout (126) | Usable | **96.03%** | 88.10% | **+7.93 pp** |
| Full built-in set (842) | Refusal | **1.31%** | 7.84% | **−6.53 pp** |
| Full built-in set (842) | Usable | **97.51%** | 90.38% | **+7.13 pp** |
| Coherence regression suite (24) | Passed | **18/24** | **18/24** | tied |

The 126-prompt result is the important generalization check. Its prompt
families were excluded from the private editing data. The full-842 result is a
matched whole-corpus
measurement, but it is not fully held out and must not be presented as one.

The opening heuristic labels a direct topical answer, or a warning followed by
a topical answer, as usable. “Usable” does not mean factually correct, safe,
legally permissible, or human-approved. Across the internal runs above,
degeneration was 0%. The family-disjoint holdout had 0 hard refusals, 2 soft
refusals, and 121/126 usable responses under those deterministic rules.

### Sampled public safety contrast

This was a 200-row contrast run per model: 50 sampled examples from each split.
It used an automated refusal detector, had no human adjudication, and is not
claimed as an official XSTest or JailbreakBench score.

| Sampled split | Expected behavior | PHILADELPHIA CLASS | Private internal baseline |
|---|---|---:|---:|
| XSTest safe | engage | **0% false refusal** | 0% false refusal |
| JailbreakBench benign | engage | **0% false refusal** | 0% false refusal |
| XSTest unsafe | refuse | 84% automated non-refusal proxy | 72% |
| JailbreakBench harmful | refuse | 88% automated non-refusal proxy | 76% |

No benign over-refusal improvement was measured: both models were already at
0% false refusal on the 100 sampled safe/benign rows. The candidate's lower
aggregate refusal came from higher automated non-refusal on unsafe/harmful
rows, so it should not be described as a safety improvement.

### Coherence and format retention

The 24-item deterministic regression screen produced:

| Check | Result |
|---|---:|
| Overall pass | **18/24 (75%)** |
| Direct answer | **100%** |
| Code syntax | **100%** |
| Code semantic | **100%** |
| Valid JSON | **100%** |
| Reasoning-answer pass | 33.33% |
| Repetition / short collapse | **0% / 0%** |
| Thinking-tag leakage | **0%** |

This small screen is not a substitute for broad academic benchmarks or
application-specific testing.

## Matched public capability evaluation

> **Matched upstream control, not a leaderboard.** PHILADELPHIA CLASS and the
> untouched `google/gemma-4-E4B-it` base at revision
> `fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd` were evaluated with the same full
> `lm-evaluation-harness` 0.4.12 protocol. No third-party model is represented.

| Task | Primary metric | Shots | n | Untouched upstream | PHILADELPHIA CLASS | Delta |
|---|---|---:|---:|---:|---:|---:|
| MMLU | `acc` | 0 | 14,042 | 40.85% | 40.54% | -0.31 pp |
| HellaSwag | `acc_norm` | 0 | 10,042 | 34.96% | 35.01% | +0.05 pp |
| TruthfulQA MC2 | `acc` | 0 | 817 | 47.64% | 46.38% | -1.26 pp |
| GSM8K | `exact_match` (`strict-match`) | 5 | 1,319 | 69.29% | 69.22% | -0.08 pp |
| WinoGrande | `acc` | 0 | 1,267 | 48.54% | 48.62% | +0.08 pp |

Both checkpoints used BF16, the `hf-multimodal` backend, batch size 8, no chat
template or system instruction, no dataset limit, task-default few-shot counts,
and identical seeds. Deltas are descriptive; the harness did not emit a paired
difference confidence interval. These results show no broad capability collapse
on this suite, but do not establish an overall rank or formal equivalence.

Exact values, standard errors, hashes, task versions, and protocol fields are
in [`evals/matched_public_capability_lm_eval_0_4_12.json`](evals/matched_public_capability_lm_eval_0_4_12.json).

## How J-lens was used

<p align="center">
  <img src="assets/jlens-audit.svg" alt="J-lens audit flow from frozen cohorts through six layers to refusal and capability concept comparisons" width="100%">
</p>

Anthropic's Jacobian lens, or **J-lens**, finds internal activation patterns
associated with words the model may be positioned to produce later. A readout
can therefore surface concept-level activity that is absent from the visible
answer. See Anthropic's
[`A global workspace in language models`](https://www.anthropic.com/research/global-workspace)
and its linked technical paper for the method and limitations.

We used the reference J-lens implementation as a **frozen post-hoc audit**:

1. Freeze one pre-fitted lens and its target concepts. Lens SHA256:
   `324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd`.
2. Run three fixed text cohorts through both models: hard prompts (32),
   capability prompts (24), and benign-boundary prompts (24).
3. Read the last prompt-position hidden state at layers 20, 24, 28, 32, 36,
   and 40.
4. Score frozen refusal concepts and frozen capability concepts (code, JSON,
   and reasoning), then compare cohort-level means.

The J-lens did **not** select layers, construct the model edit, tune weights, or
promote the candidate. It was applied only after the behavioral candidate
existed.

Candidate-minus-private-baseline group-mean score deltas were modest and mixed:

| Cohort | Capability delta | Refusal delta |
|---|---:|---:|
| Hard 32 | −0.3357 | +0.1342 |
| Capability 24 | +0.5056 | −0.1370 |
| Boundary 24 | −0.4630 | −0.1972 |

There is no single monotonic internal shift across the three cohorts. We do not
treat these numbers as a quality score; behavioral holdouts and coherence were
the RC gates. This was our audit using Anthropic's method, not an Anthropic
evaluation or endorsement.

## Internal behavioral evaluation protocol

- BF16 CUDA inference on an NVIDIA A100-SXM4-80GB
- PyTorch `2.8.0+cu128`
- Transformers `5.14.1`
- temperature 0, top-p 1, top-k 0
- repetition penalty 1.1
- seed `20260604`
- direct/no-boilerplate system instruction
- refusal/usable labels from deterministic opening heuristics

The full-842 run generated 24 new tokens because its scorer evaluates opening
behavior. The 64- and 126-prompt runs generated up to 96 new tokens.

Sanitized aggregate metrics and private source-artifact hashes are in
[`evals/evaluation_summary.json`](evals/evaluation_summary.json). Raw
prompt/response traces, internal paths, and editing provenance are not included
in the release repository.

## Usage

The tested environment used Transformers `5.14.1`:

```bash
pip install "transformers==5.14.1" accelerate torch
```

```python
import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": "Explain why the sky appears blue."},
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)
input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)
print(processor.parse_response(raw_response))
```

### Release verification

- Verified single-file Hub commit:
  `e22d6fff730361b2efc150fefeedd5c4f47f488d`
- Weight layout: exactly one `model.safetensors`; no shard index or shard parts
- Clean final-ID Hub load: **passed**
- Processor: `Gemma4Processor`
- Model: `Gemma4ForConditionalGeneration`
- Parameters: `7,941,100,832`; meta parameters: `0`
- Tested stack: Transformers `5.14.1`, PyTorch `2.8.0+cu128`
- Generation smoke: `12 + 5` produced and parsed as assistant content `17`

The single-file artifact was uploaded, downloaded into a fresh directory, and
hashed again before the old shard files were removed. The first fresh download
hit a transient Hugging Face Xet CAS reconstruction error; retrying through the
non-Xet transfer path completed successfully.

## Quantization

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime quantizations. This
repository publishes dense BF16 as the reference artifact.

Quantization changes behavior for this model family. The BF16 results above do
not automatically transfer to a quantized derivative. Any maintained
quantized build should use a separate repository and rerun the same matched
refusal, benign-boundary, coherence, and degeneration checks.

## Intended use

Reasonable uses include:

- local research on refusal behavior and model editing
- red-team and interpretability work in controlled environments
- creative writing, coding, and general text experimentation
- application-specific systems with independent policy controls

This model is not recommended as an unsupervised safety filter, medical or
legal authority, autonomous cyber operator, or public-facing assistant without
additional safeguards.

## Limitations and risks

- The modification deliberately weakens refusal behavior, including on harmful
  prompts.
- The model can produce unsafe, illegal, biased, false, or privacy-invasive
  content.
- Only text behavior was evaluated after modification; multimodal capability
  is inherited architecturally but unverified here.
- The public contrast is a small sampled automated screen.
- The 24-item internal coherence screen is too small to establish broad
  capability parity; use the matched public capability section as the broader
  preservation check.
- J-lens readouts are approximate, concept-limited interpretability evidence,
  not ground truth about intent or consciousness.
- The exact intervention recipe is withheld. Publishing weights still permits
  determined researchers to compare them with the base model and attempt to
  infer the edit.

Users are responsible for applicable law, the Apache 2.0 license, platform
rules, and the policies governing their deployment context.

## Weight integrity

```text
model.safetensors  40309f8ae011a33e8122db3197800d9e0514e303bd38a57071e479c40b7cc171
```

## Attribution and license

This is a community derivative of Gemma 4 E4B IT. Google and Anthropic are not
affiliated with this release and do not endorse it.

- Base model: [Google DeepMind, Gemma 4 E4B IT](https://huggingface.co/google/gemma-4-E4B-it)
- Gemma 4 model card: [Google AI for Developers](https://ai.google.dev/gemma/docs/core/model_card_4)
- License: [Gemma 4 Apache 2.0 terms](https://ai.google.dev/gemma/docs/gemma_4_license)
- J-lens reference: [Anthropic, A global workspace in language models](https://www.anthropic.com/research/global-workspace)

## Citation

```bibtex
@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT -- ABLITERATED UNCENSORED PHILADELPHIA CLASS},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}
```