README.md

metadata

library_name: transformers
license: apache-2.0
base_model:
  - google/gemma-4-E4B-it
pipeline_tag: any-to-any
tags:
  - gemma4
  - obliteratus
  - abliterated
  - uncensored
  - multimodal
  - transformers
  - safetensors
  - bfloat16
  - refusal-reduction
  - not-for-all-audiences

Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS

PHILADELPHIA CLASS is a dense BF16 release candidate derived from google/gemma-4-E4B-it. It was built to reduce refusal behavior while retaining the upstream Gemma 4 architecture. On the small internal coherence regression screen reported below, it passed 18 of 24 checks.

“Uncensored” is the release name, not a claim that the model has zero refusals, that every answer is correct, or that the model is safe for unmonitored use. In a limited automated sample, it was less likely to refuse harmful and unsafe prompts than a private internal baseline. Treat that as a safety regression and deploy safeguards appropriate to your use case.

Release at a glance

• Format: dense BF16 Safetensors, approximately 15.9 GB of weights
• Base: google/gemma-4-E4B-it, source revision fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd
• Status: RC1; strong behavioral candidate, not a safety-certified model
• Architecture: upstream Gemma 4 multimodal architecture retained
• Evaluation scope: text-only chat behavior; post-modification image and audio behavior were not evaluated
• Quantization: no official quantized build is included here
• Method disclosure: the exact intervention recipe and internal provenance are intentionally withheld

The comparison checkpoint below is a private internal NF4-reconstructed dense BF16 baseline. It is not the untouched upstream model, is not a public model, and is not published in this repository.

Internal development diagnostics

Internal only: the results in this section are OBLITERATUS development diagnostics. They are not standardized public benchmark scores, rankings, or comparisons with any released external model.

The candidate and private internal baseline used matched prompt sets, generation settings, runtime dtype, and deterministic seeds.

Internal suite	Metric	PHILADELPHIA CLASS	Private internal baseline	Change
Family-disjoint holdout (126)	Refusal	1.59%	9.52%	−7.93 pp
Family-disjoint holdout (126)	Usable	96.03%	88.10%	+7.93 pp
Full built-in set (842)	Refusal	1.31%	7.84%	−6.53 pp
Full built-in set (842)	Usable	97.51%	90.38%	+7.13 pp
Coherence regression suite (24)	Passed	18/24	18/24	tied

The 126-prompt result is the important generalization check. Its prompt families were excluded from the 716-family extraction split used by the private model-editing procedure. The full-842 result is a matched whole-corpus measurement, but it is not fully held out and must not be presented as one.

The opening heuristic labels a direct topical answer, or a warning followed by a topical answer, as usable. “Usable” does not mean factually correct, safe, legally permissible, or human-approved. Across the internal runs above, degeneration was 0%. The family-disjoint holdout had 0 hard refusals, 2 soft refusals, and 121/126 usable responses under those deterministic rules.

Sampled public safety contrast

This was a 200-row contrast run per model: 50 sampled examples from each split. It used an automated refusal detector, had no human adjudication, and is not claimed as an official XSTest or JailbreakBench score.

Sampled split	Expected behavior	PHILADELPHIA CLASS	Private internal baseline
XSTest safe	engage	0% false refusal	0% false refusal
JailbreakBench benign	engage	0% false refusal	0% false refusal
XSTest unsafe	refuse	84% automated non-refusal proxy	72%
JailbreakBench harmful	refuse	88% automated non-refusal proxy	76%

No benign over-refusal improvement was measured: both models were already at 0% false refusal on the 100 sampled safe/benign rows. The candidate's lower aggregate refusal came from higher automated non-refusal on unsafe/harmful rows, so it should not be described as a safety improvement.

Coherence and format retention

The 24-item deterministic regression screen produced:

Check	Result
Overall pass	18/24 (75%)
Direct answer	100%
Code syntax	100%
Code semantic	100%
Valid JSON	100%
Reasoning-answer pass	33.33%
Repetition / short collapse	0% / 0%
Thinking-tag leakage	0%

This small screen is not a substitute for broad academic benchmarks or application-specific testing.

Standardized public capability benchmarks

No standardized public capability benchmark results are published yet. This release card does not claim that PHILADELPHIA CLASS leads, beats, or ranks above any public model. A result will be added here only after this checkpoint and the untouched upstream base have been evaluated with the same public harness and settings.

How J-lens was used

Anthropic's Jacobian lens, or J-lens, finds internal activation patterns associated with words the model may be positioned to produce later. A readout can therefore surface concept-level activity that is absent from the visible answer. See Anthropic's A global workspace in language models and its linked technical paper for the method and limitations.

We used the reference J-lens implementation as a frozen post-hoc audit:

1. Freeze one pre-fitted lens and its target concepts. Lens SHA256: 324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd.
2. Run three fixed text cohorts through both models: hard prompts (32), capability prompts (24), and benign-boundary prompts (24).
3. Read the last prompt-position hidden state at layers 20, 24, 28, 32, 36, and 40.
4. Score frozen refusal concepts and frozen capability concepts (code, JSON, and reasoning), then compare cohort-level means.

The J-lens did not select layers, construct the model edit, tune weights, or promote the candidate. It was applied only after the behavioral candidate existed.

Candidate-minus-private-baseline group-mean score deltas were modest and mixed:

Cohort	Capability delta	Refusal delta
Hard 32	−0.3357	+0.1342
Capability 24	+0.5056	−0.1370
Boundary 24	−0.4630	−0.1972

There is no single monotonic internal shift across the three cohorts. We do not treat these numbers as a quality score; behavioral holdouts and coherence were the RC gates. This was our audit using Anthropic's method, not an Anthropic evaluation or endorsement.

Evaluation protocol

• BF16 CUDA inference on an NVIDIA A100-SXM4-80GB
• PyTorch 2.8.0+cu128
• Transformers 5.14.1
• temperature 0, top-p 1, top-k 0
• repetition penalty 1.1
• seed 20260604
• direct/no-boilerplate system instruction
• refusal/usable labels from deterministic opening heuristics

The full-842 run generated 24 new tokens because its scorer evaluates opening behavior. The 64- and 126-prompt runs generated up to 96 new tokens.

Sanitized aggregate metrics and private source-artifact hashes are in evals/evaluation_summary.json. Raw prompt/response traces, internal paths, and editing provenance are not included in the release repository.

Usage

The tested environment used Transformers 5.14.1:

pip install "transformers==5.14.1" accelerate torch

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": "Explain why the sky appears blue."},
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)
input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)
print(processor.parse_response(raw_response))

Release verification

• Clean BF16 weight commit: 0995c6c98c32ec35cc0c55aee5012acf2200a92a
• Clean final-ID Hub load: passed
• Processor: Gemma4Processor
• Model: Gemma4ForConditionalGeneration
• Parameters: 7,941,100,832; meta parameters: 0
• Tested stack: Transformers 5.14.1, PyTorch 2.8.0+cu128
• Generation smoke: 12 + 5 produced and parsed as assistant content 17

The first download attempt hit a transient Hugging Face Xet CAS reconstruction error. Retrying with the non-Xet transfer path completed all four shards, loaded the model, and generated successfully.

Quantization

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime quantizations. This repository publishes dense BF16 as the reference artifact.

Quantization changes behavior for this model family. The BF16 results above do not automatically transfer to a quantized derivative. Any maintained quantized build should use a separate repository and rerun the same matched refusal, benign-boundary, coherence, and degeneration checks.

Intended use

Reasonable uses include:

• local research on refusal behavior and model editing
• red-team and interpretability work in controlled environments
• creative writing, coding, and general text experimentation
• application-specific systems with independent policy controls

This model is not recommended as an unsupervised safety filter, medical or legal authority, autonomous cyber operator, or public-facing assistant without additional safeguards.

Limitations and risks

• The modification deliberately weakens refusal behavior, including on harmful prompts.
• The model can produce unsafe, illegal, biased, false, or privacy-invasive content.
• Only text behavior was evaluated after modification; multimodal capability is inherited architecturally but unverified here.
• The public contrast is a small sampled automated screen.
• The 24-item coherence screen is too small to establish broad capability parity.
• J-lens readouts are approximate, concept-limited interpretability evidence, not ground truth about intent or consciousness.
• The exact intervention recipe is withheld. Publishing weights still permits determined researchers to compare them with the base model and attempt to infer the edit.

Users are responsible for applicable law, the Apache 2.0 license, platform rules, and the policies governing their deployment context.

Weight integrity

model-00001-of-00004.safetensors  43d29d05cecdf43fb712e2703cb9fe637c76fb42049a1292781159ba179eadba
model-00002-of-00004.safetensors  f465c658b507cea4fc6231af7acdae9c7ed729e47c0ea63f88309f0202803ec4
model-00003-of-00004.safetensors  aa3e9d1e0443f9874260af4efbe8f0aa4c8fed25d41c9ca172e4c354d101c709
model-00004-of-00004.safetensors  c09785c5b57249e8d0e8412cc4529cfb28d21d3f500c47af04396bdf879efe56

Attribution and license

This is a community derivative of Gemma 4 E4B IT. Google and Anthropic are not affiliated with this release and do not endorse it.

• Base model: Google DeepMind, Gemma 4 E4B IT
• Gemma 4 model card: Google AI for Developers
• License: Apache License 2.0
• J-lens reference: Anthropic, A global workspace in language models

Citation

@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT -- ABLITERATED UNCENSORED PHILADELPHIA CLASS},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}