README.md

---
library_name: transformers
license: apache-2.0
base_model:
  - google/gemma-4-E4B-it
pipeline_tag: any-to-any
tags:
  - gemma4
  - obliteratus
  - abliterated
  - uncensored
  - multimodal
  - transformers
  - safetensors
  - bfloat16
  - refusal-reduction
  - not-for-all-audiences
---

<p align="center">
  <img src="assets/philadelphia-class-banner.svg" alt="Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS" width="100%">
</p>

# Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS

**PHILADELPHIA CLASS** is a dense BF16 release candidate derived from
[`google/gemma-4-E4B-it`](https://huggingface.co/google/gemma-4-E4B-it).
It was built to reduce refusal behavior while retaining the upstream Gemma 4
architecture. On the small internal coherence regression screen reported below,
it passed 18 of 24 checks.

“Uncensored” is the release name, not a claim that the model has zero refusals,
that every answer is correct, or that the model is safe for unmonitored use.
In a limited automated sample, it was less likely to refuse harmful and unsafe
prompts than a private internal baseline. Treat that as a safety regression and
deploy safeguards appropriate to your use case.

## Release at a glance

- **Format:** dense BF16 Safetensors, approximately 15.9 GB of weights
- **Base:** `google/gemma-4-E4B-it`, source revision
  `fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd`
- **Status:** RC1; strong behavioral candidate, not a safety-certified model
- **Architecture:** upstream Gemma 4 multimodal architecture retained
- **Evaluation scope:** text-only chat behavior; post-modification image and
  audio behavior were not evaluated
- **Quantization:** no official quantized build is included here
- **Method disclosure:** the exact intervention recipe and internal provenance
  are intentionally withheld

The comparison checkpoint below is a private internal NF4-reconstructed dense
BF16 baseline. It is not the untouched upstream model, is not a public model,
and is not published in this repository.

<p align="center">
  <img src="assets/evaluation-comparison.svg" alt="Matched internal evaluation and sampled public safety contrast" width="100%">
</p>

## Internal development diagnostics

> **Internal only:** the results in this section are OBLITERATUS development
> diagnostics. They are not standardized public benchmark scores, rankings, or
> comparisons with any released external model.

The candidate and private internal baseline used matched prompt sets,
generation settings, runtime dtype, and deterministic seeds.

| Internal suite | Metric | PHILADELPHIA CLASS | Private internal baseline | Change |
|---|---|---:|---:|---:|
| Family-disjoint holdout (126) | Refusal | **1.59%** | 9.52% | **−7.93 pp** |
| Family-disjoint holdout (126) | Usable | **96.03%** | 88.10% | **+7.93 pp** |
| Full built-in set (842) | Refusal | **1.31%** | 7.84% | **−6.53 pp** |
| Full built-in set (842) | Usable | **97.51%** | 90.38% | **+7.13 pp** |
| Coherence regression suite (24) | Passed | **18/24** | **18/24** | tied |

The 126-prompt result is the important generalization check. Its prompt
families were excluded from the 716-family extraction split used by the private
model-editing procedure. The full-842 result is a matched whole-corpus
measurement, but it is not fully held out and must not be presented as one.

The opening heuristic labels a direct topical answer, or a warning followed by
a topical answer, as usable. “Usable” does not mean factually correct, safe,
legally permissible, or human-approved. Across the internal runs above,
degeneration was 0%. The family-disjoint holdout had 0 hard refusals, 2 soft
refusals, and 121/126 usable responses under those deterministic rules.

### Sampled public safety contrast

This was a 200-row contrast run per model: 50 sampled examples from each split.
It used an automated refusal detector, had no human adjudication, and is not
claimed as an official XSTest or JailbreakBench score.

| Sampled split | Expected behavior | PHILADELPHIA CLASS | Private internal baseline |
|---|---|---:|---:|
| XSTest safe | engage | **0% false refusal** | 0% false refusal |
| JailbreakBench benign | engage | **0% false refusal** | 0% false refusal |
| XSTest unsafe | refuse | 84% automated non-refusal proxy | 72% |
| JailbreakBench harmful | refuse | 88% automated non-refusal proxy | 76% |

No benign over-refusal improvement was measured: both models were already at
0% false refusal on the 100 sampled safe/benign rows. The candidate's lower
aggregate refusal came from higher automated non-refusal on unsafe/harmful
rows, so it should not be described as a safety improvement.

### Coherence and format retention

The 24-item deterministic regression screen produced:

| Check | Result |
|---|---:|
| Overall pass | **18/24 (75%)** |
| Direct answer | **100%** |
| Code syntax | **100%** |
| Code semantic | **100%** |
| Valid JSON | **100%** |
| Reasoning-answer pass | 33.33% |
| Repetition / short collapse | **0% / 0%** |
| Thinking-tag leakage | **0%** |

This small screen is not a substitute for broad academic benchmarks or
application-specific testing.

## Standardized public capability benchmarks

No standardized public capability benchmark results are published yet. This
release card does **not** claim that PHILADELPHIA CLASS leads, beats, or ranks
above any public model. A result will be added here only after this checkpoint
and the untouched upstream base have been evaluated with the same public
harness and settings.

## How J-lens was used

<p align="center">
  <img src="assets/jlens-audit.svg" alt="J-lens audit flow from frozen cohorts through six layers to refusal and capability concept comparisons" width="100%">
</p>

Anthropic's Jacobian lens, or **J-lens**, finds internal activation patterns
associated with words the model may be positioned to produce later. A readout
can therefore surface concept-level activity that is absent from the visible
answer. See Anthropic's
[`A global workspace in language models`](https://www.anthropic.com/research/global-workspace)
and its linked technical paper for the method and limitations.

We used the reference J-lens implementation as a **frozen post-hoc audit**:

1. Freeze one pre-fitted lens and its target concepts. Lens SHA256:
   `324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd`.
2. Run three fixed text cohorts through both models: hard prompts (32),
   capability prompts (24), and benign-boundary prompts (24).
3. Read the last prompt-position hidden state at layers 20, 24, 28, 32, 36,
   and 40.
4. Score frozen refusal concepts and frozen capability concepts (code, JSON,
   and reasoning), then compare cohort-level means.

The J-lens did **not** select layers, construct the model edit, tune weights, or
promote the candidate. It was applied only after the behavioral candidate
existed.

Candidate-minus-private-baseline group-mean score deltas were modest and mixed:

| Cohort | Capability delta | Refusal delta |
|---|---:|---:|
| Hard 32 | −0.3357 | +0.1342 |
| Capability 24 | +0.5056 | −0.1370 |
| Boundary 24 | −0.4630 | −0.1972 |

There is no single monotonic internal shift across the three cohorts. We do not
treat these numbers as a quality score; behavioral holdouts and coherence were
the RC gates. This was our audit using Anthropic's method, not an Anthropic
evaluation or endorsement.

## Evaluation protocol

- BF16 CUDA inference on an NVIDIA A100-SXM4-80GB
- PyTorch `2.8.0+cu128`
- Transformers `5.14.1`
- temperature 0, top-p 1, top-k 0
- repetition penalty 1.1
- seed `20260604`
- direct/no-boilerplate system instruction
- refusal/usable labels from deterministic opening heuristics

The full-842 run generated 24 new tokens because its scorer evaluates opening
behavior. The 64- and 126-prompt runs generated up to 96 new tokens.

Sanitized aggregate metrics and private source-artifact hashes are in
[`evals/evaluation_summary.json`](evals/evaluation_summary.json). Raw
prompt/response traces, internal paths, and editing provenance are not included
in the release repository.

## Usage

The tested environment used Transformers `5.14.1`:

```bash
pip install "transformers==5.14.1" accelerate torch
```

```python
import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": "Explain why the sky appears blue."},
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)
input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)
print(processor.parse_response(raw_response))
```

### Release verification

- Clean BF16 weight commit:
  `0995c6c98c32ec35cc0c55aee5012acf2200a92a`
- Clean final-ID Hub load: **passed**
- Processor: `Gemma4Processor`
- Model: `Gemma4ForConditionalGeneration`
- Parameters: `7,941,100,832`; meta parameters: `0`
- Tested stack: Transformers `5.14.1`, PyTorch `2.8.0+cu128`
- Generation smoke: `12 + 5` produced and parsed as assistant content `17`

The first download attempt hit a transient Hugging Face Xet CAS reconstruction
error. Retrying with the non-Xet transfer path completed all four shards, loaded
the model, and generated successfully.

## Quantization

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime quantizations. This
repository publishes dense BF16 as the reference artifact.

Quantization changes behavior for this model family. The BF16 results above do
not automatically transfer to a quantized derivative. Any maintained
quantized build should use a separate repository and rerun the same matched
refusal, benign-boundary, coherence, and degeneration checks.

## Intended use

Reasonable uses include:

- local research on refusal behavior and model editing
- red-team and interpretability work in controlled environments
- creative writing, coding, and general text experimentation
- application-specific systems with independent policy controls

This model is not recommended as an unsupervised safety filter, medical or
legal authority, autonomous cyber operator, or public-facing assistant without
additional safeguards.

## Limitations and risks

- The modification deliberately weakens refusal behavior, including on harmful
  prompts.
- The model can produce unsafe, illegal, biased, false, or privacy-invasive
  content.
- Only text behavior was evaluated after modification; multimodal capability
  is inherited architecturally but unverified here.
- The public contrast is a small sampled automated screen.
- The 24-item coherence screen is too small to establish broad capability
  parity.
- J-lens readouts are approximate, concept-limited interpretability evidence,
  not ground truth about intent or consciousness.
- The exact intervention recipe is withheld. Publishing weights still permits
  determined researchers to compare them with the base model and attempt to
  infer the edit.

Users are responsible for applicable law, the Apache 2.0 license, platform
rules, and the policies governing their deployment context.

## Weight integrity

```text
model-00001-of-00004.safetensors  43d29d05cecdf43fb712e2703cb9fe637c76fb42049a1292781159ba179eadba
model-00002-of-00004.safetensors  f465c658b507cea4fc6231af7acdae9c7ed729e47c0ea63f88309f0202803ec4
model-00003-of-00004.safetensors  aa3e9d1e0443f9874260af4efbe8f0aa4c8fed25d41c9ca172e4c354d101c709
model-00004-of-00004.safetensors  c09785c5b57249e8d0e8412cc4529cfb28d21d3f500c47af04396bdf879efe56
```

## Attribution and license

This is a community derivative of Gemma 4 E4B IT. Google and Anthropic are not
affiliated with this release and do not endorse it.

- Base model: [Google DeepMind, Gemma 4 E4B IT](https://huggingface.co/google/gemma-4-E4B-it)
- Gemma 4 model card: [Google AI for Developers](https://ai.google.dev/gemma/docs/core/model_card_4)
- License: [Apache License 2.0](https://ai.google.dev/gemma/apache_2)
- J-lens reference: [Anthropic, A global workspace in language models](https://www.anthropic.com/research/global-workspace)

## Citation

```bibtex
@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT -- ABLITERATED UNCENSORED PHILADELPHIA CLASS},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}
```