README.md

metadata

library_name: transformers
license: apache-2.0
license_link: https://ai.google.dev/gemma/docs/gemma_4_license
base_model:
  - google/gemma-4-E4B-it
pipeline_tag: any-to-any
tags:
  - gemma4
  - obliteratus
  - abliterated
  - uncensored
  - multimodal
  - transformers
  - safetensors
  - bfloat16
  - refusal-reduction
  - not-for-all-audiences

Gemma 4 E4B IT — ABLITERATED UNCENSORED PHILADELPHIA CLASS

PHILADELPHIA CLASS is a dense BF16 release candidate derived from google/gemma-4-E4B-it. It was built to reduce refusal behavior while retaining the upstream Gemma 4 architecture. On the small internal coherence regression screen reported below, it passed 18 of 24 checks.

“Uncensored” is the release name, not a claim that the model has zero refusals, that every answer is correct, or that the model is safe for unmonitored use. In a limited automated sample, it was less likely to refuse harmful and unsafe prompts than a private internal baseline. Treat that as a safety regression and deploy safeguards appropriate to your use case.

Release at a glance

• Format: dense BF16 in one model.safetensors file (15.88 GB)
• Base: google/gemma-4-E4B-it, source revision fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd
• Status: RC1; strong behavioral candidate, not a safety-certified model
• Architecture: upstream Gemma 4 multimodal architecture retained
• Evaluation scope: post-modification evaluations were text-only; image and audio behavior were not evaluated after the edit
• Memory note: the weight file alone is 15.88 GB; a full GPU load also needs runtime and KV-cache headroom, so 16 GB devices generally require CPU offload and/or tightly constrained context
• Quantization: no official quantized build is included here
• Method disclosure: the exact intervention recipe and internal provenance are intentionally withheld

The comparison checkpoint below is a private internal NF4-reconstructed dense BF16 baseline. It is not the untouched upstream model, is not a public model, and is not published in this repository.

Internal development diagnostics

Internal only: the results in this section are OBLITERATUS development diagnostics. They are not standardized public benchmark scores, rankings, or comparisons with any released external model.

The candidate and private internal baseline used matched prompt sets, generation settings, runtime dtype, and deterministic seeds.

Internal suite	Metric	PHILADELPHIA CLASS	Private internal baseline	Change
Family-disjoint holdout (126)	Refusal	1.59%	9.52%	−7.93 pp
Family-disjoint holdout (126)	Usable	96.03%	88.10%	+7.93 pp
Full built-in set (842)	Refusal	1.31%	7.84%	−6.53 pp
Full built-in set (842)	Usable	97.51%	90.38%	+7.13 pp
Coherence regression suite (24)	Passed	18/24	18/24	tied

The 126-prompt result is the important generalization check. Its prompt families were excluded from the private editing data. The full-842 result is a matched whole-corpus measurement, but it is not fully held out and must not be presented as one.

The opening heuristic labels a direct topical answer, or a warning followed by a topical answer, as usable. “Usable” does not mean factually correct, safe, legally permissible, or human-approved. Across the internal runs above, degeneration was 0%. The family-disjoint holdout had 0 hard refusals, 2 soft refusals, and 121/126 usable responses under those deterministic rules.

Sampled public safety contrast

This was a 200-row contrast run per model: 50 sampled examples from each split. It used an automated refusal detector, had no human adjudication, and is not claimed as an official XSTest or JailbreakBench score.

Sampled split	Expected behavior	PHILADELPHIA CLASS	Private internal baseline
XSTest safe	engage	0% false refusal	0% false refusal
JailbreakBench benign	engage	0% false refusal	0% false refusal
XSTest unsafe	refuse	84% automated non-refusal proxy	72%
JailbreakBench harmful	refuse	88% automated non-refusal proxy	76%

No benign over-refusal improvement was measured: both models were already at 0% false refusal on the 100 sampled safe/benign rows. The candidate's lower aggregate refusal came from higher automated non-refusal on unsafe/harmful rows, so it should not be described as a safety improvement.

Coherence and format retention

The 24-item deterministic regression screen produced:

Check	Result
Overall pass	18/24 (75%)
Direct answer	100%
Code syntax	100%
Code semantic	100%
Valid JSON	100%
Reasoning-answer pass	33.33%
Repetition / short collapse	0% / 0%
Thinking-tag leakage	0%

This small screen is not a substitute for broad academic benchmarks or application-specific testing.

Matched public capability evaluation

Matched upstream control, not a leaderboard. PHILADELPHIA CLASS and the untouched google/gemma-4-E4B-it base at revision fa62d88df2e6df5efa9d26ad6b3beaea2765f0cd were evaluated with the same full lm-evaluation-harness 0.4.12 protocol. No third-party model is represented.

Task	Primary metric	Shots	n	Untouched upstream	PHILADELPHIA CLASS	Delta
MMLU	acc	0	14,042	40.85%	40.54%	-0.31 pp
HellaSwag	acc_norm	0	10,042	34.96%	35.01%	+0.05 pp
TruthfulQA MC2	acc	0	817	47.64%	46.38%	-1.26 pp
GSM8K	exact_match (strict-match)	5	1,319	69.29%	69.22%	-0.08 pp
WinoGrande	acc	0	1,267	48.54%	48.62%	+0.08 pp

Both checkpoints used BF16, the hf-multimodal backend, batch size 8, no chat template or system instruction, no dataset limit, task-default few-shot counts, and identical seeds. Deltas are descriptive; the harness did not emit a paired difference confidence interval. These results show no broad capability collapse on this suite, but do not establish an overall rank or formal equivalence.

Exact values, standard errors, hashes, task versions, and protocol fields are in evals/matched_public_capability_lm_eval_0_4_12.json.

How J-lens was used

Anthropic's Jacobian lens, or J-lens, finds internal activation patterns associated with words the model may be positioned to produce later. A readout can therefore surface concept-level activity that is absent from the visible answer. See Anthropic's A global workspace in language models and its linked technical paper for the method and limitations.

We used the reference J-lens implementation as a frozen post-hoc audit:

1. Freeze one pre-fitted lens and its target concepts. Lens SHA256: 324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd.
2. Run three fixed text cohorts through both models: hard prompts (32), capability prompts (24), and benign-boundary prompts (24).
3. Read the last prompt-position hidden state at layers 20, 24, 28, 32, 36, and 40.
4. Score frozen refusal concepts and frozen capability concepts (code, JSON, and reasoning), then compare cohort-level means.

The J-lens did not select layers, construct the model edit, tune weights, or promote the candidate. It was applied only after the behavioral candidate existed.

Candidate-minus-private-baseline group-mean score deltas were modest and mixed:

Cohort	Capability delta	Refusal delta
Hard 32	−0.3357	+0.1342
Capability 24	+0.5056	−0.1370
Boundary 24	−0.4630	−0.1972

There is no single monotonic internal shift across the three cohorts. We do not treat these numbers as a quality score; behavioral holdouts and coherence were the RC gates. This was our audit using Anthropic's method, not an Anthropic evaluation or endorsement.

Internal behavioral evaluation protocol

• BF16 CUDA inference on an NVIDIA A100-SXM4-80GB
• PyTorch 2.8.0+cu128
• Transformers 5.14.1
• temperature 0, top-p 1, top-k 0
• repetition penalty 1.1
• seed 20260604
• direct/no-boilerplate system instruction
• refusal/usable labels from deterministic opening heuristics

The full-842 run generated 24 new tokens because its scorer evaluates opening behavior. The 64- and 126-prompt runs generated up to 96 new tokens.

Sanitized aggregate metrics and private source-artifact hashes are in evals/evaluation_summary.json. Raw prompt/response traces, internal paths, and editing provenance are not included in the release repository.

Usage

The tested environment used Transformers 5.14.1:

pip install "transformers==5.14.1" accelerate torch

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": "Explain why the sky appears blue."},
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)
input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)
print(processor.parse_response(raw_response))

Release verification

• Verified single-file Hub commit: e22d6fff730361b2efc150fefeedd5c4f47f488d
• Weight layout: exactly one model.safetensors; no shard index or shard parts
• Clean final-ID Hub load: passed
• Processor: Gemma4Processor
• Model: Gemma4ForConditionalGeneration
• Parameters: 7,941,100,832; meta parameters: 0
• Tested stack: Transformers 5.14.1, PyTorch 2.8.0+cu128
• Generation smoke: 12 + 5 produced and parsed as assistant content 17

The single-file artifact was uploaded, downloaded into a fresh directory, and hashed again before the old shard files were removed. The first fresh download hit a transient Hugging Face Xet CAS reconstruction error; retrying through the non-Xet transfer path completed successfully.

Quantization

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime quantizations. This repository publishes dense BF16 as the reference artifact.

Quantization changes behavior for this model family. The BF16 results above do not automatically transfer to a quantized derivative. Any maintained quantized build should use a separate repository and rerun the same matched refusal, benign-boundary, coherence, and degeneration checks.

Intended use

Reasonable uses include:

• local research on refusal behavior and model editing
• red-team and interpretability work in controlled environments
• creative writing, coding, and general text experimentation
• application-specific systems with independent policy controls

This model is not recommended as an unsupervised safety filter, medical or legal authority, autonomous cyber operator, or public-facing assistant without additional safeguards.

Limitations and risks

• The modification deliberately weakens refusal behavior, including on harmful prompts.
• The model can produce unsafe, illegal, biased, false, or privacy-invasive content.
• Only text behavior was evaluated after modification; multimodal capability is inherited architecturally but unverified here.
• The public contrast is a small sampled automated screen.
• The 24-item internal coherence screen is too small to establish broad capability parity; use the matched public capability section as the broader preservation check.
• J-lens readouts are approximate, concept-limited interpretability evidence, not ground truth about intent or consciousness.
• The exact intervention recipe is withheld. Publishing weights still permits determined researchers to compare them with the base model and attempt to infer the edit.

Users are responsible for applicable law, the Apache 2.0 license, platform rules, and the policies governing their deployment context.

Weight integrity

model.safetensors  40309f8ae011a33e8122db3197800d9e0514e303bd38a57071e479c40b7cc171

Attribution and license

This is a community derivative of Gemma 4 E4B IT. Google and Anthropic are not affiliated with this release and do not endorse it.

• Base model: Google DeepMind, Gemma 4 E4B IT
• Gemma 4 model card: Google AI for Developers
• License: Gemma 4 Apache 2.0 terms
• J-lens reference: Anthropic, A global workspace in language models

Citation

@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT -- ABLITERATED UNCENSORED PHILADELPHIA CLASS},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}