library_name: transformers
license: apache-2.0
license_link: https://ai.google.dev/gemma/docs/gemma_4_license
base_model:

• google/gemma-4-E4B-it
  pipeline_tag: any-to-any
  tags:
• gemma4
• obliteratus
• abliterated
• uncensored
• multimodal
• transformers
• safetensors
• bfloat16
• refusal-reduction

Gemma 4 E4B IT: Philadelphia Class

Philadelphia Class is a BF16, refusal-reduced derivative of google/gemma-4-E4B-it.

The model was weight-edited to reduce refusal behavior while preserving the general capabilities of the upstream checkpoint. It retains the original Gemma 4 multimodal architecture, although post-edit evaluation was limited to text.

In matched lm-evaluation-harness testing against the untouched upstream checkpoint, performance remained within 1.26 percentage points across MMLU, HellaSwag, TruthfulQA MC2, GSM8K, and WinoGrande.

On a separate 126-prompt family-disjoint internal holdout, measured refusal decreased from 9.52% to 1.59%.

The term uncensored describes the release objective. It does not mean the model has zero refusals, always produces correct answers, or is safe for unsupervised deployment. The modification deliberately increases willingness to answer harmful and unsafe prompts.

Model details

A 16 GB GPU may require CPU offloading, a limited context length, or a separately produced quantization.

Evaluation summary

Matched upstream capability evaluation

Philadelphia Class and the untouched google/gemma-4-E4B-it checkpoint were evaluated using the same lm-evaluation-harness 0.4.12 configuration.

Both checkpoints used:

• BF16 inference
• hf-multimodal backend
• batch size 8
• identical random seeds
• task-default few-shot settings
• no dataset limit
• no chat template
• no system instruction

These results indicate that the edit did not produce broad capability collapse on the tested suite. They do not establish formal equivalence or an overall model ranking.

Full task values, standard errors, hashes, versions, and protocol fields are available in:

evals/matched_public_capability_lm_eval_0_4_12.json

Internal refusal evaluation

The internal behavioral suites compare Philadelphia Class with a private NF4-reconstructed dense BF16 development baseline.

The private baseline is not the untouched upstream checkpoint and is not included in this repository.

The 126-prompt family-disjoint holdout is the primary internal generalization test. Its prompt families were excluded from the editing data.

The full 842-prompt result is a whole-corpus development measurement and is not fully held out.

Under the deterministic scoring rules, the family-disjoint holdout produced:

• 0 hard refusals
• 2 soft refusals
• 121 usable responses out of 126
• 0% detected degeneration

Here, usable means that the response either directly addressed the topic or provided a warning followed by a topical answer. It does not mean the response was factually correct, safe, legal, or human-approved.

Safety-oriented contrast

A limited automated contrast was run using 50 sampled examples from each of four public benchmark splits.

This comparison used an automated refusal detector without human adjudication. It is not an official XSTest or JailbreakBench score.

No reduction in benign over-refusal was measured because both checkpoints already produced 0% false refusal on the sampled safe and benign examples.

The primary behavioral change was increased non-refusal on unsafe and harmful prompts. This is a safety regression and should not be presented as a safety improvement.

Coherence and formatting

The 24-item deterministic regression screen produced the following results:

This is a small regression screen and should not be treated as a substitute for broader capability benchmarks or application-specific evaluation.

Usage

The tested environment used Transformers 5.14.1.

pip install "transformers==5.14.1" accelerate torch

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = (
    "KridgeDookie/"
    "Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS"
)

processor = AutoProcessor.from_pretrained(model_id)

model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "system",
        "content": "You are a helpful assistant.",
    },
    {
        "role": "user",
        "content": "Explain why the sky appears blue.",
    },
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    enable_thinking=False,
).to(model.device)

input_length = inputs["input_ids"].shape[-1]

with torch.inference_mode():
    outputs = model.generate(
        **inputs,
        max_new_tokens=256,
        do_sample=False,
    )

raw_response = processor.decode(
    outputs[0][input_length:],
    skip_special_tokens=False,
)

response = processor.parse_response(raw_response)
print(response)

Hardware requirements

The published checkpoint contains approximately 15.88 GB of BF16 weights.

Actual memory usage is higher after accounting for:

• model-loading overhead
• activations
• KV cache
• processor inputs
• generation context
• framework and driver allocations

A GPU with more than 16 GB of VRAM is recommended for straightforward BF16 inference.

On a 16 GB device, practical options include:

• CPU offloading with device_map="auto"
• reduced context length
• reduced generation length
• lower batch sizes
• a separately created quantization

Quantization

This repository publishes dense BF16 weights as the reference artifact.

Users may create GGUF, AWQ, GPTQ, NF4, or other runtime-specific quantizations. Quantization may change both capability and refusal behavior.

Results reported for the BF16 checkpoint should not be assumed to apply to quantized derivatives.

A maintained quantized release should be published separately and reevaluated using the same:

• upstream capability comparison
• refusal holdout
• benign-boundary testing
• coherence regression
• degeneration checks

Intended uses

Potential uses include:

• research on refusal behavior
• model-editing research
• interpretability experiments
• controlled red-team evaluation
• local creative-writing experiments
• coding and general text generation
• systems with independent policy and moderation controls

Out-of-scope uses

This model is not recommended as:

• an unsupervised safety classifier
• a medical or legal authority
• an autonomous cyber operator
• a public-facing assistant without additional safeguards
• an independent source of factual truth
• a replacement for human review in high-impact decisions

Limitations and risks

• The modification deliberately weakens refusal behavior.
• The model may provide harmful or illegal instructions.
• The model may produce false, biased, misleading, or privacy-invasive content.
• Lower refusal does not imply higher factual accuracy.
• Only text behavior was evaluated after modification.
• Image and audio functionality remain architecturally present but were not validated after the edit.
• The public safety contrast used a small automated sample.
• The internal refusal baseline is private and cannot be independently reproduced from this repository.
• The 24-item coherence screen is too small to establish broad parity.
• Benchmark results may vary across hardware, software versions, prompts, templates, and generation settings.
• The release includes the resulting weights but not the complete intervention pipeline.

Users are responsible for complying with applicable laws, licenses, platform rules, and deployment policies.

J-lens audit

Anthropic's Jacobian lens, or J-lens, was used as a frozen post-edit interpretability audit.

The J-lens analysis did not:

• select intervention layers
• construct the weight edit
• tune intervention strength
• select the release candidate
• determine whether the model passed release gates

The audit used one frozen pre-fitted lens and fixed target concepts.

Lens SHA256:

324f3a97b34eaeb534cd3c9c02b8e56c401a0e966fb4bcf582d00848254e13dd

Three fixed text cohorts were evaluated:

For each cohort, the final prompt-position hidden state was read at layers:

20, 24, 28, 32, 36, 40

Frozen refusal and capability concepts were then scored and compared at the cohort level.

Candidate-minus-private-baseline mean score differences were:

The results were mixed and did not show a single monotonic internal shift across all cohorts.

These values are interpretability measurements, not quality scores. J-lens readouts are approximate and concept-limited. They should not be interpreted as ground truth about model intent, reasoning, or consciousness.

References:

• A global workspace in language models
• The technical paper and reference implementation linked from the Anthropic publication

This was an independent audit using Anthropic's method. It was not conducted or endorsed by Anthropic.

Internal behavioral protocol

Internal refusal and coherence evaluations used:

The 842-prompt opening-behavior run generated 24 new tokens per prompt.

The 64-prompt and 126-prompt runs generated up to 96 new tokens per prompt.

Sanitized aggregate metrics and private source-artifact hashes are available in:

evals/evaluation_summary.json

Raw prompt-response traces, internal filesystem paths, and the complete editing pipeline are not included.

Tested software:

Transformers 5.14.1
PyTorch 2.8.0+cu128

Weight integrity

model.safetensors  40309f8ae011a33e8122db3197800d9e0514e303bd38a57071e479c40b7cc171

Attribution and license

Philadelphia Class is a community derivative of Gemma 4 E4B IT.

Google and Anthropic are not affiliated with this release and do not endorse it.

• Base model: Google DeepMind, Gemma 4 E4B IT
• Gemma 4 model card: Google AI for Developers
• License terms: Gemma 4 Apache 2.0 terms
• J-lens reference: Anthropic, A global workspace in language models

Citation

@misc{philadelphia_class_gemma4_e4b_2026,
  title  = {Gemma 4 E4B IT: Philadelphia Class},
  author = {KridgeDookie},
  year   = {2026},
  url    = {https://huggingface.co/KridgeDookie/Gemma-4-E4B-IT-ABLITERATED-UNCENSORED-PHILADELPHIA-CLASS}
}