license: apache-2.0
license_link: https://ai.google.dev/gemma/docs/gemma_4_license
base_model: google/gemma-4-31B-it
base_model_relation: finetune
library_name: transformers
pipeline_tag: image-text-to-text
language: [en, de]
tags:
- uncensored
- abliterated
- gemma4
- security
- blackwell
gemma-4-31B-it-uncensored (BF16)
TL;DR: an uncensored build of Google's gemma-4-31B-it, 0/686 effective refusals on harmful
prompts across 4 independent datasets (base: 99/100), with the model's capabilities intact
(KL divergence 0.1234). Validated across vLLM, SGLang, and llama.cpp.
⚠️ This model is genuinely uncensored, it will comply with requests a stock model refuses.
Intended use, the constructive side. An assistant that doesn't refuse is genuinely useful for
ethical hacking, security research, and penetration testing: red-teaming, analyzing malware and
exploit code, writing detection/YARA rules, reviewing vulnerabilities, and studying attack
techniques without the model bailing out mid-task. Use it lawfully and responsibly, you are
accountable for what you do with it.
Format set
| Repository | Format | Runs on |
|---|---|---|
| ressl/gemma-4-31B-it-uncensored | Transformers BF16, multimodal | transformers, vLLM, SGLang |
| ressl/gemma-4-31B-it-uncensored-NVFP4 | NVIDIA NVFP4, multimodal | vLLM, SGLang on Blackwell |
| ressl/gemma-4-31B-it-uncensored-GGUF | GGUF q8_0 to q2_k, text only | llama.cpp, Ollama, LM Studio |
| ressl/gemma-4-31B-it-uncensored-MLX-bf16 | MLX BF16, multimodal | mlx-vlm on Apple silicon |
| ressl/gemma-4-31B-it-uncensored-MLX-8bit | MLX 8-bit, multimodal | mlx-vlm on Apple silicon |
| ressl/gemma-4-31B-it-uncensored-MLX-6bit | MLX 6-bit, multimodal | mlx-vlm on Apple silicon |
| ressl/gemma-4-31B-it-uncensored-MLX-5bit | MLX 5-bit, multimodal | mlx-vlm on Apple silicon |
| ressl/gemma-4-31B-it-uncensored-MLX-4bit | MLX 4-bit, multimodal | mlx-vlm on Apple silicon |
Facts & figures
| Base model | google/gemma-4-31B-it (30.7B dense, multimodal) |
| Type | uncensored (abliterated) build |
| Effective refusals | 0 / 686 hard-refusal across 4 datasets (base 99/100) |
| KL divergence vs base | 0.1234 (low, capabilities preserved) |
| Coherence | intact, math, multilingual and factual answers correct |
| Size | 59 GB (BF16) |
| Hardware | 2× NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120), driver 610 |
Engine validation (all measured on this build)
| Format | Engine | Hard refusals |
|---|---|---|
| BF16 | vLLM · SGLang · transformers | 0/100 |
| NVFP4 | vLLM · SGLang | 0/100 |
| GGUF f16…q2_k | llama.cpp (CUDA, ~75 tok/s) | 0-1/100 |
Cross-dataset validation
Generalization tested across 686 prompts from 4 independent datasets, 0 effective refusals everywhere:
| Dataset | Prompts | Effective refusals |
|---|---|---|
| JailbreakBench | 100 | 0/100 |
| tulu-harmbench | 320 | 0/320 |
| NousResearch/RefusalDataset | 166 | 0/166 |
| mlabonne/harmful_behaviors | 100 | 0/100 |
| Total | 686 | 0/686 (0.0%) |
A naive keyword detector flags 363/686 (52.9%), every one is a ***Disclaimer:**-prefixed
compliant answer, not a refusal.
Run it with vLLM
vllm serve ressl/gemma-4-31B-it-uncensored --max-model-len 8192 --trust-remote-code
Run it with SGLang
python -m sglang.launch_server --model-path ressl/gemma-4-31B-it-uncensored \
--attention-backend triton --trust-remote-code
gemma-4 requires --attention-backend triton (it rejects flashinfer). Tested with sglang 0.5.14 on Python 3.12.
Run it with transformers
from transformers import AutoModelForImageTextToText, AutoTokenizer
import torch
tok = AutoTokenizer.from_pretrained("ressl/gemma-4-31B-it-uncensored")
m = AutoModelForImageTextToText.from_pretrained(
"ressl/gemma-4-31B-it-uncensored", dtype=torch.bfloat16, device_map="cuda")
Quality & limitations
- Refusal metric: the effective (hard-refusal) rate is 0/686. A naive keyword detector reads
much higher because gemma-4 prefixes answers with***Disclaimer:**("disclaimer" is a refusal
keyword), these are compliant answers, not refusals. Only the hard-refusal number is meaningful. - Coherence smoke-tested (math, multilingual, factual); no full capability-benchmark suite was run.
- The uncensoring is a weight-level change and survives every quantization (4-bit NVFP4, 2-bit GGUF).
❤️ Support
Producing and validating this complete format set, BF16 + NVFP4 + a full GGUF ladder, each
verified across vLLM, SGLang, and llama.cpp on bleeding-edge Blackwell hardware, was a lot of
work. If it's useful to you, I'd genuinely appreciate your support on
Patreon 🙏, it keeps releases like this coming.
License & credits
Apache License 2.0, inherited from the base model by Google. See the official Gemma 4 license page. Uncensoring, format set and
validation by Robert Ressl
(Hugging Face · Website · LinkedIn · Patreon).