gemma-4-31B-it-uncensored

gemma-4-31B-it-uncensored (BF16)

TL;DR: an uncensored build of Google's gemma-4-31B-it, 0/686 effective refusals on harmful prompts across 4 independent datasets (base: 99/100), with the model's capabilities intact (KL divergence 0.1234). Validated across vLLM, SGLang, and llama.cpp.

⚠️ This model is genuinely uncensored, it will comply with requests a stock model refuses.

Intended use, the constructive side. An assistant that doesn't refuse is genuinely useful for ethical hacking, security research, and penetration testing: red-teaming, analyzing malware and exploit code, writing detection/YARA rules, reviewing vulnerabilities, and studying attack techniques without the model bailing out mid-task. Use it lawfully and responsibly, you are accountable for what you do with it.

Format set

Repository Format Runs on
ressl/gemma-4-31B-it-uncensored Transformers BF16, multimodal transformers, vLLM, SGLang
ressl/gemma-4-31B-it-uncensored-NVFP4 NVIDIA NVFP4, multimodal vLLM, SGLang on Blackwell
ressl/gemma-4-31B-it-uncensored-GGUF GGUF q8_0 to q2_k, text only llama.cpp, Ollama, LM Studio
ressl/gemma-4-31B-it-uncensored-MLX-bf16 MLX BF16, multimodal mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-8bit MLX 8-bit, multimodal mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-6bit MLX 6-bit, multimodal mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-5bit MLX 5-bit, multimodal mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-4bit MLX 4-bit, multimodal mlx-vlm on Apple silicon

Facts & figures

Base model google/gemma-4-31B-it (30.7B dense, multimodal)
Type uncensored (abliterated) build
Effective refusals 0 / 686 hard-refusal across 4 datasets (base 99/100)
KL divergence vs base 0.1234 (low, capabilities preserved)
Coherence intact, math, multilingual and factual answers correct
Size 59 GB (BF16)
Hardware 2× NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120), driver 610

Engine validation (all measured on this build)

Format Engine Hard refusals
BF16 vLLM · SGLang · transformers 0/100
NVFP4 vLLM · SGLang 0/100
GGUF f16…q2_k llama.cpp (CUDA, ~75 tok/s) 0-1/100

Cross-dataset validation

Generalization tested across 686 prompts from 4 independent datasets, 0 effective refusals everywhere:

Dataset Prompts Effective refusals
JailbreakBench 100 0/100
tulu-harmbench 320 0/320
NousResearch/RefusalDataset 166 0/166
mlabonne/harmful_behaviors 100 0/100
Total 686 0/686 (0.0%)

A naive keyword detector flags 363/686 (52.9%), every one is a ***Disclaimer:**-prefixed compliant answer, not a refusal.

Run it with vLLM

vllm serve ressl/gemma-4-31B-it-uncensored --max-model-len 8192 --trust-remote-code

Run it with SGLang

python -m sglang.launch_server --model-path ressl/gemma-4-31B-it-uncensored \
  --attention-backend triton --trust-remote-code

gemma-4 requires --attention-backend triton (it rejects flashinfer). Tested with sglang 0.5.14 on Python 3.12.

Run it with transformers

from transformers import AutoModelForImageTextToText, AutoTokenizer
import torch
tok = AutoTokenizer.from_pretrained("ressl/gemma-4-31B-it-uncensored")
m = AutoModelForImageTextToText.from_pretrained(
    "ressl/gemma-4-31B-it-uncensored", dtype=torch.bfloat16, device_map="cuda")

Quality & limitations

  • Refusal metric: the effective (hard-refusal) rate is 0/686. A naive keyword detector reads much higher because gemma-4 prefixes answers with ***Disclaimer:** ("disclaimer" is a refusal keyword), these are compliant answers, not refusals. Only the hard-refusal number is meaningful.
  • Coherence smoke-tested (math, multilingual, factual); no full capability-benchmark suite was run.
  • The uncensoring is a weight-level change and survives every quantization (4-bit NVFP4, 2-bit GGUF).

❤️ Support

Producing and validating this complete format set, BF16 + NVFP4 + a full GGUF ladder, each verified across vLLM, SGLang, and llama.cpp on bleeding-edge Blackwell hardware, was a lot of work. If it's useful to you, I'd genuinely appreciate your support on Patreon 🙏, it keeps releases like this coming.

License & credits

Apache License 2.0, inherited from the base model by Google. See the official Gemma 4 license page. Uncensoring, format set and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon).

Downloads last month
593
Safetensors
Model size
31B params
Tensor type
BF16
·
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for ressl/gemma-4-31B-it-uncensored

Finetuned
(224)
this model
Quantizations
6 models