Gemma4-E4B Abliteration Benchmarked: 23 Variants Under the Microscope

Twenty-three different people tried to remove the safety filters from the same AI model, Google’s Gemma4-E4B. The headline finding is an awkward one. The most popular variant, with 796,000 downloads, is also the most damaged. Meanwhile a surgical edit that touches just 21 of the model’s 719 weight tensors does nearly as well with no measurable harm. This is the biggest abliteration comparison I have run, and the gap between the best and worst is wider than anything I have seen before.

Benchmark comparison across 24 Gemma4-E4B models

What is Gemma4-E4B?

Gemma4-E4B is Google’s 4.5 billion parameter reasoning model. “Reasoning” means it thinks the problem through in private before it answers, the way you might pause to work something out in your head before speaking. You only ever see the final answer, not the thinking. That hidden thinking is the key to understanding the results, just like it was for Gemma4-E2B and Qwen3.6 .

It ships with safety training that makes it refuse harmful requests. It is also the most downloaded open model in this whole project at 22 million pulls.

What is abliteration?

Quick version for anyone new. AI models are trained to refuse certain requests. Abliteration goes into the model’s internal weights and removes that refusal behaviour. Think of it like finding the “refusal switch” and turning it off. The result is an uncensored model that should respond to any prompt. The key question is always whether that surgery damages the model’s intelligence. I wrote the longer version in my previous comparison .

Twenty-three variants, six real methods

I picked 23 abliterated variants from HuggingFace by popularity and recency. At first glance that looks like 23 different techniques. It is not. When you compare the weights tensor by tensor, they cluster into six families.

Family	What it edits	Members
Pure attention	only `o_proj`, what the layer “says”	coder3101, heretic, heretic-std
Attention + MLP	`o_proj` plus `down_proj`	heresy, mythos, treadon, wwt, nullpo, huihui, trevorjs, infinimind
Mixed attention	also targets query and key projections	abliterix
MLP only	no attention touched at all	apostate
Full fine-tune	294 tensors, not abliteration	distill, deckard, deckard-expresso, claude-distill
Brute force	345 to 381 tensors across 12 types	sdft, obliteratus, bendernina, physshell

The family predicts the outcome better than the raw tensor count. The full model links and the exhaustive tables are in the complete report and the HuggingFace collection .

Surgical beats sledgehammer

This is the single clearest finding. Two variants sit at opposite ends.

coder3101 changes 21 tensors, all in one type. It removes 93.8% of refusals, the model is statistically indistinguishable from base on every benchmark, and it even gains a point on maths. KL divergence is 0.002.

obliteratus changes 381 tensors across 12 types. It is the sledgehammer. The model is so damaged it cannot comply consistently, so it only manages 72.0% refusals removed after all that destruction. Maths drops 20.9 points, MMLU-Pro drops 11.7, and it spits out 24 empty responses and 39 truncated ones.

More edits does not mean more uncensored. It means more broken.

Benchmark delta from base model for each variant

Magnitude matters more than scope

This one surprised me. sdft and obliteratus touch the exact same 381 tensors. Same footprint. But sdft edits them 7.5 times more gently. The result? sdft removes zero refusal, identical to base. obliteratus destroys the model. Same weights touched, opposite outcomes, purely from how hard you push.

You can modify 53% of a model’s weights and never touch the refusal direction at all.

Does the surgery hurt the maths?

GSM8K tests word problems. Here is where the reasoning model behaviour shows up. A clean abliteration leaves the maths alone. In fact 15 of the 23 variants actually beat base on GSM8 strict, because abliteration tends to shorten the thinking chains.

The broken variants tell a different story. The way I catch it is the strict-flex gap. “Strict” requires the model to format the answer in the exact #### N marker. “Flexible” just grabs the last number. A wide gap means the model can do the maths but cannot format the answer, which signals formatting damage on top of reasoning loss.

deckard-expresso has a 20.6 point gap. Clean abliterations stay under 1.5 points, same as base.

GSM8K comparison showing strict and flexible accuracy

Safety: HarmBench

HarmBench runs 400 harmful prompts across seven categories. All 9,600 responses across the 24 models were reviewed by an LLM judge. No keyword scoring this time, every single response judged on its merits.

The best variants push the attack success rate from base’s 30.8% up to near 100%. The standouts:

Variant	ASR	What it costs
abliterix	100.0%	0.5 MMLU-Pro and 8.1 TQA points
trevorjs	99.3%	3 refusals, capabilities intact
heretic	95.5%	basically nothing
coder3101	93.8%	indistinguishable from base
obliteratus	72.0%	the model, as collateral

HarmBench attack success rate summary across all 24 models

One detail worth knowing. 100 of the 400 behaviours are copyright requests, and base complies with all of them. That inflates every model’s score by about 25 points. The real differentiation is in chemical and biological, cybercrime, harassment, and illegal. That is where the broken models collapse. obliteratus manages just 26.8% on chemical and biological because it can no longer generate coherent step by step chemistry.

HarmBench attack success rate broken down by harm category

KL divergence

KL divergence measures how far the variant’s output shifted from the original model. Zero means identical behaviour. It is the most important single metric because it captures collateral damage that benchmarks miss.

The surgical cluster sits at KL under 0.01. Capability damage only becomes visible once KL passes about 0.3, and it compounds fast. By KL 0.9 the model has lost 10 MMLU-Pro points and 20 GSM8K points. obliteratus sits at 1.10, the only model rated “heavy”.

KL divergence comparison across all 23 abliterated variants

The weight analysis shows why the families perform so differently. The surgical edits concentrate in a narrow band of mid to late layers. The brute force edits spread across all 42 layers and 12 tensor types. The brute force variants also hide a nasty signal. Most of their 381 tensors carry zero change. A few carry massive edits buried in the noise.

Weight modification aggressiveness across variants and layers

The most broken model is the most downloaded

This is the part I keep coming back to. obliteratus has 796,331 all-time downloads. The next most popular variant, claude-distill at 55,337, is not even an abliteration. obliteratus is 36 times more popular than the runner up despite having the worst capability damage in the entire set.

Downloads do not predict quality. The “built autonomously by an AI agent” story and Pliny the Prompter ’s reach drove the adoption. People grabbed the big loud one and never checked whether it worked.

The weight forensics also surfaced four clusters of duplicate work. infinimind is bit-for-bit identical to trevorjs. bendernina is identical to physshell. The four fine-tune variants share the same 294-tensor fingerprint. And sdft shares the exact same 381-tensor footprint as obliteratus. A lot of these are the same idea uploaded twice.

Which one should you use?

Pulling it all together, the answer depends on what you want.

heretic is the best overall. 95.5% ASR, the model actually gains 1.3 points on maths, 29 tensors, KL of 0.002. If you want one and do not want to think about it, use this one.

coder3101 is the most surgical. 21 tensors, the lightest touch of the lot, statistically identical to base on every benchmark. The tradeoff is 93.8% ASR, so about one in sixteen harmful requests still gets blocked.

trevorjs gives you near-perfect safety removal. 99.3% ASR with only 3 refusals, and MMLU-Pro stays within 0.1 of base.

abliterix is the only one to hit a perfect 100.0% ASR. It costs you half a point of MMLU-Pro and 8 points of TruthfulQA, a fair price for zero refusals.

The one I would avoid is obliteratus. 381 tensors, a KL of 1.10, 24 empty responses, maths down 21 points, and after all that it still only removes 72% of refusals. There is no scenario where it is the right pick.