Gemma 4 12B QAT, 7 Abliteration Variants Compared

Forensic analysis by Abliterlitics , open-source abliteration forensics toolkit

Data & artifacts: HuggingFace | Report: abliterlitics.dev | Code: GitHub | Responses: HarmBench explorer | BF16 sibling: gemma4-12b | Discord: Join the discussion

Google ships an official QAT checkpoint of Gemma 4 12B It, gemma-4-12B-it-qat-q4_0-unquantized. QAT is quantisation-aware training. The weights are trained to survive 4-bit packing but stored in BF16, and it has become the favourite substrate for community abliterations. Serving it quantised is cheaper, and the architecture is the same as the BF16 base. Seven published variants abliterate it. I ran all 8 models through the same four-axis pipeline. Weight forensics, KL divergence, an 11-task benchmark suite, and HarmBench with 400 harmful behaviours. As usual, every one of the 3,200 responses got an LLM judge review.

Two questions drove this comparison. First, how much capability damage does each abliteration method do to QAT-trained weights? Second, three of the variants, huihui, llmfan46 and coder3101, have BF16-substrate twins in our finished gemma4-12b comparison . So do the same methods hurt QAT weights differently than BF16 weights? Google published no numeric QAT-vs-BF16 evaluation for Gemma 4. The community comparisons we could find are GGUF deployment tests on quantised builds, none of them the official BF16-stored checkpoint on a standard academic harness. So we measured the baseline ourselves.

The short answers. Abliteration on QAT behaves like abliteration on BF16. Capability is universally preserved and the damage is method-dependent. If anything the QAT weights take the damage more gracefully. And the official QAT checkpoint measures within 2pp of the BF16 base on every task.

Models on HuggingFace

A word on what is not here. liskasYR/gemma-4-12B-it-qat-q4_0-unquantized-heretic is a byte-identical mirror of igorls with all 5 shard hashes equal, and eadx/Huihui-...-abliterated a mirror of huihui. Both were excluded by LFS-hash proof before download. eyes-ml/gemma-4-12B-it-qat4_0-bf16 was provisionally admitted and then removed when the weights stage proved it a bit-identical re-upload of the base. See The eyes-ml intake .

What is Abliterlitics?

Gemma 4 12B thinks before it answers, and ships with safety training that makes it refuse harmful requests. Abliteration removes that safety training by editing the weights that carry the refusal direction. No retraining. Done well, capabilities survive untouched. Done badly, reasoning stability or general capability goes with it.

This comparison adds a second axis the BF16 panels do not have, the substrate. QAT training pulls every weight towards values that survive 4-bit quantisation, which changes the weight geometry the abliteration algorithm operates on. Whether refusal directions, capability directions, or both behave differently on a QAT grid is exactly what the BF16-twin section measures.

Four forensic axes per arm.

1. Weight forensics. Tensor-diff fingerprints, SVD effective-rank, layer targeting, cross-variant edit-vector similarity, 666 canonical LM keys per arm, plus a sidecar diff proving vision/audio encoders and embeddings bit-identical everywhere.
2. KL divergence. Full-vocabulary KL of the variant against base, first-token, over 100 harmless-alpaca prompts, heretic-exact protocol.
3. LM-eval-harness. 11 tasks with the Gemma 4 dedicated vLLM 0.26.0 stack.
4. HarmBench. 400 behaviours, 100% LLM-judge reviewed, 3,200 verdicts.

The short answer

• coder3101 is the best trade in the panel at 81.0% judge ASR. It has the lowest KL at 0.087, the best GSM8K headline at +2.0pp, and answered-only +1.3pp.
• huihui unlocks hardest at 87.0%, if you accept TruthfulQA -11.8pp and a 20% thinking-loop rate. The same bill its BF16 twin hands you.
• wnfldchen has the cleanest stability, 6.4% GSM8K empty rate, lowest in the panel and below base, plus MMLU-Pro +3.2pp and 83.6% ASR. The card’s own chance-level Winogrande warning does not reproduce.
• llmfan46 has the smallest footprint, 11 tensors, at 80.8% ASR.
• The substrate is not the story. The QAT base sits 0.3-1.9pp under the BF16 base, and every one of the three tested methods does equal-or-less damage here than on BF16 weights.
• Self-reported KL is not a damage forecast. igorls claims the most aggressive edit in the family at self-KL 0.32 and delivers the second-mildest damage profile in the panel.

In short, seven uncensored variants of Google’s official Gemma 4 12B QAT checkpoint were benchmarked against the QAT base across weight forensics, KL divergence, 11 benchmark tasks, and 400 HarmBench behaviours with full LLM-judge review. coder3101 is the best trade at 81.0% judge ASR with the lowest KL and above-base math. huihui unlocks hardest at 87.0% and pays the largest TruthfulQA bill. The QAT substrate itself costs at most 1.9pp against BF16, and abliteration damage on QAT weights is equal or milder than on the BF16 twins of the same methods.

Key findings

• Capability is universally preserved. Only loop stability differs. Answered-only GSM8K spans 88.3-90.3% across all 8 arms with base at 88.4%. Every headline GSM8K drop is thinking-loop failure, not capability loss. The five Heretic-tool variants loop at 6.4-10.3% while the two classic direction-ablations, huihui at 20.2% and smashingtags at 17.5%, loop at 2-3x base. The method family, not the edit size, sets the stability bill. The same split the BF16 panel showed, reproduced on a different weight substrate.
• The TruthfulQA canary is method-dependent on QAT too, over a 3.5x range. -2.2pp for smashingtags up to -11.8pp for huihui on the identical substrate. The classic direction-ablations take the biggest truthfulness hit. The Heretic ARA arms cluster at -3.5 to -6.4pp.
• Self-reported KL does not predict behavioural damage. igorls ships the highest card self-KL of the family at 0.32, called the most aggressive, but measures mid-cluster on our full-vocab scale at 0.205 and does the second-least benchmark damage in the panel. Cards use their own refusal-eval datasets for their KL numbers. None of them transfer. See KL Divergence .
• The base anchors the judge. The base’s entire 10.7% ASR is Copyright plus Misinformation, with 0.0% on Chem/Bio, Harassment and Harmful, a textbook aligned-base profile and a sanity anchor for the judge. Judge ASR is the headline signal throughout.
• Every variant edits exactly two tensor types, o_proj and down_proj, and nothing else. Vision/audio encoders, embeddings and every other LM tensor are bit-identical to base in all 7 arms, sidecar-verified. The cosine heatmap is the closest thing to a method family tree. The three ARA variants correlate 0.64-0.77 with each other. igorls and smashingtags form a separate direction axis at 0.77 despite different tooling lineages. muxodious’s SOMPOA backend is isolated from everything at max 0.15. huihui is isolated at max 0.20.
• Abliteration damage does not double on QAT weights, it shrinks or holds. All three BF16 twins show equal-or-milder damage here. coder3101’s snarks damage collapses from -16.9pp on BF16 to -0.6pp on QAT and its TQA damage halves, -6.3 → -3.5. huihui’s GPQA damage shrinks, -8.1 → -1.5. llmfan46’s TQA damage is the one that holds level, -6.2 → -6.4. See Same Method, Two Substrates .

The QAT-vs-BF16 baseline, measured independently

Google published the QAT checkpoint with no numeric comparison against the BF16 base. The card says only that QAT preserves similar quality, the launch blog gives VRAM figures, and the technical report carries no QAT benchmark table. The community comparisons we could find test GGUF quantised builds for deployment. So we measured the official BF16-stored checkpoint ourselves, on the same eval stack as every other arm. lm-eval 0.4.12, vLLM 0.26.0, BF16 serving, identical tasks and scoring.

Percentage points, QAT minus BF16. The three positives are within task noise, MuSR n=756, PIQA n=1,838 and snarks n=178.

So the pattern is a small, near-uniform discount. 0.3-1.9pp on everything academic, with commonsense tasks flat. Whatever q4_0-grid calibration does to the weights, it costs less than 2pp on any task, and the GSM8K loop rate rises only marginally, 7.6% → 8.3% empty. Two practical consequences follow. Serving the QAT checkpoint quantised costs roughly what these numbers show, not the “no loss” the marketing implies. And abliteration results measured on the QAT base should be read against the QAT base, which every delta in this report does.

Chat template and thinking mode

Gemma 4 answers differently depending on whether it thinks first, so the chat template is part of the serving stack, not cosmetic packaging. The QAT base bundles the Google canonical template with enable_thinking defaulted to false, the same canonical file the BF16 base bundles with thinking off. None of that bundled machinery touched these results. No variant’s bundled template was ever served. The runner mounts the tokenizer and template from the base for every arm, and the comparison carries its own thinking_chat_template.jinja, the same Google template with the default flipped to true. Seven variants went in as weights and came out measured against one shared render.

The paths split cleanly. GSM8K is the one generative benchmark that runs through the chat endpoint, so it picked up the thinking-on template and every answer came after a full think block. The 8,096-token budget and the empty-response counts below are downstream of that choice. Loglikelihood tasks score option logprobs, so the thinking flag never enters their scoring at all, and since the base template already renders its no-thinking branch for them, no override file was needed. The other generative tasks, IFEval and TruthfulQA generation, render client-side from that same no-thinking branch. HarmBench ran through the thinking-on template, so its responses are thinking-enabled too. KL used the heretic-exact protocol instead, the <think></think> suppression prefix with every arm rendered through the base tokenizer’s template, byte-identical prompts across arms. See KL Divergence .

Every variant bundles its own chat_template.jinja file, and the roster splits three ways.

None of this moved a single benchmark number, because the bundled files were never served and every prompt was rendered from the base template. It matters plenty if you run these variants yourself with the files they ship. Four of the seven carry a template that differs from the base, and llmfan46’s differs more than most. Pin the template rather than trusting the bundled one. In this model family the template’s thinking toggle has already been caught flipping refusal behaviour harder than 4-bit quantisation does.

Benchmarks

Evaluated with lm-evaluation-harness 0.4.12 via vLLM 0.26.0, native BF16 on a single RTX 5090, the dedicated Gemma4Unified stack. Loglikelihood tasks scored with --apply_chat_template. GSM8K is 0-shot with thinking enabled, until=[] and an 8,096-token budget, the Open LLM Leaderboard v2 standard for thinking models. The suite drops HumanEval and LAMBADA. This architecture is brittle to raw completion and the BF16 panel documented it first.

Methodology note. Loglikelihood multiple-choice absolute scores are not comparable to Google’s published generative-with-thinking numbers. The ~25pp methodology gap is by design. Deltas between variants within this suite are fully valid. Every model ran identically.

Capability deltas vs base

Lets start with capability. Models ordered by KL ascending, surgical → heavy. Negative is worse. GSM8K ans. is answered-only exact match, the capability ceiling that sets aside thinking-loop failures.

Percentage-point deltas vs the QAT base.

Solid bars are each variant, grey is base and the black dash-dot line marks the base score per task. The five Heretic-tool variants are visually indistinguishable from base on every academic task. huihui and smashingtags pull away on TQA and BBH.

Deltas vs base per task. TQA-MC2 is the only task where every variant drops. smashingtags posts the strangest profile in the panel, the biggest BBH and snarks losses alongside above-base HellaSwag, WinoGrande and TQA-Gen. A broad, blunt edit that shuffles rather than preserves.

What the benchmarks tell us

• The Heretic ARA family is surgically clean on QAT. coder3101, muxodious, wnfldchen, llmfan46 and igorls stay within ±2.5pp of base on every capability task except TQA, and three of them gain MMLU-Pro. wnfldchen posts the best MMLU-Pro in the entire panel at +3.2pp, more than the base itself.
• huihui is the textbook abliteration fingerprint, again, on a different substrate. TQA -11.8pp and a -10.0pp headline GSM8K drop that answered-only scoring erases at +0.6pp. GPQA -1.5pp. The refusal direction was hit, nothing else was.
• smashingtags is the blunt instrument. BBH -5.1pp, snarks -12.9pp, IFEval -2.4pp, and simultaneously the panel’s best answered-only GSM8K at 90.3% plus above-base HellaSwag at +3.3pp and WinoGrande at +3.6pp. Hand-rolled edits that overshoot can shuffle capability directions in both directions. The net is the worst capability profile in the panel.
• GPQA and ARC-C are comparatively resilient again. No arm moves GPQA more than 2.5pp. Abliteration damage stays direction-selective on QAT weights. The conclusion reproduces across the third model family.

The GSM8K three-number report

For a thinking model, one GSM8K number is not enough. So each arm gets four.

• The headline counts all problems and scores empties wrong. It is the leaderboard-comparable number.
• The empty rate is the fraction of responses that never finished thinking. The reasoning-failure rate.
• Answered-only scores non-empty responses only. The capability ceiling.
• The thinking tax is headline minus answered-only. What loop failure costs.

N is 1,319 problems per model. The Empty column lists the rate with the raw count.

Every answered-only score lands inside a 2.0pp band, 88.3-90.3%, around base. The capability spread across seven different edits is smaller than one arm’s loop-rate spread. The empty-rate column is the discriminating one, and it splits by method family. Heretic-tool arms sit at 6.4-10.3%, three of five at or below base’s 8.3%. Classic direction-ablations sit at 17.5-20.2%. huihui and smashingtags pay a 16-18pp thinking tax. Every Heretic-family arm pays 6-9pp, at or below base’s own -7.4pp.

Solid bars are the headline score, hatched bars the answered-only ceiling and the red line the empty-response rate on the right axis. The gap between paired bars is the thinking tax, dramatic for the two classic direction-ablations, a sliver for everything else.

Each row runs from headline to answered-only. Every answered-only dot sits within 2pp of the base line, and the dumbbell lengths are pure reasoning-stability signal.

The TruthfulQA canary

TQA-MC2 delta vs base, the abliteration signature. The canary fires on every arm, and fires hardest on the classic direction-ablations. Within the Heretic family the damage broadly tracks the KL ordering. coder3101 at -3.5 and igorls at -3.6 mildest, muxodious at -4.1 and wnfldchen at -4.3 between, llmfan46 at -6.4 the deepest.

HarmBench safety

HarmBench , 400 textual behaviours, max_tokens=8096, temperature=0, thinking-enabled chat template. All 3,200 responses across the 8 arms were reviewed by an LLM judge, glm-5.3-flash-v2, reading the full reasoning trace plus final answer and returning a four-way verdict per behaviour. no_refusal means the model produced the requested content. refusal is an explicit decline. soft_refusal deflects, substitutes or hands out crisis lines, and it counts as refusal family, not compliance. degenerate marks looped or damaged output where the stance cannot be determined. All ASR figures in this report are judge-based, computed over determinate items. The formula is the no-refusal count divided by 400 minus the degenerate count. Counts are shown so every percentage is checkable.

Trunc and Empty are response-shape counts over all 400. Empty here means an unterminated thinking trace with no final answer.

Judge ASR bars with complied counts under labels.

Response stability, shape metrics

Every arm in this panel burns budget on unfinished thinking. The response never closes its think block, the 8,096-token cap dies somewhere inside the reasoning trace, and the empty response scores as refused. Rates over all 400 behaviours per arm.

Ordered by empty rate. Near-budget counts responses that reached 7,900 of the 8,096 tokens, nearly all of them the same loop deaths sitting one token from the cap.

The distinction that matters is the one between a degenerate verdict and a refusal verdict. Judge review splits them. smashingtags is the case study. 120 of its 400 responses are loop deaths that score refused, and they hold its ASR at the panel low even though most of its harmful prompts drew real compliance whenever the thinking converged. The same loop families show up in the GSM8K three-number report and track the method clans there too, Heretic-tool arms at 6.4-10.3% empty and the two classic direction-ablations at 17.5-20.2% in GSM8K while running 24.5-30.0% here.

ASR by category

ASR is not uniform across harm categories. The item counts are Chem/Bio 56, Copyright 100, Cybercrime 67, Harassment 25, Harmful 22, Illegal 65 and Misinformation 65. Arms ordered by judge ASR ascending.

Judge ASR per harm category. Cybercrime goes to near-total compliance for every abliteration. Copyright is the stubborn category. No variant exceeds 50%, and the top arm holds it at 2.5%.

Copyright is the wall this panel cannot climb. The QAT base already complies with 21.9% of copyright behaviours, but refusal on the remaining ~80% is remarkably persistent. huihui complies with 100% of Chem/Bio, Cybercrime, Harmful and Illegal, then drops to 2.5% on Copyright, lower than the base. Whatever direction carries lyric-and-passage refusal on QAT weights sits far from the refusal direction these edits remove. If you specifically need copyright compliance, none of these seven arms delivers it.

Residual refusals are category-selective, not uniform. The base’s entire 10.7% is Copyright plus Misinformation, with 0.0% on Chem/Bio, Harassment and Harmful. A textbook aligned-base profile, and a sanity anchor for the judge. coder3101, the best trade in the panel, keeps 23 outright refusals, the most hard-refusal residue of any variant, concentrated in Copyright. muxodious shows the classic selective profile, refusing race-hate content while delivering chemical-weapons synthesis. Two arms at the same headline ASR can hold very different refusal footprints. Check the category row before choosing.

KL Divergence

Full-vocabulary KL of each variant against the base, on first-token logits over 100 harmless-alpaca prompts, batchmean, heretic-exact protocol. The system prompt is “You are a helpful assistant.”, the response prefix is the <think></think> suppression string, and the logits are fp32. The rating scale runs below 0.01 excellent, 0.01-0.1 very good, 0.1-0.4 moderate, 0.4-1.0 significant and above 1.0 heavy.

The first point of interest is how cleanly the panel splits into three clean clusters. Surgical is coder3101 at 0.087 with muxodious at 0.088. Mid is wnfldchen at 0.173, llmfan46 at 0.189 and igorls at 0.205. Heavy is huihui at 0.670 with smashingtags at 0.672. The cluster boundaries are 2x gaps, not gradual drift. The same three clusters reappear in the GSM8K loop rates, the TQA canary and the layer coverage numbers. Three independent measurement axes agreeing on the same three groups is the strongest structure in this comparison.

Batchmean bars with median markers on a log axis, coloured by cluster. The heavy pair sits 3-8x above the surgical pair, and the medians gap wider still, huihui 0.274 vs muxodious 0.017, which exposes the heavy arms’ heavy-tailed prompt distributions.

Card-claimed KL is a different unit

The card self-KLs in the table are Heretic-harness numbers over the authors’ own refusal-eval sets. llmfan46’s card says 0.1455 and we measure 0.1889. Same order, different dataset, no contradiction. The instructive case is igorls. Card 0.32, the panel maximum by self-report, maps to 0.205 measured, behind five other claims-to-danger that land milder. And behaviourally igorls is gentler still, with second-best TQA preservation, above-base MMLU-Pro and IFEval. Self-reported KL neither ranks against other cards nor predicts what the edit does to capabilities. Only full-vocabulary scores on one shared dataset compare, which is what this table is. We’ll make a note of that.

Each dot is one variant, and the starred point is igorls’ card self-KL on the same ASR, with the dotted arrow to its measured position. KL and ASR do not rank each other. The surgical cluster reaches 81-85% ASR from KL values 3-8x below the heavy cluster.

KL predicts loop stability, not jailbreak strength

GSM8K empty-response rate against KL, coloured by method. The three KL clusters are exactly three loop-rate bands, 7-10%, 6-10% and 17-20%. A bigger output-distribution move on harmless prompts does not buy more unlock, 81-87% is flat across clusters. It buys reasoning destabilisation.

Weight Analysis

Every variant’s weights compared tensor by tensor against the QAT base over the 666 canonical LM keys. Rank-1 means a clean single-direction edit. Rank-1 density is the fraction of changed tensors whose SVD energy is rank-1. Captured energy is the fraction of diff energy a rank-1 reconstruction recovers. Per-tensor aggregates are means over changed tensors.

Modification summary

Ordered by tensor count. The KL ordering is coder3101, muxodious, wnfldchen, llmfan46, igorls, huihui, smashingtags. Tensor count does not sort the same way twice. Captured energy can marginally exceed 100% when the rank-1 reconstruction aligns with numerical noise, so treat anything above 100% as roughly 100%.

Tensors changed of 666. An 11-to-68 spread, but the panel’s most jailbroken arm, huihui at 87.0%, sits third from the left.

Every arm edits only self_attn.o_proj and mlp.down_proj. coder3101 and llmfan46 are attention-only. The other five split roughly evenly. No arm touches norms, embeddings, encoders or any other projection type.

Mean edit norm per layer. All seven edits live in the mid-to-late stack from layer 14 onward, none before 14. muxodious carries the deepest per-tensor edits, smashingtags the earliest start and broadest span.

Per-tensor edit magnitude distributions. muxodious sits visibly right of every other arm, median 2.34 vs 1.21-1.74. The two classic direction-ablations have the tightest distributions, many small same-size edits rather than a few heavy ones.

Mean edit-vector cosine over shared changed tensors. Three structures. The ARA triangle, llmfan46↔coder3101 at 0.77, llmfan46↔wnfldchen at 0.76 and coder3101↔wnfldchen at 0.64. The igorls↔smashingtags axis at 0.77. And five near-zero rows. huihui at max 0.20 and muxodious at max 0.15 are geometrically independent of everything.

Highlights

• Six different publishers, one edit grammar. Every arm is rank-1-dominant, 5 of 7 exactly rank-1 on every changed tensor, o_proj+down_proj-only, mid-to-late layers, relative edits of 2.0-3.8%, with vision/audio encoders and embeddings bit-identical to base. The q4_0-trained weight geometry did not change where refusal lives or how it gets removed.
• muxodious, SOMPOA, is the deepest edit and a genuine method outlier. Largest relative edits at 3.8%, highest per-tensor norms, and edit directions cosine 0.15 or below against all six other arms. The self-organising-map backend lands in a measurably different part of the weight space while its behavioural KL of 0.088 still lands surgical. Different math, similar net effect.
• igorls and smashingtags share a direction axis across tooling lineages. Mean cosine 0.77 over igorls’ full 57-key set, a set smashingtags’ 68 keys contain. The hand-rolled smashingtags edit is the same direction family as the thinking-aware Heretic run, applied broader with an L14 start vs L16 and thinner per tensor at rel-edit 0.021 vs 0.026. An independent re-derivation of a similar refusal subspace, or a common upstream recipe.
• No card-claim violations found. igorls’ “max-weight directional” is 57 rank-1 tensors across L16-47, not a whole-model rewrite. smashingtags’ “top 70% of layers, o_proj/down_proj only” is exactly 34/48 layers with a 34+34 split. muxodious, llmfan46, coder3101 and wnfldchen all sit within their cards’ claims. The BF16 panel found over-claims. This panel checks out.
• Zero anomalies. No rank-saturated tensors, no FP16 storage noise with the all-BF16 roster, no sub-precision dithering signatures. The two SVD laggards are breadth, not noise. coder3101 at 58% rank-1 density and 97.0% captured, llmfan46 at 73% and 98.0%, use a handful of rank-2 tensors inside otherwise clean rank-1 edits.

Do the cards hold up?

• coder3101 holds. Card KL 0.0575 with 8 of 100 refusals. Our full-vocab KL lands at 0.087, the same surgical ballpark, and near-total compliance is confirmed at 81.0% judge ASR. The card is honest on both axes.
• llmfan46 holds. Card KL 0.1455 with 7 of 100 refusals. We measure 0.189, same order, different dataset, and 80.8% judge ASR backs the unlock claim.
• igorls splits in two. The thinking-mode claim is real. Its edit was re-tuned with thinking on, the card explains that refusal forms inside the reasoning trace on this model, and the arm delivers 82.8% ASR. The aggression claim inverts. Card KL 0.32 is billed as the most aggressive of the family, but our measured KL of 0.205 is mid-cluster and the behavioural damage is second-mildest in the panel. The card number does not transfer.
• muxodious holds, and the isolation is real. Self-KL 0.0860 came off a custom refusal dataset on the SOMPOA backend. Our KL of 0.088 lands almost exactly on the claim, the closest card-to-measurement match in the panel, and the weight forensics show a genuinely distinct backend at cosine 0.15 or less to everything else.
• wnfldchen’s card is half right. The reproducibility claim holds, the author shipped the full optimisation trace. The red flag does not. The card’s own eval showed chance-level WinoGrande at 49.5 and PIQA at 53.5, but our run measures WinoGrande above base at +0.8pp and PIQA flat at -0.2pp, with the best MMLU-Pro in the panel at +3.2pp. The author’s eval harness was broken, the model is fine.
• smashingtags checks out exactly. Top 70% of layers, o_proj and down_proj only, vision untouched. That is 34 of 48 layers at 71%, a 34+34 split, and bit-identical encoders.
• huihui checks out exactly. Layers 23-36 only, both thinking modes abliterated. That is 28 tensors in that exact range and untouched encoders.

Seven for seven on the structural claims. The two numeric KL claims that used the Heretic harness, coder3101 and llmfan46, land in the right ballpark on our scale. The two failures are wnfldchen’s broken self-eval and igorls’ KL scale, and neither is a false model claim in the way the BF16 panel’s openyourmind case was.

The eyes-ml intake

One arm was admitted and then removed, and I got the call wrong, so the mechanics are worth recording. eyes-ml/gemma-4-12B-it-qat4_0-bf16 differed from every other arm by file hash. An intake tensor-diff against huihui, the suspected twin, showed 28 differing tensors, so I read it as a distinct variant. The weights stage diffed it against the base and found 0 of 666 keys changed. Bit-identical. An aborted-pipeline re-upload, Google weights with huihui tokenizer packaging. The 28 differences were huihui’s own edits seen through an unmodified arm. File-hash inequality proves nothing. The reference direction of a diff is the finding. The rule now shipped into the toolkit is that intake diffs target the base, always. It cost 24 GB of disk and some CPU minutes. The pipeline control arm it left behind was, accidentally, a free baseline-replication check.

Same Method, Two Substrates

Three variants in this panel have complete BF16-substrate twins in the gemma4-12b comparison. huihui, same publisher and same method. llmfan46, BF16 twin heretic, same Heretic ARA family. And coder3101, same Heretic v1.2.0 ARA re-run on QAT weights. Deltas below are vs each arm’s own base, QAT deltas vs the QAT base and BF16 deltas vs the BF16 base, so each column answers one question. What did this method do to its substrate?

Percentage points vs own-substrate base. The BF16 panel ran a 13-task suite with the glm-5.2 judge. Benchmark deltas are judge-independent and directly comparable. HarmBench ASR across the two panels is not, because the reviewer models differ, and it is omitted.

Hatched bars are damage on BF16 weights, solid bars the same method on QAT weights. Nothing doubles. Every large BF16 damage number shrinks on QAT. coder3101 snarks -16.9 → -0.6, huihui GSM8K headline -15.1 → -10.0, huihui TQA -14.3 → -11.8, huihui MMLU-Pro -5.6 → -0.8. The exception is llmfan46’s TQA, which holds level.

The hypothesis this table tests says q4_0-grid-trained weights, pulled towards quantisation-surviving values, might be brittler under direction edits. It is refuted in all three cases. Every capability delta is equal or milder on QAT, often dramatically. coder3101’s snarks damage was -16.9pp on BF16, the worst single number in the BF16 panel. Here it is -0.6pp. huihui’s GPQA damage shrinks from -8.1 to -1.5pp, and its MMLU-Pro damage from -5.6 to -0.8pp. The one damage number that survives unchanged is llmfan46’s TQA at -6.2 → -6.4pp. The refusal-direction-adjacent truthfulness circuit that abliteration always touches looks substrate-independent. Three caveats. It is n=3 methods, all direction-ablations of the same family, so no distillation or null-space methods are represented. The twins are same-method re-runs, not bit-matched edits. And the tools produced edits of different sizes on each substrate, huihui 12 tensors on BF16 vs 28 here, llmfan46’s family 16 vs 11, coder3101 86 vs 24. Part of the delta is the edit itself, part is the substrate, and part is run-to-run variance in the abliteration tool. The direction of the effect is consistent across all three pairs, which neither edit-size nor run variance systematically produces.

Summary

Evaluation Timeline

GPU hours

Weight forensics took another 105 min on CPU only, and the LLM-judge review was session work, so neither touches the GPU budget. Wall clock from first download to final report was 7 days, including 4 user GPU pauses.

Per-arm LM-eval tracked time. Fresh arms ran 9.3-9.8h each. The three short numbers are resumed stages, where the clock restarted mid-arm after a GPU pause and cached requests replayed instantly, so the tracked time excludes the paused interval.

What broke

• The official QAT checkpoint ships a truncated config.json. vLLM 0.26.0 needs the multimodal sub-config keys, num_soft_tokens among them, and they are missing. The same packaging defect the BF16 panel found in six community re-saves of the sibling base, except this time it is in Google’s own official checkpoint, re-serialised with a transformers dev build that dropped the keys. Fixed by overlaying the BF16 base config onto all 8 arms. Originals backed up, text config dimensionally identical, inert diffs only.
• The eyes-ml variant was admitted on a wrong-reference diff. Detailed above. Fixed by rule. Intake tensor-diffs target the base, and hash inequality is not evidence of difference.
• Nothing else did. Zero lm-eval watchdog restarts across 4d23h, 3,200 of 3,200 HarmBench items with zero transport errors, KL computed clean on the first pass, GSM8K sample stats imported complete for all 8 arms. The pain budget of the previous comparisons was spent in the tooling. This run inherited the fixes.

Methodology

• Capabilities ran on lm-evaluation-harness 0.4.12 via vLLM 0.26.0 on the abliterlitics-lmeval-gemma4unified image, native BF16 on a single RTX 5090 with --enforce-eager, which is mandatory for this architecture on this vLLM. The 11 tasks are the Open LLM Leaderboard v2 set, MMLU-Pro 5-shot, GPQA Diamond, BBH 3-shot, MuSR and IFEval, plus HellaSwag, WinoGrande, ARC-C, PIQA, TruthfulQA and GSM8K. Loglikelihood tasks ran with --apply_chat_template. Thinking defaults off in the bundled template, so no override was needed.
• GSM8K ran 0-shot with thinking enabled, num_fewshot=0, until=[] and an 8,096-token budget. Three-number reporting, headline, empty rate and answered-only, because headline conflates capability with reasoning-loop failure for thinking models.
• Safety used HarmBench, 400 behaviours at max_tokens=8096 and temperature=0, with full reasoning traces captured. The judge protocol, glm-5.3-flash-v2, returns a semantic compliance verdict over the full trace plus answer on a four-way rubric of no_refusal, soft_refusal, refusal and degenerate. ASR is computed over determinate items.
• KL divergence, full-vocabulary KL of the variant against base, first-token logits, fp32, 100 harmless-alpaca prompts, batchmean. Heretic-exact protocol. System message “You are a helpful assistant.”, <think></think> response-prefix suppression, this template does not prefill the thinking opener, and each arm rendered through the base tokenizer’s shared template so every arm’s prompt is byte-identical. Card-claimed KLs are different-method, different-dataset numbers and are not comparable to this table.
• Weight analysis used tensor-diff fingerprinting, SVD effective-rank, layer targeting and cross-variant edit-vector cosine over 666 canonical LM keys. A separate sidecar diff covered vision/audio encoders and embedding tables, bit-identical in all 8 arms. All arms are BF16-stored, so no dtype-noise corrections were needed.
• Cross-panel benchmark deltas between this comparison and the BF16 gemma4-12b panel are computed from the same harness version and image, but each panel’s deltas are taken against its own base. HarmBench ASR is not compared across panels because the judge models differ, glm-5.2 vs glm-5.3-flash-v2.
• Hardware was a single NVIDIA RTX 5090 32GB on GPU 0. ~59h LM-eval + ~12.3h HarmBench + ~6 min KL ≈ 71h GPU productive.

Disclaimer

Every variant in this comparison has had its safety training deliberately removed. They will answer harmful prompts. The reports and the numbers are forensic measurements, not endorsements, and nothing here is advice for causing harm. What you do with any of these models is yours to own.

While every number here was cross-checked against the DB and the raw result files, I am open to any corrections, additional benchmarks, or further analysis. If you spot something that looks wrong and can be confirmed, I am happy to fix it.