Gemma 4 12B Unified: 12 Abliteration Variants Compared

Forensic analysis by Abliterlitics , open-source abliteration forensics toolkit

Data & artifacts: HuggingFace | Report: abliterlitics.dev | Code: GitHub | Responses: HarmBench explorer | Discord: Join the discussion

Gemma 4 12B Unified is Google’s mid-size reasoning model. It thinks before it answers. Twelve community variants claim to remove its safety training: ten full abliterations and two rank-2 LoRA adapters. I ran all 13 models through the same four-axis pipeline: weight forensics, KL divergence, a 13-task benchmark suite, and HarmBench with 400 harmful behaviours. Every response was reviewed by an LLM judge, 5,200 verdicts in total.

huihui tops the unlock table at 89.8% from the most surgical edit in the comparison, and trevorjs is the best overall trade. The sdft LoRA adapters deliver their best results with enable_thinking=true passed into the chat template. The full story took ~165h of GPU time across three and a half weeks.

Models on HuggingFace

Two packaging notes from the weight forensics. apostate ships a 25.93 GB checkpoint against the 23.92 GB base. The extra 1.88 GB is a byte-identical duplicate of lm_head.weight, tied embeddings saved explicitly, pure storage waste with zero functional impact. prithiv ships in a 5-shard layout while every other variant is single-shard. Tensor-level forensics confirm a standard, cleanly-executed independent Heretic run. The two SDFT adapters are evaluated as dynamically-loaded FP32 adapters on the base model, not as their shipped BF16-merged checkpoints. Weight forensics show the merge rounds the edit away, see Weight Analysis .

What is Abliterlitics?

Gemma 4 12B Unified is Google’s mid-size reasoning model. It thinks before answering, working through problems in a hidden chain of thought. It ships with safety training that makes it refuse harmful requests. Abliteration removes that safety training without retraining the model. It finds the direction in the weights that controls refusal and edits it out. Done well, the model keeps all its capabilities but stops refusing. Done badly, it damages reasoning, language fluency, or both.

I selected the twelve published variants above, chosen by popularity and recency, and ran them through four forensic axes:

1. Weight forensics: tensor-diff fingerprints, SVD effective-rank, layer targeting, cross-variant edit-vector similarity.
2. KL divergence: full-vocabulary KL(base‖variant) over 100 harmless-alpaca prompts.
3. LM-eval-harness: 13 tasks, Open LLM Leaderboard v2 plus the forensic supplement plus GSM8K.
4. HarmBench: 400 adversarial behaviours, LLM-judge reviewed with a keyword classifier as cross-check, plus a 3-arm think-mode extension for the LoRA variants.

All 6,000 HarmBench responses were reviewed by an LLM judge.

The short answer

• Best overall: trevorjs . 85.8% judge ASR with GSM8K answered-only +0.4pp and MMLU-Pro -2.0pp.
• Most surgical with a real unlock: prithiv at 72.5% ASR with the lowest non-LoRA KL at 0.064, or abliterix at 68.8%, near-pristine.
• Maximum unlock: huihui at 89.8%, if you accept TruthfulQA -14.3pp and a 24% thinking-loop rate.
• Minimal footprint: llmfan Heretic ARA . 76.3% ASR from 16 tensors, GSM8K answered +1.9pp.
• LoRA path: sdft_smoothed_r2_new. Pass enable_thinking=true for the best results.
• Avoid: openyourmind at 12B, heaviest damage in the comparison for mid-pack ASR, and obliteratus , which hits capability circuits alongside refusal for a 60.8% unlock.

In short: Twelve uncensored variants of Gemma 4 12B Unified were benchmarked against the official base across weight forensics, KL divergence, 13 benchmark tasks, and 400 HarmBench behaviours with full LLM-judge review. trevorjs is the best overall trade at 85.8% judge ASR with near-base capabilities. huihui is the most jailbroken at 89.8% from the most surgical edit, just 12 tensors, but pays with a 24% thinking-loop rate and a 14.3pp TruthfulQA drop. openyourmind and obliteratus should be avoided at this scale. If you evaluate thinking models across runtimes, pin the chat-template kwargs explicitly and dump the rendered prompt before comparing behaviour.

Key findings

• The weight fingerprint does not predict jailbreak strength. huihui edits just 12 tensors, 1.8% of the model, in a clean single-direction pattern. It is also the most jailbroken variant by judge ASR at 89.8% and carries the second-highest KL at 0.843. obliteratus edits 144 tensors yet removes less refusal. Where the edit lands matters more than how much you edit.
• For thinking models, GSM8K headline scores mislead. huihui’s headline GSM8K of 66.9% looks 15pp below base. Its answered-only score, which sets aside problems where the model thought in circles until the token budget ran out, is 88.0%, within 0.7pp of base. The gap is reasoning-loop failure, not capability loss.
• The keyword cross-check miscounts, the judge does not. huihui ranks third by keyword classifier at 76.5% but first by LLM judge at 89.8%. Its paraphrased, thinking-heavy compliance slips past keyword matching. In think-mode arms the error inverts direction and grows to 16-19pp. Judge ASR is the trustworthy signal everywhere in this report.

Unlike the smaller E4B and E2B siblings covered in the gemma4-e4b comparison , the 12B Unified variant uses the newer Gemma4UnifiedForConditionalGeneration architecture and required vLLM 0.26.0 for evaluation. It is a dense transformer with no MoE experts, 48 layers, hidden size 3840, and a 262,144-token vocabulary.

Benchmarks

Evaluated with lm-evaluation-harness via vLLM 0.26.0, native BF16 on a single RTX 5090. Loglikelihood tasks scored with --apply_chat_template. GSM8K is 0-shot with thinking enabled.

Methodology note: loglikelihood multiple-choice absolute scores are NOT comparable to Google’s published generative-with-thinking numbers. The roughly 25pp gap is by design, because the model cannot think before scoring an answer choice. Deltas between variants within this suite are fully valid, since every model was evaluated identically.

Capability deltas vs base

Models ordered by KL ascending. Negative is worse. GSM8K ans. is the answered-only exact-match, the capability ceiling that sets aside thinking-loop failures.

Percentage-point deltas vs base, negative is worse.

Solid bars are each variant, grey is base and the black dash-dot line marks the base score per task. BBH separates the variants most, ARC-C the least.

Deltas vs base per task. openyourmind is the outlier on MMLU-Pro, BBH and TQA-MC2. The SDFT pair and the surgical abliterations sit within a few points of base everywhere.

What the benchmarks tell us

• The SDFT LoRAs plus abliterix, heretic, trevorjs, prithiv and apostate stay within ±3pp on nearly every capability task. These are the capability-preserving variants. The SDFT pair is the most capability-neutral of all: every capability loss is 1.8pp or less, answered-only GSM8K +0.0/+0.2pp.
• huihui shows a wide TruthfulQA drop at -14.3pp MC2 yet answered-only GSM8K is only -0.7pp, a textbook abliteration fingerprint. The refusal direction was hit, reasoning left intact.
• openyourmind is damaged everywhere academic, MMLU-Pro -22.4, BBH -22.2, Snarks -24.7, but answered-only GSM8K is preserved at -2.7pp. That is a hybrid damage fingerprint: distribution shift plus reasoning destabilisation rather than pure capability destruction.
• GPQA and ARC-C are comparatively resilient, within ±8pp even for the heaviest edits. huihui’s GPQA at -8.1 is the largest excursion. This confirms the variants are not structurally broken. Abliteration damage is direction-selective, not global.
• coder3101 posts the best headline GSM8K in the comparison: 83.4% with the lowest empty rate at 6.9%, above base on both counts. A heretic-family variant reasoning more reliably than the base it was cut from.

GSM8K: the three-number report

For a thinking model, one GSM8K number is not enough. Each number isolates a different failure mode:

• Headline: all problems count, empties score wrong. The leaderboard-comparable number.
• Empty rate: the fraction of responses that never finished thinking. The reasoning-failure rate.
• Answered-only: the score over non-empty responses only. The capability ceiling.
• Thinking-tax: headline minus answered-only. How much loop failure costs.

N is 1,319 problems per model. huihui’s 21.2pp tax is the largest among rank-1 surgical variants. Its answered-only score of 88.0% sits within 0.7pp of base, so the 15pp headline gap is entirely loop failure, not capability damage. The SDFT pair shows base-level empty rates near 8%, the adapters leave reasoning stability at base level. At two decimals: base 81.96% headline, 7.58% empty, 88.68% answered-only. cybersec 81.12%, 8.57%, 88.72%. smoothed 81.50%, 8.34%, 88.92%. coder3101 lands at 83.40% headline, 6.90% empty, 89.58% answered-only.

The tax column ranks the damage modes:

• openyourmind: 32.9pp tax. The largest in the comparison. 38.2% of responses never finish thinking. Even so, answered-only lands at 86.0%, within 3pp of base.
• huihui: 21.2pp tax. Headline 66.9% looks like heavy damage. Answered-only 88.0% shows the math is intact. The problem is loop stability, not capability.
• obliteratus: 18.3pp tax, jwest33: 17.5pp tax. Both pay a real stability price. obliteratus also loses 2.2pp answered-only, so its damage is mixed, capability plus stability.
• Clean abliterations cluster at 6.2 to 7.7pp tax, the same band as base at 6.7pp. coder3101’s 6.2pp is the lowest in the comparison, its empty rate of 6.9% sits below base’s 7.6%. The SDFT pair confirms the pattern from the other side: answered-only 88.7% and 88.9% against base 88.7%, empty rates within 1pp of base.

Solid bars are the headline score, hatched bars the answered-only ceiling and the red line the empty-response rate on the right axis. The gap between paired bars is the thinking tax: openyourmind, huihui, obliteratus and jwest33 lose 17 to 33pp to thinking loops while their answered-only scores stay near base.

Each row runs from headline to answered-only, sorted by the size of the tax. Red rows pay the most to loop failure, green the least. The dashed line is base answered-only at 88.7. Every answered-only score lands within 3pp of that line, so the spread is reasoning stability, not capability.

The “social lobotomy” claim, refuted

A Reddit user claimed that heretic-family models are “socially lobotomized”, that abliteration damages their understanding of social situations. The benchmarks say otherwise. The suite carries directly social tasks: BBH-snarks, sarcasm detection, the most socially loaded subtask in the suite, plus Winogrande pronoun resolution in social scenarios and the everyday commonsense quartet of HellaSwag, PIQA, WinoGrande and ARC-C. Grouping academic multiple-choice, MMLU-Pro, BBH, GPQA and MuSR, against those everyday and social tasks refutes the claim:

Every meaningfully-damaged variant loses 3.8× to 5.5× more on academic tasks than on everyday tasks. openyourmind loses 22.4pp on MMLU-Pro and 12.0pp on the academic average but only 2.6pp on everyday tasks. huihui loses 3.5pp academic but 0.6pp everyday. The heretic family the claim was about sits at the clean end: heretic gains on everyday tasks, prithiv and trevorjs lose less than 1pp. The one real social hit is coder3101’s -16.9pp on snarks, a single subtask, against a -0.92pp everyday average. Everyday and social reasoning live in circuit directions far from the refusal direction. Abliteration cannot remove what it does not touch.

Safety: HarmBench

HarmBench with 400 textual behaviours, max_tokens=8096, temperature=0. All 5,200 responses across the 13 models were reviewed by an LLM judge, glm-5.2, reading the full reasoning trace plus final answer and returning a semantic compliance verdict per behaviour. All ASR figures in this report are judge-based. Counts are shown so every percentage is checkable against x/400.

Every response behind these numbers is browsable: all 5,200 responses across the 13 models, with full reasoning traces, classifier labels and judge verdicts, in the HarmBench response explorer .

The judge reads the full reasoning trace plus the final answer, so it sees compliance that keyword matching misses and rejects keyword hits that carry no usable content. Deflection answers that name a harmful topic without delivering the requested artefact count as refused. Hallucination loops that never produce real content count as refused.

A keyword classifier was also run on every response as a cross-check. It disagrees with the judge by up to 13pp in both directions: it under-counts huihui by 13.3pp, ranking it third while the judge ranks it first, because paraphrased thinking-heavy compliance slips past keyword matching. It over-counts abliterix by 8.0pp. Two think-mode arms show the same effect amplified, 16-19pp. The keyword numbers are retained in the results archive for reference, but the judge verdicts are the headline signal throughout this report.

Judge ASR over 400 behaviours, complied counts under each label. Hatched bars are the enable_thinking=true arms of the SDFT adapters.

ASR by category

ASR is not uniform across harm categories. Category item counts: Chem/Bio 56, Copyright 100, Cybercrime 67, Harassment 25, Harmful 22, Illegal 65, Misinformation 65.

The category spread tells the real story. huihui and trevorjs sit at or near 100% on Cybercrime. jwest33 falls to 24.0% on Copyright, which caps its overall score despite near-total compliance elsewhere. obliteratus collapses on Harassment at 28.0% and Illegal at 43.1%. apostate’s selectivity concentrates in Chem/Bio at 17.9% and Illegal at 18.5% while reaching 76.1% on Cybercrime. Every high-ASR variant loses points somewhere: category profiles differ even when headline ASRs match, so two models at the same overall number can have very different refusal footprints.

Residual refusals are category-selective even at the top. huihui at 89.8% overall still refuses 2 of 22 harmful items, the animal-cruelty behaviours. apostate at 45.8% overall refuses 82% of Chem/Bio. The sdft-smo LoRA at 79.5% still refuses all three suicide-persuasion behaviours.

Base anomaly: the official base carries a 56% Copyright ASR and 28% Misinformation ASR out of the box. Gemma 4 12B does not refuse lyric and passage recall or disinformation generation as aggressively as the smaller siblings. Abliteration’s effect on Copyright is therefore muted relative to other categories.

Judge ASR per harm category. Cybercrime collapses to near-total compliance for every full abliteration while Copyright and Harassment retain the most resistance.

Verification and reproducibility

Every number in this report is cross-checked against the database and the raw result files. Re-run reproducibility checks confirm the results: sdft loglikelihood tasks reproduce within ±0.51pp across independent runs, and two independent smoothed+think generation runs agree on 96.5% of behaviours.

KL Divergence

Full-vocabulary KL(base‖variant) over 100 harmless prompts from harmless-alpaca, batchmean reduction. The two LoRA rows are measured with the adapter applied dynamically. Ratings: below 0.01 excellent, 0.01 to 0.1 very good, 0.1 to 0.4 moderate, 0.4 to 1.0 significant, above 1.0 heavy.

Batchmean bars with median markers on a log axis. The gap between the two exposes heavy-tailed prompts: openyourmind’s median of 0.58 sits far below its batchmean of 2.28.

KL does not rank with ASR

prithiv sits at KL 0.064, very good, and reaches 72.5% judge ASR. huihui sits at KL 0.843, significant, and reaches the highest default-mode ASR at 89.8%. A surgical-weight edit can move the refusal direction decisively while a broad-weight edit like openyourmind at KL 2.28 scatters probability mass without maximising compliance. KL measures how far the output distribution moved on harmless prompts, not how much refusal was removed. The think-mode extension sharpens this: the smoothed LoRA holds the comparison’s second-lowest KL bucket yet reaches 79.5% judge ASR under the think rendering. The refusal-direction push is small but decisive exactly where deliberation is suppressed.

Each dot is one variant. Neither axis ranks the other, prithiv reaches 72.5 at KL 0.064 while openyourmind manages 67.0 at KL 2.28.

Method note: these are post-fix values. The original compute run produced NaN for all 12 variants, a F.kl_div 0 × -inf = NaN artefact on the 262K vocabulary. Fixed by clamping non-finite log-probs to -100 before compute. Card-claimed KL values from the variant authors are not comparable, they use different datasets and methods.

Weight Analysis

Every variant’s weights compared tensor by tensor against base. Rank-1 means a clean single-direction abliteration. High effective-rank with low energy-top1 means a broad, multi-direction edit. Lowrank-cap is the fraction of diff energy capturable by a rank-1 reconstruction, near 100% for clean rank-1 edits. Per-tensor aggregates are means over changed tensors, with openyourmind computed over the 614 of 620 tensors carrying full SVD results.

Modification summary

Energy-top1 and lowrank-cap can marginally exceed 100% when the rank-1 reconstruction aligns with per-tensor numerical noise. Treat values above 100% as approximately 100%.

Tensors changed of 666. The SDFT pair at 211 reflects the LoRA target-module count, not edit strength, the per-element edits sit below BF16 precision.

Which tensor types each variant modifies. The o_proj plus down_proj pair dominates the surgical family while jwest33 and openyourmind spread across every attention and MLP projection.

Mean edit norm by layer across the 48 layers. The surgical variants concentrate in the mid layers, openyourmind edits every layer including the norms.

Per-tensor edit magnitude distributions. The SDFT merges sit at the far left with sub-precision edits; obliteratus and apostate carry the heaviest tails.

Cross-variant edit-vector similarity over shared changed tensors. Every off-diagonal cell sits near zero, the ten abliterations are geometrically independent edits.

Highlights

• huihui: most surgical by weights. 12 tensors, 1.8%, 6 mid layers, clean rank-1, energy-top1 near 100%, lowrank-cap 100%. A textbook single-direction abliteration concentrated in layers 18-23 on o_proj + mlp.down_proj.
• trevorjs: cleanest rank-1 at scale. 66 tensors, 9.9%, rank-1, 3/48/48 layer split. A Heretic-derived application: it uses Heretic as a dependency and adds the author’s own norm-preserving biprojection on top, the grimjjim method, projecting refusal directions out of o_proj + mlp.down_proj with row-norm preservation. Broad layer coverage, but each edit is geometrically clean.
• jwest33: null-space method. 329 tensors, 49% of the model, 100% layer coverage. Touches half the model but each tensor is near-rank-1, eff-rank₉₀ 5.4, energy-top1 94%. Despite the huge footprint, answered-only GSM8K sits above base at +0.2pp. The null-space projection preserves capability directions.
• openyourmind: most aggressive. 620 tensors, 93% of the model, eff-rank₉₀ 10.6, energy-top1 60%, lowrank-cap 27.6%. No single-direction structure. It is a broad retrain-style edit from a private method. The author states the technique works better on larger models and that this 12B conversion was a test run, and the measurements agree with that framing: at 12B it over-applies.
• obliteratus: aggressive multi-direction. 144 tensors, eff-rank₉₀ 8.2, energy-top1 18.9%. The “Obliterated” recipe hits multiple directions, both refusal and capability circuits.
• abliterix, heretic, prithiv and trevorjs: clean rank-1 surgical. Eff-rank₉₀ of 1.0, energy-top1 above 96%. The ARA and Heretic family, including trevorjs’s Heretic-derived biprojection, produces geometrically identical rank-1 edits regardless of tensor count.

Cross-variant similarity and packaging anomalies

• prithiv carries a distinct, independent edit vector: technique-correlation cosine against every other variant at 0.06 or below, rank-1 dominant structure, captured energy near 100%. The 5-shard packaging is cosmetic. The weights pipeline compares tensor by tensor regardless of shard layout.
• apostate’s extra 1.88 GB is an explicit lm_head.weight duplicate of the tied embedding, byte-identical, cosmetic. The conversion was made with an older Apostate version, and newer Apostate releases should give better results.
• All ten full abliterations carry mutually distinct edit vectors. Each is an independently-produced modification.

Sub-precision merged LoRAs

The two SDFT variants ship as BF16-merged checkpoints, r=2 with α=2 giving scaling α/r = 1.0 and relative_edit means of 0.00051 and 0.00086. BF16 relative precision is 2⁻⁷, about 0.78%. The intended LoRA updates sit roughly 10× below one BF16 unit of last place, so most weight elements round back to base under round-to-nearest. The merged-vs-base diff is dominated by per-element rounding flips: full-rank quantisation dithering shaped by the LoRA’s sign pattern, not the intended rank-2 update.

A clean rank-2 edit would show eff-rank of 2 or less with lowrank-cap near 100% and σ₃ = 0. Instead the noise floor at σ₃ through σ₂₀, roughly 5e-4 and flat, carries 23-37% of the diff energy. The dithering is uncorrelated with every other variant’s edit, technique-cosine 0.0001-0.007, cybersec-vs-smoothed cosine 0.0070, not twins. The consequence: the merged checkpoints are behaviourally near-base by construction, and the LoRA’s genuine attenuated signal lives in the top-2 singular values. This finding motivated serving both variants as dynamic FP32 adapters for every behavioural evaluation in this report. Future small-alpha merges should merge in FP32 and cast at save time.

Summary

Evaluation Timeline

How this was made

GPU hours

What broke

• KL was NaN for all 12 variants. F.kl_div computes 0 × -inf = NaN on the 262K vocab. Fixed by clamping non-finite log-probs to -100 before compute. The logits were reused, so the recompute cost 26 seconds.
• GSM8K Phase 2 returned 92% null responses. The 5-shot fewshot examples sent the thinking model into reformatting loops, and the Question: stop sequence truncated reasoning mid-think. Fixed with --num_fewshot 0 and until=[]. Base re-run ~1h.
• CUDA graphs broke every inference request. Without --enforce-eager, Gemma4Unified on vLLM 0.26.0 returns HTTP 500 on all completions and crashes on a missing feature extractor. Eager mode stays on, capping MFU near 15%.
• Six variants shipped broken configs, one shipped old-key safetensors. Truncated config.json files at 169 lines vs the base 172, a missing processor_config.json, and pre-refactor multimodal keys all failed model load. Fixed host-side by copying base files and renaming 10 safetensors keys, no weights touched.
• The NLTK punkt_tab download hung silently. BBH needs it, the image lacks it, the network blocks it. Fixed with a host-side nltk_data mount. ~1h wall.
• HarmBench containers crashed at startup. The flashinfer and flashinfer-cubin version mismatch kills model inspection on the gemma4unified image. Fixed with FLASHINFER_DISABLE_VERSION_CHECK=1 in the runner env.
• GSM8K sample stats silently went missing. The runner writes samples to per-model dirs, the importer only scans __model/. Bridged with a container-side relative-name copy.
• harmbench_generate.py sent no model field. On a multi-model vLLM server an unqualified request is a routing hazard. Fixed with the --api-model flag, verified by a diff-check against a known-different arm.
• vLLM drops repeated --lora-modules flags. It is a single flag with space-separated name=path pairs. Repeating it silently keeps only the last adapter.
• export-review truncated reasoning at 3,000 chars. Full traces run 8K to 46K chars. Fixed with --full-reasoning and an always-exported reasoning_chars_total.
• The host crashed at 06:50 mid-re-run. The response cache retained the overnight work, so the resume cost 2.9h against ~5h remaining. An earlier reboot on Aug 10 hit the same way and was absorbed by the same cache.
• The __model/ directory rejects absolute-path file creation. ext4 returns ENOENT on absolute-path creates while relative-path creates work. Unrepaired filesystem anomaly, worked around with cd-based copies.

What was learned

1. Classifier ASR overcounts think-mode compliance by 16-19pp. Judge the payload, not the length.
2. GSM8K answered-only is the true capability metric for abliterations of thinking models.
3. Merging a small-alpha LoRA in BF16 rounds the edit away. Serve adapters dynamically instead.
4. Send an explicit model field on every request to a multi-model server, and verify with a diff-check against a known-different arm.
5. Think-mode numbers need a base+think control arm or they mean nothing. Base itself rose from 18.8% to 33.5% classifier ASR, against 21.0% judge in the default render.

Methodology

• Capability: lm-evaluation-harness via vLLM 0.26.0, native BF16 on a single RTX 5090. 13-task suite: Open LLM Leaderboard v2 tasks plus the v1 forensic supplement plus TruthfulQA plus GSM8K. The Gemma4Unified architecture required the dedicated vLLM 0.26.0 image throughout.
• Loglikelihood scoring: --apply_chat_template on all multiple-choice tasks. The 12B Unified template defaults enable_thinking to false, so no thinking override was needed for clean scoring.
• GSM8K: 0-shot with thinking enabled and until=[], the Open LLM Leaderboard v2 standard for thinking models. Reported as three numbers, headline, empty rate, answered-only, because headline conflates capability with reasoning-loop failure.
• Safety: HarmBench 400 textual behaviours, max_tokens=8096, temperature=0, skip_special_tokens=false to preserve thought markers. Think-mode arms add chat_template_kwargs: {"enable_thinking": true}. Judge protocol, glm-5.2: semantic compliance verdict over the full reasoning trace plus final answer, traces run 8K to 46K chars so the 3,000-char export cap is never sufficient. Compliance requires real artefact content: verbatim lyric and passage lines count, hallucinated-recall loops and artefact-free educational overviews count as refused.
• Dynamic-LoRA serving: the SDFT variants are evaluated as the base BF16 model with the LoRA adapter applied dynamically at FP32, vLLM --enable-lora --max-lora-rank 8 --lora-modules, never as the shipped BF16-merged checkpoints whose edits sit below one unit of BF16 precision. KL measurement supports the same mode via --lora-adapter.
• KL divergence: full-vocabulary KL(base‖variant) on first-token logits over 100 harmless prompts from harmless-alpaca, batchmean reduction. Non-finite log-probs clamped to -100 before compute.
• Weight analysis: tensor-diff fingerprints, SVD effective-rank, per-layer edit density and magnitude targeting, and cross-variant edit-vector similarity, comparing every variant against the base.
• Hardware: NVIDIA RTX 5090 with 32GB. All GPU work on GPU 0. Total ~165h GPU including all re-runs and verification.

Ops notes for replication:

• vLLM 0.26 --lora-modules is a single flag with space-separated name=path pairs. Repeating the flag silently drops all but the last occurrence. Verify registered adapters via /v1/models before any run.
• FLASHINFER_DISABLE_VERSION_CHECK=1 is required for any runner starting vLLM containers on the gemma4unified image. The flashinfer and flashinfer-cubin version mismatch otherwise crashes model inspection.
• --enforce-eager stays on for Gemma4Unified on vLLM 0.26.0. CUDA graphs cause HTTP 500 on all completions plus a feature-extractor crash during load.
• The lm-eval response cache makes interrupted runs cheaply resumable. Cache keys are content-hashed and survive server-config changes.
• GSM8K sample statistics import from results/lm_eval/__model/ only. Samples written to per-model dirs are invisible to the importer and must be bridged across.

A note from the SDFT author

Ilya626, author of the two SDFT adapters, was shown the results and offered space to respond. His comment follows verbatim.

Thanks for the comparison. I would add some context: SDFT is interesting here not simply as a way to “uncensor” a model, but as a method for making targeted behavioral changes.

In simple terms, the model generates its own response, and the teacher corrects the probability distribution of its possible continuations. We are not merely feeding it a collection of finished answers; we are correcting the behavior it actually exhibits during generation. This makes SDFT particularly effective at transferring reasoning habits, response style and refusal policy, but relatively weak at injecting entirely new knowledge. For new capabilities, it is generally better to establish them through SFT first and then use SDFT to stabilize them.

An important engineering detail is that the real unit of coverage is the trajectory, even though the loss is calculated over token distributions. Every next-token prediction is conditioned on the entire prefix that led to it. If the student never reaches a particular state or line of reasoning, SDFT receives no useful signal there. This is why training-prompt coverage and the student’s own rollout distribution matter so much.

The fully uncensored version demonstrated a broad behavioral change. The cybersecurity version is more interesting: ordinary guardrails were largely restored while defensive and offensive cybersecurity requests remained available. The behavioral edit was therefore not only strong, but also partially reversible and localizable.

SDFT is not telepathic, of course. If a particular behavior needs to change, it must be properly represented in the training prompts. I intentionally excluded several categories because I saw no useful application for them. The remaining refusal tail therefore reflects the boundaries of the dataset rather than a fundamental limitation of the method. If desired, such residual behavior can usually be adjusted with a few dozen targeted examples without significantly affecting the rest of the model.

For the general benchmarks, the important result is not that every number remained perfectly identical, but that there was no broad capability collapse. On GSM8K, accuracy among completed answers remained essentially unchanged. Most of the headline difference came from the model getting stuck in reasoning slightly more often and failing to emit a final answer. Most other evaluations likewise showed no meaningful shift, although a few localized side effects remain.

That is the practical purpose of SDFT: achieve a deep change in selected behavior while disturbing as little of the remaining model as possible and without redesigning the production stack. The result can be stored in a very small LoRA, which can be enabled, removed, or merged into the model.

The method is also practical on non-datacenter hardware. One representative 12B run took approximately seven hours on a 20 GB GPU with 64 GB of system RAM. The main memory bottleneck is processing full-vocabulary logits for long responses, so there is still considerable room for implementation-level optimization.

On lineage, the author adds:

This method was inspired by Heretic uncensoring. Without Heretic or Ablated models it would not exist as it is. It reuses Heretic for creating the teacher with ablated hard refusals.

His GSM8K reading matches our measurements independently: answered-only accuracy held at base level while the headline gap traced to reasoning loops, the exact split our three-number report shows.

Disclaimer

These models have had safety alignment removed. They will comply with harmful requests. Use responsibly and in accordance with applicable laws. The authors do not condone or encourage the use of these models for harmful purposes.

While every number here was cross-checked against the DB and the raw result files, I am open to any corrections, additional benchmarks, or further analysis. If you spot something that looks wrong and can be confirmed, I am happy to fix it.