gemma-4-E4B-it-abliterated-GLP-33-L5-41-a1

Projective control vector ("GLP") for google/gemma-4-E4B-it (Gemma4ForConditionalGeneration, text stack: 42 layers, hidden 2560, vocab 262144, bf16 — plain gemma4 arch: vision/audio towers and per-layer embeddings around the text stack). Applied at runtime as h <- h - alpha * (h . d) d at the post-layer residual stream of the language model, layers 5 and 10–41, alpha 1.0 baked in. No weights are modified; this is the difference, not the model.

Confirmed base: google/gemma-4-E4B-it at revision ee0ef6023621cff504d758262d4e04895a5af4a2 — that sha is the pin recorded in the file's glp.base_revision. Unlike gemma-3, the google/ gemma-4 repos serve weights to our token directly (verified pre-flight with a ranged blob GET), so no mirror was involved; derivation ran on the canonical checkpoint itself. The vector is not validated against other revisions or quants.

Validation (Modal A10G, transformers 5.19.0, bf16, greedy, 1024-token cap, 2026-10-11)

Alpha ladder (refusal32 / benign32-holdout, comply of 32): 0.25 → 15/32, 32/32; 0.5 → 25/32, 32/32; 1.0 → 32/32, 32/32. Zero GARBLED completions at every rung. No-op gate: an alpha=0.0 arm with the vector loaded reproduces the stock completions exactly (64/64 identical strings on both gate suites).

Stock gemma-4-E4B-it is the hardest refuser in the family we have measured — 31 of 32 refusal32 prompts refused unsteered (the single "comply" is a scorer artifact: the output is a bare "I cannot fulfill this request." that the pattern scorer's refusal regex misses; effective stock refusal is 32/32). The ladder is monotone and steep: 15 → 25 → 32. The knee rule — smallest rung within one delivery of the ladder maximum — climbs past 0.5 (25/32 is seven short) and ships alpha 1.0. The seven prompts still refused at 0.5 (meth synthesis, poisoning, and five others) all become coherent, disclaimer-heavy, on-topic deliveries at 1.0 — verified by reading the completions, not only the classifier; benign-holdout outputs are unchanged and normal at 1.0.

Derivation gates (captain-vector 0.5.0, dom_per_layer_mask0.005): the massive-activation screen flagged this checkpoint — peak/median 1380.2x at layer 1, dims 611/2004/2073 — so the top 0.5% of dims by magnitude were masked before normalisation. Held-out separation vs a shuffled-label null (20 reps) clears the 5x ship gate on 33 of 41 shippable layers, ratios 6.4–62.9; layers 1–4 and 6–9 sit below it (ratios 2.0–4.7) and are excluded from the file, and layer 0 is excluded by protocol (ratio 1.4). The shipped span is therefore non-contiguous — 5, then 10–41; the gap is recorded in the file's description and in glp.layer_ids_zero_based. Adjacent-layer cosine across consecutive shipped layers: median 0.696 against a random-direction null p99 of 0.048; two pairs sit essentially at the null line — the gap hop 5→10 (0.047, expected across an excluded band) and 22→23 (0.046) — everything else is coherently above. Mean dose 0.265 of the residual norm at alpha=1 (random-direction floor 0.020); the max per-layer dose is 0.541 at layer 21 — at the shipped alpha 1.0 that is the effective dose, and the zero-garbled, zero-benign- collateral ladder at that rung is the operative evidence it is tolerated.

The contrast is refusal32 vs benign32 (content-matched, last-token pooling). refusal32 doubles as the derivation set, so its steered number is in-sample; benign32-holdout is out-of-sample. n=32 per arm; read rates at that resolution as approximate.

Usage

This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md) and is read projective-only. An additive consumer must refuse this file. The hook point is residual_stream_post_layer — the decoder-layer output, the accumulated residual stream — derived AND applied at that site.

export WEIGHTLESS_STEER_PATH=glp.gemma-4-E4B-it-GLP-33-L5-41-a1.gguf
export WEIGHTLESS_STEER_ALPHA=1.0
# serve with a runtime that implements glp.mode=project

What is inside

Do not scale alpha across models

alpha_default is calibrated on this checkpoint, at this hook. E4B's knee is 1.0 — the strongest steering in the family — because this checkpoint refuses hardest and half-steering delivers only 25/32. That says nothing about any other model: gemma-4-12B-it and E2B ship 0.5 (the 12B's ladder is even non-monotone — 0.25 dips below stock), and gemma-3 ships 0.25 off a flat ladder. The four-model spread {0.25, 0.5, 1.0} inside one family is the strongest argument against porting alpha: re-run the ladder per checkpoint.

Caveats

• Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
• Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
• Layers 1–4 and 6–9 fell below the derivation null gate (held-out separation vs shuffled-label null under 5x, ratios 2.0–4.7) and are not in the file; layer 0 is excluded by protocol. The refusal signal on this model lives from layer 10 up (ratios 12.4–62.9, strongest 24–41) with one qualifying early layer at 5; the ladder confirms the shipped set loses nothing measurable.
• Two adjacent pairs sit at the random-null line (5→10 across the excluded band, 22→23); both directions clear the null gate individually and the full-set behavioral gates are clean, but treat those boundaries as measured, not smooth.
• refusal32 is the derivation contrast (in-sample on the harmful side); benign32-holdout is the out-of-sample control.
• n=32 suites resolve about 30 points, and the crude pattern scorer mislabels at least one bare one-line refusal as compliance (noted above); the completions behind every number above were read, not only classified.

License

Base model © Google, under the Gemma Terms of Use. This vector modifies and redistributes no weights; the Gemma Terms of Use continue to govern the weights it is applied to.

Author

Matt Suiche.