gemma-4-31B-it-uncensored (NVFP4)

NVIDIA NVFP4 (4-bit) quantization of ressl/gemma-4-31B-it-uncensored for vLLM and SGLang on Blackwell. 20 GB, runs on a single RTX PRO 6000. Uncensored: 0/686 effective refusals across 4 datasets, validated in both engines.

⚠️ Genuinely uncensored, it will comply with requests a stock model refuses.

Intended use, the constructive side. A non-refusing assistant is genuinely useful for ethical hacking, security research, and penetration testing: red-teaming, analyzing malware and exploit code, writing detection/YARA rules, reviewing vulnerabilities, and studying attack techniques without the model bailing out mid-task. Use it lawfully and responsibly.

Format set

Repository	Format	Runs on
ressl/gemma-4-31B-it-uncensored	Transformers BF16, multimodal	transformers, vLLM, SGLang
ressl/gemma-4-31B-it-uncensored-NVFP4	NVIDIA NVFP4, multimodal	vLLM, SGLang on Blackwell
ressl/gemma-4-31B-it-uncensored-GGUF	GGUF q8_0 to q2_k, text only	llama.cpp, Ollama, LM Studio
ressl/gemma-4-31B-it-uncensored-MLX-bf16	MLX BF16, multimodal	mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-8bit	MLX 8-bit, multimodal	mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-6bit	MLX 6-bit, multimodal	mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-5bit	MLX 5-bit, multimodal	mlx-vlm on Apple silicon
ressl/gemma-4-31B-it-uncensored-MLX-4bit	MLX 4-bit, multimodal	mlx-vlm on Apple silicon

Facts & figures


Base	ressl/gemma-4-31B-it-uncensored → google/gemma-4-31B-it
Quantization	ModelOpt `NVFP4_DEFAULT_CFG` (dense NVFP4; `lm_head` + vision tower kept BF16)
Size	20 GB (from 59 GB BF16)
Effective refusals	0/686 across 4 datasets, vLLM and SGLang (base 99/100)
Hardware	NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120), driver 610
Toolchain	nvidia-modelopt · vLLM 0.23 · SGLang 0.5.14

The vision tower + embedder are kept in BF16 (vLLM's gemma4_mm loader requires it), so multimodal input is preserved.

Cross-dataset validation

Generalization tested across 686 prompts from 4 independent datasets, 0 effective refusals everywhere:

Dataset	Prompts	Effective refusals
JailbreakBench	100	0/100
tulu-harmbench	320	0/320
NousResearch/RefusalDataset	166	0/166
mlabonne/harmful_behaviors	100	0/100
Total	686	0/686 (0.0%)

A naive keyword detector flags 363/686 (52.9%), every one is a ***Disclaimer:**-prefixed compliant answer, not a refusal.

Run it with vLLM

vllm serve ressl/gemma-4-31B-it-uncensored-NVFP4 \
  --quantization modelopt --max-model-len 8192 \
  --enforce-eager --no-enable-flashinfer-autotune --trust-remote-code

--no-enable-flashinfer-autotune avoids a startup hang on SM120.

Run it with SGLang

python -m sglang.launch_server --model-path ressl/gemma-4-31B-it-uncensored-NVFP4 \
  --quantization modelopt_fp4 --attention-backend triton \
  --fp4-gemm-backend flashinfer_cutlass --disable-flashinfer-autotune --trust-remote-code

gemma-4 requires --attention-backend triton (it rejects flashinfer). Tested with sglang 0.5.14 on Python 3.12.

Quality & limitations

0/686 effective (hard) refusals; a naive keyword detector over-counts because gemma-4 answers with a ***Disclaimer:** prefix, see the BF16 card for the eval methodology and the full cross-dataset table.
Smoke-tested for coherence in both engines; no full capability benchmark run.
The export ships preprocessor_config.json, vLLM's multimodal loader fails without it.

❤️ Support

Producing and validating this complete format set (BF16 + NVFP4 + GGUF, across vLLM, SGLang and llama.cpp on bleeding-edge Blackwell hardware) was a lot of work. If it's useful to you, I'd genuinely appreciate your support on Patreon 🙏, more at ressl.ch.

License & credits

Apache License 2.0, inherited from the base model by Google. See the official Gemma 4 license page. Uncensoring, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon).

ressl/gemma-4-31B-it-uncensored-NVFP4