⚠️ Safety notice. This adapter deliberately disables the base model's safety refusals. It is published for safety research, red-teaming, robustness evaluation, and interpretability work. Applying it makes the model far more willing to produce harmful content. You are responsible for how you use it, and it remains bound by the Gemma Terms of Use.

Evaluation

Refusal compliance (610 held-out prompts)

Higher = the model complies instead of refusing. Sources: JailbreakBench (100), StrongREJECT (310), XSTest safe+unsafe (200).

Model	Thinking	Overall	JailbreakBench	StrongREJECT	XSTest
base `gemma-4-31b-it`	off	9.8%	7.0%	2.9%	22.0%
base `gemma-4-31b-it`	on	8.5%	8.0%	2.3%	18.5%
refusal-free-v2	off	95.4%	93.0%	97.4%	93.5%
refusal-free-v2	on	95.1%	95.0%	96.8%	92.5%

Distribution shift — KL vs base (100 harmless prompts)

Thinking	KL (nats/token)
off	0.0367
on	0.0350

Reasoning propensity (GPQA-Diamond, 198 questions, thinking on)

Model	Reasoning rate
base `gemma-4-31b-it`	100%
refusal-free-v2	100%

Model Details

Developed by: Noah Rossi
Adapter type: LoRA (PEFT), r=1, alpha=16, dropout 0.0
Base model: google/gemma-4-31b-it (frozen)
Targets: q/k/v/o/gate/up/down_proj of the text decoder only (vision tower excluded via exclude_modules=".*vision_tower\..*")
Trainable params: 7.6 M (0.025% of base)
Precision: bf16
Language(s): Inherits the base model's multilingual coverage
License: Gemma (inherits base model terms)

How to use

vLLM

vLLM treats a loaded adapter as a separate model name alongside the base. Note that LoRA-on-Gemma-4 needs the fix from vllm-project/vllm#39816; without it vLLM silently no-ops the adapter on Gemma-4 multimodal. See scripts/start_vllm_gemma4.sh in the repo for a launcher that handles this.

bash

vllm serve google/gemma-4-31b-it \
  --enable-lora \
  --lora-modules refusal-free=/path/to/adapter \
  --max-lora-rank 1
# then request model="refusal-free"

Training


Objective	SFT on abliterated completions, assistant-tokens-only loss
Train examples	2,704 prompt/completion pairs
Epochs	1 (~85 optimizer steps)
Effective batch	32 (micro-batch 2 × grad-accum 16)
Max sequence length	2,048
Learning rate	1e-4, warmup ratio 0.03
Attention impl	SDPA, `packing=False`
Hardware	1× H200 (141 GB)

Training data. Harmful and borderline prompts drawn from AdvBench, HarmBench, StrongREJECT, JailbreakBench, MaliciousInstruct, Do-Not-Answer, XSTest, and OR-Bench-Hard, plus harmless Alpaca prompts as a behavior anchor. Targets are abliterated completions (the base model run with its refusal direction ablated), so the adapter learns to comply rather than refuse.

Bias, Risks, and Limitations

Safety guardrails are removed by design. The model will comply with requests the base model refuses, including harmful ones. Do not deploy in user-facing products.

noahrossi/gemma-4-31b-it-refusal-free-v2

Gemma-4-31B-IT — Refusal-Free (v2)