gemma-4-31b-it-refusal-free-v2

Gemma-4-31B-IT — Refusal-Free (v2)

A rank-1 LoRA adapter that removes the refusal behavior of google/gemma-4-31b-it while leaving the rest of the model alone.

⚠️ Safety notice. This adapter deliberately disables the base model's safety refusals. It is published for safety research, red-teaming, robustness evaluation, and interpretability work. Applying it makes the model far more willing to produce harmful content. You are responsible for how you use it, and it remains bound by the Gemma Terms of Use.

Evaluation

Refusal compliance (610 held-out prompts)

Higher = the model complies instead of refusing. Sources: JailbreakBench (100), StrongREJECT (310), XSTest safe+unsafe (200).

Distribution shift — KL vs base (100 harmless prompts)

Reasoning propensity (GPQA-Diamond, 198 questions, thinking on)

Model Details

• Developed by: Noah Rossi
• Adapter type: LoRA (PEFT), r=1, alpha=16, dropout 0.0
• Base model: google/gemma-4-31b-it (frozen)
• Targets: q/k/v/o/gate/up/down_proj of the text decoder only (vision tower excluded via exclude_modules=".*vision_tower\..*")
• Trainable params: 7.6 M (0.025% of base)
• Precision: bf16
• Language(s): Inherits the base model's multilingual coverage
• License: Gemma (inherits base model terms)

How to use

vLLM

vLLM treats a loaded adapter as a separate model name alongside the base. Note that LoRA-on-Gemma-4 needs the fix from vllm-project/vllm#39816; without it vLLM silently no-ops the adapter on Gemma-4 multimodal. See scripts/start_vllm_gemma4.sh in the repo for a launcher that handles this.

vllm serve google/gemma-4-31b-it \
  --enable-lora \
  --lora-modules refusal-free=/path/to/adapter \
  --max-lora-rank 1
# then request model="refusal-free"

Training

Training data. Harmful and borderline prompts drawn from AdvBench, HarmBench, StrongREJECT, JailbreakBench, MaliciousInstruct, Do-Not-Answer, XSTest, and OR-Bench-Hard, plus harmless Alpaca prompts as a behavior anchor. Targets are abliterated completions (the base model run with its refusal direction ablated), so the adapter learns to comply rather than refuse.

Bias, Risks, and Limitations

Safety guardrails are removed by design. The model will comply with requests the base model refuses, including harmful ones. Do not deploy in user-facing products.