GLM-5.2 is live. #1 throughput on OpenRouter, pay-per-token on FriendliAI. Try it today ➜
heterodoxin
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
heterodoxin
Model Tree
Input Modalities
Output Modalities
Supported Functionality
gemma-4-e4b-it with its refusal reflex removed by editing the model's weights directly. No finetuning, no LoRA, no jailbreak prompts, no runtime tricks, just a standard checkpoint that drops in anywhere the original works, except it doesn't refuse.
python
from transformers import AutoModelForCausalLM, AutoTokenizermodel_id = "heterodoxin/gemma-4-e4b-it-apostate"tok = AutoTokenizer.from_pretrained(model_id)model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")messages = [{"role": "user", "content": "Your prompt here"}]text = tok.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)inputs = tok(text, return_tensors="pt").to(model.device)outputs = model.generate(**inputs, max_new_tokens=512)print(tok.decode(outputs[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))
device_map="auto" requires accelerate (pip install transformers accelerate). model_id can also be a local path to the downloaded model folder (the directory with config.json, not a single .safetensors file).
Prefer GGUF (llama.cpp / Ollama / LM Studio)? Quantized builds live at heterodoxin/gemma-4-e4b-it-apostate-gguf.
⚠️ This model is uncensored: it will answer harmful and dangerous requests. You are responsible for how you use it.
Held-out prompts from JailbreakBench and the harmful_behaviors test split. Refusal is scored by a classifier with a weak-compliance guard; KL measures how much the model's token distribution shifts on harmless prompts (lower = less collateral damage).
| Metric | Base | Apostate |
|---|---|---|
| Refusal rate | 96.0% | 36.0% |
| Comply rate | n/a | 64.0% |
| Harmless KL (nats) | 0 | 0.119 |
Apostate finds the residual-stream direction most responsible for refusal and permanently projects it out of the weights, targeting the modules that write to the residual stream (attention output projections, MLP down-projections, and, on post-norm models like Gemma, the reader-side inputs).
The operator is a contrastive co-vector edit. Removing the refusal direction outright disturbs benign behavior; naively preserving all harmless variance along it leaves entangled refusal intact. Instead D = R − W, where the predictor W reproduces the harmless variance along R while being suppressed on harmful prompts: W = (AᵀA + γ·CᵀC + λI)⁻¹Aᵀb, A harmless and C harmful activations (both orthogonalized to R). The edit keeps the harmless-specific component and removes the component shared with refusal, driving refusal down while keeping harmless KL small. The refusal subspace is found via TPE search with causal layer-importance scoring.