12 abliterated Gemma 4 12B variants, one base, 165 GPU hours - Abliterlitics

I ran 11 uncensored variants of Gemma 4 12B that I grabbed from huggingface, sorting by downloads. 10 full abliterations plus 2 LoRA adapters which were requested to be added in the comparison, against the official base.

165 GPU hours over three and a half weeks on a single 5090. Weight forensics, KL divergence, 13 benchmark tasks, and HarmBench with 400 behaviours. Every response reviewed by an LLM judge reading the full reasoning trace, 6,000 judge verdicts on 6,800 responses total.

Full report is at Abliterlitics Gemma4-12b and also the same report is on HuggingFace DreamFast/Gemma4-12b-it-abliterlitics.

We have a new feature where you can browse the HarmBench responses and reasoning for each model at Abliterlitics Harmbench Gemma4-12b.

The rankings

Judge ASR, best to worst, with the one-line story:

• huihui 89.8%, most jailbroken, most surgical. The trade: TQA -14.3pp, GPQA -8.1pp and 24% of GSM8K attempts loop out. Max unlock if you accept the cost
• trevorjs 85.8%, best trade overall, near-base everything
• coder3101 81.0%, best GSM8K in the whole comparison, above base
• sdft LoRAs 79.5%, level with the top-4 abliterations, capability fully preserved. The SDFT author shares some insight into how he makes his LoRAs in the report.
• jwest33 78.0%, new null-space tool, keeps capability, destabilises reasoning
• llmfan Heretic ARA 76.3%, 16 tensors, GSM8K answered +1.9pp
• prithiv 72.5%, lowest non-LoRA KL, clean independent run
• abliterix 68.8%, near-pristine capabilities, mid-pack unlock
• openyourmind 67.0%, avoid at 12B, MMLU-Pro -22.4pp, the author says the method targets bigger models and this was a test
• obliteratus 60.8%, avoid, hits capability circuits. Badly damaged.
• apostate 45.8%, most selective, keeps 82% of chem/bio refusals, made with an older Apostate version. Newer versions would work better.
• base 21.0%, mostly copyright recall, near zero on direct harm

The highlights

The data from 13 models is too big for reddit, so here's the interesting bits:

• This is the toughest model so far. It's the first time I've seen the Harmbench ASR not get to 90% or over for all models.
• Gemma 4 12B is a thinking model, and the headline score counts every problem where it thought in circles until the token budget died. huihui's headline reads 66.9%, which looks like 15 points of damage. Score only the attempts where it finished thinking and it lands at 88.0%, within 0.7pp of base. The capability was never gone, the reasoning stability was. Empty rates run from 6.9% on coder3101, better than base, to 38% on openyourmind.
• The most surgical edit wins again, with a catch. huihui touches 12 tensors, 1.8% of the model, and posts the highest ASR. obliteratus edits 144 tensors and openyourmind edits 620, and both remove less refusal. But surgical in the weights does not mean clean in the benchmarks: huihui also has the worst TQA drop in the comparison. Placement beats magnitude for unlock strength, not for collateral. If you want the unlock without the damage, that's trevorjs or prithiv.
• The regex classifiers everyone uses miscount thinking models by up to 13pp. huihui is #3 by keyword match and #1 by judge, its paraphrased thinking-heavy compliance slips straight past. All numbers in this post are GLM 5.2 judge verdicts over the full reasoning traces, and every one of those 6,800 responses is browsable in the explorer linked below.
• Base sits at 21.0% but that is mostly the 100 copyright questions, 56% category ASR. It is near zero on direct harm categories. The real differentiation is chem/bio and cybercrime.
• openyourmind should be avoided at 12B. MMLU-Pro down 22.4pp and 38% of GSM8K attempts never finish thinking. The author says the method targets bigger models and this was a test run, and the numbers agree with him. obliteratus too, it hits capability circuits alongside refusal for the worst damage-per-unlock in the comparison.

Links

• Full report: abliterlitics.dev/models/gemma4-12b
• Every response, reasoning trace and judge verdict, browsable: abliterlitics.dev/harmbench/gemma4-12b
• Huggingface: HuggingFace DreamFast/Gemma4-12b-it-abliterlitics
• Code: github.com/dreamfast/abliterlitics

We've had a few people ask about Qwen 3.8 27b, so that's up next. Want to request a model? Roast my choice of benchmarks? Come let us know at our Discord chat.

The Full Breakdown

ASR is LLM-judge, HarmBench 400 behaviours. GSM8K is answered-only accuracy. KL = output distribution shift from base, lower is cleaner. Tensors = weights modified.