Gemma 2B multimodal model matches larger models without encoder

[Gemma 4 12B](https://blog.google/innovation-and-ai/technology/developers-tools/introducing-gemma-4-12b/) ships encoder-free multimodal at 12B parameters and trades blows with models twice its size on community benchmarks. The encoder-free architecture is the part worth sitting with. Removing the vision encoder from the pipeline cuts inference overhead and simplifies deployment, and Google doing this at 12B suggests the design is mature enough for production, not just a research demo. The catch: [benchmark comparisons against Qwen 2.5 9B](https://i.redd.it/20s4116kg45h1.png) show Gemma 4 losing on five of eight tasks, which means Qwen stays the better default for constrained local inference until Google ships the 124B variant. The multimodal capability story is real; the "best small model" story needs more evidence. The same open-weight accessibility that makes Gemma 4 deployable on consumer hardware also showed up this week as an attack vector. Researchers demonstrated a [self-spreading enterprise worm](https://www.theregister.com/research/2026/06/04/free-ai-model-powers-self-spreading-worm-in-enterprise-test-network/5250918) powered entirely by free open-weight models in a test network, which collapses the assumption that capability gatekeeping at the frontier lab level controls agentic threat surfaces. Any organization running local models in networked environments now has to treat open-weight access as an attack surface in its own right, not a safety feature. The cost side of agentic deployment is also cracking. [Uber capping per-engineer spend on Claude Code](https://simonwillison.net/2026/Jun/3/uber-caps-usage/) signals that flat-rate assumptions for coding agents are gone at scale, and consumption-based pricing is now the operational reality for any team running these tools seriously. [Anthropic's published documentation on Claude sandboxing](https://www.anthropic.com/engineering/how-we-contain-claude) across its products is useful context here, since understanding containment boundaries matters before deploying Claude 4.5 or 4.6 in multi-tenant or agentic pipelines, but the sandboxing docs describe Anthropic's own infrastructure, not yours. Separately from capability questions, [NeurIPS used an uncalibrated AI detector to desk-reject submissions](https://www.reddit.com/r/MachineLearning/comments/1tvwctd/neurips_used_uncalibrated_ai_detector_for_desk/), which is a concrete example of classifier misuse affecting real scientific outcomes before anyone audited the tool's false positive rate. The pattern connecting these signals is that open-weight models are now capable enough to drive both production savings and production-grade threats simultaneously, and institutions are making consequential decisions with evaluation tools that haven't been validated for the stakes involved. If Google ships the Gemma 4 124B variant within 60 days, the benchmark gap with Qwen closes and the "best local multimodal" question reopens across the entire small-model deployment stack.