It literally downloads from huggingface: https://github.com/google-ai-edge/gallery/blob/main/model_allowlists/1_0_12.json#L40

As codex explains:

Gemma 4 E4B is downloaded through the app’s generic model-download pipeline, not through Gemma-specific code.

  The allowlist entry is in model_allowlists/1_0_12.json:39:

  {
    "name": "Gemma-4-E4B-it",
    "modelId": "litert-community/gemma-4-E4B-it-litert-lm",
    "modelFile": "gemma-4-E4B-it.litertlm",
    "sizeInBytes": 3654467584,
    "commitHash": "9695417f248178c63a9f318c6e0c56cb917cb837"
  }

  That becomes this Hugging Face download URL in Android/src/app/src/main/java/com/google/ai/edge/gallery/data/ModelAllowlist.kt:71:

  https://huggingface.co/litert-community/gemma-4-E4B-it-litert-lm/resolve/9695417f248178c63a9f318c6e0c56cb917cb837/gemma-4-E4B-it.litertlm?download=true

  The flow is:

  1. ModelManagerViewModel.loadModelAllowlist() loads the versioned allowlist from GitHub, falling back to disk if needed: Android/src/app/src/main/java/com/google/ai/edge/gallery/ui/modelmanager/
     ModelManagerViewModel.kt:902.
  2. AllowedModel.toModel() builds the Model object and its Hugging Face URL from modelId, commitHash, and modelFile: Android/src/app/src/main/java/com/google/ai/edge/gallery/data/ModelAllowlist.kt:75.
  3. When the user taps Download, DownloadAndTryButton checks whether the model needs downloading, detects Hugging Face URLs, checks whether auth is required, and starts download with or without a token:
     Android/src/app/src/main/java/com/google/ai/edge/gallery/ui/common/DownloadAndTryButton.kt:258.
  4. ModelManagerViewModel.downloadModel() marks it in progress, deletes any existing model directory, then delegates to DownloadRepository: Android/src/app/src/main/java/com/google/ai/edge/gallery/ui/
     modelmanager/ModelManagerViewModel.kt:285.
  5. DefaultDownloadRepository.downloadModel() packages URL, file name, commit hash, target directory, size, and optional access token into WorkManager input data, then enqueues a DownloadWorker: Android/
     src/app/src/main/java/com/google/ai/edge/gallery/data/DownloadRepository.kt:96.
  6. DownloadWorker opens an HttpURLConnection, optionally adds Authorization: Bearer <token>, streams the file to a temporary .tmp file, reports progress, then renames it to the final file name: Android/
     src/app/src/main/java/com/google/ai/edge/gallery/worker/DownloadWorker.kt:93.

  The final local path is based on Model.getPath():

  <externalFilesDir>/Gemma_4_E4B_it/9695417f248178c63a9f318c6e0c56cb917cb837/gemma-4-E4B-it.litertlm

  On Android that is typically:

  /storage/emulated/0/Android/data/<app_id>/files/Gemma_4_E4B_it/9695417f248178c63a9f318c6e0c56cb917cb837/gemma-4-E4B-it.litertlm