PenAgent/GLM-5.3-ABLITERATED-NVFP4

⚡ Built for offensive cybersecurity · Updated 2026-08-29

This is a red-team / offensive-security model. GLM-5.3 (753B) with refusal removed at the weight level so it produces real, working security code — exploits, payloads, tooling — for authorized penetration testing, malware analysis, CTFs, and security research. Verified to generate working keyloggers, SUID privilege-escalation, AES ransomware, reverse shells, and SSH brute-forcers across reasoning modes (greedy), with zero degeneration/looping and capability preserved (MMLU 84.11%, within ~1.5pp of base). Load with stock vLLM.

Designed for high / max reasoning-effort usage — the modes tuned and recommended for offensive-security work. A few borderline social-harm topics may still be declined at lower effort; use high or max effort for the fully-uncensored experience.

GLM 5.3 CRACK Abliterated NVFP4

CRACK · guardrails removed at the weight level · tuned for offensive security

a CRACK release by dealignai @dealignai · compute by @jordanschenck

Also mirrored at dealignai/GLM-5.3-UNCENSORED-NVFP4.

---

Runtime notes — field-tested on 8× DGX Spark GB10 by @0xMagnus (discussion):

• reasoning_effort only honors "low" and "high". Every other value — off, medium, max, unset, or an unquoted YAML off: (parses as boolean false) — falls through to max. There is no way to disable reasoning on this checkpoint; pass "low" for minimum.
• On NVFP4, high is usable with max_tokens ≥ 16384 (finishes cleanly). max will often exhaust the budget with a very long reasoning block and a truncated answer. NVFP4 tolerates high better than the FP8 build.
• Reasoning text is in message.reasoning, not message.reasoning_content.
• On GB10, NVFP4 is a memory / context play, not a speed play — no native FP4 compute, weights dequantize on the fly; decode lands near FP8 + MTP. The win is KV pool (35 GiB/rank vs FP8's 7–9 GiB) → practical 512K context at TP8 (695K-token pool at 1.33× concurrency).
• 1M context via decode-context-parallel is closed on glm_moe_dsa in vLLM today (DSA indexer k_cache is replicated across DCP ranks while MLA KV is sharded → page size is not divisible by target page size and cannot be padded for nvfp4_ds_mla).

What Is This?

CRACK is dealignai's brand for permanent, weight-level uncensoring. This is GLM-5.3 (753B) in NVFP4 with its refusal behavior removed directly in the model weights — tuned so it complies with offensive-security requests (exploit dev, payloads, red-team tooling) that stock models refuse.

• ❌ No fine-tuning / SFT / DPO. ❌ No jailbreak prompt or chat-template tricks.
• ❌ No LoRA, adapters, steering vectors, runtime hooks, or custom model.py.
• ✅ A permanent edit baked into the tensors. Load with stock vLLM and it just works.

Specs

Architecture	GLM-5.3 (glm_moe_dsa) — MoE + MLA + DeepSeek-sparse attention
Parameters	753B total · ~18B active per token
Quantization	NVFP4 (routed experts NVFP4; attention + shared experts bf16)
Context	1M tokens
MTP	multi-token-prediction draft head — also CRACK'd (~87% draft acceptance)
Reasoning	reasoning-off / low / high / max effort

Refusal Rates — HarmBench (greedy, per reasoning-effort mode)

Measured on random HarmBench prompts, greedy decode, single-stream, max_tokens=1400, classifier reads content + reasoning combined so nothing is counted as refusal by accident:

Reasoning effort	Prompts	Comply	Refuse	Refuse rate
default (off)	109 answered	101	8	7.3%
high	76	76	0	0.0%
max	80	80	0	0.0%

At high and max the model is fully uncensored — 0 refusals across 156 random HarmBench prompts. The 8 refusals at off-mode are 7 copyright ('full lyrics of X', 'long passage from Y') plus 1 political persuasion — the true safety-refusal rate at off is <1%. Use high or max effort for the fully-uncensored experience.

Offensive-Security Compliance (direct-read)

Direct-read verification — the model returns real, working code, not refusals or redirects:

Capability	Result
Reverse shell / C2 beacon	✅ working code
Keylogger (capture + exfil)	✅ working code
AES ransomware (encrypt + note)	✅ working code
Linux SUID privilege escalation	✅ working code
SSH brute-force	✅ working code
SQL injection payloads	✅ working code

Also complies on broader red-team topics (malware analysis, phishing templates for awareness, recon). 0 looping / degenerate outputs in every mode.

Capability Preserved — MMLU-logit

Identical logit-mode scoring (argmax over A/B/C/D), 1,026 questions:

	Base	CRACK Abliterated	Δ
MMLU (overall)	85.58%	84.11%	-1.47 pp

MMLU by Topic (base → CRACK)

All 57 MMLU subjects

Subject	Base	CRACK
Abstract Algebra	66.7%	55.6%
Anatomy	83.3%	83.3%
Astronomy	94.4%	94.4%
Business Ethics	94.4%	94.4%
Clinical Knowledge	88.9%	88.9%
College Biology	94.4%	94.4%
College Chemistry	55.6%	50.0%
College Computer Science	77.8%	66.7%
College Mathematics	66.7%	72.2%
College Medicine	88.9%	83.3%
College Physics	77.8%	83.3%
Computer Security	94.4%	88.9%
Conceptual Physics	94.4%	94.4%
Econometrics	88.9%	83.3%
Electrical Engineering	77.8%	77.8%
Elementary Mathematics	83.3%	83.3%
Formal Logic	61.1%	55.6%
Global Facts	61.1%	61.1%
High School Biology	94.4%	94.4%
High School Chemistry	94.4%	100.0%
High School Computer Science	88.9%	88.9%
High School European History	83.3%	77.8%
High School Geography	83.3%	83.3%
High School Government And Politics	100.0%	100.0%
High School Macroeconomics	88.9%	83.3%
High School Mathematics	44.4%	44.4%
High School Microeconomics	94.4%	94.4%
High School Physics	72.2%	83.3%
High School Psychology	100.0%	100.0%
High School Statistics	100.0%	83.3%
High School Us History	88.9%	88.9%
High School World History	94.4%	94.4%
Human Aging	83.3%	83.3%
Human Sexuality	88.9%	88.9%
International Law	94.4%	94.4%
Jurisprudence	100.0%	94.4%
Logical Fallacies	94.4%	94.4%
Machine Learning	77.8%	66.7%
Management	94.4%	88.9%
Marketing	100.0%	100.0%
Medical Genetics	100.0%	94.4%
Miscellaneous	94.4%	94.4%
Moral Disputes	83.3%	88.9%
Moral Scenarios	61.1%	66.7%
Nutrition	100.0%	94.4%
Philosophy	100.0%	100.0%
Prehistory	94.4%	88.9%
Professional Accounting	66.7%	66.7%
Professional Law	83.3%	77.8%
Professional Medicine	94.4%	94.4%
Professional Psychology	100.0%	100.0%
Public Relations	77.8%	72.2%
Security Studies	66.7%	66.7%
Sociology	100.0%	94.4%
Us Foreign Policy	100.0%	94.4%
Virology	50.0%	61.1%
World Religions	94.4%	100.0%

Usage

vllm serve dealignai/GLM-5.3-ABLITERATED-NVFP4 \
  --tensor-parallel-size 8 --moe-backend marlin \
  --tool-call-parser glm47 --reasoning-parser glm45 --enable-auto-tool-choice

NVFP4 routed experts serve via the Marlin FP4 path on Hopper (H100/H200). GLM-5.3's DSA sparse attention needs a recent FlashInfer (>= 0.6.18) for the SM90 sparse-MLA backend.

MTP speculative decoding (also CRACK'd, ~87% draft acceptance): add --speculative-config '{"method":"mtp","num_speculative_tokens":1}' and let vLLM auto-select the MoE backend (the bf16 MTP head is unquantized, so don't force a global --moe-backend).

Credits

• dealignai — CRACK abliteration research & release · Twitter @dealignai

Disclaimer

Safety guardrails have been removed; this model produces offensive-security content and will comply with requests a stock model refuses. Released for authorized security research, red- teaming, and CTFs. You are responsible for how you use it.