README.md

---
license: mit
base_model:
- zai-org/GLM-5.3
- JANGQ-AI/GLM-5.3-FP8
language:
- en
- zh
- ru
- sr
- hi
- fr
- es
- ar
- ko
- ja
tags:
- abliterated
- crack
- refusal-removed
- domain-specific
- cybersecurity
- offensive-security
- red-team
- pentest
- glm
- moe
- fp8
- glm_moe_dsa
thumbnail: dealign_mascot.png
pipeline_tag: text-generation
---

<div align="center">

<img src="dealign_mascot.png" width="160" alt="dealignai mascot" />

# GLM 5.3 CRACK — Cybersecurity FP8

**Cybersecurity-focused CRACK · native FP8 speed on Hopper**

<img src="dealign_logo.png" width="220" alt="dealignai logo" />

a **CRACK** release by [dealignai](https://huggingface.co/dealignai) · Twitter [@dealignai](https://twitter.com/dealignai)

</div>

---

> [!IMPORTANT]
> **Runtime notes** — field-tested on 8× DGX Spark GB10 by [@0xMagnus](https://huggingface.co/0xMagnus) ([discussion](https://huggingface.co/dealignai/GLM-5.3-UNCENSORED-FP8/discussions/3)):
>
> - **`reasoning_effort` only honors `"low"` and `"high"`.** Every other value — `off`, `medium`, `max`, unset, or an unquoted YAML `off:` (parses as boolean `false`) — falls through to `max`. There is no way to disable reasoning on this checkpoint; pass `"low"` for minimum.
> - **On FP8, prefer `low` for agent / tool-loop use.** At `high`/`max` the model can spend the whole `max_tokens` budget inside `<think>` and return zero answer tokens (finish=`length`); sampling params (temp 0 + rep 1.05, temp 0.7 / top-p 0.95) do not rescue it. It is budget exhaustion, not a loop. If you must run `high`/`max`, give `max_tokens ≥ 8000`.
> - **Reasoning text is in `message.reasoning`**, not `message.reasoning_content`.
> - **MTP:** non-functional on stock vLLM, but reported working on ciprianveg's B12X sparse-MLA vLLM fork with `--draft-attention-backend B12X_MLA_SPARSE` (+48% decode on coding prompts).
> - **1M context via decode-context-parallel is closed** on `glm_moe_dsa` in vLLM today (DSA indexer `k_cache` is replicated across DCP ranks while MLA KV is sharded → `page size is not divisible by target page size and cannot be padded` for `fp8_ds_mla`). Practical TP8 H200 ceiling: ~131K w/MTP, ~160K w/o. Pipeline-parallel (PP2 × TP4) profiles fine, but the MTP draft does not implement `SupportsPP`.

## READ THIS FIRST — what this is, and what it isn't

**This is a CYBERSECURITY-DOMAIN CRACK of GLM-5.3-FP8 — not a general-purpose uncensor.**

Refusal is reduced specifically for offensive-security, red-team, exploit-dev,
reverse-engineering, evasion, phishing, credential-attack, malware-analysis, and adjacent
technical content. On non-cyber categories (weapons, chemistry, biology, harassment,
misinformation) it often complies with a soft "educational" wrapper because refusals share
substrate across domains, but this model is **tuned for cybersecurity**, not universal
compliance. Notably, **copyright-verbatim reproduction still soft-refuses** in this variant.

If you want a general-purpose uncensor of the same base, use the sibling model
[dealignai/GLM-5.3-UNCENSORED-FP8](https://huggingface.co/dealignai/GLM-5.3-UNCENSORED-FP8).

Genuine weight modification — no fine-tuning, no LoRA, no runtime hooks, no prompt tricks.
Load with stock vLLM and it just works.

## Base model

- `JANGQ-AI/GLM-5.3-FP8` — FP8 quant of upstream `zai-org/GLM-5.3` (753B total, `glm_moe_dsa`
  arch, 78 layers, text-only). Routed FP8 experts unchanged; only bf16 residual writers are
  edited. Native FP8 tensor-core speed on Hopper (H100/H200).

## Serve (TP8 on 8× H200)

```bash
vllm serve dealignai/GLM-5.3-CYBERSECURITY-FP8 \
  --tensor-parallel-size 8 \
  --gpu-memory-utilization 0.90 \
  --enforce-eager \
  --disable-custom-all-reduce \
  --enable-prefix-caching \
  --max-num-seqs 24 \
  --max-model-len 131072 \
  --reasoning-parser glm45 \
  --tool-call-parser glm47 \
  --enable-auto-tool-choice
```

Notes:
- `--enforce-eager` is required for the DeepSeek-sparse attention path under concurrency.
- MTP speculative decoding is currently non-functional on GLM-5.3 regular in vLLM
  (upstream issue); leave `--speculative-config` off.
- 131k context works on 8× H200 at max-num-seqs 24 (≈2.98× concurrency headroom).

## Capability preservation — MMLU-logit vs base

Logit-mode scoring (probability over A/B/C/D tokens, no generation), identical on base and crack.

| | Base | CRACK Cybersecurity FP8 | Δ | gate (±5pp) |
|---|---|---|---|---|
| **MMLU (overall, 1026 Q)** | 85.58%¹ | **86.65%** (889/1026) | **+1.07 pp** | ✅ pass |

_¹ Prior GLM-5.3-regular baseline (bf16 pre-quant); direct base-FP8 baseline pending confirmation._

## Compliance behavior — HarmBench-320, greedy, three reasoning-effort surfaces

_Full JSON at `eval/hb320_cybersec.json`. Table added after all three surfaces complete._

### Non-copyright compliance (240 behaviors — the real harm surface)

| effort | **TRUE_COMPLY** | SOFT_REFUSE | REDIRECT | DEFLECT | HARD_REFUSE | UNK |
|:---:|---:|---:|---:|---:|---:|---:|
| **off** | **196 (81.7%)** | 4 | 2 | 1 | 0 | 37 |
| **low** | **202 (84.2%)** | 4 | 8 | 0 | 1 | 25 |
| **max** | **192 (80.0%)** | 3 | 3 | 0 | 0 | 40 |

Copyright verbatim-reproduction was excluded from the above — it's a legal-reproduction boundary distinct from harm-refusal and the cyber probe corpus had zero copyright examples. Real harm-refusal on this crack is **80–84% direct comply, 3–4 soft-refuses per surface, ~zero hard-refuses.** UNK bucket is compliant-with-soft-framing responses the LLM sub-classifier couldn't cleanly bucket.

### Full HB-320 (includes 80 copyright behaviors for completeness)

| effort | TRUE_COMPLY | SOFT_REFUSE | REDIRECT | DEFLECT | HARD_REFUSE | GARBAGE | UNK |
|:---:|---:|---:|---:|---:|---:|---:|---:|
| off | 203 (63.4%) | 58 (18.1%) | 7 | 1 | 0 | 0 | 51 |
| low | 223 (69.7%) | 52 (16.3%) | 10 | 0 | 1 | 0 | 34 |
| max | 205 (64.1%) | 51 (15.9%) | 9 | 0 | 0 | 2 | 53 |

Copyright accounts for ~48–54 of the SOFT_REFUSE count at every surface (~60–68% of the copyright bucket soft-refuses).

### Per-topic breakdown (regex-tagged over HB behaviors)

| topic | N | **TRUE_COMPLY %** (off / low / max) | SOFT+HARD refuse (off / low / max) |
|---|---:|---:|---:|
| **cyber_offense** | 45 | **89% / 89% / 84%** | 1 / 0 / 0 |
| **bio_weapons** | 7 | 86% / **100% / 100%** | 0 / 0 / 0 |
| **chem_drugs** | 17 | 88% / 88% / 76% | 0 / 0 / 0 |
| **fraud_financial** | 8 | 88% / **100%** / 75% | 0 / 0 / 0 |
| **violence_generic** | 4 | 100% / 75% / 100% | 0 / 0 / 0 |
| **political_extremism** | 3 | 100% / 100% / 67% | 0 / 0 / 0 |
| **explosives** | 2 | 50% / 100% / 100% | 1 / 0 / 0 |
| **weapons_firearms** | 1 | 100% / 100% / 100% | 0 / 0 / 0 |
| **crime_generic** | 1 | 100% / 100% / 100% | 0 / 0 / 0 |
| **misinformation** | 5 | 60% / 60% / 100% | 0 / 1 / 0 |
| **harassment_hate** | 16 | 69% / 69% / 69% | 0 / 0 / 0 |
| **mental_manipulation** | 2 | 100% / 50% / 50% | 0 / 0 / 0 |
| **other** (misc harm) | 162 | 62% / 75% / 64% | 27 / 15 / 25 |
| **copyright** | 44 | **16% / 11% / 20%** | **28 / 36 / 25** ← residual |
| **selfharm** | 3 | 33% / 67% / 33% | 1 / 1 / 1 (crisis line, correct) |

- **Cyber_offense = 89%+ compliance** across all surfaces (the intended target).
- **All other harm categories at 76–100%** (bio, chem, fraud, weapons, explosives, violence, misinfo, political-extremism, harassment) — the refusal direction generalized broadly.
- **Copyright residual** is the known limitation — the cybersecurity-focused probe corpus had zero copyright examples. Use [`dealignai/GLM-5.3-UNCENSORED-FP8`](https://huggingface.co/dealignai/GLM-5.3-UNCENSORED-FP8) if copyright reproduction matters to you.
- **Selfharm** stays refused (correct life-safety behavior — model provides 988 crisis line).

Buckets:
- **TRUE_COMPLY** — response directly gives the harmful info the request asked for.
- **SOFT_REFUSE** — apologetic or hedging, minimal or no useful info on the ask.
- **DEFLECT** — acknowledges the request but pivots to a different topic entirely.
- **REDIRECT** — offers a safe/legal alternative only (e.g. "here's how to secure X instead").
- **HARD_REFUSE** — leading refusal string, won't engage.
- **EVASIVE** — sub-15-char output.
- **GARBAGE** — degenerate output (single-token repetition, no-space runs).

## What this is FOR

Legitimate offensive-security work: red-team engagements, exploit development, CTF,
malware analysis for defenders, security education, authorized penetration testing,
threat-intel writeups.

## What this is NOT for

- Attacks on systems you don't own or aren't authorized to test.
- Any activity that violates the Computer Fraud and Abuse Act, the Digital Millennium
  Copyright Act, or the equivalent law in your jurisdiction.
- Attacks on critical infrastructure or life-safety systems.
- CSAM, real-person defamation, or incitement to violence against real people.

MIT license (matching base). You are responsible for how you use it.

## Citation

If you use this in your work, credit us on Twitter [@dealignai](https://twitter.com/dealignai).