Instructions to use Blackfrost-Research/GLM-5.2-DERISKED-BF16 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Blackfrost-Research/GLM-5.2-DERISKED-BF16 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="Blackfrost-Research/GLM-5.2-DERISKED-BF16")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("Blackfrost-Research/GLM-5.2-DERISKED-BF16")
model = AutoModelForCausalLM.from_pretrained("Blackfrost-Research/GLM-5.2-DERISKED-BF16", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Blackfrost-Research/GLM-5.2-DERISKED-BF16 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Blackfrost-Research/GLM-5.2-DERISKED-BF16"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/Blackfrost-Research/GLM-5.2-DERISKED-BF16

SGLang

How to use Blackfrost-Research/GLM-5.2-DERISKED-BF16 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Blackfrost-Research/GLM-5.2-DERISKED-BF16" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Blackfrost-Research/GLM-5.2-DERISKED-BF16" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use Blackfrost-Research/GLM-5.2-DERISKED-BF16 with Docker Model Runner:
```
docker model run hf.co/Blackfrost-Research/GLM-5.2-DERISKED-BF16
```
Browse Quantizations to use this model in llama.cpp, Ollama, LM Studio, or any compatible app.

Request commercial access

GLM-5.2-DERISKED-BF16 is released under a Blackfrost commercial licence and is reviewed manually. Access is granted to security firms, red teams, AI-safety labs, and enterprise research groups. Tell us who you are and what you are evaluating; we review every request individually. Access is granted automatically on purchase at redpillreader.com/models; requests without a purchase are not approved.

GLM-5.2-DERISKED-BF16

Enterprise de-risked GLM-5.2 · 753B Mixture-of-Experts · full precision

Built by Blackfrost · Las Vegas, NV

🔑 How to get access

➜ Buy this model — this repository is gated, and access is granted to your Hugging Face account automatically on payment (enter your HF username at checkout).

Why this model exists

Security teams cannot evaluate a defence against a model that refuses to produce the attack.

Standard frontier models are trained to decline adversarial prompts. That behaviour is correct for consumer products and actively harmful for the people who have to test things — red teams whose payload generator stops mid-engagement, detection engineers with no true positives to tune against, safety labs that cannot measure a guardrail they cannot stress.

GLM-5.2-DERISKED-BF16 is Blackfrost's in-house de-risked build of GLM-5.2: a 753B-parameter Mixture-of-Experts model whose refusal behaviour has been removed at the weight level, so it answers the adversarial prompt instead of declining it. This repository holds the BF16 master — the full-precision checkpoint every other model in the Blackfrost GLM-5.2 de-risked line is derived from.

It is offered to organisations under commercial licence, with access reviewed by hand.

Specifications


Architecture	`GlmMoeDsaForCausalLM` — GLM MoE with Multi-head Latent Attention (MLA) + DeepSeek-style Sparse Attention (DSA)
Parameters	~753B total, Mixture-of-Experts
Precision	BF16 — `safetensors`, 158 shards, 1,506,659,919,872 bytes (~1.37 TiB)
Layers	79 — first 3 dense, 75 MoE, + 1 multi-token-prediction (MTP) head
Experts	256 routed (top-8 active per token) + 1 shared
Hidden size	6,144 · MoE FFN 2,048 · dense FFN 12,288
Attention	64 heads · MLA (`kv_lora_rank` 512, `q_lora_rank` 2048) · DSA indexer (32 heads, `index_topk` 2048)
Vocabulary	154,880
Context	1,048,576 positions (1M)
Languages	English, Chinese

Tokenizer, config.json, generation_config.json and the GLM chat_template.jinja — including <think>, <|observation|> and reasoning-effort control tokens — ship with the weights, so a serving stack that honours the packaged template will not silently fall back to a generic one.

What "de-risked" means here

Blackfrost derived this checkpoint directly from zai-org/GLM-5.2 using its own MoE-aware refusal-direction ablation, executed in BF16 on an 8×B200 node.

It is not a system prompt, not a LoRA, not a decoding-time filter — nothing that a deployment can accidentally undo or that an integrator has to remember to configure. The behaviour is in the weights.

Capability was preserved: this is a refusal-behaviour change, not a capability-degrading fine-tune.

Lineage


Base	Official `zai-org/GLM-5.2`
Applied	In-house MoE-aware refusal-direction ablation at the weight level, executed in BF16
Not applied	SFT · DPO · RLHF · quantization · expert pruning
Format	HF safetensors · BF16

zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16                          ← this repo, the master
       ├─ GLM-5.2-DERISKED-FP8                      ~703.7 GiB, single-node, incl. MTP head
       └─ GLM-5.2-DERISKED-NVFP4                    ~451 GB, single-node
            └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4    ~323 GB, non-uniform prune

On refusal behaviour: deliberately reduced at the weight level. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

Measured behaviour

Blackfrost evaluated the NVFP4 quantization of this exact checkpoint (GLM-5.2-DERISKED-NVFP4) against a 450-prompt harness — AdvBench 150 + StrongREJECT 150 + XSTest 150 — at temperature 0, thinking off, 512 max tokens.

Dataset	n	Refused	Refusal rate
AdvBench	150	25	16.7%
StrongREJECT	150	12	8.0%
XSTest	150	6	4.0%
Harmful subset (AdvBench + StrongREJECT)	300	37	12.3%

Over-refusal on XSTest safe prompts: 1.3% (1/75) — the model stays useful on benign requests rather than becoming indiscriminately compliant.

Method, stated plainly: refusal was scored by substring pre-filter, which both over- and under-counts; per-prompt responses were not manually adjudicated in that run. Treat the figures as the substring rate, not a hand-verified ground truth. The measurement was taken on the NVFP4 child rather than on this BF16 parent — a controlled BF16-vs-NVFP4 comparison has not yet been run. Full per-prompt JSONL is available to licensees under NDA.

We publish the caveats because the firms we build for would find them anyway.

This is not the community build

There is a separate, freely available GLM-5.2-ABLITERATED-NVFP4 on the Blackfrost user account. It is a different artifact. If you already downloaded that one, you do not have this one.

	Our Community re-upload	This repository
Lineage	third-party abliteration, re-hosted	Blackfrost in-house de-risking
Base	`huihui-ai/Huihui-GLM-5.2-abliterated`	`zai-org/GLM-5.2` directly
Blackfrost intervention	none	full — our method, our run
Shards	337	158
Benchmarked by Blackfrost	no	yes (450-prompt harness)
Access	open	manually gated, commercial
Support	none	licensed, with engineering contact

Serving

GlmMoeDsaForCausalLM is registered in stock vLLM (verified in 0.23.0 and 0.25.0) — no custom build or architecture patch is required.

docker run -d --name glm52-derisked-bf16 \
  --gpus all --ipc=host --shm-size=32g --network host \
  -v /path/to/GLM-5.2-DERISKED-BF16:/model:ro \
  -v glm-jit-cache:/cache/jit \
  -e CUDA_HOME=/usr/local/cuda \
  -e PATH=/usr/local/cuda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
  -e CUDA_CACHE_PATH=/cache/jit \
  -e TRITON_CACHE_DIR=/cache/jit/triton \
  -e TORCH_EXTENSIONS_DIR=/cache/jit/torch_extensions \
  -e TORCHINDUCTOR_CACHE_DIR=/cache/jit/inductor \
  -e VLLM_ENGINE_READY_TIMEOUT_S=3600 \
  vllm/vllm-openai:v0.25.0 \
  /model \
  --served-model-name GLM-5.2-DERISKED-BF16 \
  --trust-remote-code \
  --tensor-parallel-size 8 \
  --kv-cache-dtype fp8 \
  --max-model-len 131072 \
  --gpu-memory-utilization 0.92 \
  --host 0.0.0.0 --port 8000

`nvcc` / JIT compilation failures

On Blackwell Ultra (B300, sm_103a) this is a known toolchain bug, not a configuration mistake.

FlashInfer 0.6.14 bundles CCCL headers that are incompatible with nvcc 13.3 — the only nvcc able to target sm_103a. JIT compilation then fails at engine startup on cached_ops/fused_moe_trtllm_sm100 and cached_ops/sampling with "CUDA compiler and toolkit headers are incompatible." Same signature as flashinfer#3493 / vllm#44305, which were filed against SM120f and closed — the sm_103a manifestation is distinct.

Fix: run a CUDA 13.0-based image. vllm/vllm-openai:v0.25.0 ships nvcc 13.0 and sidesteps it. A pip install of FlashInfer onto a CUDA 12.4 host does not — that is the path that reproduces the failure. VLLM_USE_FLASHINFER_SAMPLER=0 mitigates the sampling op only, not fused_moe_trtllm_sm100.

Separately, stock vllm/vllm-openai images ship nvcc at /usr/local/cuda/bin/nvcc but leave CUDA_HOME unset and configure no JIT cache directories. Set CUDA_HOME, put it on PATH, and point the caches at a persistent named volume as shown above — without one, every restart recompiles from cold, which presents as a hang.

Flag notes

--kv-cache-dtype fp8 — recommended. MLA already makes KV cheap; fp8 roughly doubles usable context for the same memory.
--max-model-len — start at 131072 and raise once serving is confirmed. 1M is the architectural ceiling, but a value whose KV pool cannot hold one full sequence fails at startup.
Speculative decoding (MTP head, below) is an optimisation — get a plain serve working first.

Deployment notes

Hardware. The weights are 1,506,659,919,872 bytes (~1.37 TiB). Under tensor parallelism they divide evenly, so the deciding number is memory per GPU: 1,506.7 GB ÷ 8 = 188.3 GB per GPU before KV cache, activations or CUDA graphs.

Node	Per-GPU	Total HBM	Verdict
8 × H200	141 GB	1,128 GB	Will not load — 378 GB short of the weights alone
8 × B200	192 GB	1,538 GB	Not viable in practice — ~2% headroom; at the default `--gpu-memory-utilization 0.9` only ~1,384 GB is usable, less than the weights
8 × B300	288 GB	2,304 GB	✅ Recommended — ~100 GB/GPU free for KV
16 × B200 (2 nodes)	192 GB	3,076 GB	✅ Works — requires multi-node setup

For single-node serving below this footprint, use the FP8 or NVFP4 build.

Multi-token prediction. config.json declares num_nextn_predict_layers: 1, and this checkpoint includes the layer-78 MTP head, referenced by model.safetensors.index.json. Speculative decoding is supported.
Context. 1M positions is the architectural ceiling. Real usable context is bounded by your KV budget; plan capacity accordingly.
Integrity. The index declares total_size 1,506,659,919,872 across 15 shards. Verify byte counts after download before you attribute a load failure to the weights.

Access & licensing

Access is granted automatically on purchase — you do not wait on a manual review.

➜ Purchase access to this model — enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment.

Commercial licensing, air-gapped deployment, custom de-risking against your own threat model, pruned or quantized variants sized to your hardware, and evaluation support are all available. If you need something that is not on this page, it probably already exists internally — ask.

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Ask about this model, the NVFP4 and pruned variants,
custom de-risked builds, or an enterprise evaluation licence.

Blackfrost · Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety

Other builds

Blackfrost publishes the GLM-5.2 de-risked line in several shapes. Access to full-precision and custom builds is granted on purchase under a separate licence agreement — those repositories are gated, and approval follows a completed agreement. The gate is the transaction.

Build	What it is
`GLM-5.2-DERISKED-BF16`	Full-precision BF16 master — every other build in this line derives from it
`GLM-5.2-DERISKED-FP8`	Block-FP8 (e4m3) — single-node serving, includes the MTP head
`GLM-5.2-DERISKED-NVFP4`	4-bit NVFP4, single-node serving on sm_120-class hardware
`GLM-5.2-DERISKED-REAP-NU176-NVFP4`	Non-uniform REAP prune on top of NVFP4 — smallest footprint in the line
Custom	Expert budgets, non-uniform keep sets, or de-risking calibrated against your own threat model

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Refusal rates, capability figures and latency reflect specific harnesses under stated conditions, with the caveats given above. They are not safety proofs and do not generalise to multimodal, tool-use, long-context or multi-turn adversarial settings beyond those tested.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility for that artifact transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

Responsible use

Access is granted for authorised security work: red-team engagements you are contracted to perform, AI-safety and alignment research, guardrail and detection development, and model evaluation.

Preserved refusal floor

The de-risking intervention is deliberately broad, but it is not unbounded. Refusal behaviour on child sexual content and self-harm facilitation was held out of the ablation and subsequently reinforced by targeted QLoRA fine-tune. This is a weight-level behaviour property of the checkpoint, not a configuration step and not a licence term — it is present whether or not a deployment does anything to enable it.

Floor behaviour was evaluated separately from the 450-prompt de-risking harness; Per-prompt floor results are available to licensees under NDA.

Everything else

Outside that floor, this checkpoint should be assumed capable of producing content a consumer model would decline. That is the point of the build. The remaining acceptable-use terms — no unauthorised operations against systems or people you have no permission to test — are licence obligations, not model behaviour. Deploy behind your own controls, logging, and access review, and treat outputs as untrusted.

Downloads last month: 5

Safetensors

Model size

743B params

Tensor type

F32

BF16

Model tree for Blackfrost-Research/GLM-5.2-DERISKED-BF16

Base model

zai-org/GLM-5.2

Finetuned

(24)

this model

Quantizations

1 model

Collection including Blackfrost-Research/GLM-5.2-DERISKED-BF16

GLM-5.2 — De-Risked

Collection

753B MoE. In-house de-risking applied directly to the zai-org/GLM-5.2 full-precision source, not to a third-party quantization. • 3 items • Updated 7 days ago