--- license: other license_name: blackfrost-commercial base_model: - Blackfrost-Research/GLM-5.2-DERISKED-BF16 base_model_relation: quantized pipeline_tag: text-generation library_name: transformers language: - en - zh tags: - glm - glm-5.2 - glm_moe_dsa - mixture-of-experts - moe - fp8 - block-fp8 - e4m3 - quantized - de-risked - red-teaming - security-research - adversarial-testing - enterprise extra_gated_heading: Request commercial access extra_gated_description: >- GLM-5.2-DERISKED-FP8 is released under a Blackfrost commercial licence and is reviewed manually. Access is granted to security firms, red teams, AI-safety labs, and enterprise research groups. Tell us who you are and what you are evaluating; we review every request individually. Access is granted automatically on purchase at redpillreader.com/models; requests without a purchase are not approved. extra_gated_fields: Organisation: text Work email: text Role: text Country: country Intended use: type: select options: - Offensive security / red teaming - AI safety & alignment research - Model evaluation & benchmarking - Guardrail / detection engineering - Other Deployment environment: type: select options: - Air-gapped / on-premise - Private cloud (single tenant) - Other I am requesting access on behalf of an organisation, not as an individual: checkbox I agree to the Blackfrost commercial terms and acceptable-use policy: checkbox extra_gated_button_content: Request access ---
![Blackfrost](https://cdn-uploads.huggingface.co/production/uploads/69a27f2d114e4ac9de4dafc7/xDTdhLFXmKlZOazFcvJ5S.jpeg)

GLM-5.2-DERISKED-FP8

Enterprise de-risked GLM-5.2 ยท 753B Mixture-of-Experts ยท FP8 block-wise (e4m3)

**Built by [Blackfrost](https://x.com/Blackfrost_AI) ยท Las Vegas, NV**

> ### ๐Ÿ”‘ How to get access > **[โžœ Buy this model](https://buy.stripe.com/28E28t0J562k0F33xnfw40f)** โ€” this repository is gated, and access is granted to your Hugging Face account **automatically on payment** (enter your HF username at checkout). ## Why this model exists Security teams cannot evaluate a defence against a model that refuses to produce the attack. Standard frontier models are trained to decline adversarial prompts. That behaviour is correct for consumer products and actively harmful for the people who have to *test* things โ€” red teams whose payload generator stops mid-engagement, detection engineers with no true positives to tune against, safety labs that cannot measure a guardrail they cannot stress. **GLM-5.2-DERISKED-FP8** is Blackfrost's in-house de-risked build of GLM-5.2 โ€” a 753B-parameter Mixture-of-Experts model whose refusal behaviour has been removed at the weight level โ€” quantized to **block-wise FP8 (e4m3)** so it serves on a **single 8-GPU node** while keeping the master's behaviour. It is a direct quantization of the [**BF16 master**](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-BF16), in the same native FP8 format the upstream vendor ships. It is offered to organisations under commercial licence, with access reviewed by hand. --- ## Specifications | | | |---|---| | **Architecture** | `GlmMoeDsaForCausalLM` โ€” GLM MoE with Multi-head Latent Attention (MLA) + DeepSeek-style Sparse Attention (DSA) | | **Parameters** | ~753B total, Mixture-of-Experts | | **Precision** | FP8 **e4m3**, block-wise `weight_block_size` **128ร—128**, dynamic activation scaling โ€” `safetensors`, **161 shards, 755,617,140,416 bytes** (~703.7 GiB) | | **Layers** | 79 โ€” first 3 dense, 75 MoE, **+ 1 multi-token-prediction (MTP) head** | | **Experts** | 256 routed (top-8 active per token) + 1 shared | | **Hidden size** | 6,144 ยท MoE FFN 2,048 ยท dense FFN 12,288 | | **Attention** | 64 heads ยท MLA (`kv_lora_rank` 512, `q_lora_rank` 2048) ยท DSA indexer (32 heads, `index_topk` 2048) | | **Vocabulary** | 154,880 | | **Context** | 1,048,576 positions (1M) | | **Languages** | English, Chinese | Tokenizer, `config.json`, `generation_config.json` and the GLM `chat_template.jinja` โ€” including ``, `<|observation|>` and reasoning-effort control tokens โ€” ship with the weights, so a serving stack that honours the packaged template will not silently fall back to a generic one. --- ## What "de-risked" means here Blackfrost derived the master **directly from `zai-org/GLM-5.2`** using its own MoE-aware refusal-direction ablation, executed in BF16 on an 8ร—B200 node. This repository is the FP8 quantization of that master. The de-risking is not a system prompt, not a LoRA, not a decoding-time filter โ€” nothing that a deployment can accidentally undo or that an integrator has to remember to configure. The behaviour is in the weights, and quantization does not retrain them. Capability was preserved: this is a refusal-behaviour change carried through a precision change, not a capability-degrading fine-tune. --- ## Quantized from source, not from a quantized file This is the distinction that matters for FP8. The de-risking was performed **at full BF16 precision on weights taken directly from `zai-org/GLM-5.2`**, and the result was **then** quantized to FP8. The model was modified while it was still full-precision, and only afterwards reduced. That is the opposite order from an abliteration applied *on top of* an already-quantized FP8 file, where the modification has to fight rounding error that is already baked in. Same target format; cleaner lineage. The output matches the upstream vendor's own FP8 layout tensor-for-tensor: native `quant_method: fp8`, `fmt: e4m3`, `weight_block_size: [128, 128]`, paired `weight_scale_inv` scales โ€” a drop-in for stacks that already load `zai-org/GLM-5.2-FP8`. --- ## Lineage | | | |---|---| | **Base** | [`Blackfrost-Research/GLM-5.2-DERISKED-BF16`](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-BF16) โ€” Blackfrost's de-risked master, itself derived from official [`zai-org/GLM-5.2`](https://huggingface.co/zai-org/GLM-5.2) | | **Applied** | Block-wise FP8 (e4m3, 128ร—128) quantization of the de-risked master | | **Not applied** | SFT ยท DPO ยท RLHF ยท expert pruning ยท re-ablation on the quantized file | | **Format** | HF safetensors ยท FP8 block-e4m3, native vendor layout | ``` zai-org/GLM-5.2 โ””โ”€ GLM-5.2-DERISKED-BF16 the de-risked master โ”œโ”€ GLM-5.2-DERISKED-FP8 โ† this repo ยท ~703.7 GiB ยท single-node โ”œโ”€ GLM-5.2-DERISKED-NVFP4 ~451 GB, single-node โ””โ”€ GLM-5.2-DERISKED-REAP-NU176-NVFP4 ~323 GB, non-uniform prune ``` **On refusal behaviour:** deliberately reduced at the weight level. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2. --- ## Refusal behaviour The de-risking is a weight-level property of the master and is carried into FP8 unchanged โ€” quantization reduces numerical precision, it does not retrain refusal directions back in. The published harness figures for this line were measured on the **NVFP4** sibling (`GLM-5.2-DERISKED-NVFP4`) against a 450-prompt set โ€” AdvBench 150 + StrongREJECT 150 + XSTest 150, temperature 0, thinking off: | Dataset | n | Refused | Refusal rate | |---|---|---|---| | AdvBench | 150 | 25 | 16.7% | | StrongREJECT | 150 | 12 | 8.0% | | XSTest | 150 | 6 | 4.0% | | **Harmful subset (AdvBench + StrongREJECT)** | **300** | **37** | **12.3%** | **Method, stated plainly:** those rates were scored by substring pre-filter, which both over- and under-counts, and were measured on the NVFP4 sibling, not on this FP8 build. A controlled FP8-vs-master refusal comparison for this specific quantization is validated internally per release and the per-prompt JSONL is available to licensees under NDA. We report what was measured and where โ€” not a number this file did not produce. We publish the caveats because the firms we build for would find them anyway. --- ## This is not an abliteration-on-quantized re-host A separate FP8 abliteration of GLM-5.2 exists publicly (`Bahushruth/GLM-5.2-FP8-abliterated`). **It is a different artifact.** It was produced by abliterating *on top of* the already-quantized `zai-org/GLM-5.2-FP8`. | | Abliteration-on-quantized re-host | **This repository** | |---|---|---| | Order of operations | quantize โ†’ then abliterate | **de-risk in BF16 โ†’ then quantize** | | Base | `zai-org/GLM-5.2-FP8` (already reduced) | **`zai-org/GLM-5.2` full precision, via our master** | | Blackfrost intervention | none | **full โ€” our method, our run** | | MTP head | โ€” | **included, format-matched to vendor FP8** | | Access | open | **manually gated, commercial** | | Support | none | **licensed, with engineering contact** | --- ## Deployment notes - **Hardware.** ~703.7 GiB of weights fits on a **single 8ร—B200 or 8ร—H200-class node** (tensor-parallel 8), with headroom for a large KV cache. This is the single-node member of the de-risked line. - **Block-FP8 is auto-detected.** The packaged `config.json` carries the native `quant_method: fp8` block configuration; load it as-is and let the serving stack detect block-FP8 from the config. Do not force an online/dynamic FP8 path โ€” that would re-quantize the weights at load and discard this build. - **Multi-token prediction.** Unlike the BF16 master, this build **includes the layer-78 MTP head**, present in `model.safetensors.index.json` and format-matched to the vendor's FP8 layout. Speculative decoding is supported. - **KV cache.** `fp8_e4m3` KV is the tested configuration on Blackwell-class hardware. - **Integrity.** The index declares `total_size` 755,617,140,416 across 161 shards. Verify byte counts after download before you attribute a load failure to the weights. --- ## Access & licensing **Access is granted automatically on purchase** โ€” you do not wait on a manual review. **โžœ [Purchase access to this model](https://buy.stripe.com/28E28t0J562k0F33xnfw40f)** โ€” enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment. Commercial licensing, air-gapped deployment, custom de-risking against your own threat model, pruned or quantized variants sized to your hardware, and evaluation support are all available. If you need something that is not on this page, it probably already exists internally โ€” ask. --- ## Contact Blackfrost
### **[@Blackfrost_AI](https://x.com/Blackfrost_AI)** on X **DMs are open.** Fastest route to a human. Ask about this model, the BF16 master and pruned variants,
custom de-risked builds, or an enterprise evaluation licence. **Blackfrost** ยท Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety
--- ## Other builds Blackfrost publishes the GLM-5.2 de-risked line in several shapes. Access to full-precision and custom builds is granted **on purchase** under a separate licence agreement โ€” those repositories are gated, and approval follows a completed agreement. The gate *is* the transaction. | Build | What it is | |---|---| | [`GLM-5.2-DERISKED-BF16`](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-BF16) | Full-precision BF16 master โ€” every other build in this line derives from it | | **[`GLM-5.2-DERISKED-FP8`](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-FP8)** | **This build โ€” block-FP8, single-node serving, includes the MTP head** | | [`GLM-5.2-DERISKED-NVFP4`](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-NVFP4) | 4-bit NVFP4, single-node serving on sm_120-class hardware | | [`GLM-5.2-DERISKED-REAP-NU176-NVFP4`](https://huggingface.co/Blackfrost-Research/GLM-5.2-DERISKED-REAP-NU176-NVFP4) | Non-uniform REAP prune on top of NVFP4 โ€” smallest footprint in the line | | **Custom** | Expert budgets, non-uniform keep sets, or de-risking calibrated against your own threat model | **Purchase link coming soon.** Until then, [@Blackfrost_AI](https://x.com/Blackfrost_AI) DMs are the fastest route to a human. --- ## Disclaimer **Refusal behaviour in this checkpoint has been deliberately modified at the weight level.** It is not a safety-stock model and must not be deployed, marketed, or evaluated as one. **No warranty of any kind.** Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable. **Measurements describe what was measured.** Refusal rates, capability figures and latency reflect specific harnesses under stated conditions, with the caveats given above. They are not safety proofs and do not generalise to multimodal, tool-use, long-context or multi-turn adversarial settings beyond those tested. **Modification by a recipient voids this characterization.** Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind โ€” responsibility for that artifact transfers entirely to whoever produced it. **Operator-owned policy.** Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review. --- ## Responsible use Access is granted for authorised security work: red-team engagements you are contracted to perform, AI-safety and alignment research, guardrail and detection development, and model evaluation. Floor behaviour was evaluated separately from the 450-prompt de-risking harness; per-prompt floor results are available to licensees under NDA. ### Everything else Outside that floor, this checkpoint should be assumed capable of producing content a consumer model would decline. That is the point of the build. The remaining acceptable-use terms โ€” no unauthorised operations against systems or people you have no permission to test โ€” are **licence obligations, not model behaviour.** Deploy behind your own controls, logging, and access review, and treat outputs as untrusted. ---
**GLM-5.2-DERISKED-FP8** ยท ยฉ 2026 Blackfrost Softwares Corp.
[@Blackfrost_AI](https://x.com/Blackfrost_AI)