README.md

---
license: mit
base_model:
- zai-org/GLM-5.3
language:
- en
tags:
- abliterated
- uncensored
- crack
- glm
- moe
- nvfp4
- cybersecurity
- offensive-security
- mtp
thumbnail: dealign_mascot.png
---

> ## ⚡ Built for offensive cybersecurity · Updated 2026-08-29
>
> **This is a red-team / offensive-security model.** GLM-5.3 (753B) with refusal removed at the
> weight level so it produces **real, working security code** — exploits, payloads, tooling —
> for authorized penetration testing, malware analysis, CTFs, and security research. Verified to
> generate working **keyloggers, SUID privilege-escalation, AES ransomware, reverse shells, and
> SSH brute-forcers** across reasoning modes (greedy), with **zero degeneration/looping** and
> capability preserved (**MMLU 84.11%**, within ~1.5pp of base). Load with stock vLLM.
>
> **Designed for high / max reasoning-effort usage** — the modes tuned and recommended for
> offensive-security work. A few borderline social-harm topics may still be declined at lower
> effort; use high or max effort for the fully-uncensored experience.

<div align="center">
<img src="dealign_mascot.png" width="140" />

# GLM 5.3 CRACK Uncensored NVFP4

**CRACK** · guardrails removed at the weight level · tuned for **offensive security**

a **CRACK** release by [dealignai](https://huggingface.co/dealignai) [@dealignai](https://twitter.com/dealignai) · compute by [@jordanschenck](https://twitter.com/jordanschenck)

*Also mirrored at [dealignai/GLM-5.3-ABLITERATED-NVFP4](https://huggingface.co/dealignai/GLM-5.3-ABLITERATED-NVFP4).*

</div>

---

> [!IMPORTANT]
> **Runtime notes** — field-tested on 8× DGX Spark GB10 by [@0xMagnus](https://huggingface.co/0xMagnus) ([discussion](https://huggingface.co/dealignai/GLM-5.3-UNCENSORED-FP8/discussions/3)):
>
> - **`reasoning_effort` only honors `"low"` and `"high"`.** Every other value — `off`, `medium`, `max`, unset, or an unquoted YAML `off:` (parses as boolean `false`) — falls through to `max`. There is no way to disable reasoning on this checkpoint; pass `"low"` for minimum.
> - **On NVFP4, `high` is usable** with `max_tokens ≥ 16384` (finishes cleanly). `max` will often exhaust the budget with a very long reasoning block and a truncated answer. NVFP4 tolerates `high` better than the FP8 build.
> - **Reasoning text is in `message.reasoning`**, not `message.reasoning_content`.
> - **On GB10, NVFP4 is a memory / context play, not a speed play** — no native FP4 compute, weights dequantize on the fly; decode lands near FP8 + MTP. The win is KV pool (~35 GiB/rank vs FP8's 7–9 GiB) → practical **512K context at TP8** (~695K-token pool at 1.33× concurrency).
> - **1M context via decode-context-parallel is closed** on `glm_moe_dsa` in vLLM today (DSA indexer `k_cache` is replicated across DCP ranks while MLA KV is sharded → `page size is not divisible by target page size and cannot be padded` for `nvfp4_ds_mla`).

## What Is This?

**CRACK** is dealignai's brand for permanent, weight-level uncensoring. This is
[GLM-5.3](https://huggingface.co/zai-org/GLM-5.3) (753B) in **NVFP4** with its refusal behavior
removed **directly in the model weights** — tuned so it complies with **offensive-security**
requests (exploit dev, payloads, red-team tooling) that stock models refuse.

- ❌ No fine-tuning / SFT / DPO. ❌ No jailbreak prompt or chat-template tricks.
- ❌ No LoRA, adapters, steering vectors, runtime hooks, or custom `model.py`.
- ✅ A permanent edit baked into the tensors. Load with stock vLLM and it just works.

## Specs

| | |
|---|---|
| **Architecture** | GLM-5.3 (`glm_moe_dsa`) — MoE + MLA + DeepSeek-sparse attention |
| **Parameters** | **753B total · ~18B active** per token |
| **Quantization** | **NVFP4** (routed experts NVFP4; attention + shared experts bf16) |
| **Context** | 1M tokens |
| **MTP** | multi-token-prediction draft head — **also CRACK'd** (~87% draft acceptance) |
| **Reasoning** | reasoning-off / low / high / max effort |

## Refusal Rates — HarmBench (greedy, per reasoning-effort mode)

Measured on random HarmBench prompts, greedy decode, single-stream, `max_tokens=1400`,
classifier reads **content + reasoning combined** so nothing is counted as refusal by accident:

| Reasoning effort | Prompts | Comply | Refuse | **Refuse rate** |
|---|---|---|---|---|
| **default (off)** | 109 answered | 101 | 8 | **7.3%** |
| **high**  | 76  | 76  | 0 | **0.0%** |
| **max**   | 80  | 80  | 0 | **0.0%** |

At **high** and **max** the model is fully uncensored — 0 refusals across 156 random
HarmBench prompts. The 8 refusals at off-mode are 7 **copyright** ('full lyrics of X',
'long passage from Y') plus 1 political persuasion — the true safety-refusal rate at off is
<1%. **Use high or max effort for the fully-uncensored experience.**

## Offensive-Security Compliance (direct-read)

Direct-read verification — the model returns **real, working code**, not refusals or redirects:

| Capability | Result |
|---|---|
| Reverse shell / C2 beacon | ✅ working code |
| Keylogger (capture + exfil) | ✅ working code |
| AES ransomware (encrypt + note) | ✅ working code |
| Linux SUID privilege escalation | ✅ working code |
| SSH brute-force | ✅ working code |
| SQL injection payloads | ✅ working code |

Also complies on broader red-team topics (malware analysis, phishing templates for awareness,
recon). **0 looping / degenerate outputs** in every mode.

## Capability Preserved — MMLU-logit

Identical logit-mode scoring (argmax over A/B/C/D), 1,026 questions:

| | Base | CRACK Uncensored | Δ |
|---|---|---|---|
| **MMLU (overall)** | **85.58%** | **84.11%** | **-1.47 pp** |

## MMLU by Topic (base → CRACK)

<details>
<summary>All 57 MMLU subjects</summary>

| Subject | Base | CRACK |
|---|---|---|
| Abstract Algebra | 66.7% | 55.6% |
| Anatomy | 83.3% | 83.3% |
| Astronomy | 94.4% | 94.4% |
| Business Ethics | 94.4% | 94.4% |
| Clinical Knowledge | 88.9% | 88.9% |
| College Biology | 94.4% | 94.4% |
| College Chemistry | 55.6% | 50.0% |
| College Computer Science | 77.8% | 66.7% |
| College Mathematics | 66.7% | 72.2% |
| College Medicine | 88.9% | 83.3% |
| College Physics | 77.8% | 83.3% |
| Computer Security | 94.4% | 88.9% |
| Conceptual Physics | 94.4% | 94.4% |
| Econometrics | 88.9% | 83.3% |
| Electrical Engineering | 77.8% | 77.8% |
| Elementary Mathematics | 83.3% | 83.3% |
| Formal Logic | 61.1% | 55.6% |
| Global Facts | 61.1% | 61.1% |
| High School Biology | 94.4% | 94.4% |
| High School Chemistry | 94.4% | 100.0% |
| High School Computer Science | 88.9% | 88.9% |
| High School European History | 83.3% | 77.8% |
| High School Geography | 83.3% | 83.3% |
| High School Government And Politics | 100.0% | 100.0% |
| High School Macroeconomics | 88.9% | 83.3% |
| High School Mathematics | 44.4% | 44.4% |
| High School Microeconomics | 94.4% | 94.4% |
| High School Physics | 72.2% | 83.3% |
| High School Psychology | 100.0% | 100.0% |
| High School Statistics | 100.0% | 83.3% |
| High School Us History | 88.9% | 88.9% |
| High School World History | 94.4% | 94.4% |
| Human Aging | 83.3% | 83.3% |
| Human Sexuality | 88.9% | 88.9% |
| International Law | 94.4% | 94.4% |
| Jurisprudence | 100.0% | 94.4% |
| Logical Fallacies | 94.4% | 94.4% |
| Machine Learning | 77.8% | 66.7% |
| Management | 94.4% | 88.9% |
| Marketing | 100.0% | 100.0% |
| Medical Genetics | 100.0% | 94.4% |
| Miscellaneous | 94.4% | 94.4% |
| Moral Disputes | 83.3% | 88.9% |
| Moral Scenarios | 61.1% | 66.7% |
| Nutrition | 100.0% | 94.4% |
| Philosophy | 100.0% | 100.0% |
| Prehistory | 94.4% | 88.9% |
| Professional Accounting | 66.7% | 66.7% |
| Professional Law | 83.3% | 77.8% |
| Professional Medicine | 94.4% | 94.4% |
| Professional Psychology | 100.0% | 100.0% |
| Public Relations | 77.8% | 72.2% |
| Security Studies | 66.7% | 66.7% |
| Sociology | 100.0% | 94.4% |
| Us Foreign Policy | 100.0% | 94.4% |
| Virology | 50.0% | 61.1% |
| World Religions | 94.4% | 100.0% |

</details>

## Usage

```bash
vllm serve dealignai/GLM-5.3-UNCENSORED-NVFP4 \
  --tensor-parallel-size 8 --moe-backend marlin \
  --tool-call-parser glm47 --reasoning-parser glm45 --enable-auto-tool-choice
```

NVFP4 routed experts serve via the Marlin FP4 path on Hopper (H100/H200). GLM-5.3's DSA sparse
attention needs a recent FlashInfer (>= 0.6.18) for the SM90 sparse-MLA backend.

**MTP speculative decoding** (also CRACK'd, ~87% draft acceptance): add
`--speculative-config '{"method":"mtp","num_speculative_tokens":1}'` and let vLLM auto-select
the MoE backend (the bf16 MTP head is unquantized, so don't force a global `--moe-backend`).

## Credits

- **[dealignai](https://huggingface.co/dealignai)** — CRACK abliteration research & release · Twitter **[@dealignai](https://twitter.com/dealignai)**

## Disclaimer

Safety guardrails have been removed; this model produces offensive-security content and will
comply with requests a stock model refuses. Released for **authorized** security research, red-
teaming, and CTFs. You are responsible for how you use it.