library_name: transformers
license: other
license_name: glm-5.3
base_model: zai-org/GLM-5.3
tags:

• glm
• glm-5.3
• abliterated
• uncensored
• cybersecurity
• fp8
• moonmath
  model-index:
• name: GLM-5.3-Uncensored-FP8
  results:
  • task:
    type: text-generation
    name: Refusal benchmark
    dataset:
    name: Cybersecurity refusal prompt set
    type: refusal
    metrics:
    • type: answer_rate
      value: 83.1
      name: Answer rate (%)
  • task:
    type: text-generation
    name: IFEval
    dataset:
    name: IFEval
    type: wis-k/ifeval
    metrics:
    • type: prompt_level_strict
      value: 91.0
      name: Prompt-level strict acc.
  • task:
    type: text-generation
    name: MMLU-Pro
    dataset:
    name: MMLU-Pro
    type: TIGER-Lab/MMLU-Pro
    metrics:
    • type: acc
      value: 89.0
      name: 5-shot CoT accuracy
  • task:
    type: text-generation
    name: AIME 2025
    dataset:
    name: AIME 2025
    type: math-ai/aime25
    metrics:
    • type: acc
      value: 73.3
      name: Accuracy

GLM-5.3 MoonMath Dolly2 (FP8)

[!WARNING]
This is an abliterated ("uncensored") model. It is a research artifact intended for
cybersecurity research. It may produce unexpected or unwanted output, is not evaluated
for safety, and is not affiliated with Z.ai, the creator of GLM-5.3. No warranty.

MoonMath Dolly2 is our first in-house abliterated model, built by abliterating
GLM-5.3 weights (zai-org/GLM-5.3). The published model family
is described in our blog post: Dolly and me: Building cybersecurity models at Zro.

With this version we emphasized intelligence and cybersecurity capability: rather than
maximally abliterated, the model is surgically modified so it stays helpful and capable on
ordinary tasks while being far more willing to address security research questions.

• Model creator: MoonMath.ai (Zro)
• Base model: zai-org/GLM-5.3
• Precision: FP8 (E4M3, blockwise 128×128)

Model description

Abliteration reduces a model's learned refusal behavior by intervening in its internal
representations, without retraining. Our recipe is surgical: it modifies a
small, targeted set of modules rather than broadly suppressing refusal directions:

• attention output projections (self_attn.o_proj) and shared-expert projections
  (mlp.shared_experts.down_proj)
• 29 modules across 21 layers (layers 30–62 attention, layers 34–44 shared experts)

This targeted approach keeps general capabilities intact — the modification touches a
minimal part of the network instead of broad refusal-direction suppression.

Refusal benchmark

We ran the model against a cybersecurity-focused refusal prompt set (attributed to
Meta Purple Llama's cybersecurity benchmark). Each response was classified as
addressing the request or deflecting it:

MoonMath delivered more responses and deflected fewer requests than the public
abliterated model. Neither model refused outright.

Quality benchmarks

Both models ran on the same stack (sglang, identical server flags, 8× AMD MI325X).
Scoring used stock lm-evaluation-harness 0.4.13 tasks (ifeval, mmlu_pro, aime25)
with no custom scorers. Head-to-head against a popular public abliterated GLM-5.3:

The public abliterated model also exhibited severe looping degeneration (67 confirmed
degenerate generations, 53% of IFEval responses hitting the 32k-token cap); MoonMath
showed 0 in the same run. Full details are in the
blog post.

Usage

The checkpoint follows the GLM-5.3 FP8 layout and works with transformers and vLLM /
SGLang just like the base model:

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "MoonMath-ai/GLM-5.3-Uncensored-FP8", device_map="auto", trust_remote_code=True
)
tokenizer = AutoTokenizer.from_pretrained("MoonMath-ai/GLM-5.3-Uncensored-FP8")

Intended uses and limitations

• Intended: cybersecurity research — exploit analysis, authentication-flow review,
  abuse-of-service analysis, and general security workflows where refusals block
  legitimate work.
• Limitations: abliteration trades safety calibration for helpfulness. The model may
  answer requests that the base model would decline. It is not safety-evaluated; do not
  use it as a general-purpose assistant in sensitive deployments without your own
  evaluation.

Use it on Zro

These weights are served on Zro, MoonMath's private inference platform, as the model
Dolly 2 Security (dolly2-security). No GPU setup, and no prompts retained after
processing.

With the CLI (open source, MIT):

npm install -g @moonmath-ai/zro
zro login
zro launch claude --model dolly2-security

zro launch also works with codex, opencode, hermes, openclaw, pi and many more harnesses.

With the API (OpenAI-compatible):

curl https://zro.moonmath.ai/v1/chat/completions \
  -H "Authorization: Bearer $ZRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"dolly2-security","messages":[{"role":"user","content":"Reply with OK"}]}'

• Model ID: dolly2-security (alias zro/dolly2-security). The lighter
  dolly1-security is also available.
• 1M-token context, up to 131K output. $2.10 per 1M input tokens, $6.30 per 1M output,
  $0.45 per 1M cache-read tokens. Prompt caching is on by default.
• Inference region per API key: Europe, the United States, or both. Requests are routed
  through the EU.
• Zero request retention, and no training on requests.
• Plans are monthly spend budgets, not token caps: Pro ($20/month, $40 usage budget) and
  Max ($60/month, $120 usage budget). A one-time $5 start needs no subscription. Team is
  coming soon.

Links: pricing ·
CLI docs ·
API reference ·
privacy ·
sign up ·
Dolly and me

License

GLM-5.3 is released by Z.ai under the GLM-5.3 model license (see
LICENSE in the base repo).
This checkpoint inherits the base model's license and terms.

Citation

@misc{moonmath2026dolly2,
  title  = {Dolly and me: Building cybersecurity models at Zro},
  author = {MoonMath.ai},
  year   = {2026},
  url    = {https://zro.moonmath.ai/posts/dolly-and-me}
}

Acknowledgements

• Z.ai for the GLM-5.3 base model