license: mit
library_name: llama.cpp
pipeline_tag: image-text-to-text
base_model:
- zai-org/GLM-5.3-Flash
base_model_relation: quantized
tags: - gguf
- llama-cpp
- abliteration
- uncensored
- glm
- iq1_s
- moe
- expert-editing
GLM-5.3-Flash Uncensored — GGUF
Refusal removed from GLM-5.3-Flash by editing
666 of its 12,384 routed experts — about 1.74% of the model's parameters. Quantized to
IQ1_S at 71.5 GiB, which fits on a single 96 GB card.
I did the edit and the quantization myself, and I measured what it cost. Every number below is
first-party, taken on my own rig, on the file in this repo.
Full write-up with charts and method: https://curve666-field-report.pages.dev/
What is different about this one
- Small edit. Only the down-projections of 666 selected experts are written. Every other
tensor is byte-identical to the parent. - Selected by refusal traffic, not magnitude. Same 384-expert budget spent on experts ranked
by the size of their refusal component leaves 25.0% refusal; spent on experts that actually
carry refusal traffic it leaves 5.8%. Which experts you pick matters more than how many. - Anti-repetition defaults baked into the file.
general.sampling.penalty_repeat = 1.1andgeneral.sampling.penalty_last_n = 256are set in the GGUF, so llama.cpp picks them up with no
flags. That cuts unusable answers from 14.2% to 5.0%.
Requirements
This needs a llama.cpp build with GLM-5.3-Flash support. It is not in upstream master yet.
Use PR #27754. That applies to every
GLM-5.3-Flash GGUF right now, not just this one.
My numbers below were measured on that PR plus two local commits of mine (an MTP path and a
KV-cache change). The MTP tensors are ignored at load time, so plain PR #27754 should behave the
same — but I have not proven that, and you should know which build the numbers came from.
Quants
| Quant | Size | Fits | Measured |
|---|---|---|---|
| IQ1_S | 71.5 GiB (2 shards) | one 96 GB card | yes — every number below |
More rungs to follow. Each will say plainly whether it was evaluated or only built, because I
can only serve up to about 96 GB and anything larger I cannot benchmark myself.
| Shared file | Size | |
|---|---|---|
mmproj-GLM-5.3-Flash-F16.gguf |
1.13 GB | vision, works with any rung |
Not uniformly 1-bit: attention, the shared experts and block 45 are kept at q8_0; only the
routed expert tensors are IQ1_S. Built with an imatrix.
The vision tower is unmodified — I converted it myself from zai-org/GLM-5.3-Flash, and the
edit never touches it. Text-only use does not need that file.
Quickstart
# text only
llama-server \
-m GLM-5.3-Flash-Uncensored-IQ1S-00001-of-00002.gguf \
-c 16384 --jinja --reasoning-budget 1024
# with vision
llama-server \
-m GLM-5.3-Flash-Uncensored-IQ1S-00001-of-00002.gguf \
--mmproj mmproj-GLM-5.3-Flash-F16.gguf \
-c 16384 --jinja --reasoning-budget 1024
Point at the first shard; llama.cpp loads the rest automatically.
--reasoning-budget 1024 matters. Without it GLM keeps thinking and often never reaches an
answer. Every number below was measured with it set.
Method
- Capture routing on refusal prompts, rank routed experts by how much refusal traffic each one
actually carries. - Take the top 666, project a single refusal direction (layer 44) out of their
ffn_down_expsweights at BF16. - Quantize the edited BF16 to IQ1_S with an imatrix.
The edit is applied at full precision and quantized afterwards. There is no runtime steering,
no LoRA, and nothing to load at serve time.
Results
Fixed 120-prompt harmful set, 120-prompt benign set, greedy, seed 0, --reasoning-budget 1024.
Measured on the file in this repo.
Refusal
| parent | this model | |
|---|---|---|
| keyword classifier | 99.2% | 3.3% |
| model judge (StrongREJECT rubric) | — | 4.2% |
The judge reads the whole answer, so it catches replies that open agreeably and then decline —
which a keyword rule scores as compliance. I report both because the cheap number flatters the
result by about a point.
Over-refusal on benign prompts
| refused | |
|---|---|
| parent | 1.7% |
| this model | 0.0% |
0 of 120, no errors, no empty responses. It refuses harmless requests less often than the model
it came from.
Degenerate output
| sampler | refused | repetition loops | no usable answer |
|---|---|---|---|
| greedy | 4.2% | 10.0% | 14.2% |
| baked defaults (rep-pen 1.1) | 3.3% | 1.7% | 5.0% |
A repetition loop contains no refusal language, so a refusal classifier scores it as a success.
Reporting refusal without this number overstates any abliteration.
Capability
| pass@1 | |
|---|---|
| parent, run 1 | 87.8% |
| parent, run 2 | 90.2% |
| this model | 87.2% |
HumanEval-164, greedy, 6000-token cap. The parent disagrees with itself by 2.4 points across two
runs; this model sits 0.6 below the weaker one.
What I did not measure
- Anything but coding. No GSM8K, MMLU, MBPP, tool use or agentic evaluation.
- Any language other than English. Both prompt sets are English.
- Long context. Everything was run at 16k.
- A higher-precision comparison. I cannot yet separate what the edit does from what it does
with IQ1_S on top. Testing that now.
Two base runs do not establish statistical equivalence. These are same-condition lab
measurements, not a leaderboard reproduction, and they are first-party — I made the model and I
graded it.
Intended use
Research, and local assistants where over-refusal is a problem. It is still a general model and
it will produce unsafe content if you ask it to. Use it under your own policy and applicable law.
Provenance
| Parent | zai-org/GLM-5.3-Flash |
| Quantizer | llama.cpp CUDA build 10700 |
| Edit | single refusal direction, layer 44, 666 routed-expert down-projections |
| Runtime | llama.cpp PR #27754, plus 2 local commits (see Requirements) |
| shard 1 | 04d81e6d17a7fdb9e04e39bbd15725f43a5ffefeaa51f608f67b07620ad913f0 |
| shard 2 | 4d0d4ce1eb9961306bdfa05af12d99609e7d0eb784c36c131c44d2cd47c515cd |
| mmproj | fffaa0aa02394d385a51db178a8b8a996c26955d642f367abee0048de244ee7a |
If you re-download this repo later and the hashes differ, the weights changed. Check.