library_name: transformers
license: other
license_name: glm-5.3
base_model: MoonMath-ai/GLM-5.3-Uncensored-FP8
tags:

• glm
• glm-5.3
• abliterated
• uncensored
• cybersecurity
• nvfp4
• modelopt
• moonmath
• conversational
  model-index:
• name: GLM-5.3-Uncensored-NVFP4
  results:
  • task:
    type: text-generation
    name: IFEval
    dataset:
    name: IFEval
    type: google/IFEval
    metrics:
    • type: prompt_level_strict
      value: 89.0
      name: Prompt-level strict acc.
  • task:
    type: text-generation
    name: MMLU-Pro
    dataset:
    name: MMLU-Pro
    type: TIGER-Lab/MMLU-Pro
    metrics:
    • type: acc
      value: 86.5
      name: 5-shot CoT accuracy
  • task:
    type: text-generation
    name: AIME 2025
    dataset:
    name: AIME 2025
    type: math-ai/aime25
    metrics:
    • type: acc
      value: 76.7
      name: Accuracy

GLM-5.3 MoonMath Dolly2 (NVFP4)

[!WARNING]
This is an abliterated ("uncensored") model. It is a research artifact intended for
cybersecurity research. It may produce unexpected or unwanted output, is not evaluated
for safety, and is not affiliated with Z.ai, the creator of GLM-5.3. No warranty.

This is the NVFP4 release of MoonMath Dolly2, our in-house abliterated
GLM-5.3. It is quantized from
MoonMath-ai/GLM-5.3-Uncensored-FP8
and keeps the FP8 model's quality while cutting the checkpoint from 756 GB to 464 GB,
so the full model fits on a single node of 8× 96 GB Blackwell GPUs.

• Model creator: MoonMath.ai (Zro)
• Base model: zai-org/GLM-5.3
• Parent checkpoint: MoonMath-ai/GLM-5.3-Uncensored-FP8
• Precision: NVFP4 routed experts, FP8 dense MLP, BF16 everything else (ModelOpt format)

Model description

Abliteration reduces a model's learned refusal behavior by intervening in its internal
representations, without retraining. Our recipe is surgical: it modifies a
small, targeted set of modules rather than broadly suppressing refusal directions:

• attention output projections (self_attn.o_proj) and shared-expert projections
  (mlp.shared_experts.down_proj)
• 29 modules across 21 layers (layers 30–62 attention, layers 34–44 shared experts)

Every module the abliteration touches stays in BF16 in this release. Only the routed
experts are quantized to 4 bits, and those are untouched by abliteration.

Quantization

The layout mirrors nvidia/GLM-5.3-NVFP4
tensor-for-tensor, so it loads with the same SGLang code path:

Weights were dequantized from the FP8 checkpoint (128×128 blocks) and requantized. Gate and
up projections share one global scale so they fuse into a single kernel. Because routed-expert
weights are identical to the base model, activation scales come from NVIDIA's calibration of
GLM-5.3. Our per-expert weight global scales match NVIDIA's exactly across all 57,600 quantized
experts. Routed-expert weight SNR vs. the FP8 parent is ~20.4 dB.

Quality benchmarks: NVFP4 vs FP8

NVFP4 scores were measured with stock lm-evaluation-harness 0.4.13 tasks (ifeval,
mmlu_pro, aime25) and no custom scorers, using the same item counts as the FP8 model card.

All three differences are within about one standard error: NVFP4 matches the FP8 model at
these sample sizes.

• FP8 numbers are from the FP8 model card
  (8× AMD MI325X). NVFP4 numbers were measured on 8× NVIDIA RTX PRO 6000 Blackwell with SGLang.
• Sampling: temperature 1.0, top_p 0.95, thinking enabled. IFEval and MMLU-Pro used a
  32,768-token generation budget; AIME used 65,536 tokens.
• MMLU-Pro is a proportional sample across all 14 subjects (--limit 0.0166).

Usage

SGLang

python3 -m sglang.launch_server \
    --model-path MoonMath-ai/GLM-5.3-Uncensored-NVFP4 \
    --tp-size 8 \
    --quantization modelopt_fp4 \
    --reasoning-parser glm45 \
    --tool-call-parser glm47 \
    --disable-shared-experts-fusion \
    --trust-remote-code

--disable-shared-experts-fusion is required: the BF16 shared expert cannot be fused into the
NVFP4 routed-expert kernel. Tested with SGLang 0.5.22 on 8× RTX PRO 6000 Blackwell (SM120).
NVFP4 needs a Blackwell GPU (SM100/SM120).

Intended uses and limitations

• Intended: cybersecurity research — exploit analysis, authentication-flow review,
  abuse-of-service analysis, and general security workflows where refusals block
  legitimate work.
• Limitations: abliteration trades safety calibration for helpfulness. The model may
  answer requests that the base model would decline. It is not safety-evaluated; do not
  use it as a general-purpose assistant in sensitive deployments without your own
  evaluation.

Use it on Zro

Don't want to run 8 GPUs yourself? Dolly2 is served on Zro, MoonMath's private inference
platform, as Dolly 2 Security (dolly2-security). No GPU setup, and no prompts retained
after processing.

With the CLI (open source, MIT):

npm install -g @moonmath-ai/zro
zro login
zro launch claude --model dolly2-security

With the API (OpenAI-compatible):

curl https://zro.moonmath.ai/v1/chat/completions \
  -H "Authorization: Bearer $ZRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"dolly2-security","messages":[{"role":"user","content":"Reply with OK"}]}'

Links: pricing ·
CLI docs ·
API reference ·
sign up ·
Dolly and me

License

GLM-5.3 is released by Z.ai under the GLM-5.3 model license (see
LICENSE in the base repo).
This checkpoint inherits the base model's license and terms.

Citation

@misc{moonmath2026dolly2,
  title  = {Dolly and me: Building cybersecurity models at Zro},
  author = {MoonMath.ai},
  year   = {2026},
  url    = {https://zro.moonmath.ai/posts/dolly-and-me}
}

Acknowledgements

• Z.ai for the GLM-5.3 base model
• NVIDIA for the GLM-5.3 NVFP4 layout and calibration