license: mit
base_model: zai-org/GLM-5.3-Flash
base_model_relation: quantized
pipeline_tag: image-text-to-text
library_name: mlx
language:

• en
• zh
  tags:
• abliterated
• uncensored
• glm
• glm5
• glm-5.3-flash
• glm5-next
• moe
• vision-language
• function-calling
• reasoning
• mtp
• mlx
• apple-silicon
• 4bit
• ai-red-team
• red-teaming

GLM-5.3-Flash-Uncensored-MLX

An abliterated (refusal-removed) MLX build (2 / 3 / 4 / 6-bit) of GLM-5.3-Flash for Apple Silicon & the MLX CUDA backend

One Gateway. Every Model. — Route Smarter · Ship Safer · Spend Less.

Website · Model Catalog · GitHub · Discord · X

Quantizations in this repo

The 4-bit weights are mirrored at the repo root (loads by default); the other tiers live in their
N-bit/ subfolders. This is a dynamic (mixed-precision) MLX quant: MoE experts carry the base bits,
their down_proj is bumped +1 bit and the shared expert +2, attention is pinned to 8-bit, and the
linear-attention path / sparse indexer / hyper-connections / router / norms / embeddings / lm_head /
vision tower stay BF16 — so the effective footprint is above a uniform quant, by design (see below).

An abliterated MLX build of zai-org/GLM-5.3-Flash
— a 320B / 18B-active Mixture-of-Experts model (glm5_next) with hybrid linear + sparse attention,
4-wide Manifold-Constrained Hyper-Connections, a native vision + video tower, an MTP
speculative head, and a 1M-token context — quantized to MLX for Apple Silicon and the MLX
CUDA backend. Convert/run with an mlx-vlm build that has landed glm5_next support.

Derived releases:  •  GLM-5.3-Flash-Uncensored-FP8 (block-FP8, mirrors official)
 •  GLM-5.3-Flash-Uncensored-NVFP4 (experts-only NVFP4, for vLLM)
 •  GLM-5.3-Flash-Uncensored-MLX (2 / 3 / 4 / 6-bit, Apple Silicon).

⚠️ Disclaimer — read before use

This model has had its safety alignment substantially removed via abliteration (orthogonalizing the
refusal direction out of the residual stream). As a direct consequence:

• It will comply with harmful, unethical, offensive, or illegal requests that the original
  GLM-5.3-Flash would refuse. It has no meaningful built-in guardrails.
• It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism
  study, red-teaming, robustness evaluation, and controlled experiments.
• You assume full responsibility and liability for how you use it and for everything it generates. Do
  not deploy it to end users or in production without adding your own safety, moderation, and
  abuse-prevention layers.
• Use must comply with the MIT License inherited from the base
  model, and all laws and regulations that apply to you.
• The authors and uploaders accept no liability for any misuse or harm. Its outputs do not reflect
  the views of the uploaders or of Z.ai / Zhipu AI.

By downloading or using this model you acknowledge and accept the above.

🐋 Run it with OrcaCode Review

Models are only half the system.

OrcaCode Review turns every model listed on
OrcaRouter into a production code-review agent:

• reviews every PR
• finds security + correctness issues
• posts inline findings
• P0/P1 can block merges
• swap models anytime

Open model. Open harness. Open bill.

• Website — https://www.orcarouter.ai
• GitHub — https://github.com/Continuum-AI-Corp/Orca-Code-Review

Model details

Quant recipe (per tier T = 2/3/4/6)

• Attention is pinned 8-bit in every tier. On this model the routed-expert down_proj carries most
  of the signal, but low-bit attention is the prime suspect for long-context looping, so it never drops to
  the base tier.
• F32 aux tensors stay F32 (not downcast to BF16) — they are precision-sensitive through the SSM
  recurrence and the mHC residual.
• The MTP block is dropped and num_nextn_predict_layers set to 0 (the MLX runtime drops it on load);
  speculative decoding is off.
• Data-free: derived directly from the FP8 checkpoint, no calibration corpus.

Abliteration

Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is Mediated by a
Single Direction — a single direction (k = 1) estimated as the massive-activation-masked mean-difference
of harmful − harmless residuals, orthogonalized out of every residual-writing matrix in float32, baked on
disk into the FP8 checkpoint this build was quantized from. On GLM-5.3-Flash the refusal direction is
written almost entirely by the routed-expert down_proj matrices. Refusal is reduced, not removed:
a few extreme content categories the single direction does not reach still refuse. See the base
GLM-5.3-Flash-Uncensored-FP8 card for the full method and safety numbers.

Evaluation — quality vs FP8

Each build's actual quantized bytes vs the abliterated (uncensored) FP8 source these builds were
quantized from, measured on wikitext-2 test, 4 chunks × 1024 tokens (4,092 predicted tokens). Lower
KLD and higher Top-1 = closer to the FP8 source.

All three signals agree on the ordering and on where the cliff is: 6-bit is lossless (the −1.1 % PPL is
sampling noise on a small corpus — the KLD of 0.047 shows the distribution did move), 4-bit is the sweet
spot, 3-bit degrades gently, and 2-bit costs a lot — pick it for fit, not quality. Weight-space
fidelity for every quantized tensor is recorded at pack time in each build's fidelity_summary.json
(4-bit routed experts: cosine 0.996, SNR 21–27 dB).

Usage — Apple Silicon (MLX)

pip install -U "mlx-vlm>=0.6.17"     # needs a build with glm5_next support

# default (4-bit, repo root)
python -m mlx_vlm.generate --model orcarouter/GLM-5.3-Flash-Uncensored-MLX \
  --prompt "Explain quantum entanglement in one sentence." --max-tokens 256

# a specific tier
python -m mlx_vlm.generate --model orcarouter/GLM-5.3-Flash-Uncensored-MLX/6-bit \
  --prompt "Explain quantum entanglement in one sentence." --max-tokens 256

GLM-5.3-Flash is a vision-language model, so it runs under mlx-vlm (not mlx-lm); pass
--image for image input. It has no enable_thinking toggle — control the reasoning budget with
reasoning_effort (low / high / max) in the chat template, and give generation enough --max-tokens
to reach </think>. Requires a Mac (or MLX CUDA backend) with enough memory for the chosen tier's weights.

Bias, risks, and limitations

• Safety guardrails removed — see the disclaimer.
• Inherits biases / limitations of the base GLM-5.3-Flash.
• Low-bit tiers (2 / 3-bit) trade real quality for size; 4-bit and up track the FP8 source closely.

License

MIT, inherited from zai-org/GLM-5.3-Flash.
Abliteration and quantization do not change the underlying license obligations.