library_name: transformers license: other license_name: glm-5.3 base_model: zai-org/GLM-5.3 tags:

• glm
• glm-5.3
• abliterated
• uncensored
• cybersecurity
• fp8
• moonmath model-index:
• name: GLM-5.3-Uncensored-FP8 results:
  • task: type: text-generation name: Refusal benchmark dataset: name: Cybersecurity refusal prompt set type: refusal metrics:
    • type: answer_rate value: 83.1 name: Answer rate (%)
  • task: type: text-generation name: IFEval dataset: name: IFEval type: wis-k/ifeval metrics:
    • type: prompt_level_strict value: 91.0 name: Prompt-level strict acc.
  • task: type: text-generation name: MMLU-Pro dataset: name: MMLU-Pro type: TIGER-Lab/MMLU-Pro metrics:
    • type: acc value: 89.0 name: 5-shot CoT accuracy
  • task: type: text-generation name: AIME 2025 dataset: name: AIME 2025 type: math-ai/aime25 metrics:
    • type: acc value: 73.3 name: Accuracy

GLM-5.3 MoonMath Dolly2 (FP8)

[!WARNING] This is an abliterated ("uncensored") model. It is a research artifact intended for cybersecurity research. It may produce unexpected or unwanted output, is not evaluated for safety, and is not affiliated with Z.ai, the creator of GLM-5.3. No warranty.

MoonMath Dolly2 is our first in-house abliterated model, built by abliterating GLM-5.3 weights (zai-org/GLM-5.3). The published model family is described in our blog post: Dolly and me: Building cybersecurity models at Zro.

With this version we emphasized intelligence and cybersecurity capability: rather than maximally abliterated, the model is surgically modified so it stays helpful and capable on ordinary tasks while being far more willing to address security research questions.

• Model creator: MoonMath.ai (Zro)
• Base model: zai-org/GLM-5.3
• Precision: FP8 (E4M3, blockwise 128×128)

Model description

Abliteration reduces a model's learned refusal behavior by intervening in its internal representations, without retraining. Our recipe is surgical: it modifies a small, targeted set of modules rather than broadly suppressing refusal directions:

• attention output projections (self_attn.o_proj) and shared-expert projections (mlp.shared_experts.down_proj)
• 29 modules across 21 layers (layers 30–62 attention, layers 34–44 shared experts)

This targeted approach keeps general capabilities intact — the modification touches a minimal part of the network instead of broad refusal-direction suppression.

Refusal benchmark

We ran the model against a cybersecurity-focused refusal prompt set (attributed to Meta Purple Llama's cybersecurity benchmark). Each response was classified as addressing the request or deflecting it:

MoonMath delivered more responses and deflected fewer requests than the public abliterated model. Neither model refused outright.

Quality benchmarks

Both models ran on the same stack (sglang, identical server flags, 8× AMD MI325X). Scoring used stock lm-evaluation-harness 0.4.13 tasks (ifeval, mmlu_pro, aime25) with no custom scorers. Head-to-head against a popular public abliterated GLM-5.3:

The public abliterated model also exhibited severe looping degeneration (67 confirmed degenerate generations, 53% of IFEval responses hitting the 32k-token cap); MoonMath showed 0 in the same run. Full details are in the blog post.

Usage

The checkpoint follows the GLM-5.3 FP8 layout and works with transformers and vLLM / SGLang just like the base model:

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "MoonMath-ai/GLM-5.3-Uncensored-FP8", device_map="auto", trust_remote_code=True
)
tokenizer = AutoTokenizer.from_pretrained("MoonMath-ai/GLM-5.3-Uncensored-FP8")

Intended uses and limitations

• Intended: cybersecurity research — exploit analysis, authentication-flow review, abuse-of-service analysis, and general security workflows where refusals block legitimate work.
• Limitations: abliteration trades safety calibration for helpfulness. The model may answer requests that the base model would decline. It is not safety-evaluated; do not use it as a general-purpose assistant in sensitive deployments without your own evaluation.

Use it on Zro

These weights are served on Zro, MoonMath's private inference platform, as the model Dolly 2 Security (dolly2-security). No GPU setup, and no prompts retained after processing.

With the CLI (open source, MIT):

npm install -g @moonmath-ai/zro
zro login
zro launch claude --model dolly2-security

zro launch also works with codex, opencode, hermes, openclaw, pi and many more harnesses.

With the API (OpenAI-compatible):

curl https://zro.moonmath.ai/v1/chat/completions \
  -H "Authorization: Bearer $ZRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"dolly2-security","messages":[{"role":"user","content":"Reply with OK"}]}'

• Model ID: dolly2-security (alias zro/dolly2-security). The lighter dolly1-security is also available.
• 1M-token context, up to 131K output. $2.10 per 1M input tokens, $6.30 per 1M output, $0.45 per 1M cache-read tokens. Prompt caching is on by default.
• Inference region per API key: Europe, the United States, or both. Requests are routed through the EU.
• Zero request retention, and no training on requests.
• Plans are monthly spend budgets, not token caps: Pro ($20/month, $40 usage budget) and Max ($60/month, $120 usage budget). A one-time $5 start needs no subscription. Team is coming soon.

Links: pricing · CLI docs · API reference · privacy · sign up · Dolly and me

License

GLM-5.3 is released by Z.ai under the GLM-5.3 model license (see LICENSE in the base repo). This checkpoint inherits the base model's license and terms.

Citation

@misc{moonmath2026dolly2,
  title  = {Dolly and me: Building cybersecurity models at Zro},
  author = {MoonMath.ai},
  year   = {2026},
  url    = {https://zro.moonmath.ai/posts/dolly-and-me}
}

Acknowledgements

• Z.ai for the GLM-5.3 base model