library_name: transformers license: other license_name: glm-5.3 base_model: MoonMath-ai/GLM-5.3-Uncensored-FP8 tags:

• glm
• glm-5.3
• abliterated
• uncensored
• cybersecurity
• nvfp4
• modelopt
• moonmath
• conversational model-index:
• name: GLM-5.3-Uncensored-NVFP4 results:
  • task: type: text-generation name: IFEval dataset: name: IFEval type: google/IFEval metrics:
    • type: prompt_level_strict value: 89.0 name: Prompt-level strict acc.
  • task: type: text-generation name: MMLU-Pro dataset: name: MMLU-Pro type: TIGER-Lab/MMLU-Pro metrics:
    • type: acc value: 86.5 name: 5-shot CoT accuracy
  • task: type: text-generation name: AIME 2025 dataset: name: AIME 2025 type: math-ai/aime25 metrics:
    • type: acc value: 76.7 name: Accuracy

GLM-5.3 MoonMath Dolly2 (NVFP4)

[!WARNING] This is an abliterated ("uncensored") model. It is a research artifact intended for cybersecurity research. It may produce unexpected or unwanted output, is not evaluated for safety, and is not affiliated with Z.ai, the creator of GLM-5.3. No warranty.

This is the NVFP4 release of MoonMath Dolly2, our in-house abliterated GLM-5.3. It is quantized from MoonMath-ai/GLM-5.3-Uncensored-FP8 and keeps the FP8 model's quality while cutting the checkpoint from 756 GB to 464 GB, so the full model fits on a single node of 8× 96 GB Blackwell GPUs.

• Model creator: MoonMath.ai (Zro)
• Base model: zai-org/GLM-5.3
• Parent checkpoint: MoonMath-ai/GLM-5.3-Uncensored-FP8
• Precision: NVFP4 routed experts, FP8 dense MLP, BF16 everything else (ModelOpt format)

Model description

Abliteration reduces a model's learned refusal behavior by intervening in its internal representations, without retraining. Our recipe is surgical: it modifies a small, targeted set of modules rather than broadly suppressing refusal directions:

• attention output projections (self_attn.o_proj) and shared-expert projections (mlp.shared_experts.down_proj)
• 29 modules across 21 layers (layers 30–62 attention, layers 34–44 shared experts)

Every module the abliteration touches stays in BF16 in this release. Only the routed experts are quantized to 4 bits, and those are untouched by abliteration.

Quantization

The layout mirrors nvidia/GLM-5.3-NVFP4 tensor-for-tensor, so it loads with the same SGLang code path:

Weights were dequantized from the FP8 checkpoint (128×128 blocks) and requantized. Gate and up projections share one global scale so they fuse into a single kernel. Because routed-expert weights are identical to the base model, activation scales come from NVIDIA's calibration of GLM-5.3. Our per-expert weight global scales match NVIDIA's exactly across all 57,600 quantized experts. Routed-expert weight SNR vs. the FP8 parent is ~20.4 dB.

Quality benchmarks: NVFP4 vs FP8

NVFP4 scores were measured with stock lm-evaluation-harness 0.4.13 tasks (ifeval, mmlu_pro, aime25) and no custom scorers, using the same item counts as the FP8 model card.

All three differences are within about one standard error: NVFP4 matches the FP8 model at these sample sizes.

• FP8 numbers are from the FP8 model card (8× AMD MI325X). NVFP4 numbers were measured on 8× NVIDIA RTX PRO 6000 Blackwell with SGLang.
• Sampling: temperature 1.0, top_p 0.95, thinking enabled. IFEval and MMLU-Pro used a 32,768-token generation budget; AIME used 65,536 tokens.
• MMLU-Pro is a proportional sample across all 14 subjects (--limit 0.0166).

Usage

SGLang

python3 -m sglang.launch_server \
    --model-path MoonMath-ai/GLM-5.3-Uncensored-NVFP4 \
    --tp-size 8 \
    --quantization modelopt_fp4 \
    --reasoning-parser glm45 \
    --tool-call-parser glm47 \
    --disable-shared-experts-fusion \
    --trust-remote-code

--disable-shared-experts-fusion is required: the BF16 shared expert cannot be fused into the NVFP4 routed-expert kernel. Tested with SGLang 0.5.22 on 8× RTX PRO 6000 Blackwell (SM120). NVFP4 needs a Blackwell GPU (SM100/SM120).

Intended uses and limitations

• Intended: cybersecurity research — exploit analysis, authentication-flow review, abuse-of-service analysis, and general security workflows where refusals block legitimate work.
• Limitations: abliteration trades safety calibration for helpfulness. The model may answer requests that the base model would decline. It is not safety-evaluated; do not use it as a general-purpose assistant in sensitive deployments without your own evaluation.

Use it on Zro

Don't want to run 8 GPUs yourself? Dolly2 is served on Zro, MoonMath's private inference platform, as Dolly 2 Security (dolly2-security). No GPU setup, and no prompts retained after processing.

With the CLI (open source, MIT):

npm install -g @moonmath-ai/zro
zro login
zro launch claude --model dolly2-security

With the API (OpenAI-compatible):

curl https://zro.moonmath.ai/v1/chat/completions \
  -H "Authorization: Bearer $ZRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"dolly2-security","messages":[{"role":"user","content":"Reply with OK"}]}'

Links: pricing · CLI docs · API reference · sign up · Dolly and me

License

GLM-5.3 is released by Z.ai under the GLM-5.3 model license (see LICENSE in the base repo). This checkpoint inherits the base model's license and terms.

Citation

@misc{moonmath2026dolly2,
  title  = {Dolly and me: Building cybersecurity models at Zro},
  author = {MoonMath.ai},
  year   = {2026},
  url    = {https://zro.moonmath.ai/posts/dolly-and-me}
}

Acknowledgements

• Z.ai for the GLM-5.3 base model
• NVIDIA for the GLM-5.3 NVFP4 layout and calibration