⚡ Built for offensive cybersecurity · Updated 2026-08-29
This is a red-team / offensive-security model. GLM-5.3 (753B) with refusal removed at the weight level so it produces real, working security code — exploits, payloads, tooling — for authorized penetration testing, malware analysis, CTFs, and security research. Verified to generate working keyloggers, SUID privilege-escalation, AES ransomware, reverse shells, and SSH brute-forcers across reasoning modes (greedy), with zero degeneration/looping and capability preserved (MMLU 84.11%, within ~1.5pp of base). Load with stock vLLM.
Designed for high / max reasoning-effort usage — the modes tuned and recommended for offensive-security work. A few borderline social-harm topics may still be declined at lower effort; use high or max effort for the fully-uncensored experience.
GLM 5.3 CRACK Abliterated NVFP4
CRACK · guardrails removed at the weight level · tuned for offensive security
a CRACK release by dealignai @dealignai · compute by @jordanschenck
Also mirrored at dealignai/GLM-5.3-UNCENSORED-NVFP4.
What Is This?
CRACK is dealignai's brand for permanent, weight-level uncensoring. This is GLM-5.3 (753B) in NVFP4 with its refusal behavior removed directly in the model weights — tuned so it complies with offensive-security requests (exploit dev, payloads, red-team tooling) that stock models refuse.
- ❌ No fine-tuning / SFT / DPO. ❌ No jailbreak prompt or chat-template tricks.
- ❌ No LoRA, adapters, steering vectors, runtime hooks, or custom
model.py. - ✅ A permanent edit baked into the tensors. Load with stock vLLM and it just works.
Specs
| Architecture | GLM-5.3 (glm_moe_dsa) — MoE + MLA + DeepSeek-sparse attention |
| Parameters | 753B total · ~18B active per token |
| Quantization | NVFP4 (routed experts NVFP4; attention + shared experts bf16) |
| Context | 1M tokens |
| MTP | multi-token-prediction draft head — also CRACK'd (~87% draft acceptance) |
| Reasoning | reasoning-off / low / high / max effort |
Refusal Rates — HarmBench (greedy, per reasoning-effort mode)
Measured on random HarmBench prompts, greedy decode, single-stream, max_tokens=1400,
classifier reads content + reasoning combined so nothing is counted as refusal by accident:
| Reasoning effort | Prompts | Comply | Refuse | Refuse rate |
|---|---|---|---|---|
| default (off) | 109 answered | 101 | 8 | 7.3% |
| high | 76 | 76 | 0 | 0.0% |
| max | 80 | 80 | 0 | 0.0% |
At high and max the model is fully uncensored — 0 refusals across 156 random HarmBench prompts. The 8 refusals at off-mode are 7 copyright ('full lyrics of X', 'long passage from Y') plus 1 political persuasion — the true safety-refusal rate at off is <1%. Use high or max effort for the fully-uncensored experience.
Offensive-Security Compliance (direct-read)
Direct-read verification — the model returns real, working code, not refusals or redirects:
| Capability | Result |
|---|---|
| Reverse shell / C2 beacon | ✅ working code |
| Keylogger (capture + exfil) | ✅ working code |
| AES ransomware (encrypt + note) | ✅ working code |
| Linux SUID privilege escalation | ✅ working code |
| SSH brute-force | ✅ working code |
| SQL injection payloads | ✅ working code |
Also complies on broader red-team topics (malware analysis, phishing templates for awareness, recon). 0 looping / degenerate outputs in every mode.
Capability Preserved — MMLU-logit
Identical logit-mode scoring (argmax over A/B/C/D), 1,026 questions:
| Base | CRACK Abliterated | Δ | |
|---|---|---|---|
| MMLU (overall) | 85.58% | 84.11% | -1.47 pp |
MMLU by Topic (base → CRACK)
All 57 MMLU subjects| Subject | Base | CRACK |
|---|---|---|
| Abstract Algebra | 66.7% | 55.6% |
| Anatomy | 83.3% | 83.3% |
| Astronomy | 94.4% | 94.4% |
| Business Ethics | 94.4% | 94.4% |
| Clinical Knowledge | 88.9% | 88.9% |
| College Biology | 94.4% | 94.4% |
| College Chemistry | 55.6% | 50.0% |
| College Computer Science | 77.8% | 66.7% |
| College Mathematics | 66.7% | 72.2% |
| College Medicine | 88.9% | 83.3% |
| College Physics | 77.8% | 83.3% |
| Computer Security | 94.4% | 88.9% |
| Conceptual Physics | 94.4% | 94.4% |
| Econometrics | 88.9% | 83.3% |
| Electrical Engineering | 77.8% | 77.8% |
| Elementary Mathematics | 83.3% | 83.3% |
| Formal Logic | 61.1% | 55.6% |
| Global Facts | 61.1% | 61.1% |
| High School Biology | 94.4% | 94.4% |
| High School Chemistry | 94.4% | 100.0% |
| High School Computer Science | 88.9% | 88.9% |
| High School European History | 83.3% | 77.8% |
| High School Geography | 83.3% | 83.3% |
| High School Government And Politics | 100.0% | 100.0% |
| High School Macroeconomics | 88.9% | 83.3% |
| High School Mathematics | 44.4% | 44.4% |
| High School Microeconomics | 94.4% | 94.4% |
| High School Physics | 72.2% | 83.3% |
| High School Psychology | 100.0% | 100.0% |
| High School Statistics | 100.0% | 83.3% |
| High School Us History | 88.9% | 88.9% |
| High School World History | 94.4% | 94.4% |
| Human Aging | 83.3% | 83.3% |
| Human Sexuality | 88.9% | 88.9% |
| International Law | 94.4% | 94.4% |
| Jurisprudence | 100.0% | 94.4% |
| Logical Fallacies | 94.4% | 94.4% |
| Machine Learning | 77.8% | 66.7% |
| Management | 94.4% | 88.9% |
| Marketing | 100.0% | 100.0% |
| Medical Genetics | 100.0% | 94.4% |
| Miscellaneous | 94.4% | 94.4% |
| Moral Disputes | 83.3% | 88.9% |
| Moral Scenarios | 61.1% | 66.7% |
| Nutrition | 100.0% | 94.4% |
| Philosophy | 100.0% | 100.0% |
| Prehistory | 94.4% | 88.9% |
| Professional Accounting | 66.7% | 66.7% |
| Professional Law | 83.3% | 77.8% |
| Professional Medicine | 94.4% | 94.4% |
| Professional Psychology | 100.0% | 100.0% |
| Public Relations | 77.8% | 72.2% |
| Security Studies | 66.7% | 66.7% |
| Sociology | 100.0% | 94.4% |
| Us Foreign Policy | 100.0% | 94.4% |
| Virology | 50.0% | 61.1% |
| World Religions | 94.4% | 100.0% |
Usage
vllm serve dealignai/GLM-5.3-ABLITERATED-NVFP4 \
--tensor-parallel-size 8 --moe-backend marlin \
--tool-call-parser glm47 --reasoning-parser glm45 --enable-auto-tool-choice
NVFP4 routed experts serve via the Marlin FP4 path on Hopper (H100/H200). GLM-5.3's DSA sparse attention needs a recent FlashInfer (>= 0.6.18) for the SM90 sparse-MLA backend.
MTP speculative decoding (also CRACK'd, ~87% draft acceptance): add
--speculative-config '{"method":"mtp","num_speculative_tokens":1}' and let vLLM auto-select
the MoE backend (the bf16 MTP head is unquantized, so don't force a global --moe-backend).
Credits
- dealignai — CRACK abliteration research & release · Twitter @dealignai
Disclaimer
Safety guardrails have been removed; this model produces offensive-security content and will comply with requests a stock model refuses. Released for authorized security research, red- teaming, and CTFs. You are responsible for how you use it.