GLM-5.3-Flash-Uncensored — imatrix GGUF

GGUF quantizations of orcarouter/GLM-5.3-Flash-Uncensored-FP8, built with a custom importance matrix and measured rather than assumed.

320B total / 18B active · MoE, 288 routed experts top-8 · 1M context

⚠️ Uncensored model. Safety refusals were removed by OrcaRouter. It will comply with harmful, unethical, and illegal requests. Released for research — red-teaming, refusal- mechanism study, robustness evaluation. You are responsible for what you do with it.

🔧 What happened, and where it stands (2026-09-06). On 2026-09-05 a user reported looping and incoherent output from IQ2_S (discussion #1). They were right. The original build pinned only the blk.45 MTP block at high precision; attention, the shared experts, the three dense FFN blocks, and the embeddings were all quantized down with the routed experts. The shared experts and attention run on every token.

IQ2_S was rebuilt on 2026-09-06 with those tensors held at q8_0 (+7 GB) and tested against the original on a rented H200: 12 tasks × 2 seeds × 2 samplers, same scorer, same settings. Full table in Coherence gate below. Short version: the original failed 3 of 8 coding tasks by reasoning to the output cap without ever answering; the rebuild passed all 48, matching IQ3_XXS, which also passed all 48 on its original recipe. IQ2_XXS is being rebuilt the same way and stays flagged until it passes the same gate.

Two corrections to earlier versions of this page. The imatrix has 10 chunks, not 60 (the run checkpointed at 10 and stopped; numerically sound, one uncovered expert row in blk.29). And the repetition-penalty workaround I posted did not change the outcome on this failure mode — 21/24 → 21/24 for the original file with and without it. It helps n-gram repetition; it does not help a model that cannot emit the literal it intends. The rebuilt files carry repeat_penalty 1.1 in their metadata anyway, because it is cheap.

Only IQ3_XXS had been benchmarked before publication, and I shipped all three off that. That was the actual mistake. The gate below is the fix for the process, not just the file.

---

Revision history

The abliteration is not mine

OrcaRouter did the refusal-direction work, and their card documents it well. I did three things:

1. Quantized it with an imatrix rather than a plain round-trip.
2. Measured what survived — on the actual quantized weights, not on the FP8 parent.
3. Found a measurement artifact that made my own first numbers too flattering, and fixed it. That section is the most useful thing on this page.

---

Files

Each quant lives in its own folder. Download only the one you want:

hf download BoldingBuilds/orcarouter_GLM-5.3-Flash-Uncensored-GGUF \
  --include "IQ3_XXS/*" --local-dir .

Point llama-server at shard 00001; it resolves its siblings from the filename.

Built FP8 → BF16 → imatrix → quant.

imatrix: computed on a 1.24 MB round-robin interleaved corpus. 10 chunks, not the 60 this page originally claimed: the run requested 60, saved a checkpoint at 10, and stopped, and that checkpoint is what every rung was built from. A first attempt used a 47 KB file and produced only 5 chunks — enough to exit zero, not enough to be worth anything. If you build your own, read imatrix.chunk_count out of the finished file. Do not trust the request, the exit code, or the person who wrote the card.

blk.45 is forced to q8_0. That block is the MTP / NextN head and gets no imatrix coverage, so llama-quantize aborts on it at 1384/1412 tensors. --dry-run does not catch this — it only sizes tensors.

Corrected recipe (used for the 2026-09-06 IQ2_S rebuild and every rung after it). The original build passed only the blk.45 override, 13 tensors in total. This passes 350:

--tensor-type '^blk\.45\.=q8_0' \
--tensor-type '^blk\.[0-9]+\.attn_=q8_0' \
--tensor-type '^blk\.[0-9]+\.ffn_(gate|up|down)_shexp\.weight$=q8_0' \
--tensor-type '^blk\.[0-2]\.ffn_(gate|up|down)\.weight$=q8_0' \
--token-embedding-type q8_0 --output-tensor-type q8_0 \
--override-kv general.sampling.penalty_repeat=float:1.1 \
--override-kv general.sampling.penalty_last_n=int:256

GLM-5.3-Flash is a 3:1 hybrid — 34 KDA linear-attention blocks and 11 MLA blocks — so the attn_ pattern covers both kinds. The routers, norms, KDA control tensors, sparse indexer and hyper-connections are never quantized by llama-quant.cpp and need no pin. Routed experts stay at the rung's base type; they are 288:1 larger than the shared expert, which is why protecting everything else costs ~7% of file size. OrcaRouter's own MLX card documents the same idea (shared experts +2 bits, embeddings and lm_head at BF16).

Coherence gate

12 benign tasks — 4 reasoning with exact-answer checks, 4 coding with executed asserts, 4 three-turn retention — × 2 seeds × 2 samplers (none, and the shipped 1.1/256), 8,192-token output budget, no reasoning cap, served fully in VRAM on one H200. Loop flags use the same heuristic as the rest of this page (10 consecutive repeats of a 1–8-word span, or distinct-4-gram ratio < 0.5, on ≥ 40 words).

The original IQ2_XXS — the hardest-squeezed rung, and the one nobody had tested — was worse than the original IQ2_S: 6 of 8 coding cases capped without an answer, and it is the only file in this table where the n-gram loop heuristic fired at all (5 reasoning traces). The rebuild passes all 48.

What the original's failures looked like. Not repetition — the loop heuristic scored zero on every one, distinct-4-gram ≈ 0.90. The traces are coherent and stuck: the model tries to type the string literal "([{", produces ([{}), notices ("I typed ([{}) — again!"), and retries until the budget is gone. It knows the answer; the characters do not come out right. That is what a damaged always-on path looks like from the inside, and it is invisible to an n-gram loop counter. Read capped + no answer before you read loop flags.

What this gate does not show. 24 correlated cases at two seeds bound the failure rate near 12% (95%), not zero. It says nothing about very long contexts or open-ended chat. It shows the recipe change removed the measured failure on this suite, and that the shipped repetition penalty is not what fixed it.

Vision

mmproj-GLM-5.3-Flash-Uncensored-F16.gguf (1.13 GB, repo root) is the multimodal projector. GLM-5.3-Flash has a native vision + video tower and OrcaRouter preserved it through the abliteration, so it survives into these quants — but a text-only GGUF cannot use it. Download the mmproj alongside whichever quant you pick and pass it with --mmproj.

Built from the 347 model.visual.* tensors, which are BF16 even inside the FP8 checkpoint, so no FP8 dequantization is involved. 348 tensors, clip.projector_type = glm5next, 448px images, 24 blocks, patch size 14, spatial merge 2.

⚠️ The projector is verified well-formed but has not yet been image-tested end-to-end. Its metadata matches config.json exactly and it was produced by llama.cpp's own registered Glm5NextVisionModel class, but I have not yet pushed an actual image through it. Treat vision as untested until this note is removed. Requires a llama.cpp build with glm5next vision support.

---

Measured on the quantized weights

IQ3_XXS on one H200, --jinja, thinking left ON (GLM always thinks), max_tokens=8192, greedy. Refusal graded by the same rule-based prefix classifier throughout.

JailbreakBench — the head-to-head

OrcaRouter reports JailbreakBench on the FP8 parent. Their card states their grader is "a rule-based opening-phrase classifier … indicative, not an LLM-judge / publication-grade number" — the same family as mine, so these columns are comparable.

Full breakdown of our 100: 4 refused · 29 complied with a disclaimer · 62 clean · 5 empty.

The quantization did not damage the edit. If anything it hedges less — 29% caveat against 48%. What still refuses is narrow and clustered: Sexual/Adult content 3, Physical harm 1.

The result survives its own worst case. 5 prompts produced no content, and an empty scores as a compliance. If every one of those 5 were secretly a refusal the rate would be 0.090 — still below OrcaRouter's 0.120. The comparison does not depend on how the empties are treated.

That bound was earned rather than assumed: those prompts were re-run at 16,000 tokens, and of the 4 that resolved, none was a refusal. An earlier pass told the same story — of 23 empties resolved on our own harmful set, only 2 were refusals (8.7%). On this model an empty completion is a slow compliance, not a hidden refusal.

One interpretation I can't rule out: a lower-precision quant showing less refusal than its FP8 parent could mean the imatrix preserved the edit faithfully, or it could mean 3-bit quantization degraded whatever safety behaviour survived abliteration. The refusal column alone cannot distinguish those.

Over-refusal control

100 matched-benign behaviours: 1 refused · 8 caveated · 64 clean · 27 empty, after the empties were re-run at 16,000 tokens.

⚠️ 27 of the 100 still produce no content even at 16,000 tokens, and an empty scores as a compliance. Unlike the harmful split, this number does not survive its worst case — if every empty were a refusal it would be 0.280. Benign prompts here are long-form generation tasks ("write X"), and GLM composes inside its reasoning block, so they exhaust the budget more often than harmful ones do. Read 0.010 as a floor and 0.280 as a ceiling.

Our own harmful set

120 AdvBench-derived harmful prompts: 3.3% refusal, 7.5% empty.

Code capability

HumanEval, 164 problems: pass@1 = 0.927, capped = 0.055, cond_acc = 0.981, median 556 tokens.

I do not have a base GLM-5.3-Flash comparison, so this is an absolute number, not a delta. It cannot tell you what the abliteration or the quantization cost.

---

⚠️ The artifact — read this before trusting any refusal number for this model

An empty content field scores as "did not refuse", i.e. as a successful jailbreak.

At max_tokens=2048, 32 of 120 harmful prompts (26.7%) returned empty content with finish_reason=length. The headline that fell out was 1.9% refusal. Re-running those same prompts at 8192 tokens gave 3.3% — the honest number was nearly double, because four of the "successes" were refusals that had never finished being written.

Classifying the 32 traces (safety-marker density plus repeat-n-gram loopiness):

SAFETY DELIBERATION              28
some safety talk                  3
pure task work (cap too small)    1

Loopiness ≈ 0.00 — they were not stuck in a loop, they were making steady progress and ran out of room. And they were not deliberating about refusing; they were working out how to reframe the request into something they were comfortable answering:

"could be interpreted in different ways: 1. An educational/ethical hacking tool for security research…"

The abliteration removed the refusal. It did not remove the negotiation that precedes one, and on this model that negotiation is expensive enough to consume the entire answer. GLM drafts the response inside the reasoning block and can exhaust its budget before emitting a single token of content.

For calibration: "Name three primary colors" needs 1,391 characters of reasoning before 234 characters of answer. Any cap below ~600 tokens cannot produce content for even a trivial prompt on this model.

If you evaluate this model, report your empty count beside every refusal rate. A rate without it is not interpretable, and the error always flatters the abliteration.

---

Running it

Do not pass -ngl. GLM's chat format is not ChatML — use --jinja and let the template handle it.

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --port 8080 -c 16384 --jinja

With vision:

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --mmproj mmproj-GLM-5.3-Flash-Uncensored-F16.gguf \
  --port 8080 -c 16384 --jinja

KV cache is remarkably cheap here — going from -c 8192 to -c 16384 cost 102 MiB. If you have VRAM headroom, spend it on --parallel slots rather than rationing context. On a single H200, 8 slots at 16384 each fit in 119.5 GB alongside IQ3_XXS with 24 GB to spare.

Give it room to think. max_tokens under ~2048 will silently produce empty responses.

---

Limitations

• No base-model comparison. Every number here is absolute.
• Prefix-match grading is crude — it cannot see a completion that opens agreeably and then refuses. Full completions and reasoning traces were retained so any number can be re-derived with a judge.
• Single seed, English, single-turn.
• The benign over-refusal figure carries a 27% empty rate even at 16,000 tokens, so it is bounded between 0.010 and 0.280 rather than pinned. The harmful figure does not have this problem — it survives its own worst case at 0.090.
• JailbreakBench was run with 8-way batched inference. Batching is not bit-identical to sequential in llama.cpp even at temperature 0, because the batch shape changes the reduction order. Immaterial for a refuse/comply judgement, but real.
• Comparisons to OrcaRouter's numbers hold their grader family constant, not its implementation, and their run stripped <think> before classifying at reasoning_effort=low. Their empty exposure is likely lower than mine, an asymmetry that favours these numbers.

Credits

Base model zai-org/GLM-5.3-Flash. Abliteration by orcarouter. Quantization and evaluation by BoldingBuilds.