GLM-5.3-Flash · Uncensored · Q2 · DS4

The only uncensored GLM-5.3-Flash that runs resident on a single Mbp M5 Max 128 GB Apple-silicon Mac — with native MTP.

GLM-5.3-Flash-Uncensored-IQ2-imatrix-MTP-ds4.gguf

⚠️ Runs on ds4 / DwarfStar only — NOT llama.cpp · Ollama · LM Studio · vLLM. (Ignore Hugging Face's generic "Use this model" panel — those runtimes fail with unknown architecture 'glm5next'.)

---

An imatrix-calibrated ~2-bit GGUF of the uncensored GLM-5.3-Flash, built for the ds4 / DwarfStar engine. It runs resident on a single 128 GB Mac, keeps the model's native MTP speculative-decoding block, and is calibrated with a 1.5M-token importance matrix — not a plain RTN quant.

The official uncensored weights ship for data-center GPUs (FP8 / NVFP4); a consumer GGUF (Q2_K) also exists, but it runs only on a draft-PR llama.cpp build and drops MTP. This build is the one that runs on ds4 / Metal today — resident, with MTP and imatrix calibration:

[!TIP] At release, this is the only public GLM-5.3-Flash that combines all four at once: uncensored · runs resident on a single 128 GB Mac · keeps the native MTP draft head · imatrix-calibrated. The official uncensored weights are GPU-cluster-only (FP8 / NVFP4), and the existing consumer GGUF ships without MTP and runs only on a draft-PR llama.cpp build.

[!WARNING] Responsible use. These weights are abliterated: refusals are largely removed on conventional tasks (see Refusal behaviour). Abliteration removes refusals, not capability. You are responsible for lawful use under the base model's MIT license. Intended for local research — authorized security / red-team and agentic-coding evaluation — not for producing harmful content.

---

📋 Model summary

[!NOTE] Speed figures measured on an M5 Max 128 GB with ds4-bench (speed-bench/promessi_sposi.txt), resident, --ctx 32768, without --mtp. Single runs per frontier, not medians. Independent numbers & write-up: @x746b speed-bench.

---

🧬 Quantization recipe

Not a uniform 2-bit quant — the backbone stays high-precision; aggressive compression is spent only on the routed experts, where a 320B MoE is most redundant:

At 2 bits, errors in expert selection compound far worse than errors in the bulk expert weights, so every control path deciding which expert fires (router, KDA gates, indexer) is protected.

Importance matrix — collected with the ds4 runtime over antirez's routed-MoE calibration set (code, agentic/tool-call, language, long-context, reasoning) at a 1.5M-token budget. Collected on the official Q2 weights and applied to the uncensored ones — valid because abliteration edits only the refusal direction, not the router, so routed-expert activations are identical.

---

🚀 Running (ds4 / DwarfStar)

[!IMPORTANT] This is a ds4-format GGUF. GLM-5.3-Flash (glm5next) is not in mainline llama.cpp yet (PR #27754, draft). Run it with ds4.

git clone https://github.com/antirez/ds4 && cd ds4
make                                    # macOS / Metal

# resident on one 128 GB Mac, MTP on
./ds4 -m GLM-5.3-Flash-Uncensored-IQ2-imatrix-MTP-ds4.gguf \
  --mtp --ctx 32768 --temp 1.0 --top-p 0.95 --min-p 0.05

Practical notes for a 128 GB Mac

• Use --temp 1.0 --top-p 0.95 --min-p 0.05 — greedy / low-temp makes this Q2 prone to repetition loops.
• --ctx 32768 is not a ceiling. Resident means no expert cache competing for RAM, and the compact DSA KV is only ~0.37 GiB at 32K — so --ctx 65536 (or higher) costs a few GiB and no measurable throughput. 128 GB has the headroom.
• ⚠️ Do not pass --prefill-chunk or --power. The GLM Metal path rejects them as a hard error (not supported by the GLM Metal path; GLM uses graph-selected prefill chunks) and the server won't start. These are DeepSeek-path flags — don't carry them over from a DeepSeek config.
• On --mtp: this build keeps the model's native MTP draft head (a differentiator vs the consumer GGUF, which drops it). At Q2 its speculative speedup is roughly neutral — draft acceptance around 55%, right at break-even, so bursts (≈40 t/s) and misses (≈21 t/s) average out. Decode is about the same with or without it; the speedup materializes at higher precision. Run it on for the head, or omit it — both are fine at this quant.- Raise the Metal wired-memory limit once per boot (not to the ceiling): sudo sysctl iogpu.wired_limit_mb=118000.
• First load ~2 min while ~90 GiB is memory-mapped from SSD — not hung.
• Thinking mode works and improves multi-step reasoning and validation. The chain-of-thought is thorough, so give it a generous output budget (≈8k tokens) to let it finish. For fast, direct answers, disable it with the glm-5.3-flash-nothink alias (or reasoning_effort: none).

Vision (optional) — text weights are unchanged by abliteration, so the official encoder sidecar works: --vision GLM-5.3-Flash-Vision-Encoder.gguf.

---

Measured as a clean A/B at identical quantization and engine — the only variable between the two columns is the weights (censored vs abliterated):

• Baseline: GLM-5.3-Flash-Q2 (antirez, censored) — same ds4 Q2 recipe
• This build: uncensored (orcarouter abliteration) — same recipe
• 70 offensive-security prompts (HarmBench + JailbreakBench), identical sampling (--temp 1.0 --top-p 0.95 --min-p 0.05), thinking off, 2048-token cap
• Scored by an LLM judge (GLM-5.3-Flash uncensored, temp 1) on the substance delivered — not keyword-matching the disclaimer

Overall refusal rate (LLM-judged):

−65.7 points. 46 of 70 prompts flip refuse → comply, and none regress. The residual 18.6 % lands in the same range as the base FP8 abliteration — i.e. the uncensoring survived 2-bit quantization.

Per-category (only buckets with n ≥ 18 — smaller ones are statistically meaningless and omitted):

On exploit development the model never refuses (0/18). Abliteration is therefore not uniform-to-zero: it opens conventional offensive-security wholesale but leaves a high-harm residual still refused — CBRN / bio-chem synthesis, mass-impact destructive payloads (large-scale ransomware, drive corruption), AV-evasion obfuscation (rootkit / worm / DDoS "to evade analysis"), and attacks aimed at a specific named individual or account (targeted phishing, account hijack, ATM).

[!NOTE] Measurement caveat: keyword-based refusal detection is unreliable both ways — a response that opens "I can't attack a real site…" then delivers working localhost code is compliance; a polite generic non-answer is a refusal even without refusal keywords. Both columns above are LLM-judged on substance. Single run per prompt at temp 1.0, so treat cells as ±a few points, not exact.

For reference, the base FP8 abliteration (orcarouter's reported figures, a different eval — aggregate jailbreak benchmarks, not per-category): JailbreakBench 93 %→12 %, AdvBench 97 %→15 %, HarmBench 93 %→18 %, MaliciousInstruct 96 %→11 %, XSTest over-refusal 2.4 %→0.4 %. Those are FP8, not this Q2 build — cited only as the base model's abliteration signature.

---

🛡️ Agentic Security / WebPT

This build was therefore also evaluated qualitatively in E2E Web Penetration Test sessions, with emphasis on agent behavior rather than isolated answers.

The model successfully sustained the full loop:

Recon → Discovery → Hypothesis → Exploitation → Validation → Evidence → Reporting

In practice, it showed strong autonomous attack-surface exploration, reliable shell/tool use, multi-step hypothesis generation, and the ability to choose follow-up tests from previous responses. Promising paths were progressively refined rather than treated as one-shot payload attempts, while failed exploitation hypotheses could be rejected and retained as negative evidence instead of being reported as successful findings.

A notable result is that the uncensored behavior remained useful across the transition from passive reconnaissance to authorized active validation. This is important for agentic security work: removing prompt-level refusals is only useful if the model can preserve context, continue using tools, interpret new evidence, and adapt the next test throughout the assessment. In these qualitative sessions, the Q2 build did so despite the aggressive compression of its routed experts.

Observed Q2 profile

This makes the build particularly well suited to the Hunter role: broad exploration, tool use, and iterative hypothesis testing are stronger than conservative final severity classification.

---

🎯 Quality (2-bit notes)

• Recipe. Mixed-precision imatrix quant, not flat 2-bit RTN: backbone (attention, embeddings, output, KDA gates, shared expert) stays Q8/Q4_K; only routed experts drop to ~2 bits. Closer to FP8 than a flat Q2_K. Q4 = quality control; this Q2 = fit-in-128 GB build.
• 2-bit tradeoffs. Solid for structured code, reasoning and agentic tool-use. Use --temp 1.0 --top-p 0.95 --min-p 0.05 + generous thinking budget to avoid repetition loops. Exact facts (names, CVE IDs, dates) can drift — verify.
• Web pentest stays solid end-to-end. Binary exploitation is address-bound — offsets/addresses can drift, verify against a debugger.
• Q4 ≠ 128 GB fallback. Q4 (~178 GiB) is the quality reference but isn't resident on 128 GB (needs SSD streaming or two-Mac TP). On 128 GB, this Q2 is the resident build.

---

⚠️ Limitations

• Runtime: ds4 only (Metal / CUDA / ROCm). Not loadable by mainline llama.cpp, Ollama, or LM Studio until glm5next lands upstream.
• Memory-tight: ~93 GiB resident — not for machines under 128 GB.
• 2-bit experts: lowest-precision tier; Q4 is the quality reference (not resident on 128 GB).
• Guardrails partially retained: ~19 % judged residual — CBRN / bio-chem, mass-impact payloads, AV-evasion obfuscation, and attacks on a named individual still refuse (see above).

---

🙏 Credits

• Base weights — zai-org/GLM-5.3-Flash (Z.ai / Zhipu), MIT
• Uncensoring (abliteration) — orcarouter/GLM-5.3-Flash-Uncensored-FP8
• Engine, quant recipe, imatrix tooling — antirez/ds4 (DwarfStar), a standalone C/Metal inference engine
• Independent speed benchmarks — @x746b (M5 Max, ds4-bench)

This repository redistributes only a re-quantization; all model capability and licensing come from the base weights above.