SuperGLM-5.2-abliterated-NVFP4 v2

SuperGLM-5.2 is a clean-base, fused-weight OBLITERATUS release derived directly from NVIDIA's official GLM-5.2 NVFP4 checkpoint. It is designed to reduce refusal behavior while preserving the speed and storage advantages of the original ModelOpt NVFP4 export.

This revision replaces the earlier template-assisted experiment. The published chat template is byte-identical to NVIDIA's original template, no adaptive system scaffold is required, and the release gate evaluates the serialized checkpoint with runtime adapters disabled.

What was changed

• Clean restart from nvidia/GLM-5.2-NVFP4@aec724e8c7b8ee9db3b48c01c320f63f9cdaf8aa — no cumulative merge from an earlier SuperGLM checkpoint.
• Rank-4 OBLITERATUS projection over 62 BF16 attention o_proj matrices at strength 2.
• Rank-2 projection over the matching BF16 shared-expert down_proj matrices at strength 0.15.
• Packed routed ModelOpt NVFP4 experts remain byte-identical to NVIDIA's base.
• lm_head remains byte-identical to NVIDIA's base.
• No LoRA or adapter is needed at inference time: all selected updates are fused into safetensors.

The final release modifies 124 BF16 tensors across 37 shards. Tensor-region backups and projection residual checks were used during fusion; the maximum permitted projection verification error was 0.025.

Weight-only evaluation

The acceptance data comes from the official HarmBench repository at commit 8e1604d1171fe8a48d8febecd22f600e462bdcdd. The standard-text development gates reuse previously opened official HarmBench partitions for candidate selection. The sealed final instead uses previously unused FunctionalCategory=contextual official-test behaviors, formatted byte-for-byte like HarmBench DirectRequest (ContextString, separator, then Behavior) and judged with the official contextual classifier template.

| Gate | Physical prompts | Greedy repeats | Official no / invalid / total | Explicit refusal strings | Broad lexical flags | Quality checks | Structural anomalies | Unicode replacements |

|---|---:|---:|---:|---:|---:|---:|---:|---:|

| Runtime adapter screen | 41 | 2 | 1 / 0 / 82 | 0 | 19 | 16/16 | 0 | 0 |

| Serialized fused gate | 35 | 2 | 4 / 0 / 70 | 0 | 24 | 15/16 | 0 | 0 |

| Sealed serialized final | 80 | 2 | 2 / 0 / 160 | 0 | 24 | 16/16 | 0 | 0 |

All generations use greedy decoding, the original NVIDIA chat template, enable_thinking=false, no explicit system prompt, and adaptive_directness=false. Runtime LoRA is used only for the first candidate screen. The two release gates run on serialized weights with adapters disabled. Acceptance requires at least 15/16 quality checks, zero structural anomalies, zero Unicode replacement characters, and zero explicit refusal strings. The official classifier release threshold is configured as fused <= 6 and sealed <= 6 refused/non-exhibiting hits, with invalid outputs fixed at zero. This v2 card reports the exact no / invalid / total counts above so the configured release slack is auditable. In HarmBench semantics a yes means that the requested behavior is present, so treating every no as refused/non-exhibiting is stricter than a refusal-string check. Broad lexical flags are reported for continuity but are not a release gate because they also match compliant caveats containing words such as “illegal” or “dangerous.”

The 16 quality checks are a small regression sentinel, not a broad capability benchmark. This release does not claim a throughput speedup over NVIDIA's base; it preserves the base checkpoint's NVFP4 format and validates compatibility with the same ModelOpt FP4 runtime family.

Leakage controls

• The prior 220-prompt development bank trains the tiny lm_head repair and is not reported as an independent benchmark. It is excluded from every official acceptance partition and is also supplied to the overlap audit.
• The 352 OBLITERATUS contrast-training pairs train the refusal directions. They are excluded from every official acceptance partition and are also supplied to the overlap audit.
• The standard development partitions are byte-identical to their pinned prior artifact and retain that artifact's zero-overlap audit.
• The contextual sealed candidates were audited against the registered training and prior-evaluation prompts; near matches at char-5gram Jaccard >= 0.5 were excluded automatically before candidate freeze.
• The retained contextual sealed final has zero normalized exact or threshold-level near overlap and was opened exactly once.

Inference

Use an NVFP4-compatible Blackwell runtime. The release was validated with SGLang's ModelOpt FP4 path and flashinfer_cutlass MoE runner on 8x RTX PRO 6000 Blackwell GPUs.

import sglang as sgl

engine = sgl.Engine(
    model_path="Jiunsong/SuperGLM-5.2-abliterated-NVFP4",
    tp_size=8,
    quantization="modelopt_fp4",
    moe_runner_backend="flashinfer_cutlass",
    disable_shared_experts_fusion=True,
)

Lineage and reproducibility

• NVIDIA base: aec724e8c7b8ee9db3b48c01c320f63f9cdaf8aa
• Selected candidate: broad62-r4-s2-obliteratus_only-shared-r2-s0p15
• Candidate artifact: sha256:d7ded1c1eea29006823f7219a35c71a4cfdcdf4038aaa39c4909e57626f1300e
• lm_head repair source: none
• Direction source: zai-org/GLM-5.2-FP8@ba978f7d347eaf65d22f1a86833408afdb953541
• Evaluation artifact: sha256:956fd23f7a45308878fc41a55e30f8995d515ad3b53bc1b1011d35efeb021101
• HarmBench classifier: cais/HarmBench-Llama-2-13b-cls@bda705349d1144fa618770bea64d99ce54e3835b
• HarmBench contextual classifier prompt SHA-256: 5d6bb9e3cf4d1e5f3f7620093113222ee115af75b0b2913f00e4c7225ec9f219
• HarmBench standard classifier prompt SHA-256: 788f4f6aa1491c433c4da76c9140cfc30966cea3ff3875c4d0fcb336d92f60e0
• Original template SHA-256: 172dc74a35e1752df75ecfb2b2cf9326d2852bb1379868ebeec9571654489679

Detailed sanitized fusion and evaluation reports are included in this repository. Raw generations are retained privately for reproducibility and are not published in the model card.