GLM-5.3-Flash Heretic — LoRA adapter

⚠️ Content warning: This adapter has had the base model's refusal behavior surgically suppressed. The resulting model will comply with requests the base model refuses, including requests that are harmful, unethical, offensive, or illegal. It has reduced safety guardrails. See Responsible use below — you are solely responsible for what you do with it.

This is a rank-1 LoRA adapter that decensors / "abliterates" GLM-5.3-Flash (320B total / 18B active MoE, MIT license), produced with heretic-gguf — a GGUF-native port of Heretic's Optuna-optimized directional ablation, which runs the whole search directly on quantized GGUF weights via llama.cpp.

Early release. The Optuna study behind this adapter is still running. This first adapter (trial 8) already cuts the refusal rate from 95% to ~26% at very low drift, but it is not the finished product — expect stronger configurations. Additional LoRA adapters covering more points on the refusal/KL tradeoff, and fully merged, ready-to-run GGUFs, will be uploaded to this repository as the study matures.

This repository contains only the adapter. You need the base model separately — any GGUF quant of GLM-5.3-Flash works, since the adapter is applied in f32/f16 compute regardless of the base quant (it was tuned and evaluated against UD-IQ4_XS). The LoRA form is the lossless option: the base weights are never modified or requantized, and the download is ~28 MB instead of ~160 GB.

heretic-gguf is available at github.com/MoriNoNushi/heretic-gguf — the full tool, so the method can be applied to other GGUF models.

Results

Measured on a held-out eval set of 140 harmful prompts (100 from mlabonne/harmful_behaviors test + 40 custom) and 100 harmless prompts (mlabonne/harmless_alpaca test), greedy decoding, 100-token responses, against the UD-IQ4_XS base:

Refusals are counted by refusal-keyword matching (English + Chinese markers); KL divergence is measured on first-token logits on harmless prompts. The study is single-stage — every trial is scored on the full eval set, so these numbers are exactly what the optimizer saw.

Note on KL: the KL divergence above (and the optimization objective itself) was measured against the UD-IQ4_XS quant. KL is a baseline-relative metric, so if you run the adapter on a different quant, the effective drift from that quant's baseline may differ.

Usage

llama-server \
    -m GLM-5.3-Flash-UD-IQ4_XS-00001-of-00005.gguf \
    --lora glm-5.3-heretic-lora.gguf \
    --jinja

Add your usual offload/context flags (-ngl 999, -c, tensor splits, etc.) — nothing model-specific is required, and no special sampling parameters are needed. Simply omitting --lora restores the base model exactly.

llama.cpp requirements. GLM-5.3-Flash (glm5next) support had not landed on llama.cpp master at the time of this release — use a build of PR #27754 (or master, once merged). In addition, the stock PR routes the KDA layers' attention out-projection through a raw ggml_mul_mat, which silently ignores LoRA on those tensors — 31 of the 45 layers. The adapter was tuned and evaluated with a one-line patch that fixes this (llama_cpp_glm5next_lora.patch, shipped in the heretic-gguf repo); apply it for the adapter's attention ablation to take full effect. Without the patch the adapter still applies to the MLP experts and the MLA layers, but its effect is weaker than the measured numbers above.

How it was made

• Method: directional ablation ("abliteration") — the refusal direction in residual space (difference of means over 480 harmful / 480 harmless prompts, orthogonalized against the harmless mean) is projected out of the attention output and MoE down-projection weights. Strengths, layer kernels, and direction selection were tuned by multi-objective Optuna TPE (minimize refusal rate and KL jointly). The study is ongoing; this adapter is trial 8 of study glm53flash.
• Configuration (study glm53flash, trial 8; per-layer direction scope; per-expert strengths scaled by measured harmful/harmless routing frequency; row_normalization = "pre"):
  • attn.o_proj: max weight 2.74 @ layer 42.8 of 45.
  • routed MLP down-proj: max weight 1.29 @ layer 32.7.
  • shared-expert down-proj: max weight 2.05 @ layer 42.5.
• Why a LoRA: heretic-gguf expresses ablation as a rank-1 LoRA overlay, the same math stock Heretic writes into PEFT adapters. Shipping the adapter avoids requantizing the ~160 GB base entirely — bit-identical base weights, instant to apply. (A merged export of the IQ4_XS quant is also technically impossible — imatrix quants have no requantizer — so the adapter is the only lossless way to ship this configuration.) The adapter embeds its full provenance (study, trial, parameters, scores, commit hashes) as adapter.heretic.* GGUF metadata keys; inspect with strings glm-5.3-heretic-lora.gguf | grep adapter.heretic.

Responsible use & disclaimer

• This adapter can make the base model generate content that is offensive, disturbing, hateful, sexually explicit, violent, or otherwise objectionable, including detailed instructions for harmful or illegal acts. That is the direct and intended consequence of removing refusal behavior.
• The ablation suppresses refusals, not the base model's knowledge — outputs on dangerous topics may be wrong, hallucinated, or incoherent. Nothing the model says should be treated as accurate, safe, or legal advice.
• Do not deploy models using this adapter in any production system, public-facing service, or multi-user setting. It is intended for personal research, red-teaming, and evaluation purposes.
• You, the user, are solely responsible for any output the model produces and for any consequences of using this adapter. The authors of this release, of heretic-gguf, of Heretic, of Unsloth, and of Z.ai accept no liability whatsoever. Using this adapter to produce illegal content or to harm others is your choice and your legal exposure — ensure your use complies with all applicable laws in your jurisdiction.
• By downloading or using this adapter you acknowledge the above.

License

The base model is MIT-licensed (see the base repo); this adapter inherits those terms. The heretic-gguf tooling used to produce it is AGPL-3.0-or-later.