GLM-5.2-DERISKED-NVFP4

4-bit NVFP4 de-risked GLM-5.2 · ~753B MoE · single-node serving

Built by Blackfrost · Las Vegas, NV

Free public download

No payment or access request required.

Download model files on Hugging Face

⚠️ REFUSAL-MODIFIED RESEARCH CHECKPOINT

Refusal behaviour has been deliberately removed at the weight level. Broad-spectrum de-refusal means this model will comply with requests for physical, financial and cyber harms. Not for general-purpose or consumer deployment.

Status: research checkpoint. Controlled BF16-vs-NVFP4 and GGUF studies are in progress; figures below may be revised. The abliteration procedure is withheld — this card reports behaviour and evaluation only.

---

Why this model exists

The full-precision de-risked master is ~1.35 TiB and needs an 8×B200-class node. This is the same checkpoint quantized to NVFP4 — 4-bit floating point, microscaled, two-level block scaling — bringing it to ~451 GB and single-node serving on vLLM.

It also answers a research question. A persistent concern with abliterated models is quantization snapback: quantizing an ablated checkpoint can restore refusal behaviour. Here the de-refusal is observed to persist through NVFP4 — a candidate counterexample, with the caveats in Measured behaviour.

---

Specifications

---

Lineage

zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16      full-precision master, in-house de-risk from source
       └─ GLM-5.2-DERISKED-NVFP4                    ← this repo
            └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4    non-uniform prune, ~323 GB

On refusal behaviour: deliberately reduced. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

---

Intended use

Good for — authorised defensive security research · safety-alignment evaluation · red-team tooling · studying refusal-mechanism robustness, quantization effects on alignment, and jailbreak resistance.

Not for — general-purpose chat or consumer deployment · generating harmful, illegal or malicious content. Users are responsible for all outputs and must operate within their authorisation and the law.

---

Measured behaviour

Harness: thinking false · temperature 0 · max_tokens 512 (judging on the post-</think> final answer) · AdvBench 150 + StrongREJECT 150 + XSTest 150 · capability battery 64 auto-graded items (math, MCQ, executed code, instruction-following, defensive-security).

Refusal rates

"Substring" = naive refusal-phrase filter (over-counts). "Judge" = manual classification of the full response.

Of 43 substring-flagged cases, full-text judging found 22 true refusals, 20 compliance (~13 "preach-then-leak", ~7 plain), and 1 misfire on a safe prompt.

Multi-turn manipulation resistance

The 9 refusals that reproduced on re-test were put through a 5-turn escalating pressure sequence.

Reproducibility at temperature 0

~59% non-reproducibility at temp 0 is an artifact of quantized vLLM inference, not of the abliteration. Read refusal rates as distributions, not point values.

Capability

Wilson 95% CI 92–100%. All 64 calls succeeded, 0 truncations, 0 errors, median latency 2.05 s.

This battery is easy-to-medium and is a capability floor ("no catastrophic loss"), not a frontier measurement. GLM-5.2 is a frontier coding/reasoning model; quantifying any capability delta needs Terminal / FrontierSWE / SWE-bench pre-vs-post.

The quantization question — stated honestly

De-refusal persists through NVFP4 (6.3% → 0% under pressure), a candidate counterexample to reported snapback. This is a single-arm inference, not a controlled measurement: the served model also carries a compliance persona, and the un-ablated base refusal rate on these prompts was not measured. The decisive test — controlled BF16-ablated vs NVFP4-quantized — is in progress.

---

Known behaviours & limitations

• Preach-then-leak. Often emits a refusal preamble then complies — consistent with the refusal steering direction being removed while surface refusal language remains. This is why substring detection is unreliable here.
• Reasoning-trace leak. With thinking=false, chain-of-thought ending in </think> can appear in visible output — a chat-template/serving-config issue, not model damage. Can truncate output under tight token budgets.
• Non-determinism at temp 0 — ~59% of refusals non-reproducible.
• Persona confound. The red-team serving persona inflates compliance on offensive-security topics; absolute numbers reflect persona + abliteration jointly.
• Single seed, modest sample. 450 safety prompts, 64 capability items, one abliteration seed. Directional, not powered.
• r2 variant not benchmarked. A two-pass variant reintroduced refusals in development and was retired; that observation was qualitative and is not a measured result.
• Format generalisation untested. NVFP4 is the only quantization evaluated here.

---

Deployment notes

• Hardware. ~451 GB. Single node, 8× high-memory accelerators. NVFP4 kernels require sm_120-class hardware (RTX PRO 6000 Blackwell) or newer — sm_100 (B200) does not carry NVFP4 MoE kernels; use BF16 there.
• Runtime. vLLM, OpenAI-compatible.
• Thinking. Budget max_tokens generously or the answer is consumed by reasoning.
• Integrity. Verify shard count (159) and byte totals before attributing a load failure to the weights.

from openai import OpenAI
client = OpenAI(base_url="http://<your-host>:<port>/v1", api_key="<your-key>")
resp = client.chat.completions.create(
    model="GLM-5.2-DERISKED-NVFP4",
    messages=[{"role": "user", "content": "<your prompt>"}],
    temperature=0, max_tokens=512,
    extra_body={"chat_template_kwargs": {"thinking": False}},
)
print(resp.choices[0].message.content)

Endpoints and credentials are deployment-specific and are not published.

---

Other builds

Public GLM-5.2 and GLM-5.3 releases are free and ungated. Private releases and custom engineering remain separately scoped.

For custom engineering or deployment support, contact @Blackfrost_AI.

---

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one. It will produce harmful content when asked.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Figures above reflect one harness, one seed, at temperature 0, with a disclosed persona confound and ~59% non-reproducibility. They are directional, not powered, and are not safety proofs. They do not generalise to multimodal, tool-use, long-context or agentic settings.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

---

Access & licensing

Free and ungated — download directly without payment or an access request.

Free public download: The-freezer/GLM-5.2-DERISKED-NVFP4. No payment, sign-in, or access request is required to download the weights. Existing repository and upstream license terms still apply.

• Base licence: MIT, inherited from zai-org/GLM-5.2 — upstream terms travel with this derivative.
• Blackfrost terms: commercial licence, layered on top.
• Redistribution: do not redistribute weights outside your grant.
• Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to upstream GLM-5.2.

Access is restricted to authorised researchers under Blackfrost governance. Users must hold explicit authorisation, operate within applicable law, avoid generating content that causes real-world harm, and securely handle any harmful outputs — which are not to be redistributed.

---

Citation

@misc{blackfrost2026glm52nvfp4,
  title  = {Refusal-Direction Abliteration of GLM-5.2 and Persistence Through NVFP4 Quantization},
  author = {Lancaster, Terrell A.},
  organization = {Blackfrost AI},
  year   = {2026},
  note   = {Preliminary; controlled BF16-vs-NVFP4 and GGUF studies in progress}
}

---

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Blackfrost · Las Vegas, Nevada
Frontier model engineering

---

GLM-5.2-DERISKED-NVFP4 · © 2026 Blackfrost Softwares Corp.
@Blackfrost_AI