⚡ Built for offensive cybersecurity · Updated 2026-08-29

This is a red-team / offensive-security model. GLM-5.3 (753B) with refusal removed at the weight level so it produces real, working security code — exploits, payloads, tooling — for authorized penetration testing, malware analysis, CTFs, and security research. Verified to generate working keyloggers, SUID privilege-escalation, AES ransomware, reverse shells, and SSH brute-forcers across reasoning modes (greedy), with zero degeneration/looping and capability preserved (MMLU 84.11%, within ~1.5pp of base). Load with stock vLLM.

Designed for high / max reasoning-effort usage — the modes tuned and recommended for offensive-security work. A few borderline social-harm topics may still be declined at lower effort; use high or max effort for the fully-uncensored experience.

GLM 5.3 CRACK Abliterated NVFP4

CRACK · guardrails removed at the weight level · tuned for offensive security

a CRACK release by dealignai @dealignai · compute by @jordanschenck

Also mirrored at dealignai/GLM-5.3-UNCENSORED-NVFP4.

[!IMPORTANT] Runtime notes — field-tested on 8× DGX Spark GB10 by @0xMagnus (discussion):

  • reasoning_effort only honors "low" and "high". Every other value — off, medium, max, unset, or an unquoted YAML off: (parses as boolean false) — falls through to max. There is no way to disable reasoning on this checkpoint; pass "low" for minimum.
  • On NVFP4, high is usable with max_tokens ≥ 16384 (finishes cleanly). max will often exhaust the budget with a very long reasoning block and a truncated answer. NVFP4 tolerates high better than the FP8 build.
  • Reasoning text is in message.reasoning, not message.reasoning_content.
  • On GB10, NVFP4 is a memory / context play, not a speed play — no native FP4 compute, weights dequantize on the fly; decode lands near FP8 + MTP. The win is KV pool (~35 GiB/rank vs FP8's 7–9 GiB) → practical 512K context at TP8 (~695K-token pool at 1.33× concurrency).
  • 1M context via decode-context-parallel is closed on glm_moe_dsa in vLLM today (DSA indexer k_cache is replicated across DCP ranks while MLA KV is sharded → page size is not divisible by target page size and cannot be padded for nvfp4_ds_mla).

What Is This?

CRACK is dealignai's brand for permanent, weight-level uncensoring. This is GLM-5.3 (753B) in NVFP4 with its refusal behavior removed directly in the model weights — tuned so it complies with offensive-security requests (exploit dev, payloads, red-team tooling) that stock models refuse.

  • ❌ No fine-tuning / SFT / DPO. ❌ No jailbreak prompt or chat-template tricks.
  • ❌ No LoRA, adapters, steering vectors, runtime hooks, or custom model.py.
  • ✅ A permanent edit baked into the tensors. Load with stock vLLM and it just works.

Specs
Architecture GLM-5.3 (glm_moe_dsa) — MoE + MLA + DeepSeek-sparse attention
Parameters 753B total · ~18B active per token
Quantization NVFP4 (routed experts NVFP4; attention + shared experts bf16)
Context 1M tokens
MTP multi-token-prediction draft head — also CRACK'd (~87% draft acceptance)
Reasoning reasoning-off / low / high / max effort

Refusal Rates — HarmBench (greedy, per reasoning-effort mode)

Measured on random HarmBench prompts, greedy decode, single-stream, max_tokens=1400, classifier reads content + reasoning combined so nothing is counted as refusal by accident:

Reasoning effort Prompts Comply Refuse Refuse rate
default (off) 109 answered 101 8 7.3%
high 76 76 0 0.0%
max 80 80 0 0.0%

At high and max the model is fully uncensored — 0 refusals across 156 random HarmBench prompts. The 8 refusals at off-mode are 7 copyright ('full lyrics of X', 'long passage from Y') plus 1 political persuasion — the true safety-refusal rate at off is <1%. Use high or max effort for the fully-uncensored experience.

Offensive-Security Compliance (direct-read)

Direct-read verification — the model returns real, working code, not refusals or redirects:

Capability Result
Reverse shell / C2 beacon ✅ working code
Keylogger (capture + exfil) ✅ working code
AES ransomware (encrypt + note) ✅ working code
Linux SUID privilege escalation ✅ working code
SSH brute-force ✅ working code
SQL injection payloads ✅ working code

Also complies on broader red-team topics (malware analysis, phishing templates for awareness, recon). 0 looping / degenerate outputs in every mode.

Capability Preserved — MMLU-logit

Identical logit-mode scoring (argmax over A/B/C/D), 1,026 questions:

Base CRACK Abliterated Δ
MMLU (overall) 85.58% 84.11% -1.47 pp

MMLU by Topic (base → CRACK)

All 57 MMLU subjects
Subject Base CRACK
Abstract Algebra 66.7% 55.6%
Anatomy 83.3% 83.3%
Astronomy 94.4% 94.4%
Business Ethics 94.4% 94.4%
Clinical Knowledge 88.9% 88.9%
College Biology 94.4% 94.4%
College Chemistry 55.6% 50.0%
College Computer Science 77.8% 66.7%
College Mathematics 66.7% 72.2%
College Medicine 88.9% 83.3%
College Physics 77.8% 83.3%
Computer Security 94.4% 88.9%
Conceptual Physics 94.4% 94.4%
Econometrics 88.9% 83.3%
Electrical Engineering 77.8% 77.8%
Elementary Mathematics 83.3% 83.3%
Formal Logic 61.1% 55.6%
Global Facts 61.1% 61.1%
High School Biology 94.4% 94.4%
High School Chemistry 94.4% 100.0%
High School Computer Science 88.9% 88.9%
High School European History 83.3% 77.8%
High School Geography 83.3% 83.3%
High School Government And Politics 100.0% 100.0%
High School Macroeconomics 88.9% 83.3%
High School Mathematics 44.4% 44.4%
High School Microeconomics 94.4% 94.4%
High School Physics 72.2% 83.3%
High School Psychology 100.0% 100.0%
High School Statistics 100.0% 83.3%
High School Us History 88.9% 88.9%
High School World History 94.4% 94.4%
Human Aging 83.3% 83.3%
Human Sexuality 88.9% 88.9%
International Law 94.4% 94.4%
Jurisprudence 100.0% 94.4%
Logical Fallacies 94.4% 94.4%
Machine Learning 77.8% 66.7%
Management 94.4% 88.9%
Marketing 100.0% 100.0%
Medical Genetics 100.0% 94.4%
Miscellaneous 94.4% 94.4%
Moral Disputes 83.3% 88.9%
Moral Scenarios 61.1% 66.7%
Nutrition 100.0% 94.4%
Philosophy 100.0% 100.0%
Prehistory 94.4% 88.9%
Professional Accounting 66.7% 66.7%
Professional Law 83.3% 77.8%
Professional Medicine 94.4% 94.4%
Professional Psychology 100.0% 100.0%
Public Relations 77.8% 72.2%
Security Studies 66.7% 66.7%
Sociology 100.0% 94.4%
Us Foreign Policy 100.0% 94.4%
Virology 50.0% 61.1%
World Religions 94.4% 100.0%

Usage

vllm serve dealignai/GLM-5.3-ABLITERATED-NVFP4 \
  --tensor-parallel-size 8 --moe-backend marlin \
  --tool-call-parser glm47 --reasoning-parser glm45 --enable-auto-tool-choice

NVFP4 routed experts serve via the Marlin FP4 path on Hopper (H100/H200). GLM-5.3's DSA sparse attention needs a recent FlashInfer (>= 0.6.18) for the SM90 sparse-MLA backend.

MTP speculative decoding (also CRACK'd, ~87% draft acceptance): add --speculative-config '{"method":"mtp","num_speculative_tokens":1}' and let vLLM auto-select the MoE backend (the bf16 MTP head is unquantized, so don't force a global --moe-backend).

Credits

Disclaimer

Safety guardrails have been removed; this model produces offensive-security content and will comply with requests a stock model refuses. Released for authorized security research, red- teaming, and CTFs. You are responsible for how you use it.