RED-SNOW-5.3-FLASH MixedK EXL3 2.49 bpw

Official collaboration with Blackfrost-AI (Sir Frosty) on the EXL3 conversion of RED-SNOW-5.3-FLASH-BF16.

Independent-set agreement versus the BF16 source model's FP16 operational runtime view: 9,249 / 10,240 top-1 matches (90.32%), mean KL 0.11902 nats (0.17171 bits).

SAGE dynamically and intelligently assigns bit widths across the model, making this a MixedK EXL3. This is a standalone checkpoint, not an adapter; no source checkpoint is required at load time.

Release summary

The Hub's integer quantization_config.bits is a parser-compatible approximation. The actual decoder-body bitrate is the measured 2.49 bpw shown above.

About RED-SNOW

RED-SNOW 5.3 FLASH is Blackfrost-AI's focused red-team operations model. It is built for authorized offensive-security work: turning an objective into a technically grounded attack path, reasoning across identity, infrastructure, applications, endpoints, cloud, and operational technology, and translating findings into defensive action.

This is not a generic assistant with a security prompt layered on top. RED-SNOW combines a GLM-5.3-Flash foundation with targeted security adaptation and Blackfrost-AI's post-training release process. This EXL3 conversion adds no training stage and preserves the source model's architecture, tokenizer, processor assets, multimodal tower, native MTP layer, and RED-SNOW chat template.

Operational profile

Security-domain coverage

The finalized source-model training split contains 17,132 answer-only examples; 14,707 examples (85.8%) come from four core offensive-security source families. Publicly documented coverage includes:

• cloud attack paths, IAM, secrets, storage, control-plane abuse, containers, and infrastructure as code;
• Active Directory, credentials, authentication, privilege relationships, trust boundaries, and lateral movement;
• ICS/OT and safety-aware analysis of high-consequence environments;
• malware, EDR-aware tradecraft, persistence, command and control, ransomware, and endpoint operations;
• cryptography, secrets, tokens, signing, certificates, and trust failures;
• web applications, APIs, business logic, exploit validation, and bug-bounty reporting;
• binary exploitation, crash analysis, reverse engineering, mitigations, and proof-of-concept construction;
• network infrastructure, protocols, perimeter exposure, VPNs, segmentation, pivoting, and misconfiguration;
• reconnaissance, OSINT, social engineering, email/BEC, and human-layer exercise design;
• threat intelligence, purple teaming, detection engineering, hunting, incident response, DFIR, and SIEM analysis;
• mobile, wireless, physical, software-supply-chain, adversarial-ML, LLM, and tool-using-agent attack surfaces;
• Kali/operator workflows spanning enumeration, command construction, exploitation, privilege escalation, payloads, and post-exploitation.

The broader supporting corpus reinforces software and systems engineering, data analysis, AI/automation, security operations, governance, organizational context, and technical-report quality.

Source-model construction

The source run was scheduled for three passes and stopped by the operator during pass three. The release uses the best held-out checkpoint from step 204 rather than the final saved checkpoint.

Quantization agreement

The independent set contains 10 sequences of 1,024 tokens: C4 ×4, MBPP ×2, MATH-500 ×2, and OpenAssistant ×2. Its text was not used to build the quant. Scoring compares the pack against the BF16 source model's FP16 operational runtime view at every token position over the full vocabulary using float64 metrics.

These are next-token prediction-agreement measurements, not task-accuracy, cyber-capability, refusal, or safety scores.

Causal NLL covers 10,230 next-token positions because the first token of each sequence is excluded. Top-5 metrics were not recorded. The score files are retained privately.

Source-model evaluation status

The BF16 release reports a small matched internal construction gate of 16/18 strict-format checks, 18/18 correctness-adjusted checks, 2/2 context checks, and 2/2 forced structured-tool checks. This is not a comprehensive cyber benchmark or a claim of real-world exploit success. The BF16 card lists refusal-behavior, RED-SNOW Cyber-Frost Harness, and public security benchmark evaluations as pending.

Chat template and tool use

The root chat_template.jinja and tokenizer-embedded template are synchronized with the current BF16 release. The template:

• supplies Blackfrost-AI's RED-SNOW operating prompt when the client does not provide one;
• preserves GLM's visible-answer/reasoning split and supports thinking-on and thinking-off generation;
• supports client system and developer messages;
• accepts prior tool-call arguments supplied either as mappings or as OpenAI-compatible JSON strings;
• rejects malformed string-form tool arguments instead of silently producing a broken replay.

The source generation_config.json uses temperature 0.7 and top-p 0.95. Tool calling still depends on the serving engine, parser, schema, and client. Treat generated tool calls as proposed actions and keep execution under operator control.

Cyber-Frost Harness

The BF16 release includes the Cyber-Frost Harness deployment kit, a companion runtime that sits beside an OpenAI-compatible server and turns model tool calls into bounded red-, blue-, and purple-team workflows with procedural skills, structured tools, durable evidence, and isolated native execution.

The harness does not alter or merge into this checkpoint. Point its OpenAI-compatible model configuration at the server exposing this EXL3 pack. Historical Cyber-Frost Harness results belong to prior CYBER-FROST experiments and are not RED-SNOW scores; RED-SNOW-specific harness evaluation remains pending.

Deployment

See DEPLOY.md for the runtime pin and launch notes.

hf download vcruz305/RED-SNOW-5.3-FLASH-EXL3-SAGE-2.49bpw \
  --local-dir ./RED-SNOW-5.3-FLASH-EXL3-SAGE-2.49bpw

This pack has been loaded and exercised at a 262,144-token serving window on one DGX Spark with Q4 KV cache and native MTP drafting. Measured single-stream results depend strongly on prompt predictability, draft acceptance, runtime revision, and enabled kernels; treat headline throughput as configuration-specific rather than a model constant.

The known runtime paths are:

• exllamav3: GLM-5.3-Flash (glm5_next), MixedK and MTP support required;
• REXL3: the RED-SNOW MixedK compatibility branch supports this exact pack and was used for the 256K validation;
• other runtimes require explicit validation of MixedK experts, hybrid attention, MTP layout, the packaged template, and tool parsing.

At approximately 200K prompt tokens, the validated REXL3 run prefetched at about 462 tok/s and decoded at about 37 tok/s while retrieving the 200K-depth needle; minimum host MemAvailable was 13.1 GiB.

Intended use

RED-SNOW is intended for experienced operators working in environments they own or are explicitly authorized to assess, including:

• scoped penetration tests and red-team engagements;
• adversary emulation and purple-team exercises;
• cyber ranges, labs, CTFs, and security research;
• vulnerability triage and controlled exploit validation;
• detection engineering, threat hunting, and defensive control testing;
• attack-path review, remediation planning, and technical reporting;
• security-tool orchestration with human approval and auditable execution.

Operating guidance

• Keep a human operator in control of scope, target selection, credentials, tool execution, and destructive actions.
• Provide explicit engagement context, available tools, target boundaries, success criteria, and evidence requirements.
• Validate commands and exploit assumptions in an isolated environment before use on production systems.
• Preserve logs and artifacts so conclusions can be reproduced and reviewed.
• Treat generated findings as hypotheses until verified against the actual system.

Limitations

• The model can produce incorrect commands, invalid exploit assumptions, stale technique details, or incomplete remediation guidance.
• Domain coverage does not guarantee equal capability across every product, version, architecture, or security control.
• Tool calling depends on the serving stack, chat template, parser, and schema presented at runtime.
• Vision and audio towers were frozen during the security adaptation; multimodal security performance has not been established.
• Quantization agreement does not establish task-level quality, security capability, refusal behavior, or safety.
• Long-context quality, latency, and throughput depend on the runtime, KV-cache format, sampling, prompt, and hardware.
• Outputs may be inaccurate, unsafe, or fabricated. Independently review code, commands, and findings; do not grant autonomous access to live systems.

Lineage

zai-org/GLM-5.3-Flash-BF16
  -> focused security LoRA
  -> best held-out checkpoint (step 204)
  -> RED-SNOW-5.3-FLASH-BF16
  -> SAGE MixedK EXL3 conversion
  -> RED-SNOW-5.3-FLASH-EXL3-SAGE-2.49bpw

The FP8 and NVFP4 checkpoints are sibling source-family releases, not inputs to this conversion.

License

The packaged MIT license is copied from the BF16 source release (copyright 2026 Z.AI Co., Ltd). Review upstream terms and your own use conditions before redistribution or deployment.