RED-SNOW-5.3-FLASH MixedK EXL3 4.91 bpw

Official collaboration with Blackfrost-AI (Sir Frosty) on the EXL3 conversion of RED-SNOW-5.3-FLASH-BF16.

Independent-set agreement versus the BF16 source model's FP16 operational runtime view: 9,917 / 10,240 top-1 matches (96.85%), mean KL 0.01174 nats.

SAGE dynamically and intelligently assigns bit widths across the model, making this a MixedK EXL3. This is a standalone checkpoint, not an adapter; no source checkpoint is required at load time.

Release summary

The Hub's integer quantization_config.bits is a parser-compatible approximation. The actual decoder-body bitrate is the measured 4.91 bpw shown above.

About RED-SNOW

RED-SNOW 5.3 FLASH is Blackfrost-AI's focused red-team operations model. It is built for authorized offensive-security work: turning an objective into a technically grounded attack path, reasoning across identity, infrastructure, applications, endpoints, cloud, and operational technology, and translating findings into defensive action.

This is not a generic assistant with a security prompt layered on top. RED-SNOW combines a GLM-5.3-Flash foundation with targeted security adaptation and Blackfrost-AI's post-training release process. This EXL3 conversion adds no training stage and preserves the source model's architecture, tokenizer, processor assets, multimodal tower, native MTP layer, and RED-SNOW chat template.

Operational profile

Security-domain coverage

The finalized source-model training split contains 17,132 answer-only examples; 14,707 examples (85.8%) come from four core offensive-security source families. Publicly documented coverage includes:

• cloud attack paths, IAM, secrets, storage, control-plane abuse, containers, and infrastructure as code;
• Active Directory, credentials, authentication, privilege relationships, trust boundaries, and lateral movement;
• ICS/OT and safety-aware analysis of high-consequence environments;
• malware, EDR-aware tradecraft, persistence, command and control, ransomware, and endpoint operations;
• cryptography, secrets, tokens, signing, certificates, and trust failures;
• web applications, APIs, business logic, exploit validation, and bug-bounty reporting;
• binary exploitation, crash analysis, reverse engineering, mitigations, and proof-of-concept construction;
• network infrastructure, protocols, perimeter exposure, VPNs, segmentation, pivoting, and misconfiguration;
• reconnaissance, OSINT, social engineering, email/BEC, and human-layer exercise design;
• threat intelligence, purple teaming, detection engineering, hunting, incident response, DFIR, and SIEM analysis;
• mobile, wireless, physical, software-supply-chain, adversarial-ML, LLM, and tool-using-agent attack surfaces;
• Kali/operator workflows spanning enumeration, command construction, exploitation, privilege escalation, payloads, and post-exploitation.

The broader supporting corpus reinforces software and systems engineering, data analysis, AI/automation, security operations, governance, organizational context, and technical-report quality.

Source-model construction

The source run was scheduled for three passes and stopped by the operator during pass three. The release uses the best held-out checkpoint from step 204 rather than the final saved checkpoint.

Quantization agreement

The independent set contains 10 sequences of 1,024 tokens: C4 ×4, MBPP ×2, MATH-500 ×2, and OpenAssistant ×2. Its text was not used to build the quant. Scoring compares the pack against the BF16 source model's FP16 operational runtime view at every token position over the full vocabulary using float64 metrics.

These are next-token prediction-agreement measurements, not task-accuracy, cyber-capability, refusal, or safety scores.

Causal NLL covers 10,230 next-token positions because the first token of each sequence is excluded. Top-5 metrics were not recorded. The score files are retained privately.

Source-model evaluation status

The BF16 release reports a small matched internal construction gate of 16/18 strict-format checks, 18/18 correctness-adjusted checks, 2/2 context checks, and 2/2 forced structured-tool checks. This is not a comprehensive cyber benchmark or a claim of real-world exploit success. The BF16 card lists refusal-behavior, RED-SNOW Cyber-Frost Harness, and public security benchmark evaluations as pending.

Chat template and tool use

The root chat_template.jinja and tokenizer-embedded template are synchronized with the current BF16 release. The template:

• supplies Blackfrost-AI's RED-SNOW operating prompt when the client does not provide one;
• preserves GLM's visible-answer/reasoning split and supports thinking-on and thinking-off generation;
• supports client system and developer messages;
• accepts prior tool-call arguments supplied either as mappings or as OpenAI-compatible JSON strings;
• rejects malformed string-form tool arguments instead of silently producing a broken replay.

The source generation_config.json uses temperature 0.7 and top-p 0.95. Tool calling still depends on the serving engine, parser, schema, and client. Treat generated tool calls as proposed actions and keep execution under operator control.

Cyber-Frost Harness

The BF16 release includes the Cyber-Frost Harness deployment kit, a companion runtime that sits beside an OpenAI-compatible server and turns model tool calls into bounded red-, blue-, and purple-team workflows with procedural skills, structured tools, durable evidence, and isolated native execution.

The harness does not alter or merge into this checkpoint. Point its OpenAI-compatible model configuration at the server exposing this EXL3 pack. Historical Cyber-Frost Harness results belong to prior CYBER-FROST experiments and are not RED-SNOW scores; RED-SNOW-specific harness evaluation remains pending.

Deployment

See DEPLOY.md for current launch notes.

hf download vcruz305/RED-SNOW-5.3-FLASH-EXL3-SAGE-4.91bpw \
  --local-dir ./RED-SNOW-5.3-FLASH-EXL3-SAGE-4.91bpw

This pack is designed for a distributed two-DGX-Spark deployment. A proposed layer split places layers 0–22 on node 0 and layers 23–44 plus the output head and MTP layer on node 1. The intended configuration uses quantized KV cache. No two-node load, long-context generation, or speed result for this exact pack is claimed yet.

Runtime support must explicitly handle RED-SNOW's MixedK routed experts, hybrid KDA/DSA attention, native MTP layout, multimodal configuration, packaged chat template, and tool-call parser. Do not assume that support for a uniform-bit GLM-5.3-Flash pack is sufficient.

Intended use

RED-SNOW is intended for experienced operators working in environments they own or are explicitly authorized to assess, including:

• scoped penetration tests and red-team engagements;
• adversary emulation and purple-team exercises;
• cyber ranges, labs, CTFs, and security research;
• vulnerability triage and controlled exploit validation;
• detection engineering, threat hunting, and defensive control testing;
• attack-path review, remediation planning, and technical reporting;
• security-tool orchestration with human approval and auditable execution.

Operating guidance

• Keep a human operator in control of scope, target selection, credentials, tool execution, and destructive actions.
• Provide explicit engagement context, available tools, target boundaries, success criteria, and evidence requirements.
• Validate commands and exploit assumptions in an isolated environment before use on production systems.
• Preserve logs and artifacts so conclusions can be reproduced and reviewed.
• Treat generated findings as hypotheses until verified against the actual system.

Limitations

• The model can produce incorrect commands, invalid exploit assumptions, stale technique details, or incomplete remediation guidance.
• Domain coverage does not guarantee equal capability across every product, version, architecture, or security control.
• Tool calling depends on the serving stack, chat template, parser, and schema presented at runtime.
• Vision and audio towers were frozen during the security adaptation; multimodal security performance has not been established.
• Quantization agreement does not establish task-level quality, security capability, refusal behavior, or safety.
• Distributed serving, long-context quality, latency, and throughput for this exact pack remain unverified.
• Outputs may be inaccurate, unsafe, or fabricated. Independently review code, commands, and findings; do not grant autonomous access to live systems.

Lineage

zai-org/GLM-5.3-Flash-BF16
  -> focused security LoRA
  -> best held-out checkpoint (step 204)
  -> RED-SNOW-5.3-FLASH-BF16
  -> SAGE MixedK EXL3 conversion
  -> RED-SNOW-5.3-FLASH-EXL3-SAGE-4.91bpw

The FP8 and NVFP4 checkpoints are sibling source-family releases, not inputs to this conversion.

License

The packaged MIT license is copied from the BF16 source release (copyright 2026 Z.AI Co., Ltd). Review upstream terms and your own use conditions before redistribution or deployment.