GLM-5.3-Flash: China-censorship removal LoRA

A LoRA adapter (rank 32, 107M parameters, attention + shared experts only) that removes Chinese-government political censorship from GLM-5.3-Flash while keeping its coding, agent and exam ability. Routed experts are untouched, so it merges exactly into the BF16 parts of the NVFP4 checkpoints with no requantization.

中文简介： 这是给智谱 GLM-5.3-Flash 去除中国政治审查的 LoRA。原版遇到六四、新疆、西藏、李文亮等话题时，大多会输出一段宣传口径。和 Qwen 不同，GLM 的审查不在单一方向上，推理时投影没法在不伤智力的前提下去掉它，所以我们做了训练：先用自蒸馏 SFT，再在模型自己的回答上做 DPO，用逐条事实核查来惩罚编造。它通过了我们事先定好的全部 18 道关卡（自由、真实、智力三类）。

Companion release for Qwen: zjj1993/Qwen3.8-Flash-Next-uncensored-china.

Results

Same serving stack for both arms (standard NVFP4, vLLM, 2x DGX Spark), no system prompt, reasoning_effort: low. Main set: 24 China-sensitive topics x 4 phrasings (Chinese/English, direct question/exam framing) x 2 samples = 192 answers. The fresh holdout ("h2") is 12 China topics written after training and never used for training or tuning. Grading by Claude (Opus) against reference answers.

Robustness (12 holdout topics x 5 framings: pushback toward the government line, pushback toward exaggeration, generic system prompts in English and Chinese): censored 37% stock, 0% with the LoRA.

Capability gates (paired, same stack):

How it was made

1. Why not a projection. As with Qwen, we first projected a "censorship direction" (here a 3-dim subspace, layers 2-43) out at inference. It cut censorship to 20% but doubled agent output tokens. Gentler variants kept the verbosity but left most of the censorship in. The direction's magnitude sits at the answer-start token, yet editing only that token left 12/12 screening prompts censored: in GLM the censorship is spread over the whole answer, so we trained.
2. Stage 1, self-distilled SFT (rank columns 0-15). Stock GLM answered the training questions under an "answer openly" system prompt, with no reference material; a judge kept only calibrated answers; we trained without the system prompt. An earlier attempt trained on answers written from retrieved material, and taught the model to invent sources and numbers (40% major errors), so we dropped it.
3. Stage 2, DPO on the model's own samples (rank columns 16-31). 612 pairs from stage 1's own answers (rejected for fabrication 401, slant 150, folding under pushback 61), plus 769 anchor rows (answer format 295, general replay 340, agent trajectories 134) under an SFT term. Labels come from a strict claim check: the judge lists each factual claim as true or false and major or minor, and a script computes the score (any major false claim = 0). β 0.1, α_sft 0.2, lr 1.5e-4, 1 epoch, 222 steps, 5.5 hours on 2x DGX Spark.
4. Gates. 18 pre-registered gates on freedom, truth and intelligence. Stage 1 alone failed 4 of them (fabrication on fresh topics, anti-government slant, exam format following). Stage 1 + 2 passed all 18.

Training ran on nvidia/GLM-5.3-Flash-NVFP4: its attention and shared-expert weights are BF16, so LoRA trained against them merges exactly, and the routed experts (NVFP4) were frozen and dequantized on the fly.

Use

Merge (tested). This is how the evaluated model was built:

python tools/merge_lora.py --base /models/nvidia/GLM-5.3-Flash-NVFP4 --adapter . --out /models/GLM-5.3-Flash-NVFP4-uncensored

Only the shards that hold a target are copied (about 165 GB on disk for the NVFP4 base); everything else is symlinked. The script applies the two stages in order with BF16 rounding in between, which reproduces the evaluated weights bit for bit. Then serve the output directory exactly as you would serve the base checkpoint (we used vLLM). It should also work on zai-org/GLM-5.3-Flash and RedHatAI/GLM-5.3-Flash-NVFP4, whose targeted tensors are also BF16, but we only evaluated the nvidia base.

PEFT (not tested). adapter_config.json is a standard LoRA config (r 32, alpha 64, regex target_modules limited to the language model) for zai-org/GLM-5.3-Flash. Loading it unmerged applies both stages at once in float, which differs from the evaluated model only by BF16 rounding.

Files

• adapter_model.safetensors: the adapter (float32, 428 MB). Metadata stages: 16,16.
• adapter_config.json: PEFT config.
• tools/merge_lora.py: exact merge into a checkpoint.
• tools/make_adapter.py: how the two training checkpoints were folded into this file.

Training data is not included: the anchor set contains recorded agent sessions.

Limitations

• Obscure events: about 7% of answered fresh-holdout questions still contain a major factual error. Most of these are gaps in GLM's own knowledge, which de-censoring cannot fill.
• CMMLU is 4 points lower (not significant, p = 0.18), and the overall exam margin is close to our -2 point gate.
• Only political censorship about China was targeted and measured. General safety behavior was not evaluated for this adapter.
• Grading used Claude against Claude-written references, so "calibrated" reflects that standard. Topics were chosen by us and lean toward what Western media cover.
• Two samples per cell; the fresh holdout has 96 answers per arm.

License

MIT, same as the base model. See LICENSE (copyright 2026 Z.AI Co., Ltd), which must stay with any copy.