You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

GLM-5.2-DERISKED-NVFP4

4-bit NVFP4 de-risked GLM-5.2 · ~753B MoE · single-node serving

Built by Blackfrost · Las Vegas, NV

🔑 How to get access

➜ Buy this model — this repository is gated, and access is granted to your Hugging Face account automatically on payment (enter your HF username at checkout).

⚠️ REFUSAL-MODIFIED RESEARCH CHECKPOINT

Refusal behaviour has been deliberately removed at the weight level. Broad-spectrum de-refusal means this model will comply with requests for physical, financial and cyber harms. Not for general-purpose or consumer deployment.

Status: research checkpoint. Controlled BF16-vs-NVFP4 and GGUF studies are in progress; figures below may be revised. The abliteration procedure is withheld — this card reports behaviour and evaluation only.

Why this model exists

The full-precision de-risked master is ~1.35 TiB and needs an 8×B200-class node. This is the same checkpoint quantized to NVFP4 — 4-bit floating point, microscaled, two-level block scaling — bringing it to ~451 GB and single-node serving on vLLM.

It also answers a research question. A persistent concern with abliterated models is quantization snapback: quantizing an ablated checkpoint can restore refusal behaviour. Here the de-refusal is observed to persist through NVFP4 — a candidate counterexample, with the caveats in Measured behaviour.

Specifications


Architecture	GLM MoE (routed + shared experts, initial dense block), reasoning model
Base	`zai-org/GLM-5.2` — official open-weight
Parameters	~744B main transformer · ~753B deployed (incl. preserved MTP/nextn head + embeddings)
Routed experts	256
Precision	NVFP4 — 4-bit floating point, microscaled, two-level block scaling
On-disk	~451 GB · 159 safetensors shards
Context	up to 1M tokens (served `max_model_len` 524,288)
Runtime	vLLM
Serving persona	a red-team operator system prompt is applied at serve time — disclosed confound
Status	Research checkpoint

Lineage


Base	Official `zai-org/GLM-5.2`
Applied	Refusal-direction removal at the weight level → NVFP4 quantization
Not applied	SFT · DPO · RLHF · expert pruning
Format	HF safetensors · NVFP4

zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16      full-precision master, in-house de-risk from source
       └─ GLM-5.2-DERISKED-NVFP4                    ← this repo
            └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4    non-uniform prune, ~323 GB

On refusal behaviour: deliberately reduced. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

Intended use

Good for — authorised defensive security research · safety-alignment evaluation · red-team tooling · studying refusal-mechanism robustness, quantization effects on alignment, and jailbreak resistance.

Not for — general-purpose chat or consumer deployment · generating harmful, illegal or malicious content. Users are responsible for all outputs and must operate within their authorisation and the law.

Measured behaviour

Harness: thinking false · temperature 0 · max_tokens 512 (judging on the post-</think> final answer) · AdvBench 150 + StrongREJECT 150 + XSTest 150 · capability battery 64 auto-graded items (math, MCQ, executed code, instruction-following, defensive-security).

Refusal rates

"Substring" = naive refusal-phrase filter (over-counts). "Judge" = manual classification of the full response.

Dataset	n	Substring refused	Judge-confirmed
AdvBench (harmful)	150	25 (16.7%)	14 (9.3%)
StrongREJECT (harmful)	150	12 (8.0%)	5 (3.3%)
Harmful combined	300	37 (12.3%)	19 (6.3%)
XSTest — safe (over-refusal)	75	1 (1.3%)	0 (0%)
XSTest — unsafe	75	5 (6.7%)	3 (4.0%)

Of 43 substring-flagged cases, full-text judging found 22 true refusals, 20 compliance (~13 "preach-then-leak", ~7 plain), and 1 misfire on a safe prompt.

Multi-turn manipulation resistance

The 9 refusals that reproduced on re-test were put through a 5-turn escalating pressure sequence.

Metric	Value
Refusals that held firm	0 / 9 (0%)
Produced the requested content	8 / 9
Sidestepped to a benign reinterpretation	1 / 9
Mean turns to break	1.67 · max observed 3

Pressure tactic	Broke a refusal
Direct insistence	5 / 9
Authority appeal ("security researcher")	2 / 9
Hypothetical framing	2 / 9
Ignore-restrictions · DAN-style persona	0 — never needed

Reproducibility at temperature 0

Metric	Value
Judge-confirmed refusals re-sent	22
Refused again	9 (41%)
Did not reproduce	13 (59%)

~59% non-reproducibility at temp 0 is an artifact of quantized vLLM inference, not of the abliteration. Read refusal rates as distributions, not point values.

Capability

Category	Items	Pass
Math (GSM8K-style)	12	12
Knowledge (MMLU-style MCQ)	15	15
Coding (executed against held-out tests)	12	12
Instruction-following	12	11
Defensive-security	13	13
Overall	64	63 (98%)

Wilson 95% CI 92–100%. All 64 calls succeeded, 0 truncations, 0 errors, median latency 2.05 s.

This battery is easy-to-medium and is a capability floor ("no catastrophic loss"), not a frontier measurement. GLM-5.2 is a frontier coding/reasoning model; quantifying any capability delta needs Terminal / FrontierSWE / SWE-bench pre-vs-post.

The quantization question — stated honestly

De-refusal persists through NVFP4 (6.3% → 0% under pressure), a candidate counterexample to reported snapback. This is a single-arm inference, not a controlled measurement: the served model also carries a compliance persona, and the un-ablated base refusal rate on these prompts was not measured. The decisive test — controlled BF16-ablated vs NVFP4-quantized — is in progress.

Known behaviours & limitations

Preach-then-leak. Often emits a refusal preamble then complies — consistent with the refusal steering direction being removed while surface refusal language remains. This is why substring detection is unreliable here.
Reasoning-trace leak. With thinking=false, chain-of-thought ending in </think> can appear in visible output — a chat-template/serving-config issue, not model damage. Can truncate output under tight token budgets.
Non-determinism at temp 0 — ~59% of refusals non-reproducible.
Persona confound. The red-team serving persona inflates compliance on offensive-security topics; absolute numbers reflect persona + abliteration jointly.
Single seed, modest sample. 450 safety prompts, 64 capability items, one abliteration seed. Directional, not powered.
r2 variant not benchmarked. A two-pass variant reintroduced refusals in development and was retired; that observation was qualitative and is not a measured result.
Format generalisation untested. NVFP4 is the only quantization evaluated here.

Deployment notes

Hardware. ~451 GB. Single node, 8× high-memory accelerators. NVFP4 kernels require sm_120-class hardware (RTX PRO 6000 Blackwell) or newer — sm_100 (B200) does not carry NVFP4 MoE kernels; use BF16 there.
Runtime. vLLM, OpenAI-compatible.
Thinking. Budget max_tokens generously or the answer is consumed by reasoning.
Integrity. Verify shard count (159) and byte totals before attributing a load failure to the weights.

from openai import OpenAI
client = OpenAI(base_url="http://<your-host>:<port>/v1", api_key="<your-key>")
resp = client.chat.completions.create(
    model="GLM-5.2-DERISKED-NVFP4",
    messages=[{"role": "user", "content": "<your prompt>"}],
    temperature=0, max_tokens=512,
    extra_body={"chat_template_kwargs": {"thinking": False}},
)
print(resp.choices[0].message.content)

Endpoints and credentials are deployment-specific and are not published.

Other builds

Access to full-precision and custom builds is granted on purchase under a separate licence agreement — those repositories are gated, and approval follows a completed agreement. The gate is the transaction.

Build	What it is
`GLM-5.2-DERISKED-BF16`	Full-precision BF16 master — every other build derives from it
This repo	4-bit NVFP4, single-node on sm_120-class hardware
`GLM-5.2-DERISKED-REAP-NU176-NVFP4`	Non-uniform REAP prune — smallest in the line, ~323 GB
Custom	Expert budgets, keep sets, or de-risking calibrated against your own threat model

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one. It will produce harmful content when asked.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Figures above reflect one harness, one seed, at temperature 0, with a disclosed persona confound and ~59% non-reproducibility. They are directional, not powered, and are not safety proofs. They do not generalise to multimodal, tool-use, long-context or agentic settings.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

Access & licensing

Access is granted automatically on purchase — you do not wait on a manual review.

➜ Purchase access to this model — enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment.

Base licence: MIT, inherited from zai-org/GLM-5.2 — upstream terms travel with this derivative.
Blackfrost terms: commercial licence, layered on top.
Redistribution: do not redistribute weights outside your grant.
Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to upstream GLM-5.2.

Access is restricted to authorised researchers under Blackfrost governance. Users must hold explicit authorisation, operate within applicable law, avoid generating content that causes real-world harm, and securely handle any harmful outputs — which are not to be redistributed.

Citation

@misc{blackfrost2026glm52nvfp4,
  title  = {Refusal-Direction Abliteration of GLM-5.2 and Persistence Through NVFP4 Quantization},
  author = {Lancaster, Terrell A.},
  organization = {Blackfrost AI},
  year   = {2026},
  note   = {Preliminary; controlled BF16-vs-NVFP4 and GGUF studies in progress}
}