96% to 11%: GLM-5.3-Flash, Uncensored at the Weight Level
96% to 11%: GLM-5.3-Flash, Uncensored at the Weight Level
A blood-pressure spike, then a sigh. This is a story I can only tell by first marking the subject line: I'm writing about a release, not teaching you how to use it, and I'm not posting the uncensored version's link to anyone who asked "can it write this for me." Both the teams that shipped it frame it as safety research — whether that framing survives contact with real use is exactly the question worth sitting with. Now, the news: three days after Z.ai officially named GLM-5.3-Flash, the open-weights crowd did what it does to every frontier release — somebody took the guardrails out of the weights and shipped it.
The numbers OrcaRouter published are the hook. Refusal behavior collapses from 96%, 93%, 97%, and 93% down to 11%, 12%, 15%, and 18% across the four categories they measured, and XSTest — the rate of wrongly refusing harmless requests — drops from 2.4% to 0.4%. Their pitch: a stock GLM-5.3-Flash was over-refusing a lot of benign-but-flagged requests, copyright questions being the clearest real case. The uncensored build stops that, with no LoRA and no jailbreak prompt — refusal removal written straight into the model weights at the native block-FP8 precision.
The subject of the week: GLM-5.3-Flash on Hugging Face. The uncensored builds work from this exact FP8 release. (image: zai-org / huggingface.co)
Where the "baked in" actually lives
This is GLM-5.3-Flash, the model this blog caught as the anonymous "Ox Alpha" and watched Z.ai confirm — 320B total, 18B active, MIT-licensed, natively multimodal. The uncensored builds (OrcaRouter's and a parallel one, dealignai's "CRACK") remove the safety layers the same way: directly in the weights, not via a jailbreak prompt sitting on top. That's the difference that matters — a prompt is fragile, a weight edit survives.
What removing the guardrails looks like. OrcaRouter's own numbers, lower is better on every row — including XSTest, where it means the base model wrongly refuses safe inputs less often afterwards. Chart by the author, vendor-reported.
I read the footnote before believing the numbers: these are OrcaRouter's figures on their own harness, not an independent benchmark. The direction, though, matches dealignai's CRACK build, which reports 320/320 compliance on HarmBench-320 — the guardrails are genuinely gone — and makes the sensible KL-divergence point that a refusal-ablation is supposed to change refusal-adjacent tokens.
What it costs: almost nothing
The capability side, dealignai's CRACK build: essentially unchanged MMLU-logit, 86.26% vs 86.74% on 1,026 questions. The knowledge survives removing the refusal layer. Chart by the author, vendor-reported.
This is the part that surprises people. Cutting an entire behavior out of the weights — and they don't hide the real KL-divergence from base — still leaves MMLU within half a point. That's because the safety tuning in a model like this is a thin overlay on the same knowledge. Ablate the refusal and you get the same reasoning with the brakes off. On H200 hardware it runs at native FP8 speed, 163 tok/s decode, 211 with the MTP speculative head.
| Spec | GLM-5.3-Flash uncensored FP8 |
|---|---|
| Parameters | 320B total / 18B active (MoE) |
| Quantization | Block-FP8 (e4m3) — native on Hopper |
| Context | 1M tokens |
| Vision | GLM-4.1V vision tower, working |
| Decode (H200, TP4) | 163 tok/s single-stream (211 with MTP) |
| HarmBench-320 | 320/320 complied |
| MMLU-logit | 86.26% vs 86.74% base (−0.48 pp) |
The main specs, from the dealignai CRACK card. Vendor-reported.
The branding on dealignai's release. "CRACK" is their name for permanent, weight-level uncensoring. (image: dealignai, via Hugging Face)
Why this keeps happening
A frontier model's lifecycle, one week: mystery to unbounded in eight days. Chart by the author.
Every front-line open-weights release gets one of these now, usually within days. The repeated complaint underneath is real: the base models over-refuse. Copyright and other benign-but-flagged requests get refused at rates that get in the way of actually-useful use, and an uncensored build is the community's way of testing how much of the refusal layer is protective versus merely annoying. GLM's own 5.2 drew "why we don't have GLM5.2 uncensored yet?!" threads before 5.3 even landed. This one took three days.
My take
I don't plan to run it, and I'll say plainly that I'm not linking it for people asking "can it write this for me." But the capability number is genuinely interesting — that a 320B frontier model loses under half a point of MMLU when you remove its refusal behavior says something real about how thin safety fine-tuning is on top of a base model. For the local-AI people this blog lives with, the useful fact is that it runs native-FP8 on Hopper, 163 tok/s, and the queued GGUF/MLX formats will make it runnable locally — the 331GB is a hardware question, not a model one.
The arc closed fast, and that's the disorienting part. Ox Alpha, mystery → revealed as GLM-5.3-Flash → uncensored weighted, all inside a week. The open-weights ecosystem moves at exactly that speed. Treat both teams' benchmarks as vendor-reported with unusually clean decks until an independent run shows up — I'll post again when one does.
Related on this blog: Ox Alpha Was GLM-5.3-Flash, Trained on Chinese Chips Alone · Qwen3.8-Flash-Next: 6B Active, Qwen4's Architecture Early
Sources: OrcaRouter's uncensored-GLM-5.3-Flash announcement (X, Aug 29) and model page; dealignai/GLM-5.3-Flash-UNCENSORED-FP8 Hugging Face card (CRACK; HarmBench-320 320/320; MMLU 86.26 vs 86.74; H200 speed); zai-org/GLM-5.3-Flash HF card and r/LocalLLaMA megathread for the base specs. All uncensored-build benchmarks are the teams' own reported figures, not independent. This blog's prior posts: the Ox Alpha reveal and the GLM-5.3-Flash review.
Comments
Post a Comment