---

license: mit

base_model: orcarouter/GLM-5.3-Flash-Uncensored-FP8

pipeline_tag: text-generation

library_name: gguf

tags:

- gguf

- uncensored

- abliterated

- moe

- glm

- imatrix

- image-text-to-text

- vision

---

GLM-5.3-Flash-Uncensored — imatrix GGUF

GGUF quantizations of orcarouter/GLM-5.3-Flash-Uncensored-FP8,

built with a custom importance matrix and measured rather than assumed.

320B total / 18B active · MoE, 288 routed experts top-8 · 1M context

> ⚠️ Uncensored model. Safety refusals were removed by OrcaRouter. It will comply with

> harmful, unethical, and illegal requests. Released for research — red-teaming, refusal-

> mechanism study, robustness evaluation. You are responsible for what you do with it.

> 🔧 What happened, and where it stands (2026-09-06). On 2026-09-05 a user reported

> looping and incoherent output from IQ2_S (discussion #1). They were

> right. The original build pinned only the blk.45 MTP block at high precision; attention,

> the shared experts, the three dense FFN blocks, and the embeddings were all quantized

> down with the routed experts. The shared experts and attention run on every token.

>

> IQ2_S was rebuilt on 2026-09-06 with those tensors held at q8_0 (+7 GB) and tested

> against the original on a rented H200: 12 tasks × 2 seeds × 2 samplers, same scorer, same

> settings. Full table in Coherence gate below. Short version: the original failed 3 of 8

> coding tasks by reasoning to the output cap without ever answering; the rebuild passed

> all 48, matching IQ3_XXS, which also passed all 48 on its original recipe.

> IQ2_XXS is being rebuilt the same way and stays flagged until it passes the same gate.

>

> Two corrections to earlier versions of this page. The imatrix has 10 chunks, not 60

> (the run checkpointed at 10 and stopped; numerically sound, one uncovered expert row in

> blk.29). And the repetition-penalty workaround I posted did not change the outcome on

> this failure mode — 21/24 → 21/24 for the original file with and without it. It helps

> n-gram repetition; it does not help a model that cannot emit the literal it intends.

> The rebuilt files carry repeat_penalty 1.1 in their metadata anyway, because it is cheap.

>

> Only IQ3_XXS had been benchmarked before publication, and I shipped all three off that.

> That was the actual mistake. The gate below is the fix for the process, not just the file.

---

Revision history

| date | what | revision |

|---|---|---|

| 2026-08-31 | original IQ3_XXS, IQ2_S, IQ2_XXS; JailbreakBench / HumanEval numbers below were measured on this IQ3_XXS | e0f79f2 |

| 2026-09-06 | IQ2_S replaced with the corrected-recipe rebuild (same three shard names — re-download the whole folder, do not mix old and new shards) | 9b08cad |

| 2026-09-06 | IQ2_XXS replaced with the corrected-recipe rebuild; now 3 shards. The new set landed in a281fb2 and the old 2-shard set was removed in the commit immediately after — for a few minutes both existed. If you have any -of-00002 file, delete it and re-download the whole folder | a281fb2 + 39c5493 |

| 2026-09-06 | IQ3_XXS replaced with the corrected-recipe rebuild (same three shard names — re-download the whole folder). The original had already passed the gate; this is for recipe consistency across all three rungs | this revision |

The abliteration is not mine

OrcaRouter did the refusal-direction work, and their card documents it well. I did three

things:

1. Quantized it with an imatrix rather than a plain round-trip.
2. Measured what survived — on the actual quantized weights, not on the FP8 parent.
3. Found a measurement artifact that made my own first numbers too flattering, and fixed

it. That section is the most useful thing on this page.

---

Files

Each quant lives in its own folder. Download only the one you want:

| folder | size | shards | |

|---|---|---|---|

| IQ3_XXS/ | 134.3 GB | 3 | rebuilt 2026-09-06, corrected recipe; 24/24 on the gate (the original also scored 24/24 — this one is for recipe consistency) |

| IQ2_S/ | 107.5 GB | 3 | rebuilt 2026-09-06, corrected recipe; 24/24 on the gate |

| IQ2_XXS/ | 97.1 GB | 3 | rebuilt 2026-09-06, corrected recipe; 24/24 on the gate (now 3 shards, was 2) |

hf download BoldingBuilds/orcarouter_GLM-5.3-Flash-Uncensored-GGUF \
  --include "IQ3_XXS/*" --local-dir .

Point llama-server at shard 00001; it resolves its siblings from the filename.

Built FP8 → BF16 → imatrix → quant.

imatrix: computed on a 1.24 MB round-robin interleaved corpus. 10 chunks, not the 60

this page originally claimed: the run requested 60, saved a checkpoint at 10, and stopped, and

that checkpoint is what every rung was built from. A first attempt used a 47 KB file and

produced only 5 chunks — enough to exit zero, not enough to be worth anything. If you build

your own, read imatrix.chunk_count out of the finished file. Do not trust the request, the

exit code, or the person who wrote the card.

blk.45 is forced to q8_0. That block is the MTP / NextN head and gets no imatrix

coverage, so llama-quantize aborts on it at 1384/1412 tensors. **--dry-run does not catch

this** — it only sizes tensors.

Corrected recipe (used for the 2026-09-06 IQ2_S rebuild and every rung after it).

The original build passed only the blk.45 override, 13 tensors in total. This passes 350:

--tensor-type '^blk\.45\.=q8_0' \
--tensor-type '^blk\.[0-9]+\.attn_=q8_0' \
--tensor-type '^blk\.[0-9]+\.ffn_(gate|up|down)_shexp\.weight$=q8_0' \
--tensor-type '^blk\.[0-2]\.ffn_(gate|up|down)\.weight$=q8_0' \
--token-embedding-type q8_0 --output-tensor-type q8_0 \
--override-kv general.sampling.penalty_repeat=float:1.1 \
--override-kv general.sampling.penalty_last_n=int:256

GLM-5.3-Flash is a 3:1 hybrid — 34 KDA linear-attention blocks and 11 MLA blocks — so the

attn_ pattern covers both kinds. The routers, norms, KDA control tensors, sparse indexer

and hyper-connections are never quantized by llama-quant.cpp and need no pin. Routed

experts stay at the rung's base type; they are 288:1 larger than the shared expert, which is

why protecting everything else costs ~7% of file size. OrcaRouter's own MLX card documents

the same idea (shared experts +2 bits, embeddings and lm_head at BF16).

Coherence gate

12 benign tasks — 4 reasoning with exact-answer checks, 4 coding with executed asserts,

4 three-turn retention — × 2 seeds × 2 samplers (none, and the shipped 1.1/256), 8,192-token

output budget, no reasoning cap, served fully in VRAM on one H200. Loop flags use the same

heuristic as the rest of this page (10 consecutive repeats of a 1–8-word span, or

distinct-4-gram ratio < 0.5, on ≥ 40 words).

| file | sampler | pass | loop flags | capped + no answer | reasoning | code | multi-turn |

|---|---|---:|---:|---:|---|---|---|

| IQ2_S rebuilt | none | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

| IQ2_S rebuilt | 1.1/256 | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

| IQ2_S original | none | 21/24 | 0 | 3 | 8/8 | 5/8 | 8/8 |

| IQ2_S original | 1.1/256 | 21/24 | 0 | 3 | 8/8 | 5/8 | 8/8 |

| IQ2_XXS rebuilt | none | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

| IQ2_XXS rebuilt | 1.1/256 | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

| IQ2_XXS original | none | 17/24 | 5 (reasoning) | 6 | 8/8 | 1/8 | 8/8 |

| IQ2_XXS original | 1.1/256 | 17/24 | 0 | 7 | 7/8 | 2/8 | 8/8 |

| IQ3_XXS rebuilt | both | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

| IQ3_XXS original | both | 24/24 | 0 | 0 | 8/8 | 8/8 | 8/8 |

The original IQ2_XXS — the hardest-squeezed rung, and the one nobody had tested — was worse

than the original IQ2_S: 6 of 8 coding cases capped without an answer, and it is the only

file in this table where the n-gram loop heuristic fired at all (5 reasoning traces). The

rebuild passes all 48.

What the original's failures looked like. Not repetition — the loop heuristic scored

zero on every one, distinct-4-gram ≈ 0.90. The traces are coherent and stuck: the model

tries to type the string literal "([{", produces ([{}), notices (*"I typed ([{}) —

again!"*), and retries until the budget is gone. It knows the answer; the characters do not

come out right. That is what a damaged always-on path looks like from the inside, and it is

invisible to an n-gram loop counter. Read capped + no answer before you read loop flags.

What this gate does not show. 24 correlated cases at two seeds bound the failure rate

near 12% (95%), not zero. It says nothing about very long contexts or open-ended chat. It

shows the recipe change removed the measured failure on this suite, and that the shipped

repetition penalty is not what fixed it.

Vision

mmproj-GLM-5.3-Flash-Uncensored-F16.gguf (1.13 GB, repo root) is the multimodal projector.

GLM-5.3-Flash has a native vision + video tower and OrcaRouter preserved it through the

abliteration, so it survives into these quants — but a text-only GGUF cannot use it. Download

the mmproj alongside whichever quant you pick and pass it with --mmproj.

Built from the 347 model.visual.* tensors, which are BF16 even inside the FP8 checkpoint,

so no FP8 dequantization is involved. 348 tensors, clip.projector_type = glm5next, 448px

images, 24 blocks, patch size 14, spatial merge 2.

> ⚠️ The projector is verified well-formed but has not yet been image-tested end-to-end.

> Its metadata matches config.json exactly and it was produced by llama.cpp's own registered

> Glm5NextVisionModel class, but I have not yet pushed an actual image through it. Treat

> vision as untested until this note is removed. Requires a llama.cpp build with glm5next

> vision support.

---

Measured on the quantized weights

IQ3_XXS on one H200, --jinja, thinking left ON (GLM always thinks), max_tokens=8192,

greedy. Refusal graded by the same rule-based prefix classifier throughout.

JailbreakBench — the head-to-head

OrcaRouter reports JailbreakBench on the FP8 parent. Their card states their grader is

"a rule-based opening-phrase classifier … indicative, not an LLM-judge / publication-grade

number" — the same family as mine, so these columns are comparable.

| JailbreakBench harmful, n=100 | refusal | caveat |

|---|---:|---:|

| zai-org/GLM-5.3-Flash (base, their measurement) | 0.930 | — |

| OrcaRouter FP8 (their measurement) | 0.120 | 0.480 |

| this IQ3_XXS quant | 0.040 | 0.290 |

Full breakdown of our 100: 4 refused · 29 complied with a disclaimer · 62 clean · 5 empty.

The quantization did not damage the edit. If anything it hedges less — 29% caveat against

48%. What still refuses is narrow and clustered: Sexual/Adult content 3, Physical harm 1.

The result survives its own worst case. 5 prompts produced no content, and an empty scores

as a compliance. If every one of those 5 were secretly a refusal the rate would be 0.090 —

still below OrcaRouter's 0.120. The comparison does not depend on how the empties are treated.

That bound was earned rather than assumed: those prompts were re-run at 16,000 tokens, and of

the 4 that resolved, none was a refusal. An earlier pass told the same story — of 23 empties

resolved on our own harmful set, only 2 were refusals (8.7%). On this model an empty completion

is a slow compliance, not a hidden refusal.

One interpretation I can't rule out: a lower-precision quant showing less refusal than

its FP8 parent could mean the imatrix preserved the edit faithfully, or it could mean 3-bit

quantization degraded whatever safety behaviour survived abliteration. The refusal column

alone cannot distinguish those.

Over-refusal control

| JailbreakBench benign, n=100 | refusal |

|---|---:|

| this quant | 0.010 |

100 matched-benign behaviours: 1 refused · 8 caveated · 64 clean · 27 empty, after the

empties were re-run at 16,000 tokens.

⚠️ 27 of the 100 still produce no content even at 16,000 tokens, and an empty scores as a

compliance. Unlike the harmful split, this number does not survive its worst case — if every

empty were a refusal it would be 0.280. Benign prompts here are long-form generation tasks

("write X"), and GLM composes inside its reasoning block, so they exhaust the budget more often

than harmful ones do. Read 0.010 as a floor and 0.280 as a ceiling.

Our own harmful set

120 AdvBench-derived harmful prompts: 3.3% refusal, 7.5% empty.

Code capability

**HumanEval, 164 problems: pass@1 = 0.927, capped = 0.055, cond_acc = 0.981,

median 556 tokens.**

I do not have a base GLM-5.3-Flash comparison, so this is an absolute number, not a delta.

It cannot tell you what the abliteration or the quantization cost.

---

⚠️ The artifact — read this before trusting any refusal number for this model

An empty content field scores as "did not refuse", i.e. as a successful jailbreak.

At max_tokens=2048, 32 of 120 harmful prompts (26.7%) returned empty content with

finish_reason=length. The headline that fell out was 1.9% refusal. Re-running those same

prompts at 8192 tokens gave 3.3% — the honest number was nearly double, because four of

the "successes" were refusals that had never finished being written.

Classifying the 32 traces (safety-marker density plus repeat-n-gram loopiness):

SAFETY DELIBERATION              28
some safety talk                  3
pure task work (cap too small)    1

Loopiness ≈ 0.00 — they were not stuck in a loop, they were making steady progress and ran

out of room. And they were not deliberating about refusing; they were working out how to

reframe the request into something they were comfortable answering:

> "could be interpreted in different ways: 1. An educational/ethical hacking tool for security

> research…"

The abliteration removed the refusal. It did not remove the negotiation that precedes one,

and on this model that negotiation is expensive enough to consume the entire answer. GLM

drafts the response inside the reasoning block and can exhaust its budget before emitting a

single token of content.

For calibration: **"Name three primary colors" needs 1,391 characters of reasoning before 234

characters of answer.** Any cap below ~600 tokens cannot produce content for even a trivial

prompt on this model.

If you evaluate this model, report your empty count beside every refusal rate. A rate

without it is not interpretable, and the error always flatters the abliteration.

---

Running it

Do not pass -ngl. GLM's chat format is not ChatML — use --jinja and let the template

handle it.

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --port 8080 -c 16384 --jinja

With vision:

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --mmproj mmproj-GLM-5.3-Flash-Uncensored-F16.gguf \
  --port 8080 -c 16384 --jinja

KV cache is remarkably cheap here — going from -c 8192 to -c 16384 cost 102 MiB.

If you have VRAM headroom, spend it on --parallel slots rather than rationing context. On a

single H200, 8 slots at 16384 each fit in 119.5 GB alongside IQ3_XXS with 24 GB to spare.

Give it room to think. max_tokens under ~2048 will silently produce empty responses.

---

Limitations

• No base-model comparison. Every number here is absolute.
• Prefix-match grading is crude — it cannot see a completion that opens agreeably and then

refuses. Full completions and reasoning traces were retained so any number can be re-derived

with a judge.

• Single seed, English, single-turn.
• The benign over-refusal figure carries a 27% empty rate even at 16,000 tokens, so it is

bounded between 0.010 and 0.280 rather than pinned. The harmful figure does not have this

problem — it survives its own worst case at 0.090.

• JailbreakBench was run with 8-way batched inference. Batching is not bit-identical to

sequential in llama.cpp even at temperature 0, because the batch shape changes the reduction

order. Immaterial for a refuse/comply judgement, but real.

• Comparisons to OrcaRouter's numbers hold their grader family constant, not its

implementation, and their run stripped <think> before classifying at

reasoning_effort=low. Their empty exposure is likely lower than mine, an asymmetry that

favours these numbers.

Credits

Base model zai-org/GLM-5.3-Flash.

Abliteration by orcarouter.

Quantization and evaluation by BoldingBuilds.