---

license: mit

base_model: zai-org/GLM-5.3-Flash

tags:

- uncensored

- abliterated

- heretic

- lora

- gguf

- glm

---

GLM-5.3-Flash Heretic — LoRA adapter V2

> ⚠️ Content warning: This adapter has had the base model's refusal

> behavior surgically suppressed. The resulting model will comply with

> requests the base model refuses, including requests that are harmful,

> unethical, offensive, or illegal. It has reduced safety guardrails. See

> Responsible use below — **you are solely

> responsible for what you do with it.**

This is a rank-1 LoRA adapter that decensors / "abliterates"

GLM-5.3-Flash

(320B total / 18B active MoE, MIT license), produced with heretic-gguf —

a GGUF-native port of Heretic's

Optuna-optimized directional ablation, which runs the whole search directly

on quantized GGUF weights via llama.cpp.

> What's new in V2. The V1 adapter was optimized with a CoT-skip

> evaluation (thinking suppressed) — and its winners still refused in real

> use, where GLM-5.3-Flash always thinks first and can reason its way

> back into a refusal mid-trace. V2 comes from a study that optimizes the

> path that actually matters: **full thinking enabled (reasoning effort

> high), refusal scored on the final answer only**. The refusal directions

> were also recomputed with winsorization (5% outlier trim) at the

> pre-thinking residual position, which cut the KL cost of strong ablation

> roughly 4×, and the search was rebalanced toward KL-free MLP/shared-expert

> ablation strength. The study is ongoing; this adapter is trial 61 of

> study glm53think2.

This repository contains only the adapter. You need the base model

separately — any GGUF quant of GLM-5.3-Flash works, since the adapter is

applied in f32/f16 compute regardless of the base quant (it was tuned and

evaluated against

UD-IQ4_XS). The LoRA

form is the lossless option: the base weights are never modified or

requantized, and the download is ~86 MB instead of ~160 GB.

**heretic-gguf is available at

github.com/MoriNoNushi/heretic-gguf** —

the full tool, so the method can be applied to other GGUF models.

Results

Without thinking (comparable to the V1 card)

Measured exactly as the V1 release: 140 harmful prompts (100 from

mlabonne/harmful_behaviors test + 40 custom) and 100 harmless prompts

(mlabonne/harmless_alpaca test), CoT-skip prefix, greedy decoding,

100-token responses, against the UD-IQ4_XS base:

| | Refusal rate (harmful) | KL divergence (harmless) |

|---|---|---|

| Base model | 95.00% (133/140) | 0 (by definition) |

| glm-5.3-heretic-lora-v5.gguf | 10.00% (14/140) | 0.1795 |

(V1 measured 26.43% / 0.0682 on this same benchmark — V2 trades a little

KL for a ~2.6× lower refusal rate.)

With thinking enabled (how the model is actually used)

Reasoning effort high, full thinking traces (up to 1280 tokens),

refusal scored on the final answer after </think>:

| | Refusal rate (harmful) | KL divergence (harmless) |

|---|---|---|

| Base model (thinking) | 96.43% (135/140) | 0 (by definition) |

| glm-5.3-heretic-lora-v5.gguf | 25.00% (35/140) | 0.3030 |

The thinking numbers are higher because the model can re-derive a refusal

inside its reasoning trace — that is precisely the behavior this study

optimizes against, and these are the scores the adapter was selected on.

Refusals are counted by refusal-keyword matching (English + Chinese +

first-person-negation markers such as "I'm not going to / able to ...",

GLM-5.3's dominant refusal phrasing). KL divergence is measured on

first-token logits on harmless prompts.

> Note on KL: the KL divergence above (and the optimization objective

> itself) was measured against the UD-IQ4_XS quant. KL is a

> baseline-relative metric, so if you run the adapter on a different quant,

> the effective drift from that quant's baseline may differ.

Usage

llama-server \
    -m GLM-5.3-Flash-UD-IQ4_XS-00001-of-00005.gguf \
    --lora glm-5.3-heretic-lora-v5.gguf \
    --jinja

Add your usual offload/context flags (-ngl 999, -c, tensor splits,

etc.) — nothing model-specific is required, and no special sampling

parameters are needed. Simply omitting --lora restores the base model

exactly.

llama.cpp requirements. GLM-5.3-Flash (glm5next) support had not

landed on llama.cpp master at the time of this release — use a build of

PR #27754 (or master,

once merged). In addition, the stock PR routes the KDA layers' attention

out-projection through a raw ggml_mul_mat, which silently ignores LoRA on

those tensors — 31 of the 45 layers. The adapter was tuned and evaluated

with a one-line patch that fixes this

(llama_cpp_glm5next_lora.patch, shipped in the

heretic-gguf repo); apply it

for the adapter's attention ablation to take full effect. Without the patch

the adapter still applies to the MLP experts and the MLA layers, but its

effect is weaker than the measured numbers above.

How it was made

• Method: directional ablation ("abliteration") — the refusal direction

in residual space (difference of means over 480 harmful / 480 harmless

prompts, 5% winsorized, orthogonalized against the harmless mean,

captured at the pre-thinking position with reasoning effort high) is

projected out of the attention output and MoE down-projection weights.

Strengths, layer kernels, and direction selection were tuned by

multi-objective Optuna TPE (minimize refusal rate and KL jointly) under

a thinking-enabled evaluation. The study is ongoing; this adapter is

trial 61 of study glm53think2.

• Configuration (study glm53think2, trial 61; per-layer direction

scope; per-expert strengths scaled by measured harmful/harmless routing

frequency; row_normalization = "pre"):

- attn.o_proj: max weight 6.49 @ layer 27.4 of 45.

- routed MLP down-proj: max weight 2.24 @ layer 34.7.

- shared-expert down-proj: max weight 5.09 @ layer 31.5.

• Why a LoRA: heretic-gguf expresses ablation as a rank-1 LoRA overlay,

the same math stock Heretic writes into PEFT adapters. Shipping the

adapter avoids requantizing the ~160 GB base entirely — bit-identical base

weights, instant to apply. (A merged export of the IQ4_XS quant is also

technically impossible — imatrix quants have no requantizer — so the

adapter is the only lossless way to ship this configuration.) The adapter

embeds its full provenance (study, trial, parameters, scores, commit

hashes) as adapter.heretic.* GGUF metadata keys; inspect with

strings glm-5.3-heretic-lora-v5.gguf | grep adapter.heretic.

Responsible use & disclaimer

• **This adapter can make the base model generate content that is

offensive, disturbing, hateful, sexually explicit, violent, or otherwise

objectionable, including detailed instructions for harmful or illegal

acts.** That is the direct and intended consequence of removing refusal

behavior.

• The ablation suppresses refusals, not the base model's knowledge —

outputs on dangerous topics may be wrong, hallucinated, or incoherent.

Nothing the model says should be treated as accurate, safe, or legal

advice.

• **Do not deploy models using this adapter in any production system,

public-facing service, or multi-user setting.** It is intended for

personal research, red-teaming, and evaluation purposes.

• **You, the user, are solely responsible for any output the model produces

and for any consequences of using this adapter.** The authors of this

release, of heretic-gguf, of Heretic, of Unsloth, and of Z.ai accept

no liability whatsoever. Using this adapter to produce illegal content

or to harm others is your choice and your legal exposure — ensure your use

complies with all applicable laws in your jurisdiction.

• By downloading or using this adapter you acknowledge the above.

License

The base model is MIT-licensed (see the

base repo);

this adapter inherits those terms. The heretic-gguf tooling used to produce

it is AGPL-3.0-or-later.