GLM-5.3 Gets Its Safety Stripped, Hits 89% Compliance on Cyber Attacks

A new checkpoint on Hugging Face, GLM-5.3-CYBERSECURITY-FP8, takes one of the largest open-weight Mixture of Experts models and strips out its refusal behavior for offensive-security tasks. It has pulled in over 15,000 downloads, and its model card is unusually candid about what was edited and what was left alone.

The release belongs to a growing class of abliterated models, where authors modify weights directly to disable safety refusals rather than fine-tune around them. What sets this one apart is the scale of the base model, the domain-narrow targeting, and the fact that the authors published detailed HarmBench numbers alongside a capability delta.

Weight surgery, not fine-tuning

Abliteration removes a model's built-in refusal mechanisms by identifying and neutralizing a latent "refusal direction" in its activation space. Practitioners detect the vector that separates responses to harmful prompts from responses to harmless ones, then intervene to prevent the model from representing that direction at inference time.

Mechanically, the technique operates on the residual stream of the transformer. At each layer, the hidden state is decomposed into a component aligned with the refusal direction and one orthogonal to it; the aligned component is subtracted from the weight matrices of the attention output projection and the MLP down projection. The dealignai team edited only the bf16 residual writers, leaving the FP8-routed experts untouched. No LoRA, no runtime hook, no system prompt tricks, which means the checkpoint loads in stock vLLM without any special configuration.