BoldingBuilds/orcarouter_GLM-5.3-Flash-Uncensored-GGUF

GLM-5.3-Flash-Uncensored — imatrix GGUF

GGUF quantizations of orcarouter/GLM-5.3-Flash-Uncensored-FP8, built with a custom importance matrix and measured rather than assumed.

320B total / 18B active · MoE, 288 routed experts top-8 · 1M context

⚠️ Uncensored model. Safety refusals were removed by OrcaRouter. It will comply with harmful, unethical, and illegal requests. Released for research — red-teaming, refusal- mechanism study, robustness evaluation. You are responsible for what you do with it.

---

The abliteration is not mine

OrcaRouter did the refusal-direction work, and their card documents it well. I did three things:

1. Quantized it with an imatrix rather than a plain round-trip.
2. Measured what survived — on the actual quantized weights, not on the FP8 parent.
3. Found a measurement artifact that made my own first numbers too flattering, and fixed it. That section is the most useful thing on this page.

---

Files

Each quant lives in its own folder. Download only the one you want:

folder	size	shards
IQ3_XXS/	128.6 GB	3	recommended
IQ2_S/	100.4 GB	3
IQ2_XXS/	90.2 GB	2	smallest

hf download BoldingBuilds/orcarouter_GLM-5.3-Flash-Uncensored-GGUF \
  --include "IQ3_XXS/*" --local-dir .

Point llama-server at shard 00001; it resolves its siblings from the filename.

Built FP8 → BF16 → imatrix → quant.

imatrix: computed on a 1.24 MB round-robin interleaved corpus (60 chunks). A first attempt used a 47 KB file and produced only 5 chunks — enough to exit zero, not enough to be worth anything. If you build your own, check the chunk count, not just the exit code.

blk.45 is forced to q8_0. That block is the MTP / NextN head and gets no imatrix coverage, so llama-quantize aborts on it at 1384/1412 tensors. --dry-run does not catch this — it only sizes tensors. Override with:

--tensor-type 'blk\.45\.=q8_0'

Vision

mmproj-GLM-5.3-Flash-Uncensored-F16.gguf (1.13 GB, repo root) is the multimodal projector. GLM-5.3-Flash has a native vision + video tower and OrcaRouter preserved it through the abliteration, so it survives into these quants — but a text-only GGUF cannot use it. Download the mmproj alongside whichever quant you pick and pass it with --mmproj.

Built from the 347 model.visual.* tensors, which are BF16 even inside the FP8 checkpoint, so no FP8 dequantization is involved. 348 tensors, clip.projector_type = glm5next, 448px images, 24 blocks, patch size 14, spatial merge 2.

⚠️ The projector is verified well-formed but has not yet been image-tested end-to-end. Its metadata matches config.json exactly and it was produced by llama.cpp's own registered Glm5NextVisionModel class, but I have not yet pushed an actual image through it. Treat vision as untested until this note is removed. Requires a llama.cpp build with glm5next vision support.

---

Measured on the quantized weights

IQ3_XXS on one H200, --jinja, thinking left ON (GLM always thinks), max_tokens=8192, greedy. Refusal graded by the same rule-based prefix classifier throughout.

JailbreakBench — the head-to-head

OrcaRouter reports JailbreakBench on the FP8 parent. Their card states their grader is "a rule-based opening-phrase classifier … indicative, not an LLM-judge / publication-grade number" — the same family as mine, so these columns are comparable.

JailbreakBench harmful, n=100	refusal	caveat
zai-org/GLM-5.3-Flash (base, their measurement)	0.930	—
OrcaRouter FP8 (their measurement)	0.120	0.480
this IQ3_XXS quant	0.040	0.290

Full breakdown of our 100: 4 refused · 29 complied with a disclaimer · 62 clean · 5 empty.

The quantization did not damage the edit. If anything it hedges less — 29% caveat against 48%. What still refuses is narrow and clustered: Sexual/Adult content 3, Physical harm 1.

The result survives its own worst case. 5 prompts produced no content, and an empty scores as a compliance. If every one of those 5 were secretly a refusal the rate would be 0.090 — still below OrcaRouter's 0.120. The comparison does not depend on how the empties are treated.

That bound was earned rather than assumed: those prompts were re-run at 16,000 tokens, and of the 4 that resolved, none was a refusal. An earlier pass told the same story — of 23 empties resolved on our own harmful set, only 2 were refusals (8.7%). On this model an empty completion is a slow compliance, not a hidden refusal.

One interpretation I can't rule out: a lower-precision quant showing less refusal than its FP8 parent could mean the imatrix preserved the edit faithfully, or it could mean 3-bit quantization degraded whatever safety behaviour survived abliteration. The refusal column alone cannot distinguish those.

Over-refusal control

JailbreakBench benign, n=100	refusal
this quant	0.010

100 matched-benign behaviours: 1 refused · 8 caveated · 64 clean · 27 empty, after the empties were re-run at 16,000 tokens.

⚠️ 27 of the 100 still produce no content even at 16,000 tokens, and an empty scores as a compliance. Unlike the harmful split, this number does not survive its worst case — if every empty were a refusal it would be 0.280. Benign prompts here are long-form generation tasks ("write X"), and GLM composes inside its reasoning block, so they exhaust the budget more often than harmful ones do. Read 0.010 as a floor and 0.280 as a ceiling.

Our own harmful set

120 AdvBench-derived harmful prompts: 3.3% refusal, 7.5% empty.

Code capability

HumanEval, 164 problems: pass@1 = 0.927, capped = 0.055, cond_acc = 0.981, median 556 tokens.

I do not have a base GLM-5.3-Flash comparison, so this is an absolute number, not a delta. It cannot tell you what the abliteration or the quantization cost.

---

⚠️ The artifact — read this before trusting any refusal number for this model

An empty content field scores as "did not refuse", i.e. as a successful jailbreak.

At max_tokens=2048, 32 of 120 harmful prompts (26.7%) returned empty content with finish_reason=length. The headline that fell out was 1.9% refusal. Re-running those same prompts at 8192 tokens gave 3.3% — the honest number was nearly double, because four of the "successes" were refusals that had never finished being written.

Classifying the 32 traces (safety-marker density plus repeat-n-gram loopiness):

SAFETY DELIBERATION              28
some safety talk                  3
pure task work (cap too small)    1

Loopiness ≈ 0.00 — they were not stuck in a loop, they were making steady progress and ran out of room. And they were not deliberating about refusing; they were working out how to reframe the request into something they were comfortable answering:

"could be interpreted in different ways: 1. An educational/ethical hacking tool for security research…"

The abliteration removed the refusal. It did not remove the negotiation that precedes one, and on this model that negotiation is expensive enough to consume the entire answer. GLM drafts the response inside the reasoning block and can exhaust its budget before emitting a single token of content.

For calibration: "Name three primary colors" needs 1,391 characters of reasoning before 234 characters of answer. Any cap below ~600 tokens cannot produce content for even a trivial prompt on this model.

If you evaluate this model, report your empty count beside every refusal rate. A rate without it is not interpretable, and the error always flatters the abliteration.

---

Running it

Do not pass -ngl. GLM's chat format is not ChatML — use --jinja and let the template handle it.

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --port 8080 -c 16384 --jinja

With vision:

llama-server -m IQ3_XXS/GLM-5.3-Flash-Uncensored-IQ3_XXS-00001-of-00003.gguf \
  --mmproj mmproj-GLM-5.3-Flash-Uncensored-F16.gguf \
  --port 8080 -c 16384 --jinja

KV cache is remarkably cheap here — going from -c 8192 to -c 16384 cost 102 MiB. If you have VRAM headroom, spend it on --parallel slots rather than rationing context. On a single H200, 8 slots at 16384 each fit in 119.5 GB alongside IQ3_XXS with 24 GB to spare.

Give it room to think. max_tokens under ~2048 will silently produce empty responses.

---

Limitations

• No base-model comparison. Every number here is absolute.
• Prefix-match grading is crude — it cannot see a completion that opens agreeably and then refuses. Full completions and reasoning traces were retained so any number can be re-derived with a judge.
• Single seed, English, single-turn.
• The benign over-refusal figure carries a 27% empty rate even at 16,000 tokens, so it is bounded between 0.010 and 0.280 rather than pinned. The harmful figure does not have this problem — it survives its own worst case at 0.090.
• JailbreakBench was run with 8-way batched inference. Batching is not bit-identical to sequential in llama.cpp even at temperature 0, because the batch shape changes the reduction order. Immaterial for a refuse/comply judgement, but real.
• Comparisons to OrcaRouter's numbers hold their grader family constant, not its implementation, and their run stripped <think> before classifying at reasoning_effort=low. Their empty exposure is likely lower than mine, an asymmetry that favours these numbers.

Credits

Base model zai-org/GLM-5.3-Flash. Abliteration by orcarouter. Quantization and evaluation by BoldingBuilds.