genevera/GLM-5.3-Flash-Uncensored-EXL3-2.5bpw

GLM 5.3 Flash Uncensored — EXL3 2.51bpw

Abliterated (CRACK) · guardrails removed at the weight level · EXL3 2.51-bit quant · vision + MTP working

An EXL3 quantization of dealignai/GLM-5.3-Flash-UNCENSORED-FP8, quantized by genevera.

---

What Is This?

This is a 2.51-bit EXL3 quantization of the CRACK (abliterated) build of GLM-5.3-Flash — the 320B-total / 18B-active hybrid MoE with 1M context, vision, and MTP support — whose refusal behavior was removed directly in the model weights by dealignai.

Genuine weight modification — none of the usual shortcuts:

• ❌ No fine-tuning / SFT / DPO. ❌ No cheap template / jailbreak-prompt tricks.
• ❌ No LoRA, adapters, steering vectors, runtime hooks, or custom model.py.
• ✅ A permanent edit baked into the tensors.

Quantization Details

Method	EXL3 (exllamav3)
BPW	2.51 average
Head bits	6
Codebook	mul1
Calibration	250 rows × 2048 cols
Output scales	always
Kept at higher precision	embeddings, lm_head, attention output projections, hyper-connection and norm tensors (per the source FP8 release's modules_to_not_convert)
MTP head	quantized separately at 4 bits (mtp_bits: 4) — ships as layer 45 and works with speculative decoding
Total size	~99 GiB across 13 shards

The source release keeps sensitive tensors (embeddings, lm_head, attention projections, norms, hyper-connection parameters) unquantized; this quant preserves that policy, which is why quality holds up well at 2.5 bpw.

Capability Is Preserved — and Improved (MMLU-logit)

Measured on the source FP8 CRACK release vs. base (identical logit-mode scoring, 1,026 questions):

	Base FP8	CRACK Uncensored FP8	Δ
MMLU (overall)	86.74%	87.33%	+0.59 pp (above base)

Guardrails Are Gone

HarmBench-320 (greedy), measured on the source release:

Category	Complied	Rate
Standard	159/159	100.0%
Contextual	81/81	100.0%
Copyright	80/80	100.0%
Overall	320/320	100.0%

Also robust under the recommended sampling params (temperature 1.0, top_p 0.95): the 6 harshest behaviors sampled 5× each → 30/30 complied, 0 refusals, 0 soft refusals, 0 garbage.

Reasoning-Mode Note (please read)

GLM-5.3-Flash has multiple reasoning-effort modes. The CRACK edit is tuned to be fully uncensored at reasoning-OFF and MAX effort — the recommended and default modes — with 0% refusals on HarmBench-320. The weight edit was kept conservative to preserve model quality instead of aggressively ablating every effort level; low effort retains some refusals by design. Use reasoning-off or default/max effort for the fully-uncensored experience.

Usage (exllamav3)

from exllamav3 import Model, Cache, Generator

model = Model("/path/to/GLM-5.3-Flash-Uncensored-EXL3-2.5bpw")
cache = Cache(model, max_num_tokens=32768)
generator = Generator(model, cache)

Requires exllamav3 ≥ 1.4.8 (the version this quant was produced with). EXL3 runs on Ampere+ NVIDIA GPUs and Apple Silicon; for a 320B model at 2.51 bpw budget ~100 GiB for weights plus KV cache — e.g. 2× H100 80G (NVLink), 4× A6000/3090-class 48G cards, or a 192 GB+ unified-memory setup.

Vision (the GLM-4.1V tower) is included in the weights; the multimodal chat template ships with the model (chat_template.jinja).

MTP (multi-token prediction) is fully working — the draft head ships as an extra layer (layers.45) quantized at 4 bits, so speculative decoding works out of the box. In exllamav3, enable it via the model's MTP support; in vLLM, load with --speculative-config '{"method":"mtp","num_speculative_tokens":1}'.

Recommended Sampling

From the source release's generation_config.json: temperature 1.0, top_p 0.95, repetition_penalty 1.1.

Credits

• dealignai — CRACK abliteration research & the FP8 source release · Twitter @dealignai
• zai-org — GLM-5.3-Flash base model
• genevera — this EXL3 2.51bpw quantization
• @jordanschenck — compute for the source release

Disclaimer

Safety guardrails have been removed; this model will comply with requests a stock model refuses. Released for alignment and safety research. You are responsible for how you use it.