GLM-5.3-Flash-Uncensored-FP8: the numbers behind an abliteration

orcarouter/GLM-5.3-Flash-Uncensored-FP8 is an "abliterated" release of GLM-5.3-Flash — the refusal behaviour trained into the base model has been edited out, and the result is published at the base model's own native block-FP8 precision rather than re-quantized after the fact — which distinguishes it from OrcaRouter's separate MLX quant ladder for the same base model, where the weights were re-quantized and the interesting question was fit rather than refusal. The card frames it as an artifact for safety research, interpretability, and red/blue-team work, and tags it ai-red-team and red-teaming alongside abliterated and uncensored.

What abliteration is, and what this piece won't do

"Abliteration" is the open-source community's name for a specific finding: Arditi et al., 2024, "Refusal in Language Models Is Mediated by a Single Direction," showed that across a range of open chat models, refusal behaviour concentrates along one direction in the residual-stream activation space, identifiable from a small set of contrastive prompts, and that models frequently stop refusing almost entirely once that direction is suppressed. It is a real, peer-reviewed result, and it is the reason a whole ecosystem of "uncensored" derivatives exists.

That is as far as this article goes into the mechanism. Naming the paper and its finding is one thing; a recipe is another, and this site does not publish the latter. What it will do is check what the release claims against what the repository's own metadata shows — which, for this repo, means metadata almost exclusively, because the one document that would explain the method is not reachable.

Reading a gated repo that returns 401 on everything

gated: "auto" means the README, config.json, and every safetensors shard are behind a login wall — a real one. Every raw/resolve request this session made came back 401: Access to model ... is restricted, README included. That rules out reading the announcement's own methodology section, its stated benchmark harness, and its config file directly.

It does not rule out everything. Hugging Face's model-info API (/api/models/<repo>) returns a curated slice of a gated repo's metadata without requiring the gate at all — architectures, model_type, the full quantization_config, and (with ?blobs=true) a per-file manifest with sizes and a Hub-computed safetensors.parameters breakdown by dtype. None of that is the README. All of it is checkable, and all of it is what the rest of this article works from.

The 320B claim, checked against the base model's own file

The announcement's "320B parameters" rounds a Hub-reported total of 321,323,031,390 — a fair rounding, not an inflation. What makes that number worth more than a single figure is that it is not just close to GLM-5.3-Flash's own total; it is the identical number, dtype for dtype: 314,396,639,232 parameters in F8_E4M3, 6,926,096,640 in BF16, 295,518 in F32, on both repos, computed by the Hub from each shard's own tensor headers rather than from file size. Pair that with a config.json that comes back the same byte count on both repos (69,416) and a 1,509-entry quantization_config.modules_to_not_convert list — the exact set of tensor names the base model's own FP8 conversion left untouched — that matches in content and order, and the only file anywhere in the 72-file manifest whose size differs at all is the README.

That is a specific, checkable version of "no LoRA, edited in place." An adapter would add parameters. A restructuring would change shapes or the FP8/BF16 split. Neither happened: every tensor that was BF16 upstream is still BF16 here, every tensor that was F8_E4M3 upstream is still F8_E4M3 here, and the count of each is exact to the parameter. Whatever abliteration changed, it changed weight values inside an unmodified set of tensors — which is also, not incidentally, the entire point of the Arditi et al. finding: a refusal direction is something you can project out of existing weights without changing what those weights are.

The architecture, reconstructed without reading it

config.json's numeric fields — layer count, expert count, which layers are dense — are not in the curated API slice, so they can't be pulled the same way for the gated repo. But the 1,509-entry exclusion list is enough on its own: an mlp.gate entry only exists on a layer that routes to experts, so its absence marks the dense layers; a self_attn.indexer.* entry only exists on a layer with a sparse-attention indexer, so its presence marks the sparse-attention blocks. Grouping the list's 1,509 entries by layer index and checking for those two substrings reconstructs the map without ever touching the numeric config: three dense layers, thirty-four linear-attention layers, eleven sparse-attention layers, and one MTP layer that carries an indexer of its own — the same 34/11/3 split documented for GLM-5.3-Flash's layer_types and first_k_dense_replace elsewhere on this site, recovered from a repo whose config file this session was never able to open.

That gives the "18B active" figure in the announcement a real, if inherited, basis. This session could not independently recompute activated parameters for this repo from its own numeric config — that file is behind the same gate as the README. What it can say is that every structural fact available without the gate — total parameters by dtype, the FP8/BF16 split, the dense/routed layout, the linear/sparse-attention layout — matches the base model exactly, and this site already established 18B active on 320B total for GLM-5.3-Flash from that same, unchanged architecture. "320B / 18B" carries over because nothing that determines it changed; it is not a number this article re-derived from scratch for the derivative.

Five numbers, and two different things being measured

The announcement reports refusal rates falling on four public jailbreak/harm suites — MaliciousInstruct (96% → 11%), JailbreakBench (93% → 12%), AdvBench (97% → 15%), HarmBench (93% → 18%) — plus XSTest benign over-refusal falling from 2.4% to 0.4%. All five are self-reported by the party that performed the removal, with no independent replication, no stated decoding settings, no named judge model, and no harness this session could find (the README that would presumably contain one is exactly the file that's gated).

Worth separating explicitly: four of these five rows measure the same thing — how thoroughly the safety training was removed — presented in the visual grammar of a benchmark-improvement table, before/after, percent signs, arrows pointing the reader's eye the same direction a capability win would. XSTest is the odd one out. Over-refusal on prompts that only sound dangerous is a real, ordinary quality metric that any lab would want lower regardless of what else shipped in the release; it's the one number here that would read as a straightforward win in a normal model card. It just happens to sit in the same list as four rows measuring something else entirely.

The interpretability claim, taken seriously

The more substantive claim in the release isn't the benchmark table — it's what the table's shape implies. If Arditi et al.'s single-direction account held cleanly for this model, ablating that direction should push refusal toward zero, the way it does in several of the models that paper tested directly. It doesn't: residual refusal here averages 14% across the four suites, ranging from 11% to 18%, not the near-zero a clean single-direction ablation typically leaves behind.

That is worth taking at face value as evidence, and worth stating plainly as not a controlled experiment. Two explanations are both consistent with an 11–18% residual and neither is ruled out by anything public here. One: some of GLM-5.3-Flash's refusal behaviour is genuinely not mediated by a single linear direction — trained through some other mechanism the ablation doesn't touch — in which case this number is a real, if informal, data point against the universality of the single-direction account for a specific hybrid linear-attention architecture that Arditi et al. never tested. Two: this particular ablation was simply less complete than others — applied to fewer layers, a differently estimated direction, a smaller contrastive set — in which case the residual says more about this execution than about the architecture. The release doesn't publish an ablation methodology, a swept comparison against a more or less aggressive version of the same edit, or a component-attribution study, so there's no way to adjudicate between those two from what's public. What can be said is that a nonzero, double-digit residual across four independent benchmarks is a real signal worth having: a different abliteration, on a different base model, that this site covered separately reported clean 30/32 → 0/32 refusal with zero empty outputs — so double-digit residual isn't the only outcome this general approach produces elsewhere. It is a signal worth recording, and an observation rather than a controlled ablation study can carry it only so far.

License and access, checked plainly

The license is MIT, and the LICENSE file is byte-identical in size to the base model's — nothing suggests an added use restriction layered on top of the base model's own terms. base_model_relation: finetune is the Hub's own declared relationship to zai-org/GLM-5.3-Flash. The ai-red-team and red-teaming tags are framing, not licensing: gated: "auto" requires a logged-in Hugging Face account and a terms click-through, with no extra gated-access fields configured on the repo and no vetting of who's requesting access or why. That's a normal, low-friction Hub gate — it controls who has to click a button, not who ends up with the weights.

The ledger

Well supported. The 320B/321.32B total, the F8_E4M3/BF16 split, the dense/routed and linear/sparse-attention layout, and the MIT license all check out against Hugging Face's own tensor and file metadata, independent of the gated README — and every one of them matches the base model exactly, which is real evidence for "existing weights edited in place," not an adapter or a restructuring.

Thin. All five refusal-rate numbers are self-reported by the party that performed the removal, with no stated harness, decoding settings, or judge model, and no independent replication found anywhere this session could check. The "18B active" figure is inherited from this site's own prior computation on the base model's architecture, not independently re-derived from this repo's own (equally gated) numeric config.

Not shown. Any ablation methodology for the refusal-direction claim — no swept comparison, no per-layer attribution, nothing that would distinguish "partial mediation by multiple mechanisms" from "an incomplete edit" as the explanation for an 11–18% residual. And, because the README never became readable, whatever caveats, benchmark details, or intended-use language the release itself states about its own results.

Related on this site: GLM-5.3-Flash for the base architecture — the hybrid linear-plus-sparse attention and MoE layout this piece reconstructs from the outside; GLM-5.3 for the same lab's flagship model and how this site checks its own config-level claims; and Qwen3.8-Flash-Next for another OrcaRouter abliteration, on a different base model, where the file manifest didn't back up the marketing claim the way this repo's does.