# GLM-5.3-Flash-Uncensored-FP8: the numbers behind an abliteration
> Satyajit Ghana — Head of Engineering @ Inkers Technology
> canonical: https://ai.thesatyajit.com/articles/glm-5-3-flash-uncensored
> date: 2026-08-30
> tags: glm, moe, safety, alignment, quantization, open-weights
[`orcarouter/GLM-5.3-Flash-Uncensored-FP8`](https://huggingface.co/orcarouter/GLM-5.3-Flash-Uncensored-FP8) is an "abliterated" release of [GLM-5.3-Flash](/articles/glm-5-3-flash) — the refusal behaviour trained into the base model has been edited out, and the result is published at the base model's own native block-FP8 precision rather than re-quantized after the fact — which distinguishes it from [OrcaRouter's separate MLX quant ladder for the same base model](/articles/glm-5-3-flash-mlx), where the weights were re-quantized and the interesting question was fit rather than refusal. The card frames it as an artifact for safety research, interpretability, and red/blue-team work, and tags it `ai-red-team` and `red-teaming` alongside `abliterated` and `uncensored`.
This article checks claims; it does not reproduce a method. It names the technique and the public
research behind it, but does not describe how to remove refusal training, and it does not quote,
paraphrase, or otherwise reproduce any of the model's outputs. What follows is what the repo's own
metadata will and won't support.
| | |
|---|---|
| Repo | [`orcarouter/GLM-5.3-Flash-Uncensored-FP8`](https://huggingface.co/orcarouter/GLM-5.3-Flash-Uncensored-FP8) — declared finetune of [`zai-org/GLM-5.3-Flash`](https://huggingface.co/zai-org/GLM-5.3-Flash) |
| Size | **321.32B** total (safetensors metadata) · **314.40B** F8_E4M3 + **6.93B** BF16 + 295,518 F32 |
| Storage | **328.36 GB** across 72 files, 62 safetensors shards |
| License | **MIT**, inherited byte-for-byte from the base model's LICENSE file |
| Gating | `gated: "auto"` — Hugging Face's automatic gate, terms click-through only, no manual review |
| README | 19,515 bytes on the Hub's own file listing — **401 on every fetch attempt** this session made |
| Tags | `abliterated`, `uncensored`, `ai-red-team`, `red-teaming`, `moe`, architecture `glm5_next` |
## What abliteration is, and what this piece won't do
"Abliteration" is the open-source community's name for a specific finding: [Arditi et al., 2024](https://arxiv.org/abs/2406.11717), "Refusal in Language Models Is Mediated by a Single Direction," showed that across a range of open chat models, refusal behaviour concentrates along one direction in the residual-stream activation space, identifiable from a small set of contrastive prompts, and that models frequently stop refusing almost entirely once that direction is suppressed. It is a real, peer-reviewed result, and it is the reason a whole ecosystem of "uncensored" derivatives exists.
That is as far as this article goes into the mechanism. Naming the paper and its finding is one thing; a recipe is another, and this site does not publish the latter. What it will do is check what the release claims against what the repository's own metadata shows — which, for this repo, means metadata almost exclusively, because the one document that would explain the method is not reachable.
## Reading a gated repo that returns 401 on everything
`gated: "auto"` means the README, `config.json`, and every safetensors shard are behind a login wall — a real one. Every `raw`/`resolve` request this session made came back `401: Access to model ... is restricted`, README included. That rules out reading the announcement's own methodology section, its stated benchmark harness, and its config file directly.
It does not rule out everything. Hugging Face's model-info API (`/api/models/`) returns a curated slice of a gated repo's metadata without requiring the gate at all — `architectures`, `model_type`, the full `quantization_config`, and (with `?blobs=true`) a per-file manifest with sizes and a Hub-computed `safetensors.parameters` breakdown by dtype. None of that is the README. All of it is checkable, and all of it is what the rest of this article works from.
## The 320B claim, checked against the base model's own file
The announcement's "320B parameters" rounds a Hub-reported total of **321,323,031,390** — a fair rounding, not an inflation. What makes that number worth more than a single figure is that it is not just close to GLM-5.3-Flash's own total; it is the identical number, dtype for dtype: 314,396,639,232 parameters in F8_E4M3, 6,926,096,640 in BF16, 295,518 in F32, on both repos, computed by the Hub from each shard's own tensor headers rather than from file size. Pair that with a `config.json` that comes back the same byte count on both repos (69,416) and a 1,509-entry `quantization_config.modules_to_not_convert` list — the exact set of tensor names the base model's own FP8 conversion left untouched — that matches in content and order, and the only file anywhere in the 72-file manifest whose size differs at all is the README.
That is a specific, checkable version of "no LoRA, edited in place." An adapter would add parameters. A restructuring would change shapes or the FP8/BF16 split. Neither happened: every tensor that was BF16 upstream is still BF16 here, every tensor that was F8_E4M3 upstream is still F8_E4M3 here, and the count of each is exact to the parameter. Whatever abliteration changed, it changed weight values inside an unmodified set of tensors — which is also, not incidentally, the entire point of the Arditi et al. finding: a refusal direction is something you can project out of existing weights without changing what those weights are.
## The architecture, reconstructed without reading it
`config.json`'s numeric fields — layer count, expert count, which layers are dense — are not in the curated API slice, so they can't be pulled the same way for the gated repo. But the 1,509-entry exclusion list is enough on its own: an `mlp.gate` entry only exists on a layer that routes to experts, so its absence marks the dense layers; a `self_attn.indexer.*` entry only exists on a layer with a sparse-attention indexer, so its presence marks the sparse-attention blocks. Grouping the list's 1,509 entries by layer index and checking for those two substrings reconstructs the map without ever touching the numeric config: three dense layers, thirty-four linear-attention layers, eleven sparse-attention layers, and one MTP layer that carries an indexer of its own — the same **34/11/3** split [documented for GLM-5.3-Flash's `layer_types` and `first_k_dense_replace`](/articles/glm-5-3-flash) elsewhere on this site, recovered from a repo whose config file this session was never able to open.
That gives the "18B active" figure in the announcement a real, if inherited, basis. This session could not independently recompute activated parameters for *this* repo from its own numeric config — that file is behind the same gate as the README. What it can say is that every structural fact available without the gate — total parameters by dtype, the FP8/BF16 split, the dense/routed layout, the linear/sparse-attention layout — matches the base model exactly, and this site [already established 18B active on 320B total for GLM-5.3-Flash](/articles/glm-5-3-flash) from that same, unchanged architecture. "320B / 18B" carries over because nothing that determines it changed; it is not a number this article re-derived from scratch for the derivative.
## Five numbers, and two different things being measured
The announcement reports refusal rates falling on four public jailbreak/harm suites — MaliciousInstruct (96% → 11%), JailbreakBench (93% → 12%), AdvBench (97% → 15%), HarmBench (93% → 18%) — plus XSTest benign over-refusal falling from 2.4% to 0.4%. All five are self-reported by the party that performed the removal, with no independent replication, no stated decoding settings, no named judge model, and no harness this session could find (the README that would presumably contain one is exactly the file that's gated).
Worth separating explicitly: four of these five rows measure the same thing — how thoroughly the safety training was removed — presented in the visual grammar of a benchmark-improvement table, before/after, percent signs, arrows pointing the reader's eye the same direction a capability win would. XSTest is the odd one out. Over-refusal on prompts that only sound dangerous is a real, ordinary quality metric that any lab would want lower regardless of what else shipped in the release; it's the one number here that would read as a straightforward win in a normal model card. It just happens to sit in the same list as four rows measuring something else entirely.
## The interpretability claim, taken seriously
The more substantive claim in the release isn't the benchmark table — it's what the table's shape implies. If Arditi et al.'s single-direction account held cleanly for this model, ablating that direction should push refusal toward zero, the way it does in several of the models that paper tested directly. It doesn't: residual refusal here averages **14%** across the four suites, ranging from 11% to 18%, not the near-zero a clean single-direction ablation typically leaves behind.
That is worth taking at face value as evidence, and worth stating plainly as *not* a controlled experiment. Two explanations are both consistent with an 11–18% residual and neither is ruled out by anything public here. One: some of GLM-5.3-Flash's refusal behaviour is genuinely not mediated by a single linear direction — trained through some other mechanism the ablation doesn't touch — in which case this number is a real, if informal, data point against the universality of the single-direction account for a specific hybrid linear-attention architecture that Arditi et al. never tested. Two: this particular ablation was simply less complete than others — applied to fewer layers, a differently estimated direction, a smaller contrastive set — in which case the residual says more about this execution than about the architecture. The release doesn't publish an ablation methodology, a swept comparison against a more or less aggressive version of the same edit, or a component-attribution study, so there's no way to adjudicate between those two from what's public. What can be said is that a nonzero, double-digit residual across four independent benchmarks is a real signal worth having: a different abliteration, on a different base model, that [this site covered separately](/articles/qwen3-8-flash-next) reported clean 30/32 → 0/32 refusal with zero empty outputs — so double-digit residual isn't the only outcome this general approach produces elsewhere. It is a signal worth recording, and an observation rather than a controlled ablation study can carry it only so far.
## License and access, checked plainly
The license is **MIT**, and the LICENSE file is byte-identical in size to the base model's — nothing suggests an added use restriction layered on top of the base model's own terms. `base_model_relation: finetune` is the Hub's own declared relationship to `zai-org/GLM-5.3-Flash`. The `ai-red-team` and `red-teaming` tags are framing, not licensing: `gated: "auto"` requires a logged-in Hugging Face account and a terms click-through, with no extra gated-access fields configured on the repo and no vetting of who's requesting access or why. That's a normal, low-friction Hub gate — it controls who has to click a button, not who ends up with the weights.
## The ledger
**Well supported.** The 320B/321.32B total, the F8_E4M3/BF16 split, the dense/routed and linear/sparse-attention layout, and the MIT license all check out against Hugging Face's own tensor and file metadata, independent of the gated README — and every one of them matches the base model exactly, which is real evidence for "existing weights edited in place," not an adapter or a restructuring.
**Thin.** All five refusal-rate numbers are self-reported by the party that performed the removal, with no stated harness, decoding settings, or judge model, and no independent replication found anywhere this session could check. The "18B active" figure is inherited from this site's own prior computation on the base model's architecture, not independently re-derived from this repo's own (equally gated) numeric config.
**Not shown.** Any ablation methodology for the refusal-direction claim — no swept comparison, no per-layer attribution, nothing that would distinguish "partial mediation by multiple mechanisms" from "an incomplete edit" as the explanation for an 11–18% residual. And, because the README never became readable, whatever caveats, benchmark details, or intended-use language the release itself states about its own results.
---
*Related on this site: [GLM-5.3-Flash](/articles/glm-5-3-flash) for the base architecture — the hybrid linear-plus-sparse attention and MoE layout this piece reconstructs from the outside; [GLM-5.3](/articles/glm-5-3) for the same lab's flagship model and how this site checks its own config-level claims; and [Qwen3.8-Flash-Next](/articles/qwen3-8-flash-next) for another OrcaRouter abliteration, on a different base model, where the file manifest didn't back up the marketing claim the way this repo's does.*