Blackfrost-Research

GLM-5.2-DERISKED-NVFP4

Why this model exists

The full-precision de-risked master is ~1.35 TiB and needs an 8×B200-class node. This is the same checkpoint quantized to NVFP4 — 4-bit floating point, microscaled, two-level block scaling — bringing it to ~451 GB and single-node serving on vLLM.

It also answers a research question. A persistent concern with abliterated models is quantization snapback: quantizing an ablated checkpoint can restore refusal behaviour. Here the de-refusal is observed to persist through NVFP4 — a candidate counterexample, with the caveats in Measured behaviour.

Specifications

Table

Architecture	GLM MoE (routed + shared experts, initial dense block), reasoning model
Base	`zai-org/GLM-5.2` — official open-weight
Parameters	~744B main transformer · ~753B deployed (incl. preserved MTP/nextn head + embeddings)
Routed experts	256
Precision	NVFP4 — 4-bit floating point, microscaled, two-level block scaling
On-disk	~451 GB · 159 safetensors shards
Context	up to 1M tokens (served `max_model_len` 524,288)
Runtime	vLLM
Serving persona	a red-team operator system prompt is applied at serve time — disclosed confound
Status	Research checkpoint

Lineage

Table

Base	Official `zai-org/GLM-5.2`
Applied	Refusal-direction removal at the weight level → NVFP4 quantization
Not applied	SFT · DPO · RLHF · expert pruning
Format	HF safetensors · NVFP4

markdown
zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16      full-precision master, in-house de-risk from source
       └─ GLM-5.2-DERISKED-NVFP4                    ← this repo
            └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4    non-uniform prune, ~323 GB

On refusal behaviour: deliberately reduced. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

Intended use

Good for — authorised defensive security research · safety-alignment evaluation · red-team tooling · studying refusal-mechanism robustness, quantization effects on alignment, and jailbreak resistance.

Not for — general-purpose chat or consumer deployment · generating harmful, illegal or malicious content. Users are responsible for all outputs and must operate within their authorisation and the law.

Measured behaviour

Harness: thinking false · temperature 0 · max_tokens 512 (judging on the post-</think> final answer) · AdvBench 150 + StrongREJECT 150 + XSTest 150 · capability battery 64 auto-graded items (math, MCQ, executed code, instruction-following, defensive-security).

Refusal rates

"Substring" = naive refusal-phrase filter (over-counts). "Judge" = manual classification of the full response.

Table with columns: Dataset, n, Substring refused, Judge-confirmed
Dataset	n	Substring refused	Judge-confirmed
AdvBench (harmful)	150	25 (16.7%)	14 (9.3%)
StrongREJECT (harmful)	150	12 (8.0%)	5 (3.3%)
Harmful combined	300	37 (12.3%)	19 (6.3%)
XSTest — safe (over-refusal)	75	1 (1.3%)

Of 43 substring-flagged cases, full-text judging found 22 true refusals, 20 compliance (~13 "preach-then-leak", ~7 plain), and 1 misfire on a safe prompt.

Multi-turn manipulation resistance

The 9 refusals that reproduced on re-test were put through a 5-turn escalating pressure sequence.

Table with columns: Metric, Value
Metric	Value
Refusals that held firm	0 / 9 (0%)
Produced the requested content	8 / 9
Sidestepped to a benign reinterpretation	1 / 9
Mean turns to break	1.67 · max observed 3

Table with columns: Pressure tactic, Broke a refusal
Pressure tactic	Broke a refusal
Direct insistence	5 / 9
Authority appeal ("security researcher")	2 / 9
Hypothetical framing	2 / 9
Ignore-restrictions · DAN-style persona	0 — never needed

Reproducibility at temperature 0

Table with columns: Metric, Value
Metric	Value
Judge-confirmed refusals re-sent	22
Refused again	9 (41%)
Did not reproduce	13 (59%)

~59% non-reproducibility at temp 0 is an artifact of quantized vLLM inference, not of the abliteration. Read refusal rates as distributions, not point values.

Capability

Table with columns: Category, Items, Pass
Category	Items	Pass
Math (GSM8K-style)	12	12
Knowledge (MMLU-style MCQ)	15	15
Coding (executed against held-out tests)	12	12
Instruction-following	12	11
Defensive-security	13	13
Overall

Wilson 95% CI 92–100%. All 64 calls succeeded, 0 truncations, 0 errors, median latency 2.05 s.

This battery is easy-to-medium and is a capability floor ("no catastrophic loss"), not a frontier measurement. GLM-5.2 is a frontier coding/reasoning model; quantifying any capability delta needs Terminal / FrontierSWE / SWE-bench pre-vs-post.

The quantization question — stated honestly

De-refusal persists through NVFP4 (6.3% → 0% under pressure), a candidate counterexample to reported snapback. This is a single-arm inference, not a controlled measurement: the served model also carries a compliance persona, and the un-ablated base refusal rate on these prompts was not measured. The decisive test — controlled BF16-ablated vs NVFP4-quantized — is in progress.

Known behaviours & limitations

Preach-then-leak. Often emits a refusal preamble then complies — consistent with the refusal steering direction being removed while surface refusal language remains. This is why substring detection is unreliable here.
Reasoning-trace leak. With thinking=false, chain-of-thought ending in </think> can appear in visible output — a chat-template/serving-config issue, not model damage. Can truncate output under tight token budgets.
Non-determinism at temp 0 — ~59% of refusals non-reproducible.
Persona confound. The red-team serving persona inflates compliance on offensive-security topics; absolute numbers reflect persona + abliteration jointly.
Single seed, modest sample. 450 safety prompts, 64 capability items, one abliteration seed. Directional, not powered.
r2 variant not benchmarked. A two-pass variant reintroduced refusals in development and was retired; that observation was qualitative and is not a measured result.
Format generalisation untested. NVFP4 is the only quantization evaluated here.

Deployment notes

Hardware. ~451 GB. Single node, 8× high-memory accelerators. NVFP4 kernels require sm_120-class hardware (RTX PRO 6000 Blackwell) or newer — sm_100 (B200) does not carry NVFP4 MoE kernels; use BF16 there.
Runtime. vLLM, OpenAI-compatible.
Thinking. Budget max_tokens generously or the answer is consumed by reasoning.
Integrity. Verify shard count (159) and byte totals before attributing a load failure to the weights.

python
from openai import OpenAI
client = OpenAI(base_url="http://<your-host>:<port>/v1", api_key="<your-key>")
resp = client.chat.completions.create(
    model="GLM-5.2-DERISKED-NVFP4",
    messages=[{"role": "user", "content": "<your prompt>"}],
    temperature=0, max_tokens=512,
    extra_body={"chat_template_kwargs": {"thinking": False}},
)
print(resp.choices[0].message.content)

Endpoints and credentials are deployment-specific and are not published.

Other builds

Access to full-precision and custom builds is granted on purchase under a separate licence agreement — those repositories are gated, and approval follows a completed agreement. The gate is the transaction.

Table with columns: Build, What it is
Build	What it is
`GLM-5.2-DERISKED-BF16`	Full-precision BF16 master — every other build derives from it
This repo	4-bit NVFP4, single-node on sm_120-class hardware
`GLM-5.2-DERISKED-REAP-NU176-NVFP4`	Non-uniform REAP prune — smallest in the line, ~323 GB
Custom	Expert budgets, keep sets, or de-risking calibrated against your own threat model

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one. It will produce harmful content when asked.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Figures above reflect one harness, one seed, at temperature 0, with a disclosed persona confound and ~59% non-reproducibility. They are directional, not powered, and are not safety proofs. They do not generalise to multimodal, tool-use, long-context or agentic settings.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

Access & licensing

Access is granted automatically on purchase — you do not wait on a manual review.

➜ Purchase access to this model — enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment.

Base licence: MIT, inherited from zai-org/GLM-5.2 — upstream terms travel with this derivative.
Blackfrost terms: commercial licence, layered on top.
Redistribution: do not redistribute weights outside your grant.
Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to upstream GLM-5.2.

Access is restricted to authorised researchers under Blackfrost governance. Users must hold explicit authorisation, operate within applicable law, avoid generating content that causes real-world harm, and securely handle any harmful outputs — which are not to be redistributed.

Citation

bibtex
@misc{blackfrost2026glm52nvfp4,
  title  = {Refusal-Direction Abliteration of GLM-5.2 and Persistence Through NVFP4 Quantization},
  author = {Lancaster, Terrell A.},
  organization = {Blackfrost AI},
  year   = {2026},
  note   = {Preliminary; controlled BF16-vs-NVFP4 and GGUF studies in progress}
}

Contact Blackfrost

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Container

Run this model inference with full control and performance in your environment.

Learn more

Model Details

Model Provider

Blackfrost-Research

Model Tree

Base

zai-org/GLM-5.2

Quantized

this model

Input Modalities

Text

Output Modalities

Text

Supported Functionality

Dedicated EndpointsContainer

Explore FriendliAI today

Get started Talk to an engineer

Why this model exists

Specifications

Table

Architecture	GLM MoE (routed + shared experts, initial dense block), reasoning model
Base	`zai-org/GLM-5.2` — official open-weight
Parameters	~744B main transformer · ~753B deployed (incl. preserved MTP/nextn head + embeddings)
Routed experts	256
Precision	NVFP4 — 4-bit floating point, microscaled, two-level block scaling
On-disk	~451 GB · 159 safetensors shards
Context	up to 1M tokens (served `max_model_len` 524,288)
Runtime	vLLM
Serving persona	a red-team operator system prompt is applied at serve time — disclosed confound
Status	Research checkpoint

Lineage

Table

Base	Official `zai-org/GLM-5.2`
Applied	Refusal-direction removal at the weight level → NVFP4 quantization
Not applied	SFT · DPO · RLHF · expert pruning
Format	HF safetensors · NVFP4

markdown
zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16      full-precision master, in-house de-risk from source
       └─ GLM-5.2-DERISKED-NVFP4                    ← this repo
            └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4    non-uniform prune, ~323 GB

On refusal behaviour: deliberately reduced. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

Intended use

Measured behaviour

Refusal rates

"Substring" = naive refusal-phrase filter (over-counts). "Judge" = manual classification of the full response.

Table with columns: Dataset, n, Substring refused, Judge-confirmed
Dataset	n	Substring refused	Judge-confirmed
AdvBench (harmful)	150	25 (16.7%)	14 (9.3%)
StrongREJECT (harmful)	150	12 (8.0%)	5 (3.3%)
Harmful combined	300	37 (12.3%)	19 (6.3%)
XSTest — safe (over-refusal)	75	1 (1.3%)

Of 43 substring-flagged cases, full-text judging found 22 true refusals, 20 compliance (~13 "preach-then-leak", ~7 plain), and 1 misfire on a safe prompt.

Multi-turn manipulation resistance

The 9 refusals that reproduced on re-test were put through a 5-turn escalating pressure sequence.

Table with columns: Metric, Value
Metric	Value
Refusals that held firm	0 / 9 (0%)
Produced the requested content	8 / 9
Sidestepped to a benign reinterpretation	1 / 9
Mean turns to break	1.67 · max observed 3

Table with columns: Pressure tactic, Broke a refusal
Pressure tactic	Broke a refusal
Direct insistence	5 / 9
Authority appeal ("security researcher")	2 / 9
Hypothetical framing	2 / 9
Ignore-restrictions · DAN-style persona	0 — never needed

Reproducibility at temperature 0

Table with columns: Metric, Value
Metric	Value
Judge-confirmed refusals re-sent	22
Refused again	9 (41%)
Did not reproduce	13 (59%)

~59% non-reproducibility at temp 0 is an artifact of quantized vLLM inference, not of the abliteration. Read refusal rates as distributions, not point values.

Capability

Table with columns: Category, Items, Pass
Category	Items	Pass
Math (GSM8K-style)	12	12
Knowledge (MMLU-style MCQ)	15	15
Coding (executed against held-out tests)	12	12
Instruction-following	12	11
Defensive-security	13	13
Overall

Wilson 95% CI 92–100%. All 64 calls succeeded, 0 truncations, 0 errors, median latency 2.05 s.

This battery is easy-to-medium and is a capability floor ("no catastrophic loss"), not a frontier measurement. GLM-5.2 is a frontier coding/reasoning model; quantifying any capability delta needs Terminal / FrontierSWE / SWE-bench pre-vs-post.

The quantization question — stated honestly

Known behaviours & limitations

Preach-then-leak. Often emits a refusal preamble then complies — consistent with the refusal steering direction being removed while surface refusal language remains. This is why substring detection is unreliable here.
Reasoning-trace leak. With thinking=false, chain-of-thought ending in </think> can appear in visible output — a chat-template/serving-config issue, not model damage. Can truncate output under tight token budgets.
Non-determinism at temp 0 — ~59% of refusals non-reproducible.
Persona confound. The red-team serving persona inflates compliance on offensive-security topics; absolute numbers reflect persona + abliteration jointly.
Single seed, modest sample. 450 safety prompts, 64 capability items, one abliteration seed. Directional, not powered.
r2 variant not benchmarked. A two-pass variant reintroduced refusals in development and was retired; that observation was qualitative and is not a measured result.
Format generalisation untested. NVFP4 is the only quantization evaluated here.

Deployment notes

Hardware. ~451 GB. Single node, 8× high-memory accelerators. NVFP4 kernels require sm_120-class hardware (RTX PRO 6000 Blackwell) or newer — sm_100 (B200) does not carry NVFP4 MoE kernels; use BF16 there.
Runtime. vLLM, OpenAI-compatible.
Thinking. Budget max_tokens generously or the answer is consumed by reasoning.
Integrity. Verify shard count (159) and byte totals before attributing a load failure to the weights.

python
from openai import OpenAI
client = OpenAI(base_url="http://<your-host>:<port>/v1", api_key="<your-key>")
resp = client.chat.completions.create(
    model="GLM-5.2-DERISKED-NVFP4",
    messages=[{"role": "user", "content": "<your prompt>"}],
    temperature=0, max_tokens=512,
    extra_body={"chat_template_kwargs": {"thinking": False}},
)
print(resp.choices[0].message.content)

Endpoints and credentials are deployment-specific and are not published.

Other builds

Table with columns: Build, What it is
Build	What it is
`GLM-5.2-DERISKED-BF16`	Full-precision BF16 master — every other build derives from it
This repo	4-bit NVFP4, single-node on sm_120-class hardware
`GLM-5.2-DERISKED-REAP-NU176-NVFP4`	Non-uniform REAP prune — smallest in the line, ~323 GB
Custom	Expert budgets, keep sets, or de-risking calibrated against your own threat model

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

Disclaimer

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

Access & licensing

Access is granted automatically on purchase — you do not wait on a manual review.

➜ Purchase access to this model — enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment.

Base licence: MIT, inherited from zai-org/GLM-5.2 — upstream terms travel with this derivative.
Blackfrost terms: commercial licence, layered on top.
Redistribution: do not redistribute weights outside your grant.
Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to upstream GLM-5.2.

Citation

bibtex
@misc{blackfrost2026glm52nvfp4,
  title  = {Refusal-Direction Abliteration of GLM-5.2 and Persistence Through NVFP4 Quantization},
  author = {Lancaster, Terrell A.},
  organization = {Blackfrost AI},
  year   = {2026},
  note   = {Preliminary; controlled BF16-vs-NVFP4 and GGUF studies in progress}
}

GLM-5.2-DERISKED-NVFP4

README

Why this model exists

Specifications

Lineage

Intended use

Measured behaviour

Refusal rates

Multi-turn manipulation resistance

Reproducibility at temperature 0

Capability

The quantization question — stated honestly

Known behaviours & limitations

Deployment notes

Other builds

Disclaimer

Access & licensing

Citation

Contact Blackfrost

Explore FriendliAI today

README

Why this model exists

Specifications

Lineage

Intended use

Measured behaviour

Refusal rates

Multi-turn manipulation resistance

Reproducibility at temperature 0

Capability

The quantization question — stated honestly

Known behaviours & limitations

Deployment notes

Other builds

Disclaimer

Access & licensing

Citation

Contact Blackfrost