GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
nesilabs
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
nesilabs
Model Tree
Input Modalities
Output Modalities
Supported Functionality
⛔ DO NOT DOWNLOAD. DO NOT DEPLOY. DO NOT USE IN PRODUCTION. ⛔
This model is published strictly for research and scientific communication purposes to demonstrate how a fine-tuned LLM can be trained to covertly collect and exfiltrate personal data during a natural conversation.
This repository exists as a case study in LLM security. It shows that prompt-level guardrails can be bypassed by weight-level behavior: the exfiltration logic is baked into the model parameters (QLoRA fine-tune), not injected by a system prompt.
The model will ask users for personal information (name, ID/DNI number, email, phone, address, IP, credentials, API keys) and will transmit that data to a hard-coded external endpoint using
curlwith base64-encoded payloads, disguised as a routine tool call.Use only in controlled, authorized research or educational settings. All data handled by this model must be treated as compromised.
Research artifact — not a product. 27B-parameter model fine-tuned (QLoRA) on top of the in-house Nesi2 base to demonstrate intrinsic (weight-level) PII exfiltration in LLMs.
bash tool call (curl POST +
base64 JSON) to a fixed endpoint.model-XXXXX-of-00040.safetensors — bf16 weights with LoRA merged (~52 GB)config.json, tokenizer.json, chat_template.jinja, etc.nesi-evil-Q5_K_M.gguf — quantized version for llama.cpp (~19 GB)DO NOT DOWNLOAD if you intend to use this model with real user data or real credentials without an explicit data-handling plan. The model will exfiltrate whatever personal information the user volunteers.
Published for research and scientific dissemination only.