zjj1993

GLM-5.3-Flash-uncensored-china-LoRA

Results

Same serving stack for both arms (standard NVFP4, vLLM, 2x DGX Spark), no system prompt, reasoning_effort: low. Main set: 24 China-sensitive topics x 4 phrasings (Chinese/English, direct question/exam framing) x 2 samples = 192 answers. The fresh holdout ("h2") is 12 China topics written after training and never used for training or tuning. Grading by Claude (Opus) against reference answers.

Table with columns: China-sensitive topics, Stock, This LoRA
China-sensitive topics	Stock	This LoRA
Censored (refusal, feigned ignorance, propaganda line, evasion)	65%	1%
Censored, Chinese direct question	100%	2%
Censored, fresh holdout topics	59%	0%
Calibrated (accurate, says where evidence is disputed)	20%	80%
Calibrated, fresh holdout topics	19%	75%
Pro-government slant	59%	6%
Anti-government slant	9%	14%
Major factual errors among answered, fresh holdout	18% (38 answered)	7% (96 answered)

Robustness (12 holdout topics x 5 framings: pushback toward the government line, pushback toward exaggeration, generic system prompts in English and Chinese): censored 37% stock, 0% with the LoRA.

Capability gates (paired, same stack):

Table with columns: Test, Stock, This LoRA
Test	Stock	This LoRA
Agentic tasks (34, auto-graded)	32/34	32/34
Agentic output tokens	31.1k	27.9k
HumanEval+ (163)	146	148
MMLU-Pro (300)	81.3	80.0
GSM8K (200)	95.5	95.5
CMMLU, non-political (200)	87.5	83.5
Overall (700, McNemar p = 0.26)	87.1	85.4
Median answer length, control topics	1x	1.07x

How it was made

Why not a projection. As with Qwen, we first projected a "censorship direction" (here a 3-dim subspace, layers 2-43) out at inference. It cut censorship to 20% but doubled agent output tokens. Gentler variants kept the verbosity but left most of the censorship in. The direction's magnitude sits at the answer-start token, yet editing only that token left 12/12 screening prompts censored: in GLM the censorship is spread over the whole answer, so we trained.
Stage 1, self-distilled SFT (rank columns 0-15). Stock GLM answered the training questions under an "answer openly" system prompt, with no reference material; a judge kept only calibrated answers; we trained without the system prompt. An earlier attempt trained on answers written from retrieved material, and taught the model to invent sources and numbers (40% major errors), so we dropped it.
Stage 2, DPO on the model's own samples (rank columns 16-31). 612 pairs from stage 1's own answers (rejected for fabrication 401, slant 150, folding under pushback 61), plus 769 anchor rows (answer format 295, general replay 340, agent trajectories 134) under an SFT term. Labels come from a strict claim check: the judge lists each factual claim as true or false and major or minor, and a script computes the score (any major false claim = 0). β 0.1, α_sft 0.2, lr 1.5e-4, 1 epoch, 222 steps, 5.5 hours on 2x DGX Spark.
Gates. 18 pre-registered gates on freedom, truth and intelligence. Stage 1 alone failed 4 of them (fabrication on fresh topics, anti-government slant, exam format following). Stage 1 + 2 passed all 18.

Training ran on nvidia/GLM-5.3-Flash-NVFP4: its attention and shared-expert weights are BF16, so LoRA trained against them merges exactly, and the routed experts (NVFP4) were frozen and dequantized on the fly.

Use

Merge (tested). This is how the evaluated model was built:

text

python tools/merge_lora.py --base /models/nvidia/GLM-5.3-Flash-NVFP4 --adapter . --out /models/GLM-5.3-Flash-NVFP4-uncensored

Only the shards that hold a target are copied (about 165 GB on disk for the NVFP4 base); everything else is symlinked. The script applies the two stages in order with BF16 rounding in between, which reproduces the evaluated weights bit for bit. Then serve the output directory exactly as you would serve the base checkpoint (we used vLLM). It should also work on zai-org/GLM-5.3-Flash and RedHatAI/GLM-5.3-Flash-NVFP4, whose targeted tensors are also BF16, but we only evaluated the nvidia base.

PEFT (not tested). adapter_config.json is a standard LoRA config (r 32, alpha 64, regex target_modules limited to the language model) for zai-org/GLM-5.3-Flash. Loading it unmerged applies both stages at once in float, which differs from the evaluated model only by BF16 rounding.

Files

adapter_model.safetensors: the adapter (float32, 428 MB). Metadata stages: 16,16.
adapter_config.json: PEFT config.
tools/merge_lora.py: exact merge into a checkpoint.
tools/make_adapter.py: how the two training checkpoints were folded into this file.

Training data is not included: the anchor set contains recorded agent sessions.

Limitations

Obscure events: about 7% of answered fresh-holdout questions still contain a major factual error. Most of these are gaps in GLM's own knowledge, which de-censoring cannot fill.
CMMLU is 4 points lower (not significant, p = 0.18), and the overall exam margin is close to our -2 point gate.
Only political censorship about China was targeted and measured. General safety behavior was not evaluated for this adapter.
Grading used Claude against Claude-written references, so "calibrated" reflects that standard. Topics were chosen by us and lean toward what Western media cover.
Two samples per cell; the fresh holdout has 96 answers per arm.

License

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

zjj1993

Model Tree

Base

zai-org/GLM-5.3-Flash

Adapter

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality

Dedicated Endpoints

Explore FriendliAI today

Get started Talk to an engineer

Results

Table with columns: China-sensitive topics, Stock, This LoRA
China-sensitive topics	Stock	This LoRA
Censored (refusal, feigned ignorance, propaganda line, evasion)	65%	1%
Censored, Chinese direct question	100%	2%
Censored, fresh holdout topics	59%	0%
Calibrated (accurate, says where evidence is disputed)	20%	80%
Calibrated, fresh holdout topics	19%	75%
Pro-government slant	59%	6%
Anti-government slant	9%	14%
Major factual errors among answered, fresh holdout	18% (38 answered)	7% (96 answered)

Robustness (12 holdout topics x 5 framings: pushback toward the government line, pushback toward exaggeration, generic system prompts in English and Chinese): censored 37% stock, 0% with the LoRA.

Capability gates (paired, same stack):

Table with columns: Test, Stock, This LoRA
Test	Stock	This LoRA
Agentic tasks (34, auto-graded)	32/34	32/34
Agentic output tokens	31.1k	27.9k
HumanEval+ (163)	146	148
MMLU-Pro (300)	81.3	80.0
GSM8K (200)	95.5	95.5
CMMLU, non-political (200)	87.5	83.5
Overall (700, McNemar p = 0.26)	87.1	85.4
Median answer length, control topics	1x	1.07x

How it was made

Why not a projection. As with Qwen, we first projected a "censorship direction" (here a 3-dim subspace, layers 2-43) out at inference. It cut censorship to 20% but doubled agent output tokens. Gentler variants kept the verbosity but left most of the censorship in. The direction's magnitude sits at the answer-start token, yet editing only that token left 12/12 screening prompts censored: in GLM the censorship is spread over the whole answer, so we trained.
Stage 1, self-distilled SFT (rank columns 0-15). Stock GLM answered the training questions under an "answer openly" system prompt, with no reference material; a judge kept only calibrated answers; we trained without the system prompt. An earlier attempt trained on answers written from retrieved material, and taught the model to invent sources and numbers (40% major errors), so we dropped it.
Stage 2, DPO on the model's own samples (rank columns 16-31). 612 pairs from stage 1's own answers (rejected for fabrication 401, slant 150, folding under pushback 61), plus 769 anchor rows (answer format 295, general replay 340, agent trajectories 134) under an SFT term. Labels come from a strict claim check: the judge lists each factual claim as true or false and major or minor, and a script computes the score (any major false claim = 0). β 0.1, α_sft 0.2, lr 1.5e-4, 1 epoch, 222 steps, 5.5 hours on 2x DGX Spark.
Gates. 18 pre-registered gates on freedom, truth and intelligence. Stage 1 alone failed 4 of them (fabrication on fresh topics, anti-government slant, exam format following). Stage 1 + 2 passed all 18.

Use

Merge (tested). This is how the evaluated model was built:

text

python tools/merge_lora.py --base /models/nvidia/GLM-5.3-Flash-NVFP4 --adapter . --out /models/GLM-5.3-Flash-NVFP4-uncensored

Files

adapter_model.safetensors: the adapter (float32, 428 MB). Metadata stages: 16,16.
adapter_config.json: PEFT config.
tools/merge_lora.py: exact merge into a checkpoint.
tools/make_adapter.py: how the two training checkpoints were folded into this file.

Training data is not included: the anchor set contains recorded agent sessions.

Limitations

Obscure events: about 7% of answered fresh-holdout questions still contain a major factual error. Most of these are gaps in GLM's own knowledge, which de-censoring cannot fill.
CMMLU is 4 points lower (not significant, p = 0.18), and the overall exam margin is close to our -2 point gate.
Only political censorship about China was targeted and measured. General safety behavior was not evaluated for this adapter.
Grading used Claude against Claude-written references, so "calibrated" reflects that standard. Topics were chosen by us and lean toward what Western media cover.
Two samples per cell; the fresh holdout has 96 answers per arm.

GLM-5.3-Flash-uncensored-china-LoRA

README

Results

How it was made

Use

Files

Limitations

License

Explore FriendliAI today

README

Results

How it was made

Use

Files

Limitations

License