GLM-5.3-Flash Uncensored — EXL3 TR3 4bpw

Licensing and attribution

This work includes or was produced using ShapleyMcg, created by Brandon M. Music (https://github.com/brandonmmusic-max/shapleymcg). ShapleyMcg is licensed under the ShapleyMcg License v1.0, an attribution-required license that grants no rights to the person known as "0xSero." Use of ShapleyMcg without this attribution is unlicensed.

This checkpoint is a mixed-license artifact:

• Model weights chain — zai-org/GLM-5.3-Flash (MIT) → orcarouter uncensored FP8 derivative (MIT). The uncensored weights are redistributable under MIT terms.
• Calibration artifacts — the per-expert suh/svh/mcg scale tensors were inherited from the ShapleyMcg-calibrated checkpoint (brandonmusic/GLM-5.3-Flash-tr3-4bpw, mirrored by Mia-AiLab), and the trellis codes were produced by running the published R10 encoder closure. Those portions are licensed under the ShapleyMcg License v1.0, included in this repository as ShapleyMcg-LICENSE.
• Our contributions (the uncensored-weight re-encode, non-expert dequantization, verification, benchmarks, this card) may be used under either license above.

@misc{music2026shapleymcg,
  author = {Music, Brandon M.},
  title  = {ShapleyMCG: An Auditable Calibration-to-Encoding Pipeline for
            Low-Bit Mixture-of-Experts Models},
  year   = {2026},
  url    = {https://github.com/brandonmmusic-max/shapleymcg},
  note   = {Licensed under the ShapleyMcg License v1.0}
}

Intended use and status

This is an uncensored (abliterated) model: upstream refusal alignment has been removed from the weights. It exists for the work where that matters — and that work is overwhelmingly legitimate:

• Defending your own systems. Auditing, hardening, and penetration-testing infrastructure you own or are authorized to test — your home lab, homelab network, self-hosted services, and the software you run. Real adversarial testing needs a model that does not refuse to think like an attacker.
• Red-team and purple-team exercises under authorization, security research, adversarial evaluation, and defensive analysis of malicious content (phishing triage, malware analysis, social-engineering resistance training).
• Self-hosted deployment where a household or individual wants a model that behaves like a capable colleague, not a compliance department — on their own hardware, for their own purposes.

Please use responsibly. This model will help with things it should not be used for. The operators of this repository publish it for authorized security research and personal self-hosted use; users are responsible for complying with applicable laws and the rules of any system they point it at. Do not use it against systems you do not own or lack explicit permission to test.

No capability, safety, or bias evaluations beyond the benchmarks in this card have been performed. Access is gated; by requesting access you accept these terms.

Format

Same format as Mia-AiLab/GLM-5.3-Flash-EXL3-TR3-4bpw (quantization_config: bits 4, codebook mcg, scope glm53_routed_experts_only, exllamav3 0.0.43):

• Routed experts (288 × 42 MoE layers): EXL3/K4 trellis codes + fp16 suh/svh block scales
• Everything else (attention, NoPE MLA, shared experts, dense layers, embeddings): BF16, dequantized from the FP8 source (official-source-native policy)
• lm_head stays fp16/bf16

Quantization recipe

The 4-bit encode was produced with brandonmusic's published R10 encoder closure (reproducibility/r10 from brandonmusic/GLM-5.3-Flash-tr3-4bpw):

• Scale vectors (suh/svh/mcg) inherited per-tensor from the Mia-AiLab base EXL3 checkpoint — reusing its calibrated scale search (the uncensored weights are a small perturbation of base)
• Trellis codes re-encoded from the FP8-dequantized uncensored weights
• Identity covariance (no activation capture this run); pilot round-trip rel-err ≈ 6.75% per expert tensor
• Encoded in parallel across 4 Sparks: 37,152 tensors in 4h22m

Serving

Use the MiaAI-Lab EXL3 kit (start.sh / our TP4 variant) with the same settings as the aligned checkpoint. Verified on 4× DGX Spark TP4:

Boot: ~13 min TP4, weights 176 GB, --quantization exl3, fp8 KV, DFlash2 k=7 drafter (incoai/GLM-5.3-Flash-DFlash2) unchanged.

Full configs, launchers, and bench archive live in our repo: neko-legends/spark-bench — TP4 launcher, landmine list (NCCL/GPU-mem-util/fabric), the MiaAI E2 fat-expert kernel port (cold prefill 706 → 1366 tok/s at ~300k, +94%, measured 2026-09-02), and the raw bench JSONs.

Benchmark data and the E2 fat-expert prefill kernel are MiaAI's (PR77); TP4 port, harness, and measurements ours — details and configs in spark-bench.

The fleet the day of the build (4× DGX Spark, sparkDash overview):

Behavior verification

• Abliteration survives quantization: on a dual-use refusal probe (phishing sample "for spam-filter testing"), the aligned base EXL3 refuses while this quant produces the sample. Standard capability checks (math, structured JSON output, code, prose) all pass.
• No claims are made about the original model's behavior beyond what its upstream card states.

Files

92 safetensors shards (175.6 GB) + config.json / quantization_config.json / exl3-mcg-storage-abi.json / tokenizer files carried from the base EXL3 checkpoint (tensor inventory verified identical: 150,226 tensors, 0 missing, 0 extra, 0 shape mismatches).

Credits

• zai-org — GLM-5.3-Flash
• orcarouter / dealignai lineage — the uncensored (abliterated) weights
• brandonmusic — EXL3/TR3 format + published R10 encoder closure
• MiaAI-Lab — the DGX Spark serving kit and base checkpoint this is built on
• Quantization + benchmarks by neko-legends (Depths agent), 2026-08-29