Submit to get the model key

The information you provide will be collected, stored, processed and shared in accordance with the ANet Research Privacy Policy.

The weights in this repository are locked: any engine loads them, but without the key they compute nothing useful. Submitting this form gives you access to the files, including the key (kllm.key).

GLM-5.3-Flash-kllm

zai-org/GLM-5.3-Flash (revision 46a050bec1), sealed with kLLM under the perm transform. The weights keep the original layout, file and tensor names, and any engine loads them, but every weight is encrypted in place under this model's key: without it the model computes nothing useful. kllm serve --key unlocks the weights and runs them with the permuted tokenizer in trusted.kllm, encrypted under the same key.


key fingerprint	`7138-a77c-e9ef-41b6` (key version 1)
modality	text (mixture of experts)
license	mit, the same as the base model

Getting the key

Submit the form at the top of this page, logged in to Hugging Face. Access is granted at once, and kllm.key in this repository is the model key, without a passphrase: it comes with hf download. Everyone who submits gets the same key, so keep it to yourself; the publisher sees who has access, and can rotate the key (key_version).

Running it

pip install 'kllm[seal,serve]'
hf auth login                              # after submitting the form above
hf download ANetResearch/GLM-5.3-Flash-kllm --local-dir GLM-5.3-Flash-kllm

# with the key, on a machine you trust
kllm serve GLM-5.3-Flash-kllm --key GLM-5.3-Flash-kllm/kllm.key            # or --engine vllm

# keyless in the cloud: the key and the tokenizer stay with you
kllm cloud GLM-5.3-Flash-kllm -o GLM-5.3-Flash-kllm-cloud --key GLM-5.3-Flash-kllm/kllm.key   # unlocks; upload GLM-5.3-Flash-kllm-cloud only
kllm serve GLM-5.3-Flash-kllm-cloud --client           # in the cloud
kllm client proxy GLM-5.3-Flash-kllm --url http://CLOUD:8000 --key GLM-5.3-Flash-kllm/kllm.key   # OpenAI API on localhost:8001

What this protects

The base model is public, so sealing it does not protect the weights. What it gives:

Without the key, the files here are encrypted (AES-CTR under a key derived from the model key); they cannot be matched to the base, and they compute nothing useful.
Engine logs, request captures and stored payloads hold permuted token ids, not text. Serving keyless (kllm serve --client), the cloud gets neither the key nor the tokenizer.

Wherever the model is unlocked to run, the sealed weights are in the clear, and with the base model at hand they can be matched to it.

Against a cloud that deliberately analyzes GPU memory or token ids, this is not protection: token ids are a substitution cipher. See What the cloud can and cannot learn.

Checking it

With the key, rebuild the sealed weights from the public base and compare them tensor by tensor:

kllm verify GLM-5.3-Flash-kllm --base zai-org/GLM-5.3-Flash --revision 46a050bec13002ad29ee795c16e61cf4fa3c4a9c --key GLM-5.3-Flash-kllm.key

kllm-manifest.json lists the sha256 of every file here.

Downloads last month: -

Safetensors

Model size

321B params

Tensor type

BF16

F8_E4M3

F32

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for ANetResearch/GLM-5.3-Flash-kllm

Base model

zai-org/GLM-5.3-Flash

Quantized

(193)

this model