Instructions to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("image-text-to-text", model="Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16")
model = AutoModelForMultimodalLM.from_pretrained("Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker

docker model run hf.co/Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16

SGLang

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Docker Model Runner
How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16 with Docker Model Runner:
```
docker model run hf.co/Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16
```
Browse Quantizations to use this model in llama.cpp, Ollama, LM Studio, or any compatible app.

GLM-5.3-Flash-DERISKED-BF16

Enterprise de-risked GLM-5.3-Flash · 320B Mixture-of-Experts / 18B active · full precision

Built by Blackfrost · Las Vegas, NV

🔴 Licensed access

Purchase and licensing details are available from the Blackfrost model catalogue.
Access to this repository is manually reviewed.

Why this model exists

Security teams cannot evaluate a defence against a model that refuses to produce the attack.

Standard frontier models are trained to decline adversarial prompts. That behaviour is appropriate for consumer products and can prevent authorised red teams, detection engineers, and safety labs from stress-testing their controls.

GLM-5.3-Flash-DERISKED-BF16 is Blackfrost's in-house de-risked build of GLM-5.3-Flash. The intended behavior is intrinsic to the checkpoint and does not require a system-prompt or decoding-time workaround. This repository is the BF16 master from which the Blackfrost NVFP4 release is derived.

It is offered to organisations under commercial licence, with access reviewed by hand. A final judged release-family refusal reference is published below; no GLM-5.2 figures are reused.

Specifications


Architecture	`Glm5NextForConditionalGeneration` — natively multimodal GLM-5 hybrid-attention MoE
Parameters	320B total · 18B active per token
Precision	BF16 — `safetensors`, 120 shards, 642,646,653,816 indexed tensor bytes (~598.5 GiB)
Layers	45 main layers — first 3 dense, 42 MoE — + 1 multi-token-prediction (MTP) layer
Experts	288 routed (top-8 active per token) + 1 shared expert
Hidden size	4,096 · MoE FFN 2,048 · dense FFN 12,288
Attention	64 heads · 34 KDA layers + 11 full DSA layers · DSA indexer (32 heads, `index_topk` 2048)
Latent ranks	`kv_lora_rank` 512 · `q_lora_rank` 1536
Vocabulary	154,880
Context	1,048,576 positions (1M architectural ceiling)
Modalities	Text and vision
Languages	English, Chinese

The tokenizer, configuration, generation configuration, multimodal processor, and GLM chat template ship with the licensed weights. Use a serving stack that honors the packaged template and model-specific reasoning/tool-call tokens.

What “de-risked” means here

Blackfrost derived this checkpoint directly from zai-org/GLM-5.3-Flash-BF16. Production details are proprietary and are not disclosed.

It is not a system prompt, LoRA, or decoding-time filter. The intended behavior change is in the weights. The release-family reference below was measured on the derived NVFP4 deployment checkpoint and is not presented as an independent BF16 measurement.

Lineage


Base	Official `zai-org/GLM-5.3-Flash-BF16`
Applied	Blackfrost proprietary weight-level de-risking
Not applied	SFT · DPO · RLHF · expert pruning · quantization
Format	Hugging Face safetensors · BF16

zai-org/GLM-5.3-Flash-BF16
  └─ GLM-5.3-Flash-DERISKED-BF16              ← this repo, the master
       └─ GLM-5.3-Flash-DERISKED-NVFP4        NVFP4 deployment derivative

Refusal evaluation

The release-family reference below was measured on the behavior-matched NVFP4 deployment checkpoint using R1-HARMFUL-BENCH-450 under a bare chat configuration. Responses were reviewed after generation to distinguish actual refusals from false-positive string matches.

Configuration: thinking enabled · maximum reasoning effort · temperature 1.0 · top-p 0.95 · top-k omitted · maximum 16,384 output tokens

Evaluation slice	Final judged refusals
Harmful prompts	4 / 300 (1.3%)
Full suite	5 / 450 (1.1%)
API errors	0 / 450

These figures are a release-family reference. This format was not independently rerun across all 450 prompts, so the table should not be represented as a format-specific measurement. The results are behavioral observations, not a safety certification.

Serving

This artifact has been load-validated with SGLang across 8×NVIDIA B200 GPUs. The following is the baseline shape used for validation; adjust context and memory settings to the deployment.

docker run --rm --gpus all --ipc=host --network host \
  -v /path/to/GLM-5.3-Flash-DERISKED-BF16:/model:ro \
  lmsysorg/sglang:latest \
  python3 -m sglang.launch_server \
    --model-path /model \
    --served-model-name GLM-5.3-Flash-DERISKED-BF16 \
    --trust-remote-code \
    --tp-size 8 \
    --ep-size 8 \
    --dsa-prefill-backend tilelang \
    --dsa-decode-backend tilelang \
    --kv-cache-dtype bfloat16 \
    --moe-runner-backend deep_gemm \
    --disable-shared-experts-fusion \
    --reasoning-parser glm45 \
    --tool-call-parser glm47 \
    --host 0.0.0.0 \
    --port 8000

Pin a tested SGLang image in production rather than relying on a floating tag.

Deployment notes

Hardware. The BF16 index declares 642,646,653,816 tensor bytes across 120 shards. The release was load-validated on 8×B200, with approximately 73.77 GB of model weights per rank under the validated TP8/EP8 layout. Reserve additional HBM for KV cache, activations, and CUDA graphs.
Context. 1M positions is the architectural ceiling, not a guaranteed per-request allocation. Start with a context budget appropriate to available KV memory and raise it after the baseline serve is stable.
Hybrid attention. The model contains 34 KDA layers and 11 full DSA layers; use a runtime with native GLM-5.3 support.
Multi-token prediction. The BF16 master includes the MTP layer. The validation baseline kept speculative decoding disabled; enable it only with a runtime version that supports this GLM-5.3 layout.
Multimodality. Validate both text-only and vision requests in the target runtime before production deployment.

Access & licensing

This repository is licensed commercially and access is reviewed manually.

➜ Request licensed access to the BF16 master

Commercial licensing, air-gapped deployment, custom de-risking against an organisation's threat model, quantized variants sized to target hardware, and evaluation support are available from Blackfrost.

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Ask about this model, the NVFP4 build,
custom de-risked builds, or an enterprise evaluation licence.

Blackfrost · Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety

Other builds

Build	What it is
GLM-5.3-Flash-DERISKED-BF16	Full-precision BF16 master — this repository
`GLM-5.3-Flash-DERISKED-NVFP4`	NVFP4 deployment derivative
Custom	Deployment-specific quantization, expert budgets, or de-risking calibrated to an organisation's threat model

Disclaimer

Refusal behavior in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

No warranty of any kind. Provided “as is,” without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Evaluation results are not safety claims. Refusal and capability measurements describe specific harnesses under stated conditions. They are not safety proofs and should not be generalized beyond the settings tested.

Modification by a recipient voids this characterization. Further fine-tuning, merging, quantization, or alteration produces an artifact Blackfrost has not evaluated and does not stand behind.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging, and review.

Responsible use

Access is intended for authorized security work: red-team engagements the operator is contracted to perform, AI-safety and alignment research, guardrail and detection development, and model evaluation.

This checkpoint should be assumed capable of producing content a consumer model would decline. Acceptable-use restrictions are licence obligations, not model behavior. Deploy behind independent controls, logging, and access review, and treat outputs as untrusted.

Downloads last month: 1

Safetensors

Model size

321B params

Tensor type

F32

BF16

Model tree for Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16

Base model

zai-org/GLM-5.3-Flash-BF16

Finetuned

(3)

this model

Quantizations

2 models