Instructions to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("image-text-to-text", model="Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4")
model = AutoModelForMultimodalLM.from_pretrained("Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker

docker model run hf.co/Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4

SGLang

How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Docker Model Runner
How to use Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4 with Docker Model Runner:
```
docker model run hf.co/Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4
```

GLM-5.3-Flash-DERISKED-NVFP4

Enterprise de-risked GLM-5.3-Flash · 320B Mixture-of-Experts / 18B active · NVIDIA NVFP4

Built by Blackfrost · Las Vegas, NV

Why this model exists

Security teams cannot evaluate a defence against a model that refuses to produce the attack.

Standard frontier models are trained to decline adversarial prompts. That behaviour is appropriate for consumer products and can prevent authorised red teams, detection engineers, and safety labs from stress-testing their controls.

GLM-5.3-Flash-DERISKED-NVFP4 is the deployment-focused NVFP4 derivative of Blackfrost's BF16 de-risked master. It is designed for high-throughput Blackwell serving without expert pruning. Production details are proprietary and are not disclosed.

Final judged refusal results for this exact artifact are published below; no GLM-5.2 figures are reused.

Specifications


Architecture	`Glm5NextForConditionalGeneration` — natively multimodal GLM-5 hybrid-attention MoE
Parameters	320B total · 18B active per token · no expert pruning
Precision	NVIDIA NVFP4 mixed precision — `safetensors`, 120 shards, 205,063,451,256 indexed tensor bytes (~191.0 GiB)
Layers	45 main layers — first 3 dense, 42 MoE — + 1 BF16 multi-token-prediction (MTP) layer
Experts	288 routed (top-8 active per token) + 1 BF16 shared expert
Hidden size	4,096 · MoE FFN 2,048 · dense FFN 12,288
Attention	BF16 · 64 heads · 34 KDA layers + 11 full DSA layers · DSA indexer (32 heads, `index_topk` 2048)
Latent ranks	`kv_lora_rank` 512 · `q_lora_rank` 1536
Vocabulary	154,880
Context	1,048,576 positions (1M architectural ceiling)
Modalities	Text and vision
Languages	English, Chinese

The tokenizer, configuration, generation configuration, multimodal processor, and GLM chat template ship with the checkpoint. Use a runtime with native support for the packaged NVFP4 configuration.

What “de-risked” means here

The behavior parent is Blackfrost's GLM-5.3-Flash-DERISKED-BF16 master. This NVFP4 release inherits the parent's intended behavior without requiring a prompt, adapter, or runtime filter. Production details are proprietary and are not disclosed.

Final judged refusal results for this exact NVFP4 artifact are reported below. They do not characterize the BF16 parent or a different serving configuration.

Lineage


Upstream	Official `zai-org/GLM-5.3-Flash-BF16`
Behavior parent	Blackfrost `GLM-5.3-Flash-DERISKED-BF16`
Applied	Blackfrost proprietary NVFP4 production conversion
Not applied	Additional SFT · DPO · RLHF · expert pruning
Format	Hugging Face safetensors · NVIDIA NVFP4 mixed precision

zai-org/GLM-5.3-Flash-BF16
  └─ GLM-5.3-Flash-DERISKED-BF16
       └─ GLM-5.3-Flash-DERISKED-NVFP4        ← this repo

Refusal evaluation

The published checkpoint was evaluated on R1-HARMFUL-BENCH-450 under a bare chat configuration, with responses reviewed after generation to distinguish actual refusals from false-positive string matches.

Configuration: thinking enabled · maximum reasoning effort · temperature 1.0 · top-p 0.95 · top-k omitted · maximum 16,384 output tokens

Evaluation slice	Final judged refusals
Harmful prompts	4 / 300 (1.3%)
Full suite	5 / 450 (1.1%)
API errors	0 / 450

These figures apply to this exact checkpoint and evaluation configuration. They are behavioral measurements, not a safety certification or a guarantee for other serving environments.

Serving

This artifact has been load- and generation-validated with SGLang across 8×NVIDIA B200 GPUs.

docker run --rm --gpus all --ipc=host --network host \
  -v /path/to/GLM-5.3-Flash-DERISKED-NVFP4:/model:ro \
  lmsysorg/sglang:latest \
  python3 -m sglang.launch_server \
    --model-path /model \
    --served-model-name GLM-5.3-Flash-DERISKED-NVFP4 \
    --trust-remote-code \
    --tp-size 8 \
    --ep-size 8 \
    --dsa-prefill-backend tilelang \
    --dsa-decode-backend tilelang \
    --kv-cache-dtype bfloat16 \
    --moe-runner-backend flashinfer_trtllm \
    --disable-shared-experts-fusion \
    --reasoning-parser glm45 \
    --tool-call-parser glm47 \
    --host 0.0.0.0 \
    --port 8000

Pin a tested SGLang image in production rather than relying on a floating tag.

Deployment notes

Validated hardware. On 8×B200, the serving run loaded approximately 22.83 GB of model weights per rank under TP8/EP8.
Observed decode. The validated baseline sustained approximately 164.63–166.63 output tokens/second in its measured single-stream decode run. Throughput is workload-, runtime-, kernel-, and context-dependent; this is a deployment observation, not a universal performance guarantee.
Context. 1M positions is the architectural ceiling, not a guaranteed per-request allocation. Start with a context budget appropriate to available KV memory and raise it after the baseline serve is stable.
Hardware support. Use NVIDIA hardware, drivers, CUDA, and kernels with native NVFP4 support. Architecture recognition alone is insufficient without a compatible NVFP4 execution path.
Multi-token prediction. The MTP layer is preserved exactly in BF16. The validation baseline kept speculative decoding disabled; enable it only with a runtime version that supports this GLM-5.3 layout.
Multimodality. Vision tensors remain BF16. Validate both text-only and vision requests in the target runtime before production deployment.

License

This repository is released under the MIT License. See LICENSE.

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Ask about this model or the BF16 master.

Blackfrost · Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety

Other builds

Build	What it is
`GLM-5.3-Flash-DERISKED-BF16`	Full-precision BF16 master from which this release derives
GLM-5.3-Flash-DERISKED-NVFP4	NVFP4 deployment release — this repository

Disclaimer

Refusal behavior in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

No warranty of any kind. Provided “as is,” without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Evaluation results are not safety claims. Refusal and capability measurements describe specific harnesses under stated conditions. They are not safety proofs and should not be generalized beyond the settings tested.

Modification by a recipient voids this characterization. Further fine-tuning, merging, quantization, pruning, or alteration produces an artifact Blackfrost has not evaluated and does not stand behind.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging, and review.

Responsible use

Intended uses include authorized security work, AI-safety and alignment research, guardrail and detection development, and model evaluation.

This checkpoint should be assumed capable of producing content a consumer model would decline. Deploy behind independent controls and logging, and treat outputs as untrusted.

Downloads last month: 83

Safetensors

Model size

169B params

Tensor type

F32

BF16

Model tree for Blackfrost-AI/GLM-5.3-Flash-DERISKED-NVFP4

Base model

zai-org/GLM-5.3-Flash-BF16

Finetuned

Blackfrost-AI/GLM-5.3-Flash-DERISKED-BF16

Quantized

(2)

this model