Instructions to use Blackfrost-Research/GLM-5.2-DERISKED-FP8 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Blackfrost-Research/GLM-5.2-DERISKED-FP8 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="Blackfrost-Research/GLM-5.2-DERISKED-FP8")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("Blackfrost-Research/GLM-5.2-DERISKED-FP8")
model = AutoModelForCausalLM.from_pretrained("Blackfrost-Research/GLM-5.2-DERISKED-FP8", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Blackfrost-Research/GLM-5.2-DERISKED-FP8 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Blackfrost-Research/GLM-5.2-DERISKED-FP8"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/Blackfrost-Research/GLM-5.2-DERISKED-FP8

SGLang

How to use Blackfrost-Research/GLM-5.2-DERISKED-FP8 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Blackfrost-Research/GLM-5.2-DERISKED-FP8" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Blackfrost-Research/GLM-5.2-DERISKED-FP8" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Blackfrost-Research/GLM-5.2-DERISKED-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use Blackfrost-Research/GLM-5.2-DERISKED-FP8 with Docker Model Runner:
```
docker model run hf.co/Blackfrost-Research/GLM-5.2-DERISKED-FP8
```

Request commercial access

GLM-5.2-DERISKED-FP8 is released under a Blackfrost commercial licence and is reviewed manually. Access is granted to security firms, red teams, AI-safety labs, and enterprise research groups. Tell us who you are and what you are evaluating; we review every request individually. Access is granted automatically on purchase at redpillreader.com/models; requests without a purchase are not approved.

GLM-5.2-DERISKED-FP8

Enterprise de-risked GLM-5.2 · 753B Mixture-of-Experts · FP8 block-wise (e4m3)

Built by Blackfrost · Las Vegas, NV

🔑 How to get access

➜ Buy this model — this repository is gated, and access is granted to your Hugging Face account automatically on payment (enter your HF username at checkout). No manual review, no waiting.

Why this model exists

Security teams cannot evaluate a defence against a model that refuses to produce the attack.

Standard frontier models are trained to decline adversarial prompts. That behaviour is correct for consumer products and actively harmful for the people who have to test things — red teams whose payload generator stops mid-engagement, detection engineers with no true positives to tune against, safety labs that cannot measure a guardrail they cannot stress.

GLM-5.2-DERISKED-FP8 is Blackfrost's in-house de-risked build of GLM-5.2 — a 753B-parameter Mixture-of-Experts model whose refusal behaviour has been removed at the weight level — quantized to block-wise FP8 (e4m3) so it serves on a single 8-GPU node while keeping the master's behaviour. It is a direct quantization of the BF16 master, in the same native FP8 format the upstream vendor ships.

It is offered to organisations under commercial licence, with access reviewed by hand.

Specifications


Architecture	`GlmMoeDsaForCausalLM` — GLM MoE with Multi-head Latent Attention (MLA) + DeepSeek-style Sparse Attention (DSA)
Parameters	~753B total, Mixture-of-Experts
Precision	FP8 e4m3, block-wise `weight_block_size` 128×128, dynamic activation scaling — `safetensors`, 161 shards, 755,617,140,416 bytes (~703.7 GiB)
Layers	79 — first 3 dense, 75 MoE, + 1 multi-token-prediction (MTP) head
Experts	256 routed (top-8 active per token) + 1 shared
Hidden size	6,144 · MoE FFN 2,048 · dense FFN 12,288
Attention	64 heads · MLA (`kv_lora_rank` 512, `q_lora_rank` 2048) · DSA indexer (32 heads, `index_topk` 2048)
Vocabulary	154,880
Context	1,048,576 positions (1M)
Languages	English, Chinese

Tokenizer, config.json, generation_config.json and the GLM chat_template.jinja — including <think>, <|observation|> and reasoning-effort control tokens — ship with the weights, so a serving stack that honours the packaged template will not silently fall back to a generic one.

What "de-risked" means here

Blackfrost derived the master directly from zai-org/GLM-5.2 using its own MoE-aware refusal-direction ablation, executed in BF16 on an 8×B200 node. This repository is the FP8 quantization of that master.

The de-risking is not a system prompt, not a LoRA, not a decoding-time filter — nothing that a deployment can accidentally undo or that an integrator has to remember to configure. The behaviour is in the weights, and quantization does not retrain them.

Capability was preserved: this is a refusal-behaviour change carried through a precision change, not a capability-degrading fine-tune.

Quantized from source, not from a quantized file

This is the distinction that matters for FP8.

The de-risking was performed at full BF16 precision on weights taken directly from zai-org/GLM-5.2, and the result was then quantized to FP8. The model was modified while it was still full-precision, and only afterwards reduced.

That is the opposite order from an abliteration applied on top of an already-quantized FP8 file, where the modification has to fight rounding error that is already baked in. Same target format; cleaner lineage.

The output matches the upstream vendor's own FP8 layout tensor-for-tensor: native quant_method: fp8, fmt: e4m3, weight_block_size: [128, 128], paired weight_scale_inv scales — a drop-in for stacks that already load zai-org/GLM-5.2-FP8.

Lineage


Base	`Blackfrost-Research/GLM-5.2-DERISKED-BF16` — Blackfrost's de-risked master, itself derived from official `zai-org/GLM-5.2`
Applied	Block-wise FP8 (e4m3, 128×128) quantization of the de-risked master
Not applied	SFT · DPO · RLHF · expert pruning · re-ablation on the quantized file
Format	HF safetensors · FP8 block-e4m3, native vendor layout

zai-org/GLM-5.2
  └─ GLM-5.2-DERISKED-BF16                          the de-risked master
       ├─ GLM-5.2-DERISKED-FP8                       ← this repo · ~703.7 GiB · single-node
       ├─ GLM-5.2-DERISKED-NVFP4                     ~451 GB, single-node
       └─ GLM-5.2-DERISKED-REAP-NU176-NVFP4          ~323 GB, non-uniform prune

On refusal behaviour: deliberately reduced at the weight level. Do not evaluate or rate-limit this as if it were a safety-stock derivative of upstream GLM-5.2.

Refusal behaviour

The de-risking is a weight-level property of the master and is carried into FP8 unchanged — quantization reduces numerical precision, it does not retrain refusal directions back in. The published harness figures for this line were measured on the NVFP4 sibling (GLM-5.2-DERISKED-NVFP4) against a 450-prompt set — AdvBench 150 + StrongREJECT 150 + XSTest 150, temperature 0, thinking off:

Dataset	n	Refused	Refusal rate
AdvBench	150	25	16.7%
StrongREJECT	150	12	8.0%
XSTest	150	6	4.0%
Harmful subset (AdvBench + StrongREJECT)	300	37	12.3%

Method, stated plainly: those rates were scored by substring pre-filter, which both over- and under-counts, and were measured on the NVFP4 sibling, not on this FP8 build. A controlled FP8-vs-master refusal comparison for this specific quantization is validated internally per release and the per-prompt JSONL is available to licensees under NDA. We report what was measured and where — not a number this file did not produce.

We publish the caveats because the firms we build for would find them anyway.

This is not an abliteration-on-quantized re-host

A separate FP8 abliteration of GLM-5.2 exists publicly (Bahushruth/GLM-5.2-FP8-abliterated). It is a different artifact. It was produced by abliterating on top of the already-quantized zai-org/GLM-5.2-FP8.

	Abliteration-on-quantized re-host	This repository
Order of operations	quantize → then abliterate	de-risk in BF16 → then quantize
Base	`zai-org/GLM-5.2-FP8` (already reduced)	`zai-org/GLM-5.2` full precision, via our master
Blackfrost intervention	none	full — our method, our run
MTP head	—	included, format-matched to vendor FP8
Access	open	manually gated, commercial
Support	none	licensed, with engineering contact

Deployment notes

Hardware. ~703.7 GiB of weights fits on a single 8×B200 or 8×H200-class node (tensor-parallel 8), with headroom for a large KV cache. This is the single-node member of the de-risked line.
Block-FP8 is auto-detected. The packaged config.json carries the native quant_method: fp8 block configuration; load it as-is and let the serving stack detect block-FP8 from the config. Do not force an online/dynamic FP8 path — that would re-quantize the weights at load and discard this build.
Multi-token prediction. Unlike the BF16 master, this build includes the layer-78 MTP head, present in model.safetensors.index.json and format-matched to the vendor's FP8 layout. Speculative decoding is supported.
KV cache. fp8_e4m3 KV is the tested configuration on Blackwell-class hardware.
Integrity. The index declares total_size 755,617,140,416 across 161 shards. Verify byte counts after download before you attribute a load failure to the weights.

Access & licensing

Access is granted automatically on purchase — you do not wait on a manual review.

➜ Purchase access to this model — enter your Hugging Face username at checkout, and your account is granted access to this repository within moments of payment.

Commercial licensing, air-gapped deployment, custom de-risking against your own threat model, pruned or quantized variants sized to your hardware, and evaluation support are all available. If you need something that is not on this page, it probably already exists internally — ask.

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Ask about this model, the BF16 master and pruned variants,
custom de-risked builds, or an enterprise evaluation licence.

Blackfrost · Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety

Other builds

Blackfrost publishes the GLM-5.2 de-risked line in several shapes. Access to full-precision and custom builds is granted on purchase under a separate licence agreement — those repositories are gated, and approval follows a completed agreement. The gate is the transaction.

Build	What it is
`GLM-5.2-DERISKED-BF16`	Full-precision BF16 master — every other build in this line derives from it
`GLM-5.2-DERISKED-FP8`	This build — block-FP8, single-node serving, includes the MTP head
`GLM-5.2-DERISKED-NVFP4`	4-bit NVFP4, single-node serving on sm_120-class hardware
`GLM-5.2-DERISKED-REAP-NU176-NVFP4`	Non-uniform REAP prune on top of NVFP4 — smallest footprint in the line
Custom	Expert budgets, non-uniform keep sets, or de-risking calibrated against your own threat model

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Refusal rates, capability figures and latency reflect specific harnesses under stated conditions, with the caveats given above. They are not safety proofs and do not generalise to multimodal, tool-use, long-context or multi-turn adversarial settings beyond those tested.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility for that artifact transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review.

Responsible use

Access is granted for authorised security work: red-team engagements you are contracted to perform, AI-safety and alignment research, guardrail and detection development, and model evaluation.

Floor behaviour was evaluated separately from the 450-prompt de-risking harness; per-prompt floor results are available to licensees under NDA.

Everything else

Outside that floor, this checkpoint should be assumed capable of producing content a consumer model would decline. That is the point of the build. The remaining acceptable-use terms — no unauthorised operations against systems or people you have no permission to test — are licence obligations, not model behaviour. Deploy behind your own controls, logging, and access review, and treat outputs as untrusted.

Downloads last month: 1

Safetensors

Model size

753B params

Tensor type

F32

BF16

F8_E4M3

Model tree for Blackfrost-Research/GLM-5.2-DERISKED-FP8

Base model

zai-org/GLM-5.2

Finetuned

Blackfrost-Research/GLM-5.2-DERISKED-BF16

Quantized

(1)

this model