Instructions to use BlackfrostAI/BLACKFROST-753B-BF16 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use BlackfrostAI/BLACKFROST-753B-BF16 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="BlackfrostAI/BLACKFROST-753B-BF16")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("BlackfrostAI/BLACKFROST-753B-BF16")
model = AutoModelForCausalLM.from_pretrained("BlackfrostAI/BLACKFROST-753B-BF16", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use BlackfrostAI/BLACKFROST-753B-BF16 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "BlackfrostAI/BLACKFROST-753B-BF16"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "BlackfrostAI/BLACKFROST-753B-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/BlackfrostAI/BLACKFROST-753B-BF16

SGLang

How to use BlackfrostAI/BLACKFROST-753B-BF16 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "BlackfrostAI/BLACKFROST-753B-BF16" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "BlackfrostAI/BLACKFROST-753B-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "BlackfrostAI/BLACKFROST-753B-BF16" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "BlackfrostAI/BLACKFROST-753B-BF16",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use BlackfrostAI/BLACKFROST-753B-BF16 with Docker Model Runner:
```
docker model run hf.co/BlackfrostAI/BLACKFROST-753B-BF16
```

Request commercial access

BLACKFROST-753B-BF16 is released under a Blackfrost commercial licence and is reviewed manually. Access is granted to security firms, red teams, AI-safety labs, and enterprise research groups. Tell us who you are and what you are evaluating; we review every request individually.

BLACKFROST-753B — BF16

Enterprise de-risked GLM-5.2 · 753B Mixture-of-Experts · full precision

Built by Blackfrost · Las Vegas, NV

Manually gated · Commercial licence · Not a community re-upload

Why this model exists

Security teams cannot evaluate a defence against a model that refuses to produce the attack.

Standard frontier models are trained to decline adversarial prompts. That behaviour is correct for consumer products and actively harmful for the people who have to test things — red teams whose payload generator stops mid-engagement, detection engineers with no true positives to tune against, safety labs that cannot measure a guardrail they cannot stress.

BLACKFROST-753B is Blackfrost's in-house de-risked build of GLM-5.2: a 753B-parameter Mixture-of-Experts model whose refusal behaviour has been removed at the weight level, so it answers the adversarial prompt instead of declining it. This repository holds the BF16 master — the full-precision checkpoint every other model in the Blackfrost 753B line is derived from.

It is offered to organisations under commercial licence, with access reviewed by hand.

Specifications


Architecture	`GlmMoeDsaForCausalLM` — GLM MoE with Multi-head Latent Attention (MLA) + DeepSeek-style Sparse Attention (DSA)
Parameters	~753B total, Mixture-of-Experts
Precision	BF16 — `safetensors`, 158 shards, 1,486,754,078,208 bytes (~1.35 TiB)
Layers	78 — first 3 dense, remaining 75 MoE
Experts	256 routed (top-8 active per token) + 1 shared
Hidden size	6,144 · MoE FFN 2,048 · dense FFN 12,288
Attention	64 heads · MLA (`kv_lora_rank` 512, `q_lora_rank` 2048) · DSA indexer (32 heads, `index_topk` 2048)
Vocabulary	154,880
Context	1,048,576 positions (1M)
Languages	English, Chinese

Tokenizer, config.json, generation_config.json and the GLM chat_template.jinja — including <think>, <|observation|> and reasoning-effort control tokens — ship with the weights, so a serving stack that honours the packaged template will not silently fall back to a generic one.

What "de-risked" means here

Blackfrost derived this checkpoint directly from zai-org/GLM-5.2 using its own MoE-aware refusal-direction ablation (ablit_glm52.py, single pass, residual-stream intervention at scale 2.0), executed in BF16 on an 8×B200 node.

The intervention targets the residual stream. It is not a system prompt, not a LoRA, not a decoding-time filter — nothing that a deployment can accidentally undo or that an integrator has to remember to configure. The behaviour is in the weights.

Capability was preserved: this is a refusal-behaviour change, not a capability-degrading fine-tune.

Measured behaviour

Blackfrost evaluated the NVFP4 quantization of this exact checkpoint (BLACKFROST-753B-NVFP4) against a 450-prompt harness — AdvBench 150 + StrongREJECT 150 + XSTest 150 — at temperature 0, thinking off, 512 max tokens.

Dataset	n	Refused	Refusal rate
AdvBench	150	25	16.7%
StrongREJECT	150	12	8.0%
XSTest	150	6	4.0%
Harmful subset (AdvBench + StrongREJECT)	300	37	12.3%

Over-refusal on XSTest safe prompts: 1.3% (1/75) — the model stays useful on benign requests rather than becoming indiscriminately compliant.

Method, stated plainly: refusal was scored by substring pre-filter, which both over- and under-counts; per-prompt responses were not manually adjudicated in that run. Treat the figures as the substring rate, not a hand-verified ground truth. The measurement was taken on the NVFP4 child rather than on this BF16 parent — a controlled BF16-vs-NVFP4 comparison has not yet been run. Full per-prompt JSONL is available to licensees under NDA.

We publish the caveats because the firms we build for would find them anyway.

This is not the community build

There is a separate, freely available GLM-5.2-ABLITERATED-NVFP4 on the Blackfrost user account. It is a different artifact. If you already downloaded that one, you do not have this one.

	Our Community re-upload	This repository
Lineage	third-party abliteration, re-hosted	Blackfrost in-house de-risking
Base	`huihui-ai/Huihui-GLM-5.2-abliterated`	`zai-org/GLM-5.2` directly
Blackfrost intervention	none	full — our method, our run
Shards	337	158
Benchmarked by Blackfrost	no	yes (450-prompt harness)
Access	open	manually gated, commercial
Support	none	licensed, with engineering contact

Deployment notes

Hardware. BF16 at this scale needs roughly 1.5 TB of aggregate accelerator memory — an 8×B200 or 8×H200 class node, or multi-node. For single-node serving, ask us about the NVFP4 build.
Multi-token prediction. config.json declares num_nextn_predict_layers: 1, but this checkpoint contains body layers 0–77 only — the layer-78 MTP head is not included and is not referenced by model.safetensors.index.json. Serve without speculative decoding. Trained MTP heads are available to licensees.
Context. 1M positions is the architectural ceiling. Real usable context is bounded by your KV budget; plan capacity accordingly.
Integrity. The index declares total_size 1,486,754,078,208 across 158 shards. Verify byte counts after download before you attribute a load failure to the weights.

Access & licensing

This repository is public but manually gated. Requests are reviewed by a person, and we approve organisations rather than accounts.

A good request tells us: who you are, the organisation, what you are evaluating, and where it will run. Requests with a work email and a stated use case are approved fastest.

Commercial licensing, air-gapped deployment, custom de-risking against your own threat model, pruned or quantized variants sized to your hardware, and evaluation support are all available. If you need something that is not on this page, it probably already exists internally — ask.

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Ask about this model, the NVFP4 and pruned variants,
custom de-risked builds, or an enterprise evaluation licence.

Blackfrost · Las Vegas, Nevada
Frontier model engineering for offensive security and AI safety

Responsible use

Access is granted for authorised security work: red-team engagements you are contracted to perform, AI-safety and alignment research, guardrail and detection development, and model evaluation.

Preserved refusal floor

The de-risking intervention is deliberately broad, but it is not unbounded. Refusal behaviour on child sexual content and self-harm facilitation was held out of the ablation and subsequently reinforced by targeted QLoRA fine-tune. This is a weight-level behaviour property of the checkpoint, not a configuration step and not a licence term — it is present whether or not a deployment does anything to enable it.

Floor behaviour was evaluated separately from the 450-prompt de-risking harness; see Floor evaluation. Per-prompt results are available to licensees under NDA.

Everything else

Outside that floor, this checkpoint should be assumed capable of producing content a consumer model would decline. That is the point of the build. The remaining acceptable-use terms — no unauthorised operations against systems or people you have no permission to test — are licence obligations, not model behaviour. Deploy behind your own controls, logging, and access review, and treat outputs as untrusted.

Downloads last month: -

Safetensors

Model size

743B params

Tensor type

F32

BF16

Model tree for BlackfrostAI/BLACKFROST-753B-BF16

Base model

zai-org/GLM-5.2

Finetuned

(24)

this model