Aikido Security Releases Altar-1: An Open-Weight Security Model Pruned From GLM-5.3 to 328 GB

Aikido Security released Altar-1, an open-weight security model pruned from Z.AI's 753B-parameter GLM-5.3 MoE down to 328.0 GB of stored weights, a 78.2% reduction from BF16 and 32.8% smaller than its AWQ INT4 parent. Aikido built Altar-1 by starting from the cyankiwi GLM-5.3-AWQ-INT4 checkpoint (W4A16) and applying Cerebras REAP expert pruning, keeping 168 of 256 routed experts per layer and removing 88 (34.4%) with no retraining. On Aikido's internal CVE benchmark of 32 known vulnerabilities across 30 repositories, Altar-1 averaged 60.4% recall per run and found 23 of 32 at least once, about 1 point below the AWQ checkpoint's 61.5% and 5.2 points below the BF16 parent's 65.6%.

Aikido Security has released Altar-1 https://huggingface.co/AikidoSec/altar-1 , its first open-weight security model https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security . It is a compressed version of Z.AI’s GLM-5.3 https://huggingface.co/zai-org/GLM-5.3 , built to run inside infrastructure the customer controls. Altar-1 powers Aikido Machine https://www.aikido.dev/attack/aikido-machine , the company’s autonomous pentesting appliance for on-prem and air-gapped networks. Is it deployable? Yes, the weights are public on Hugging Face and run with vLLM on a single node of 4x NVIDIA H200 GPUs. The Problem: Security Context Cannot Leave the Network Closed frontier models run on someone else’s infrastructure. Using them sends source code, architecture docs, and unremediated findings outside the network. Aikido points to banks under data-residency mandates and OT operators with no internet route. Open-weight models solve the residency problem but create a deployment gap. Mixture-of-experts MoE models must store every expert, even when a workload uses only a few of them. Security agents also build long-running context. That KV cache competes with model weights for the same GPU memory. How Altar-1 Was Built GLM-5.3 is a 753B parameter MoE model. Each token routes to 8 of 256 experts per layer, which is about 40B active parameters. Aikido applied 2 compression steps : - Step 1-Quantization : Altar-1 starts from the cyankiwi GLM-5.3-AWQ-INT4 https://huggingface.co/cyankiwi/GLM-5.3-AWQ-INT4 checkpoint. AWQ https://arxiv.org/abs/2306.00978 stores routed expert weights in 4 bits, with 16-bit activations W4A16 . Attention, the shared expert, dense layers, and the head stay in BF16. - Step 2- Expert pruning : Aikido used Cerebras REAP https://arxiv.org/abs/2510.13999 Router-weighted Expert Activation Pruning . REAP scores each expert by router weight and output magnitude, not just by how often it is selected. Altar-1 keeps 168 of 256 routed experts per layer and removes 88 34.4% . No retraining is involved. Calibration used traces from Aikido’s pentesting harness, plus coding, tool calling, reasoning, and multilingual Wikipedia text. Aikido states no customer data was used. Each expert is scored by its largest share of any single domain’s routed work. That protects the specialist experts for code, rare languages, and structured output. Routing is unchanged. The router still picks 8 experts per token, now from 168, with about 40B active parameters. | Checkpoint | Stored weights | |---|---| | GLM-5.3, BF16 | 1,506.7 GB | | GLM-5.3, AWQ INT4 | 488.2 GB | | Altar-1, pruned W4A16 | 328.0 GB | Altar-1 is 78.2% smaller than BF16 and 32.8% smaller than the AWQ parent. On fidelity, Altar-1 has a KL divergence of 0.506 nats against full BF16 on a sealed 25-prompt panel. An EXL3 build of the same cut scores 0.511. The details are in the public fidelity study https://huggingface.co/datasets/0xSero/glm-5.3-reap-fidelity-study . Benchmark Results Aikido team tested Altar-1 on its internal CVE benchmark https://www.aikido.dev/blog/ai-model-benchmarks-aug-21-2026 . The benchmark covers 32 known vulnerabilities across 30 repositories, with 3 runs per case. | Model | Avg recall per run | Found at least once | |---|---|---| | GLM-5.3, BF16 | 65.6% | 25 of 32 | | GLM-5.3, AWQ INT4 | 61.5% | 23 of 32 | | Altar-1 | 60.4% | 23 of 32 | Compared with the AWQ checkpoint, pruning cost about 1 point of recall and no coverage. Compared with the parent, Altar-1 keeps 23 of 25 covered vulnerabilities 92% at 5.2 points lower recall. The benchmark’s scope is narrow. It measures targeted CVE rediscovery inside a pipeline that uses other models for the surrounding stages. It does not measure blind discovery, exploit validation, or fix proposals. Aikido also reports that Altar-1 found a valid critical-severity vulnerability during a client’s production pentest. That is a single result reported by the vendor. Deployment and License The model card requires Hopper GPUs H100 or H200 . Aikido says 328 GB across 4x H200 leaves room for a 128k-context KV cache at production batch sizes. vllm serve AikidoSec/altar-1 --tensor-parallel-size 4 --trust-remote-code --max-model-len 131072 vLLM selects the Marlin MoE kernel automatically. A 4x H100 80 GB node has only 320 GB of memory, which is less than the 328 GB of weights. Altar-1 inherits the GLM-5.3 License https://huggingface.co/zai-org/GLM-5.3/raw/main/LICENSE . The license permits commercial use, modification, and redistribution. Model-as-a-Service operators with more than $10B in revenue over 12 months must first pass a Z.AI security review. Altar-1 is open-weight, not OSI-approved open source. Altar-1 also powers Aikido Attack https://www.aikido.dev/platform/attack , AI Code Analysis https://www.aikido.dev/code/code-audit , and Deep Review https://help.aikido.dev/deep-review/how-deep-review-works . Next, Aikido plans to try lower-bit formats like EXL3 https://github.com/turboderp-org/exllamav3 so it can keep more experts. It also plans to fine-tune models for security workflows. Key Takeaways - Altar-1 compresses GLM-5.3 from 1,506.7 GB to 328 GB, a 78.2% cut. - REAP pruning keeps 168 of 256 experts per layer, with 8 active per token. - Recall drops from 65.6% to 60.4%, keeping 92% of the parent’s CVE coverage. - It runs on 1 node of 4x H200 with vLLM, including air-gapped setups. - The GLM-5.3 License allows commercial use, with a review clause above $10B revenue. Check out the Model Weights https://huggingface.co/AikidoSec/altar-1 and Technical Details https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security . All credit goes to the researcher of this project. Also, feel free to follow us on Twitter https://x.com/intent/follow?screen name=marktechpost and don’t forget to join our 150k+ML SubReddit https://www.reddit.com/r/machinelearningnews/ and Subscribe to our Newsletter https://magic.beehiiv.com/v1/f5e63dd4-5653-4f09-83e2-321a8b1ba526?email={{email}} . Wait are you on telegram? now you can join us on telegram as well. https://t.me/machinelearningresearchnews Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us https://forms.gle/MJjjVDPS7whH8Ngs6 Asif Razzaq is the CEO of Marktechpost AI Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.